diff --git a/.dockerignore b/.dockerignore
index 98f84c0e..88486895 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -32,6 +32,8 @@ betterdesk-server/_test_*
 # Archive (old/deprecated files)
 archive/
 
+
+
 # Documentation (not needed in image)
 docs/
 screenshots/
diff --git a/.github/SECURITY_AUDIT_2026-03-01.md b/.github/SECURITY_AUDIT_2026-03-01.md
deleted file mode 100644
index 77c5dd1f..00000000
--- a/.github/SECURITY_AUDIT_2026-03-01.md
+++ /dev/null
@@ -1,676 +0,0 @@
-# BetterDesk Security Audit Report
-
-**Date:** 2026-03-01  
-**Auditor:** GitHub Copilot (Claude Opus 4.5)  
-**Scope:** `betterdesk-server/` (Go), `web-nodejs/` (Node.js)
-
----
-
-## Executive Summary
-
-This audit identified **24 security findings** across the BetterDesk project:
-- **Critical:** 2 ✅ FIXED
-- **High:** 5 ✅ FIXED
-- **Medium:** 10 ✅ 6 FIXED, 4 LOW RISK (accepted)
-- **Low:** 7 (tracked for future work)
-
-Many security best practices are already in place (CSRF protection, session fixation prevention, timing-safe auth, rate limiting, SQL parameterization). The findings below represent remaining gaps or areas for improvement.
-
----
-
-## Remediation Status (2026-03-01)
-
-| ID | Severity | Description | Status |
-|----|----------|-------------|--------|
-| C-1 | Critical | Command Injection in pingHost() | ✅ Fixed: spawn() with args array + host validation |
-| C-2 | Critical | Password Logging in main.go | ✅ Fixed: Write to secure file with 0600 perms |
-| H-1 | High | SQL LIKE Injection | ✅ Fixed: escapeLikePattern() + ESCAPE clause |
-| H-2 | High | Error Leakage in Go API | ✅ Fixed: writeInternalError() helper |
-| H-3 | High | Error Leakage in Token Handlers | ✅ Fixed: Generic error messages + logging |
-| H-4 | High | Path Traversal in i18n | ✅ Fixed: isValidLangCode() validation |
-| H-5 | High | MD5 for Hash | ✅ Fixed: SHA256 |
-| M-1 | Medium | XSS via innerHTML | ✅ Fixed: Utils.escapeHtml() + SVG sanitization |
-| M-2 | Medium | parseInt NaN validation | ✅ Fixed: isNaN() checks added |
-| M-3 | Medium | Weak Random in generateId | ✅ Fixed: crypto.randomUUID() |
-| M-4 | Medium | Cookie httpOnly: false | ✅ Documented: Intentional for client-side i18n |
-| M-5 | Medium | Trust Proxy Default | ✅ Fixed: Default changed to false |
-| M-6 | Medium | Missing Content-Type Check | ✅ Fixed: requireJsonContentType middleware |
-
----
-
-## Critical Findings
-
-### C-1: Command Injection in Network Monitor (CRITICAL)
-
-**File:** [web-nodejs/services/networkMonitor.js](../web-nodejs/services/networkMonitor.js#L60-L64)  
-**Severity:** Critical  
-**Description:** The `pingHost` function passes user-controllable `host` parameter directly to shell command without sanitization.
-
-**Code:**
-```javascript
-// Line 60-62
-const cmd = isWin
-    ? `ping -n 1 -w ${timeoutMs} ${host}`
-    : `ping -c 1 -W ${timeoutSec} ${host}`;
-
-const start = Date.now();
-exec(cmd, { timeout: timeoutMs + 2000 }, (err, stdout) => {
-```
-
-**Impact:** An attacker who can control the `host` parameter can execute arbitrary system commands (e.g., `; rm -rf /` or `& calc.exe`).
-
-**Recommended Fix:**
-```javascript
-// Validate hostname/IP format before use
-const validHostRegex = /^[a-zA-Z0-9][a-zA-Z0-9.-]{0,253}[a-zA-Z0-9]$/;
-if (!validHostRegex.test(host) && !net.isIP(host)) {
-    return resolve({ success: false, rtt_ms: null, error: 'Invalid host format' });
-}
-// Use spawn() with array arguments instead of exec()
-const { spawn } = require('child_process');
-const args = isWin ? ['-n', '1', '-w', String(timeoutMs), host] : ['-c', '1', '-W', String(timeoutSec), host];
-const proc = spawn('ping', args);
-```
-
----
-
-### C-2: Initial Admin Password Logged to Console (CRITICAL)
-
-**File:** [betterdesk-server/main.go](../betterdesk-server/main.go#L165)  
-**Severity:** Critical  
-**Description:** When a random admin password is generated, it is printed to logs in plaintext.
-
-**Code:**
-```go
-// Line 163-165
-if cfg.InitAdminPass == "" {
-    log.Printf("  Password: %s", adminPass)
-} else {
-```
-
-**Impact:** The password may be visible in:
-- Docker logs (`docker logs`)
-- systemd journal (`journalctl`)
-- Log files if stdout is redirected
-- CI/CD build logs
-
-**Recommended Fix:**
-```go
-// Write password to a secure file with restricted permissions instead
-if cfg.InitAdminPass == "" {
-    passFile := filepath.Join(cfg.DataDir, ".init_password")
-    os.WriteFile(passFile, []byte(adminPass), 0600)
-    log.Printf("  Password written to: %s (delete after reading)", passFile)
-    log.Printf("  (password not shown in logs for security)")
-} else {
-    log.Printf("  Password: *** (user-provided, not logged)")
-}
-```
-
----
-
-## High Findings
-
-### H-1: SQL LIKE Pattern Injection in dbAdapter.js (HIGH)
-
-**File:** [web-nodejs/services/dbAdapter.js](../web-nodejs/services/dbAdapter.js#L629)  
-**Severity:** High  
-**Description:** The `getAllPeers` function in the new dbAdapter does NOT escape `%` and `_` wildcards in the search parameter, unlike `database.js` which does.
-
-**Code:**
-```javascript
-// Line 629 - dbAdapter.js (NO escape)
-if (filters.search) { where += ' AND (id LIKE ? OR note LIKE ? OR "user" LIKE ?)'; const s = `%${filters.search}%`; params.push(s, s, s); }
-
-// Compare with database.js (CORRECT - with escape)
-// Line 435 - database.js
-const escaped = escapeLikePattern(filters.search);
-sql += " AND (id LIKE ? ESCAPE '\\' OR user LIKE ? ESCAPE '\\' OR note LIKE ? ESCAPE '\\')";
-```
-
-**Impact:** User can inject `%` or `_` wildcards to match arbitrary patterns (information disclosure through pattern matching).
-
-**Recommended Fix:**
-```javascript
-if (filters.search) {
-    const escaped = filters.search.replace(/[%_\\]/g, '\\$&');
-    where += " AND (id LIKE ? ESCAPE '\\' OR note LIKE ? ESCAPE '\\' OR \"user\" LIKE ? ESCAPE '\\')";
-    const s = `%${escaped}%`;
-    params.push(s, s, s);
-}
-```
-
-Also apply to lines: 903, 1510, 2096, 2297, 2889.
-
----
-
-### H-2: Error Message Information Leakage in Go API (HIGH)
-
-**File:** [betterdesk-server/api/server.go](../betterdesk-server/api/server.go#L327)  
-**Severity:** High  
-**Description:** Internal error messages are exposed to API clients via `err.Error()`.
-
-**Code:**
-```go
-// Multiple locations including line 327, 359, 380, 403, 423, 494, 519, 559, 721, 738
-writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
-```
-
-**Impact:** Internal implementation details, database errors, file paths, and system information may leak to attackers.
-
-**Recommended Fix:**
-```go
-func handleDbError(w http.ResponseWriter, err error, action string) {
-    // Log full error internally
-    log.Printf("[api] %s error: %v", action, err)
-    // Return generic message to client
-    writeJSON(w, http.StatusInternalServerError, map[string]string{
-        "error": "Internal server error",
-    })
-}
-```
-
----
-
-### H-3: Error Leakage in token_handlers.go (HIGH)
-
-**File:** [betterdesk-server/api/token_handlers.go](../betterdesk-server/api/token_handlers.go#L87)  
-**Severity:** High  
-**Description:** Database and system errors are directly exposed via `http.Error(w, err.Error(), ...)`.
-
-**Code:**
-```go
-// Lines 87, 150, 175, 199, 229, 249, 258, 343, 391, 409, 465
-http.Error(w, err.Error(), http.StatusInternalServerError)
-```
-
-**Impact:** Same as H-2 - information leakage.
-
-**Recommended Fix:** Same pattern as H-2.
-
----
-
-### H-4: Path Traversal Risk in i18n Language Upload (HIGH)
-
-**File:** [web-nodejs/routes/i18n.routes.js](../web-nodejs/routes/i18n.routes.js#L134-L145)  
-**Severity:** High  
-**Description:** Language code derived from uploaded filename or body is used in file path without full validation.
-
-**Code:**
-```javascript
-// Line 137-146
-const meta = translations._meta;
-const code = meta?.code || req.body.code || req.file.originalname.replace('.json', '');
-
-if (!code || code.length < 2 || code.length > 5) {
-    return res.status(400).json({
-        success: false,
-        error: 'Invalid language code'
-    });
-}
-
-const result = manager.saveLanguage(code, translations);
-```
-
-**Impact:** An attacker could potentially submit `../../../etc/passwd` as code (though length check provides some protection). The `saveLanguage` function uses `path.join(config.langDir, ${code}.json)` which may still be vulnerable.
-
-**Recommended Fix:**
-```javascript
-// Strict validation: only allow alphanumeric + dash, 2-5 chars
-if (!/^[a-z]{2}(-[A-Z]{2})?$/.test(code)) {
-    return res.status(400).json({
-        success: false,
-        error: 'Invalid language code format (use: xx or xx-XX)'
-    });
-}
-// Also validate in saveLanguage():
-const safeName = path.basename(code); // Extra protection
-const filePath = path.join(config.langDir, `${safeName}.json`);
-```
-
----
-
-### H-5: MD5 Used for Sysinfo Hash (HIGH)
-
-**File:** [web-nodejs/routes/rustdesk-api.routes.js](../web-nodejs/routes/rustdesk-api.routes.js#L323)  
-**Severity:** High  
-**Description:** MD5 is used for creating content hashes, which is cryptographically weak.
-
-**Code:**
-```javascript
-// Line 323
-const hash = require('crypto').createHash('md5')
-    .update(JSON.stringify(sysinfo.raw_json))
-    .digest('hex')
-    .substring(0, 16);
-```
-
-**Impact:** While used only for cache invalidation (not security), MD5 is deprecated and could lead to collisions. Using a deprecated algorithm in security-critical software sets a bad precedent.
-
-**Recommended Fix:**
-```javascript
-const hash = require('crypto').createHash('sha256')
-    .update(JSON.stringify(sysinfo.raw_json))
-    .digest('hex')
-    .substring(0, 32);
-```
-
----
-
-## Medium Findings
-
-### M-1: XSS Risk via innerHTML in Frontend JS (MEDIUM)
-
-**File:** [web-nodejs/public/js/users.js](../web-nodejs/public/js/users.js#L65)  
-**Severity:** Medium  
-**Description:** User data is rendered via template literals and innerHTML without consistent escaping.
-
-**Code:**
-```javascript
-// Line 65 - users.js
-tableBody.innerHTML = users.map(user => `
-    <tr data-id="${user.id}">
-        <td>${user.username}</td>
-        ...
-```
-
-**Impact:** If `user.username` contains `<script>`, it could execute in the admin's browser.
-
-**Context:** The app uses `Utils.escapeHtml()` in some places but not consistently.
-
-**Recommended Fix:**
-```javascript
-tableBody.innerHTML = users.map(user => `
-    <tr data-id="${Utils.escapeHtml(user.id)}">
-        <td>${Utils.escapeHtml(user.username)}</td>
-        ...
-```
-
-Also affected files/lines:
-- [settings.js](../web-nodejs/public/js/settings.js#L148-L158)
-
----
-
-### M-2: Missing NaN Validation for parseInt (MEDIUM)
-
-**File:** [web-nodejs/routes/users.routes.js](../web-nodejs/routes/users.routes.js#L132)  
-**Severity:** Medium  
-**Description:** `parseInt` results are not checked for `NaN`, which can cause unexpected behavior.
-
-**Code:**
-```javascript
-// Line 132
-const userId = parseInt(req.params.id, 10);
-```
-
-**Impact:** If `req.params.id` is "abc", `userId` becomes `NaN`, which may bypass ID-based access controls or cause errors.
-
-**Recommended Fix:**
-```javascript
-const userId = parseInt(req.params.id, 10);
-if (isNaN(userId) || userId <= 0) {
-    return res.status(400).json({ success: false, error: 'Invalid user ID' });
-}
-```
-
-Also check: tickets.routes.js, tenants.routes.js, settings.routes.js
-
----
-
-### M-3: Weak Random in Frontend generateId (MEDIUM)
-
-**File:** [web-nodejs/public/js/utils.js](../web-nodejs/public/js/utils.js#L128)  
-**Severity:** Medium  
-**Description:** Uses `Math.random()` for ID generation, which is not cryptographically secure.
-
-**Code:**
-```javascript
-// Line 128
-generateId() {
-    return 'id-' + Math.random().toString(36).substr(2, 9);
-}
-```
-
-**Impact:** For DOM element IDs this is acceptable, but if used for security tokens it would be vulnerable.
-
-**Recommended Fix:**
-```javascript
-generateId() {
-    if (window.crypto && window.crypto.randomUUID) {
-        return 'id-' + crypto.randomUUID().split('-')[0];
-    }
-    return 'id-' + Date.now().toString(36) + Math.random().toString(36).substr(2, 5);
-}
-```
-
----
-
-### M-4: Cookie httpOnly: false for Language Cookie (MEDIUM)
-
-**File:** [web-nodejs/routes/i18n.routes.js](../web-nodejs/routes/i18n.routes.js#L90)  
-**Severity:** Medium  
-**Description:** Language preference cookie is set with `httpOnly: false`.
-
-**Code:**
-```javascript
-// Line 86-92
-res.cookie('betterdesk_lang', code, {
-    maxAge: 365 * 24 * 60 * 60 * 1000, // 1 year
-    httpOnly: false,
-    sameSite: 'lax'
-});
-```
-
-**Impact:** While language preference is not sensitive, this sets a precedent. JavaScript access to this cookie is intentional (for i18n JS), but if misunderstood could lead to similar patterns for sensitive cookies.
-
-**Recommended Fix:** Add comment explaining why httpOnly is false:
-```javascript
-res.cookie('betterdesk_lang', code, {
-    maxAge: 365 * 24 * 60 * 60 * 1000,
-    httpOnly: false, // Intentionally accessible to JS for client-side i18n
-    sameSite: 'lax',
-    secure: config.httpsEnabled // Add secure flag
-});
-```
-
----
-
-### M-5: Trust Proxy Default Value (MEDIUM)
-
-**File:** [web-nodejs/server.js](../web-nodejs/server.js#L40-L42)  
-**Severity:** Medium  
-**Description:** Default trust proxy is `1`, which trusts one level of proxy. If deployed without a proxy, this could allow IP spoofing.
-
-**Code:**
-```javascript
-// Line 40-42
-const trustProxy = process.env.TRUST_PROXY !== undefined ? 
-    (isNaN(process.env.TRUST_PROXY) ? process.env.TRUST_PROXY : parseInt(process.env.TRUST_PROXY, 10)) : 1;
-app.set('trust proxy', trustProxy);
-```
-
-**Impact:** When running directly (no reverse proxy), attackers can spoof `X-Forwarded-For` to bypass rate limiting.
-
-**Recommended Fix:**
-```javascript
-// Default to false (safest), require explicit configuration
-const trustProxy = process.env.TRUST_PROXY !== undefined ? 
-    (isNaN(process.env.TRUST_PROXY) ? process.env.TRUST_PROXY : parseInt(process.env.TRUST_PROXY, 10)) 
-    : false;  // Changed from 1 to false
-```
-
----
-
-### M-6: Missing Content-Type Validation in Some Routes (MEDIUM)
-
-**File:** [web-nodejs/routes/devices.routes.js](../web-nodejs/routes/devices.routes.js)  
-**Severity:** Medium  
-**Description:** POST/PATCH routes don't explicitly validate `Content-Type: application/json`.
-
-**Impact:** Could allow CSRF attacks via form submissions (though CSRF tokens provide protection).
-
-**Recommended Fix:** Add middleware:
-```javascript
-function requireJson(req, res, next) {
-    if (req.method !== 'GET' && !req.is('application/json')) {
-        return res.status(415).json({ error: 'Content-Type must be application/json' });
-    }
-    next();
-}
-```
-
----
-
-### M-7: No Rate Limit on Some Admin Endpoints (MEDIUM)
-
-**File:** [web-nodejs/routes/users.routes.js](../web-nodejs/routes/users.routes.js)  
-**Severity:** Medium  
-**Description:** PATCH and DELETE operations on users have no rate limiting beyond the global API limiter.
-
-**Impact:** An attacker with valid admin credentials could rapidly enumerate/modify users.
-
-**Recommended Fix:** Apply specific rate limiter to sensitive admin operations:
-```javascript
-const adminOpLimiter = rateLimit({
-    windowMs: 60 * 1000,
-    max: 10,
-    message: { success: false, error: 'Too many admin operations' }
-});
-
-router.patch('/api/users/:id', requireAuth, requireAdmin, adminOpLimiter, async (req, res) => { ...
-```
-
----
-
-### M-8: WebSocket Session Cookie Only Checks Presence (MEDIUM)
-
-**File:** [web-nodejs/services/wsRelay.js](../web-nodejs/services/wsRelay.js#L79-L85)  
-**Severity:** Medium  
-**Description:** WebSocket upgrade only checks if session cookie exists, not if it's valid.
-
-**Code:**
-```javascript
-// Line 79-85
-if (!cookies['betterdesk.sid']) {
-    console.warn(`WS proxy: Rejected upgrade to ${pathname} — no session cookie`);
-    socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
-    socket.destroy();
-    return;
-}
-```
-
-**Impact:** An attacker with an expired or invalid session cookie could potentially upgrade the WebSocket connection.
-
-**Recommended Fix:**
-```javascript
-// Parse and validate the session using express-session
-const sessionMiddleware = require('../middleware/session');
-sessionMiddleware(request, {}, (err) => {
-    if (err || !request.session?.userId) {
-        socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
-        socket.destroy();
-        return;
-    }
-    // Continue with upgrade
-});
-```
-
----
-
-### M-9: Stack Trace Potential in Error Handler (MEDIUM)
-
-**File:** [web-nodejs/server.js](../web-nodejs/server.js#L140)  
-**Severity:** Medium  
-**Description:** The error handler logs the full error object which may include stack traces.
-
-**Code:**
-```javascript
-// Line 140
-console.error('Server error:', err);
-```
-
-**Impact:** Not a direct vulnerability, but if error.stack includes sensitive paths they appear in logs.
-
-**Recommended Fix:** Already handled correctly for client-side, but ensure `err.stack` is never sent to clients.
-
----
-
-### M-10: PostgreSQL Configuration in Error Messages (MEDIUM)
-
-**File:** [betterdesk-server/db/postgres.go](../betterdesk-server/db/postgres.go#L157)  
-**Severity:** Medium  
-**Description:** SQL statements are included in error messages.
-
-**Code:**
-```go
-// Line 157
-return fmt.Errorf("db: PostgreSQL migration failed: %w\nStatement: %s", err, stmt)
-```
-
-**Impact:** Internal SQL schema visible in error responses if not properly handled by API layer.
-
-**Recommended Fix:** Log statement internally, return generic error:
-```go
-log.Printf("[db] Migration failed: %v\nStatement: %s", err, stmt)
-return fmt.Errorf("db: database migration failed")
-```
-
----
-
-## Low Findings
-
-### L-1: Hardcoded Default Admin Credentials (LOW)
-
-**File:** [web-nodejs/services/authService.js](../web-nodejs/services/authService.js#L76)  
-**Severity:** Low  
-**Description:** Default admin password is "admin".
-
-**Code:**
-```javascript
-const defaultPassword = process.env.DEFAULT_ADMIN_PASSWORD || 'admin';
-```
-
-**Impact:** Widely known default password could be tried by attackers.
-
-**Status:** Mitigated by console warnings and documented requirement to change.
-
----
-
-### L-2: Console.log with Password Context (LOW)
-
-**File:** [web-nodejs/routes/users.routes.js](../web-nodejs/routes/users.routes.js#L278)  
-**Severity:** Low  
-**Description:** Error logged with "Reset password error" context.
-
-**Code:**
-```javascript
-console.error('Reset password error:', err);
-```
-
-**Impact:** Minimal - no password in error, but context reveals operation type.
-
----
-
-### L-3: Missing CORS Origin Validation for WAN API (LOW)
-
-**File:** [web-nodejs/middleware/wanSecurity.js](../web-nodejs/middleware/wanSecurity.js#L169-L171)  
-**Severity:** Low  
-**Description:** CORS headers are set but `Access-Control-Allow-Origin` is not explicitly set to reject browser requests.
-
-**Impact:** Desktop RustDesk client doesn't need CORS, but browser-based attacks could be attempted.
-
-**Recommended Fix:** Add explicit rejection:
-```javascript
-res.setHeader('Access-Control-Allow-Origin', ''); // Explicitly empty = reject
-```
-
----
-
-### L-4: Go Module Version Mismatch Warning (LOW)
-
-**File:** [betterdesk-server/go.mod](../betterdesk-server/go.mod#L3)  
-**Severity:** Low  
-**Description:** Go version 1.25.0 specified, which is a future version (current stable is 1.22+).
-
-**Code:**
-```go
-go 1.25.0
-```
-
-**Impact:** May cause build issues on older Go versions.
-
----
-
-### L-5: Integer Overflow in Settings Limit (LOW)
-
-**File:** [web-nodejs/routes/settings.routes.js](../web-nodejs/routes/settings.routes.js#L102)  
-**Severity:** Low  
-**Description:** No upper bound on limit parameter.
-
-**Code:**
-```javascript
-const limit = parseInt(req.query.limit, 10) || 100;
-```
-
-**Recommended Fix:**
-```javascript
-const limit = Math.min(1000, Math.max(1, parseInt(req.query.limit, 10) || 100));
-```
-
----
-
-### L-6: Verbose Enrollment Logging (LOW)
-
-**File:** [betterdesk-server/signal/handler.go](../betterdesk-server/signal/handler.go#L1020)  
-**Severity:** Low  
-**Description:** Enrollment logs include token names which could be sensitive.
-
-**Code:**
-```go
-log.Printf("[signal] Enrollment: peer %s matched token %s (managed mode)", peerID, token.Name)
-```
-
-**Impact:** Token names visible in logs.
-
----
-
-### L-7: DeviceID Validation Inconsistency (LOW)
-
-**File:** Multiple  
-**Severity:** Low  
-**Description:** Device ID validation regex differs between Go server (`^[A-Za-z0-9_-]{6,16}$`) and Node.js console (`/^[A-Za-z0-9_-]+$/`).
-
-**Impact:** Could allow IDs accepted by one system but rejected by another.
-
-**Recommended Fix:** Unify regex across both systems.
-
----
-
-## Positive Security Controls Observed
-
-The following security best practices are already implemented:
-
-1. **CSRF Protection** - Double-submit cookie pattern with csrf-csrf library
-2. **Session Fixation Prevention** - `req.session.regenerate()` after login
-3. **Timing-Safe Authentication** - Pre-computed DUMMY_HASH for user enumeration prevention
-4. **Parameterized SQL Queries** - Using prepared statements throughout
-5. **PBKDF2 Password Hashing** - 100,000 iterations with SHA-256 (Go server)
-6. **bcrypt Password Hashing** - 12 salt rounds (Node.js console)
-7. **Rate Limiting** - express-rate-limit on API and login endpoints
-8. **Helmet Security Headers** - CSP, X-Frame-Options, X-Content-Type-Options
-9. **Session Security** - httpOnly, secure, sameSite cookie flags
-10. **Input Length Limits** - DoS prevention via bcrypt input limits
-11. **WAN API Path Whitelist** - Zero attack surface on dedicated port
-12. **TOTP 2FA Support** - Optional two-factor authentication
-13. **Audit Logging** - Security events logged with user/IP context
-14. **SQL LIKE Escape** - `escapeLikePattern()` in database.js (partially)
-
----
-
-## Recommendations Summary
-
-### Immediate (Critical/High)
-1. Fix command injection in networkMonitor.js
-2. Remove password logging in Go main.go
-3. Add LIKE pattern escaping to dbAdapter.js
-4. Replace err.Error() with generic messages in API responses
-5. Strengthen i18n language code validation
-6. Replace MD5 with SHA-256 for sysinfo hash
-
-### Short-Term (Medium)
-1. Add escapeHtml() consistently in frontend JS
-2. Validate parseInt results for NaN
-3. Change default trust proxy to false
-4. Add Content-Type validation middleware
-5. Rate limit admin operations
-6. Validate WebSocket session properly
-
-### Long-Term (Low)
-1. Unify device ID validation regex
-2. Add upper bounds to all limit parameters
-3. Review logging for sensitive data
-4. Document security configuration options
-
----
-
-*End of Report*
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index da66c12b..37052a22 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -5,7 +5,7 @@
 
 ---
 
-## 📊 Stan Projektu (aktualizacja: 2026-03-01)
+## 📊 Stan Projektu (aktualizacja: 2026-03-21)
 
 ### Wersja Skryptów ALL-IN-ONE (v2.4.0)
 
@@ -182,6 +182,17 @@ Rustdesk-FreeConsole/
 │   ├── proto/               # Generated protobuf (rendezvous + message)
 │   └── tools/               # Migration utilities
 ├── web-nodejs/              # Node.js web console (active)
+├── betterdesk-agent/        # Native CDAP agent (Go binary)
+│   ├── main.go              # CLI entry point, 14 flags, signal handling
+│   ├── agent/               # Core: config, agent, system, manifest, terminal, filebrowser, clipboard, screenshot
+│   └── install/             # Systemd + NSSM service installers
+├── sdks/                    # CDAP Bridge SDKs
+│   ├── python/              # betterdesk-cdap v1.0.0 (async CDAPBridge, Widget helpers)
+│   └── nodejs/              # betterdesk-cdap v1.0.0 (EventEmitter CDAPBridge, Widget class)
+├── bridges/                 # Reference CDAP bridges
+│   ├── modbus/              # Modbus TCP/RTU bridge (pymodbus)
+│   ├── snmp/                # SNMP v2c/v3 bridge (pysnmplib)
+│   └── rest-webhook/        # REST polling + webhook bridge (aiohttp)
 ├── web/                     # Flask web console (deprecated)
 ├── hbbs-patch-v2/           # Legacy Rust server binaries (v2.1.3)
 │   ├── hbbs-linux-x86_64    # Signal server Linux (Rust)
@@ -209,6 +220,7 @@ Rustdesk-FreeConsole/
 | 21119 | WS | WebSocket Relay (relay port + 2) |
 | 5000 | HTTP | Web Console (admin panel, LAN) |
 | 21121 | TCP | RustDesk Client API (WAN-facing, Node.js) |
+| 21122 | WS | CDAP Gateway (WebSocket, path: /cdap) |
 
 ### Go Server — Architecture Flow
 
@@ -300,7 +312,7 @@ sudo apt-get install -y build-essential libsqlite3-dev pkg-config libssl-dev git
 20. [x] **Nowe endpointy API** - /api/config, /api/peers/stats, /api/server/stats
 21. [x] **Dokumentacja v3.0** - STATUS_TRACKING_v3.md
 22. [x] **Zmiana ID urządzenia** - moduł id_change.rs, endpoint POST /api/peers/:id/change-id
-23. [x] **Dokumentacja ID Change** - docs/ID_CHANGE_FEATURE.md
+23. [x] **Dokumentacja ID Change** - docs/features/ID_CHANGE_FEATURE.md
 
 ### ✅ Ukończone (2026-02-11)
 24. [x] **System i18n** - wielojęzyczność panelu web przez JSON
@@ -308,7 +320,7 @@ sudo apt-get install -y build-essential libsqlite3-dev pkg-config libssl-dev git
 26. [x] **JavaScript i18n** - web/static/js/i18n.js client-side
 27. [x] **Tłumaczenia EN/PL** - web/lang/en.json, web/lang/pl.json
 28. [x] **Selector języka** - w sidebarze panelu
-29. [x] **Dokumentacja i18n** - docs/CONTRIBUTING_TRANSLATIONS.md
+29. [x] **Dokumentacja i18n** - docs/development/CONTRIBUTING_TRANSLATIONS.md
 
 ### ✅ Ukończone (2026-02-17)
 30. [x] **Security audit v2.3.0** - 3 Critical, 5 High, 8 Medium, 6 Low findings - all Critical/High fixed
@@ -576,9 +588,57 @@ sudo apt-get install -y build-essential libsqlite3-dev pkg-config libssl-dev git
 183. [x] **Password `$` escaping in systemd (Issue #68)**: systemd interprets `$` as variable substitution in ExecStart and Environment directives. Admin password and PostgreSQL URL now escaped `$` → `$$` before writing to `.service` files. Auto-generated passwords (alphanumeric) unaffected.
 184. [x] **Port CONFLICT false positive**: `ss -tlnp` shows `MainThread` instead of `node` on some Linux systems (Ubuntu 24.04+). Added `MainThread` to expected process patterns for ports 5000 and 21121.
 
----
+#### Web Remote Client — Mouse, Quality & FPS Fix (Phase 32) ✅ COMPLETED 2026-03-21
+185. [x] **Mouse click fix (Critical)**: RustDesk parses mouse mask as `button = mask >> 3; type = mask & 7`. Web client sent flat values (mask=1 for left click → `button = 1>>3 = 0` = no button). Hover worked because mask=0 is correct for both formats. Fixed `input.js`: replaced flat values with `TYPE | (BUTTON << 3)` encoding (left click = `1|(1<<3)=9`, right click = `1|(2<<3)=17`, etc.). Added static constants `MOUSE_TYPE_DOWN=1`, `MOUSE_TYPE_UP=2`, `MOUSE_TYPE_WHEEL=3`, `MOUSE_BUTTON_LEFT=1`, `MOUSE_BUTTON_RIGHT=2`, `MOUSE_BUTTON_MIDDLE=4`.
+186. [x] **Image quality fix**: `buildLoginRequest` in `protocol.js` hardcoded `imageQuality: Balanced`. Changed to configurable with default `Best`. `remote.js` passes `imageQuality: 'Best'` in constructor.
+187. [x] **FPS fix**: Login used `customFps: opts.fps || 30` despite wanting 60fps. Changed default to 60. `client.js` `_startSession()` now sends both `customFps` and `imageQuality` options. `authenticate()` passes `fps: 60` and `imageQuality: 'Best'`.
+188. [x] **Beta banner**: Replaced large orange "WIP" banner in `remote.ejs` with slim blue "Beta" banner with dismiss button.
 
-## 🔄 System Statusu v3.0
+#### CDAP Full-Stack — Audio, Clipboard, Cursor, Quality, Codec, Multi-Monitor (Phase 33) ✅ COMPLETED 2026-03-21
+189. [x] **clipboard.go rewrite**: Fixed all field mismatches (sync.Map Load, DeviceConn.WriteMessage, session.browser, session.DeviceID, context.Background(), gw.auditAction()). Bidirectional browser↔device clipboard sync with format detection.
+190. [x] **audio.go**: Full audio session management (~230 lines). AudioSession struct, AudioStartPayload (codec/sample_rate/channels/direction), AudioFramePayload (codec/data/timestamp/duration/sequence). StartAudioSession checks "audio" capability on device manifest. HandleAudioFrame/RelayAudioInput/EndAudioSession.
+191. [x] **media_control.go**: Cursor rendering, adaptive quality, codec negotiation, multi-monitor, key exchange relay, keyframe requests (~320 lines). CursorUpdatePayload (format/width/height/hotspot_x/y/data/cursor_id/hidden), QualityReportPayload (bandwidth_kb/latency_ms/frame_loss/fps), computeQualityAdjustment (adaptive), CodecOffer/Answer relay, MonitorList/MonitorSelect, HandleKeyExchange, RelayKeyframeRequest.
+192. [x] **gateway.go + handler.go integration**: Added audioSessions sync.Map. 7 new message cases in messageLoop: audio_frame, audio_end, clipboard_update, key_exchange, cursor_update, codec_answer, monitor_list. handleAudioFrame/handleAudioEnd in handler.go.
+193. [x] **cdap_handlers.go extensions**: Desktop handler: 6 new switch cases (clipboard_set, quality_report, codec_offer, key_exchange, keyframe_request, monitor_select). Video handler: 4 new switch cases (quality_report, codec_offer, key_exchange, keyframe_request). New handleCDAPAudio WS handler (~100 lines) with init/ready/audio_input/close protocol.
+194. [x] **server.go audio route**: `GET /api/cdap/devices/{id}/audio` with operator role requirement.
+195. [x] **cdapMediaProxy.js audio entry**: Added audio channel to DRY proxy factory (subprotocol: cdap-audio, minRole: operator).
+196. [x] **cdap-audio.js** (~310 lines, NEW): Web Audio API browser client. PCM 16-bit decode + Opus via decodeAudioData. Microphone capture via getUserMedia + ScriptProcessorNode. Volume/mute control, RMS level meter. WS init/ready/audio_frame/error/end protocol. Public API: CDAPAudio.open/close/isActive/setVolume/toggleMute/isMuted.
+197. [x] **cdap-desktop.js rewrite** (~500 lines): Cursor rendering (PNG/RGBA format, LRU cache 50, hidden cursor), clipboard sync (navigator.clipboard API, paste events, clipboard indicator), quality reporting (5s interval, bandwidth/latency/frame_loss/fps), codec negotiation (sendCodecOffer on ready), multi-monitor (select UI in toolbar), keyframe requests.
+198. [x] **cdap-video.js rewrite** (~280 lines): Quality reporting (5s interval), codec negotiation, keyframe request, frame byte/drop tracking.
+199. [x] **cdap-widgets.js updates**: Audio widget renderer (status indicator, level meter, mute/connect buttons), desktop toolbar with clipboard indicator, audio connect/mute event listeners.
+200. [x] **cdap.css** (~170 lines added): Audio widget styles (streaming/connecting/disconnected status, level meter with color thresholds), desktop toolbar, clipboard indicator (fade animation), monitor selector, .cdap-widget-md grid span.
+201. [x] **i18n**: 7 new keys in EN/PL/ZH: connect_audio, audio_connecting, audio_streaming, clipboard_in, clipboard_out, monitor_select, keyframe_request, quality_auto.
+202. [x] **Deployed & verified**: Go binary (28MB) + 10 Node.js files deployed to 192.168.0.110. Both services active. CDAP endpoint returns JSON, console returns 302 (auth redirect) — all correct.
+
+#### Native BetterDesk Agent — Go Binary (Phase 34) ✅ COMPLETED 2026-03-21
+203. [x] **betterdesk-agent/main.go**: CLI entry point with 14 flags, signal handling (SIGINT/SIGTERM), graceful shutdown.
+204. [x] **agent/config.go**: Config struct + JSON/env loading + Validate(). Supports `server`, `auth_method` (api_key/device_token/user_password), `device_id`, `device_name`, `device_type`, `tags`, `terminal`, `file_browser`, `clipboard`, `screenshot`, `file_root`, `heartbeat_sec`, `reconnect_sec`, `log_level`.
+205. [x] **agent/agent.go** (~750 lines): Core agent — WebSocket connect, CDAP auth, manifest registration, heartbeat loop with system metric → widget_values mapping (sys_cpu, sys_memory, sys_disk, sys_hostname, sys_uptime), message dispatch for 20+ CDAP message types (command, terminal_start/input/resize/kill, file_list/read/write/delete, clipboard_get/set, screenshot_capture, state_update, bulk_update, alert_ack, ping).
+206. [x] **agent/system.go**: gopsutil metrics (CPU 1s sample, Memory, Disk root), SystemInfo (hostname/os/platform/version/arch/uptime/total_memory/total_disk), live Uptime() method.
+207. [x] **agent/manifest.go**: CDAP manifest builder — device descriptor, capabilities (telemetry, commands, remote_desktop, file_transfer, clipboard), 9 system widgets (3 gauges, 2 text, 1 terminal, 1 file_browser, 1 button, 1 clipboard text), `heartbeat_interval` field.
+208. [x] **agent/terminal_{unix,windows}.go**: Cross-platform terminal — creack/pty on Unix, cmd.exe StdinPipe/StdoutPipe on Windows.
+209. [x] **agent/filebrowser.go**: safePath() path traversal protection, ListDirectory, ReadFileChunk (base64, 1MB max), WriteFileChunk (base64 decode), DeletePath.
+210. [x] **agent/clipboard.go**: Cross-platform clipboard via OS commands (xclip/xsel/pbcopy/powershell).
+211. [x] **agent/screenshot_{unix,windows}.go**: Platform-specific screenshot capture (screencapture/import/scrot on Unix, System.Drawing on Windows).
+212. [x] **install/install.sh**: Linux systemd installer with ProtectSystem=strict, PrivateTmp, NoNewPrivileges security hardening.
+213. [x] **install/install.ps1**: Windows NSSM service installer.
+214. [x] **Protocol mismatches fixed**: terminal_output (not terminal_data), terminal_end (not terminal_close), file_write_response (not file_write_ack), file_delete_response (not file_delete_ack), flat widget fields (label/group, not nested config), heartbeat_interval (not heartbeat).
+215. [x] **Deployed & verified**: Binary on 192.168.0.110, device_id=CDAP-6A9A5452, type=os_agent, 9 widgets, heartbeat=15s, telemetry flowing (CPU/Memory/Disk/Hostname/Uptime). CDAP API key created via REST (`POST /api/keys`), `api_keys` table entry active.
+
+#### Bridge Ecosystem SDK — Python + Node.js + Reference Bridges (Phase 35) ✅ COMPLETED 2026-03-21
+216. [x] **sdks/python/**: betterdesk-cdap v1.0.0 — CDAPBridge async class (~330 lines), Widget dataclass + 9 factory helpers, Message dataclass, all CDAP constants. Deps: websockets>=12.0.
+217. [x] **sdks/nodejs/**: betterdesk-cdap v1.0.0 — CDAPBridge extends EventEmitter (~300 lines), Widget class + factory helpers, protocol constants. Dep: ws ^8.18.0. Smoke test verified.
+218. [x] **bridges/modbus/**: Modbus TCP/RTU bridge (~200 lines) — register polling, data type encode/decode, write-back commands. Dep: pymodbus>=3.6.0.
+219. [x] **bridges/snmp/**: SNMP v2c/v3 bridge (~200 lines) — OID polling, timetick formatting, counter rate computation. Dep: pysnmplib>=5.0.0.
+220. [x] **bridges/rest-webhook/**: REST polling + aiohttp webhook listener (~230 lines) — JMESPath-lite extraction, configurable polling intervals. Dep: aiohttp>=3.9.0.
+221. [x] **sdks/README.md + bridges/README.md**: Architecture overview, quick start, bridge creation guide.
+222. [x] **WebSocket path fixed**: All SDKs, bridges, agent, and install scripts updated from `/ws` to `/cdap` (27 replacements across 14 files).
+
+#### Node.js Console
+31. [ ] Kompilacja binarek v3.0.0 z nowymi plikami źródłowymi (Rust legacy)
+32. [ ] WebSocket real-time push dla statusu
+33. [ ] Dodać testy jednostkowe dla HTTP API
+34. [ ] Deploy v2.3.0 to production and test all new features
 
 ### Nowe Pliki Źródłowe
 
@@ -608,7 +668,7 @@ OFFLINE  → Przekroczony timeout
 
 ### Dokumentacja
 
-Pełna dokumentacja: [STATUS_TRACKING_v3.md](../docs/STATUS_TRACKING_v3.md)
+Pełna dokumentacja: [STATUS_TRACKING_v3.md](../docs/features/STATUS_TRACKING_v3.md)
 
 ---
 
@@ -641,7 +701,7 @@ X-API-Key: <api-key>
 
 ### Dokumentacja
 
-Pełna dokumentacja: [ID_CHANGE_FEATURE.md](../docs/ID_CHANGE_FEATURE.md)
+Pełna dokumentacja: [ID_CHANGE_FEATURE.md](../docs/features/ID_CHANGE_FEATURE.md)
 
 ---
 
@@ -674,7 +734,7 @@ Pełna dokumentacja: [ID_CHANGE_FEATURE.md](../docs/ID_CHANGE_FEATURE.md)
 
 ### Dokumentacja
 
-Pełna dokumentacja: [CONTRIBUTING_TRANSLATIONS.md](../docs/CONTRIBUTING_TRANSLATIONS.md)
+Pełna dokumentacja: [CONTRIBUTING_TRANSLATIONS.md](../docs/development/CONTRIBUTING_TRANSLATIONS.md)
 
 ---
 
@@ -713,7 +773,7 @@ Workflow `.github/workflows/build.yml` automatycznie:
 
 ### Dokumentacja
 
-Pełna dokumentacja budowania: [BUILD_GUIDE.md](../docs/BUILD_GUIDE.md)
+Pełna dokumentacja budowania: [BUILD_GUIDE.md](../docs/setup/BUILD_GUIDE.md)
 
 ---
 
@@ -845,4 +905,4 @@ All code changes MUST include a security review as part of the implementation pr
 
 ---
 
-*Ostatnia aktualizacja: 2026-03-20 (Security & Installer Fixes — Phase 31) przez GitHub Copilot*
+*Ostatnia aktualizacja: 2026-03-21 (Native Agent + Bridge SDK — Phase 34+35) przez GitHub Copilot*
diff --git a/.gitignore b/.gitignore
index e76a4a76..72a4aeb3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,9 @@
-# Python
+# ============================================================
+# BetterDesk Console — .gitignore
+# Organized by category, no duplicate patterns
+# ============================================================
+
+# --- Python ---
 __pycache__/
 *.py[cod]
 *$py.class
@@ -6,6 +11,7 @@ __pycache__/
 .Python
 env/
 venv/
+.venv/
 ENV/
 build/
 develop-eggs/
@@ -22,56 +28,59 @@ wheels/
 *.egg-info/
 .installed.cfg
 *.egg
-
-# Flask
 instance/
 .webassets-cache
 
-# Rust
+# --- Rust ---
 target/
 Cargo.lock
 **/*.rs.bk
 *.pdb
 
-# IDEs
+# --- Node.js ---
+node_modules/
+package-lock.json
+
+# --- IDEs & OS ---
 .vscode/
 .idea/
+.playwright-mcp/
 *.swp
 *.swo
 *~
 .DS_Store
+Thumbs.db
+.Spotlight-V100
+.Trashes
 
-# Logs
+# --- Logs ---
 *.log
 logs/
 
-# Database
+# --- Database files ---
 *.sqlite3
 *.db
 
-# Sensitive data & reports
-*.key
-*.pem
-*.pub
-*credentials*
-*REPORT*.md
-test_*.sh
-verify_*.sh
-.security_scan_report.md
+# --- Temporary files & caches ---
+*.tmp
+*.temp
+/tmp/
+.cache/
 
-# Archive folder (contains old files with potential sensitive data)
-archive/
-
-# Backups
+# --- Backups ---
+*.bak
 *.backup
 *backup*/
 rustdesk-backup*/
+rustdesk-backup-*/
 
-# Old binary versions (keep only latest in bin/)
-hbbs-v[0-7]-patched
-hbbr-v[0-7]-patched
-
-# Sensitive data (should never be committed)
+# --- Environment & secrets ---
+.env
+.env.local
+.env.*.local
+config.local.*
+*_local.sh
+*_local.ps1
 *credentials*
 *.password
 *.passwords
@@ -79,72 +88,77 @@ hbbr-v[0-7]-patched
 *_password.log
 *secret*.key
 *secret*.pem
-.env
-config.local.*
 
-# Temporary files
-*.tmp
-*.temp
-/tmp/
-
-
-# Backups
-*.bak
-*.backup
-rustdesk-backup-*/
-
-# Temporary files
-*.tmp
-*.temp
-/tmp/
-.cache/
-
-# OS
-Thumbs.db
-.Spotlight-V100
-.Trashes
-
-# Project specific
-screenshots/*.png
-!screenshots/.gitkeep
-web-nodejs/uploads/
+# --- Cryptographic keys & certificates ---
 *.key
 *.pem
-id_*.pub
+*.pub
 id_*
 
-# Environment
-.env
-.env.local
-.env.*.local
-config.local.*
-*_local.sh
-*_local.ps1
+# --- Sensitive internal documents (security audits, reports) ---
+docs/_internal/
+*REPORT*.md
+.security_scan_report.md
 
-# Testing
+# --- Testing ---
 .coverage
 htmlcov/
 .pytest_cache/
 test_*.sh
+verify_*.sh
 TESTING.local.md
+web-nodejs/test-db.js
 
-# Dev scripts (removed — old Flask/Rust-era utilities, not needed for production)
+# --- Test screenshots (moved from root to screenshots/tests/) ---
+screenshots/tests/
+/test-*.png
+
+#visual_studio
+.vs/CopilotSnapshots
+.vs/
+
+# --- Temporary test scripts (contain credentials/URLs — moved to dev_modules/) ---
+tmp_test_*.py
+tmp_test_*.sh
+
+# --- Archive (old files with potential sensitive data) ---
+archive/
+
+# --- Legacy binaries ---
+hbbs-patch/
+hbbs-patch-v2/
+hbbs-v[0-7]-patched
+hbbr-v[0-7]-patched
+
+# --- Dev scripts (old Flask/Rust-era utilities) ---
 dev_modules/
 scripts/legacy/
 migrations/
 templates/
 test_api.sh
 build_windows.sh
-
-# Dev scripts with potential sensitive data
-web-nodejs/_test_*.sh
-web-nodejs/_fix_*.sh
 _write_readme.py
 
-# BetterDesk Desktop Client (development paused — using RustDesk client instead)
+# --- Dev scripts with potential sensitive data ---
+web-nodejs/_test_*.sh
+web-nodejs/_fix_*.sh
+
+# --- BetterDesk Desktop Client (dev paused — using RustDesk client) ---
 betterdesk-client/
 
-# BetterDesk Go server binary files (compiled locally, not shipped in repo)
+# --- BetterDesk Agent binaries & config (compiled locally) ---
+betterdesk-agent/betterdesk-agent
+betterdesk-agent/betterdesk-agent-*
+betterdesk-agent/*.exe
+betterdesk-agent/deploy-config.json
+betterdesk-agent/*.json
+betterdesk-agent/create_key.py
+betterdesk-agent/fix_devid.py
+betterdesk-agent/fix_type.py
+betterdesk-agent/update_config.py
+!betterdesk-agent/package.json
+
+# --- BetterDesk Go server binaries (compiled locally) ---
 betterdesk-server/betterdesk-server
 betterdesk-server/betterdesk-server-*
 betterdesk-server/*.exe
@@ -154,27 +168,36 @@ betterdesk-server/id_ed25519*
 betterdesk-server/test_*.go
 betterdesk-server/_test_*
 
-# Node.js
-node_modules/
-package-lock.json
-
-# Root-level image duplicates (originals in web-nodejs/public/img/)
+# --- Root-level image duplicates (originals in web-nodejs/public/img/) ---
 /betterdesk.png
 /betterdesk_icon.png
+/betterdesk_wallpaper.png
 
-# Internal dev/analysis documents (not for public repo)
+# --- Screenshots ---
+screenshots/*.png
+!screenshots/.gitkeep
+web-nodejs/uploads/
+
+# --- Deployment temporary files & artifacts ---
+_deploy_tmp/
+_server_checksums.txt
+deploy_console.tar.gz
+*.tar.gz
+
+# --- Wallpapers (128MB+ — too large for git, ship separately) ---
+web-nodejs/wallpapers/
+
+# --- Internal dev/analysis documents (not for public repo) ---
 .github/audyt_bezpieczenstwa.md
 .github/RUSTDESK_SZYFROWANIE.md
 .github/rustdesk_client_server_data_analysis.md
 .github/rustdesk_encryption_analysis.md
 .github/new_functions.md
 .github/rustdesk_client.md
+.github/copilot-instructions.md
 
-# Legacy Rust binaries (archived, removed from repo)
-hbbs-patch/
-hbbs-patch-v2/
+# --- Playwright MCP screenshots ---
+.playwright-mcp/
+
+# --- Task tracking (local only) ---
 tasks/todo.md
-docs/SECURITY_AUDIT_FULL_2026-03-19.md
-.github/copilot-instructions.md
-.github/copilot-instructions.md
-.github/copilot-instructions.md
diff --git a/Dockerfile b/Dockerfile
index 69a5125a..9e216077 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -71,8 +71,8 @@ RUN apk add --no-cache \
     && mkdir -p /var/log/supervisor; }
 
 # Create betterdesk user and directories
-RUN addgroup -S betterdesk && \
-    adduser -S -G betterdesk betterdesk && \
+RUN addgroup -g 10001 -S betterdesk && \
+    adduser -u 10001 -S -G betterdesk betterdesk && \
     mkdir -p /opt/rustdesk /app/data /var/log/betterdesk && \
     chown -R betterdesk:betterdesk /opt/rustdesk /app/data /var/log/betterdesk
 
diff --git a/Dockerfile.console b/Dockerfile.console
index ed084bb3..5b7c1d30 100644
--- a/Dockerfile.console
+++ b/Dockerfile.console
@@ -34,8 +34,8 @@ RUN apk add --no-cache \
     curl \
     tini \
     || { sleep 2 && apk add --no-cache sqlite curl tini; } \
-    && addgroup -S betterdesk \
-    && adduser -S -G betterdesk betterdesk
+    && addgroup -g 10001 -S betterdesk \
+    && adduser -u 10001 -S -G betterdesk betterdesk
 
 # Copy application files FIRST, then overlay compiled node_modules.
 # This prevents local node_modules from overwriting Alpine/musl native modules.
diff --git a/Dockerfile.server b/Dockerfile.server
index a88db30f..84663f9e 100644
--- a/Dockerfile.server
+++ b/Dockerfile.server
@@ -41,8 +41,8 @@ RUN apk add --no-cache \
     tini \
     || { sleep 2 && apk add --no-cache \
     ca-certificates curl sqlite tini; } \
-    && addgroup -S betterdesk \
-    && adduser -S -G betterdesk betterdesk
+    && addgroup -g 10001 -S betterdesk \
+    && adduser -u 10001 -S -G betterdesk betterdesk
 
 COPY --from=builder /betterdesk-server /usr/local/bin/betterdesk-server
 RUN chmod +x /usr/local/bin/betterdesk-server
diff --git a/README.md b/README.md
index f116edfb..b7a554c0 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# 🚀 BetterDesk — RustDesk-Compatible Server & Web Console
+# 🚀 BetterDesk v3 — Ultimate Remote Desktop & CDAP Solution
 
 <div align="center">
 
@@ -9,11 +9,12 @@
 ![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)
 ![Go](https://img.shields.io/badge/Go-1.21+-00ADD8.svg)
 ![Node.js](https://img.shields.io/badge/Node.js-18+-339933.svg)
-![Version](https://img.shields.io/badge/version-2.4.0-brightgreen.svg)
+![Version](https://img.shields.io/badge/version-3.0.0-brightgreen.svg)
 ![Security](https://img.shields.io/badge/Security-TLS%20%2B%20NaCl%20%2B%20TOTP-green.svg)
 ![Database](https://img.shields.io/badge/DB-SQLite%20%2B%20PostgreSQL-blue.svg)
+![CDAP](https://img.shields.io/badge/CDAP-v1.0-orange.svg)
 
-**A clean-room RustDesk-compatible server written in Go — single binary replacing hbbs + hbbr — with full protocol support, TLS everywhere, PostgreSQL backend, and a modern Node.js web management console.**
+**A clean-room RustDesk-compatible server written in Go — single binary replacing hbbs + hbbr — with full protocol support, TLS everywhere, PostgreSQL backend, CDAP (Custom Device API Protocol) for IoT/SCADA/network devices, and a modern Node.js web management console.**
 
 [Architecture](#-architecture) • [Installation](#-installation) • [Configuration](#-configuration) • [Security](#-security-architecture) • [API](#-api-reference) • [Troubleshooting](#-troubleshooting)
 
@@ -530,7 +531,7 @@ docker compose up -d
 docker compose logs console 2>&1 | grep -i "Admin password"
 ```
 
-Open http://localhost:5000 — done in 30 seconds! See [DOCKER_QUICKSTART.md](DOCKER_QUICKSTART.md) for more options.
+Open http://localhost:5000 — done in 30 seconds! See [DOCKER_QUICKSTART.md](docs/docker/DOCKER_QUICKSTART.md) for more options.
 
 **Build from source (advanced):**
 
@@ -1353,7 +1354,7 @@ BetterDesk Console supports multiple languages through JSON-based translations.
 3. Update the `_meta` section with language info
 4. Upload via Settings → Language Settings or place in the `lang/` folder
 
-See [Contributing Translations](docs/CONTRIBUTING_TRANSLATIONS.md) for details.
+See [Contributing Translations](docs/development/CONTRIBUTING_TRANSLATIONS.md) for details.
 
 ---
 
@@ -1404,7 +1405,7 @@ Rustdesk-FreeConsole/
 
 ## 🤝 Contributing
 
-Contributions are welcome! See [CONTRIBUTING.md](docs/CONTRIBUTING.md) for guidelines.
+Contributions are welcome! See [CONTRIBUTING.md](docs/development/CONTRIBUTING.md) for guidelines.
 
 ### Reporting Issues
 
diff --git a/VERSION b/VERSION
index 9183195a..56fea8a0 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.4.0
\ No newline at end of file
+3.0.0
\ No newline at end of file
diff --git a/betterdesk-agent/README.md b/betterdesk-agent/README.md
new file mode 100644
index 00000000..61e8dbf0
--- /dev/null
+++ b/betterdesk-agent/README.md
@@ -0,0 +1,179 @@
+# BetterDesk Agent
+
+CDAP (Connected Device Automation Protocol) agent for BetterDesk. Connects to a BetterDesk server's CDAP gateway and provides system monitoring, remote terminal, file browser, clipboard sync, and screenshot capabilities.
+
+## Features
+
+- **System Monitoring** — CPU, memory, disk usage (gauges updated via heartbeat)
+- **Remote Terminal** — Full PTY shell on Linux/macOS, pipe-based on Windows
+- **File Browser** — Directory listing, file read/write/delete with path sanitization
+- **Clipboard Sync** — Read/write system clipboard (xclip/xsel/wl-copy/PowerShell)
+- **Screenshot Capture** — On-demand JPEG screenshot (ImageMagick/scrot/PowerShell)
+- **Automatic Reconnect** — Exponential backoff with jitter
+- **Cross-Platform** — Linux, macOS, Windows (single binary, no CGo)
+
+## Quick Start
+
+```bash
+# Build
+cd betterdesk-agent
+go build -o betterdesk-agent .
+
+# Run
+./betterdesk-agent \
+  -server ws://your-server:21122/cdap \
+  -auth api_key \
+  -key YOUR_API_KEY
+```
+
+## Configuration
+
+### CLI Flags
+
+| Flag | Description | Default |
+|------|-------------|---------|
+| `-server` | Gateway WebSocket URL | `ws://localhost:21122/cdap` |
+| `-auth` | Auth method: `api_key`, `device_token`, `user_password` | `api_key` |
+| `-key` | API key | |
+| `-token` | Device enrollment token | |
+| `-user` | Username | |
+| `-pass` | Password | |
+| `-device-id` | Device ID | auto-assigned |
+| `-device-name` | Device display name | hostname |
+| `-device-type` | Device type | `os_agent` |
+| `-config` | JSON config file path | |
+| `-data-dir` | Data directory | `/var/lib/betterdesk-agent` |
+| `-log-level` | Log level: debug, info, warning, error | `info` |
+| `-version` | Print version | |
+
+### Config File (JSON)
+
+```json
+{
+  "server": "ws://192.168.0.110:21122/cdap",
+  "auth_method": "api_key",
+  "api_key": "your-api-key-here",
+  "device_name": "Production Server",
+  "device_type": "os_agent",
+  "tags": ["production", "linux"],
+  "terminal": true,
+  "file_browser": true,
+  "clipboard": true,
+  "screenshot": true,
+  "file_root": "/",
+  "heartbeat_sec": 15,
+  "log_level": "info"
+}
+```
+
+### Environment Variables
+
+All config fields can be overridden via `BDAGENT_*` environment variables:
+
+```bash
+BDAGENT_SERVER=ws://host:21122/cdap
+BDAGENT_AUTH_METHOD=api_key
+BDAGENT_API_KEY=your-key
+BDAGENT_DEVICE_NAME=my-server
+BDAGENT_TERMINAL=Y        # Y/N to enable/disable
+BDAGENT_FILE_BROWSER=Y
+BDAGENT_CLIPBOARD=Y
+BDAGENT_SCREENSHOT=Y
+BDAGENT_LOG_LEVEL=debug
+```
+
+Priority: CLI flags > Environment variables > Config file > Defaults
+
+## Building
+
+```bash
+# Current platform
+go build -o betterdesk-agent .
+
+# Linux AMD64
+GOOS=linux GOARCH=amd64 go build -o betterdesk-agent-linux-amd64 .
+
+# Linux ARM64
+GOOS=linux GOARCH=arm64 go build -o betterdesk-agent-linux-arm64 .
+
+# Windows
+GOOS=windows GOARCH=amd64 go build -o betterdesk-agent.exe .
+```
+
+## Installation
+
+### Linux (systemd)
+
+```bash
+sudo ./install/install.sh -s ws://your-server:21122/cdap -k YOUR_API_KEY
+```
+
+### Windows (NSSM service)
+
+```powershell
+# Run as Administrator
+.\install\install.ps1 -Server ws://your-server:21122/cdap -Key YOUR_API_KEY
+```
+
+### Uninstall
+
+```bash
+# Linux
+sudo ./install/install.sh -u
+
+# Windows
+.\install\install.ps1 -Uninstall
+```
+
+## Protocol
+
+The agent communicates via the CDAP WebSocket protocol (port 21122 by default).
+
+### Connection Flow
+
+1. **Connect** — WebSocket dial to gateway
+2. **Authenticate** — Send `auth` message with credentials
+3. **Register** — Send `register` message with device manifest
+4. **Operate** — Heartbeat loop + message dispatch (commands, terminal, files, etc.)
+5. **Reconnect** — Automatic on disconnect with exponential backoff
+
+### Supported Message Types
+
+| Direction | Type | Description |
+|-----------|------|-------------|
+| Agent → Server | `heartbeat` | Metrics + widget values |
+| Agent → Server | `state_update` | Single widget value change |
+| Agent → Server | `command_response` | Command execution result |
+| Agent → Server | `terminal_output` | Shell output data |
+| Agent → Server | `terminal_end` | Shell session ended |
+| Agent → Server | `file_list_response` | Directory listing |
+| Agent → Server | `file_read_response` | File chunk data |
+| Agent → Server | `desktop_frame` | Screenshot JPEG data |
+| Server → Agent | `command` | Execute widget command |
+| Server → Agent | `terminal_start` | Start shell session |
+| Server → Agent | `terminal_data` | Shell input from browser |
+| Server → Agent | `terminal_resize` | Resize terminal |
+| Server → Agent | `file_list` | List directory |
+| Server → Agent | `file_read` | Read file chunk |
+| Server → Agent | `file_write` | Write file chunk |
+| Server → Agent | `file_delete` | Delete file |
+| Server → Agent | `clipboard_set` | Set clipboard content |
+| Server → Agent | `desktop_start` | Request screenshot |
+
+## Prerequisites
+
+### Screenshot Support
+
+- **Linux**: Install `scrot` or `ImageMagick` (`sudo apt install scrot` or `sudo apt install imagemagick`)
+- **macOS**: Built-in `screencapture` (no install needed)
+- **Windows**: PowerShell with .NET Framework (built-in)
+
+### Clipboard Support
+
+- **Linux (X11)**: Install `xclip` or `xsel` (`sudo apt install xclip`)
+- **Linux (Wayland)**: Install `wl-clipboard` (`sudo apt install wl-clipboard`)
+- **macOS/Windows**: Built-in (no install needed)
+
+## License
+
+Same as BetterDesk project — see repository LICENSE.
diff --git a/betterdesk-agent/agent/agent.go b/betterdesk-agent/agent/agent.go
new file mode 100644
index 00000000..686a4a75
--- /dev/null
+++ b/betterdesk-agent/agent/agent.go
@@ -0,0 +1,746 @@
+package agent
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"log"
+	"math/rand"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/coder/websocket"
+)
+
+// Message is the CDAP protocol envelope (mirrors server-side cdap.Message).
+type Message struct {
+	Type      string          `json:"type"`
+	ID        string          `json:"id,omitempty"`
+	Timestamp string          `json:"timestamp,omitempty"`
+	Payload   json.RawMessage `json:"payload"`
+}
+
+// Agent connects to a BetterDesk CDAP gateway, authenticates, registers
+// a system manifest, and handles commands / media sessions.
+type Agent struct {
+	cfg     *Config
+	version string
+
+	conn *websocket.Conn
+	mu   sync.Mutex // serialise writes
+
+	// Auth state
+	token     string
+	deviceID  string
+	role      string
+	sessionID string
+
+	// Session managers
+	terminals    sync.Map // session_id → *TerminalSession
+	fileHandlers sync.Map // session_id → context.CancelFunc
+
+	// System modules
+	sysCollector *SystemCollector
+	clipboard    *ClipboardHandler
+
+	// Widget values collected per heartbeat cycle
+	widgetValues sync.Map // widget_id → any
+
+	// Lifecycle
+	connected atomic.Bool
+	ctx       context.Context
+	cancel    context.CancelFunc
+	wg        sync.WaitGroup
+}
+
+// New creates a new Agent with the supplied configuration.
+func New(cfg *Config, version string) *Agent {
+	ctx, cancel := context.WithCancel(context.Background())
+	return &Agent{
+		cfg:          cfg,
+		version:      version,
+		sysCollector: NewSystemCollector(),
+		clipboard:    NewClipboardHandler(),
+		ctx:          ctx,
+		cancel:       cancel,
+	}
+}
+
+// Run starts the agent with automatic reconnect on disconnect.
+func (a *Agent) Run() error {
+	delay := time.Duration(a.cfg.ReconnectSec) * time.Second
+	maxDelay := time.Duration(a.cfg.MaxReconnect) * time.Second
+
+	for {
+		select {
+		case <-a.ctx.Done():
+			return nil
+		default:
+		}
+		err := a.runOnce()
+		if err != nil {
+			log.Printf("[agent] Connection lost: %v", err)
+		} else {
+			delay = time.Duration(a.cfg.ReconnectSec) * time.Second
+		}
+
+		// Exponential backoff with jitter
+		jitter := time.Duration(rand.Int63n(max(int64(delay/4), 1)))
+		wait := delay + jitter
+		log.Printf("[agent] Reconnecting in %v...", wait)
+
+		select {
+		case <-a.ctx.Done():
+			return nil
+		case <-time.After(wait):
+		}
+		delay = min(delay*2, maxDelay)
+	}
+}
+
+// Stop signals the agent to shut down gracefully.
+func (a *Agent) Stop() {
+	a.cancel()
+	a.mu.Lock()
+	conn := a.conn
+	a.mu.Unlock()
+	if conn != nil {
+		conn.Close(websocket.StatusNormalClosure, "agent shutdown")
+	}
+	a.wg.Wait()
+}
+
+// ── Single connection lifecycle ──────────────────────────────────────
+
+func (a *Agent) runOnce() error {
+	log.Printf("[agent] Connecting to %s...", a.cfg.Server)
+
+	dialCtx, dialCancel := context.WithTimeout(a.ctx, 30*time.Second)
+	defer dialCancel()
+
+	conn, _, err := websocket.Dial(dialCtx, a.cfg.Server, nil)
+	if err != nil {
+		return fmt.Errorf("dial: %w", err)
+	}
+	conn.SetReadLimit(4 * 1024 * 1024) // 4MB max message
+
+	a.mu.Lock()
+	a.conn = conn
+	a.mu.Unlock()
+
+	// Authenticate
+	if err := a.authenticate(); err != nil {
+		conn.Close(websocket.StatusPolicyViolation, "auth failed")
+		return fmt.Errorf("auth: %w", err)
+	}
+
+	// Register manifest
+	if err := a.register(); err != nil {
+		conn.Close(websocket.StatusInternalError, "register failed")
+		return fmt.Errorf("register: %w", err)
+	}
+
+	a.connected.Store(true)
+	log.Printf("[agent] Connected as %q (device_id=%s, role=%s)", a.cfg.DeviceName, a.deviceID, a.role)
+
+	// Start heartbeat sender
+	a.wg.Add(1)
+	go a.heartbeatLoop()
+
+	// Blocking message loop
+	err = a.messageLoop()
+
+	a.connected.Store(false)
+	a.cleanupSessions()
+	a.wg.Wait()
+	return err
+}
+
+// ── Authentication ───────────────────────────────────────────────────
+
+func (a *Agent) authenticate() error {
+	payload := map[string]string{
+		"method":         a.cfg.AuthMethod,
+		"device_id":      a.cfg.DeviceID,
+		"client_version": a.version,
+	}
+	switch a.cfg.AuthMethod {
+	case "api_key":
+		payload["key"] = a.cfg.APIKey
+	case "device_token":
+		payload["token"] = a.cfg.DeviceToken
+	case "user_password":
+		payload["username"] = a.cfg.Username
+		payload["password"] = a.cfg.Password
+	}
+
+	if err := a.sendMessage("auth", payload); err != nil {
+		return err
+	}
+
+	msg, err := a.readMessage()
+	if err != nil {
+		return err
+	}
+	if msg.Type != "auth_result" {
+		return fmt.Errorf("expected auth_result, got %s", msg.Type)
+	}
+
+	var result struct {
+		Success     bool   `json:"success"`
+		Token       string `json:"token"`
+		Role        string `json:"role"`
+		DeviceID    string `json:"device_id"`
+		SessionTok  string `json:"session_token"`
+		Requires2FA bool   `json:"requires_2fa"`
+		Error       string `json:"error"`
+	}
+	if err := json.Unmarshal(msg.Payload, &result); err != nil {
+		return fmt.Errorf("parse auth_result: %w", err)
+	}
+	if !result.Success {
+		return fmt.Errorf("auth rejected: %s", result.Error)
+	}
+	a.token = result.Token
+	a.deviceID = result.DeviceID
+	a.role = result.Role
+	a.sessionID = result.SessionTok
+	return nil
+}
+
+// ── Registration ─────────────────────────────────────────────────────
+
+func (a *Agent) register() error {
+	manifest := BuildManifest(a.cfg, a.sysCollector, a.version)
+	return a.sendMessage("register", map[string]any{"manifest": manifest})
+}
+
+// ── Heartbeat ────────────────────────────────────────────────────────
+
+func (a *Agent) heartbeatLoop() {
+	defer a.wg.Done()
+	ticker := time.NewTicker(time.Duration(a.cfg.HeartbeatSec) * time.Second)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-a.ctx.Done():
+			return
+		case <-ticker.C:
+			if !a.connected.Load() {
+				return
+			}
+			metrics := a.sysCollector.Collect()
+			info := a.sysCollector.GetInfo()
+
+			// Map system metrics to widget IDs for server-side state tracking.
+			a.widgetValues.Store("sys_cpu", metrics.CPU)
+			a.widgetValues.Store("sys_memory", metrics.Memory)
+			a.widgetValues.Store("sys_disk", metrics.Disk)
+			a.widgetValues.Store("sys_hostname", info.Hostname)
+			a.widgetValues.Store("sys_uptime", formatUptime(a.sysCollector.Uptime()))
+
+			wv := a.collectWidgetValues()
+			payload := map[string]any{"metrics": metrics}
+			if len(wv) > 0 {
+				payload["widget_values"] = wv
+			}
+			if err := a.sendMessage("heartbeat", payload); err != nil {
+				log.Printf("[agent] Heartbeat failed: %v", err)
+				return
+			}
+		}
+	}
+}
+
+func (a *Agent) collectWidgetValues() map[string]any {
+	vals := make(map[string]any)
+	a.widgetValues.Range(func(k, v any) bool {
+		vals[k.(string)] = v
+		return true
+	})
+	return vals
+}
+
+func formatUptime(secs uint64) string {
+	d := secs / 86400
+	h := (secs % 86400) / 3600
+	m := (secs % 3600) / 60
+	if d > 0 {
+		return fmt.Sprintf("%dd %dh %dm", d, h, m)
+	}
+	return fmt.Sprintf("%dh %dm", h, m)
+}
+
+// ── Message Loop & Dispatch ──────────────────────────────────────────
+
+func (a *Agent) messageLoop() error {
+	for {
+		msg, err := a.readMessage()
+		if err != nil {
+			return err
+		}
+		a.dispatch(msg)
+	}
+}
+
+func (a *Agent) dispatch(msg *Message) {
+	switch msg.Type {
+
+	// ── Commands ──
+	case "command":
+		a.handleCommand(msg)
+
+	// ── Terminal ──
+	case "terminal_start":
+		a.handleTerminalStart(msg)
+	case "terminal_data":
+		a.handleTerminalInput(msg)
+	case "terminal_resize":
+		a.handleTerminalResize(msg)
+
+	// ── File Browser ──
+	case "file_start":
+		// Session acknowledged — nothing to do on agent side
+	case "file_list":
+		a.handleFileList(msg)
+	case "file_read":
+		a.handleFileRead(msg)
+	case "file_write":
+		a.handleFileWrite(msg)
+	case "file_delete":
+		a.handleFileDelete(msg)
+
+	// ── Clipboard ──
+	case "clipboard_set":
+		a.handleClipboardSet(msg)
+
+	// ── Desktop (basic screenshot mode) ──
+	case "desktop_start":
+		a.handleDesktopStart(msg)
+	case "desktop_input":
+		// No input injection in os_agent mode
+
+	// ── Video / Audio (not supported in os_agent) ──
+	case "video_start", "audio_start", "audio_input":
+		log.Printf("[agent] %s: not supported in os_agent mode", msg.Type)
+
+	// ── Codec / Media Control ──
+	case "codec_offer":
+		a.handleCodecOffer(msg)
+	case "monitor_select", "keyframe_request", "key_exchange", "quality_adjust":
+		// Acknowledged — no real-time media to adjust
+
+	// ── Errors ──
+	case "error":
+		var ep struct {
+			Code    int    `json:"code"`
+			Message string `json:"message"`
+		}
+		json.Unmarshal(msg.Payload, &ep)
+		log.Printf("[agent] Server error %d: %s", ep.Code, ep.Message)
+
+	default:
+		if a.cfg.LogLevel == "debug" {
+			log.Printf("[agent] Unknown message: %s", msg.Type)
+		}
+	}
+}
+
+// ── Command Handling ─────────────────────────────────────────────────
+
+func (a *Agent) handleCommand(msg *Message) {
+	var cmd struct {
+		CommandID string `json:"command_id"`
+		WidgetID  string `json:"widget_id"`
+		Action    string `json:"action"`
+		Value     any    `json:"value"`
+	}
+	if err := json.Unmarshal(msg.Payload, &cmd); err != nil {
+		return
+	}
+
+	go func() {
+		start := time.Now()
+		result, err := a.executeWidgetCommand(cmd.WidgetID, cmd.Action, cmd.Value)
+		resp := map[string]any{
+			"command_id":        cmd.CommandID,
+			"execution_time_ms": time.Since(start).Milliseconds(),
+		}
+		if err != nil {
+			resp["status"] = "error"
+			resp["error_message"] = err.Error()
+		} else {
+			resp["status"] = "ok"
+			resp["result"] = result
+		}
+		a.sendMessage("command_response", resp)
+	}()
+}
+
+func (a *Agent) executeWidgetCommand(widgetID, action string, value any) (any, error) {
+	switch widgetID {
+	case "sys_screenshot":
+		if action == "trigger" {
+			return a.captureAndSendScreenshot()
+		}
+	case "sys_clipboard":
+		if action == "query" {
+			text := a.clipboard.Get()
+			return map[string]string{"text": text}, nil
+		}
+		if action == "set" {
+			if s, ok := value.(string); ok {
+				a.clipboard.Set(s)
+				return "ok", nil
+			}
+		}
+	}
+
+	// Generic widget — store the value
+	if action == "set" {
+		a.widgetValues.Store(widgetID, value)
+		return "ok", nil
+	}
+	if action == "query" {
+		if v, ok := a.widgetValues.Load(widgetID); ok {
+			return v, nil
+		}
+		return nil, nil
+	}
+
+	return nil, fmt.Errorf("unsupported action %q on widget %q", action, widgetID)
+}
+
+// ── Terminal Handlers ────────────────────────────────────────────────
+
+func (a *Agent) handleTerminalStart(msg *Message) {
+	if !a.cfg.Terminal {
+		log.Printf("[agent] Terminal disabled, ignoring terminal_start")
+		return
+	}
+	var p struct {
+		SessionID string `json:"session_id"`
+		Cols      int    `json:"cols"`
+		Rows      int    `json:"rows"`
+		Shell     string `json:"shell"`
+	}
+	if err := json.Unmarshal(msg.Payload, &p); err != nil {
+		return
+	}
+	if p.Cols <= 0 {
+		p.Cols = 80
+	}
+	if p.Rows <= 0 {
+		p.Rows = 24
+	}
+
+	ts, err := StartTerminal(p.SessionID, p.Cols, p.Rows, p.Shell, func(data []byte) {
+		a.sendMessage("terminal_output", map[string]any{
+			"session_id": p.SessionID,
+			"data":       string(data),
+			"stream":     "stdout",
+		})
+	})
+	if err != nil {
+		log.Printf("[agent] Terminal start failed: %v", err)
+		a.sendMessage("terminal_end", map[string]any{
+			"session_id": p.SessionID,
+			"reason":     "start_failed",
+		})
+		return
+	}
+	a.terminals.Store(p.SessionID, ts)
+}
+
+func (a *Agent) handleTerminalInput(msg *Message) {
+	var p struct {
+		SessionID string `json:"session_id"`
+		Data      string `json:"data"`
+	}
+	if err := json.Unmarshal(msg.Payload, &p); err != nil {
+		return
+	}
+	if ts, ok := a.terminals.Load(p.SessionID); ok {
+		ts.(*TerminalSession).Write([]byte(p.Data))
+	}
+}
+
+func (a *Agent) handleTerminalResize(msg *Message) {
+	var p struct {
+		SessionID string `json:"session_id"`
+		Cols      int    `json:"cols"`
+		Rows      int    `json:"rows"`
+	}
+	if err := json.Unmarshal(msg.Payload, &p); err != nil {
+		return
+	}
+	if ts, ok := a.terminals.Load(p.SessionID); ok {
+		ts.(*TerminalSession).Resize(p.Cols, p.Rows)
+	}
+}
+
+// ── File Browser Handlers ────────────────────────────────────────────
+
+func (a *Agent) handleFileList(msg *Message) {
+	if !a.cfg.FileBrowser {
+		return
+	}
+	var p struct {
+		SessionID string `json:"session_id"`
+		RequestID string `json:"request_id"`
+		Path      string `json:"path"`
+	}
+	if err := json.Unmarshal(msg.Payload, &p); err != nil {
+		return
+	}
+	go func() {
+		entries, err := ListDirectory(a.cfg.FileRoot, p.Path)
+		resp := map[string]any{
+			"session_id": p.SessionID,
+			"request_id": p.RequestID,
+			"path":       p.Path,
+		}
+		if err != nil {
+			resp["error"] = err.Error()
+			resp["entries"] = []any{}
+		} else {
+			resp["entries"] = entries
+		}
+		a.sendMessage("file_list_response", resp)
+	}()
+}
+
+func (a *Agent) handleFileRead(msg *Message) {
+	if !a.cfg.FileBrowser {
+		return
+	}
+	var p struct {
+		SessionID string `json:"session_id"`
+		RequestID string `json:"request_id"`
+		Path      string `json:"path"`
+		Offset    int64  `json:"offset"`
+		Length    int64  `json:"length"`
+	}
+	if err := json.Unmarshal(msg.Payload, &p); err != nil {
+		return
+	}
+	go func() {
+		data, size, done, err := ReadFileChunk(a.cfg.FileRoot, p.Path, p.Offset, p.Length)
+		resp := map[string]any{
+			"session_id": p.SessionID,
+			"request_id": p.RequestID,
+			"path":       p.Path,
+			"offset":     p.Offset,
+			"done":       done,
+		}
+		if err != nil {
+			resp["error"] = err.Error()
+			resp["data"] = ""
+			resp["size"] = int64(0)
+		} else {
+			resp["data"] = base64.StdEncoding.EncodeToString(data)
+			resp["size"] = size
+		}
+		a.sendMessage("file_read_response", resp)
+	}()
+}
+
+func (a *Agent) handleFileWrite(msg *Message) {
+	if !a.cfg.FileBrowser {
+		return
+	}
+	var p struct {
+		SessionID string `json:"session_id"`
+		RequestID string `json:"request_id"`
+		Path      string `json:"path"`
+		Data      string `json:"data"` // base64
+		Offset    int64  `json:"offset"`
+		Done      bool   `json:"done"`
+	}
+	if err := json.Unmarshal(msg.Payload, &p); err != nil {
+		return
+	}
+	go func() {
+		raw, err := base64.StdEncoding.DecodeString(p.Data)
+		resp := map[string]any{
+			"session_id": p.SessionID,
+			"request_id": p.RequestID,
+			"path":       p.Path,
+		}
+		if err != nil {
+			resp["error"] = "invalid base64 data"
+			resp["written"] = int64(0)
+		} else {
+			written, writeErr := WriteFileChunk(a.cfg.FileRoot, p.Path, p.Offset, raw)
+			resp["written"] = written
+			if writeErr != nil {
+				resp["error"] = writeErr.Error()
+			}
+		}
+		a.sendMessage("file_write_response", resp)
+	}()
+}
+
+func (a *Agent) handleFileDelete(msg *Message) {
+	if !a.cfg.FileBrowser {
+		return
+	}
+	var p struct {
+		SessionID string `json:"session_id"`
+		RequestID string `json:"request_id"`
+		Path      string `json:"path"`
+	}
+	if err := json.Unmarshal(msg.Payload, &p); err != nil {
+		return
+	}
+	go func() {
+		err := DeletePath(a.cfg.FileRoot, p.Path)
+		resp := map[string]any{
+			"session_id": p.SessionID,
+			"request_id": p.RequestID,
+			"path":       p.Path,
+		}
+		if err != nil {
+			resp["error"] = err.Error()
+		}
+		a.sendMessage("file_delete_response", resp)
+	}()
+}
+
+// ── Clipboard Handler ────────────────────────────────────────────────
+
+func (a *Agent) handleClipboardSet(msg *Message) {
+	if !a.cfg.Clipboard {
+		return
+	}
+	var p struct {
+		Format string `json:"format"`
+		Data   string `json:"data"`
+	}
+	if err := json.Unmarshal(msg.Payload, &p); err != nil {
+		return
+	}
+	if p.Format == "text" {
+		a.clipboard.Set(p.Data)
+	}
+}
+
+// ── Desktop (Screenshot Mode) ────────────────────────────────────────
+
+func (a *Agent) handleDesktopStart(msg *Message) {
+	if !a.cfg.Screenshot {
+		return
+	}
+	var p struct {
+		SessionID string `json:"session_id"`
+		Width     int    `json:"width"`
+		Height    int    `json:"height"`
+		Quality   int    `json:"quality"`
+		FPS       int    `json:"fps"`
+	}
+	if err := json.Unmarshal(msg.Payload, &p); err != nil {
+		return
+	}
+
+	// In os_agent mode, send a single screenshot frame
+	go func() {
+		data, err := CaptureScreenshot()
+		if err != nil {
+			log.Printf("[agent] Screenshot capture failed: %v", err)
+			return
+		}
+		a.sendMessage("desktop_frame", map[string]any{
+			"session_id": p.SessionID,
+			"format":     "jpeg",
+			"width":      0,
+			"height":     0,
+			"data":       base64.StdEncoding.EncodeToString(data),
+			"timestamp":  time.Now().UnixMilli(),
+		})
+	}()
+}
+
+func (a *Agent) captureAndSendScreenshot() (any, error) {
+	data, err := CaptureScreenshot()
+	if err != nil {
+		return nil, err
+	}
+	return map[string]any{
+		"format": "jpeg",
+		"size":   len(data),
+		"data":   base64.StdEncoding.EncodeToString(data),
+	}, nil
+}
+
+// ── Codec Offer ──────────────────────────────────────────────────────
+
+func (a *Agent) handleCodecOffer(msg *Message) {
+	var p struct {
+		SessionID string `json:"session_id"`
+	}
+	json.Unmarshal(msg.Payload, &p)
+	a.sendMessage("codec_answer", map[string]any{
+		"session_id":  p.SessionID,
+		"video_codec": "jpeg",
+		"audio_codec": "",
+	})
+}
+
+// ── Session Cleanup ──────────────────────────────────────────────────
+
+func (a *Agent) cleanupSessions() {
+	a.terminals.Range(func(key, value any) bool {
+		value.(*TerminalSession).Close()
+		a.terminals.Delete(key)
+		return true
+	})
+	a.fileHandlers.Range(func(key, value any) bool {
+		if cancel, ok := value.(context.CancelFunc); ok {
+			cancel()
+		}
+		a.fileHandlers.Delete(key)
+		return true
+	})
+}
+
+// ── Wire I/O ─────────────────────────────────────────────────────────
+
+func (a *Agent) sendMessage(msgType string, payload any) error {
+	data, err := json.Marshal(payload)
+	if err != nil {
+		return err
+	}
+	envelope := Message{
+		Type:      msgType,
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   data,
+	}
+	raw, err := json.Marshal(envelope)
+	if err != nil {
+		return err
+	}
+
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if a.conn == nil {
+		return fmt.Errorf("no connection")
+	}
+	ctx, cancel := context.WithTimeout(a.ctx, 10*time.Second)
+	defer cancel()
+	return a.conn.Write(ctx, websocket.MessageText, raw)
+}
+
+func (a *Agent) readMessage() (*Message, error) {
+	_, data, err := a.conn.Read(a.ctx)
+	if err != nil {
+		return nil, err
+	}
+	var msg Message
+	if err := json.Unmarshal(data, &msg); err != nil {
+		return nil, fmt.Errorf("invalid message: %w", err)
+	}
+	return &msg, nil
+}
diff --git a/betterdesk-agent/agent/clipboard.go b/betterdesk-agent/agent/clipboard.go
new file mode 100644
index 00000000..535f26c7
--- /dev/null
+++ b/betterdesk-agent/agent/clipboard.go
@@ -0,0 +1,79 @@
+package agent
+
+import (
+	"log"
+	"os/exec"
+	"runtime"
+	"strings"
+)
+
+// ClipboardHandler provides cross-platform text clipboard access
+// using OS commands (no CGo required).
+type ClipboardHandler struct{}
+
+// NewClipboardHandler creates a new handler.
+func NewClipboardHandler() *ClipboardHandler {
+	return &ClipboardHandler{}
+}
+
+// Get returns the current clipboard text content.
+func (ch *ClipboardHandler) Get() string {
+	var cmd *exec.Cmd
+
+	switch runtime.GOOS {
+	case "darwin":
+		cmd = exec.Command("pbpaste")
+	case "linux", "freebsd", "openbsd", "netbsd":
+		if _, err := exec.LookPath("xclip"); err == nil {
+			cmd = exec.Command("xclip", "-selection", "clipboard", "-o")
+		} else if _, err := exec.LookPath("xsel"); err == nil {
+			cmd = exec.Command("xsel", "--clipboard", "--output")
+		} else if _, err := exec.LookPath("wl-paste"); err == nil {
+			cmd = exec.Command("wl-paste", "--no-newline")
+		} else {
+			log.Printf("[clipboard] No clipboard tool found (install xclip, xsel, or wl-paste)")
+			return ""
+		}
+	case "windows":
+		cmd = exec.Command("powershell", "-NoProfile", "-Command", "Get-Clipboard")
+	default:
+		return ""
+	}
+
+	out, err := cmd.Output()
+	if err != nil {
+		log.Printf("[clipboard] Get failed: %v", err)
+		return ""
+	}
+	return strings.TrimRight(string(out), "\r\n")
+}
+
+// Set writes text to the system clipboard.
+func (ch *ClipboardHandler) Set(text string) {
+	var cmd *exec.Cmd
+
+	switch runtime.GOOS {
+	case "darwin":
+		cmd = exec.Command("pbcopy")
+	case "linux", "freebsd", "openbsd", "netbsd":
+		if _, err := exec.LookPath("xclip"); err == nil {
+			cmd = exec.Command("xclip", "-selection", "clipboard")
+		} else if _, err := exec.LookPath("xsel"); err == nil {
+			cmd = exec.Command("xsel", "--clipboard", "--input")
+		} else if _, err := exec.LookPath("wl-copy"); err == nil {
+			cmd = exec.Command("wl-copy")
+		} else {
+			log.Printf("[clipboard] No clipboard tool found")
+			return
+		}
+	case "windows":
+		cmd = exec.Command("powershell", "-NoProfile", "-Command", "Set-Clipboard -Value $input")
+	default:
+		return
+	}
+
+	cmd.Stdin = strings.NewReader(text)
+	if err := cmd.Run(); err != nil {
+		log.Printf("[clipboard] Set failed: %v", err)
+	}
+}
diff --git a/betterdesk-agent/agent/config.go b/betterdesk-agent/agent/config.go
new file mode 100644
index 00000000..fe5a2c33
--- /dev/null
+++ b/betterdesk-agent/agent/config.go
@@ -0,0 +1,162 @@
+package agent
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+)
+
+// Config holds all agent configuration.
+type Config struct {
+	Server      string   `json:"server"`      // ws://host:21122/cdap
+	AuthMethod  string   `json:"auth_method"` // api_key, device_token, user_password
+	APIKey      string   `json:"api_key,omitempty"`
+	DeviceToken string   `json:"device_token,omitempty"`
+	Username    string   `json:"username,omitempty"`
+	Password    string   `json:"password,omitempty"`
+	DeviceID    string   `json:"device_id,omitempty"`
+	DeviceName  string   `json:"device_name,omitempty"`
+	DeviceType  string   `json:"device_type,omitempty"` // os_agent, desktop, custom
+	Tags        []string `json:"tags,omitempty"`
+
+	Terminal    bool `json:"terminal"`
+	FileBrowser bool `json:"file_browser"`
+	Clipboard   bool `json:"clipboard"`
+	Screenshot  bool `json:"screenshot"`
+
+	FileRoot     string `json:"file_root,omitempty"` // root dir for file browser (default: /)
+	HeartbeatSec int    `json:"heartbeat_sec"`       // default 15
+	ReconnectSec int    `json:"reconnect_sec"`       // base reconnect delay
+	MaxReconnect int    `json:"max_reconnect"`       // max reconnect delay
+	LogLevel     string `json:"log_level"`           // debug, info, warning, error
+	DataDir      string `json:"data_dir"`
+}
+
+// DefaultConfig returns sensible defaults for all platforms.
+func DefaultConfig() *Config {
+	hostname, _ := os.Hostname()
+
+	// BD-2026-004: Platform-specific safe default for file browser root
+	fileRoot := "/var/lib/betterdesk-agent/files"
+	if runtime.GOOS == "windows" {
+		fileRoot = filepath.Join(os.Getenv("ProgramData"), "BetterDesk", "AgentFiles")
+		if fileRoot == filepath.Join("", "BetterDesk", "AgentFiles") {
+			fileRoot = `C:\ProgramData\BetterDesk\AgentFiles`
+		}
+	}
+
+	return &Config{
+		Server:       "ws://localhost:21122/cdap",
+		AuthMethod:   "api_key",
+		DeviceType:   "os_agent",
+		DeviceName:   hostname,
+		Terminal:     true,
+		FileBrowser:  true,
+		Clipboard:    true,
+		Screenshot:   true,
+		FileRoot:     fileRoot,
+		HeartbeatSec: 15,
+		ReconnectSec: 5,
+		MaxReconnect: 300,
+		LogLevel:     "info",
+		DataDir:      defaultDataDir(),
+	}
+}
+
+// LoadConfig reads config from file (if path provided) then overlays env vars.
+func LoadConfig(path string) (*Config, error) {
+	cfg := DefaultConfig()
+	if path != "" {
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return nil, fmt.Errorf("read config: %w", err)
+		}
+		if err := json.Unmarshal(data, cfg); err != nil {
+			return nil, fmt.Errorf("parse config: %w", err)
+		}
+	}
+	cfg.loadEnv()
+	return cfg, nil
+}
+
+func (c *Config) loadEnv() {
+	envStr := func(key string, target *string) {
+		if v := os.Getenv(key); v != "" {
+			*target = v
+		}
+	}
+	envBool := func(key string, target *bool) {
+		v := strings.ToUpper(os.Getenv(key))
+		if v == "Y" || v == "TRUE" || v == "1" {
+			*target = true
+		} else if v == "N" || v == "FALSE" || v == "0" {
+			*target = false
+		}
+	}
+
+	envStr("BDAGENT_SERVER", &c.Server)
+	envStr("BDAGENT_AUTH_METHOD", &c.AuthMethod)
+	envStr("BDAGENT_API_KEY", &c.APIKey)
+	envStr("BDAGENT_DEVICE_TOKEN", &c.DeviceToken)
+	envStr("BDAGENT_USERNAME", &c.Username)
+	envStr("BDAGENT_PASSWORD", &c.Password)
+	envStr("BDAGENT_DEVICE_ID", &c.DeviceID)
+	envStr("BDAGENT_DEVICE_NAME", &c.DeviceName)
+	envStr("BDAGENT_DEVICE_TYPE", &c.DeviceType)
+	envStr("BDAGENT_LOG_LEVEL", &c.LogLevel)
+	envStr("BDAGENT_DATA_DIR", &c.DataDir)
+	envStr("BDAGENT_FILE_ROOT", &c.FileRoot)
+	envBool("BDAGENT_TERMINAL", &c.Terminal)
+	envBool("BDAGENT_FILE_BROWSER", &c.FileBrowser)
+	envBool("BDAGENT_CLIPBOARD", &c.Clipboard)
+	envBool("BDAGENT_SCREENSHOT", &c.Screenshot)
+}
+
+// Validate checks required fields and clamps values to safe ranges.
+func (c *Config) Validate() error {
+	if c.Server == "" {
+		return fmt.Errorf("server URL is required")
+	}
+	if !strings.HasPrefix(c.Server, "ws://") && !strings.HasPrefix(c.Server, "wss://") {
+		return fmt.Errorf("server URL must start with ws:// or wss://")
+	}
+	switch c.AuthMethod {
+	case "api_key":
+		if c.APIKey == "" {
+			return fmt.Errorf("api_key required for api_key auth")
+		}
+	case "device_token":
+		if c.DeviceToken == "" {
+			return fmt.Errorf("device_token required for device_token auth")
+		}
+	case "user_password":
+		if c.Username == "" || c.Password == "" {
+			return fmt.Errorf("username and password required for user_password auth")
+		}
+	default:
+		return fmt.Errorf("unknown auth method: %s (expected: api_key, device_token, user_password)", c.AuthMethod)
+	}
+	if c.HeartbeatSec < 5 {
+		c.HeartbeatSec = 5
+	}
+	if c.HeartbeatSec > 300 {
+		c.HeartbeatSec = 300
+	}
+	if c.ReconnectSec < 1 {
+		c.ReconnectSec = 1
+	}
+	if c.MaxReconnect < c.ReconnectSec {
+		c.MaxReconnect = c.ReconnectSec * 60
+	}
+	return nil
+}
+
+func defaultDataDir() string {
+	if runtime.GOOS == "windows" {
+		return filepath.Join(os.Getenv("ProgramData"), "BetterDesk", "Agent")
+	}
+	return "/var/lib/betterdesk-agent"
+}
diff --git a/betterdesk-agent/agent/filebrowser.go b/betterdesk-agent/agent/filebrowser.go
new file mode 100644
index 00000000..120072a0
--- /dev/null
+++ b/betterdesk-agent/agent/filebrowser.go
@@ -0,0 +1,157 @@
+package agent
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// FileEntry represents a single directory entry returned to the gateway.
+type FileEntry struct {
+	Name     string `json:"name"`
+	IsDir    bool   `json:"is_dir"`
+	Size     int64  `json:"size"`
+	Modified int64  `json:"modified"` // unix ms
+	Mode     string `json:"mode"`     // e.g. "drwxr-xr-x"
+}
+
+// safePath resolves a user-supplied path relative to root and prevents
+// directory traversal attacks. Returns the absolute path or an error.
+func safePath(root, userPath string) (string, error) {
+	// Clean the user path to remove .. and similar tricks
+	cleaned := filepath.Clean("/" + userPath)
+	abs := filepath.Join(root, cleaned)
+
+	// Ensure the result is still under root
+	absRoot, err := filepath.Abs(root)
+	if err != nil {
+		return "", fmt.Errorf("invalid root: %w", err)
+	}
+	absPath, err := filepath.Abs(abs)
+	if err != nil {
+		return "", fmt.Errorf("invalid path: %w", err)
+	}
+
+	if !strings.HasPrefix(absPath, absRoot) {
+		return "", fmt.Errorf("path traversal denied")
+	}
+	return absPath, nil
+}
+
+// ListDirectory lists the contents of a directory.
+func ListDirectory(root, path string) ([]FileEntry, error) {
+	dir, err := safePath(root, path)
+	if err != nil {
+		return nil, err
+	}
+
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return nil, fmt.Errorf("read dir: %w", err)
+	}
+
+	result := make([]FileEntry, 0, len(entries))
+	for _, e := range entries {
+		info, infoErr := e.Info()
+		if infoErr != nil {
+			continue
+		}
+		result = append(result, FileEntry{
+			Name:     e.Name(),
+			IsDir:    e.IsDir(),
+			Size:     info.Size(),
+			Modified: info.ModTime().UnixMilli(),
+			Mode:     info.Mode().String(),
+		})
+	}
+	return result, nil
+}
+
+// ReadFileChunk reads a segment of a file. Returns the data, total file
+// size, whether EOF has been reached, and any error.
+func ReadFileChunk(root, path string, offset, length int64) ([]byte, int64, bool, error) {
+	fp, err := safePath(root, path)
+	if err != nil {
+		return nil, 0, false, err
+	}
+
+	f, err := os.Open(fp)
+	if err != nil {
+		return nil, 0, false, fmt.Errorf("open: %w", err)
+	}
+	defer f.Close()
+
+	stat, err := f.Stat()
+	if err != nil {
+		return nil, 0, false, err
+	}
+	if stat.IsDir() {
+		return nil, 0, false, fmt.Errorf("cannot read directory")
+	}
+
+	totalSize := stat.Size()
+	if length <= 0 || length > 1024*1024 {
+		length = 64 * 1024 // 64 KB default chunk
+	}
+	if offset >= totalSize {
+		return nil, totalSize, true, nil
+	}
+
+	if _, err := f.Seek(offset, io.SeekStart); err != nil {
+		return nil, totalSize, false, err
+	}
+
+	buf := make([]byte, length)
+	n, readErr := f.Read(buf)
+	done := readErr == io.EOF || offset+int64(n) >= totalSize
+	if readErr != nil && readErr != io.EOF {
+		return nil, totalSize, false, readErr
+	}
+	return buf[:n], totalSize, done, nil
+}
+
+// WriteFileChunk writes data at the given offset in a file. Creates the
+// file (and parent directories) if it does not exist.
+func WriteFileChunk(root, path string, offset int64, data []byte) (int64, error) {
+	fp, err := safePath(root, path)
+	if err != nil {
+		return 0, err
+	}
+
+	// Ensure parent directory exists
+	if mkErr := os.MkdirAll(filepath.Dir(fp), 0755); mkErr != nil {
+		return 0, mkErr
+	}
+
+	flag := os.O_CREATE | os.O_WRONLY
+	f, err := os.OpenFile(fp, flag, 0644)
+	if err != nil {
+		return 0, err
+	}
+	defer f.Close()
+
+	if _, err := f.Seek(offset, io.SeekStart); err != nil {
+		return 0, err
+	}
+
+	n, err := f.Write(data)
+	return int64(n), err
+}
+
+// DeletePath removes a file or empty directory.
+func DeletePath(root, path string) error {
+	fp, err := safePath(root, path)
+	if err != nil {
+		return err
+	}
+
+	// Extra safety: never delete the root itself
+	absRoot, _ := filepath.Abs(root)
+	if fp == absRoot {
+		return fmt.Errorf("cannot delete root directory")
+	}
+
+	return os.Remove(fp)
+}
diff --git a/betterdesk-agent/agent/manifest.go b/betterdesk-agent/agent/manifest.go
new file mode 100644
index 00000000..f5d719db
--- /dev/null
+++ b/betterdesk-agent/agent/manifest.go
@@ -0,0 +1,181 @@
+package agent
+
+import (
+	"fmt"
+	"runtime"
+)
+
+// BuildManifest creates a CDAP device manifest from agent config and system info.
+func BuildManifest(cfg *Config, sys *SystemCollector, version string) map[string]any {
+	info := sys.GetInfo()
+
+	// Capabilities based on config
+	caps := []string{"telemetry", "commands"}
+	if cfg.Terminal {
+		caps = append(caps, "remote_desktop") // terminal is part of remote_desktop capability
+	}
+	if cfg.FileBrowser {
+		caps = append(caps, "file_transfer")
+	}
+	if cfg.Clipboard {
+		caps = append(caps, "clipboard")
+	}
+
+	// Build widgets
+	widgets := buildSystemWidgets(cfg)
+
+	// Build device descriptor
+	device := map[string]any{
+		"name":     cfg.DeviceName,
+		"type":     cfg.DeviceType,
+		"vendor":   "BetterDesk",
+		"model":    fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH),
+		"firmware": version,
+	}
+	if info.Hostname != "" {
+		device["name"] = info.Hostname
+	}
+	if cfg.DeviceName != "" {
+		device["name"] = cfg.DeviceName
+	}
+	if len(cfg.Tags) > 0 {
+		device["tags"] = cfg.Tags
+	}
+	device["description"] = fmt.Sprintf("%s %s %s (%s)", info.Platform, info.PlatformVersion, info.OS, info.Arch)
+
+	return map[string]any{
+		"manifest_version":   "1.0",
+		"device":             device,
+		"capabilities":       caps,
+		"heartbeat_interval": cfg.HeartbeatSec,
+		"widgets":            widgets,
+	}
+}
+
+func buildSystemWidgets(cfg *Config) []map[string]any {
+	var widgets []map[string]any
+
+	// CPU gauge
+	widgets = append(widgets, map[string]any{
+		"id":           "sys_cpu",
+		"type":         "gauge",
+		"label":        "CPU Usage",
+		"group":        "System",
+		"min":          0.0,
+		"max":          100.0,
+		"unit":         "%",
+		"warning_high": 70.0,
+		"precision":    1,
+		"permissions":  &map[string]string{"read": "viewer"},
+	})
+
+	// Memory gauge
+	widgets = append(widgets, map[string]any{
+		"id":           "sys_memory",
+		"type":         "gauge",
+		"label":        "Memory Usage",
+		"group":        "System",
+		"min":          0.0,
+		"max":          100.0,
+		"unit":         "%",
+		"warning_high": 80.0,
+		"precision":    1,
+		"permissions":  &map[string]string{"read": "viewer"},
+	})
+
+	// Disk gauge
+	widgets = append(widgets, map[string]any{
+		"id":           "sys_disk",
+		"type":         "gauge",
+		"label":        "Disk Usage",
+		"group":        "System",
+		"min":          0.0,
+		"max":          100.0,
+		"unit":         "%",
+		"warning_high": 85.0,
+		"precision":    1,
+		"permissions":  &map[string]string{"read": "viewer"},
+	})
+
+	// Uptime text
+	widgets = append(widgets, map[string]any{
+		"id":          "sys_uptime",
+		"type":        "text",
+		"label":       "Uptime",
+		"group":       "System",
+		"readonly":    true,
+		"permissions": &map[string]string{"read": "viewer"},
+	})
+
+	// Hostname text
+	widgets = append(widgets, map[string]any{
+		"id":          "sys_hostname",
+		"type":        "text",
+		"label":       "Hostname",
+		"group":       "System",
+		"readonly":    true,
+		"permissions": &map[string]string{"read": "viewer"},
+	})
+
+	// Terminal
+	if cfg.Terminal {
+		widgets = append(widgets, map[string]any{
+			"id":    "sys_terminal",
+			"type":  "terminal",
+			"label": "Terminal",
+			"group": "Access",
+			"permissions": &map[string]string{
+				"read":    "operator",
+				"control": "operator",
+				"execute": "admin",
+			},
+		})
+	}
+
+	// File browser
+	if cfg.FileBrowser {
+		widgets = append(widgets, map[string]any{
+			"id":    "sys_files",
+			"type":  "file_browser",
+			"label": "File Browser",
+			"group": "Access",
+			"permissions": &map[string]string{
+				"read":    "operator",
+				"control": "operator",
+				"execute": "admin",
+			},
+		})
+	}
+
+	// Screenshot button
+	if cfg.Screenshot {
+		widgets = append(widgets, map[string]any{
+			"id":      "sys_screenshot",
+			"type":    "button",
+			"label":   "Capture Screenshot",
+			"group":   "Tools",
+			"icon":    "screenshot_monitor",
+			"confirm": false,
+			"permissions": &map[string]string{
+				"control": "operator",
+			},
+		})
+	}
+
+	// Clipboard
+	if cfg.Clipboard {
+		widgets = append(widgets, map[string]any{
+			"id":       "sys_clipboard",
+			"type":     "text",
+			"label":    "Clipboard",
+			"group":    "Tools",
+			"readonly": false,
+			"permissions": &map[string]string{
+				"read":    "operator",
+				"control": "operator",
+			},
+		})
+	}
+
+	return widgets
+}
diff --git a/betterdesk-agent/agent/screenshot_unix.go b/betterdesk-agent/agent/screenshot_unix.go
new file mode 100644
index 00000000..f91e7330
--- /dev/null
+++ b/betterdesk-agent/agent/screenshot_unix.go
@@ -0,0 +1,50 @@
+//go:build !windows
+
+package agent
+
+import (
+	"fmt"
+	"os/exec"
+)
+
+// captureScreenshotPlatform captures a screenshot on Linux/macOS using
+// available command-line tools. Returns JPEG bytes.
+func captureScreenshotPlatform() ([]byte, error) {
+	// macOS: screencapture
+	if path, err := exec.LookPath("screencapture"); err == nil {
+		cmd := exec.Command(path, "-x", "-t", "jpg", "-")
+		out, err := cmd.Output()
+		if err == nil && len(out) > 0 {
+			return out, nil
+		}
+	}
+
+	// Linux: import (ImageMagick)
+	if path, err := exec.LookPath("import"); err == nil {
+		cmd := exec.Command(path, "-window", "root", "jpeg:-")
+		out, err := cmd.Output()
+		if err == nil && len(out) > 0 {
+			return out, nil
+		}
+	}
+
+	// Linux: scrot
+	if path, err := exec.LookPath("scrot"); err == nil {
+		cmd := exec.Command(path, "-o", "-", "--quality", "80")
+		out, err := cmd.Output()
+		if err == nil && len(out) > 0 {
+			return out, nil
+		}
+	}
+
+	// Linux: gnome-screenshot
+	if path, err := exec.LookPath("gnome-screenshot"); err == nil {
+		cmd := exec.Command(path, "-f", "/dev/stdout")
+		out, err := cmd.Output()
+		if err == nil && len(out) > 0 {
+			return out, nil
+		}
+	}
+
+	return nil, fmt.Errorf("no screenshot tool available (install scrot, ImageMagick, or gnome-screenshot)")
+}
diff --git a/betterdesk-agent/agent/screenshot_windows.go b/betterdesk-agent/agent/screenshot_windows.go
new file mode 100644
index 00000000..140f1583
--- /dev/null
+++ b/betterdesk-agent/agent/screenshot_windows.go
@@ -0,0 +1,38 @@
+//go:build windows
+
+package agent
+
+import (
+	"fmt"
+	"os/exec"
+)
+
+// captureScreenshotPlatform captures a screenshot on Windows using
+// PowerShell and .NET System.Drawing. Returns JPEG bytes.
+func captureScreenshotPlatform() ([]byte, error) {
+	// PowerShell script to capture the primary screen and write JPEG to stdout.
+	script := `
+Add-Type -AssemblyName System.Windows.Forms
+Add-Type -AssemblyName System.Drawing
+$screen = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds
+$bmp = New-Object System.Drawing.Bitmap($screen.Width, $screen.Height)
+$gfx = [System.Drawing.Graphics]::FromImage($bmp)
+$gfx.CopyFromScreen($screen.Location, [System.Drawing.Point]::Empty, $screen.Size)
+$gfx.Dispose()
+$ms = New-Object System.IO.MemoryStream
+$bmp.Save($ms, [System.Drawing.Imaging.ImageFormat]::Jpeg)
+$bmp.Dispose()
+$bytes = $ms.ToArray()
+$ms.Dispose()
+[System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length)
+`
+	cmd := exec.Command("powershell", "-NoProfile", "-NonInteractive", "-Command", script)
+	out, err := cmd.Output()
+	if err != nil {
+		return nil, fmt.Errorf("screenshot capture failed: %w", err)
+	}
+	if len(out) == 0 {
+		return nil, fmt.Errorf("screenshot returned empty data")
+	}
+	return out, nil
+}
diff --git a/betterdesk-agent/agent/system.go b/betterdesk-agent/agent/system.go
new file mode 100644
index 00000000..54f73145
--- /dev/null
+++ b/betterdesk-agent/agent/system.go
@@ -0,0 +1,121 @@
+package agent
+
+import (
+	"context"
+	"log"
+	"runtime"
+	"time"
+
+	"github.com/shirou/gopsutil/v3/cpu"
+	"github.com/shirou/gopsutil/v3/disk"
+	"github.com/shirou/gopsutil/v3/host"
+	"github.com/shirou/gopsutil/v3/mem"
+)
+
+// MetricsData mirrors the server-side MetricsData struct.
+type MetricsData struct {
+	CPU    float64 `json:"cpu"`
+	Memory float64 `json:"memory"`
+	Disk   float64 `json:"disk"`
+}
+
+// SystemInfo holds static system information used for manifest building.
+type SystemInfo struct {
+	Hostname        string
+	OS              string
+	Platform        string
+	PlatformVersion string
+	Arch            string
+	Uptime          uint64 // seconds
+	TotalMemory     uint64 // bytes
+	TotalDisk       uint64 // bytes
+}
+
+// SystemCollector gathers host metrics using gopsutil.
+type SystemCollector struct {
+	cachedInfo *SystemInfo
+}
+
+// NewSystemCollector creates a new collector that lazily caches static info.
+func NewSystemCollector() *SystemCollector {
+	return &SystemCollector{}
+}
+
+// Collect returns current CPU, memory, and disk usage percentages.
+func (sc *SystemCollector) Collect() *MetricsData {
+	m := &MetricsData{}
+
+	// CPU (1-second sample)
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	if pcts, err := cpu.PercentWithContext(ctx, time.Second, false); err == nil && len(pcts) > 0 {
+		m.CPU = pcts[0]
+	}
+
+	// Memory
+	if vm, err := mem.VirtualMemory(); err == nil {
+		m.Memory = vm.UsedPercent
+	}
+
+	// Disk (root partition)
+	rootPath := "/"
+	if runtime.GOOS == "windows" {
+		rootPath = "C:\\"
+	}
+	if du, err := disk.Usage(rootPath); err == nil {
+		m.Disk = du.UsedPercent
+	}
+
+	return m
+}
+
+// GetInfo returns static system information, cached after first call.
+func (sc *SystemCollector) GetInfo() *SystemInfo {
+	if sc.cachedInfo != nil {
+		return sc.cachedInfo
+	}
+
+	info := &SystemInfo{Arch: runtime.GOARCH}
+
+	if hi, err := host.Info(); err == nil {
+		info.Hostname = hi.Hostname
+		info.OS = hi.OS
+		info.Platform = hi.Platform
+		info.PlatformVersion = hi.PlatformVersion
+		info.Uptime = hi.Uptime
+	}
+
+	if vm, err := mem.VirtualMemory(); err == nil {
+		info.TotalMemory = vm.Total
+	}
+
+	rootPath := "/"
+	if runtime.GOOS == "windows" {
+		rootPath = "C:\\"
+	}
+	if du, err := disk.Usage(rootPath); err == nil {
+		info.TotalDisk = du.Total
+	}
+
+	sc.cachedInfo = info
+	return info
+}
+
+// Uptime returns the current system uptime in seconds.
+func (sc *SystemCollector) Uptime() uint64 {
+	if hi, err := host.Info(); err == nil {
+		return hi.Uptime
+	}
+	return 0
+}
+
+// CaptureScreenshot takes a screenshot using OS-specific commands.
+// Returns JPEG bytes or an error. This is a best-effort function.
+func CaptureScreenshot() ([]byte, error) {
+	return captureScreenshotPlatform()
+}
+
+func init() {
+	// Suppress gopsutil warnings on systems without certain features
+	log.SetFlags(log.LstdFlags | log.Lshortfile)
+}
diff --git a/betterdesk-agent/agent/terminal.go b/betterdesk-agent/agent/terminal.go
new file mode 100644
index 00000000..fe732f0f
--- /dev/null
+++ b/betterdesk-agent/agent/terminal.go
@@ -0,0 +1,33 @@
+package agent
+
+// TerminalSession wraps a platform-specific shell process.
+type TerminalSession struct {
+	ID       string
+	closeFn  func() error
+	writeFn  func([]byte) error
+	resizeFn func(int, int) error
+}
+
+// Write sends data to the shell's stdin.
+func (ts *TerminalSession) Write(data []byte) error {
+	if ts.writeFn != nil {
+		return ts.writeFn(data)
+	}
+	return nil
+}
+
+// Resize changes the terminal dimensions (cols × rows).
+func (ts *TerminalSession) Resize(cols, rows int) error {
+	if ts.resizeFn != nil {
+		return ts.resizeFn(cols, rows)
+	}
+	return nil
+}
+
+// Close shuts down the shell process.
+func (ts *TerminalSession) Close() error {
+	if ts.closeFn != nil {
+		return ts.closeFn()
+	}
+	return nil
+}
diff --git a/betterdesk-agent/agent/terminal_unix.go b/betterdesk-agent/agent/terminal_unix.go
new file mode 100644
index 00000000..d2112b61
--- /dev/null
+++ b/betterdesk-agent/agent/terminal_unix.go
@@ -0,0 +1,68 @@
+//go:build !windows
+
+package agent
+
+import (
+	"io"
+	"log"
+	"os"
+	"os/exec"
+
+	"github.com/creack/pty"
+)
+
+// StartTerminal spawns a PTY shell on Unix systems.
+func StartTerminal(id string, cols, rows int, shell string, onOutput func([]byte)) (*TerminalSession, error) {
+	if shell == "" {
+		shell = os.Getenv("SHELL")
+		if shell == "" {
+			shell = "/bin/sh"
+		}
+	}
+
+	cmd := exec.Command(shell)
+	cmd.Env = append(os.Environ(), "TERM=xterm-256color")
+
+	ptmx, err := pty.StartWithSize(cmd, &pty.Winsize{
+		Cols: uint16(cols),
+		Rows: uint16(rows),
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	// Read goroutine — stream PTY output to callback
+	go func() {
+		buf := make([]byte, 8192)
+		for {
+			n, readErr := ptmx.Read(buf)
+			if n > 0 {
+				chunk := make([]byte, n)
+				copy(chunk, buf[:n])
+				onOutput(chunk)
+			}
+			if readErr != nil {
+				if readErr != io.EOF {
+					log.Printf("[terminal:%s] Read error: %v", id, readErr)
+				}
+				break
+			}
+		}
+	}()
+
+	ts := &TerminalSession{
+		ID: id,
+		writeFn: func(data []byte) error {
+			_, err := ptmx.Write(data)
+			return err
+		},
+		resizeFn: func(c, r int) error {
+			return pty.Setsize(ptmx, &pty.Winsize{Cols: uint16(c), Rows: uint16(r)})
+		},
+		closeFn: func() error {
+			ptmx.Close()
+			return cmd.Process.Kill()
+		},
+	}
+	return ts, nil
+}
diff --git a/betterdesk-agent/agent/terminal_windows.go b/betterdesk-agent/agent/terminal_windows.go
new file mode 100644
index 00000000..70970ac7
--- /dev/null
+++ b/betterdesk-agent/agent/terminal_windows.go
@@ -0,0 +1,76 @@
+//go:build windows
+
+package agent
+
+import (
+	"io"
+	"log"
+	"os"
+	"os/exec"
+)
+
+// StartTerminal spawns a shell on Windows using pipes (no PTY).
+func StartTerminal(id string, cols, rows int, shell string, onOutput func([]byte)) (*TerminalSession, error) {
+	if shell == "" {
+		shell = os.Getenv("COMSPEC")
+		if shell == "" {
+			shell = "cmd.exe"
+		}
+	}
+
+	cmd := exec.Command(shell, "/Q")
+	cmd.Env = os.Environ()
+
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		return nil, err
+	}
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, err
+	}
+	stderr, err := cmd.StderrPipe()
+	if err != nil {
+		return nil, err
+	}
+
+	if err := cmd.Start(); err != nil {
+		return nil, err
+	}
+
+	readPipe := func(r io.ReadCloser) {
+		buf := make([]byte, 8192)
+		for {
+			n, readErr := r.Read(buf)
+			if n > 0 {
+				chunk := make([]byte, n)
+				copy(chunk, buf[:n])
+				onOutput(chunk)
+			}
+			if readErr != nil {
+				break
+			}
+		}
+	}
+
+	go readPipe(stdout)
+	go readPipe(stderr)
+
+	ts := &TerminalSession{
+		ID: id,
+		writeFn: func(data []byte) error {
+			_, err := stdin.Write(data)
+			return err
+		},
+		resizeFn: func(c, r int) error {
+			// Windows pipes do not support resize. ConPTY would be needed.
+			log.Printf("[terminal:%s] Resize not supported on Windows pipes", id)
+			return nil
+		},
+		closeFn: func() error {
+			stdin.Close()
+			return cmd.Process.Kill()
+		},
+	}
+	return ts, nil
+}
diff --git a/betterdesk-agent/go.mod b/betterdesk-agent/go.mod
new file mode 100644
index 00000000..ee410180
--- /dev/null
+++ b/betterdesk-agent/go.mod
@@ -0,0 +1,20 @@
+module github.com/unitronix/betterdesk-agent
+
+go 1.25.0
+
+require (
+	github.com/coder/websocket v1.8.14
+	github.com/creack/pty v1.1.24
+	github.com/shirou/gopsutil/v3 v3.24.5
+)
+
+require (
+	github.com/go-ole/go-ole v1.2.6 // indirect
+	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
+	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
+	github.com/shoenig/go-m1cpu v0.1.6 // indirect
+	github.com/tklauser/go-sysconf v0.3.12 // indirect
+	github.com/tklauser/numcpus v0.6.1 // indirect
+	github.com/yusufpapurcu/wmi v1.2.4 // indirect
+	golang.org/x/sys v0.20.0 // indirect
+)
diff --git a/betterdesk-agent/go.sum b/betterdesk-agent/go.sum
new file mode 100644
index 00000000..f2c328a2
--- /dev/null
+++ b/betterdesk-agent/go.sum
@@ -0,0 +1,40 @@
+github.com/coder/websocket v1.8.14 h1:9L0p0iKiNOibykf283eHkKUHHrpG7f65OE3BhhO7v9g=
+github.com/coder/websocket v1.8.14/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
+github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
+github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
+github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
+github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
+github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
+github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
+github.com/shirou/gopsutil/v3 v3.24.5 h1:i0t8kL+kQTvpAYToeuiVk3TgDeKOFioZO3Ztz/iZ9pI=
+github.com/shirou/gopsutil/v3 v3.24.5/go.mod h1:bsoOS1aStSs9ErQ1WWfxllSeS1K5D+U30r2NfcubMVk=
+github.com/shoenig/go-m1cpu v0.1.6 h1:nxdKQNcEB6vzgA2E2bvzKIYRuNj7XNJ4S/aRSwKzFtM=
+github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg9SUEw2VQ=
+github.com/shoenig/test v0.6.4 h1:kVTaSd7WLz5WZ2IaoM0RSzRsUD+m8wRR+5qvntpn4LU=
+github.com/shoenig/test v0.6.4/go.mod h1:byHiCGXqrVaflBLAMq/srcZIHynQPQgeyvkvXnjqq0k=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
+github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
+github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
+github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
+github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
+github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/betterdesk-agent/install/install.ps1 b/betterdesk-agent/install/install.ps1
new file mode 100644
index 00000000..5644becc
--- /dev/null
+++ b/betterdesk-agent/install/install.ps1
@@ -0,0 +1,150 @@
+# BetterDesk Agent — Windows installer (NSSM service)
+# Usage: Run as Administrator
+#   .\install.ps1 [-Server URL] [-Key KEY] [-Name NAME] [-Uninstall]
+[CmdletBinding()]
+param(
+    [string]$Server,
+    [string]$Key,
+    [string]$Name,
+    [string]$InstallDir = "$env:ProgramFiles\BetterDesk\Agent",
+    [switch]$Uninstall
+)
+
+$ErrorActionPreference = "Stop"
+$ServiceName = "BetterDeskAgent"
+$NSSMUrl = "https://nssm.cc/release/nssm-2.24.zip"
+
+function Test-Admin {
+    $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+    $principal = New-Object Security.Principal.WindowsPrincipal($identity)
+    return $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+}
+
+if (-not (Test-Admin)) {
+    Write-Host "ERROR: Run this script as Administrator" -ForegroundColor Red
+    exit 1
+}
+
+# Uninstall
+if ($Uninstall) {
+    Write-Host "=== Uninstalling BetterDesk Agent ===" -ForegroundColor Yellow
+    $nssmPath = "$InstallDir\nssm.exe"
+    if (Test-Path $nssmPath) {
+        & $nssmPath stop $ServiceName 2>$null
+        & $nssmPath remove $ServiceName confirm 2>$null
+    } elseif (Get-Service -Name $ServiceName -ErrorAction SilentlyContinue) {
+        Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue
+        sc.exe delete $ServiceName 2>$null
+    }
+    if (Test-Path $InstallDir) {
+        Remove-Item -Path $InstallDir -Recurse -Force
+    }
+    Write-Host "BetterDesk Agent uninstalled." -ForegroundColor Green
+    exit 0
+}
+
+# Find binary
+$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$BinaryPath = $null
+$Candidates = @(
+    (Join-Path (Split-Path $ScriptDir) "betterdesk-agent.exe"),
+    (Join-Path $ScriptDir "betterdesk-agent.exe")
+)
+foreach ($c in $Candidates) {
+    if (Test-Path $c) { $BinaryPath = $c; break }
+}
+if (-not $BinaryPath) {
+    Write-Host "ERROR: betterdesk-agent.exe not found. Build it first." -ForegroundColor Red
+    exit 1
+}
+
+Write-Host "=== Installing BetterDesk Agent ===" -ForegroundColor Cyan
+
+# Create directories
+New-Item -ItemType Directory -Path $InstallDir -Force | Out-Null
+New-Item -ItemType Directory -Path "$InstallDir\data" -Force | Out-Null
+
+# Copy binary
+Copy-Item -Path $BinaryPath -Destination "$InstallDir\betterdesk-agent.exe" -Force
+
+# Create config if not exists
+$ConfigFile = "$InstallDir\config.json"
+if (-not (Test-Path $ConfigFile)) {
+    if (-not $Server) {
+        $Server = Read-Host "Gateway WebSocket URL (ws://host:21122/cdap)"
+    }
+    if (-not $Key) {
+        $Key = Read-Host "API Key"
+    }
+    if (-not $Name) {
+        $Name = $env:COMPUTERNAME
+    }
+    $config = @{
+        server       = $Server
+        auth_method  = "api_key"
+        api_key      = $Key
+        device_name  = $Name
+        device_type  = "os_agent"
+        terminal     = $true
+        file_browser = $true
+        clipboard    = $true
+        screenshot   = $true
+        file_root    = "C:\"
+        heartbeat_sec = 15
+        reconnect_sec = 5
+        max_reconnect = 300
+        log_level    = "info"
+        data_dir     = "$InstallDir\data"
+    }
+    $config | ConvertTo-Json -Depth 5 | Set-Content -Path $ConfigFile -Encoding UTF8
+    Write-Host "Config created: $ConfigFile"
+} else {
+    Write-Host "Config exists, preserving: $ConfigFile"
+}
+
+# Install NSSM if not present
+$nssmPath = "$InstallDir\nssm.exe"
+if (-not (Test-Path $nssmPath)) {
+    Write-Host "Downloading NSSM..."
+    $zipPath = "$env:TEMP\nssm.zip"
+    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+    Invoke-WebRequest -Uri $NSSMUrl -OutFile $zipPath -UseBasicParsing
+    $extractDir = "$env:TEMP\nssm-extract"
+    Expand-Archive -Path $zipPath -DestinationPath $extractDir -Force
+    $nssmBin = Get-ChildItem -Path $extractDir -Recurse -Filter "nssm.exe" |
+        Where-Object { $_.DirectoryName -like "*win64*" } | Select-Object -First 1
+    if ($nssmBin) {
+        Copy-Item -Path $nssmBin.FullName -Destination $nssmPath -Force
+    } else {
+        Write-Host "ERROR: Failed to find nssm.exe in archive" -ForegroundColor Red
+        exit 1
+    }
+    Remove-Item $zipPath, $extractDir -Recurse -Force -ErrorAction SilentlyContinue
+}
+
+# Create service
+& $nssmPath stop $ServiceName 2>$null
+& $nssmPath remove $ServiceName confirm 2>$null
+
+& $nssmPath install $ServiceName "$InstallDir\betterdesk-agent.exe"
+& $nssmPath set $ServiceName AppParameters "-config `"$ConfigFile`""
+& $nssmPath set $ServiceName AppDirectory $InstallDir
+& $nssmPath set $ServiceName Start SERVICE_AUTO_START
+& $nssmPath set $ServiceName AppStdout "$InstallDir\data\agent.log"
+& $nssmPath set $ServiceName AppStderr "$InstallDir\data\agent.log"
+& $nssmPath set $ServiceName AppRotateFiles 1
+& $nssmPath set $ServiceName AppRotateBytes 10485760
+& $nssmPath set $ServiceName Description "BetterDesk CDAP Agent"
+
+& $nssmPath start $ServiceName
+
+Write-Host ""
+Write-Host "=== BetterDesk Agent Installed ===" -ForegroundColor Green
+Write-Host "  Binary:  $InstallDir\betterdesk-agent.exe"
+Write-Host "  Config:  $ConfigFile"
+Write-Host "  Service: $ServiceName"
+Write-Host ""
+Write-Host "Commands:"
+Write-Host "  nssm status $ServiceName"
+Write-Host "  nssm restart $ServiceName"
+Write-Host "  Get-Content $InstallDir\data\agent.log -Tail 50"
diff --git a/betterdesk-agent/install/install.sh b/betterdesk-agent/install/install.sh
new file mode 100644
index 00000000..c3eb707a
--- /dev/null
+++ b/betterdesk-agent/install/install.sh
@@ -0,0 +1,174 @@
+#!/usr/bin/env bash
+# BetterDesk Agent — Linux installer (systemd)
+# Usage: sudo ./install.sh [OPTIONS]
+#   -s URL        Gateway WebSocket URL
+#   -k KEY        API key
+#   -n NAME       Device name
+#   -d DIR        Install directory (default: /opt/betterdesk-agent)
+#   -u            Uninstall
+set -euo pipefail
+
+INSTALL_DIR="/opt/betterdesk-agent"
+SERVICE_NAME="betterdesk-agent"
+USER_NAME="betterdesk-agent"
+CONFIG_FILE=""
+SERVER_URL=""
+API_KEY=""
+DEVICE_NAME=""
+UNINSTALL=false
+
+usage() {
+    echo "Usage: sudo $0 [-s URL] [-k KEY] [-n NAME] [-d DIR] [-u]"
+    echo "  -s URL   Gateway WebSocket URL (ws://host:21122/cdap)"
+    echo "  -k KEY   API key for authentication"
+    echo "  -n NAME  Device name (default: hostname)"
+    echo "  -d DIR   Install directory (default: /opt/betterdesk-agent)"
+    echo "  -u       Uninstall"
+    exit 1
+}
+
+while getopts "s:k:n:d:uh" opt; do
+    case $opt in
+        s) SERVER_URL="$OPTARG" ;;
+        k) API_KEY="$OPTARG" ;;
+        n) DEVICE_NAME="$OPTARG" ;;
+        d) INSTALL_DIR="$OPTARG" ;;
+        u) UNINSTALL=true ;;
+        h|*) usage ;;
+    esac
+done
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "ERROR: This script must be run as root (sudo)"
+    exit 1
+fi
+
+uninstall() {
+    echo "=== Uninstalling BetterDesk Agent ==="
+    systemctl stop "$SERVICE_NAME" 2>/dev/null || true
+    systemctl disable "$SERVICE_NAME" 2>/dev/null || true
+    rm -f "/etc/systemd/system/${SERVICE_NAME}.service"
+    systemctl daemon-reload
+    if id "$USER_NAME" &>/dev/null; then
+        userdel "$USER_NAME" 2>/dev/null || true
+    fi
+    rm -rf "$INSTALL_DIR"
+    echo "BetterDesk Agent uninstalled."
+    exit 0
+}
+
+if $UNINSTALL; then
+    uninstall
+fi
+
+# Detect binary
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+BINARY=""
+if [ -f "${SCRIPT_DIR}/../betterdesk-agent-linux-amd64" ] && [ "$(uname -m)" = "x86_64" ]; then
+    BINARY="${SCRIPT_DIR}/../betterdesk-agent-linux-amd64"
+elif [ -f "${SCRIPT_DIR}/../betterdesk-agent" ]; then
+    BINARY="${SCRIPT_DIR}/../betterdesk-agent"
+else
+    echo "ERROR: Agent binary not found. Build it first: go build -o betterdesk-agent ."
+    exit 1
+fi
+
+echo "=== Installing BetterDesk Agent ==="
+
+# Create service user
+if ! id "$USER_NAME" &>/dev/null; then
+    useradd --system --no-create-home --shell /usr/sbin/nologin "$USER_NAME"
+    echo "Created service user: $USER_NAME"
+fi
+
+# Install binary
+mkdir -p "$INSTALL_DIR"
+cp "$BINARY" "${INSTALL_DIR}/betterdesk-agent"
+chmod 755 "${INSTALL_DIR}/betterdesk-agent"
+
+# Create data directory
+mkdir -p "${INSTALL_DIR}/data"
+chown -R "$USER_NAME:$USER_NAME" "${INSTALL_DIR}/data"
+
+# Create config if not exists
+CONFIG_FILE="${INSTALL_DIR}/config.json"
+if [ ! -f "$CONFIG_FILE" ]; then
+    if [ -z "$SERVER_URL" ]; then
+        read -rp "Gateway WebSocket URL (ws://host:21122/cdap): " SERVER_URL
+    fi
+    if [ -z "$API_KEY" ]; then
+        read -rp "API Key: " API_KEY
+    fi
+    if [ -z "$DEVICE_NAME" ]; then
+        DEVICE_NAME="$(hostname)"
+    fi
+
+    cat > "$CONFIG_FILE" <<JSONEOF
+{
+  "server": "${SERVER_URL}",
+  "auth_method": "api_key",
+  "api_key": "${API_KEY}",
+  "device_name": "${DEVICE_NAME}",
+  "device_type": "os_agent",
+  "terminal": true,
+  "file_browser": true,
+  "clipboard": true,
+  "screenshot": true,
+  "file_root": "/",
+  "heartbeat_sec": 15,
+  "reconnect_sec": 5,
+  "max_reconnect": 300,
+  "log_level": "info",
+  "data_dir": "${INSTALL_DIR}/data"
+}
+JSONEOF
+    chmod 600 "$CONFIG_FILE"
+    chown "$USER_NAME:$USER_NAME" "$CONFIG_FILE"
+    echo "Config created: $CONFIG_FILE"
+else
+    echo "Config exists, preserving: $CONFIG_FILE"
+fi
+
+# Create systemd service
+cat > "/etc/systemd/system/${SERVICE_NAME}.service" <<EOF
+[Unit]
+Description=BetterDesk CDAP Agent
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=${USER_NAME}
+Group=${USER_NAME}
+ExecStart=${INSTALL_DIR}/betterdesk-agent -config ${CONFIG_FILE}
+Restart=always
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=${SERVICE_NAME}
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=read-only
+ReadWritePaths=${INSTALL_DIR}/data
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable "$SERVICE_NAME"
+systemctl start "$SERVICE_NAME"
+
+echo ""
+echo "=== BetterDesk Agent Installed ==="
+echo "  Binary:  ${INSTALL_DIR}/betterdesk-agent"
+echo "  Config:  ${CONFIG_FILE}"
+echo "  Service: ${SERVICE_NAME}"
+echo ""
+echo "Commands:"
+echo "  systemctl status  $SERVICE_NAME"
+echo "  journalctl -u $SERVICE_NAME -f"
+echo "  systemctl restart $SERVICE_NAME"
diff --git a/betterdesk-agent/main.go b/betterdesk-agent/main.go
new file mode 100644
index 00000000..a3383668
--- /dev/null
+++ b/betterdesk-agent/main.go
@@ -0,0 +1,106 @@
+// BetterDesk Agent — CDAP device agent for system monitoring, terminal,
+// file browser, and clipboard sync.
+//
+// Usage:
+//
+//	betterdesk-agent -server ws://host:21122/cdap -auth api_key -key YOUR_KEY
+//	betterdesk-agent -config /etc/betterdesk-agent.json
+package main
+
+import (
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/unitronix/betterdesk-agent/agent"
+)
+
+var version = "1.0.0"
+
+func main() {
+	var (
+		configFile = flag.String("config", "", "Config file path (JSON)")
+		server     = flag.String("server", "", "Gateway WebSocket URL (ws://host:21122/cdap)")
+		authMethod = flag.String("auth", "", "Auth method: api_key, device_token, user_password")
+		apiKey     = flag.String("key", "", "API key")
+		devToken   = flag.String("token", "", "Device enrollment token")
+		username   = flag.String("user", "", "Username")
+		password   = flag.String("pass", "", "Password")
+		deviceID   = flag.String("device-id", "", "Device ID (default: auto)")
+		deviceName = flag.String("device-name", "", "Device name (default: hostname)")
+		deviceType = flag.String("device-type", "", "Device type (default: os_agent)")
+		logLevel   = flag.String("log-level", "", "Log level: debug, info, warning, error")
+		dataDir    = flag.String("data-dir", "", "Data directory")
+		showVer    = flag.Bool("version", false, "Print version and exit")
+	)
+	flag.Parse()
+
+	if *showVer {
+		fmt.Printf("betterdesk-agent %s\n", version)
+		os.Exit(0)
+	}
+
+	cfg, err := agent.LoadConfig(*configFile)
+	if err != nil {
+		log.Fatalf("Config error: %v", err)
+	}
+
+	// CLI flags override config file
+	if *server != "" {
+		cfg.Server = *server
+	}
+	if *authMethod != "" {
+		cfg.AuthMethod = *authMethod
+	}
+	if *apiKey != "" {
+		cfg.APIKey = *apiKey
+	}
+	if *devToken != "" {
+		cfg.DeviceToken = *devToken
+	}
+	if *username != "" {
+		cfg.Username = *username
+	}
+	if *password != "" {
+		cfg.Password = *password
+	}
+	if *deviceID != "" {
+		cfg.DeviceID = *deviceID
+	}
+	if *deviceName != "" {
+		cfg.DeviceName = *deviceName
+	}
+	if *deviceType != "" {
+		cfg.DeviceType = *deviceType
+	}
+	if *logLevel != "" {
+		cfg.LogLevel = *logLevel
+	}
+	if *dataDir != "" {
+		cfg.DataDir = *dataDir
+	}
+
+	if err := cfg.Validate(); err != nil {
+		log.Fatalf("Config validation: %v", err)
+	}
+
+	log.Printf("[agent] BetterDesk Agent %s starting (device: %s, type: %s)", version, cfg.DeviceName, cfg.DeviceType)
+
+	a := agent.New(cfg, version)
+
+	// Graceful shutdown on SIGINT/SIGTERM
+	sigCh := make(chan os.Signal, 1)
+	signal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM)
+	go func() {
+		<-sigCh
+		log.Println("[agent] Shutting down...")
+		a.Stop()
+	}()
+
+	if err := a.Run(); err != nil {
+		log.Fatalf("[agent] Fatal: %v", err)
+	}
+}
diff --git a/betterdesk-docker.sh b/betterdesk-docker.sh
index e6806ece..6023cc4b 100644
--- a/betterdesk-docker.sh
+++ b/betterdesk-docker.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 #===============================================================================
 #
-#   BetterDesk Console Manager v2.4.0
+#   BetterDesk Console Manager v3.0.0
 #   All-in-One Interactive Tool for Docker
 #
 #   Features:
@@ -14,8 +14,9 @@
 #     - Build custom images
 #     - Full diagnostics
 #     - Migrate from existing RustDesk Docker
-#     - PostgreSQL database support (new in v2.4.0)
+#     - PostgreSQL database support
 #     - SQLite to PostgreSQL migration
+#     - CDAP (Custom Device API Protocol) support
 #
 #   Usage: ./betterdesk-docker.sh
 #
@@ -24,7 +25,7 @@
 set -e
 
 # Version
-VERSION="2.4.0"
+VERSION="3.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # Default paths (can be overridden by environment variables)
diff --git a/betterdesk-server/admin/server.go b/betterdesk-server/admin/server.go
index e6b8a59f..779e740f 100644
--- a/betterdesk-server/admin/server.go
+++ b/betterdesk-server/admin/server.go
@@ -135,6 +135,8 @@ func (s *Server) handleConn(conn net.Conn) {
 			return
 		}
 		if subtle.ConstantTimeCompare([]byte(strings.TrimSpace(scanner.Text())), []byte(s.adminPassword)) != 1 {
+			// BD-2026-011: Delay after failed auth to slow brute-force attempts
+			time.Sleep(2 * time.Second)
 			fmt.Fprintln(conn, "Authentication failed.")
 			log.Printf("[admin] Authentication failed from %s", remote)
 			return
diff --git a/betterdesk-server/api/auth_handlers.go b/betterdesk-server/api/auth_handlers.go
index 6b5c42ac..2402fc5d 100644
--- a/betterdesk-server/api/auth_handlers.go
+++ b/betterdesk-server/api/auth_handlers.go
@@ -9,6 +9,7 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"log"
 	"net/http"
 	"strconv"
 	"time"
@@ -631,6 +632,10 @@ func (s *Server) authenticateRequest(r *http.Request) (username, role string, ok
 	apiKey := r.Header.Get("X-API-Key")
 	if apiKey == "" {
 		apiKey = r.URL.Query().Get("api_key")
+		if apiKey != "" {
+			// BD-2026-005: Deprecation warning for query-param API keys
+			log.Printf("[SECURITY] DEPRECATED: API key passed via query parameter from %s %s — use X-API-Key header instead", r.Method, r.URL.Path)
+		}
 	}
 	if apiKey != "" {
 		keyHash := hashAPIKey(apiKey)
@@ -649,6 +654,8 @@ func (s *Server) authenticateRequest(r *http.Request) (username, role string, ok
 		// 3. Legacy: match against config table's api_key value (full admin access)
 		storedKey, _ := s.db.GetConfig("api_key")
 		if storedKey != "" && subtle.ConstantTimeCompare([]byte(apiKey), []byte(storedKey)) == 1 {
+			// BD-2026-005: Deprecation warning for legacy config-table API key
+			log.Printf("[SECURITY] DEPRECATED: Legacy config-table API key used from %s — migrate to scoped api_keys table", s.remoteIP(r))
 			return "legacy_apikey", auth.RoleAdmin, true
 		}
 	}
@@ -670,7 +677,9 @@ func (s *Server) authMiddleware(next http.Handler) http.Handler {
 			path == "/api/auth/login" || path == "/api/auth/login/2fa" ||
 			path == "/api/server/pubkey" || path == "/api/server/stats" ||
 			path == "/api/login" || path == "/api/login-options" || path == "/api/logout" ||
-			path == "/api/heartbeat" || path == "/api/sysinfo" || path == "/api/sysinfo_ver" {
+			path == "/api/heartbeat" || path == "/api/sysinfo" || path == "/api/sysinfo_ver" ||
+			path == "/api/branding" ||
+			path == "/api/devices/register" || path == "/api/devices/register/status" {
 			next.ServeHTTP(w, r)
 			return
 		}
diff --git a/betterdesk-server/api/branding_handlers.go b/betterdesk-server/api/branding_handlers.go
new file mode 100644
index 00000000..65dabbb7
--- /dev/null
+++ b/betterdesk-server/api/branding_handlers.go
@@ -0,0 +1,607 @@
+package api
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/unitronix/betterdesk-server/db"
+	"github.com/unitronix/betterdesk-server/events"
+)
+
+// ---------------------------------------------------------------------------
+//  Branding configuration — served to desktop clients (public, no auth)
+// ---------------------------------------------------------------------------
+
+// BrandingConfig is the payload returned by GET /api/branding.
+// Desktop clients fetch this to apply company theming.
+type BrandingConfig struct {
+	CompanyName    string            `json:"company_name"`
+	AccentColor    string            `json:"accent_color"`
+	SupportContact string            `json:"support_contact"`
+	Colors         map[string]string `json:"colors,omitempty"`
+	SyncModes      []SyncModeOption  `json:"sync_modes"`
+}
+
+// SyncModeOption describes a sync speed tier for enrollment approval UI.
+type SyncModeOption struct {
+	ID          string `json:"id"`
+	Label       string `json:"label"`
+	Description string `json:"description"`
+}
+
+var defaultSyncModes = []SyncModeOption{
+	{ID: "silent", Label: "Silent", Description: "Minimal telemetry — CPU/RAM every 60s, no software scan"},
+	{ID: "standard", Label: "Standard", Description: "Balanced — 30s telemetry, 5min disk, 6h software"},
+	{ID: "turbo", Label: "Turbo", Description: "Aggressive — 10s telemetry, 1min disk, 30min software"},
+}
+
+// handleGetBranding returns the branding configuration.
+// Public endpoint — no authentication required.
+// GET /api/branding
+func (s *Server) handleGetBranding(w http.ResponseWriter, r *http.Request) {
+	cfg := BrandingConfig{
+		CompanyName:    "BetterDesk",
+		AccentColor:    "#4f6ef7",
+		SupportContact: "",
+		SyncModes:      defaultSyncModes,
+	}
+
+	// Load overrides from server_config
+	if v, err := s.db.GetConfig("branding_company_name"); err == nil && v != "" {
+		cfg.CompanyName = v
+	}
+	if v, err := s.db.GetConfig("branding_accent_color"); err == nil && v != "" {
+		cfg.AccentColor = v
+	}
+	if v, err := s.db.GetConfig("branding_support_contact"); err == nil && v != "" {
+		cfg.SupportContact = v
+	}
+	if v, err := s.db.GetConfig("branding_colors"); err == nil && v != "" {
+		var colors map[string]string
+		if json.Unmarshal([]byte(v), &colors) == nil {
+			cfg.Colors = colors
+		}
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(cfg)
+}
+
+// handleSaveBranding saves branding configuration. Admin only.
+// POST /api/branding
+func (s *Server) handleSaveBranding(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		CompanyName    *string           `json:"company_name"`
+		AccentColor    *string           `json:"accent_color"`
+		SupportContact *string           `json:"support_contact"`
+		Colors         map[string]string `json:"colors"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid JSON", http.StatusBadRequest)
+		return
+	}
+
+	if req.CompanyName != nil {
+		s.db.SetConfig("branding_company_name", *req.CompanyName)
+	}
+	if req.AccentColor != nil {
+		s.db.SetConfig("branding_accent_color", *req.AccentColor)
+	}
+	if req.SupportContact != nil {
+		s.db.SetConfig("branding_support_contact", *req.SupportContact)
+	}
+	if req.Colors != nil {
+		if data, err := json.Marshal(req.Colors); err == nil {
+			s.db.SetConfig("branding_colors", string(data))
+		}
+	}
+
+	if s.auditLog != nil {
+		s.auditLog.Log("branding_updated", s.remoteIP(r), getUsernameFromCtx(r), nil)
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]interface{}{"success": true})
+}
+
+// ---------------------------------------------------------------------------
+//  Device enrollment — desktop client self-registration
+// ---------------------------------------------------------------------------
+
+// EnrollmentRequest is sent by the BetterDesk desktop client on first connect.
+type EnrollmentRequest struct {
+	DeviceID   string `json:"device_id"`
+	UUID       string `json:"uuid"`
+	Hostname   string `json:"hostname"`
+	Platform   string `json:"platform"`
+	Version    string `json:"version"`
+	DeviceType string `json:"device_type,omitempty"` // "betterdesk", "rustdesk", "os_agent", etc.
+	PublicKey  string `json:"public_key,omitempty"`
+	Token      string `json:"token,omitempty"` // Optional enrollment token
+}
+
+// EnrollmentResponse is returned to the desktop client.
+type EnrollmentResponse struct {
+	Status        string         `json:"status"` // approved, pending, rejected
+	DeviceID      string         `json:"device_id"`
+	ServerTime    int64          `json:"server_time"`
+	SyncMode      string         `json:"sync_mode,omitempty"`      // silent, standard, turbo
+	DisplayName   string         `json:"display_name,omitempty"`   // Operator-assigned name
+	Branding      *BrandingConfig `json:"branding,omitempty"`      // Inline branding
+	ServerKey     string         `json:"server_key,omitempty"`     // Ed25519 public key (base64)
+	HeartbeatSec  int            `json:"heartbeat_interval"`       // Heartbeat interval
+	Message       string         `json:"message,omitempty"`        // Human-readable message
+}
+
+// handleDeviceRegister handles desktop client self-registration.
+// POST /api/devices/register
+//
+// In "open" mode: device is immediately approved.
+// In "managed" mode: device is placed in pending state until operator approves.
+// In "locked" mode: device needs a valid enrollment token.
+func (s *Server) handleDeviceRegister(w http.ResponseWriter, r *http.Request) {
+	var req EnrollmentRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid JSON", http.StatusBadRequest)
+		return
+	}
+
+	if req.DeviceID == "" {
+		http.Error(w, "device_id is required", http.StatusBadRequest)
+		return
+	}
+
+	clientIP := s.remoteIP(r)
+	mode := s.cfg.EnrollmentMode
+	if mode == "" {
+		mode = "open"
+	}
+
+	// Check if device already exists (re-registration = always approve)
+	existing, _ := s.db.GetPeer(req.DeviceID)
+	if existing != nil {
+		// Device already known — return approved with current config
+		syncMode, _ := s.db.GetConfig("device_sync_mode_" + req.DeviceID)
+		if syncMode == "" {
+			syncMode = "standard"
+		}
+		displayName, _ := s.db.GetConfig("device_display_name_" + req.DeviceID)
+
+		resp := s.buildEnrollmentResponse("approved", req.DeviceID, syncMode, displayName)
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(resp)
+		return
+	}
+
+	// Check if banned or soft-deleted
+	if banned, _ := s.db.IsPeerBanned(req.DeviceID); banned {
+		resp := EnrollmentResponse{
+			Status:   "rejected",
+			DeviceID: req.DeviceID,
+			Message:  "Device is banned",
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusForbidden)
+		json.NewEncoder(w).Encode(resp)
+		return
+	}
+
+	switch mode {
+	case "open":
+		// Auto-approve: create peer immediately
+		s.createPeerFromEnrollment(&req, clientIP)
+		resp := s.buildEnrollmentResponse("approved", req.DeviceID, "standard", "")
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(resp)
+
+		if s.auditLog != nil {
+			s.auditLog.Log("device_enrolled", clientIP, req.DeviceID, map[string]string{
+				"mode": "open", "hostname": req.Hostname,
+			})
+		}
+
+	case "managed":
+		// Check for valid token first
+		if req.Token != "" {
+			if tok, err := s.db.GetDeviceTokenByPeerID(req.DeviceID); err == nil && tok != nil {
+				// Token exists — auto-approve
+				s.createPeerFromEnrollment(&req, clientIP)
+				resp := s.buildEnrollmentResponse("approved", req.DeviceID, "standard", "")
+				w.Header().Set("Content-Type", "application/json")
+				json.NewEncoder(w).Encode(resp)
+				return
+			}
+		}
+
+		// Store as pending
+		s.storePendingDevice(&req, clientIP)
+		resp := EnrollmentResponse{
+			Status:       "pending",
+			DeviceID:     req.DeviceID,
+			ServerTime:   timeNowUnixMilli(),
+			HeartbeatSec: 5, // Poll faster while pending
+			Message:      "Waiting for operator approval",
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusAccepted)
+		json.NewEncoder(w).Encode(resp)
+
+		if s.auditLog != nil {
+			s.auditLog.Log("device_pending", clientIP, req.DeviceID, map[string]string{
+				"hostname": req.Hostname, "platform": req.Platform,
+			})
+		}
+
+		// Emit event for web panel real-time update
+		if s.eventBus != nil {
+			s.eventBus.Publish(events.Event{
+				Type: "device_pending",
+				Data: map[string]string{
+					"device_id": req.DeviceID,
+					"hostname":  req.Hostname,
+					"platform":  req.Platform,
+					"ip":        clientIP,
+				},
+			})
+		}
+
+	case "locked":
+		resp := EnrollmentResponse{
+			Status:   "rejected",
+			DeviceID: req.DeviceID,
+			Message:  "Enrollment is locked — a valid token is required",
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusForbidden)
+		json.NewEncoder(w).Encode(resp)
+	}
+}
+
+// handleDeviceRegisterStatus lets the client poll its enrollment status.
+// GET /api/devices/register/status?device_id=X
+func (s *Server) handleDeviceRegisterStatus(w http.ResponseWriter, r *http.Request) {
+	deviceID := r.URL.Query().Get("device_id")
+	if deviceID == "" {
+		http.Error(w, "device_id query param required", http.StatusBadRequest)
+		return
+	}
+
+	// Check if approved (exists in peers table)
+	if peer, _ := s.db.GetPeer(deviceID); peer != nil {
+		syncMode, _ := s.db.GetConfig("device_sync_mode_" + deviceID)
+		if syncMode == "" {
+			syncMode = "standard"
+		}
+		displayName, _ := s.db.GetConfig("device_display_name_" + deviceID)
+		resp := s.buildEnrollmentResponse("approved", deviceID, syncMode, displayName)
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(resp)
+		return
+	}
+
+	// Check if pending
+	pending, _ := s.db.GetConfig("pending_device_" + deviceID)
+	if pending != "" {
+		resp := EnrollmentResponse{
+			Status:       "pending",
+			DeviceID:     deviceID,
+			ServerTime:   timeNowUnixMilli(),
+			HeartbeatSec: 5,
+			Message:      "Waiting for operator approval",
+		}
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(resp)
+		return
+	}
+
+	// Check if explicitly rejected
+	rejected, _ := s.db.GetConfig("rejected_device_" + deviceID)
+	if rejected != "" {
+		resp := EnrollmentResponse{
+			Status:   "rejected",
+			DeviceID: deviceID,
+			Message:  "Device enrollment was rejected",
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusForbidden)
+		json.NewEncoder(w).Encode(resp)
+		return
+	}
+
+	// Unknown — not registered
+	resp := EnrollmentResponse{
+		Status:   "unknown",
+		DeviceID: deviceID,
+		Message:  "Device not found — register first",
+	}
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusNotFound)
+	json.NewEncoder(w).Encode(resp)
+}
+
+// ---------------------------------------------------------------------------
+//  Enrollment management — operator approval (admin/operator only)
+// ---------------------------------------------------------------------------
+
+// handleListPendingDevices returns all pending enrollment requests.
+// GET /api/enrollment/pending
+func (s *Server) handleListPendingDevices(w http.ResponseWriter, r *http.Request) {
+	// Pending devices are stored as server_config entries: pending_device_<id> = JSON
+	// We scan all config keys with this prefix.
+	// Note: For production scale, a dedicated table would be better.
+	// Using server_config for now since it's available and simple.
+
+	type PendingDevice struct {
+		DeviceID  string `json:"device_id"`
+		Hostname  string `json:"hostname"`
+		Platform  string `json:"platform"`
+		Version   string `json:"version"`
+		IP        string `json:"ip"`
+		CreatedAt string `json:"created_at"`
+	}
+
+	// List all pending_ entries
+	pending := s.listPendingDevices()
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]interface{}{
+		"devices": pending,
+		"count":   len(pending),
+	})
+}
+
+// handleApproveDevice approves a pending enrollment request.
+// POST /api/enrollment/approve/{id}
+func (s *Server) handleApproveDevice(w http.ResponseWriter, r *http.Request) {
+	deviceID := r.PathValue("id")
+	if deviceID == "" {
+		http.Error(w, "Device ID required", http.StatusBadRequest)
+		return
+	}
+
+	var req struct {
+		DisplayName string `json:"display_name"`
+		SyncMode    string `json:"sync_mode"` // silent, standard, turbo
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid JSON", http.StatusBadRequest)
+		return
+	}
+
+	// Validate sync mode
+	syncMode := strings.ToLower(req.SyncMode)
+	if syncMode == "" {
+		syncMode = "standard"
+	}
+	if syncMode != "silent" && syncMode != "standard" && syncMode != "turbo" {
+		http.Error(w, "Invalid sync_mode (silent, standard, turbo)", http.StatusBadRequest)
+		return
+	}
+
+	// Load pending device data
+	pendingJSON, _ := s.db.GetConfig("pending_device_" + deviceID)
+	if pendingJSON == "" {
+		http.Error(w, "Device not found in pending list", http.StatusNotFound)
+		return
+	}
+
+	var pending struct {
+		DeviceID  string `json:"device_id"`
+		UUID      string `json:"uuid"`
+		Hostname  string `json:"hostname"`
+		Platform  string `json:"platform"`
+		Version   string `json:"version"`
+		PublicKey string `json:"public_key"`
+		IP        string `json:"ip"`
+		CreatedAt string `json:"created_at"`
+	}
+	json.Unmarshal([]byte(pendingJSON), &pending)
+
+	// Create the peer
+	enrollment := &EnrollmentRequest{
+		DeviceID:  pending.DeviceID,
+		UUID:      pending.UUID,
+		Hostname:  pending.Hostname,
+		Platform:  pending.Platform,
+		Version:   pending.Version,
+		PublicKey: pending.PublicKey,
+	}
+	s.createPeerFromEnrollment(enrollment, pending.IP)
+
+	// Store sync mode and display name
+	s.db.SetConfig("device_sync_mode_"+deviceID, syncMode)
+	if req.DisplayName != "" {
+		s.db.SetConfig("device_display_name_"+deviceID, req.DisplayName)
+		// Also update the peer's note field for display
+		s.db.UpdatePeerFields(deviceID, map[string]string{"note": req.DisplayName})
+	}
+
+	// Remove from pending
+	s.db.DeleteConfig("pending_device_" + deviceID)
+
+	if s.auditLog != nil {
+		s.auditLog.Log("device_approved", s.remoteIP(r), getUsernameFromCtx(r), map[string]string{
+			"device_id": deviceID, "sync_mode": syncMode, "display_name": req.DisplayName,
+		})
+	}
+
+	// Emit event for real-time push
+	if s.eventBus != nil {
+		s.eventBus.Publish(events.Event{
+			Type: "device_approved",
+			Data: map[string]string{
+				"device_id":    deviceID,
+				"sync_mode":    syncMode,
+				"display_name": req.DisplayName,
+			},
+		})
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]interface{}{
+		"success":   true,
+		"device_id": deviceID,
+		"sync_mode": syncMode,
+	})
+}
+
+// handleRejectDevice rejects a pending enrollment request.
+// POST /api/enrollment/reject/{id}
+func (s *Server) handleRejectDevice(w http.ResponseWriter, r *http.Request) {
+	deviceID := r.PathValue("id")
+	if deviceID == "" {
+		http.Error(w, "Device ID required", http.StatusBadRequest)
+		return
+	}
+
+	// Remove from pending
+	s.db.DeleteConfig("pending_device_" + deviceID)
+	// Store rejection marker (so status poll returns "rejected")
+	s.db.SetConfig("rejected_device_"+deviceID, `{"rejected":true}`)
+
+	if s.auditLog != nil {
+		s.auditLog.Log("device_rejected", s.remoteIP(r), getUsernameFromCtx(r), map[string]string{
+			"device_id": deviceID,
+		})
+	}
+
+	if s.eventBus != nil {
+		s.eventBus.Publish(events.Event{
+			Type: "device_rejected",
+			Data: map[string]string{
+				"device_id": deviceID,
+			},
+		})
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]interface{}{"success": true})
+}
+
+// ---------------------------------------------------------------------------
+//  Internal helpers
+// ---------------------------------------------------------------------------
+
+func (s *Server) buildEnrollmentResponse(status, deviceID, syncMode, displayName string) EnrollmentResponse {
+	resp := EnrollmentResponse{
+		Status:       status,
+		DeviceID:     deviceID,
+		ServerTime:   timeNowUnixMilli(),
+		SyncMode:     syncMode,
+		DisplayName:  displayName,
+		HeartbeatSec: 15,
+	}
+
+	// Inline branding
+	branding := &BrandingConfig{
+		CompanyName:    "BetterDesk",
+		AccentColor:    "#4f6ef7",
+		SupportContact: "",
+		SyncModes:      defaultSyncModes,
+	}
+	if v, _ := s.db.GetConfig("branding_company_name"); v != "" {
+		branding.CompanyName = v
+	}
+	if v, _ := s.db.GetConfig("branding_accent_color"); v != "" {
+		branding.AccentColor = v
+	}
+	if v, _ := s.db.GetConfig("branding_support_contact"); v != "" {
+		branding.SupportContact = v
+	}
+	if v, _ := s.db.GetConfig("branding_colors"); v != "" {
+		var colors map[string]string
+		if json.Unmarshal([]byte(v), &colors) == nil {
+			branding.Colors = colors
+		}
+	}
+	resp.Branding = branding
+
+	// Server public key
+	if s.keyPair != nil {
+		resp.ServerKey = s.keyPair.PublicKeyBase64()
+	}
+
+	return resp
+}
+
+func (s *Server) createPeerFromEnrollment(req *EnrollmentRequest, clientIP string) {
+	devType := req.DeviceType
+	if devType == "" {
+		devType = "betterdesk"
+	}
+
+	s.db.UpsertPeer(&db.Peer{
+		ID:         req.DeviceID,
+		UUID:       req.UUID,
+		IP:         clientIP,
+		Hostname:   req.Hostname,
+		OS:         req.Platform,
+		Version:    req.Version,
+		DeviceType: devType,
+		Status:     "ONLINE",
+	})
+
+	// Update sysinfo fields separately (handles non-empty check)
+	if req.Hostname != "" || req.Platform != "" || req.Version != "" {
+		s.db.UpdatePeerSysinfo(req.DeviceID, req.Hostname, req.Platform, req.Version)
+	}
+
+	// Persist device_type via UpdatePeerFields
+	s.db.UpdatePeerFields(req.DeviceID, map[string]string{"device_type": devType})
+}
+
+type pendingDeviceInfo struct {
+	DeviceID  string `json:"device_id"`
+	Hostname  string `json:"hostname"`
+	Platform  string `json:"platform"`
+	Version   string `json:"version"`
+	IP        string `json:"ip"`
+	CreatedAt string `json:"created_at"`
+}
+
+func (s *Server) storePendingDevice(req *EnrollmentRequest, clientIP string) {
+	info := pendingDeviceInfo{
+		DeviceID:  req.DeviceID,
+		Hostname:  req.Hostname,
+		Platform:  req.Platform,
+		Version:   req.Version,
+		IP:        clientIP,
+		CreatedAt: timeNowISO(),
+	}
+	data, _ := json.Marshal(info)
+	s.db.SetConfig("pending_device_"+req.DeviceID, string(data))
+}
+
+func (s *Server) listPendingDevices() []pendingDeviceInfo {
+	// This is a pragmatic approach using server_config.
+	// For a production system with thousands of pending devices,
+	// a dedicated table would be more efficient.
+	var result []pendingDeviceInfo
+
+	// We need to query all server_config keys starting with "pending_device_"
+	// Since the DB interface doesn't have a ListConfigByPrefix, we'll add a helper.
+	configs, err := s.db.ListConfigByPrefix("pending_device_")
+	if err != nil {
+		log.Printf("[API] listPendingDevices: %v", err)
+		return result
+	}
+
+	for _, cfg := range configs {
+		var info pendingDeviceInfo
+		if json.Unmarshal([]byte(cfg.Value), &info) == nil {
+			result = append(result, info)
+		}
+	}
+	return result
+}
+
+func timeNowUnixMilli() int64 {
+	return time.Now().UnixMilli()
+}
+
+func timeNowISO() string {
+	return time.Now().UTC().Format(time.RFC3339)
+}
diff --git a/betterdesk-server/api/cdap_handlers.go b/betterdesk-server/api/cdap_handlers.go
index f31b264d..b5bcd102 100644
--- a/betterdesk-server/api/cdap_handlers.go
+++ b/betterdesk-server/api/cdap_handlers.go
@@ -1,13 +1,16 @@
 package api
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"log"
 	"net/http"
 	"regexp"
 	"sync/atomic"
+	"time"
 
+	"github.com/coder/websocket"
 	"github.com/unitronix/betterdesk-server/cdap"
 )
 
@@ -140,6 +143,34 @@ func (s *Server) handleCDAPSendCommand(w http.ResponseWriter, r *http.Request) {
 	}
 
 	operator := getUsernameFromCtx(r)
+	operatorRole := getRoleFromCtx(r)
+
+	// RBAC per-widget check: verify the operator's role has sufficient
+	// privilege for the requested action on this widget.
+	// Check delegation store for elevated access first.
+	widget := s.cdapGw.GetWidget(id, body.WidgetID)
+	if widget == nil {
+		writeJSON(w, http.StatusNotFound, map[string]string{"error": "Widget not found on device"})
+		return
+	}
+
+	effectiveRole := operatorRole
+	if delegated := s.cdapGw.Delegations().GetEffectiveRole(operator, id, body.WidgetID); delegated != "" {
+		if cdap.RoleLevel(delegated) > cdap.RoleLevel(effectiveRole) {
+			effectiveRole = delegated
+		}
+	}
+
+	if !cdap.CheckWidgetPermission(effectiveRole, body.Action, widget) {
+		log.Printf("[cdap-api] RBAC denied: %s (role=%s, effective=%s) action=%s on widget %s/%s", operator, operatorRole, effectiveRole, body.Action, id, body.WidgetID)
+		writeJSON(w, http.StatusForbidden, map[string]string{
+			"error":     "Insufficient permissions for this widget action",
+			"required":  cdap.EffectivePermissions(widget).Control,
+			"your_role": effectiveRole,
+		})
+		return
+	}
+
 	commandID := fmt.Sprintf("cmd_%s_%d", id, commandCounter.Add(1))
 
 	if err := s.cdapGw.SendCommandJSON(r.Context(), id, commandID, body.WidgetID, body.Action, body.Value, operator, body.Reason); err != nil {
@@ -196,3 +227,711 @@ func (s *Server) handleCDAPStatus(w http.ResponseWriter, r *http.Request) {
 		"tls":       s.cfg.CDAPTLSEnabled(),
 	})
 }
+
+// handleCDAPAlerts returns all currently firing CDAP alerts.
+// GET /api/cdap/alerts?device_id=optional
+func (s *Server) handleCDAPAlerts(w http.ResponseWriter, r *http.Request) {
+	if s.cdapGw == nil {
+		writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "CDAP gateway not enabled"})
+		return
+	}
+
+	deviceID := r.URL.Query().Get("device_id")
+	alerts := s.cdapGw.GetActiveAlerts(deviceID)
+	if alerts == nil {
+		alerts = make([]*cdap.AlertState, 0)
+	}
+
+	writeJSON(w, http.StatusOK, map[string]any{
+		"alerts": alerts,
+		"total":  len(alerts),
+	})
+}
+
+// handleCDAPDelegateCreate creates a new auth delegation.
+// POST /api/cdap/delegate
+func (s *Server) handleCDAPDelegateCreate(w http.ResponseWriter, r *http.Request) {
+	if s.cdapGw == nil {
+		writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "CDAP gateway not enabled"})
+		return
+	}
+
+	// Only admins can create delegations
+	role := getRoleFromCtx(r)
+	if role != "admin" {
+		writeJSON(w, http.StatusForbidden, map[string]string{"error": "Only admins can create delegations"})
+		return
+	}
+
+	var body struct {
+		Grantee   string   `json:"grantee"`
+		DeviceID  string   `json:"device_id"`
+		WidgetIDs []string `json:"widget_ids"` // empty = all widgets
+		Role      string   `json:"role"`       // operator or admin
+		Duration  int      `json:"duration"`   // seconds, max 86400 (24h)
+		Reason    string   `json:"reason"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "Invalid request body"})
+		return
+	}
+
+	if body.Grantee == "" || body.DeviceID == "" || body.Role == "" {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "grantee, device_id, and role are required"})
+		return
+	}
+
+	if body.Role != "operator" && body.Role != "admin" {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "role must be 'operator' or 'admin'"})
+		return
+	}
+
+	if body.Duration <= 0 || body.Duration > 86400 {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "duration must be 1-86400 seconds"})
+		return
+	}
+
+	if !cdapDeviceIDRegexp.MatchString(body.DeviceID) {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "Invalid device ID"})
+		return
+	}
+
+	grantor := getUsernameFromCtx(r)
+	delegationID := fmt.Sprintf("dlg_%d", commandCounter.Add(1))
+
+	d := &cdap.Delegation{
+		ID:        delegationID,
+		Grantor:   grantor,
+		Grantee:   body.Grantee,
+		DeviceID:  body.DeviceID,
+		WidgetIDs: body.WidgetIDs,
+		Role:      body.Role,
+		ExpiresAt: time.Now().Add(time.Duration(body.Duration) * time.Second),
+		CreatedAt: time.Now(),
+		Reason:    body.Reason,
+	}
+
+	if err := s.cdapGw.Delegations().Add(d); err != nil {
+		writeJSON(w, http.StatusConflict, map[string]string{"error": err.Error()})
+		return
+	}
+
+	log.Printf("[cdap-api] Delegation created: %s granted %s role=%s on device=%s by %s", delegationID, body.Grantee, body.Role, body.DeviceID, grantor)
+
+	if s.auditLog != nil {
+		s.auditLog.Log("cdap_delegation_created", s.remoteIP(r), grantor, map[string]string{
+			"delegation_id": delegationID,
+			"grantee":       body.Grantee,
+			"device_id":     body.DeviceID,
+			"role":          body.Role,
+			"duration":      fmt.Sprintf("%ds", body.Duration),
+		})
+	}
+
+	writeJSON(w, http.StatusCreated, d)
+}
+
+// handleCDAPDelegateRevoke revokes an active delegation.
+// DELETE /api/cdap/delegate/{id}
+func (s *Server) handleCDAPDelegateRevoke(w http.ResponseWriter, r *http.Request) {
+	if s.cdapGw == nil {
+		writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "CDAP gateway not enabled"})
+		return
+	}
+
+	role := getRoleFromCtx(r)
+	if role != "admin" {
+		writeJSON(w, http.StatusForbidden, map[string]string{"error": "Only admins can manage delegations"})
+		return
+	}
+
+	id := r.PathValue("id")
+	if id == "" {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "Delegation ID required"})
+		return
+	}
+
+	if !s.cdapGw.Delegations().Revoke(id) {
+		writeJSON(w, http.StatusNotFound, map[string]string{"error": "Delegation not found or already expired"})
+		return
+	}
+
+	if s.auditLog != nil {
+		s.auditLog.Log("cdap_delegation_revoked", s.remoteIP(r), getUsernameFromCtx(r), map[string]string{
+			"delegation_id": id,
+		})
+	}
+
+	writeJSON(w, http.StatusOK, map[string]string{"status": "revoked", "id": id})
+}
+
+// handleCDAPDelegateList returns all active delegations.
+// GET /api/cdap/delegations
+func (s *Server) handleCDAPDelegateList(w http.ResponseWriter, r *http.Request) {
+	if s.cdapGw == nil {
+		writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "CDAP gateway not enabled"})
+		return
+	}
+
+	role := getRoleFromCtx(r)
+	if role != "admin" {
+		writeJSON(w, http.StatusForbidden, map[string]string{"error": "Only admins can view all delegations"})
+		return
+	}
+
+	delegations := s.cdapGw.Delegations().ListAll()
+	if delegations == nil {
+		delegations = make([]*cdap.Delegation, 0)
+	}
+
+	writeJSON(w, http.StatusOK, map[string]any{
+		"delegations": delegations,
+		"total":       len(delegations),
+	})
+}
+
+// handleCDAPTerminal upgrades the HTTP connection to a WebSocket and
+// relays terminal I/O between the browser and a CDAP device.
+// GET /api/cdap/devices/{id}/terminal
+func (s *Server) handleCDAPTerminal(w http.ResponseWriter, r *http.Request) {
+	if s.cdapGw == nil {
+		writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "CDAP gateway not enabled"})
+		return
+	}
+
+	id := r.PathValue("id")
+	if !cdapDeviceIDRegexp.MatchString(id) {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "Invalid device ID"})
+		return
+	}
+
+	username := getUsernameFromCtx(r)
+	role := getRoleFromCtx(r)
+
+	// RBAC: only admins (or delegated users) can open terminal sessions
+	effectiveRole := role
+	if s.cdapGw.Delegations() != nil {
+		if delegated := s.cdapGw.Delegations().GetEffectiveRole(username, id, "terminal"); delegated != "" {
+			if cdap.RoleLevel(delegated) > cdap.RoleLevel(effectiveRole) {
+				effectiveRole = delegated
+			}
+		}
+	}
+	if effectiveRole != "admin" {
+		writeJSON(w, http.StatusForbidden, map[string]string{"error": "Terminal access requires admin role"})
+		return
+	}
+
+	// Accept WebSocket upgrade
+	wsConn, err := websocket.Accept(w, r, &websocket.AcceptOptions{
+		Subprotocols: []string{"cdap-terminal"},
+	})
+	if err != nil {
+		log.Printf("[cdap] Terminal WS upgrade failed for device %s: %v", id, err)
+		return // Accept already wrote the HTTP error
+	}
+	defer wsConn.CloseNow()
+
+	ctx, cancel := context.WithCancel(r.Context())
+	defer cancel()
+
+	// Read initial message from browser with terminal dimensions
+	_, initData, err := wsConn.Read(ctx)
+	if err != nil {
+		log.Printf("[cdap] Terminal init read failed for device %s: %v", id, err)
+		wsConn.Close(websocket.StatusProtocolError, "expected init message")
+		return
+	}
+
+	var initMsg struct {
+		Cols int `json:"cols"`
+		Rows int `json:"rows"`
+	}
+	if err := json.Unmarshal(initData, &initMsg); err != nil {
+		wsConn.Close(websocket.StatusProtocolError, "invalid init message")
+		return
+	}
+	if initMsg.Cols < 1 {
+		initMsg.Cols = 80
+	}
+	if initMsg.Rows < 1 {
+		initMsg.Rows = 24
+	}
+
+	// Start terminal session on the device
+	session, err := s.cdapGw.StartTerminalSession(ctx, wsConn, id, username, role, initMsg.Cols, initMsg.Rows)
+	if err != nil {
+		errMsg, _ := json.Marshal(map[string]string{
+			"type":  "error",
+			"error": fmt.Sprintf("Failed to start terminal: %v", err),
+		})
+		wsConn.Write(ctx, websocket.MessageText, errMsg)
+		wsConn.Close(websocket.StatusInternalError, "terminal start failed")
+		return
+	}
+
+	// Notify browser that session is ready
+	readyMsg, _ := json.Marshal(map[string]string{
+		"type":       "ready",
+		"session_id": session.ID,
+	})
+	if err := wsConn.Write(ctx, websocket.MessageText, readyMsg); err != nil {
+		s.cdapGw.EndTerminalSession(ctx, session.ID, "browser write failed")
+		return
+	}
+
+	// Read loop: relay browser input/resize to device
+	for {
+		_, msgData, err := wsConn.Read(ctx)
+		if err != nil {
+			s.cdapGw.EndTerminalSession(ctx, session.ID, "browser disconnected")
+			return
+		}
+
+		var msg struct {
+			Type string `json:"type"`
+			Data string `json:"data,omitempty"`
+			Cols int    `json:"cols,omitempty"`
+			Rows int    `json:"rows,omitempty"`
+		}
+		if err := json.Unmarshal(msgData, &msg); err != nil {
+			continue // skip malformed messages
+		}
+
+		switch msg.Type {
+		case "input":
+			if err := s.cdapGw.RelayTerminalInput(ctx, session.ID, msg.Data); err != nil {
+				s.cdapGw.EndTerminalSession(ctx, session.ID, "relay input failed")
+				return
+			}
+		case "resize":
+			if msg.Cols > 0 && msg.Rows > 0 {
+				s.cdapGw.RelayTerminalResize(ctx, session.ID, msg.Cols, msg.Rows)
+			}
+		case "close":
+			s.cdapGw.EndTerminalSession(ctx, session.ID, "user closed terminal")
+			return
+		}
+	}
+}
+
+// handleCDAPDesktop handles WebSocket connections for remote desktop sessions.
+func (s *Server) handleCDAPDesktop(w http.ResponseWriter, r *http.Request) {
+	if s.cdapGw == nil {
+		writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "CDAP gateway not enabled"})
+		return
+	}
+
+	id := r.PathValue("id")
+	if !cdapDeviceIDRegexp.MatchString(id) {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "Invalid device ID"})
+		return
+	}
+
+	username := getUsernameFromCtx(r)
+	role := getRoleFromCtx(r)
+
+	effectiveRole := role
+	if s.cdapGw.Delegations() != nil {
+		if delegated := s.cdapGw.Delegations().GetEffectiveRole(username, id, "desktop"); delegated != "" {
+			if cdap.RoleLevel(delegated) > cdap.RoleLevel(effectiveRole) {
+				effectiveRole = delegated
+			}
+		}
+	}
+	if effectiveRole != "admin" {
+		writeJSON(w, http.StatusForbidden, map[string]string{"error": "Desktop access requires admin role"})
+		return
+	}
+
+	wsConn, err := websocket.Accept(w, r, &websocket.AcceptOptions{
+		Subprotocols: []string{"cdap-desktop"},
+	})
+	if err != nil {
+		log.Printf("[cdap] Desktop WS upgrade failed for device %s: %v", id, err)
+		return
+	}
+	defer wsConn.CloseNow()
+
+	ctx, cancel := context.WithCancel(r.Context())
+	defer cancel()
+
+	// Read init message with viewport size and quality preferences
+	_, initData, err := wsConn.Read(ctx)
+	if err != nil {
+		wsConn.Close(websocket.StatusProtocolError, "expected init message")
+		return
+	}
+
+	var initMsg struct {
+		Width   int `json:"width"`
+		Height  int `json:"height"`
+		Quality int `json:"quality"`
+		FPS     int `json:"fps"`
+	}
+	if err := json.Unmarshal(initData, &initMsg); err != nil {
+		wsConn.Close(websocket.StatusProtocolError, "invalid init message")
+		return
+	}
+
+	session, err := s.cdapGw.StartDesktopSession(ctx, wsConn, id, username, role, initMsg.Width, initMsg.Height, initMsg.Quality, initMsg.FPS)
+	if err != nil {
+		errMsg, _ := json.Marshal(map[string]string{"type": "error", "error": fmt.Sprintf("Failed to start desktop: %v", err)})
+		wsConn.Write(ctx, websocket.MessageText, errMsg)
+		wsConn.Close(websocket.StatusInternalError, "desktop start failed")
+		return
+	}
+
+	readyMsg, _ := json.Marshal(map[string]string{"type": "ready", "session_id": session.ID})
+	if err := wsConn.Write(ctx, websocket.MessageText, readyMsg); err != nil {
+		s.cdapGw.EndDesktopSession(ctx, session.ID, "browser write failed")
+		return
+	}
+
+	for {
+		_, msgData, err := wsConn.Read(ctx)
+		if err != nil {
+			s.cdapGw.EndDesktopSession(ctx, session.ID, "browser disconnected")
+			return
+		}
+
+		var msg struct {
+			Type      string          `json:"type"`
+			InputType string          `json:"input_type,omitempty"`
+			X         int             `json:"x,omitempty"`
+			Y         int             `json:"y,omitempty"`
+			Button    int             `json:"button,omitempty"`
+			Key       string          `json:"key,omitempty"`
+			Code      string          `json:"code,omitempty"`
+			Modifiers int             `json:"modifiers,omitempty"`
+			DeltaX    int             `json:"delta_x,omitempty"`
+			DeltaY    int             `json:"delta_y,omitempty"`
+			Width     int             `json:"width,omitempty"`
+			Height    int             `json:"height,omitempty"`
+			Format    string          `json:"format,omitempty"`
+			Data      string          `json:"data,omitempty"`
+			SessionID string          `json:"session_id,omitempty"`
+			Index     int             `json:"index,omitempty"`
+			Raw       json.RawMessage `json:"-"`
+		}
+		if err := json.Unmarshal(msgData, &msg); err != nil {
+			continue
+		}
+		msg.Raw = json.RawMessage(msgData)
+
+		switch msg.Type {
+		case "input":
+			input := &cdap.DesktopInputPayload{
+				InputType: msg.InputType,
+				X:         msg.X,
+				Y:         msg.Y,
+				Button:    msg.Button,
+				Key:       msg.Key,
+				Code:      msg.Code,
+				Modifiers: msg.Modifiers,
+				DeltaX:    msg.DeltaX,
+				DeltaY:    msg.DeltaY,
+			}
+			if err := s.cdapGw.RelayDesktopInput(ctx, session.ID, input); err != nil {
+				s.cdapGw.EndDesktopSession(ctx, session.ID, "relay input failed")
+				return
+			}
+		case "resize":
+			if msg.Width > 0 && msg.Height > 0 {
+				s.cdapGw.RelayDesktopResize(ctx, session.ID, msg.Width, msg.Height)
+			}
+		case "clipboard_set":
+			if msg.Format != "" && msg.Data != "" {
+				s.cdapGw.RelayClipboard(ctx, id, session.ID, msg.Format, msg.Data)
+			}
+		case "quality_report":
+			s.cdapGw.HandleQualityReport(ctx, session.ID, msg.Raw)
+		case "codec_offer":
+			s.cdapGw.RelayCodecOffer(ctx, session.ID, msg.Raw)
+		case "key_exchange":
+			s.cdapGw.RelayKeyExchangeToDevice(ctx, session.ID, msg.Raw)
+		case "keyframe_request":
+			s.cdapGw.RelayKeyframeRequest(ctx, session.ID)
+		case "monitor_select":
+			s.cdapGw.RelayMonitorSelect(ctx, session.ID, msg.Index)
+		case "close":
+			s.cdapGw.EndDesktopSession(ctx, session.ID, "user closed desktop")
+			return
+		}
+	}
+}
+
+// handleCDAPVideo handles WebSocket connections for video stream sessions.
+func (s *Server) handleCDAPVideo(w http.ResponseWriter, r *http.Request) {
+	if s.cdapGw == nil {
+		writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "CDAP gateway not enabled"})
+		return
+	}
+
+	id := r.PathValue("id")
+	if !cdapDeviceIDRegexp.MatchString(id) {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "Invalid device ID"})
+		return
+	}
+
+	username := getUsernameFromCtx(r)
+	role := getRoleFromCtx(r)
+
+	wsConn, err := websocket.Accept(w, r, &websocket.AcceptOptions{
+		Subprotocols: []string{"cdap-video"},
+	})
+	if err != nil {
+		log.Printf("[cdap] Video WS upgrade failed for device %s: %v", id, err)
+		return
+	}
+	defer wsConn.CloseNow()
+
+	ctx, cancel := context.WithCancel(r.Context())
+	defer cancel()
+
+	_, initData, err := wsConn.Read(ctx)
+	if err != nil {
+		wsConn.Close(websocket.StatusProtocolError, "expected init message")
+		return
+	}
+
+	var initMsg struct {
+		StreamID string `json:"stream_id"`
+		Quality  int    `json:"quality"`
+		FPS      int    `json:"fps"`
+	}
+	if err := json.Unmarshal(initData, &initMsg); err != nil {
+		wsConn.Close(websocket.StatusProtocolError, "invalid init message")
+		return
+	}
+
+	session, err := s.cdapGw.StartVideoSession(ctx, wsConn, id, username, role, initMsg.StreamID, initMsg.Quality, initMsg.FPS)
+	if err != nil {
+		errMsg, _ := json.Marshal(map[string]string{"type": "error", "error": fmt.Sprintf("Failed to start video: %v", err)})
+		wsConn.Write(ctx, websocket.MessageText, errMsg)
+		wsConn.Close(websocket.StatusInternalError, "video start failed")
+		return
+	}
+
+	readyMsg, _ := json.Marshal(map[string]string{"type": "ready", "session_id": session.ID})
+	if err := wsConn.Write(ctx, websocket.MessageText, readyMsg); err != nil {
+		s.cdapGw.EndVideoSession(ctx, session.ID, "browser write failed")
+		return
+	}
+
+	// Read loop: only handle close messages (video is unidirectional)
+	for {
+		_, msgData, err := wsConn.Read(ctx)
+		if err != nil {
+			s.cdapGw.EndVideoSession(ctx, session.ID, "browser disconnected")
+			return
+		}
+
+		var msg struct {
+			Type string `json:"type"`
+		}
+		if json.Unmarshal(msgData, &msg) == nil {
+			switch msg.Type {
+			case "close":
+				s.cdapGw.EndVideoSession(ctx, session.ID, "user closed video")
+				return
+			case "quality_report":
+				s.cdapGw.HandleQualityReport(ctx, session.ID, json.RawMessage(msgData))
+			case "codec_offer":
+				s.cdapGw.RelayCodecOffer(ctx, session.ID, json.RawMessage(msgData))
+			case "key_exchange":
+				s.cdapGw.RelayKeyExchangeToDevice(ctx, session.ID, json.RawMessage(msgData))
+			case "keyframe_request":
+				s.cdapGw.RelayKeyframeRequest(ctx, session.ID)
+			}
+		}
+	}
+}
+
+// handleCDAPFileBrowser handles WebSocket connections for file browser sessions.
+func (s *Server) handleCDAPFileBrowser(w http.ResponseWriter, r *http.Request) {
+	if s.cdapGw == nil {
+		writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "CDAP gateway not enabled"})
+		return
+	}
+
+	id := r.PathValue("id")
+	if !cdapDeviceIDRegexp.MatchString(id) {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "Invalid device ID"})
+		return
+	}
+
+	username := getUsernameFromCtx(r)
+	role := getRoleFromCtx(r)
+
+	effectiveRole := role
+	if s.cdapGw.Delegations() != nil {
+		if delegated := s.cdapGw.Delegations().GetEffectiveRole(username, id, "file_browser"); delegated != "" {
+			if cdap.RoleLevel(delegated) > cdap.RoleLevel(effectiveRole) {
+				effectiveRole = delegated
+			}
+		}
+	}
+	if effectiveRole != "admin" {
+		writeJSON(w, http.StatusForbidden, map[string]string{"error": "File browser access requires admin role"})
+		return
+	}
+
+	wsConn, err := websocket.Accept(w, r, &websocket.AcceptOptions{
+		Subprotocols: []string{"cdap-filebrowser"},
+	})
+	if err != nil {
+		log.Printf("[cdap] File browser WS upgrade failed for device %s: %v", id, err)
+		return
+	}
+	defer wsConn.CloseNow()
+
+	ctx, cancel := context.WithCancel(r.Context())
+	defer cancel()
+
+	session, err := s.cdapGw.StartFileSession(ctx, wsConn, id, username, role)
+	if err != nil {
+		errMsg, _ := json.Marshal(map[string]string{"type": "error", "error": fmt.Sprintf("Failed to start file browser: %v", err)})
+		wsConn.Write(ctx, websocket.MessageText, errMsg)
+		wsConn.Close(websocket.StatusInternalError, "file start failed")
+		return
+	}
+
+	readyMsg, _ := json.Marshal(map[string]string{"type": "ready", "session_id": session.ID})
+	if err := wsConn.Write(ctx, websocket.MessageText, readyMsg); err != nil {
+		s.cdapGw.EndFileSession(ctx, session.ID, "browser write failed")
+		return
+	}
+
+	for {
+		_, msgData, err := wsConn.Read(ctx)
+		if err != nil {
+			s.cdapGw.EndFileSession(ctx, session.ID, "browser disconnected")
+			return
+		}
+
+		var msg struct {
+			Type string          `json:"type"`
+			Data json.RawMessage `json:"data,omitempty"`
+		}
+		if err := json.Unmarshal(msgData, &msg); err != nil {
+			continue
+		}
+
+		switch msg.Type {
+		case "file_list", "file_read", "file_write", "file_delete":
+			if err := s.cdapGw.RelayFileRequest(ctx, session.ID, msg.Type, msg.Data); err != nil {
+				s.cdapGw.EndFileSession(ctx, session.ID, "relay request failed")
+				return
+			}
+		case "close":
+			s.cdapGw.EndFileSession(ctx, session.ID, "user closed file browser")
+			return
+		}
+	}
+}
+
+// handleCDAPAudio handles WebSocket connections for audio stream sessions.
+// GET /api/cdap/devices/{id}/audio
+func (s *Server) handleCDAPAudio(w http.ResponseWriter, r *http.Request) {
+	if s.cdapGw == nil {
+		writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "CDAP gateway not enabled"})
+		return
+	}
+
+	id := r.PathValue("id")
+	if !cdapDeviceIDRegexp.MatchString(id) {
+		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "Invalid device ID"})
+		return
+	}
+
+	username := getUsernameFromCtx(r)
+	role := getRoleFromCtx(r)
+
+	// RBAC: operator+ can access audio streams
+	effectiveRole := role
+	if s.cdapGw.Delegations() != nil {
+		if delegated := s.cdapGw.Delegations().GetEffectiveRole(username, id, "audio"); delegated != "" {
+			if cdap.RoleLevel(delegated) > cdap.RoleLevel(effectiveRole) {
+				effectiveRole = delegated
+			}
+		}
+	}
+	if cdap.RoleLevel(effectiveRole) < cdap.RoleLevel("operator") {
+		writeJSON(w, http.StatusForbidden, map[string]string{"error": "Audio access requires operator role"})
+		return
+	}
+
+	wsConn, err := websocket.Accept(w, r, &websocket.AcceptOptions{
+		Subprotocols: []string{"cdap-audio"},
+	})
+	if err != nil {
+		log.Printf("[cdap] Audio WS upgrade failed for device %s: %v", id, err)
+		return
+	}
+	defer wsConn.CloseNow()
+
+	ctx, cancel := context.WithCancel(r.Context())
+	defer cancel()
+
+	_, initData, err := wsConn.Read(ctx)
+	if err != nil {
+		wsConn.Close(websocket.StatusProtocolError, "expected init message")
+		return
+	}
+
+	var initMsg struct {
+		Codec      string `json:"codec"`
+		SampleRate int    `json:"sample_rate"`
+		Channels   int    `json:"channels"`
+		Direction  string `json:"direction"`
+	}
+	if err := json.Unmarshal(initData, &initMsg); err != nil {
+		wsConn.Close(websocket.StatusProtocolError, "invalid init message")
+		return
+	}
+
+	session, err := s.cdapGw.StartAudioSession(ctx, wsConn, id, username, role, initMsg.Codec, initMsg.SampleRate, initMsg.Channels, initMsg.Direction)
+	if err != nil {
+		errMsg, _ := json.Marshal(map[string]string{"type": "error", "error": fmt.Sprintf("Failed to start audio: %v", err)})
+		wsConn.Write(ctx, websocket.MessageText, errMsg)
+		wsConn.Close(websocket.StatusInternalError, "audio start failed")
+		return
+	}
+
+	readyMsg, _ := json.Marshal(map[string]string{"type": "ready", "session_id": session.ID})
+	if err := wsConn.Write(ctx, websocket.MessageText, readyMsg); err != nil {
+		s.cdapGw.EndAudioSession(ctx, session.ID, "browser write failed")
+		return
+	}
+
+	for {
+		_, msgData, err := wsConn.Read(ctx)
+		if err != nil {
+			s.cdapGw.EndAudioSession(ctx, session.ID, "browser disconnected")
+			return
+		}
+
+		var msg struct {
+			Type      string `json:"type"`
+			Codec     string `json:"codec,omitempty"`
+			Data      string `json:"data,omitempty"`
+			Timestamp int64  `json:"timestamp,omitempty"`
+		}
+		if err := json.Unmarshal(msgData, &msg); err != nil {
+			continue
+		}
+
+		switch msg.Type {
+		case "audio_input":
+			if msg.Data != "" {
+				s.cdapGw.RelayAudioInput(ctx, session.ID, msg.Codec, msg.Data, msg.Timestamp)
+			}
+		case "key_exchange":
+			s.cdapGw.RelayKeyExchangeToDevice(ctx, session.ID, json.RawMessage(msgData))
+		case "close":
+			s.cdapGw.EndAudioSession(ctx, session.ID, "user closed audio")
+			return
+		}
+	}
+}
diff --git a/betterdesk-server/api/client_api_handlers.go b/betterdesk-server/api/client_api_handlers.go
index 0d893824..753cd0df 100644
--- a/betterdesk-server/api/client_api_handlers.go
+++ b/betterdesk-server/api/client_api_handlers.go
@@ -440,6 +440,13 @@ func (s *Server) handleClientAddressBookTags(w http.ResponseWriter, r *http.Requ
 //
 //	{ "modified_at": "2026-..." }                   (normal ACK)
 func (s *Server) handleClientHeartbeat(w http.ResponseWriter, r *http.Request) {
+	// BD-2026-001: Rate-limit heartbeat requests per IP
+	clientIP := s.remoteIP(r)
+	if !s.heartbeatLimiter.Allow(clientIP) {
+		writeJSON(w, http.StatusOK, map[string]string{"modified_at": time.Now().UTC().Format(time.RFC3339)})
+		return
+	}
+
 	var body struct {
 		ID     string  `json:"id"`
 		UUID   string  `json:"uuid"`
@@ -474,7 +481,6 @@ func (s *Server) handleClientHeartbeat(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Update peer status to ONLINE
-	clientIP := s.remoteIP(r)
 	_ = s.db.UpdatePeerStatus(deviceID, "ONLINE", clientIP)
 
 	// Save metrics if any values provided (values > 0)
@@ -503,6 +509,13 @@ func (s *Server) handleClientHeartbeat(w http.ResponseWriter, r *http.Request) {
 //
 //	"ID_NOT_FOUND" (client retries), or "ERROR".
 func (s *Server) handleClientSysinfo(w http.ResponseWriter, r *http.Request) {
+	// BD-2026-001: Rate-limit sysinfo requests per IP
+	if !s.heartbeatLimiter.Allow(s.remoteIP(r)) {
+		w.Header().Set("Content-Type", "text/plain")
+		w.Write([]byte("ID_NOT_FOUND")) //nolint:errcheck
+		return
+	}
+
 	var body struct {
 		ID       string `json:"id"`
 		UUID     string `json:"uuid"`
@@ -573,6 +586,13 @@ func (s *Server) handleClientSysinfo(w http.ResponseWriter, r *http.Request) {
 // POST /api/sysinfo_ver
 // Returns a hash of existing sysinfo; empty response triggers full upload.
 func (s *Server) handleClientSysinfoVer(w http.ResponseWriter, r *http.Request) {
+	// BD-2026-001: Rate-limit sysinfo_ver requests per IP
+	if !s.heartbeatLimiter.Allow(s.remoteIP(r)) {
+		w.Header().Set("Content-Type", "text/plain")
+		w.Write([]byte("")) //nolint:errcheck
+		return
+	}
+
 	var body struct {
 		ID   string `json:"id"`
 		UUID string `json:"uuid"`
diff --git a/betterdesk-server/api/server.go b/betterdesk-server/api/server.go
index 37e36192..0b6ebaf8 100644
--- a/betterdesk-server/api/server.go
+++ b/betterdesk-server/api/server.go
@@ -54,8 +54,9 @@ type Server struct {
 	metrics           *metrics.Collector
 	jwtManager        *auth.JWTManager
 	loginLimiter      *ratelimit.IPLimiter
-	keyPair           *crypto.KeyPair // Ed25519 keypair for signing
-	cdapGw            *cdap.Gateway   // CDAP gateway (nil if CDAP disabled)
+	heartbeatLimiter  *ratelimit.IPLimiter // BD-2026-001: rate-limit heartbeat/sysinfo
+	keyPair           *crypto.KeyPair      // Ed25519 keypair for signing
+	cdapGw            *cdap.Gateway        // CDAP gateway (nil if CDAP disabled)
 	clientTFASessions *tfaSessionStore
 	httpSrv           *http.Server
 	wg                sync.WaitGroup
@@ -71,6 +72,7 @@ func New(cfg *config.Config, database db.Database, peerMap *peer.Map, relaySrv *
 		relay:             relaySrv,
 		version:           version,
 		loginLimiter:      ratelimit.NewIPLimiter(5, 5*time.Minute, 10*time.Minute),
+		heartbeatLimiter:  ratelimit.NewIPLimiter(20, 60*time.Second, 5*time.Minute), // BD-2026-001: 20 req/min per IP
 		clientTFASessions: newTFASessionStore(),
 	}
 }
@@ -138,6 +140,7 @@ func (s *Server) Start(ctx context.Context) error {
 	mux.HandleFunc("GET /api/peers/online", s.handleOnlinePeers)
 	mux.HandleFunc("GET /api/peers/{id}/status", s.handlePeerStatus)
 	mux.HandleFunc("GET /api/peers/{id}/metrics", s.handlePeerMetrics)
+	mux.HandleFunc("GET /api/peers/{id}/linked", s.handleLinkedPeers)
 
 	// Blocklist management
 	mux.HandleFunc("GET /api/blocklist", s.handleListBlocklist)
@@ -208,6 +211,19 @@ func (s *Server) Start(ctx context.Context) error {
 	mux.HandleFunc("GET /api/enrollment/mode", s.requireRole(auth.RoleAdmin, s.handleGetEnrollmentMode))
 	mux.HandleFunc("PUT /api/enrollment/mode", s.requireRole(auth.RoleAdmin, s.handleSetEnrollmentMode))
 
+	// Enrollment — device self-registration (public, no auth)
+	mux.HandleFunc("POST /api/devices/register", s.handleDeviceRegister)
+	mux.HandleFunc("GET /api/devices/register/status", s.handleDeviceRegisterStatus)
+
+	// Enrollment — operator approval (admin/operator)
+	mux.HandleFunc("GET /api/enrollment/pending", s.requireRole(auth.RoleOperator, s.handleListPendingDevices))
+	mux.HandleFunc("POST /api/enrollment/approve/{id}", s.requireRole(auth.RoleOperator, s.handleApproveDevice))
+	mux.HandleFunc("POST /api/enrollment/reject/{id}", s.requireRole(auth.RoleOperator, s.handleRejectDevice))
+
+	// Branding (GET is public for desktop clients, POST is admin)
+	mux.HandleFunc("GET /api/branding", s.handleGetBranding)
+	mux.HandleFunc("POST /api/branding", s.requireRole(auth.RoleAdmin, s.handleSaveBranding))
+
 	// CDAP device management (requires CDAP gateway to be enabled)
 	mux.HandleFunc("GET /api/cdap/status", s.handleCDAPStatus)
 	mux.HandleFunc("GET /api/cdap/devices", s.handleCDAPListDevices)
@@ -215,6 +231,27 @@ func (s *Server) Start(ctx context.Context) error {
 	mux.HandleFunc("GET /api/cdap/devices/{id}/manifest", s.handleCDAPDeviceManifest)
 	mux.HandleFunc("GET /api/cdap/devices/{id}/state", s.handleCDAPDeviceState)
 	mux.HandleFunc("POST /api/cdap/devices/{id}/command", s.requireRole(auth.RoleOperator, s.handleCDAPSendCommand))
+	mux.HandleFunc("GET /api/cdap/alerts", s.handleCDAPAlerts)
+
+	// CDAP auth delegation (admin only)
+	mux.HandleFunc("POST /api/cdap/delegate", s.requireRole(auth.RoleAdmin, s.handleCDAPDelegateCreate))
+	mux.HandleFunc("DELETE /api/cdap/delegate/{id}", s.requireRole(auth.RoleAdmin, s.handleCDAPDelegateRevoke))
+	mux.HandleFunc("GET /api/cdap/delegations", s.requireRole(auth.RoleAdmin, s.handleCDAPDelegateList))
+
+	// CDAP terminal WebSocket (admin only, upgraded inside handler)
+	mux.HandleFunc("GET /api/cdap/devices/{id}/terminal", s.requireRole(auth.RoleAdmin, s.handleCDAPTerminal))
+
+	// CDAP remote desktop WebSocket (admin only)
+	mux.HandleFunc("GET /api/cdap/devices/{id}/desktop", s.requireRole(auth.RoleAdmin, s.handleCDAPDesktop))
+
+	// CDAP video stream WebSocket (operator+)
+	mux.HandleFunc("GET /api/cdap/devices/{id}/video", s.requireRole(auth.RoleOperator, s.handleCDAPVideo))
+
+	// CDAP file browser WebSocket (admin only)
+	mux.HandleFunc("GET /api/cdap/devices/{id}/files", s.requireRole(auth.RoleAdmin, s.handleCDAPFileBrowser))
+
+	// CDAP audio stream WebSocket (operator+)
+	mux.HandleFunc("GET /api/cdap/devices/{id}/audio", s.requireRole(auth.RoleOperator, s.handleCDAPAudio))
 
 	// Prometheus metrics (public, no API key required)
 	mux.HandleFunc("GET /metrics", s.handleMetrics)
@@ -323,13 +360,18 @@ func (s *Server) handleServerStats(w http.ResponseWriter, r *http.Request) {
 		"uptime":          time.Since(startTime).String(),
 		"uptime_seconds":  int(time.Since(startTime).Seconds()),
 		// Enhanced status stats from peer map
-		"peers_online_live":   peerStats.Online,
-		"peers_degraded":      peerStats.Degraded,
-		"peers_critical":      peerStats.Critical,
-		"peers_udp":           peerStats.UDP,
-		"peers_tcp":           peerStats.TCP,
-		"peers_ws":            peerStats.WS,
-		"peers_banned":        peerStats.Banned,
+		"peers_online_live": peerStats.Online,
+		"peers_degraded":    peerStats.Degraded,
+		"peers_critical":    peerStats.Critical,
+		"peers_udp":         peerStats.UDP,
+		"peers_tcp":         peerStats.TCP,
+		"peers_ws":          peerStats.WS,
+		"peers_banned": func() int {
+			if n, err := s.db.GetBannedPeerCount(); err == nil {
+				return n
+			}
+			return peerStats.Banned
+		}(),
 		"peers_disabled":      peerStats.Disabled,
 		"avg_uptime_secs":     peerStats.AvgUptimeSecs,
 		"avg_beat_age_secs":   peerStats.AvgBeatAge,
@@ -443,6 +485,23 @@ func (s *Server) handleGetPeer(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
+// handleLinkedPeers returns all peers linked to the given peer ID.
+// GET /api/peers/{id}/linked
+func (s *Server) handleLinkedPeers(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	linked, err := s.db.GetLinkedPeers(id)
+	if err != nil {
+		writeInternalError(w, err, "GetLinkedPeers")
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]any{
+		"peer_id": id,
+		"linked":  linked,
+		"total":   len(linked),
+	})
+}
+
 // handleUpdatePeerFields partially updates a peer's editable fields (note, user, tags).
 // PATCH /api/peers/{id}
 func (s *Server) handleUpdatePeerFields(w http.ResponseWriter, r *http.Request) {
@@ -521,6 +580,14 @@ func (s *Server) handleDeletePeer(w http.ResponseWriter, r *http.Request) {
 		s.blocklist.BlockID(id, "revoked via panel")
 	}
 
+	// CDAP revocation: send revoke message and disconnect CDAP device.
+	if revoke && s.cdapGw != nil {
+		if err := s.cdapGw.SendRevoke(r.Context(), id, "revoked via panel"); err != nil {
+			// Not an error — device may not be CDAP-connected
+			_ = err
+		}
+	}
+
 	// Cascade: revoke linked devices (e.g., paired mobile→desktop).
 	var cascadedIDs []string
 	if cascade && len(linkedIDs) > 0 {
@@ -534,6 +601,9 @@ func (s *Server) handleDeletePeer(w http.ResponseWriter, r *http.Request) {
 			if revoke && s.blocklist != nil {
 				s.blocklist.BlockID(lid, "revoked via cascade")
 			}
+			if revoke && s.cdapGw != nil {
+				s.cdapGw.SendRevoke(r.Context(), lid, "revoked via cascade")
+			}
 			cascadedIDs = append(cascadedIDs, lid)
 		}
 	}
diff --git a/betterdesk-server/cdap/alerts.go b/betterdesk-server/cdap/alerts.go
new file mode 100644
index 00000000..9f0c6039
--- /dev/null
+++ b/betterdesk-server/cdap/alerts.go
@@ -0,0 +1,284 @@
+package cdap
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"regexp"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/unitronix/betterdesk-server/events"
+)
+
+// AlertState tracks whether an individual alert is currently firing.
+type AlertState struct {
+	AlertID   string    `json:"alert_id"`
+	DeviceID  string    `json:"device_id"`
+	Label     string    `json:"label"`
+	Severity  string    `json:"severity"` // critical, warning, info
+	Message   string    `json:"message"`
+	Firing    bool      `json:"firing"`
+	FiredAt   time.Time `json:"fired_at,omitempty"`
+	ClearedAt time.Time `json:"cleared_at,omitempty"`
+}
+
+// AlertEngine evaluates AlertDef conditions against widget state and
+// publishes events when alerts fire or clear.
+type AlertEngine struct {
+	eventBus *events.Bus
+	mu       sync.RWMutex
+	// active: deviceID → alertID → AlertState
+	active map[string]map[string]*AlertState
+}
+
+// NewAlertEngine creates a new alert processing engine.
+func NewAlertEngine(bus *events.Bus) *AlertEngine {
+	return &AlertEngine{
+		eventBus: bus,
+		active:   make(map[string]map[string]*AlertState),
+	}
+}
+
+// Evaluate checks all alert definitions from the manifest against the
+// current widget state and fires/clears alerts as needed.
+func (ae *AlertEngine) Evaluate(deviceID string, manifest *Manifest, widgetState map[string]any) {
+	if manifest == nil || len(manifest.Alerts) == 0 {
+		return
+	}
+
+	ae.mu.Lock()
+	defer ae.mu.Unlock()
+
+	if ae.active[deviceID] == nil {
+		ae.active[deviceID] = make(map[string]*AlertState)
+	}
+	deviceAlerts := ae.active[deviceID]
+
+	for i := range manifest.Alerts {
+		alert := &manifest.Alerts[i]
+		firing := evaluateCondition(alert.Condition, widgetState)
+		existing := deviceAlerts[alert.ID]
+
+		if firing && (existing == nil || !existing.Firing) {
+			// Alert just fired
+			state := &AlertState{
+				AlertID:  alert.ID,
+				DeviceID: deviceID,
+				Label:    alert.Label,
+				Severity: alert.Severity,
+				Message:  interpolateMessage(alert.Message, widgetState),
+				Firing:   true,
+				FiredAt:  time.Now(),
+			}
+			deviceAlerts[alert.ID] = state
+
+			log.Printf("[cdap] %s: alert FIRED %s (%s): %s",
+				deviceID, alert.ID, alert.Severity, state.Message)
+
+			ae.publishAlertEvent(state, "cdap_alert_fired")
+
+		} else if !firing && existing != nil && existing.Firing {
+			// Alert cleared
+			existing.Firing = false
+			existing.ClearedAt = time.Now()
+
+			log.Printf("[cdap] %s: alert CLEARED %s", deviceID, alert.ID)
+
+			ae.publishAlertEvent(existing, "cdap_alert_cleared")
+		}
+	}
+}
+
+// RemoveDevice cleans up alert state when a device disconnects.
+func (ae *AlertEngine) RemoveDevice(deviceID string) {
+	ae.mu.Lock()
+	defer ae.mu.Unlock()
+
+	if alerts, ok := ae.active[deviceID]; ok {
+		for _, state := range alerts {
+			if state.Firing {
+				state.Firing = false
+				state.ClearedAt = time.Now()
+				ae.publishAlertEvent(state, "cdap_alert_cleared")
+			}
+		}
+		delete(ae.active, deviceID)
+	}
+}
+
+// GetActiveAlerts returns all currently firing alerts, optionally for a single device.
+func (ae *AlertEngine) GetActiveAlerts(deviceID string) []*AlertState {
+	ae.mu.RLock()
+	defer ae.mu.RUnlock()
+
+	var result []*AlertState
+	if deviceID != "" {
+		if alerts, ok := ae.active[deviceID]; ok {
+			for _, a := range alerts {
+				if a.Firing {
+					result = append(result, a)
+				}
+			}
+		}
+	} else {
+		for _, alerts := range ae.active {
+			for _, a := range alerts {
+				if a.Firing {
+					result = append(result, a)
+				}
+			}
+		}
+	}
+	return result
+}
+
+func (ae *AlertEngine) publishAlertEvent(state *AlertState, eventType string) {
+	if ae.eventBus == nil {
+		return
+	}
+	ae.eventBus.Publish(events.Event{
+		Type: events.EventType(eventType),
+		Data: map[string]string{
+			"peer_id":  state.DeviceID,
+			"alert_id": state.AlertID,
+			"label":    state.Label,
+			"severity": state.Severity,
+			"message":  state.Message,
+			"firing":   fmt.Sprintf("%t", state.Firing),
+		},
+	})
+}
+
+// ── Condition Evaluator ──────────────────────────────────────────────
+
+// condRegexp matches simple conditions like:
+//
+//	"temperature > 80"
+//	"cpu >= 95.5"
+//	"status == 'error'"
+//	"relay_active != true"
+var condRegexp = regexp.MustCompile(`^([a-zA-Z_][a-zA-Z0-9_.]*)\s*(==|!=|>=|<=|>|<)\s*(.+)$`)
+
+// evaluateCondition evaluates a simple expression against widget state.
+// Supported formats:
+//
+//	"widget_id > 80"     (numeric comparison)
+//	"widget_id == true"  (boolean)
+//	"widget_id == 'on'"  (string)
+//	"widget_id != 0"     (numeric)
+//
+// Returns false for unparseable conditions or missing widget values (fail-safe).
+func evaluateCondition(condition string, state map[string]any) bool {
+	condition = strings.TrimSpace(condition)
+	if condition == "" {
+		return false
+	}
+
+	matches := condRegexp.FindStringSubmatch(condition)
+	if matches == nil {
+		return false
+	}
+
+	widgetID := matches[1]
+	operator := matches[2]
+	expected := strings.TrimSpace(matches[3])
+
+	actual, ok := state[widgetID]
+	if !ok {
+		return false // widget value not available → not firing
+	}
+
+	return compare(actual, operator, expected)
+}
+
+func compare(actual any, op string, expected string) bool {
+	// Try numeric comparison
+	actualNum, actualIsNum := toFloat64(actual)
+	expectedNum, expectedIsNum := toFloat64Str(expected)
+
+	if actualIsNum && expectedIsNum {
+		switch op {
+		case "==":
+			return actualNum == expectedNum
+		case "!=":
+			return actualNum != expectedNum
+		case ">":
+			return actualNum > expectedNum
+		case "<":
+			return actualNum < expectedNum
+		case ">=":
+			return actualNum >= expectedNum
+		case "<=":
+			return actualNum <= expectedNum
+		}
+		return false
+	}
+
+	// String/bool comparison
+	actualStr := fmt.Sprintf("%v", actual)
+	// Strip quotes from expected
+	expected = strings.Trim(expected, "'\"")
+
+	switch op {
+	case "==":
+		return strings.EqualFold(actualStr, expected)
+	case "!=":
+		return !strings.EqualFold(actualStr, expected)
+	default:
+		return false
+	}
+}
+
+func toFloat64(v any) (float64, bool) {
+	switch n := v.(type) {
+	case float64:
+		return n, true
+	case float32:
+		return float64(n), true
+	case int:
+		return float64(n), true
+	case int64:
+		return float64(n), true
+	case json.Number:
+		f, err := n.Float64()
+		return f, err == nil
+	case bool:
+		if n {
+			return 1, true
+		}
+		return 0, true
+	case string:
+		f, err := strconv.ParseFloat(n, 64)
+		return f, err == nil
+	default:
+		return 0, false
+	}
+}
+
+func toFloat64Str(s string) (float64, bool) {
+	s = strings.Trim(s, "'\"")
+	// Handle boolean keywords
+	switch strings.ToLower(s) {
+	case "true":
+		return 1, true
+	case "false":
+		return 0, true
+	}
+	f, err := strconv.ParseFloat(s, 64)
+	return f, err == nil
+}
+
+// interpolateMessage substitutes {widget_id} placeholders in the message
+// with actual widget values.
+func interpolateMessage(msg string, state map[string]any) string {
+	return regexp.MustCompile(`\{([a-zA-Z_][a-zA-Z0-9_.]*)\}`).ReplaceAllStringFunc(msg, func(match string) string {
+		key := match[1 : len(match)-1]
+		if val, ok := state[key]; ok {
+			return fmt.Sprintf("%v", val)
+		}
+		return match
+	})
+}
diff --git a/betterdesk-server/cdap/api.go b/betterdesk-server/cdap/api.go
index bfe500cd..0c4bbbc7 100644
--- a/betterdesk-server/cdap/api.go
+++ b/betterdesk-server/cdap/api.go
@@ -110,7 +110,23 @@ func (g *Gateway) IsConnected(id string) bool {
 	return g.GetDeviceConn(id) != nil
 }
 
+// GetWidget looks up a widget by ID from a connected device's manifest.
+// Returns nil if the device is not connected or widget not found.
+func (g *Gateway) GetWidget(deviceID, widgetID string) *Widget {
+	dc := g.GetDeviceConn(deviceID)
+	if dc == nil || dc.Manifest == nil {
+		return nil
+	}
+	for i := range dc.Manifest.Widgets {
+		if dc.Manifest.Widgets[i].ID == widgetID {
+			return &dc.Manifest.Widgets[i]
+		}
+	}
+	return nil
+}
+
 // SendCommandJSON builds and sends a command to a connected CDAP device.
+// The caller must perform RBAC checks before invoking this method.
 func (g *Gateway) SendCommandJSON(ctx context.Context, deviceID, commandID, widgetID, action string, value any, operator, reason string) error {
 	payload := CommandPayload{
 		CommandID: commandID,
@@ -154,3 +170,12 @@ func (g *Gateway) ListConnectedDevices() []string {
 	})
 	return ids
 }
+
+// GetActiveAlerts returns all currently firing CDAP alerts.
+// If deviceID is non-empty, only alerts for that device are returned.
+func (g *Gateway) GetActiveAlerts(deviceID string) []*AlertState {
+	if g.alertEngine == nil {
+		return nil
+	}
+	return g.alertEngine.GetActiveAlerts(deviceID)
+}
diff --git a/betterdesk-server/cdap/audio.go b/betterdesk-server/cdap/audio.go
new file mode 100644
index 00000000..222bf30a
--- /dev/null
+++ b/betterdesk-server/cdap/audio.go
@@ -0,0 +1,240 @@
+// Package cdap — audio handles WebSocket audio stream sessions between
+// the admin panel and CDAP devices. Supports bidirectional audio relay
+// (device→browser for monitoring, browser→device for communication).
+// Audio codec negotiation supports Opus and raw PCM.
+package cdap
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/coder/websocket"
+)
+
+// AudioSession represents an active audio stream between a browser and device.
+type AudioSession struct {
+	ID       string
+	DeviceID string
+	Username string
+	Role     string
+
+	browser    *websocket.Conn
+	deviceConn *DeviceConn
+
+	createdAt time.Time
+	mu        sync.Mutex
+	closed    atomic.Bool
+}
+
+// AudioStartPayload is sent to the device to start an audio stream.
+type AudioStartPayload struct {
+	SessionID  string `json:"session_id"`
+	Codec      string `json:"codec"`       // opus, pcm
+	SampleRate int    `json:"sample_rate"` // e.g. 48000
+	Channels   int    `json:"channels"`    // 1=mono, 2=stereo
+	Direction  string `json:"direction"`   // send, receive, bidirectional
+}
+
+// AudioFramePayload carries a single audio chunk from device to browser.
+type AudioFramePayload struct {
+	SessionID string `json:"session_id"`
+	Codec     string `json:"codec"`     // opus, pcm
+	Data      string `json:"data"`      // base64-encoded audio data
+	Timestamp int64  `json:"timestamp"` // capture timestamp ms
+	Duration  int    `json:"duration"`  // frame duration ms (typically 20)
+	Sequence  int64  `json:"sequence"`  // sequential frame number
+}
+
+// AudioEndPayload is sent when an audio session ends.
+type AudioEndPayload struct {
+	SessionID string `json:"session_id"`
+	Reason    string `json:"reason,omitempty"`
+}
+
+// StartAudioSession creates a new audio stream session between the
+// browser and a CDAP device for audio monitoring or communication.
+func (g *Gateway) StartAudioSession(ctx context.Context, browserConn *websocket.Conn, deviceID, username, role string, codec string, sampleRate, channels int, direction string) (*AudioSession, error) {
+	dc := g.GetDeviceConn(deviceID)
+	if dc == nil {
+		return nil, fmt.Errorf("device %s not connected", deviceID)
+	}
+
+	// Check audio capability
+	if dc.Manifest != nil {
+		hasAudio := false
+		for _, cap := range dc.Manifest.Capabilities {
+			if cap == "audio" {
+				hasAudio = true
+				break
+			}
+		}
+		if !hasAudio {
+			return nil, fmt.Errorf("device %s does not support audio", deviceID)
+		}
+	}
+
+	// Defaults
+	if codec == "" {
+		codec = "opus"
+	}
+	if sampleRate <= 0 {
+		sampleRate = 48000
+	}
+	if channels <= 0 || channels > 2 {
+		channels = 1
+	}
+	if direction == "" {
+		direction = "receive"
+	}
+
+	sessionID := fmt.Sprintf("aud_%s_%d", deviceID, time.Now().UnixNano())
+
+	as := &AudioSession{
+		ID:         sessionID,
+		DeviceID:   deviceID,
+		Username:   username,
+		Role:       role,
+		browser:    browserConn,
+		deviceConn: dc,
+		createdAt:  time.Now(),
+	}
+
+	startPayload := AudioStartPayload{
+		SessionID:  sessionID,
+		Codec:      codec,
+		SampleRate: sampleRate,
+		Channels:   channels,
+		Direction:  direction,
+	}
+	data, _ := json.Marshal(startPayload)
+	msg := &Message{
+		Type:      "audio_start",
+		ID:        sessionID,
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   data,
+	}
+
+	if err := dc.WriteMessage(ctx, msg); err != nil {
+		return nil, fmt.Errorf("send audio_start to device: %w", err)
+	}
+
+	g.audioSessions.Store(sessionID, as)
+
+	log.Printf("[cdap] Audio session %s started for device %s by %s (codec=%s rate=%d ch=%d dir=%s)",
+		sessionID, deviceID, username, codec, sampleRate, channels, direction)
+
+	if g.auditLog != nil {
+		g.auditLog.Log("cdap_audio_started", dc.ClientIP, username, map[string]string{
+			"session_id": sessionID,
+			"device_id":  deviceID,
+			"codec":      codec,
+			"direction":  direction,
+		})
+	}
+
+	return as, nil
+}
+
+// HandleAudioFrame is called when the device sends an audio frame.
+func (g *Gateway) HandleAudioFrame(ctx context.Context, sessionID string, frame *AudioFramePayload) error {
+	val, ok := g.audioSessions.Load(sessionID)
+	if !ok {
+		return fmt.Errorf("audio session %s not found", sessionID)
+	}
+	as := val.(*AudioSession)
+	if as.closed.Load() {
+		return nil
+	}
+
+	output := map[string]any{
+		"type":       "audio_frame",
+		"session_id": sessionID,
+		"codec":      frame.Codec,
+		"data":       frame.Data,
+		"timestamp":  frame.Timestamp,
+		"duration":   frame.Duration,
+		"sequence":   frame.Sequence,
+	}
+	outData, _ := json.Marshal(output)
+
+	as.mu.Lock()
+	defer as.mu.Unlock()
+	return as.browser.Write(ctx, websocket.MessageText, outData)
+}
+
+// RelayAudioInput forwards audio data from the browser to the device
+// (for bidirectional audio sessions, e.g. intercom / voice communication).
+func (g *Gateway) RelayAudioInput(ctx context.Context, sessionID string, codec, data string, timestamp int64) error {
+	val, ok := g.audioSessions.Load(sessionID)
+	if !ok {
+		return fmt.Errorf("audio session %s not found", sessionID)
+	}
+	as := val.(*AudioSession)
+	if as.closed.Load() {
+		return fmt.Errorf("audio session %s is closed", sessionID)
+	}
+
+	payload := map[string]any{
+		"session_id": sessionID,
+		"codec":      codec,
+		"data":       data,
+		"timestamp":  timestamp,
+	}
+	payloadData, _ := json.Marshal(payload)
+	msg := &Message{
+		Type:      "audio_input",
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   payloadData,
+	}
+
+	return as.deviceConn.WriteMessage(ctx, msg)
+}
+
+// EndAudioSession terminates an audio session.
+func (g *Gateway) EndAudioSession(ctx context.Context, sessionID, reason string) {
+	val, ok := g.audioSessions.LoadAndDelete(sessionID)
+	if !ok {
+		return
+	}
+	as := val.(*AudioSession)
+	if as.closed.Swap(true) {
+		return
+	}
+
+	endPayload := AudioEndPayload{
+		SessionID: sessionID,
+		Reason:    reason,
+	}
+	data, _ := json.Marshal(endPayload)
+	msg := &Message{
+		Type:      "audio_end",
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   data,
+	}
+	as.deviceConn.WriteMessage(ctx, msg)
+
+	endMsg, _ := json.Marshal(map[string]string{
+		"type":       "end",
+		"session_id": sessionID,
+		"reason":     reason,
+	})
+	as.mu.Lock()
+	as.browser.Write(ctx, websocket.MessageText, endMsg)
+	as.mu.Unlock()
+	as.browser.Close(websocket.StatusNormalClosure, reason)
+
+	log.Printf("[cdap] Audio session %s ended: %s", sessionID, reason)
+
+	if g.auditLog != nil {
+		g.auditLog.Log("cdap_audio_ended", as.deviceConn.ClientIP, as.Username, map[string]string{
+			"session_id": sessionID,
+			"device_id":  as.DeviceID,
+			"reason":     reason,
+		})
+	}
+}
diff --git a/betterdesk-server/cdap/clipboard.go b/betterdesk-server/cdap/clipboard.go
new file mode 100644
index 00000000..bb52cdbd
--- /dev/null
+++ b/betterdesk-server/cdap/clipboard.go
@@ -0,0 +1,99 @@
+// Package cdap — clipboard handles bidirectional clipboard synchronization
+// between the admin panel and CDAP devices. Supports text and image data.
+package cdap
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/coder/websocket"
+)
+
+// ClipboardPayload represents clipboard data exchanged between viewer and device.
+type ClipboardPayload struct {
+	Type      string `json:"type"`       // "clipboard_set" or "clipboard_update"
+	Format    string `json:"format"`     // "text", "image", "html"
+	Data      string `json:"data"`       // text content or base64-encoded binary
+	SessionID string `json:"session_id"` // associated desktop session
+}
+
+// RelayClipboard forwards clipboard data from the viewer to the CDAP device.
+func (gw *Gateway) RelayClipboard(ctx context.Context, deviceID, sessionID, format, data string) error {
+	val, ok := gw.devices.Load(deviceID)
+	if !ok {
+		return fmt.Errorf("device %s not connected", deviceID)
+	}
+	dc := val.(*DeviceConn)
+
+	msg := &Message{
+		Type:      "clipboard_set",
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload: mustMarshal(map[string]string{
+			"session_id": sessionID,
+			"format":     format,
+			"data":       data,
+		}),
+	}
+	return dc.WriteMessage(ctx, msg)
+}
+
+// HandleClipboardUpdate processes clipboard data from a device and forwards
+// it to the active desktop session viewer (if any).
+func (gw *Gateway) HandleClipboardUpdate(deviceID string, payload json.RawMessage) {
+	var clip ClipboardPayload
+	if err := json.Unmarshal(payload, &clip); err != nil {
+		log.Printf("[cdap] Invalid clipboard payload from %s: %v", deviceID, err)
+		return
+	}
+
+	// Validate format
+	switch clip.Format {
+	case "text", "image", "html":
+		// valid
+	default:
+		log.Printf("[cdap] Unknown clipboard format from %s: %s", deviceID, clip.Format)
+		return
+	}
+
+	// Limit clipboard data size (8MB max for images)
+	const maxClipboardSize = 8 * 1024 * 1024
+	if len(clip.Data) > maxClipboardSize {
+		log.Printf("[cdap] Clipboard data too large from %s: %d bytes", deviceID, len(clip.Data))
+		return
+	}
+
+	// Find active desktop session and forward clipboard to viewer
+	if clip.SessionID != "" {
+		if sessionVal, ok := gw.desktopSessions.Load(clip.SessionID); ok {
+			session := sessionVal.(*DesktopSession)
+			if session.DeviceID == deviceID {
+				fwdMsg, _ := json.Marshal(map[string]string{
+					"type":       "clipboard_update",
+					"format":     clip.Format,
+					"data":       clip.Data,
+					"session_id": clip.SessionID,
+				})
+				session.mu.Lock()
+				_ = session.browser.Write(context.Background(), websocket.MessageText, fwdMsg)
+				session.mu.Unlock()
+			}
+		}
+	}
+
+	gw.auditAction("clipboard_sync", deviceID, map[string]string{
+		"format": clip.Format,
+		"size":   fmt.Sprintf("%d", len(clip.Data)),
+	})
+}
+
+// mustMarshal marshals v to JSON, panicking on error (for static structures).
+func mustMarshal(v any) json.RawMessage {
+	data, err := json.Marshal(v)
+	if err != nil {
+		panic(fmt.Sprintf("mustMarshal: %v", err))
+	}
+	return data
+}
diff --git a/betterdesk-server/cdap/crypto.go b/betterdesk-server/cdap/crypto.go
new file mode 100644
index 00000000..0e32bb28
--- /dev/null
+++ b/betterdesk-server/cdap/crypto.go
@@ -0,0 +1,180 @@
+// Package cdap — crypto provides X25519 key exchange and XSalsa20-Poly1305
+// authenticated encryption for end-to-end encrypted media channels between
+// the browser (viewer) and the CDAP device. The server sees only opaque
+// ciphertext — it cannot decrypt the media frames.
+package cdap
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+
+	"golang.org/x/crypto/curve25519"
+	"golang.org/x/crypto/nacl/box"
+)
+
+// MediaCrypto holds the E2E key material for a single media session.
+// The session key is derived via X25519 Diffie-Hellman between the viewer
+// and the device. The server only facilitates the key exchange messages.
+type MediaCrypto struct {
+	mu           sync.Mutex
+	sessionID    string
+	localPub     [32]byte
+	localPriv    [32]byte
+	remotePub    [32]byte
+	sharedSecret [32]byte
+	ready        bool
+	created      time.Time
+}
+
+// KeyExchangePayload is sent between viewer and device via control messages.
+type KeyExchangePayload struct {
+	Type      string `json:"type"`       // "key_exchange"
+	SessionID string `json:"session_id"` // media session ID
+	PublicKey string `json:"public_key"` // base64-encoded X25519 public key
+}
+
+// EncryptedFrame wraps a media frame with authenticated encryption.
+type EncryptedFrame struct {
+	Type       string `json:"type"`       // "encrypted_frame"
+	SessionID  string `json:"session_id"` // media session ID
+	Nonce      string `json:"nonce"`      // base64-encoded 24-byte nonce
+	Ciphertext string `json:"ciphertext"` // base64-encoded XSalsa20-Poly1305 ciphertext
+}
+
+// NewMediaCrypto generates a new X25519 keypair for a media session.
+func NewMediaCrypto(sessionID string) (*MediaCrypto, error) {
+	pub, priv, err := box.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, fmt.Errorf("generate X25519 keypair: %w", err)
+	}
+	return &MediaCrypto{
+		sessionID: sessionID,
+		localPub:  *pub,
+		localPriv: *priv,
+		created:   time.Now(),
+	}, nil
+}
+
+// PublicKeyBase64 returns the local public key as base64 for key exchange.
+func (mc *MediaCrypto) PublicKeyBase64() string {
+	return base64.StdEncoding.EncodeToString(mc.localPub[:])
+}
+
+// CompleteExchange derives the shared secret from the remote public key.
+func (mc *MediaCrypto) CompleteExchange(remotePubB64 string) error {
+	mc.mu.Lock()
+	defer mc.mu.Unlock()
+
+	pubBytes, err := base64.StdEncoding.DecodeString(remotePubB64)
+	if err != nil {
+		return fmt.Errorf("decode remote public key: %w", err)
+	}
+	if len(pubBytes) != 32 {
+		return errors.New("invalid X25519 public key length")
+	}
+
+	copy(mc.remotePub[:], pubBytes)
+
+	// Derive shared secret via X25519
+	shared, err := curve25519.X25519(mc.localPriv[:], mc.remotePub[:])
+	if err != nil {
+		return fmt.Errorf("X25519 key exchange: %w", err)
+	}
+	copy(mc.sharedSecret[:], shared)
+
+	mc.ready = true
+	return nil
+}
+
+// IsReady returns true after key exchange is complete.
+func (mc *MediaCrypto) IsReady() bool {
+	mc.mu.Lock()
+	defer mc.mu.Unlock()
+	return mc.ready
+}
+
+// Encrypt encrypts plaintext using XSalsa20-Poly1305 with the shared secret.
+// Returns the nonce and ciphertext.
+func (mc *MediaCrypto) Encrypt(plaintext []byte) (nonce [24]byte, ciphertext []byte, err error) {
+	mc.mu.Lock()
+	defer mc.mu.Unlock()
+
+	if !mc.ready {
+		return nonce, nil, errors.New("key exchange not complete")
+	}
+
+	// Generate random nonce
+	if _, err = rand.Read(nonce[:]); err != nil {
+		return nonce, nil, fmt.Errorf("generate nonce: %w", err)
+	}
+
+	// Encrypt with NaCl box.SealAfterPrecomputation
+	var sharedKey [32]byte
+	box.Precompute(&sharedKey, &mc.remotePub, &mc.localPriv)
+	ciphertext = box.SealAfterPrecomputation(nil, plaintext, &nonce, &sharedKey)
+
+	return nonce, ciphertext, nil
+}
+
+// Decrypt decrypts ciphertext using XSalsa20-Poly1305 with the shared secret.
+func (mc *MediaCrypto) Decrypt(nonce [24]byte, ciphertext []byte) ([]byte, error) {
+	mc.mu.Lock()
+	defer mc.mu.Unlock()
+
+	if !mc.ready {
+		return nil, errors.New("key exchange not complete")
+	}
+
+	var sharedKey [32]byte
+	box.Precompute(&sharedKey, &mc.remotePub, &mc.localPriv)
+
+	plaintext, ok := box.OpenAfterPrecomputation(nil, ciphertext, &nonce, &sharedKey)
+	if !ok {
+		return nil, errors.New("decryption failed: authentication error")
+	}
+
+	return plaintext, nil
+}
+
+// MarshalKeyExchange creates a JSON key exchange message.
+func (mc *MediaCrypto) MarshalKeyExchange() ([]byte, error) {
+	payload := KeyExchangePayload{
+		Type:      "key_exchange",
+		SessionID: mc.sessionID,
+		PublicKey: mc.PublicKeyBase64(),
+	}
+	return json.Marshal(payload)
+}
+
+// MarshalEncryptedFrame creates a JSON encrypted frame message.
+func (mc *MediaCrypto) MarshalEncryptedFrame(plaintext []byte) ([]byte, error) {
+	nonce, ciphertext, err := mc.Encrypt(plaintext)
+	if err != nil {
+		return nil, err
+	}
+	frame := EncryptedFrame{
+		Type:       "encrypted_frame",
+		SessionID:  mc.sessionID,
+		Nonce:      base64.StdEncoding.EncodeToString(nonce[:]),
+		Ciphertext: base64.StdEncoding.EncodeToString(ciphertext),
+	}
+	return json.Marshal(frame)
+}
+
+// Zero wipes the private key and shared secret from memory.
+func (mc *MediaCrypto) Zero() {
+	mc.mu.Lock()
+	defer mc.mu.Unlock()
+	for i := range mc.localPriv {
+		mc.localPriv[i] = 0
+	}
+	for i := range mc.sharedSecret {
+		mc.sharedSecret[i] = 0
+	}
+	mc.ready = false
+}
diff --git a/betterdesk-server/cdap/delegation.go b/betterdesk-server/cdap/delegation.go
new file mode 100644
index 00000000..7f2f4c71
--- /dev/null
+++ b/betterdesk-server/cdap/delegation.go
@@ -0,0 +1,176 @@
+// Package cdap — auth delegation allows admins to grant time-limited
+// elevated access to specific devices and widgets for other users.
+package cdap
+
+import (
+	"fmt"
+	"sync"
+	"time"
+)
+
+// Delegation represents a temporary privilege grant from an admin to
+// another user for specific device(s) and optional widget(s).
+type Delegation struct {
+	ID        string    `json:"id"`
+	Grantor   string    `json:"grantor"`    // admin who created this delegation
+	Grantee   string    `json:"grantee"`    // target user receiving elevated access
+	DeviceID  string    `json:"device_id"`  // CDAP device ID (required)
+	WidgetIDs []string  `json:"widget_ids"` // empty = all widgets on that device
+	Role      string    `json:"role"`       // elevated role to grant (operator, admin)
+	ExpiresAt time.Time `json:"expires_at"`
+	CreatedAt time.Time `json:"created_at"`
+	Reason    string    `json:"reason,omitempty"`
+}
+
+// DelegationStore manages active delegations in memory.
+// Delegations are ephemeral and are lost on server restart.
+type DelegationStore struct {
+	mu          sync.RWMutex
+	delegations map[string]*Delegation // keyed by ID
+	byGrantee   map[string][]*Delegation
+}
+
+// NewDelegationStore creates a new delegation store.
+func NewDelegationStore() *DelegationStore {
+	return &DelegationStore{
+		delegations: make(map[string]*Delegation),
+		byGrantee:   make(map[string][]*Delegation),
+	}
+}
+
+// Add stores a new delegation. Returns error if ID already exists.
+func (ds *DelegationStore) Add(d *Delegation) error {
+	ds.mu.Lock()
+	defer ds.mu.Unlock()
+
+	if _, exists := ds.delegations[d.ID]; exists {
+		return fmt.Errorf("delegation %s already exists", d.ID)
+	}
+
+	ds.delegations[d.ID] = d
+	ds.byGrantee[d.Grantee] = append(ds.byGrantee[d.Grantee], d)
+	return nil
+}
+
+// Revoke removes a delegation by ID. Returns true if it existed.
+func (ds *DelegationStore) Revoke(id string) bool {
+	ds.mu.Lock()
+	defer ds.mu.Unlock()
+
+	d, ok := ds.delegations[id]
+	if !ok {
+		return false
+	}
+	delete(ds.delegations, id)
+
+	// Remove from grantee index
+	list := ds.byGrantee[d.Grantee]
+	for i, dd := range list {
+		if dd.ID == id {
+			ds.byGrantee[d.Grantee] = append(list[:i], list[i+1:]...)
+			break
+		}
+	}
+	if len(ds.byGrantee[d.Grantee]) == 0 {
+		delete(ds.byGrantee, d.Grantee)
+	}
+	return true
+}
+
+// GetEffectiveRole returns the highest role the user has for a specific device
+// and widget via active (non-expired) delegations. Returns "" if no delegation
+// applies.
+func (ds *DelegationStore) GetEffectiveRole(username, deviceID, widgetID string) string {
+	ds.mu.RLock()
+	defer ds.mu.RUnlock()
+
+	now := time.Now()
+	bestLevel := 0
+
+	for _, d := range ds.byGrantee[username] {
+		if d.ExpiresAt.Before(now) {
+			continue
+		}
+		if d.DeviceID != deviceID {
+			continue
+		}
+		// Check if this delegation covers the specific widget
+		if len(d.WidgetIDs) > 0 && widgetID != "" {
+			found := false
+			for _, wid := range d.WidgetIDs {
+				if wid == widgetID {
+					found = true
+					break
+				}
+			}
+			if !found {
+				continue
+			}
+		}
+		level := roleLevel[d.Role]
+		if level > bestLevel {
+			bestLevel = level
+		}
+	}
+
+	// Map back to role name
+	for role, level := range roleLevel {
+		if level == bestLevel {
+			return role
+		}
+	}
+	return ""
+}
+
+// ListByGrantee returns all active (non-expired) delegations for a user.
+func (ds *DelegationStore) ListByGrantee(username string) []*Delegation {
+	ds.mu.RLock()
+	defer ds.mu.RUnlock()
+
+	now := time.Now()
+	var result []*Delegation
+	for _, d := range ds.byGrantee[username] {
+		if d.ExpiresAt.After(now) {
+			result = append(result, d)
+		}
+	}
+	return result
+}
+
+// ListAll returns all active (non-expired) delegations.
+func (ds *DelegationStore) ListAll() []*Delegation {
+	ds.mu.RLock()
+	defer ds.mu.RUnlock()
+
+	now := time.Now()
+	result := make([]*Delegation, 0, len(ds.delegations))
+	for _, d := range ds.delegations {
+		if d.ExpiresAt.After(now) {
+			result = append(result, d)
+		}
+	}
+	return result
+}
+
+// CleanExpired removes all expired delegations.
+func (ds *DelegationStore) CleanExpired() int {
+	ds.mu.Lock()
+	defer ds.mu.Unlock()
+
+	now := time.Now()
+	count := 0
+	for id, d := range ds.delegations {
+		if d.ExpiresAt.Before(now) {
+			delete(ds.delegations, id)
+			count++
+		}
+	}
+	// Rebuild grantee index
+	if count > 0 {
+		ds.byGrantee = make(map[string][]*Delegation)
+		for _, d := range ds.delegations {
+			ds.byGrantee[d.Grantee] = append(ds.byGrantee[d.Grantee], d)
+		}
+	}
+	return count
+}
diff --git a/betterdesk-server/cdap/desktop.go b/betterdesk-server/cdap/desktop.go
new file mode 100644
index 00000000..7e72ce87
--- /dev/null
+++ b/betterdesk-server/cdap/desktop.go
@@ -0,0 +1,276 @@
+// Package cdap — desktop handles the binary/text WebSocket channel for
+// remote desktop sessions between the admin panel and CDAP devices.
+// Supports both frame-based (MJPEG/raw) and input relay (mouse/keyboard).
+package cdap
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/coder/websocket"
+)
+
+// DesktopSession represents an active remote desktop session relaying
+// video frames from device→browser and input events from browser→device.
+type DesktopSession struct {
+	ID       string
+	DeviceID string
+	Username string
+	Role     string
+
+	browser    *websocket.Conn
+	deviceConn *DeviceConn
+
+	createdAt time.Time
+	mu        sync.Mutex
+	closed    atomic.Bool
+}
+
+// DesktopStartPayload is sent to the device to initiate a desktop session.
+type DesktopStartPayload struct {
+	SessionID string `json:"session_id"`
+	Width     int    `json:"width"`
+	Height    int    `json:"height"`
+	Quality   int    `json:"quality"` // JPEG quality 1-100
+	FPS       int    `json:"fps"`     // target frames per second
+}
+
+// DesktopFramePayload is sent from the device to the browser.
+type DesktopFramePayload struct {
+	SessionID string `json:"session_id"`
+	Format    string `json:"format"`    // jpeg, png, raw
+	Width     int    `json:"width"`     // frame width
+	Height    int    `json:"height"`    // frame height
+	Data      string `json:"data"`      // base64-encoded frame data
+	Timestamp int64  `json:"timestamp"` // capture timestamp ms
+}
+
+// DesktopInputPayload is sent from the browser to the device.
+type DesktopInputPayload struct {
+	SessionID string `json:"session_id"`
+	InputType string `json:"input_type"` // mouse_move, mouse_down, mouse_up, key_down, key_up, scroll
+	X         int    `json:"x,omitempty"`
+	Y         int    `json:"y,omitempty"`
+	Button    int    `json:"button,omitempty"` // 0=left, 1=middle, 2=right
+	Key       string `json:"key,omitempty"`    // key name (e.g. "Enter", "a")
+	Code      string `json:"code,omitempty"`   // key code (e.g. "KeyA")
+	Modifiers int    `json:"modifiers,omitempty"`
+	DeltaX    int    `json:"delta_x,omitempty"` // scroll delta
+	DeltaY    int    `json:"delta_y,omitempty"`
+}
+
+// DesktopResizePayload is sent when the browser viewport resizes.
+type DesktopResizePayload struct {
+	SessionID string `json:"session_id"`
+	Width     int    `json:"width"`
+	Height    int    `json:"height"`
+}
+
+// DesktopEndPayload is sent when a desktop session ends.
+type DesktopEndPayload struct {
+	SessionID string `json:"session_id"`
+	Reason    string `json:"reason,omitempty"`
+}
+
+// StartDesktopSession creates a new remote desktop session between the
+// browser and a CDAP device for screen capture and input relay.
+func (g *Gateway) StartDesktopSession(ctx context.Context, browserConn *websocket.Conn, deviceID, username, role string, width, height, quality, fps int) (*DesktopSession, error) {
+	dc := g.GetDeviceConn(deviceID)
+	if dc == nil {
+		return nil, fmt.Errorf("device %s not connected", deviceID)
+	}
+
+	// Check that device supports remote_desktop capability
+	if dc.Manifest != nil {
+		hasDesktop := false
+		for _, cap := range dc.Manifest.Capabilities {
+			if cap == "remote_desktop" {
+				hasDesktop = true
+				break
+			}
+		}
+		if !hasDesktop {
+			return nil, fmt.Errorf("device %s does not support remote_desktop", deviceID)
+		}
+	}
+
+	if quality <= 0 || quality > 100 {
+		quality = 70
+	}
+	if fps <= 0 || fps > 60 {
+		fps = 15
+	}
+	if width <= 0 {
+		width = 1280
+	}
+	if height <= 0 {
+		height = 720
+	}
+
+	sessionID := fmt.Sprintf("desk_%s_%d", deviceID, time.Now().UnixNano())
+
+	ds := &DesktopSession{
+		ID:         sessionID,
+		DeviceID:   deviceID,
+		Username:   username,
+		Role:       role,
+		browser:    browserConn,
+		deviceConn: dc,
+		createdAt:  time.Now(),
+	}
+
+	startPayload := DesktopStartPayload{
+		SessionID: sessionID,
+		Width:     width,
+		Height:    height,
+		Quality:   quality,
+		FPS:       fps,
+	}
+	data, _ := json.Marshal(startPayload)
+	msg := &Message{
+		Type:      "desktop_start",
+		ID:        sessionID,
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   data,
+	}
+
+	if err := dc.WriteMessage(ctx, msg); err != nil {
+		return nil, fmt.Errorf("send desktop_start to device: %w", err)
+	}
+
+	g.desktopSessions.Store(sessionID, ds)
+
+	log.Printf("[cdap] Desktop session %s started for device %s by %s (%dx%d q%d @%dfps)",
+		sessionID, deviceID, username, width, height, quality, fps)
+
+	if g.auditLog != nil {
+		g.auditLog.Log("cdap_desktop_started", dc.ClientIP, username, map[string]string{
+			"session_id": sessionID,
+			"device_id":  deviceID,
+		})
+	}
+
+	return ds, nil
+}
+
+// RelayDesktopInput forwards mouse/keyboard input from browser to device.
+func (g *Gateway) RelayDesktopInput(ctx context.Context, sessionID string, input *DesktopInputPayload) error {
+	val, ok := g.desktopSessions.Load(sessionID)
+	if !ok {
+		return fmt.Errorf("desktop session %s not found", sessionID)
+	}
+	ds := val.(*DesktopSession)
+	if ds.closed.Load() {
+		return fmt.Errorf("desktop session %s is closed", sessionID)
+	}
+
+	input.SessionID = sessionID
+	payloadData, _ := json.Marshal(input)
+	msg := &Message{
+		Type:      "desktop_input",
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   payloadData,
+	}
+
+	return ds.deviceConn.WriteMessage(ctx, msg)
+}
+
+// RelayDesktopResize forwards a viewport resize from browser to device.
+func (g *Gateway) RelayDesktopResize(ctx context.Context, sessionID string, width, height int) error {
+	val, ok := g.desktopSessions.Load(sessionID)
+	if !ok {
+		return fmt.Errorf("desktop session %s not found", sessionID)
+	}
+	ds := val.(*DesktopSession)
+
+	payload := DesktopResizePayload{
+		SessionID: sessionID,
+		Width:     width,
+		Height:    height,
+	}
+	payloadData, _ := json.Marshal(payload)
+	msg := &Message{
+		Type:      "desktop_resize",
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   payloadData,
+	}
+
+	return ds.deviceConn.WriteMessage(ctx, msg)
+}
+
+// HandleDesktopFrame is called when the device sends a captured frame.
+// It forwards the frame to the browser WebSocket.
+func (g *Gateway) HandleDesktopFrame(ctx context.Context, sessionID string, frame *DesktopFramePayload) error {
+	val, ok := g.desktopSessions.Load(sessionID)
+	if !ok {
+		return fmt.Errorf("desktop session %s not found", sessionID)
+	}
+	ds := val.(*DesktopSession)
+	if ds.closed.Load() {
+		return nil
+	}
+
+	output := map[string]any{
+		"type":       "frame",
+		"session_id": sessionID,
+		"format":     frame.Format,
+		"width":      frame.Width,
+		"height":     frame.Height,
+		"data":       frame.Data,
+		"timestamp":  frame.Timestamp,
+	}
+	outData, _ := json.Marshal(output)
+
+	ds.mu.Lock()
+	defer ds.mu.Unlock()
+	return ds.browser.Write(ctx, websocket.MessageText, outData)
+}
+
+// EndDesktopSession terminates a desktop session.
+func (g *Gateway) EndDesktopSession(ctx context.Context, sessionID, reason string) {
+	val, ok := g.desktopSessions.LoadAndDelete(sessionID)
+	if !ok {
+		return
+	}
+	ds := val.(*DesktopSession)
+	if ds.closed.Swap(true) {
+		return
+	}
+
+	endPayload := DesktopEndPayload{
+		SessionID: sessionID,
+		Reason:    reason,
+	}
+	data, _ := json.Marshal(endPayload)
+	msg := &Message{
+		Type:      "desktop_end",
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   data,
+	}
+	ds.deviceConn.WriteMessage(ctx, msg)
+
+	endMsg, _ := json.Marshal(map[string]string{
+		"type":       "end",
+		"session_id": sessionID,
+		"reason":     reason,
+	})
+	ds.mu.Lock()
+	ds.browser.Write(ctx, websocket.MessageText, endMsg)
+	ds.mu.Unlock()
+	ds.browser.Close(websocket.StatusNormalClosure, reason)
+
+	log.Printf("[cdap] Desktop session %s ended: %s", sessionID, reason)
+
+	if g.auditLog != nil {
+		g.auditLog.Log("cdap_desktop_ended", ds.deviceConn.ClientIP, ds.Username, map[string]string{
+			"session_id": sessionID,
+			"device_id":  ds.DeviceID,
+			"reason":     reason,
+		})
+	}
+}
diff --git a/betterdesk-server/cdap/filebrowser.go b/betterdesk-server/cdap/filebrowser.go
new file mode 100644
index 00000000..4382e156
--- /dev/null
+++ b/betterdesk-server/cdap/filebrowser.go
@@ -0,0 +1,271 @@
+// Package cdap — filebrowser handles file browsing and transfer sessions
+// between the admin panel and CDAP devices. Uses a request-response pattern
+// over WebSocket for directory listing, file download, and file upload.
+package cdap
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/coder/websocket"
+)
+
+// FileSession represents an active file browser session.
+type FileSession struct {
+	ID       string
+	DeviceID string
+	Username string
+	Role     string
+
+	browser    *websocket.Conn
+	deviceConn *DeviceConn
+
+	// pending tracks in-flight requests awaiting device response.
+	pending sync.Map // requestID → chan *Message
+
+	createdAt time.Time
+	mu        sync.Mutex
+	closed    atomic.Bool
+}
+
+// FileListRequest asks the device to list a directory.
+type FileListRequest struct {
+	SessionID string `json:"session_id"`
+	RequestID string `json:"request_id"`
+	Path      string `json:"path"`
+}
+
+// FileListResponse is sent from the device with directory contents.
+type FileListResponse struct {
+	SessionID string      `json:"session_id"`
+	RequestID string      `json:"request_id"`
+	Path      string      `json:"path"`
+	Entries   []FileEntry `json:"entries"`
+	Error     string      `json:"error,omitempty"`
+}
+
+// FileEntry represents a single file or directory.
+type FileEntry struct {
+	Name     string `json:"name"`
+	IsDir    bool   `json:"is_dir"`
+	Size     int64  `json:"size"`
+	Modified string `json:"modified"` // RFC3339
+	Mode     string `json:"mode,omitempty"`
+}
+
+// FileReadRequest asks the device to read (download) a file.
+type FileReadRequest struct {
+	SessionID string `json:"session_id"`
+	RequestID string `json:"request_id"`
+	Path      string `json:"path"`
+	Offset    int64  `json:"offset,omitempty"`
+	Length    int64  `json:"length,omitempty"` // 0 = entire file
+}
+
+// FileReadResponse is sent from the device with file data.
+type FileReadResponse struct {
+	SessionID string `json:"session_id"`
+	RequestID string `json:"request_id"`
+	Path      string `json:"path"`
+	Data      string `json:"data"` // base64-encoded content
+	Size      int64  `json:"size"` // total file size
+	Offset    int64  `json:"offset"`
+	Done      bool   `json:"done"`
+	Error     string `json:"error,omitempty"`
+}
+
+// FileWriteRequest asks the device to create/write a file.
+type FileWriteRequest struct {
+	SessionID string `json:"session_id"`
+	RequestID string `json:"request_id"`
+	Path      string `json:"path"`
+	Data      string `json:"data"` // base64-encoded content
+	Offset    int64  `json:"offset,omitempty"`
+	Done      bool   `json:"done"` // true = last chunk
+}
+
+// FileWriteResponse confirms write status.
+type FileWriteResponse struct {
+	SessionID string `json:"session_id"`
+	RequestID string `json:"request_id"`
+	Path      string `json:"path"`
+	Written   int64  `json:"written"`
+	Error     string `json:"error,omitempty"`
+}
+
+// FileDeleteRequest asks the device to delete a file or directory.
+type FileDeleteRequest struct {
+	SessionID string `json:"session_id"`
+	RequestID string `json:"request_id"`
+	Path      string `json:"path"`
+}
+
+// FileEndPayload is sent when a file browser session ends.
+type FileEndPayload struct {
+	SessionID string `json:"session_id"`
+	Reason    string `json:"reason,omitempty"`
+}
+
+// StartFileSession creates a new file browser session between the
+// browser and a CDAP device.
+func (g *Gateway) StartFileSession(ctx context.Context, browserConn *websocket.Conn, deviceID, username, role string) (*FileSession, error) {
+	dc := g.GetDeviceConn(deviceID)
+	if dc == nil {
+		return nil, fmt.Errorf("device %s not connected", deviceID)
+	}
+
+	if dc.Manifest != nil {
+		hasFile := false
+		for _, cap := range dc.Manifest.Capabilities {
+			if cap == "file_transfer" {
+				hasFile = true
+				break
+			}
+		}
+		if !hasFile {
+			return nil, fmt.Errorf("device %s does not support file_transfer", deviceID)
+		}
+	}
+
+	sessionID := fmt.Sprintf("file_%s_%d", deviceID, time.Now().UnixNano())
+
+	fs := &FileSession{
+		ID:         sessionID,
+		DeviceID:   deviceID,
+		Username:   username,
+		Role:       role,
+		browser:    browserConn,
+		deviceConn: dc,
+		createdAt:  time.Now(),
+	}
+
+	// Notify device that a file browser session is starting.
+	startPayload, _ := json.Marshal(map[string]string{
+		"session_id": sessionID,
+	})
+	msg := &Message{
+		Type:      "file_start",
+		ID:        sessionID,
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   startPayload,
+	}
+
+	if err := dc.WriteMessage(ctx, msg); err != nil {
+		return nil, fmt.Errorf("send file_start to device: %w", err)
+	}
+
+	g.fileSessions.Store(sessionID, fs)
+
+	log.Printf("[cdap] File session %s started for device %s by %s", sessionID, deviceID, username)
+
+	if g.auditLog != nil {
+		g.auditLog.Log("cdap_file_started", dc.ClientIP, username, map[string]string{
+			"session_id": sessionID,
+			"device_id":  deviceID,
+		})
+	}
+
+	return fs, nil
+}
+
+// RelayFileRequest forwards a file browser request (list, read, write, delete)
+// from the browser to the device.
+func (g *Gateway) RelayFileRequest(ctx context.Context, sessionID, requestType string, payload json.RawMessage) error {
+	val, ok := g.fileSessions.Load(sessionID)
+	if !ok {
+		return fmt.Errorf("file session %s not found", sessionID)
+	}
+	fs := val.(*FileSession)
+	if fs.closed.Load() {
+		return fmt.Errorf("file session %s is closed", sessionID)
+	}
+
+	msg := &Message{
+		Type:      requestType, // file_list, file_read, file_write, file_delete
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   payload,
+	}
+
+	return fs.deviceConn.WriteMessage(ctx, msg)
+}
+
+// HandleFileResponse is called when the device sends a file browser response.
+// It forwards the response to the browser WebSocket.
+func (g *Gateway) HandleFileResponse(ctx context.Context, sessionID, responseType string, payload json.RawMessage) error {
+	val, ok := g.fileSessions.Load(sessionID)
+	if !ok {
+		return fmt.Errorf("file session %s not found", sessionID)
+	}
+	fs := val.(*FileSession)
+	if fs.closed.Load() {
+		return nil
+	}
+
+	output := map[string]any{
+		"type":       responseType,
+		"session_id": sessionID,
+	}
+
+	// Parse the payload to embed it inline
+	var raw map[string]any
+	if json.Unmarshal(payload, &raw) == nil {
+		for k, v := range raw {
+			output[k] = v
+		}
+	}
+
+	outData, _ := json.Marshal(output)
+
+	fs.mu.Lock()
+	defer fs.mu.Unlock()
+	return fs.browser.Write(ctx, websocket.MessageText, outData)
+}
+
+// EndFileSession terminates a file browser session.
+func (g *Gateway) EndFileSession(ctx context.Context, sessionID, reason string) {
+	val, ok := g.fileSessions.LoadAndDelete(sessionID)
+	if !ok {
+		return
+	}
+	fs := val.(*FileSession)
+	if fs.closed.Swap(true) {
+		return
+	}
+
+	endPayload := FileEndPayload{
+		SessionID: sessionID,
+		Reason:    reason,
+	}
+	data, _ := json.Marshal(endPayload)
+	msg := &Message{
+		Type:      "file_end",
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   data,
+	}
+	fs.deviceConn.WriteMessage(ctx, msg)
+
+	endMsg, _ := json.Marshal(map[string]string{
+		"type":       "end",
+		"session_id": sessionID,
+		"reason":     reason,
+	})
+	fs.mu.Lock()
+	fs.browser.Write(ctx, websocket.MessageText, endMsg)
+	fs.mu.Unlock()
+	fs.browser.Close(websocket.StatusNormalClosure, reason)
+
+	log.Printf("[cdap] File session %s ended: %s", sessionID, reason)
+
+	if g.auditLog != nil {
+		g.auditLog.Log("cdap_file_ended", fs.deviceConn.ClientIP, fs.Username, map[string]string{
+			"session_id": sessionID,
+			"device_id":  fs.DeviceID,
+			"reason":     reason,
+		})
+	}
+}
diff --git a/betterdesk-server/cdap/gateway.go b/betterdesk-server/cdap/gateway.go
index 690fa0df..142bd044 100644
--- a/betterdesk-server/cdap/gateway.go
+++ b/betterdesk-server/cdap/gateway.go
@@ -41,9 +41,33 @@ type Gateway struct {
 	httpSrv *http.Server
 	ln      net.Listener
 
+	// alertEngine evaluates manifest alert definitions on state changes.
+	alertEngine *AlertEngine
+
+	// delegations stores active auth delegations (admin → user grants).
+	delegations *DelegationStore
+
 	// devices holds all authenticated CDAP connections keyed by device ID.
 	devices sync.Map // map[string]*DeviceConn
 
+	// pendingCommands tracks commands sent to devices, keyed by command ID.
+	pendingCommands sync.Map // map[string]*PendingCommand
+
+	// terminalSessions tracks active terminal sessions, keyed by session ID.
+	terminalSessions sync.Map // map[string]*TerminalSession
+
+	// desktopSessions tracks active remote desktop sessions, keyed by session ID.
+	desktopSessions sync.Map // map[string]*DesktopSession
+
+	// videoSessions tracks active video stream sessions, keyed by session ID.
+	videoSessions sync.Map // map[string]*VideoSession
+
+	// fileSessions tracks active file browser sessions, keyed by session ID.
+	fileSessions sync.Map // map[string]*FileSession
+
+	// audioSessions tracks active audio stream sessions, keyed by session ID.
+	audioSessions sync.Map // map[string]*AudioSession
+
 	ctx    context.Context
 	cancel context.CancelFunc
 	wg     sync.WaitGroup
@@ -54,14 +78,28 @@ type Gateway struct {
 	version string
 }
 
+// PendingCommand tracks a command sent to a device, awaiting ACK/NACK.
+type PendingCommand struct {
+	CommandID string
+	DeviceID  string
+	SentAt    time.Time
+	ResultCh  chan *CommandResponsePayload // optional; nil if fire-and-forget
+}
+
 // New creates a new CDAP gateway.
 func New(cfg *config.Config, database db.Database, peerMap *peer.Map, eventBus *events.Bus) *Gateway {
+	rateLimit := cfg.CDAPRateLimit
+	if rateLimit <= 0 {
+		rateLimit = 30
+	}
 	return &Gateway{
-		cfg:      cfg,
-		db:       database,
-		peerMap:  peerMap,
-		eventBus: eventBus,
-		limiter:  ratelimit.NewIPLimiter(10, 1*time.Minute, 5*time.Minute),
+		cfg:         cfg,
+		db:          database,
+		peerMap:     peerMap,
+		eventBus:    eventBus,
+		limiter:     ratelimit.NewIPLimiter(rateLimit, 1*time.Minute, 5*time.Minute),
+		alertEngine: NewAlertEngine(eventBus),
+		delegations: NewDelegationStore(),
 	}
 }
 
@@ -80,6 +118,9 @@ func (g *Gateway) SetRateLimiter(l *ratelimit.IPLimiter) { g.limiter = l }
 // SetVersion sets the version string for startup log.
 func (g *Gateway) SetVersion(v string) { g.version = v }
 
+// Delegations returns the delegation store for auth delegation management.
+func (g *Gateway) Delegations() *DelegationStore { return g.delegations }
+
 // Start binds the WebSocket listener and begins accepting connections.
 func (g *Gateway) Start(ctx context.Context) error {
 	g.ctx, g.cancel = context.WithCancel(ctx)
@@ -125,6 +166,10 @@ func (g *Gateway) Start(ctx context.Context) error {
 	g.wg.Add(1)
 	go g.heartbeatMonitor()
 
+	// Delegation cleanup: purge expired delegations every 5 minutes
+	g.wg.Add(1)
+	go g.delegationCleaner()
+
 	scheme := "ws"
 	if g.cfg.CDAPTLSEnabled() {
 		scheme = "wss"
@@ -282,13 +327,44 @@ func (g *Gateway) messageLoop(ctx context.Context, dc *DeviceConn) {
 			return
 		case "token_refresh":
 			g.handleTokenRefresh(ctx, dc, msg)
+		case "terminal_output":
+			g.handleTerminalOutput(ctx, dc, msg)
+		case "terminal_end":
+			g.handleTerminalEnd(ctx, dc, msg)
+		case "desktop_frame":
+			g.handleDesktopFrame(ctx, dc, msg)
+		case "desktop_end":
+			g.handleDesktopEnd(ctx, dc, msg)
+		case "video_frame":
+			g.handleVideoFrame(ctx, dc, msg)
+		case "video_end":
+			g.handleVideoEnd(ctx, dc, msg)
+		case "file_list_response", "file_read_response", "file_write_response", "file_delete_response":
+			g.handleFileResponse(ctx, dc, msg)
+		case "file_end":
+			g.handleFileEnd(ctx, dc, msg)
+		case "audio_frame":
+			g.handleAudioFrame(ctx, dc, msg)
+		case "audio_end":
+			g.handleAudioEnd(ctx, dc, msg)
+		case "clipboard_update":
+			g.HandleClipboardUpdate(dc.ID, msg.Payload)
+		case "key_exchange":
+			g.HandleKeyExchange(ctx, dc.ID, msg.Payload)
+		case "cursor_update":
+			g.HandleCursorUpdate(ctx, dc.ID, msg.Payload)
+		case "codec_answer":
+			g.HandleCodecAnswer(ctx, dc.ID, msg.Payload)
+		case "monitor_list":
+			g.HandleMonitorList(ctx, dc.ID, msg.Payload)
 		default:
 			sendError(ctx, dc.conn, 1006, fmt.Sprintf("unknown message type: %s", msg.Type))
 		}
 	}
 }
 
-// heartbeatMonitor periodically checks for stale CDAP connections.
+// heartbeatMonitor periodically checks for stale CDAP connections
+// and cleans up expired pending commands.
 func (g *Gateway) heartbeatMonitor() {
 	defer g.wg.Done()
 	ticker := time.NewTicker(30 * time.Second)
@@ -317,6 +393,39 @@ func (g *Gateway) heartbeatMonitor() {
 				}
 				return true
 			})
+
+			// Cleanup stale pending commands (>2 min without response)
+			g.pendingCommands.Range(func(key, value any) bool {
+				pc, ok := value.(*PendingCommand)
+				if !ok {
+					return true
+				}
+				if now.Sub(pc.SentAt) > 2*time.Minute {
+					if pc.ResultCh != nil {
+						close(pc.ResultCh)
+					}
+					g.pendingCommands.Delete(key)
+				}
+				return true
+			})
+		}
+	}
+}
+
+// delegationCleaner periodically purges expired auth delegations.
+func (g *Gateway) delegationCleaner() {
+	defer g.wg.Done()
+	ticker := time.NewTicker(5 * time.Minute)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-g.ctx.Done():
+			return
+		case <-ticker.C:
+			if n := g.delegations.CleanExpired(); n > 0 {
+				log.Printf("[cdap] Cleaned %d expired delegation(s)", n)
+			}
 		}
 	}
 }
@@ -328,6 +437,27 @@ func (g *Gateway) removeDevice(dc *DeviceConn) {
 	}
 	g.devices.Delete(dc.ID)
 
+	// Clear any firing alerts for this device
+	if g.alertEngine != nil {
+		g.alertEngine.RemoveDevice(dc.ID)
+	}
+
+	// Clean up manifest from server_config
+	if err := g.db.DeleteConfig(fmt.Sprintf("cdap_manifest_%s", dc.ID)); err != nil {
+		log.Printf("[cdap] %s: failed to delete manifest: %v", dc.ID, err)
+	}
+
+	// Clean up pending commands for this device
+	g.pendingCommands.Range(func(key, value any) bool {
+		if pc, ok := value.(*PendingCommand); ok && pc.DeviceID == dc.ID {
+			if pc.ResultCh != nil {
+				close(pc.ResultCh)
+			}
+			g.pendingCommands.Delete(key)
+		}
+		return true
+	})
+
 	// Update peer status to OFFLINE
 	if err := g.db.UpdatePeerStatus(dc.ID, "OFFLINE", dc.ClientIP); err != nil {
 		log.Printf("[cdap] %s: failed to set offline: %v", dc.ID, err)
@@ -347,8 +477,8 @@ func (g *Gateway) removeDevice(dc *DeviceConn) {
 	log.Printf("[cdap] %s: disconnected (session: %s)", dc.ID, time.Since(dc.ConnectedAt).Round(time.Second))
 }
 
-// SendCommand sends a command to a connected CDAP device.
-// Returns error if the device is not connected.
+// SendCommand sends a command to a connected CDAP device and tracks it
+// for ACK/NACK. Returns error if the device is not connected.
 func (g *Gateway) SendCommand(ctx context.Context, deviceID string, cmd *CommandMessage) error {
 	val, ok := g.devices.Load(deviceID)
 	if !ok {
@@ -356,6 +486,13 @@ func (g *Gateway) SendCommand(ctx context.Context, deviceID string, cmd *Command
 	}
 	dc := val.(*DeviceConn)
 
+	// Track pending command
+	g.pendingCommands.Store(cmd.ID, &PendingCommand{
+		CommandID: cmd.ID,
+		DeviceID:  deviceID,
+		SentAt:    time.Now(),
+	})
+
 	dc.CommandCount.Add(1)
 	return dc.WriteMessage(ctx, &Message{
 		Type:      "command",
@@ -365,6 +502,44 @@ func (g *Gateway) SendCommand(ctx context.Context, deviceID string, cmd *Command
 	})
 }
 
+// ResolvePendingCommand resolves a pending command by ID.
+// Returns the PendingCommand and true if found, nil and false otherwise.
+func (g *Gateway) ResolvePendingCommand(commandID string) (*PendingCommand, bool) {
+	val, ok := g.pendingCommands.LoadAndDelete(commandID)
+	if !ok {
+		return nil, false
+	}
+	return val.(*PendingCommand), true
+}
+
+// SendRevoke sends a revocation message to a connected CDAP device
+// and forcefully closes its connection.
+func (g *Gateway) SendRevoke(ctx context.Context, deviceID, reason string) error {
+	val, ok := g.devices.Load(deviceID)
+	if !ok {
+		return fmt.Errorf("device %s not connected", deviceID)
+	}
+	dc := val.(*DeviceConn)
+
+	// Send revoke message (best-effort)
+	revokeCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	sendMessage(revokeCtx, dc.conn, "revoke", map[string]string{
+		"reason": reason,
+	})
+
+	// Close the connection
+	dc.Close(4003, reason)
+	g.removeDevice(dc)
+
+	g.auditAction("cdap_revoke", deviceID, map[string]string{
+		"reason": reason,
+	})
+
+	log.Printf("[cdap] %s: revoked (%s)", deviceID, reason)
+	return nil
+}
+
 // GetDeviceConn returns the connection for a device, or nil if not connected.
 func (g *Gateway) GetDeviceConn(deviceID string) *DeviceConn {
 	val, ok := g.devices.Load(deviceID)
diff --git a/betterdesk-server/cdap/handler.go b/betterdesk-server/cdap/handler.go
index 990760ea..fe085979 100644
--- a/betterdesk-server/cdap/handler.go
+++ b/betterdesk-server/cdap/handler.go
@@ -60,16 +60,17 @@ func (g *Gateway) handleRegister(ctx context.Context, dc *DeviceConn) error {
 	// Upsert the peer in the database
 	tags := strings.Join(rp.Manifest.Device.Tags, ",")
 	peer := &db.Peer{
-		ID:         dc.ID,
-		Hostname:   rp.Manifest.Device.Name,
-		Status:     "ONLINE",
-		IP:         dc.ClientIP,
-		DeviceType: rp.Manifest.Device.Type,
-		Tags:       tags,
-		User:       dc.Username,
-		LastOnline: time.Now(),
-		OS:         rp.Manifest.Bridge.Protocol,
-		Version:    rp.Manifest.Bridge.Version,
+		ID:           dc.ID,
+		Hostname:     rp.Manifest.Device.Name,
+		Status:       "ONLINE",
+		IP:           dc.ClientIP,
+		DeviceType:   rp.Manifest.Device.Type,
+		LinkedPeerID: rp.Manifest.Device.LinkedPeerID,
+		Tags:         tags,
+		User:         dc.Username,
+		LastOnline:   time.Now(),
+		OS:           rp.Manifest.Bridge.Protocol,
+		Version:      rp.Manifest.Bridge.Version,
 	}
 	if err := g.db.UpsertPeer(peer); err != nil {
 		return fmt.Errorf("save peer: %w", err)
@@ -154,6 +155,11 @@ func (g *Gateway) handleHeartbeat(ctx context.Context, dc *DeviceConn, msg *Mess
 			dc.widgetState.Store(widgetID, value)
 		}
 
+		// Evaluate alert conditions
+		if g.alertEngine != nil && dc.Manifest != nil {
+			g.alertEngine.Evaluate(dc.ID, dc.Manifest, collectWidgetState(dc))
+		}
+
 		// Publish widget state update event
 		if g.eventBus != nil {
 			valuesJSON, _ := json.Marshal(payload.WidgetValues)
@@ -192,6 +198,11 @@ func (g *Gateway) handleStateUpdate(ctx context.Context, dc *DeviceConn, msg *Me
 	// Update cached state
 	dc.widgetState.Store(payload.WidgetID, payload.Value)
 
+	// Evaluate alert conditions
+	if g.alertEngine != nil && dc.Manifest != nil {
+		g.alertEngine.Evaluate(dc.ID, dc.Manifest, collectWidgetState(dc))
+	}
+
 	// Publish to event bus for real-time panel updates
 	if g.eventBus != nil {
 		valueJSON, _ := json.Marshal(payload.Value)
@@ -222,6 +233,11 @@ func (g *Gateway) handleBulkUpdate(ctx context.Context, dc *DeviceConn, msg *Mes
 		}
 	}
 
+	// Evaluate alert conditions after all updates are applied
+	if g.alertEngine != nil && dc.Manifest != nil && len(updates) > 0 {
+		g.alertEngine.Evaluate(dc.ID, dc.Manifest, collectWidgetState(dc))
+	}
+
 	if g.eventBus != nil && len(updates) > 0 {
 		valuesJSON, _ := json.Marshal(updates)
 		g.eventBus.Publish(events.Event{
@@ -242,6 +258,19 @@ func (g *Gateway) handleCommandResponse(ctx context.Context, dc *DeviceConn, msg
 		return
 	}
 
+	// Resolve pending command tracking
+	if pc, ok := g.ResolvePendingCommand(payload.CommandID); ok {
+		latency := time.Since(pc.SentAt)
+		if pc.ResultCh != nil {
+			select {
+			case pc.ResultCh <- &payload:
+			default:
+			}
+		}
+		log.Printf("[cdap] %s: command %s → %s (latency: %s)",
+			dc.ID, payload.CommandID, payload.Status, latency.Round(time.Millisecond))
+	}
+
 	// Publish to event bus so the panel can display the result
 	if g.eventBus != nil {
 		resultJSON, _ := json.Marshal(payload)
@@ -354,3 +383,136 @@ func (g *Gateway) handleTokenRefresh(ctx context.Context, dc *DeviceConn, msg *M
 		"expires_at": dc.TokenExpiry.UTC().Format(time.RFC3339),
 	})
 }
+
+// collectWidgetState builds a flat map of all cached widget values for a device.
+func collectWidgetState(dc *DeviceConn) map[string]any {
+	state := make(map[string]any)
+	dc.widgetState.Range(func(key, value any) bool {
+		state[key.(string)] = value
+		return true
+	})
+	return state
+}
+
+// handleTerminalOutput forwards terminal output from device to the browser.
+func (g *Gateway) handleTerminalOutput(ctx context.Context, dc *DeviceConn, msg *Message) {
+	var payload TerminalOutputPayload
+	if err := json.Unmarshal(msg.Payload, &payload); err != nil {
+		return
+	}
+	if payload.SessionID == "" {
+		return
+	}
+	if payload.Stream == "" {
+		payload.Stream = "stdout"
+	}
+	g.HandleTerminalOutput(ctx, payload.SessionID, payload.Data, payload.Stream)
+}
+
+// handleTerminalEnd processes device-initiated terminal session end.
+func (g *Gateway) handleTerminalEnd(ctx context.Context, dc *DeviceConn, msg *Message) {
+	var payload TerminalEndPayload
+	if err := json.Unmarshal(msg.Payload, &payload); err != nil {
+		return
+	}
+	if payload.SessionID == "" {
+		return
+	}
+	g.EndTerminalSession(ctx, payload.SessionID, payload.Reason)
+}
+
+// handleDesktopFrame forwards a desktop frame from device to the browser.
+func (g *Gateway) handleDesktopFrame(ctx context.Context, dc *DeviceConn, msg *Message) {
+	var payload DesktopFramePayload
+	if err := json.Unmarshal(msg.Payload, &payload); err != nil {
+		return
+	}
+	if payload.SessionID == "" {
+		return
+	}
+	g.HandleDesktopFrame(ctx, payload.SessionID, &payload)
+}
+
+// handleDesktopEnd processes device-initiated desktop session end.
+func (g *Gateway) handleDesktopEnd(ctx context.Context, dc *DeviceConn, msg *Message) {
+	var payload DesktopEndPayload
+	if err := json.Unmarshal(msg.Payload, &payload); err != nil {
+		return
+	}
+	if payload.SessionID == "" {
+		return
+	}
+	g.EndDesktopSession(ctx, payload.SessionID, payload.Reason)
+}
+
+// handleVideoFrame forwards a video frame from device to the browser.
+func (g *Gateway) handleVideoFrame(ctx context.Context, dc *DeviceConn, msg *Message) {
+	var payload VideoFramePayload
+	if err := json.Unmarshal(msg.Payload, &payload); err != nil {
+		return
+	}
+	if payload.SessionID == "" {
+		return
+	}
+	g.HandleVideoFrame(ctx, payload.SessionID, &payload)
+}
+
+// handleVideoEnd processes device-initiated video session end.
+func (g *Gateway) handleVideoEnd(ctx context.Context, dc *DeviceConn, msg *Message) {
+	var payload VideoEndPayload
+	if err := json.Unmarshal(msg.Payload, &payload); err != nil {
+		return
+	}
+	if payload.SessionID == "" {
+		return
+	}
+	g.EndVideoSession(ctx, payload.SessionID, payload.Reason)
+}
+
+// handleFileResponse forwards a file browser response from device to browser.
+func (g *Gateway) handleFileResponse(ctx context.Context, dc *DeviceConn, msg *Message) {
+	// Extract session_id from the payload
+	var base struct {
+		SessionID string `json:"session_id"`
+	}
+	if err := json.Unmarshal(msg.Payload, &base); err != nil || base.SessionID == "" {
+		return
+	}
+	g.HandleFileResponse(ctx, base.SessionID, msg.Type, msg.Payload)
+}
+
+// handleFileEnd processes device-initiated file session end.
+func (g *Gateway) handleFileEnd(ctx context.Context, dc *DeviceConn, msg *Message) {
+	var payload FileEndPayload
+	if err := json.Unmarshal(msg.Payload, &payload); err != nil {
+		return
+	}
+	if payload.SessionID == "" {
+		return
+	}
+	g.EndFileSession(ctx, payload.SessionID, payload.Reason)
+}
+
+// handleAudioFrame forwards an audio frame from device to the browser.
+func (g *Gateway) handleAudioFrame(ctx context.Context, dc *DeviceConn, msg *Message) {
+	var payload AudioFramePayload
+	if err := json.Unmarshal(msg.Payload, &payload); err != nil {
+		return
+	}
+	if payload.SessionID == "" {
+		return
+	}
+	g.HandleAudioFrame(ctx, payload.SessionID, &payload)
+}
+
+// handleAudioEnd processes device-initiated audio session end.
+func (g *Gateway) handleAudioEnd(ctx context.Context, dc *DeviceConn, msg *Message) {
+	var payload AudioEndPayload
+	if err := json.Unmarshal(msg.Payload, &payload); err != nil {
+		return
+	}
+	if payload.SessionID == "" {
+		return
+	}
+	g.EndAudioSession(ctx, payload.SessionID, payload.Reason)
+}
diff --git a/betterdesk-server/cdap/manifest.go b/betterdesk-server/cdap/manifest.go
index 83acd129..90f96d88 100644
--- a/betterdesk-server/cdap/manifest.go
+++ b/betterdesk-server/cdap/manifest.go
@@ -19,16 +19,17 @@ type Manifest struct {
 
 // ManifestDevice describes the physical/virtual device identity.
 type ManifestDevice struct {
-	Name        string   `json:"name"`
-	Type        string   `json:"type"` // scada, iot, os_agent, network, camera, desktop, custom
-	Vendor      string   `json:"vendor,omitempty"`
-	Model       string   `json:"model,omitempty"`
-	Firmware    string   `json:"firmware,omitempty"`
-	Serial      string   `json:"serial,omitempty"`
-	Location    string   `json:"location,omitempty"`
-	Tags        []string `json:"tags,omitempty"`
-	Icon        string   `json:"icon,omitempty"`
-	Description string   `json:"description,omitempty"`
+	Name         string   `json:"name"`
+	Type         string   `json:"type"` // scada, iot, os_agent, network, camera, desktop, custom
+	Vendor       string   `json:"vendor,omitempty"`
+	Model        string   `json:"model,omitempty"`
+	Firmware     string   `json:"firmware,omitempty"`
+	Serial       string   `json:"serial,omitempty"`
+	Location     string   `json:"location,omitempty"`
+	Tags         []string `json:"tags,omitempty"`
+	Icon         string   `json:"icon,omitempty"`
+	Description  string   `json:"description,omitempty"`
+	LinkedPeerID string   `json:"linked_peer_id,omitempty"` // RustDesk peer ID to link this CDAP device with
 }
 
 // ManifestBridge describes the bridge software connecting the device to CDAP.
@@ -78,6 +79,9 @@ type Widget struct {
 	Columns  []TableColumn `json:"columns,omitempty"`
 	MaxRows  int           `json:"max_rows,omitempty"`
 	Sortable bool          `json:"sortable,omitempty"`
+
+	// RBAC permissions (optional, defaults applied if nil)
+	Permissions *WidgetPermissions `json:"permissions,omitempty"`
 }
 
 // WidgetOption for select widgets.
@@ -101,6 +105,15 @@ type TableColumn struct {
 	Type  string `json:"type,omitempty"` // string, number, boolean, date
 }
 
+// WidgetPermissions defines per-widget RBAC rules.
+// Each field names the minimum role required for that operation class.
+// Valid roles: "admin", "operator", "viewer".  Empty string means unrestricted.
+type WidgetPermissions struct {
+	Read    string `json:"read,omitempty"`    // required role to see widget state (default: viewer)
+	Control string `json:"control,omitempty"` // required role for set/trigger/reset (default: operator)
+	Execute string `json:"execute,omitempty"` // required role for execute action (default: admin)
+}
+
 // AlertDef defines a threshold-based alert.
 type AlertDef struct {
 	ID        string `json:"id"`
@@ -155,6 +168,101 @@ var allowedCapabilities = map[string]bool{
 // maxWidgets is the hard limit on widget count per device.
 const maxWidgets = 200
 
+// roleLevel maps a role name to a numeric authority level.
+// Higher number = more privilege.
+var roleLevel = map[string]int{
+	"viewer":   1,
+	"operator": 2,
+	"admin":    3,
+}
+
+// RoleLevel returns the numeric authority level for a role name.
+// Returns 0 for unknown roles.
+func RoleLevel(role string) int {
+	return roleLevel[role]
+}
+
+// allowedRoles is used for validation of permission fields.
+var allowedRoles = map[string]bool{
+	"admin":    true,
+	"operator": true,
+	"viewer":   true,
+}
+
+// dangerousWidgetTypes default to admin-level execute permission.
+var dangerousWidgetTypes = map[string]bool{
+	"terminal":     true,
+	"desktop":      true,
+	"file_browser": true,
+}
+
+// DefaultPermissions returns the default RBAC permissions for a widget type.
+func DefaultPermissions(widgetType string) *WidgetPermissions {
+	p := &WidgetPermissions{
+		Read:    "viewer",
+		Control: "operator",
+		Execute: "operator",
+	}
+	if dangerousWidgetTypes[widgetType] {
+		p.Control = "admin"
+		p.Execute = "admin"
+	}
+	return p
+}
+
+// EffectivePermissions returns the permissions for a widget,
+// using explicit values when set and defaults otherwise.
+func EffectivePermissions(w *Widget) *WidgetPermissions {
+	def := DefaultPermissions(w.Type)
+	if w.Permissions == nil {
+		return def
+	}
+	p := *w.Permissions
+	if p.Read == "" {
+		p.Read = def.Read
+	}
+	if p.Control == "" {
+		p.Control = def.Control
+	}
+	if p.Execute == "" {
+		p.Execute = def.Execute
+	}
+	return &p
+}
+
+// actionPermissionType maps a command action to the permission class it requires.
+func actionPermissionType(action string) string {
+	switch action {
+	case "query":
+		return "read"
+	case "execute":
+		return "execute"
+	default: // set, trigger, reset
+		return "control"
+	}
+}
+
+// CheckWidgetPermission returns true if the given role has sufficient
+// privilege to perform the specified action on the widget.
+func CheckWidgetPermission(role, action string, w *Widget) bool {
+	perm := EffectivePermissions(w)
+	permType := actionPermissionType(action)
+
+	var requiredRole string
+	switch permType {
+	case "read":
+		requiredRole = perm.Read
+	case "execute":
+		requiredRole = perm.Execute
+	default:
+		requiredRole = perm.Control
+	}
+
+	userLevel := roleLevel[role]
+	requiredLevel := roleLevel[requiredRole]
+	return userLevel >= requiredLevel
+}
+
 // ParseManifest parses and validates a CDAP device manifest from raw JSON.
 func ParseManifest(data json.RawMessage) (*Manifest, error) {
 	var m Manifest
@@ -237,6 +345,19 @@ func ValidateManifest(m *Manifest) error {
 		if w.Label == "" {
 			w.Label = w.ID
 		}
+
+		// Permission field validation
+		if w.Permissions != nil {
+			for _, rv := range []struct{ name, val string }{
+				{"read", w.Permissions.Read},
+				{"control", w.Permissions.Control},
+				{"execute", w.Permissions.Execute},
+			} {
+				if rv.val != "" && !allowedRoles[rv.val] {
+					return fmt.Errorf("widget %s: invalid permission role for %s: %s", w.ID, rv.name, rv.val)
+				}
+			}
+		}
 	}
 
 	// Alert validation
diff --git a/betterdesk-server/cdap/media_control.go b/betterdesk-server/cdap/media_control.go
new file mode 100644
index 00000000..4a4e4717
--- /dev/null
+++ b/betterdesk-server/cdap/media_control.go
@@ -0,0 +1,424 @@
+// Package cdap — media_control handles adaptive quality negotiation,
+// custom cursor rendering, codec negotiation, and multi-monitor support
+// for desktop and video sessions.
+package cdap
+
+import (
+	"context"
+	"encoding/json"
+	"log"
+	"time"
+
+	"github.com/coder/websocket"
+)
+
+// ──────────────────────────────────────────────────────────────────────
+// Cursor
+// ──────────────────────────────────────────────────────────────────────
+
+// CursorUpdatePayload carries custom cursor image and hotspot from device.
+type CursorUpdatePayload struct {
+	SessionID string `json:"session_id"`
+	Format    string `json:"format"`    // png, rgba
+	Width     int    `json:"width"`     // cursor image width
+	Height    int    `json:"height"`    // cursor image height
+	HotspotX  int    `json:"hotspot_x"` // click point offset X
+	HotspotY  int    `json:"hotspot_y"` // click point offset Y
+	Data      string `json:"data"`      // base64-encoded image data
+	CursorID  string `json:"cursor_id"` // stable ID for caching
+	Hidden    bool   `json:"hidden"`    // true = hide cursor
+}
+
+// HandleCursorUpdate forwards a custom cursor image from device to browser.
+func (g *Gateway) HandleCursorUpdate(ctx context.Context, deviceID string, payload json.RawMessage) {
+	var cursor CursorUpdatePayload
+	if err := json.Unmarshal(payload, &cursor); err != nil {
+		log.Printf("[cdap] Invalid cursor payload from %s: %v", deviceID, err)
+		return
+	}
+	if cursor.SessionID == "" {
+		return
+	}
+
+	val, ok := g.desktopSessions.Load(cursor.SessionID)
+	if !ok {
+		return
+	}
+	ds := val.(*DesktopSession)
+	if ds.DeviceID != deviceID || ds.closed.Load() {
+		return
+	}
+
+	fwdMsg, _ := json.Marshal(map[string]any{
+		"type":       "cursor_update",
+		"session_id": cursor.SessionID,
+		"format":     cursor.Format,
+		"width":      cursor.Width,
+		"height":     cursor.Height,
+		"hotspot_x":  cursor.HotspotX,
+		"hotspot_y":  cursor.HotspotY,
+		"data":       cursor.Data,
+		"cursor_id":  cursor.CursorID,
+		"hidden":     cursor.Hidden,
+	})
+
+	ds.mu.Lock()
+	_ = ds.browser.Write(ctx, websocket.MessageText, fwdMsg)
+	ds.mu.Unlock()
+}
+
+// ──────────────────────────────────────────────────────────────────────
+// Adaptive Quality
+// ──────────────────────────────────────────────────────────────────────
+
+// QualityReportPayload is sent by the browser with bandwidth/latency stats.
+type QualityReportPayload struct {
+	SessionID   string  `json:"session_id"`
+	BandwidthKB float64 `json:"bandwidth_kb"` // estimated KB/s
+	LatencyMS   int     `json:"latency_ms"`   // round-trip ms
+	FrameLoss   float64 `json:"frame_loss"`   // 0.0–1.0 fraction of dropped frames
+	FPS         int     `json:"fps"`          // actual received FPS
+}
+
+// QualityAdjustPayload is sent to the device to change stream parameters.
+type QualityAdjustPayload struct {
+	SessionID string `json:"session_id"`
+	Quality   int    `json:"quality,omitempty"` // JPEG quality 1–100
+	FPS       int    `json:"fps,omitempty"`     // target FPS
+	Width     int    `json:"width,omitempty"`   // target resolution
+	Height    int    `json:"height,omitempty"`
+	MaxKBps   int    `json:"max_kbps,omitempty"` // bandwidth cap
+}
+
+// HandleQualityReport processes a quality report from the browser and
+// computes adaptive quality adjustments for the device.
+func (g *Gateway) HandleQualityReport(ctx context.Context, sessionID string, payload json.RawMessage) {
+	var report QualityReportPayload
+	if err := json.Unmarshal(payload, &report); err != nil {
+		return
+	}
+
+	// Determine session type (desktop or video)
+	var deviceConn *DeviceConn
+	if val, ok := g.desktopSessions.Load(sessionID); ok {
+		ds := val.(*DesktopSession)
+		deviceConn = ds.deviceConn
+	} else if val, ok := g.videoSessions.Load(sessionID); ok {
+		vs := val.(*VideoSession)
+		deviceConn = vs.deviceConn
+	}
+	if deviceConn == nil {
+		return
+	}
+
+	// Compute adaptive quality based on network conditions
+	adjust := computeQualityAdjustment(&report)
+	if adjust == nil {
+		return // no adjustment needed
+	}
+	adjust.SessionID = sessionID
+
+	adjustData, _ := json.Marshal(adjust)
+	msg := &Message{
+		Type:      "quality_adjust",
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   adjustData,
+	}
+	deviceConn.WriteMessage(ctx, msg)
+}
+
+// computeQualityAdjustment returns a QualityAdjustPayload if conditions
+// warrant changing stream parameters, or nil if current settings are fine.
+func computeQualityAdjustment(report *QualityReportPayload) *QualityAdjustPayload {
+	var adjust QualityAdjustPayload
+	changed := false
+
+	// High latency → lower quality and FPS
+	if report.LatencyMS > 200 {
+		adjust.Quality = 40
+		adjust.FPS = 10
+		changed = true
+	} else if report.LatencyMS > 100 {
+		adjust.Quality = 60
+		adjust.FPS = 15
+		changed = true
+	}
+
+	// High frame loss → lower FPS
+	if report.FrameLoss > 0.2 {
+		adjust.FPS = 5
+		changed = true
+	} else if report.FrameLoss > 0.1 {
+		if adjust.FPS == 0 || adjust.FPS > 10 {
+			adjust.FPS = 10
+		}
+		changed = true
+	}
+
+	// Low bandwidth → lower quality
+	if report.BandwidthKB > 0 && report.BandwidthKB < 100 {
+		adjust.Quality = 30
+		adjust.MaxKBps = int(report.BandwidthKB * 0.8)
+		changed = true
+	} else if report.BandwidthKB > 0 && report.BandwidthKB < 500 {
+		if adjust.Quality == 0 || adjust.Quality > 50 {
+			adjust.Quality = 50
+		}
+		changed = true
+	}
+
+	if !changed {
+		return nil
+	}
+	return &adjust
+}
+
+// ──────────────────────────────────────────────────────────────────────
+// Codec Negotiation
+// ──────────────────────────────────────────────────────────────────────
+
+// CodecOfferPayload is sent by the browser declaring supported codecs.
+type CodecOfferPayload struct {
+	SessionID string   `json:"session_id"`
+	Video     []string `json:"video"`     // e.g. ["jpeg","png","h264","vp8"]
+	Audio     []string `json:"audio"`     // e.g. ["opus","pcm"]
+	Preferred string   `json:"preferred"` // preferred video codec
+}
+
+// CodecAnswerPayload is the device's chosen codec from the offer list.
+type CodecAnswerPayload struct {
+	SessionID  string `json:"session_id"`
+	VideoCodec string `json:"video_codec"` // chosen video codec
+	AudioCodec string `json:"audio_codec"` // chosen audio codec
+}
+
+// RelayCodecOffer forwards a codec offer from browser to device.
+func (g *Gateway) RelayCodecOffer(ctx context.Context, sessionID string, payload json.RawMessage) error {
+	var deviceConn *DeviceConn
+	if val, ok := g.desktopSessions.Load(sessionID); ok {
+		deviceConn = val.(*DesktopSession).deviceConn
+	} else if val, ok := g.videoSessions.Load(sessionID); ok {
+		deviceConn = val.(*VideoSession).deviceConn
+	}
+	if deviceConn == nil {
+		return nil
+	}
+
+	msg := &Message{
+		Type:      "codec_offer",
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   payload,
+	}
+	return deviceConn.WriteMessage(ctx, msg)
+}
+
+// HandleCodecAnswer forwards the device's codec choice to the browser.
+func (g *Gateway) HandleCodecAnswer(ctx context.Context, deviceID string, payload json.RawMessage) {
+	var answer CodecAnswerPayload
+	if err := json.Unmarshal(payload, &answer); err != nil {
+		return
+	}
+	if answer.SessionID == "" {
+		return
+	}
+
+	// Forward to the correct session's browser WS
+	if val, ok := g.desktopSessions.Load(answer.SessionID); ok {
+		ds := val.(*DesktopSession)
+		if ds.DeviceID == deviceID {
+			fwdMsg, _ := json.Marshal(map[string]any{
+				"type":        "codec_answer",
+				"session_id":  answer.SessionID,
+				"video_codec": answer.VideoCodec,
+				"audio_codec": answer.AudioCodec,
+			})
+			ds.mu.Lock()
+			_ = ds.browser.Write(ctx, websocket.MessageText, fwdMsg)
+			ds.mu.Unlock()
+		}
+	} else if val, ok := g.videoSessions.Load(answer.SessionID); ok {
+		vs := val.(*VideoSession)
+		if vs.DeviceID == deviceID {
+			fwdMsg, _ := json.Marshal(map[string]any{
+				"type":        "codec_answer",
+				"session_id":  answer.SessionID,
+				"video_codec": answer.VideoCodec,
+				"audio_codec": answer.AudioCodec,
+			})
+			vs.mu.Lock()
+			_ = vs.browser.Write(ctx, websocket.MessageText, fwdMsg)
+			vs.mu.Unlock()
+		}
+	}
+}
+
+// ──────────────────────────────────────────────────────────────────────
+// Multi-Monitor
+// ──────────────────────────────────────────────────────────────────────
+
+// MonitorInfo describes a single display attached to the device.
+type MonitorInfo struct {
+	Index   int    `json:"index"`
+	Name    string `json:"name"`
+	Width   int    `json:"width"`
+	Height  int    `json:"height"`
+	X       int    `json:"x"` // desktop position
+	Y       int    `json:"y"`
+	Primary bool   `json:"primary"`
+	ScaleF  int    `json:"scale_factor,omitempty"` // DPI scale percentage (100=1x)
+}
+
+// MonitorListPayload is sent by the device listing available displays.
+type MonitorListPayload struct {
+	SessionID string        `json:"session_id"`
+	Monitors  []MonitorInfo `json:"monitors"`
+	Active    int           `json:"active"` // currently streaming index
+}
+
+// MonitorSelectPayload is sent by the browser to switch displays.
+type MonitorSelectPayload struct {
+	SessionID string `json:"session_id"`
+	Index     int    `json:"index"` // monitor index to stream
+}
+
+// HandleMonitorList forwards the device's monitor list to the browser.
+func (g *Gateway) HandleMonitorList(ctx context.Context, deviceID string, payload json.RawMessage) {
+	var ml MonitorListPayload
+	if err := json.Unmarshal(payload, &ml); err != nil {
+		return
+	}
+	if ml.SessionID == "" {
+		return
+	}
+
+	val, ok := g.desktopSessions.Load(ml.SessionID)
+	if !ok {
+		return
+	}
+	ds := val.(*DesktopSession)
+	if ds.DeviceID != deviceID || ds.closed.Load() {
+		return
+	}
+
+	fwdMsg, _ := json.Marshal(map[string]any{
+		"type":       "monitor_list",
+		"session_id": ml.SessionID,
+		"monitors":   ml.Monitors,
+		"active":     ml.Active,
+	})
+
+	ds.mu.Lock()
+	_ = ds.browser.Write(ctx, websocket.MessageText, fwdMsg)
+	ds.mu.Unlock()
+}
+
+// RelayMonitorSelect forwards the browser's monitor selection to the device.
+func (g *Gateway) RelayMonitorSelect(ctx context.Context, sessionID string, index int) error {
+	val, ok := g.desktopSessions.Load(sessionID)
+	if !ok {
+		return nil
+	}
+	ds := val.(*DesktopSession)
+	if ds.closed.Load() {
+		return nil
+	}
+
+	payload := MonitorSelectPayload{
+		SessionID: sessionID,
+		Index:     index,
+	}
+	data, _ := json.Marshal(payload)
+	msg := &Message{
+		Type:      "monitor_select",
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   data,
+	}
+	return ds.deviceConn.WriteMessage(ctx, msg)
+}
+
+// ──────────────────────────────────────────────────────────────────────
+// Key Exchange Relay (E2E Crypto)
+// ──────────────────────────────────────────────────────────────────────
+
+// HandleKeyExchange relays an E2E key exchange message from the device
+// to the browser (or vice versa). The server is transparent — it cannot
+// read the exchanged keys or decrypt media frames.
+func (g *Gateway) HandleKeyExchange(ctx context.Context, deviceID string, payload json.RawMessage) {
+	var kx KeyExchangePayload
+	if err := json.Unmarshal(payload, &kx); err != nil {
+		log.Printf("[cdap] Invalid key_exchange from %s: %v", deviceID, err)
+		return
+	}
+	if kx.SessionID == "" {
+		return
+	}
+
+	// Forward to the correct session's browser WS
+	if val, ok := g.desktopSessions.Load(kx.SessionID); ok {
+		ds := val.(*DesktopSession)
+		if ds.DeviceID == deviceID {
+			ds.mu.Lock()
+			_ = ds.browser.Write(ctx, websocket.MessageText, payload)
+			ds.mu.Unlock()
+		}
+	} else if val, ok := g.videoSessions.Load(kx.SessionID); ok {
+		vs := val.(*VideoSession)
+		if vs.DeviceID == deviceID {
+			vs.mu.Lock()
+			_ = vs.browser.Write(ctx, websocket.MessageText, payload)
+			vs.mu.Unlock()
+		}
+	} else if val, ok := g.audioSessions.Load(kx.SessionID); ok {
+		as := val.(*AudioSession)
+		if as.DeviceID == deviceID {
+			as.mu.Lock()
+			_ = as.browser.Write(ctx, websocket.MessageText, payload)
+			as.mu.Unlock()
+		}
+	}
+}
+
+// RelayKeyExchangeToBrowser forwards a key_exchange from browser→device.
+func (g *Gateway) RelayKeyExchangeToDevice(ctx context.Context, sessionID string, payload json.RawMessage) error {
+	var deviceConn *DeviceConn
+	if val, ok := g.desktopSessions.Load(sessionID); ok {
+		deviceConn = val.(*DesktopSession).deviceConn
+	} else if val, ok := g.videoSessions.Load(sessionID); ok {
+		deviceConn = val.(*VideoSession).deviceConn
+	} else if val, ok := g.audioSessions.Load(sessionID); ok {
+		deviceConn = val.(*AudioSession).deviceConn
+	}
+	if deviceConn == nil {
+		return nil
+	}
+
+	msg := &Message{
+		Type:      "key_exchange",
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   payload,
+	}
+	return deviceConn.WriteMessage(ctx, msg)
+}
+
+// RelayKeyframeRequest forwards a keyframe request from browser to device.
+func (g *Gateway) RelayKeyframeRequest(ctx context.Context, sessionID string) error {
+	var deviceConn *DeviceConn
+	if val, ok := g.desktopSessions.Load(sessionID); ok {
+		deviceConn = val.(*DesktopSession).deviceConn
+	} else if val, ok := g.videoSessions.Load(sessionID); ok {
+		deviceConn = val.(*VideoSession).deviceConn
+	}
+	if deviceConn == nil {
+		return nil
+	}
+
+	payload, _ := json.Marshal(map[string]string{
+		"session_id": sessionID,
+	})
+	msg := &Message{
+		Type:      "keyframe_request",
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   payload,
+	}
+	return deviceConn.WriteMessage(ctx, msg)
+}
diff --git a/betterdesk-server/cdap/terminal.go b/betterdesk-server/cdap/terminal.go
new file mode 100644
index 00000000..a2cead5f
--- /dev/null
+++ b/betterdesk-server/cdap/terminal.go
@@ -0,0 +1,263 @@
+// Package cdap — terminal handles the binary WebSocket channel for
+// interactive terminal sessions between the admin panel and CDAP devices.
+package cdap
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/coder/websocket"
+)
+
+// TerminalSession represents an active terminal session relaying between
+// a browser client and a CDAP device.
+type TerminalSession struct {
+	ID       string
+	DeviceID string
+	Username string
+	Role     string
+
+	// browser is the WebSocket connection from the admin panel.
+	browser *websocket.Conn
+	// device points to the DeviceConn's underlying connection.
+	deviceConn *DeviceConn
+
+	createdAt time.Time
+	mu        sync.Mutex
+	closed    atomic.Bool
+}
+
+// TerminalInputPayload is sent from the browser to the device.
+type TerminalInputPayload struct {
+	SessionID string `json:"session_id"`
+	Data      string `json:"data"` // base64 or raw text
+}
+
+// TerminalOutputPayload is sent from the device to the browser.
+type TerminalOutputPayload struct {
+	SessionID string `json:"session_id"`
+	Data      string `json:"data"`
+	Stream    string `json:"stream"` // stdout, stderr
+}
+
+// TerminalResizePayload is sent when the browser terminal resizes.
+type TerminalResizePayload struct {
+	SessionID string `json:"session_id"`
+	Cols      int    `json:"cols"`
+	Rows      int    `json:"rows"`
+}
+
+// TerminalStartRequest is sent to the device to open a terminal session.
+type TerminalStartPayload struct {
+	SessionID string `json:"session_id"`
+	Shell     string `json:"shell,omitempty"` // optional shell path
+	Cols      int    `json:"cols"`
+	Rows      int    `json:"rows"`
+}
+
+// TerminalEndPayload is sent when a terminal session ends.
+type TerminalEndPayload struct {
+	SessionID string `json:"session_id"`
+	Reason    string `json:"reason,omitempty"`
+}
+
+// StartTerminalSession creates a new terminal session between the browser
+// client and the CDAP device. The session relays I/O bidirectionally.
+func (g *Gateway) StartTerminalSession(ctx context.Context, browserConn *websocket.Conn, deviceID, username, role string, cols, rows int) (*TerminalSession, error) {
+	dc := g.GetDeviceConn(deviceID)
+	if dc == nil {
+		return nil, fmt.Errorf("device %s not connected", deviceID)
+	}
+
+	// Check that device supports terminal capability
+	if dc.Manifest != nil {
+		hasTerminal := false
+		for _, cap := range dc.Manifest.Capabilities {
+			if cap == "commands" {
+				hasTerminal = true
+				break
+			}
+		}
+		if !hasTerminal {
+			return nil, fmt.Errorf("device %s does not support terminal", deviceID)
+		}
+	}
+
+	sessionID := fmt.Sprintf("term_%s_%d", deviceID, time.Now().UnixNano())
+
+	ts := &TerminalSession{
+		ID:         sessionID,
+		DeviceID:   deviceID,
+		Username:   username,
+		Role:       role,
+		browser:    browserConn,
+		deviceConn: dc,
+		createdAt:  time.Now(),
+	}
+
+	// Send terminal_start command to the device
+	startPayload := TerminalStartPayload{
+		SessionID: sessionID,
+		Cols:      cols,
+		Rows:      rows,
+	}
+	data, _ := json.Marshal(startPayload)
+	msg := &Message{
+		Type:      "terminal_start",
+		ID:        sessionID,
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   data,
+	}
+
+	if err := dc.WriteMessage(ctx, msg); err != nil {
+		return nil, fmt.Errorf("send terminal_start to device: %w", err)
+	}
+
+	// Store terminal session in gateway
+	g.terminalSessions.Store(sessionID, ts)
+
+	log.Printf("[cdap] Terminal session %s started for device %s by %s", sessionID, deviceID, username)
+
+	if g.auditLog != nil {
+		g.auditLog.Log("cdap_terminal_started", dc.ClientIP, username, map[string]string{
+			"session_id": sessionID,
+			"device_id":  deviceID,
+		})
+	}
+
+	return ts, nil
+}
+
+// RelayTerminalInput forwards a terminal_input message from browser to device.
+func (g *Gateway) RelayTerminalInput(ctx context.Context, sessionID, data string) error {
+	val, ok := g.terminalSessions.Load(sessionID)
+	if !ok {
+		return fmt.Errorf("terminal session %s not found", sessionID)
+	}
+	ts := val.(*TerminalSession)
+	if ts.closed.Load() {
+		return fmt.Errorf("terminal session %s is closed", sessionID)
+	}
+
+	payload := TerminalInputPayload{
+		SessionID: sessionID,
+		Data:      data,
+	}
+	payloadData, _ := json.Marshal(payload)
+	msg := &Message{
+		Type:      "terminal_input",
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   payloadData,
+	}
+
+	return ts.deviceConn.WriteMessage(ctx, msg)
+}
+
+// RelayTerminalResize forwards a terminal_resize message from browser to device.
+func (g *Gateway) RelayTerminalResize(ctx context.Context, sessionID string, cols, rows int) error {
+	val, ok := g.terminalSessions.Load(sessionID)
+	if !ok {
+		return fmt.Errorf("terminal session %s not found", sessionID)
+	}
+	ts := val.(*TerminalSession)
+
+	payload := TerminalResizePayload{
+		SessionID: sessionID,
+		Cols:      cols,
+		Rows:      rows,
+	}
+	payloadData, _ := json.Marshal(payload)
+	msg := &Message{
+		Type:      "terminal_resize",
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   payloadData,
+	}
+
+	return ts.deviceConn.WriteMessage(ctx, msg)
+}
+
+// HandleTerminalOutput is called when the device sends terminal output
+// back to the gateway. It forwards the data to the browser WebSocket.
+func (g *Gateway) HandleTerminalOutput(ctx context.Context, sessionID, data, stream string) error {
+	val, ok := g.terminalSessions.Load(sessionID)
+	if !ok {
+		return fmt.Errorf("terminal session %s not found", sessionID)
+	}
+	ts := val.(*TerminalSession)
+	if ts.closed.Load() {
+		return nil
+	}
+
+	// Forward to browser as JSON (browser WebSocket expects text frames)
+	output := map[string]string{
+		"type":       "output",
+		"session_id": sessionID,
+		"data":       data,
+		"stream":     stream,
+	}
+	outData, _ := json.Marshal(output)
+
+	ts.mu.Lock()
+	defer ts.mu.Unlock()
+	return ts.browser.Write(ctx, websocket.MessageText, outData)
+}
+
+// EndTerminalSession terminates a terminal session.
+func (g *Gateway) EndTerminalSession(ctx context.Context, sessionID, reason string) {
+	val, ok := g.terminalSessions.LoadAndDelete(sessionID)
+	if !ok {
+		return
+	}
+	ts := val.(*TerminalSession)
+	if ts.closed.Swap(true) {
+		return // already closed
+	}
+
+	// Send terminal_end to device
+	endPayload := TerminalEndPayload{
+		SessionID: sessionID,
+		Reason:    reason,
+	}
+	data, _ := json.Marshal(endPayload)
+	msg := &Message{
+		Type:      "terminal_end",
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   data,
+	}
+	ts.deviceConn.WriteMessage(ctx, msg)
+
+	// Notify browser that session ended
+	endMsg, _ := json.Marshal(map[string]string{
+		"type":       "end",
+		"session_id": sessionID,
+		"reason":     reason,
+	})
+	ts.mu.Lock()
+	ts.browser.Write(ctx, websocket.MessageText, endMsg)
+	ts.mu.Unlock()
+	ts.browser.Close(websocket.StatusNormalClosure, reason)
+
+	log.Printf("[cdap] Terminal session %s ended: %s", sessionID, reason)
+
+	if g.auditLog != nil {
+		g.auditLog.Log("cdap_terminal_ended", ts.deviceConn.ClientIP, ts.Username, map[string]string{
+			"session_id": sessionID,
+			"device_id":  ts.DeviceID,
+			"reason":     reason,
+		})
+	}
+}
+
+// GetTerminalSession returns a terminal session by its ID.
+func (g *Gateway) GetTerminalSession(sessionID string) *TerminalSession {
+	val, ok := g.terminalSessions.Load(sessionID)
+	if !ok {
+		return nil
+	}
+	return val.(*TerminalSession)
+}
diff --git a/betterdesk-server/cdap/video.go b/betterdesk-server/cdap/video.go
new file mode 100644
index 00000000..54670ad2
--- /dev/null
+++ b/betterdesk-server/cdap/video.go
@@ -0,0 +1,205 @@
+// Package cdap — video handles WebSocket video stream sessions between
+// the admin panel and CDAP devices (e.g. IP cameras, surveillance).
+// Read-only streams — no input relay, only frame forwarding.
+package cdap
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/coder/websocket"
+)
+
+// VideoSession represents an active video stream session relaying
+// frames from a CDAP device to the browser.
+type VideoSession struct {
+	ID       string
+	DeviceID string
+	Username string
+	Role     string
+
+	browser    *websocket.Conn
+	deviceConn *DeviceConn
+
+	createdAt time.Time
+	mu        sync.Mutex
+	closed    atomic.Bool
+}
+
+// VideoStartPayload is sent to the device to start a video stream.
+type VideoStartPayload struct {
+	SessionID  string `json:"session_id"`
+	StreamID   string `json:"stream_id,omitempty"` // optional camera/stream selector
+	Width      int    `json:"width,omitempty"`
+	Height     int    `json:"height,omitempty"`
+	Quality    int    `json:"quality,omitempty"` // JPEG quality 1-100
+	FPS        int    `json:"fps,omitempty"`
+	AudioCodec string `json:"audio_codec,omitempty"` // none, opus, pcm
+}
+
+// VideoFramePayload is sent from the device to the browser.
+type VideoFramePayload struct {
+	SessionID string `json:"session_id"`
+	Format    string `json:"format"`    // jpeg, png, h264
+	Width     int    `json:"width"`     // frame width
+	Height    int    `json:"height"`    // frame height
+	Data      string `json:"data"`      // base64-encoded frame
+	Timestamp int64  `json:"timestamp"` // capture timestamp ms
+	KeyFrame  bool   `json:"key_frame,omitempty"`
+}
+
+// VideoEndPayload is sent when a video stream session ends.
+type VideoEndPayload struct {
+	SessionID string `json:"session_id"`
+	Reason    string `json:"reason,omitempty"`
+}
+
+// StartVideoSession creates a new video stream session between the
+// browser and a CDAP device for live video monitoring.
+func (g *Gateway) StartVideoSession(ctx context.Context, browserConn *websocket.Conn, deviceID, username, role string, streamID string, quality, fps int) (*VideoSession, error) {
+	dc := g.GetDeviceConn(deviceID)
+	if dc == nil {
+		return nil, fmt.Errorf("device %s not connected", deviceID)
+	}
+
+	if dc.Manifest != nil {
+		hasVideo := false
+		for _, cap := range dc.Manifest.Capabilities {
+			if cap == "video_stream" {
+				hasVideo = true
+				break
+			}
+		}
+		if !hasVideo {
+			return nil, fmt.Errorf("device %s does not support video_stream", deviceID)
+		}
+	}
+
+	if quality <= 0 || quality > 100 {
+		quality = 60
+	}
+	if fps <= 0 || fps > 30 {
+		fps = 10
+	}
+
+	sessionID := fmt.Sprintf("vid_%s_%d", deviceID, time.Now().UnixNano())
+
+	vs := &VideoSession{
+		ID:         sessionID,
+		DeviceID:   deviceID,
+		Username:   username,
+		Role:       role,
+		browser:    browserConn,
+		deviceConn: dc,
+		createdAt:  time.Now(),
+	}
+
+	startPayload := VideoStartPayload{
+		SessionID: sessionID,
+		StreamID:  streamID,
+		Quality:   quality,
+		FPS:       fps,
+	}
+	data, _ := json.Marshal(startPayload)
+	msg := &Message{
+		Type:      "video_start",
+		ID:        sessionID,
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   data,
+	}
+
+	if err := dc.WriteMessage(ctx, msg); err != nil {
+		return nil, fmt.Errorf("send video_start to device: %w", err)
+	}
+
+	g.videoSessions.Store(sessionID, vs)
+
+	log.Printf("[cdap] Video session %s started for device %s by %s (q%d @%dfps)",
+		sessionID, deviceID, username, quality, fps)
+
+	if g.auditLog != nil {
+		g.auditLog.Log("cdap_video_started", dc.ClientIP, username, map[string]string{
+			"session_id": sessionID,
+			"device_id":  deviceID,
+		})
+	}
+
+	return vs, nil
+}
+
+// HandleVideoFrame is called when the device sends a video frame.
+func (g *Gateway) HandleVideoFrame(ctx context.Context, sessionID string, frame *VideoFramePayload) error {
+	val, ok := g.videoSessions.Load(sessionID)
+	if !ok {
+		return fmt.Errorf("video session %s not found", sessionID)
+	}
+	vs := val.(*VideoSession)
+	if vs.closed.Load() {
+		return nil
+	}
+
+	output := map[string]any{
+		"type":       "frame",
+		"session_id": sessionID,
+		"format":     frame.Format,
+		"width":      frame.Width,
+		"height":     frame.Height,
+		"data":       frame.Data,
+		"timestamp":  frame.Timestamp,
+		"key_frame":  frame.KeyFrame,
+	}
+	outData, _ := json.Marshal(output)
+
+	vs.mu.Lock()
+	defer vs.mu.Unlock()
+	return vs.browser.Write(ctx, websocket.MessageText, outData)
+}
+
+// EndVideoSession terminates a video stream session.
+func (g *Gateway) EndVideoSession(ctx context.Context, sessionID, reason string) {
+	val, ok := g.videoSessions.LoadAndDelete(sessionID)
+	if !ok {
+		return
+	}
+	vs := val.(*VideoSession)
+	if vs.closed.Swap(true) {
+		return
+	}
+
+	endPayload := VideoEndPayload{
+		SessionID: sessionID,
+		Reason:    reason,
+	}
+	data, _ := json.Marshal(endPayload)
+	msg := &Message{
+		Type:      "video_end",
+		Timestamp: time.Now().UTC().Format(time.RFC3339),
+		Payload:   data,
+	}
+	vs.deviceConn.WriteMessage(ctx, msg)
+
+	endMsg, _ := json.Marshal(map[string]string{
+		"type":       "end",
+		"session_id": sessionID,
+		"reason":     reason,
+	})
+	vs.mu.Lock()
+	vs.browser.Write(ctx, websocket.MessageText, endMsg)
+	vs.mu.Unlock()
+	vs.browser.Close(websocket.StatusNormalClosure, reason)
+
+	log.Printf("[cdap] Video session %s ended: %s", sessionID, reason)
+
+	if g.auditLog != nil {
+		g.auditLog.Log("cdap_video_ended", vs.deviceConn.ClientIP, vs.Username, map[string]string{
+			"session_id": sessionID,
+			"device_id":  vs.DeviceID,
+			"reason":     reason,
+		})
+	}
+}
diff --git a/betterdesk-server/config/config.go b/betterdesk-server/config/config.go
index 308b0f3e..2cc93521 100644
--- a/betterdesk-server/config/config.go
+++ b/betterdesk-server/config/config.go
@@ -85,9 +85,10 @@ type Config struct {
 	EnrollmentMode string
 
 	// CDAP Gateway
-	CDAPPort    int  // WebSocket gateway port (default 21122)
-	CDAPEnabled bool // Enable CDAP gateway (default false)
-	CDAPTLS     bool // Enable TLS on CDAP port
+	CDAPPort      int  // WebSocket gateway port (default 21122)
+	CDAPEnabled   bool // Enable CDAP gateway (default false)
+	CDAPTLS       bool // Enable TLS on CDAP port
+	CDAPRateLimit int  // Max requests per minute per IP (default 30)
 }
 
 // DefaultConfig returns a Config with sensible defaults.
@@ -103,6 +104,8 @@ func DefaultConfig() *Config {
 		RelayMaxConnsIP: 20,
 		EnrollmentMode:  EnrollmentModeOpen, // Backward compatible default
 		CDAPPort:        21122,
+		CDAPEnabled:     true, // Enabled by default; set CDAP_ENABLED=N for minimal installs
+		CDAPRateLimit:   30,
 	}
 }
 
@@ -226,12 +229,19 @@ func (c *Config) LoadEnv() {
 			c.CDAPPort = n
 		}
 	}
-	if strings.ToUpper(os.Getenv("CDAP_ENABLED")) == "Y" {
+	if v := strings.ToUpper(os.Getenv("CDAP_ENABLED")); v == "N" || v == "NO" || v == "FALSE" || v == "0" {
+		c.CDAPEnabled = false
+	} else if v == "Y" || v == "YES" || v == "TRUE" || v == "1" {
 		c.CDAPEnabled = true
 	}
 	if strings.ToUpper(os.Getenv("CDAP_TLS")) == "Y" {
 		c.CDAPTLS = true
 	}
+	if v := os.Getenv("CDAP_RATE_LIMIT"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			c.CDAPRateLimit = n
+		}
+	}
 }
 
 // NATTestPort returns the NAT test port (signal port - 1).
diff --git a/betterdesk-server/db/database.go b/betterdesk-server/db/database.go
index e86c971c..c6ab4503 100644
--- a/betterdesk-server/db/database.go
+++ b/betterdesk-server/db/database.go
@@ -122,6 +122,7 @@ type Database interface {
 	HardDeletePeer(id string) error // permanent delete
 	ListPeers(includeDeleted bool) ([]*Peer, error)
 	GetPeerCount() (total int, online int, err error)
+	GetBannedPeerCount() (int, error)
 
 	// Status tracking
 	UpdatePeerStatus(id string, status string, ip string) error
@@ -152,6 +153,7 @@ type Database interface {
 	GetConfig(key string) (string, error)
 	SetConfig(key, value string) error
 	DeleteConfig(key string) error
+	ListConfigByPrefix(prefix string) ([]ServerConfig, error)
 
 	// Users
 	CreateUser(u *User) error
diff --git a/betterdesk-server/db/postgres.go b/betterdesk-server/db/postgres.go
index 2322a057..aeec525d 100644
--- a/betterdesk-server/db/postgres.go
+++ b/betterdesk-server/db/postgres.go
@@ -357,6 +357,14 @@ func (pg *PostgresDB) GetPeerCount() (total int, online int, err error) {
 	return total, online, err
 }
 
+// GetBannedPeerCount returns the number of banned peers in the database.
+func (pg *PostgresDB) GetBannedPeerCount() (int, error) {
+	var count int
+	err := pg.pool.QueryRow(pg.ctx,
+		`SELECT COUNT(*) FROM peers WHERE banned = TRUE AND soft_deleted = FALSE`).Scan(&count)
+	return count, err
+}
+
 // UpdatePeerStatus updates a peer's status and IP, plus last_online timestamp.
 func (pg *PostgresDB) UpdatePeerStatus(id string, status string, ip string) error {
 	_, err := pg.pool.Exec(pg.ctx,
@@ -615,6 +623,27 @@ func (pg *PostgresDB) DeleteConfig(key string) error {
 	return err
 }
 
+// ListConfigByPrefix returns all configuration entries whose key starts with the given prefix.
+func (pg *PostgresDB) ListConfigByPrefix(prefix string) ([]ServerConfig, error) {
+	rows, err := pg.pool.Query(pg.ctx,
+		`SELECT key, value FROM server_config WHERE key LIKE $1`,
+		prefix+"%")
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var configs []ServerConfig
+	for rows.Next() {
+		var c ServerConfig
+		if err := rows.Scan(&c.Key, &c.Value); err != nil {
+			return nil, err
+		}
+		configs = append(configs, c)
+	}
+	return configs, rows.Err()
+}
+
 // ── User Operations ───────────────────────────────────────────────────
 
 // CreateUser inserts a new user and sets u.ID to the generated primary key.
diff --git a/betterdesk-server/db/sqlite.go b/betterdesk-server/db/sqlite.go
index eb7758d7..950a925d 100644
--- a/betterdesk-server/db/sqlite.go
+++ b/betterdesk-server/db/sqlite.go
@@ -417,6 +417,16 @@ func (s *SQLiteDB) GetPeerCount() (total int, online int, err error) {
 	return total, online, err
 }
 
+// GetBannedPeerCount returns the number of banned peers in the database.
+func (s *SQLiteDB) GetBannedPeerCount() (int, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	var count int
+	err := s.db.QueryRow(
+		`SELECT COUNT(*) FROM peers WHERE banned = 1 AND soft_deleted = 0`).Scan(&count)
+	return count, err
+}
+
 // UpdatePeerStatus updates a peer's status and IP, plus last_online timestamp.
 func (s *SQLiteDB) UpdatePeerStatus(id string, status string, ip string) error {
 	s.mu.Lock()
@@ -678,6 +688,29 @@ func (s *SQLiteDB) DeleteConfig(key string) error {
 	return err
 }
 
+// ListConfigByPrefix returns all configuration entries whose key starts with the given prefix.
+func (s *SQLiteDB) ListConfigByPrefix(prefix string) ([]ServerConfig, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	rows, err := s.db.Query(`SELECT key, value FROM server_config WHERE key LIKE ?`,
+		prefix+"%")
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var configs []ServerConfig
+	for rows.Next() {
+		var c ServerConfig
+		if err := rows.Scan(&c.Key, &c.Value); err != nil {
+			return nil, err
+		}
+		configs = append(configs, c)
+	}
+	return configs, rows.Err()
+}
+
 // UpdatePeerTags updates the tags field for a peer.
 func (s *SQLiteDB) UpdatePeerTags(id, tags string) error {
 	s.mu.Lock()
diff --git a/betterdesk-server/main.go b/betterdesk-server/main.go
index 5e3a39e1..ab8006a8 100644
--- a/betterdesk-server/main.go
+++ b/betterdesk-server/main.go
@@ -246,6 +246,14 @@ func main() {
 	go reloadHandler.ListenSIGHUP(reloadDone)
 	defer close(reloadDone)
 
+	// BD-2026-010: Warn when WebSocket origin policy is permissive
+	if cfg.AllowedWSOrigins == "" {
+		log.Printf("[SECURITY] NOTICE: WS_ALLOWED_ORIGINS is not set — signal/relay WebSocket accepts all origins")
+	}
+	if cfg.APIAllowedWSOrigins == "" {
+		log.Printf("[SECURITY] NOTICE: API_WS_ALLOWED_ORIGINS is not set — API events WebSocket accepts all origins")
+	}
+
 	// Start servers based on mode
 	switch cfg.Mode {
 	case "all":
diff --git a/betterdesk.ps1 b/betterdesk.ps1
index 749cb70b..3fc242d6 100644
--- a/betterdesk.ps1
+++ b/betterdesk.ps1
@@ -1,11 +1,12 @@
 #Requires -RunAsAdministrator
 <#
 .SYNOPSIS
-    BetterDesk Console Manager v2.4.0 - All-in-One Interactive Tool for Windows
+    BetterDesk Console Manager v3.0.0 - All-in-One Interactive Tool for Windows
 
 .DESCRIPTION
     Features:
       - Fresh installation (Node.js web console)
+      - Minimal installation (Go server only, no web console)
       - Update existing installation
       - Repair/fix issues (enhanced with graceful shutdown)
       - Validate installation
@@ -21,8 +22,9 @@
       - RustDesk Client API (login, address book sync)
       - TOTP Two-Factor Authentication
       - SSL/TLS certificate configuration
-      - PostgreSQL database support (new in v2.4.0)
+      - PostgreSQL database support
       - SQLite to PostgreSQL migration
+      - CDAP (Custom Device API Protocol) support
 
 .PARAMETER Auto
     Run installation in automatic mode (non-interactive)
@@ -59,6 +61,7 @@
 param(
     [switch]$Auto,
     [switch]$SkipVerify,
+    [switch]$Minimal,
     [switch]$NodeJs,
     [switch]$PostgreSQL,
     [string]$PgUri = "",
@@ -69,12 +72,13 @@ param(
 # Configuration
 #===============================================================================
 
-$script:VERSION = "2.4.0"
+$script:VERSION = "3.0.0"
 $script:ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
 
 # Auto mode flags
 $script:AUTO_MODE = $Auto
 $script:SKIP_VERIFY = $SkipVerify
+$script:MINIMAL_MODE = $Minimal
 
 # Console type preference
 $script:PREFERRED_CONSOLE_TYPE = "nodejs"  # Always Node.js (Flask removed in v2.3.0)
@@ -2197,6 +2201,181 @@ function Start-ServicesWithVerification {
     return $true
 }
 
+#=============================================================================
+# Minimal Installation Function (Go server only, no web console)
+#===============================================================================
+
+function Do-InstallMinimal {
+    Print-Header
+    Write-Host "========== MINIMAL INSTALLATION (Server Only) ==========" -ForegroundColor White
+    Write-Host ""
+    
+    Print-Info "BetterDesk Minimal installs the Go server binary only."
+    Print-Info "No web console, no Node.js, no npm dependencies."
+    Print-Info "Manage via REST API on port 21114 or TCP admin console."
+    Write-Host ""
+    
+    Detect-Installation
+    
+    if ($script:INSTALL_STATUS -eq "complete") {
+        Print-Warning "BetterDesk is already installed!"
+        if (-not $script:AUTO_MODE) {
+            if (-not (Confirm-Action "Do you want to reinstall in Minimal mode?")) {
+                return
+            }
+        }
+        Do-BackupSilent
+    }
+    
+    # Choose database type (SQLite or PostgreSQL)
+    Choose-DatabaseType
+    
+    # Gracefully stop existing services
+    Graceful-StopServices
+    
+    # Create installation directory
+    $installDir = $script:INSTALL_DIR
+    if (-not (Test-Path $installDir)) {
+        New-Item -ItemType Directory -Path $installDir -Force | Out-Null
+    }
+    
+    # Setup PostgreSQL if selected
+    if ($script:USE_POSTGRESQL) {
+        if (-not (Setup-PostgreSQLDatabase)) {
+            Print-Error "PostgreSQL setup failed"
+            return
+        }
+    }
+    
+    # Install Go server binary
+    Detect-Architecture
+    if (-not (Install-Binaries)) {
+        Print-Error "Binary installation failed"
+        return
+    }
+    
+    # Skip console installation entirely
+    Print-Info "Skipping web console (Minimal mode)"
+    
+    # Generate self-signed TLS certificates
+    Generate-SSLCertificates
+    
+    # Setup only the Go server service (no console service)
+    Setup-ServicesMinimal
+    
+    # Configure firewall rules (server ports only)
+    Print-Step "Configuring firewall rules..."
+    $ports = @(21114, 21115, 21116, 21117, 21118, 21119)
+    foreach ($port in $ports) {
+        try {
+            New-NetFirewallRule -DisplayName "BetterDesk Port $port" -Direction Inbound -LocalPort $port -Protocol TCP -Action Allow -ErrorAction SilentlyContinue | Out-Null
+        } catch {}
+    }
+    # UDP for signal port
+    try {
+        New-NetFirewallRule -DisplayName "BetterDesk Signal UDP 21116" -Direction Inbound -LocalPort 21116 -Protocol UDP -Action Allow -ErrorAction SilentlyContinue | Out-Null
+    } catch {}
+    
+    # Start server
+    Print-Step "Starting BetterDesk server..."
+    $svcName = "BetterDeskServer"
+    if (Get-Service $svcName -ErrorAction SilentlyContinue) {
+        Start-Service $svcName -ErrorAction SilentlyContinue
+    } elseif (Get-Command nssm -ErrorAction SilentlyContinue) {
+        nssm start $svcName 2>$null
+    }
+    
+    Start-Sleep -Seconds 3
+    
+    # Verify
+    $svc = Get-Service $svcName -ErrorAction SilentlyContinue
+    if ($svc -and $svc.Status -eq "Running") {
+        Print-Success "BetterDesk server is running"
+    } else {
+        Print-Warning "BetterDesk server may not have started correctly"
+    }
+    
+    Write-Host ""
+    Print-Success "===== BETTERDESK MINIMAL INSTALLATION COMPLETE ====="
+    Write-Host ""
+    
+    $serverIP = Get-PublicIP
+    Write-Host "Server: $serverIP" -ForegroundColor Green
+    Write-Host "API: http://${serverIP}:21114" -ForegroundColor Green
+    Write-Host ""
+    Write-Host "Ports: 21114 (API), 21115-21117 (Signal/Relay), 21118-21119 (WS)" -ForegroundColor Yellow
+    Write-Host "No web console installed. Use REST API or TCP admin for management." -ForegroundColor Yellow
+    Write-Host ""
+    
+    Press-Enter
+}
+
+function Setup-ServicesMinimal {
+    Print-Step "Setting up BetterDesk server service (Minimal mode)..."
+    
+    $goBinary = Join-Path $script:INSTALL_DIR "betterdesk-server.exe"
+    $keyDir = $script:INSTALL_DIR
+    $dbDir = $script:INSTALL_DIR
+    
+    # Build arguments
+    $serverArgs = "-key `"$keyDir`" -db `"$dbDir`""
+    
+    # Add relay servers
+    $serverIP = Get-PublicIP
+    if ($serverIP) {
+        $serverArgs += " -relay-servers $serverIP"
+    }
+    
+    # TLS configuration
+    $tlsCert = Join-Path $script:INSTALL_DIR "cert.pem"
+    $tlsKey = Join-Path $script:INSTALL_DIR "key.pem"
+    if ((Test-Path $tlsCert) -and (Test-Path $tlsKey)) {
+        $serverArgs += " -tls-cert `"$tlsCert`" -tls-key `"$tlsKey`" -tls-signal -tls-relay"
+    }
+    
+    # Remove old services
+    foreach ($oldSvc in @("RustDeskSignal", "RustDeskRelay", "BetterDeskAPI", "BetterDeskGo", "BetterDeskConsole")) {
+        if (Get-Service $oldSvc -ErrorAction SilentlyContinue) {
+            Stop-Service $oldSvc -Force -ErrorAction SilentlyContinue
+            if (Get-Command nssm -ErrorAction SilentlyContinue) {
+                nssm remove $oldSvc confirm 2>$null
+            } else {
+                sc.exe delete $oldSvc 2>$null
+            }
+        }
+    }
+    
+    # Install NSSM if not present
+    if (-not (Get-Command nssm -ErrorAction SilentlyContinue)) {
+        Install-NSSM
+    }
+    
+    # Create server service via NSSM
+    $svcName = "BetterDeskServer"
+    if (Get-Service $svcName -ErrorAction SilentlyContinue) {
+        nssm remove $svcName confirm 2>$null
+    }
+    
+    nssm install $svcName $goBinary $serverArgs
+    nssm set $svcName AppDirectory $script:INSTALL_DIR
+    nssm set $svcName DisplayName "BetterDesk Server (Minimal)"
+    nssm set $svcName Description "BetterDesk Go server - signal, relay, and API"
+    nssm set $svcName Start SERVICE_AUTO_START
+    nssm set $svcName AppStdout (Join-Path $script:INSTALL_DIR "server.log")
+    nssm set $svcName AppStderr (Join-Path $script:INSTALL_DIR "server-error.log")
+    nssm set $svcName AppRotateFiles 1
+    nssm set $svcName AppRotateBytes 10485760
+    
+    # Database environment
+    $envExtra = "SIGNAL_PORT=21116"
+    if ($script:USE_POSTGRESQL -and $script:POSTGRESQL_URI) {
+        $envExtra += "`nDB_URL=$($script:POSTGRESQL_URI)"
+    }
+    nssm set $svcName AppEnvironmentExtra $envExtra
+    
+    Print-Success "BetterDesk server service created (Minimal mode)"
+}
+
 #=============================================================================
 # Main Installation Function
 #===============================================================================
@@ -4115,6 +4294,7 @@ function Show-Menu {
     Write-Host "  8. DIAGNOSTICS"
     Write-Host "  9. UNINSTALL"
     Write-Host ""
+    Write-Host "  L. MINIMAL INSTALLATION (server only)"
     Write-Host "  C. Configure SSL certificates"
     Write-Host "  M. Database migration"
     Write-Host "  S. Settings (paths)"
@@ -4132,7 +4312,11 @@ function Main {
     # Auto mode - run installation directly
     if ($script:AUTO_MODE) {
         Print-Info "Running in AUTO mode..."
-        Do-Install
+        if ($script:MINIMAL_MODE) {
+            Do-InstallMinimal
+        } else {
+            Do-Install
+        }
         exit 0
     }
     
@@ -4150,6 +4334,8 @@ function Main {
             "7" { Do-Build }
             "8" { Do-Diagnostics }
             "9" { Do-Uninstall }
+            "L" { Do-InstallMinimal }
+            "l" { Do-InstallMinimal }
             "C" { Do-ConfigureSSL }
             "c" { Do-ConfigureSSL }
             "M" { Do-MigrateDatabase }
diff --git a/betterdesk.sh b/betterdesk.sh
index 3525f7d9..a680e537 100644
--- a/betterdesk.sh
+++ b/betterdesk.sh
@@ -1,11 +1,12 @@
 #!/bin/bash
 #===============================================================================
 #
-#   BetterDesk Console Manager v2.4.0
+#   BetterDesk Console Manager v3.0.0
 #   All-in-One Interactive Tool for Linux
 #
 #   Features:
 #     - Fresh installation (Node.js web console)
+#     - Minimal installation (Go server only, no web console)
 #     - Update existing installation  
 #     - Repair/fix issues (enhanced with graceful shutdown)
 #     - Validate installation
@@ -21,8 +22,9 @@
 #     - RustDesk Client API (login, address book sync)
 #     - TOTP Two-Factor Authentication
 #     - SSL/TLS certificate configuration
-#     - PostgreSQL database support (new in v2.4.0)
+#     - PostgreSQL database support
 #     - SQLite to PostgreSQL migration
+#     - CDAP (Custom Device API Protocol) support
 #
 #   Usage: 
 #     Interactive: sudo ./betterdesk.sh
@@ -34,12 +36,13 @@
 set -e
 
 # Version
-VERSION="2.4.0"
+VERSION="3.0.0"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # Auto mode flag
 AUTO_MODE=false
 SKIP_VERIFY=false
+MINIMAL_MODE=false
 PREFERRED_CONSOLE_TYPE="nodejs"  # Always Node.js (Flask removed in v2.3.0)
 
 # Parse command line arguments
@@ -53,6 +56,10 @@ while [[ $# -gt 0 ]]; do
             SKIP_VERIFY=true
             shift
             ;;
+        --minimal)
+            MINIMAL_MODE=true
+            shift
+            ;;
         --nodejs)
             PREFERRED_CONSOLE_TYPE="nodejs"
             shift
@@ -80,6 +87,7 @@ while [[ $# -gt 0 ]]; do
             echo "Options:"
             echo "  --auto, -a       Run in automatic mode (non-interactive)"
             echo "  --skip-verify    Skip SHA256 verification of binaries"
+            echo "  --minimal        Install Go server only (no web console)"
             echo "  --nodejs         Install Node.js web console (default)"
             echo "  --postgresql     Use PostgreSQL instead of SQLite"
             echo "  --pg-uri URI     PostgreSQL connection URI (implies --postgresql)"
@@ -2093,6 +2101,188 @@ start_services() {
     start_services_with_verification
 }
 
+#===============================================================================
+# BetterDesk Minimal Installation (Go server only, no web console)
+#===============================================================================
+
+do_install_minimal() {
+    print_header
+    echo -e "${WHITE}${BOLD}══════════ MINIMAL INSTALLATION (Server Only) ══════════${NC}"
+    echo ""
+    
+    print_info "BetterDesk Minimal installs the Go server binary only."
+    print_info "No web console, no Node.js, no npm dependencies."
+    print_info "Manage via REST API on port 21114 or TCP admin console."
+    echo ""
+    
+    detect_installation
+    
+    if [ "$INSTALL_STATUS" = "complete" ]; then
+        print_warning "BetterDesk is already installed!"
+        if [ "$AUTO_MODE" = false ]; then
+            if ! confirm "Do you want to reinstall in Minimal mode?"; then
+                return
+            fi
+        fi
+        do_backup_silent
+    fi
+    
+    # Choose database type (SQLite or PostgreSQL)
+    choose_database_type
+    
+    # Stop services if running
+    graceful_stop_services
+    
+    # Minimal: no Node.js dependencies needed
+    print_step "Checking system dependencies..."
+    command -v curl >/dev/null 2>&1 || apt-get install -y curl
+    
+    # Install and configure PostgreSQL if selected
+    if [ "$USE_POSTGRESQL" = "true" ]; then
+        install_postgresql || { print_error "PostgreSQL installation failed"; return 1; }
+        setup_postgresql_database || { print_error "PostgreSQL setup failed"; return 1; }
+    fi
+    
+    detect_architecture
+    install_binaries || { print_error "Binary installation failed"; return 1; }
+    
+    # Skip console installation entirely
+    print_info "Skipping web console (Minimal mode)"
+    
+    # Generate self-signed TLS certificates (default for fresh installs)
+    generate_ssl_certificates
+    
+    # Migrate existing SQLite data to PostgreSQL if applicable
+    if [ "$USE_POSTGRESQL" = "true" ]; then
+        migrate_sqlite_to_postgresql
+    fi
+    
+    # Setup only the Go server service (no console service)
+    setup_services_minimal
+    
+    # Configure firewall rules (signal + relay + API only, no console ports)
+    print_step "Configuring firewall rules..."
+    if command -v ufw >/dev/null 2>&1; then
+        ufw allow 21114/tcp comment "BetterDesk API" 2>/dev/null || true
+        ufw allow 21115/tcp comment "BetterDesk NAT" 2>/dev/null || true
+        ufw allow 21116/tcp comment "BetterDesk Signal TCP" 2>/dev/null || true
+        ufw allow 21116/udp comment "BetterDesk Signal UDP" 2>/dev/null || true
+        ufw allow 21117/tcp comment "BetterDesk Relay" 2>/dev/null || true
+        ufw allow 21118/tcp comment "BetterDesk WS Signal" 2>/dev/null || true
+        ufw allow 21119/tcp comment "BetterDesk WS Relay" 2>/dev/null || true
+    fi
+    
+    # Start server
+    print_step "Starting BetterDesk server..."
+    systemctl daemon-reload
+    systemctl start betterdesk-server.service 2>/dev/null || true
+    systemctl enable betterdesk-server.service 2>/dev/null || true
+    
+    sleep 3
+    
+    # Verify
+    if systemctl is-active --quiet betterdesk-server.service; then
+        print_success "BetterDesk server is running"
+    else
+        print_error "BetterDesk server failed to start"
+        journalctl -u betterdesk-server.service --no-pager -n 20
+        return 1
+    fi
+    
+    echo ""
+    print_success "===== BETTERDESK MINIMAL INSTALLATION COMPLETE ====="
+    echo ""
+    
+    local SERVER_IP
+    SERVER_IP=$(get_public_ip)
+    
+    echo -e "${GREEN}Server: ${SERVER_IP}${NC}"
+    echo -e "${GREEN}API: http://${SERVER_IP}:21114${NC}"
+    echo ""
+    echo -e "${YELLOW}Ports: 21114 (API), 21115-21117 (Signal/Relay), 21118-21119 (WS)${NC}"
+    echo -e "${YELLOW}No web console installed. Use REST API or TCP admin for management.${NC}"
+    echo ""
+    
+    press_enter
+}
+
+setup_services_minimal() {
+    print_step "Setting up BetterDesk server service (Minimal mode)..."
+    
+    local GO_BINARY_PATH="$INSTALL_DIR/betterdesk-server"
+    local KEY_DIR="$INSTALL_DIR"
+    local DB_DIR="$INSTALL_DIR"
+    
+    # Build server arguments
+    local SERVER_ARGS="-key $KEY_DIR"
+    SERVER_ARGS="$SERVER_ARGS -db $DB_DIR"
+    
+    # Add relay servers argument
+    local SERVER_IP
+    SERVER_IP=$(get_public_ip)
+    if [ -n "$SERVER_IP" ]; then
+        SERVER_ARGS="$SERVER_ARGS -relay-servers $SERVER_IP"
+    fi
+    
+    # Database configuration for Go server
+    local GO_ENV=""
+    if [ "$USE_POSTGRESQL" = "true" ] && [ -n "$POSTGRESQL_URI" ]; then
+        GO_ENV="Environment=\"DB_URL=$POSTGRESQL_URI\""
+    fi
+    
+    # TLS configuration
+    local TLS_CERT_PATH="$INSTALL_DIR/cert.pem"
+    local TLS_KEY_PATH="$INSTALL_DIR/key.pem"
+    if [ -f "$TLS_CERT_PATH" ] && [ -f "$TLS_KEY_PATH" ]; then
+        SERVER_ARGS="$SERVER_ARGS -tls-cert $TLS_CERT_PATH -tls-key $TLS_KEY_PATH -tls-signal -tls-relay"
+    fi
+    
+    # Remove old services (cleanup)
+    for old_svc in rustdesksignal rustdeskrelay betterdesk-api betterdesk-go betterdesk-console; do
+        if systemctl is-active --quiet "$old_svc.service" 2>/dev/null; then
+            systemctl stop "$old_svc.service" 2>/dev/null || true
+        fi
+        if [ -f "/etc/systemd/system/$old_svc.service" ]; then
+            systemctl disable "$old_svc.service" 2>/dev/null || true
+            rm -f "/etc/systemd/system/$old_svc.service"
+        fi
+    done
+    
+    cat > /etc/systemd/system/betterdesk-server.service <<EOF
+[Unit]
+Description=BetterDesk Server (Minimal)
+After=network.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=$INSTALL_DIR
+ExecStart=$GO_BINARY_PATH $SERVER_ARGS
+Restart=always
+RestartSec=5
+$GO_ENV
+
+# Hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ReadWritePaths=$INSTALL_DIR $DB_DIR
+ProtectHome=true
+PrivateTmp=true
+
+# Logging
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=betterdesk-server
+
+[Install]
+WantedBy=multi-user.target
+EOF
+    
+    systemctl daemon-reload
+    print_success "BetterDesk server service created (Minimal mode)"
+}
+
 do_install() {
     print_header
     echo -e "${WHITE}${BOLD}══════════ FRESH INSTALLATION ══════════${NC}"
@@ -3795,10 +3985,6 @@ do_configure_ssl() {
             # Ensure API URLs stay HTTP in systemd service too
             sed -i "s|Environment=HBBS_API_URL=https://localhost|Environment=HBBS_API_URL=http://localhost|" "$svc_file"
             sed -i "s|Environment=BETTERDESK_API_URL=https://localhost|Environment=BETTERDESK_API_URL=http://localhost|" "$svc_file"
-            else
-                sed -i "s|Environment=HBBS_API_URL=https://localhost|Environment=HBBS_API_URL=http://localhost|" "$svc_file"
-                sed -i "s|Environment=BETTERDESK_API_URL=https://localhost|Environment=BETTERDESK_API_URL=http://localhost|" "$svc_file"
-            fi
             # Sync HTTPS_ENABLED in systemd (overrides .env value)
             if grep -q 'Environment=HTTPS_ENABLED=' "$svc_file"; then
                 sed -i "s|Environment=HTTPS_ENABLED=.*|Environment=HTTPS_ENABLED=true|" "$svc_file"
@@ -4119,6 +4305,7 @@ show_menu() {
     echo "  8. 📊 DIAGNOSTICS"
     echo "  9. 🗑️  UNINSTALL"
     echo ""
+    echo "  L. 📦 MINIMAL INSTALLATION (server only)"
     echo "  C. 🔒 Configure SSL certificates"
     echo "  M. 🔄 Database migration"
     echo "  S. ⚙️  Settings (paths)"
@@ -4143,7 +4330,11 @@ main() {
     # Auto mode - run installation directly
     if [ "$AUTO_MODE" = true ]; then
         print_info "Running in AUTO mode..."
-        do_install
+        if [ "$MINIMAL_MODE" = true ]; then
+            do_install_minimal
+        else
+            do_install
+        fi
         exit $?
     fi
     
@@ -4161,6 +4352,7 @@ main() {
             7) do_build ;;
             8) do_diagnostics ;;
             9) do_uninstall ;;
+            [Ll]) do_install_minimal ;;
             [Cc]) do_configure_ssl ;;
             [Mm]) do_migrate_database ;;
             [Ss]) configure_paths ;;
diff --git a/bridges/README.md b/bridges/README.md
new file mode 100644
index 00000000..4fcb33c0
--- /dev/null
+++ b/bridges/README.md
@@ -0,0 +1,108 @@
+# BetterDesk CDAP — Reference Bridges
+
+This directory contains ready-to-use bridge implementations that connect
+external systems to BetterDesk via the CDAP protocol. Each bridge uses
+the **Python SDK** (`sdks/python/`) and can be deployed as a standalone
+service alongside BetterDesk server.
+
+## Available Bridges
+
+| Bridge | Directory | Protocol | Use Case |
+|--------|-----------|----------|----------|
+| **Modbus** | `modbus/` | Modbus TCP / RTU | PLCs, VFDs, power meters, industrial I/O |
+| **SNMP** | `snmp/` | SNMP v2c / v3 | Network switches, routers, UPS, printers |
+| **REST Webhook** | `rest-webhook/` | HTTP REST | Home automation (HA, OpenHAB), cloud APIs |
+
+## Architecture
+
+```
+External Device/API
+       │
+       ▼
+┌──────────────┐
+│  Bridge      │ ← polls/subscribes to external system
+│  (Python)    │ ← pushes state updates to CDAP
+│              │ ← receives commands from CDAP → writes to external system
+└──────┬───────┘
+       │ WebSocket (CDAP)
+       ▼
+┌──────────────┐
+│ BetterDesk   │
+│ CDAP Gateway │
+│ (:21122)     │
+└──────────────┘
+```
+
+## Quick Start
+
+```bash
+# 1. Install Python SDK
+cd sdks/python
+pip install -e .
+
+# 2. Install bridge dependencies
+cd bridges/modbus
+pip install -r requirements.txt
+
+# 3. Copy and edit config
+cp config.example.json config.json
+# edit config.json with your server URL, API key, and device addresses
+
+# 4. Run
+python bridge_modbus.py --config config.json
+```
+
+## Creating a Custom Bridge
+
+Use the Python SDK directly:
+
+```python
+from betterdesk_cdap import CDAPBridge, gauge, toggle
+
+bridge = CDAPBridge(
+    server="ws://your-server:21122/cdap",
+    api_key="YOUR_KEY",
+    device_name="My Custom Bridge",
+    device_type="bridge",
+)
+
+bridge.add_widget(gauge("sensor1", "Temperature", unit="°C", max_val=50))
+
+@bridge.on_command("relay1")
+async def handle_relay(action, value, **kw):
+    # Write to your external system here
+    return value
+
+bridge.run()
+```
+
+See the [Python SDK README](../sdks/python/README.md) and
+[Node.js SDK README](../sdks/nodejs/README.md) for full API reference.
+
+## Configuration
+
+All bridges use a shared configuration pattern:
+
+```json
+{
+  "cdap": {
+    "server": "ws://192.168.0.110:21122/cdap",
+    "api_key": "YOUR_API_KEY",
+    "device_name": "Bridge Name",
+    "device_type": "bridge",
+    "heartbeat_sec": 15
+  },
+  "bridge_specific_options": { }
+}
+```
+
+## Deployment
+
+Each bridge can run as:
+- **systemd service** (Linux) — see `install/` in each bridge directory
+- **Docker container** — `docker run` with mounted `config.json`
+- **Screen/tmux session** — for testing
+
+## License
+
+MIT
diff --git a/bridges/modbus/bridge_modbus.py b/bridges/modbus/bridge_modbus.py
new file mode 100644
index 00000000..56ca9f81
--- /dev/null
+++ b/bridges/modbus/bridge_modbus.py
@@ -0,0 +1,259 @@
+#!/usr/bin/env python3
+"""BetterDesk CDAP — Modbus TCP/RTU Bridge.
+
+Polls Modbus registers/coils at a configurable interval and pushes values
+to BetterDesk via CDAP.  Incoming commands (toggle, slider set) are written
+back to the Modbus target.
+
+Usage:
+    pip install betterdesk-cdap pymodbus
+    python bridge_modbus.py --config config.json
+"""
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import json
+import logging
+import struct
+import sys
+from pathlib import Path
+from typing import Any
+
+from betterdesk_cdap import CDAPBridge, gauge, toggle, slider, textWidget
+
+logger = logging.getLogger("bridge_modbus")
+
+# ── Modbus helpers ────────────────────────────────────────────────────
+
+DATA_FORMATS: dict[str, str] = {
+    "int16": ">h",
+    "uint16": ">H",
+    "int32": ">i",
+    "uint32": ">I",
+    "float32": ">f",
+}
+
+
+def decode_registers(regs: list[int], data_type: str, scale: float, offset: float) -> float:
+    """Convert raw register values to a scaled float."""
+    fmt = DATA_FORMATS.get(data_type, ">H")
+    size = struct.calcsize(fmt) // 2  # number of 16-bit registers
+    raw_bytes = b""
+    for r in regs[:size]:
+        raw_bytes += struct.pack(">H", r)
+    value = struct.unpack(fmt, raw_bytes)[0]
+    return round(value * scale + offset, 4)
+
+
+def encode_value(value: float, data_type: str, scale: float, offset: float) -> list[int]:
+    """Convert a scaled float back to raw register values."""
+    raw = (value - offset) / scale if scale else value
+    fmt = DATA_FORMATS.get(data_type, ">H")
+    packed = struct.pack(fmt, int(raw))
+    regs = []
+    for i in range(0, len(packed), 2):
+        regs.append(struct.unpack(">H", packed[i : i + 2])[0])
+    return regs
+
+
+# ── Bridge ────────────────────────────────────────────────────────────
+
+
+class ModbusBridge:
+    """Modbus ↔ CDAP bridge."""
+
+    def __init__(self, cfg: dict[str, Any]):
+        self.cfg = cfg
+        self.mcfg = cfg["modbus"]
+        self.registers: list[dict] = cfg.get("registers", [])
+        self.client = None  # pymodbus client instance
+
+        # Build CDAP bridge
+        cdap = cfg["cdap"]
+        self.bridge = CDAPBridge(
+            server=cdap["server"],
+            auth_method="api_key",
+            api_key=cdap.get("api_key", ""),
+            device_name=cdap.get("device_name", "Modbus Bridge"),
+            device_type=cdap.get("device_type", "bridge"),
+            bridge_name=cdap.get("bridge_name", "modbus"),
+            bridge_version="1.0.0",
+            heartbeat_sec=cdap.get("heartbeat_sec", 15),
+        )
+
+        self._build_widgets()
+        self._register_handlers()
+
+    # ── Widget construction ───────────────────────────────────────
+
+    def _build_widgets(self) -> None:
+        for reg in self.registers:
+            wtype = reg.get("widget", "text")
+            wid = reg["widget_id"]
+            label = reg.get("label", wid)
+            ro = reg.get("readonly", True)
+
+            if wtype == "gauge":
+                self.bridge.add_widget(gauge(wid, label, unit=reg.get("unit", ""), min_val=reg.get("min", 0), max_val=reg.get("max", 100)))
+            elif wtype == "toggle":
+                self.bridge.add_widget(toggle(wid, label))
+            elif wtype == "slider":
+                self.bridge.add_widget(slider(wid, label, min_val=reg.get("min", 0), max_val=reg.get("max", 100), step=reg.get("step", 1), unit=reg.get("unit", "")))
+            else:
+                self.bridge.add_widget(textWidget(wid, label, readonly=ro))
+
+    def _register_handlers(self) -> None:
+        for reg in self.registers:
+            if reg.get("readonly", True):
+                continue
+            wid = reg["widget_id"]
+
+            @self.bridge.on_command(wid)
+            async def _handler(action: str, value: Any, *, _reg: dict = reg, **kw: Any) -> Any:
+                return await self._write_register(_reg, value)
+
+    # ── Modbus I/O ────────────────────────────────────────────────
+
+    async def _connect_modbus(self) -> None:
+        transport = self.mcfg.get("transport", "tcp")
+        if transport == "tcp":
+            from pymodbus.client import AsyncModbusTcpClient
+
+            self.client = AsyncModbusTcpClient(
+                host=self.mcfg["host"],
+                port=self.mcfg.get("port", 502),
+                timeout=self.mcfg.get("timeout_sec", 5),
+            )
+        else:
+            from pymodbus.client import AsyncModbusSerialClient
+
+            self.client = AsyncModbusSerialClient(
+                port=self.mcfg.get("serial_port", "/dev/ttyUSB0"),
+                baudrate=self.mcfg.get("serial_baudrate", 9600),
+                parity=self.mcfg.get("serial_parity", "N"),
+                stopbits=self.mcfg.get("serial_stopbits", 1),
+                timeout=self.mcfg.get("timeout_sec", 5),
+            )
+        await self.client.connect()
+
+    async def _read_register(self, reg: dict) -> Any:
+        unit = self.mcfg.get("unit_id", 1)
+        rtype = reg.get("type", "holding")
+        addr = reg["address"]
+        count = reg.get("count", 1)
+
+        if rtype == "coil":
+            result = await self.client.read_coils(addr, count, slave=unit)
+            return bool(result.bits[0]) if not result.isError() else None
+        elif rtype == "discrete":
+            result = await self.client.read_discrete_inputs(addr, count, slave=unit)
+            return bool(result.bits[0]) if not result.isError() else None
+        elif rtype == "input":
+            result = await self.client.read_input_registers(addr, count, slave=unit)
+        else:
+            result = await self.client.read_holding_registers(addr, count, slave=unit)
+
+        if result.isError():
+            return None
+
+        return decode_registers(
+            result.registers,
+            reg.get("data_type", "uint16"),
+            reg.get("scale", 1.0),
+            reg.get("offset", 0.0),
+        )
+
+    async def _write_register(self, reg: dict, value: Any) -> Any:
+        unit = self.mcfg.get("unit_id", 1)
+        rtype = reg.get("type", "holding")
+        addr = reg["address"]
+
+        if rtype == "coil":
+            result = await self.client.write_coil(addr, bool(value), slave=unit)
+            return bool(value) if not result.isError() else None
+        else:
+            regs = encode_value(
+                float(value),
+                reg.get("data_type", "uint16"),
+                reg.get("scale", 1.0),
+                reg.get("offset", 0.0),
+            )
+            result = await self.client.write_registers(addr, regs, slave=unit)
+            return float(value) if not result.isError() else None
+
+    # ── Poll loop ─────────────────────────────────────────────────
+
+    async def _poll_loop(self) -> None:
+        interval = self.mcfg.get("poll_interval_sec", 3)
+        await self._connect_modbus()
+        logger.info("Modbus connected to %s:%s", self.mcfg.get("host", "serial"), self.mcfg.get("port", ""))
+
+        while True:
+            updates: dict[str, Any] = {}
+            for reg in self.registers:
+                try:
+                    val = await self._read_register(reg)
+                    if val is not None:
+                        updates[reg["widget_id"]] = val
+                except Exception as exc:
+                    logger.warning("Read %s failed: %s", reg["widget_id"], exc)
+
+            if updates:
+                self.bridge.bulk_update(updates)
+
+            await asyncio.sleep(interval)
+
+    # ── Entry point ───────────────────────────────────────────────
+
+    def run(self) -> None:
+        loop = asyncio.new_event_loop()
+        asyncio.set_event_loop(loop)
+
+        # Start poll loop alongside CDAP bridge
+        async def _main() -> None:
+            poll_task = asyncio.create_task(self._poll_loop())
+            cdap_task = asyncio.create_task(self.bridge._run_forever())
+            done, pending = await asyncio.wait(
+                [poll_task, cdap_task], return_when=asyncio.FIRST_EXCEPTION
+            )
+            for t in done:
+                if t.exception():
+                    logger.error("Task failed: %s", t.exception())
+            for t in pending:
+                t.cancel()
+
+        try:
+            loop.run_until_complete(_main())
+        except KeyboardInterrupt:
+            logger.info("Shutting down")
+        finally:
+            loop.close()
+
+
+# ── CLI ───────────────────────────────────────────────────────────────
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description="BetterDesk CDAP Modbus Bridge")
+    parser.add_argument("--config", "-c", default="config.json", help="Path to config file")
+    parser.add_argument("--log-level", "-l", default="INFO", choices=["DEBUG", "INFO", "WARNING", "ERROR"])
+    args = parser.parse_args()
+
+    logging.basicConfig(level=getattr(logging, args.log_level), format="%(asctime)s [%(name)s] %(levelname)s %(message)s")
+
+    path = Path(args.config)
+    if not path.is_file():
+        logger.error("Config file not found: %s", path)
+        sys.exit(1)
+
+    with open(path, encoding="utf-8") as f:
+        cfg = json.load(f)
+
+    bridge = ModbusBridge(cfg)
+    bridge.run()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/bridges/modbus/config.example.json b/bridges/modbus/config.example.json
new file mode 100644
index 00000000..e11b4255
--- /dev/null
+++ b/bridges/modbus/config.example.json
@@ -0,0 +1,78 @@
+{
+  "cdap": {
+    "server": "ws://192.168.0.110:21122/cdap",
+    "api_key": "YOUR_API_KEY",
+    "device_name": "Modbus Bridge",
+    "device_type": "bridge",
+    "bridge_name": "modbus",
+    "heartbeat_sec": 15
+  },
+  "modbus": {
+    "transport": "tcp",
+    "host": "192.168.1.100",
+    "port": 502,
+    "unit_id": 1,
+    "timeout_sec": 5,
+    "poll_interval_sec": 3,
+    "serial_port": "/dev/ttyUSB0",
+    "serial_baudrate": 9600,
+    "serial_parity": "N",
+    "serial_stopbits": 1
+  },
+  "registers": [
+    {
+      "widget_id": "temperature",
+      "label": "Temperature",
+      "type": "holding",
+      "address": 0,
+      "count": 1,
+      "data_type": "int16",
+      "scale": 0.1,
+      "offset": 0,
+      "unit": "°C",
+      "widget": "gauge",
+      "min": -20,
+      "max": 80,
+      "readonly": true
+    },
+    {
+      "widget_id": "humidity",
+      "label": "Humidity",
+      "type": "holding",
+      "address": 1,
+      "count": 1,
+      "data_type": "uint16",
+      "scale": 0.1,
+      "offset": 0,
+      "unit": "%",
+      "widget": "gauge",
+      "min": 0,
+      "max": 100,
+      "readonly": true
+    },
+    {
+      "widget_id": "relay_1",
+      "label": "Relay 1",
+      "type": "coil",
+      "address": 0,
+      "widget": "toggle",
+      "readonly": false
+    },
+    {
+      "widget_id": "setpoint",
+      "label": "Setpoint",
+      "type": "holding",
+      "address": 10,
+      "count": 1,
+      "data_type": "int16",
+      "scale": 0.1,
+      "offset": 0,
+      "unit": "°C",
+      "widget": "slider",
+      "min": 10,
+      "max": 40,
+      "step": 0.5,
+      "readonly": false
+    }
+  ]
+}
diff --git a/bridges/modbus/requirements.txt b/bridges/modbus/requirements.txt
new file mode 100644
index 00000000..d50e667c
--- /dev/null
+++ b/bridges/modbus/requirements.txt
@@ -0,0 +1 @@
+pymodbus>=3.6.0
diff --git a/bridges/rest-webhook/bridge_rest.py b/bridges/rest-webhook/bridge_rest.py
new file mode 100644
index 00000000..f8c2a922
--- /dev/null
+++ b/bridges/rest-webhook/bridge_rest.py
@@ -0,0 +1,273 @@
+#!/usr/bin/env python3
+"""BetterDesk CDAP — REST / Webhook Bridge.
+
+Polls HTTP endpoints and/or listens for incoming webhooks.  Pushes values
+to BetterDesk via CDAP, and writes back to REST APIs on command.
+
+Usage:
+    pip install betterdesk-cdap aiohttp
+    python bridge_rest.py --config config.json
+"""
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import json
+import logging
+import sys
+from pathlib import Path
+from typing import Any
+
+import aiohttp
+from aiohttp import web
+
+from betterdesk_cdap import CDAPBridge, gauge, toggle, textWidget
+
+logger = logging.getLogger("bridge_rest")
+
+# ── JMESPath-lite extraction ──────────────────────────────────────────
+
+
+def extract_path(data: Any, path: str) -> Any:
+    """Simple dot-notation path extractor (no full JMESPath dependency)."""
+    parts = path.split(".")
+    current = data
+    for part in parts:
+        if isinstance(current, dict):
+            current = current.get(part)
+        elif isinstance(current, (list, tuple)) and part.isdigit():
+            idx = int(part)
+            current = current[idx] if idx < len(current) else None
+        else:
+            return None
+        if current is None:
+            return None
+    return current
+
+
+# ── Bridge ────────────────────────────────────────────────────────────
+
+
+class RESTBridge:
+    """REST/Webhook ↔ CDAP bridge."""
+
+    def __init__(self, cfg: dict[str, Any]):
+        self.cfg = cfg
+        self.hcfg = cfg.get("http", {})
+        self.sources: list[dict] = cfg.get("sources", [])
+        self.webhooks: list[dict] = cfg.get("webhooks", [])
+        self._session: aiohttp.ClientSession | None = None
+
+        cdap = cfg["cdap"]
+        self.bridge = CDAPBridge(
+            server=cdap["server"],
+            auth_method="api_key",
+            api_key=cdap.get("api_key", ""),
+            device_name=cdap.get("device_name", "REST Bridge"),
+            device_type=cdap.get("device_type", "bridge"),
+            bridge_name=cdap.get("bridge_name", "rest"),
+            bridge_version="1.0.0",
+            heartbeat_sec=cdap.get("heartbeat_sec", 15),
+        )
+
+        self._build_widgets()
+        self._register_handlers()
+
+    # ── Widgets ───────────────────────────────────────────────────
+
+    def _build_widgets(self) -> None:
+        for src in self.sources:
+            wtype = src.get("widget", "text")
+            wid = src["widget_id"]
+            label = src.get("label", wid)
+
+            if wtype == "gauge":
+                self.bridge.add_widget(gauge(wid, label, unit=src.get("unit", ""), min_val=src.get("min", 0), max_val=src.get("max", 100)))
+            elif wtype == "toggle":
+                self.bridge.add_widget(toggle(wid, label))
+            else:
+                self.bridge.add_widget(textWidget(wid, label))
+
+        for wh in self.webhooks:
+            wid = wh["widget_id"]
+            self.bridge.add_widget(textWidget(wid, wh.get("label", wid)))
+
+    def _register_handlers(self) -> None:
+        for src in self.sources:
+            if not src.get("write_url"):
+                continue
+            wid = src["widget_id"]
+
+            @self.bridge.on_command(wid)
+            async def _handler(action: str, value: Any, *, _src: dict = src, **kw: Any) -> Any:
+                return await self._write_source(_src, action, value)
+
+    # ── HTTP polling ──────────────────────────────────────────────
+
+    async def _poll_source(self, src: dict) -> Any:
+        method = src.get("method", "GET").upper()
+        headers = src.get("headers", {})
+        url = src["url"]
+
+        async with self._session.request(method, url, headers=headers) as resp:
+            if resp.status >= 400:
+                logger.warning("HTTP %d from %s", resp.status, url)
+                return None
+            data = await resp.json()
+            path = src.get("jmespath", "")
+            return extract_path(data, path) if path else data
+
+    async def _write_source(self, src: dict, action: str, value: Any) -> Any:
+        """Write command back to REST API."""
+        url = src["write_url"]
+
+        # Resolve {action} placeholder for HA-style services
+        if src.get("widget") == "toggle":
+            act = src.get("on_action", "turn_on") if value else src.get("off_action", "turn_off")
+            url = url.replace("{action}", act)
+
+        method = src.get("write_method", "POST").upper()
+        headers = src.get("write_headers", src.get("headers", {}))
+        body = src.get("write_body", {})
+
+        async with self._session.request(method, url, headers=headers, json=body) as resp:
+            if resp.status >= 400:
+                logger.warning("Write HTTP %d to %s", resp.status, url)
+                return None
+            return value
+
+    async def _poll_loop(self) -> None:
+        default_interval = self.hcfg.get("poll_interval_sec", 10)
+        self._session = aiohttp.ClientSession()
+        logger.info("REST polling started (%d sources)", len(self.sources))
+
+        # Group sources by their poll interval
+        intervals: dict[int, list[dict]] = {}
+        for src in self.sources:
+            iv = src.get("poll_interval_sec", default_interval)
+            intervals.setdefault(iv, []).append(src)
+
+        async def _poll_group(sources: list[dict], interval: int) -> None:
+            while True:
+                updates: dict[str, Any] = {}
+                for src in sources:
+                    try:
+                        val = await self._poll_source(src)
+                        if val is not None:
+                            wtype = src.get("widget", "text")
+                            if wtype == "toggle":
+                                val = str(val).lower() in ("on", "true", "1")
+                            elif wtype == "gauge":
+                                try:
+                                    val = float(val)
+                                except (ValueError, TypeError):
+                                    continue
+                            else:
+                                val = str(val)
+                            updates[src["widget_id"]] = val
+                    except Exception as exc:
+                        logger.warning("Poll %s failed: %s", src["widget_id"], exc)
+                if updates:
+                    self.bridge.bulk_update(updates)
+                await asyncio.sleep(interval)
+
+        tasks = [asyncio.create_task(_poll_group(srcs, iv)) for iv, srcs in intervals.items()]
+        await asyncio.gather(*tasks)
+
+    # ── Webhook listener ──────────────────────────────────────────
+
+    async def _start_webhook_server(self) -> None:
+        if not self.webhooks:
+            return
+
+        port = self.hcfg.get("webhook_port", 8090)
+        path = self.hcfg.get("webhook_path", "/webhook")
+
+        async def handle_webhook(request: web.Request) -> web.Response:
+            try:
+                data = await request.json()
+            except Exception:
+                return web.Response(status=400, text="invalid json")
+
+            for wh in self.webhooks:
+                match_field = wh.get("match_field", "")
+                match_value = wh.get("match_value", "")
+                if match_field and str(extract_path(data, match_field)) != str(match_value):
+                    continue
+
+                value_field = wh.get("value_field", "")
+                val = extract_path(data, value_field) if value_field else json.dumps(data)
+                self.bridge.update_state(wh["widget_id"], str(val))
+
+                if wh.get("alert_severity"):
+                    self.bridge.fire_alert(
+                        f"wh_{wh['widget_id']}",
+                        wh["alert_severity"],
+                        wh.get("alert_message", str(val)),
+                    )
+
+            return web.Response(status=200, text="ok")
+
+        app = web.Application()
+        app.router.add_post(path, handle_webhook)
+        runner = web.AppRunner(app)
+        await runner.setup()
+        site = web.TCPSite(runner, "0.0.0.0", port)
+        await site.start()
+        logger.info("Webhook server listening on 0.0.0.0:%d%s", port, path)
+
+    # ── Entry point ───────────────────────────────────────────────
+
+    def run(self) -> None:
+        loop = asyncio.new_event_loop()
+        asyncio.set_event_loop(loop)
+
+        async def _main() -> None:
+            await self._start_webhook_server()
+            tasks = [
+                asyncio.create_task(self._poll_loop()),
+                asyncio.create_task(self.bridge._run_forever()),
+            ]
+            done, pending = await asyncio.wait(tasks, return_when=asyncio.FIRST_EXCEPTION)
+            for t in done:
+                if t.exception():
+                    logger.error("Task failed: %s", t.exception())
+            for t in pending:
+                t.cancel()
+
+        try:
+            loop.run_until_complete(_main())
+        except KeyboardInterrupt:
+            logger.info("Shutting down")
+        finally:
+            if self._session:
+                loop.run_until_complete(self._session.close())
+            loop.close()
+
+
+# ── CLI ───────────────────────────────────────────────────────────────
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description="BetterDesk CDAP REST/Webhook Bridge")
+    parser.add_argument("--config", "-c", default="config.json", help="Path to config file")
+    parser.add_argument("--log-level", "-l", default="INFO", choices=["DEBUG", "INFO", "WARNING", "ERROR"])
+    args = parser.parse_args()
+
+    logging.basicConfig(level=getattr(logging, args.log_level), format="%(asctime)s [%(name)s] %(levelname)s %(message)s")
+
+    path = Path(args.config)
+    if not path.is_file():
+        logger.error("Config file not found: %s", path)
+        sys.exit(1)
+
+    with open(path, encoding="utf-8") as f:
+        cfg = json.load(f)
+
+    bridge = RESTBridge(cfg)
+    bridge.run()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/bridges/rest-webhook/config.example.json b/bridges/rest-webhook/config.example.json
new file mode 100644
index 00000000..4bc575fb
--- /dev/null
+++ b/bridges/rest-webhook/config.example.json
@@ -0,0 +1,63 @@
+{
+  "cdap": {
+    "server": "ws://192.168.0.110:21122/cdap",
+    "api_key": "YOUR_API_KEY",
+    "device_name": "REST Bridge",
+    "device_type": "bridge",
+    "bridge_name": "rest",
+    "heartbeat_sec": 15
+  },
+  "http": {
+    "webhook_port": 8090,
+    "webhook_path": "/webhook",
+    "poll_interval_sec": 10
+  },
+  "sources": [
+    {
+      "widget_id": "weather_temp",
+      "label": "Outside Temperature",
+      "url": "https://api.openweathermap.org/data/2.5/weather?q=Warsaw&appid=YOUR_KEY&units=metric",
+      "method": "GET",
+      "headers": {},
+      "jmespath": "main.temp",
+      "widget": "gauge",
+      "unit": "°C",
+      "min": -30,
+      "max": 50,
+      "poll_interval_sec": 300
+    },
+    {
+      "widget_id": "ha_light",
+      "label": "Living Room Light",
+      "url": "http://homeassistant.local:8123/api/states/light.living_room",
+      "method": "GET",
+      "headers": {
+        "Authorization": "Bearer HA_LONG_LIVED_TOKEN"
+      },
+      "jmespath": "state",
+      "widget": "toggle",
+      "write_url": "http://homeassistant.local:8123/api/services/light/{action}",
+      "write_method": "POST",
+      "write_headers": {
+        "Authorization": "Bearer HA_LONG_LIVED_TOKEN"
+      },
+      "write_body": {
+        "entity_id": "light.living_room"
+      },
+      "on_action": "turn_on",
+      "off_action": "turn_off"
+    }
+  ],
+  "webhooks": [
+    {
+      "widget_id": "doorbell",
+      "label": "Doorbell",
+      "match_field": "event",
+      "match_value": "ring",
+      "value_field": "timestamp",
+      "widget": "text",
+      "alert_severity": "info",
+      "alert_message": "Doorbell rang"
+    }
+  ]
+}
diff --git a/bridges/rest-webhook/requirements.txt b/bridges/rest-webhook/requirements.txt
new file mode 100644
index 00000000..3beb7cba
--- /dev/null
+++ b/bridges/rest-webhook/requirements.txt
@@ -0,0 +1 @@
+aiohttp>=3.9.0
diff --git a/bridges/snmp/bridge_snmp.py b/bridges/snmp/bridge_snmp.py
new file mode 100644
index 00000000..7adcb5c1
--- /dev/null
+++ b/bridges/snmp/bridge_snmp.py
@@ -0,0 +1,251 @@
+#!/usr/bin/env python3
+"""BetterDesk CDAP — SNMP v2c/v3 Bridge.
+
+Periodically polls SNMP OIDs and pushes values to BetterDesk via CDAP.
+Supports counter-rate computation, timetick formatting, and byte formatting.
+
+Usage:
+    pip install betterdesk-cdap pysnmplib
+    python bridge_snmp.py --config config.json
+"""
+
+from __future__ import annotations
+
+import argparse
+import asyncio
+import json
+import logging
+import sys
+import time
+from pathlib import Path
+from typing import Any
+
+from betterdesk_cdap import CDAPBridge, gauge, textWidget
+
+logger = logging.getLogger("bridge_snmp")
+
+# ── Value transforms ──────────────────────────────────────────────────
+
+
+def format_timeticks(value: int) -> str:
+    """Convert SNMP TimeTicks (1/100s) to human-readable uptime."""
+    secs = int(value) // 100
+    days, rem = divmod(secs, 86400)
+    hours, rem = divmod(rem, 3600)
+    mins, rem = divmod(rem, 60)
+    return f"{days}d {hours:02d}:{mins:02d}:{rem:02d}"
+
+
+def format_bytes_kb(value: int) -> str:
+    """Format kilobytes to human-readable string."""
+    kb = int(value)
+    if kb >= 1048576:
+        return f"{kb / 1048576:.1f} GB"
+    if kb >= 1024:
+        return f"{kb / 1024:.1f} MB"
+    return f"{kb} KB"
+
+
+def apply_transform(raw: Any, transform: str) -> Any:
+    """Apply simple arithmetic transform expressed as '100 - x'."""
+    if not transform:
+        return raw
+    try:
+        x = float(raw)
+        return eval(transform, {"__builtins__": {}}, {"x": x})  # noqa: S307 — safe: restricted builtins
+    except Exception:
+        return raw
+
+
+# ── Bridge ────────────────────────────────────────────────────────────
+
+
+class SNMPBridge:
+    """SNMP ↔ CDAP bridge."""
+
+    def __init__(self, cfg: dict[str, Any]):
+        self.cfg = cfg
+        self.scfg = cfg["snmp"]
+        self.oids: list[dict] = cfg.get("oids", [])
+        self._prev_counters: dict[str, tuple[float, float]] = {}  # oid → (timestamp, value)
+
+        cdap = cfg["cdap"]
+        self.bridge = CDAPBridge(
+            server=cdap["server"],
+            auth_method="api_key",
+            api_key=cdap.get("api_key", ""),
+            device_name=cdap.get("device_name", "SNMP Bridge"),
+            device_type=cdap.get("device_type", "bridge"),
+            bridge_name=cdap.get("bridge_name", "snmp"),
+            bridge_version="1.0.0",
+            heartbeat_sec=cdap.get("heartbeat_sec", 15),
+        )
+
+        self._build_widgets()
+
+    def _build_widgets(self) -> None:
+        for entry in self.oids:
+            wtype = entry.get("widget", "text")
+            wid = entry["widget_id"]
+            label = entry.get("label", wid)
+
+            if wtype == "gauge":
+                self.bridge.add_widget(
+                    gauge(wid, label, unit=entry.get("unit", ""), min_val=entry.get("min", 0), max_val=entry.get("max", 100))
+                )
+            else:
+                self.bridge.add_widget(textWidget(wid, label))
+
+    # ── SNMP engine ───────────────────────────────────────────────
+
+    async def _snmp_get(self, oid: str) -> Any:
+        from pysnmp.hlapi.v3arch.asyncio import (
+            CommunityData,
+            ContextData,
+            ObjectIdentity,
+            ObjectType,
+            SnmpEngine,
+            UdpTransportTarget,
+            UsmUserData,
+            get_cmd,
+            usmAesCfb128Protocol,
+            usmHMACSHAAuthProtocol,
+        )
+
+        version = self.scfg.get("version", "2c")
+        target = await UdpTransportTarget.create(
+            (self.scfg["host"], self.scfg.get("port", 161)),
+            timeout=self.scfg.get("timeout_sec", 5),
+            retries=1,
+        )
+
+        if version == "3":
+            auth_proto = usmHMACSHAAuthProtocol
+            priv_proto = usmAesCfb128Protocol
+            cred = UsmUserData(
+                self.scfg.get("v3_user", ""),
+                authKey=self.scfg.get("v3_auth_key", ""),
+                privKey=self.scfg.get("v3_priv_key", ""),
+                authProtocol=auth_proto,
+                privProtocol=priv_proto,
+            )
+        else:
+            cred = CommunityData(self.scfg.get("community", "public"))
+
+        engine = SnmpEngine()
+        error_indication, error_status, error_index, var_binds = await get_cmd(
+            engine, cred, target, ContextData(), ObjectType(ObjectIdentity(oid))
+        )
+
+        if error_indication or error_status:
+            logger.warning("SNMP error for %s: %s / %s", oid, error_indication, error_status)
+            return None
+
+        for _, val in var_binds:
+            return val
+
+        return None
+
+    def _compute_rate(self, oid: str, raw: float) -> float | None:
+        """Compute per-second rate from SNMP counter."""
+        now = time.monotonic()
+        prev = self._prev_counters.get(oid)
+        self._prev_counters[oid] = (now, raw)
+        if prev is None:
+            return None
+        dt = now - prev[0]
+        if dt <= 0:
+            return None
+        return max(0.0, (raw - prev[1]) / dt)
+
+    # ── Poll loop ─────────────────────────────────────────────────
+
+    async def _poll_loop(self) -> None:
+        interval = self.scfg.get("poll_interval_sec", 10)
+        logger.info("SNMP polling %s:%s every %ds", self.scfg["host"], self.scfg.get("port", 161), interval)
+
+        while True:
+            updates: dict[str, Any] = {}
+            for entry in self.oids:
+                try:
+                    raw = await self._snmp_get(entry["oid"])
+                    if raw is None:
+                        continue
+
+                    fmt = entry.get("format", "")
+                    transform = entry.get("transform", "")
+
+                    if fmt == "timeticks":
+                        updates[entry["widget_id"]] = format_timeticks(raw)
+                    elif fmt == "bytes_kb":
+                        updates[entry["widget_id"]] = format_bytes_kb(raw)
+                    elif fmt == "counter_rate":
+                        rate = self._compute_rate(entry["oid"], float(raw))
+                        if rate is not None:
+                            updates[entry["widget_id"]] = round(rate, 2)
+                    else:
+                        val = apply_transform(raw, transform) if transform else raw
+                        try:
+                            updates[entry["widget_id"]] = float(val)
+                        except (ValueError, TypeError):
+                            updates[entry["widget_id"]] = str(val)
+
+                except Exception as exc:
+                    logger.warning("Poll %s failed: %s", entry["widget_id"], exc)
+
+            if updates:
+                self.bridge.bulk_update(updates)
+
+            await asyncio.sleep(interval)
+
+    # ── Entry point ───────────────────────────────────────────────
+
+    def run(self) -> None:
+        loop = asyncio.new_event_loop()
+        asyncio.set_event_loop(loop)
+
+        async def _main() -> None:
+            poll_task = asyncio.create_task(self._poll_loop())
+            cdap_task = asyncio.create_task(self.bridge._run_forever())
+            done, pending = await asyncio.wait(
+                [poll_task, cdap_task], return_when=asyncio.FIRST_EXCEPTION
+            )
+            for t in done:
+                if t.exception():
+                    logger.error("Task failed: %s", t.exception())
+            for t in pending:
+                t.cancel()
+
+        try:
+            loop.run_until_complete(_main())
+        except KeyboardInterrupt:
+            logger.info("Shutting down")
+        finally:
+            loop.close()
+
+
+# ── CLI ───────────────────────────────────────────────────────────────
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description="BetterDesk CDAP SNMP Bridge")
+    parser.add_argument("--config", "-c", default="config.json", help="Path to config file")
+    parser.add_argument("--log-level", "-l", default="INFO", choices=["DEBUG", "INFO", "WARNING", "ERROR"])
+    args = parser.parse_args()
+
+    logging.basicConfig(level=getattr(logging, args.log_level), format="%(asctime)s [%(name)s] %(levelname)s %(message)s")
+
+    path = Path(args.config)
+    if not path.is_file():
+        logger.error("Config file not found: %s", path)
+        sys.exit(1)
+
+    with open(path, encoding="utf-8") as f:
+        cfg = json.load(f)
+
+    bridge = SNMPBridge(cfg)
+    bridge.run()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/bridges/snmp/config.example.json b/bridges/snmp/config.example.json
new file mode 100644
index 00000000..7d999aee
--- /dev/null
+++ b/bridges/snmp/config.example.json
@@ -0,0 +1,78 @@
+{
+  "cdap": {
+    "server": "ws://192.168.0.110:21122/cdap",
+    "api_key": "YOUR_API_KEY",
+    "device_name": "SNMP Bridge",
+    "device_type": "bridge",
+    "bridge_name": "snmp",
+    "heartbeat_sec": 15
+  },
+  "snmp": {
+    "version": "2c",
+    "host": "192.168.1.1",
+    "port": 161,
+    "community": "public",
+    "timeout_sec": 5,
+    "poll_interval_sec": 10,
+    "v3_user": "",
+    "v3_auth_key": "",
+    "v3_auth_proto": "SHA",
+    "v3_priv_key": "",
+    "v3_priv_proto": "AES128"
+  },
+  "oids": [
+    {
+      "widget_id": "sys_name",
+      "label": "System Name",
+      "oid": "1.3.6.1.2.1.1.5.0",
+      "widget": "text",
+      "readonly": true
+    },
+    {
+      "widget_id": "sys_uptime",
+      "label": "Uptime",
+      "oid": "1.3.6.1.2.1.1.3.0",
+      "widget": "text",
+      "format": "timeticks",
+      "readonly": true
+    },
+    {
+      "widget_id": "cpu_load",
+      "label": "CPU Load",
+      "oid": "1.3.6.1.4.1.2021.11.11.0",
+      "widget": "gauge",
+      "unit": "%",
+      "min": 0,
+      "max": 100,
+      "transform": "100 - x",
+      "readonly": true
+    },
+    {
+      "widget_id": "mem_total",
+      "label": "Total Memory",
+      "oid": "1.3.6.1.4.1.2021.4.5.0",
+      "widget": "text",
+      "format": "bytes_kb",
+      "readonly": true
+    },
+    {
+      "widget_id": "mem_avail",
+      "label": "Available Memory",
+      "oid": "1.3.6.1.4.1.2021.4.6.0",
+      "widget": "text",
+      "format": "bytes_kb",
+      "readonly": true
+    },
+    {
+      "widget_id": "if_in_octets",
+      "label": "Eth0 In",
+      "oid": "1.3.6.1.2.1.2.2.1.10.1",
+      "widget": "gauge",
+      "unit": "B/s",
+      "min": 0,
+      "max": 125000000,
+      "format": "counter_rate",
+      "readonly": true
+    }
+  ]
+}
diff --git a/bridges/snmp/requirements.txt b/bridges/snmp/requirements.txt
new file mode 100644
index 00000000..0a9f72d6
--- /dev/null
+++ b/bridges/snmp/requirements.txt
@@ -0,0 +1 @@
+pysnmplib>=5.0.0
diff --git a/docker-compose.single.yml b/docker-compose.single.yml
index 78a6c7c8..c5eff8b7 100644
--- a/docker-compose.single.yml
+++ b/docker-compose.single.yml
@@ -7,13 +7,14 @@
 #   docker compose -f docker-compose.single.yml up -d --build
 #
 # With PostgreSQL:
-#   DB_TYPE=postgres DATABASE_URL=postgres://betterdesk:betterdesk@postgres:5432/betterdesk \
+#   PG_PASSWORD=YourStrongPasswordHere \
+#   DB_TYPE=postgres DATABASE_URL=postgres://betterdesk:YourStrongPasswordHere@postgres:5432/betterdesk \
 #     docker compose -f docker-compose.single.yml --profile postgres up -d --build
 #
 #   Or create a .env file:
 #     DB_TYPE=postgres
-#     DATABASE_URL=postgres://betterdesk:betterdesk@postgres:5432/betterdesk
-#     PG_PASSWORD=betterdesk
+#     DATABASE_URL=postgres://betterdesk:YourStrongPasswordHere@postgres:5432/betterdesk
+#     PG_PASSWORD=YourStrongPasswordHere
 #   Then: docker compose -f docker-compose.single.yml --profile postgres up -d --build
 #
 # Access:
@@ -84,7 +85,8 @@ services:
     container_name: betterdesk-postgres
     environment:
       - POSTGRES_USER=betterdesk
-      - POSTGRES_PASSWORD=${PG_PASSWORD:-betterdesk}
+      # BD-2026-007: PG_PASSWORD MUST be set explicitly — do not use default values in production
+      - POSTGRES_PASSWORD=${PG_PASSWORD:?PG_PASSWORD must be set for PostgreSQL}
       - POSTGRES_DB=betterdesk
     volumes:
       - postgres-data:/var/lib/postgresql/data
diff --git a/docker-compose.yml b/docker-compose.yml
index 531df0f6..c952e2f1 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -61,7 +61,7 @@ services:
       - "5000:5000"             # Web console
       - "21121:21121"           # RustDesk Client API (WAN)
     volumes:
-      - rustdesk-data:/opt/rustdesk:ro    # Read-only access to server data (keys, db)
+      - rustdesk-data:/opt/rustdesk        # Shared server data (keys, db) — needs write for WAL mode
       - console-data:/app/data            # Console-specific data (auth.db, sessions)
     environment:
       - NODE_ENV=production
diff --git a/docker-entrypoint.sh b/docker-entrypoint.sh
index 803cb795..809dd75d 100644
--- a/docker-entrypoint.sh
+++ b/docker-entrypoint.sh
@@ -25,6 +25,32 @@ echo ""
 # Ensure data directories exist
 mkdir -p "${DATA_DIR:-/app/data}" 2>/dev/null || true
 
+# Verify SQLite database path is writable (catches :ro volume mounts early)
+DB_FILE="${DB_PATH:-/opt/rustdesk/db_v2.sqlite3}"
+DB_DIR="$(dirname "$DB_FILE")"
+if [ "${DB_TYPE:-sqlite}" = "sqlite" ]; then
+    if [ -f "$DB_FILE" ] && [ ! -w "$DB_FILE" ]; then
+        echo ""
+        echo "ERROR: Database file $DB_FILE is not writable!"
+        echo "  This usually means the volume is mounted read-only (:ro)."
+        echo "  Fix: In docker-compose.yml, change the console volume mount from:"
+        echo "    rustdesk-data:/opt/rustdesk:ro"
+        echo "  to:"
+        echo "    rustdesk-data:/opt/rustdesk"
+        echo ""
+        echo "  Then run: docker compose down && docker compose up -d"
+        echo ""
+        exit 1
+    fi
+    if [ ! -w "$DB_DIR" ]; then
+        echo ""
+        echo "WARNING: Database directory $DB_DIR is not writable."
+        echo "  SQLite needs write access for WAL journal files (.db-wal, .db-shm)."
+        echo "  Check volume mount permissions in docker-compose.yml."
+        echo ""
+    fi
+fi
+
 # Wait for BetterDesk server (hbbs) to be available if using betterdesk backend
 if [ "${SERVER_BACKEND}" = "betterdesk" ] && [ -n "${HBBS_API_URL}" ]; then
     echo "Waiting for BetterDesk server..."
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index ed24ccd6..1caffbd7 100644
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -24,6 +24,14 @@ echo ""
 mkdir -p /opt/rustdesk /app/data /var/log/betterdesk 2>/dev/null || true
 chown -R betterdesk:betterdesk /opt/rustdesk /app/data /var/log/betterdesk 2>/dev/null || true
 
+# BD-2026-007: Warn about weak default secrets
+if [ -n "${SESSION_SECRET}" ] && [ ${#SESSION_SECRET} -lt 32 ]; then
+    echo "WARNING [SECURITY]: SESSION_SECRET is shorter than 32 characters — generate a stronger secret"
+fi
+if [ -n "${ADMIN_PASSWORD}" ] && [ ${#ADMIN_PASSWORD} -lt 12 ]; then
+    echo "WARNING [SECURITY]: ADMIN_PASSWORD is shorter than 12 characters — use a stronger password"
+fi
+
 # Determine database DSN for Go server
 # DB_URL env var is read by Go server's config.LoadEnv()
 if [ "${DB_TYPE}" = "postgres" ] || [ "${DB_TYPE}" = "postgresql" ]; then
diff --git a/docs/README.md b/docs/README.md
index e94e6a40..c4cf8ef4 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,41 +1,63 @@
 # Documentation
 
-This directory contains comprehensive documentation for BetterDesk Console.
+This directory contains comprehensive documentation for BetterDesk Console, organized by topic.
 
-## Quick Start
-- **[INSTALLATION_V1.4.0.md](INSTALLATION_V1.4.0.md)** - Installation guide
-- **[UPDATE_GUIDE.md](UPDATE_GUIDE.md)** - Updating existing installations
-- **[TROUBLESHOOTING_EN.md](TROUBLESHOOTING_EN.md)** - Common issues & solutions
+## Setup & Installation
+
+- **[Installation Guide](setup/INSTALLATION_V1.4.0.md)** — Full installation instructions
+- **[Update Guide](setup/UPDATE_GUIDE.md)** — Updating existing installations
+- **[Build Guide](setup/BUILD_GUIDE.md)** — Building from source
+- **[Synology Installation](setup/SYNOLOGY_INSTALLATION.md)** — NAS-specific setup
+- **[HTTPS Setup](setup/HTTPS_SETUP.md)** — SSL/TLS certificate configuration
 
 ## Docker
-- **[DOCKER_SUPPORT.md](DOCKER_SUPPORT.md)** - Docker installation guide
-- **[DOCKER_TROUBLESHOOTING.md](DOCKER_TROUBLESHOOTING.md)** - Docker-specific issues
+
+- **[Docker Support](docker/DOCKER_SUPPORT.md)** — Docker installation guide
+- **[Docker Quick Start](docker/DOCKER_QUICKSTART.md)** — 30-second quick start with pre-built images
+- **[Docker Troubleshooting](docker/DOCKER_TROUBLESHOOTING.md)** — Docker-specific issues & fixes
+- **[Docker Migration](docker/DOCKER_MIGRATION.md)** — Migrating from existing RustDesk Docker
 
 ## Features
-- **[CLIENT_GENERATOR.md](CLIENT_GENERATOR.md)** - Custom client generator
-- **[CLIENT_GENERATOR_QUICKSTART_EN.md](CLIENT_GENERATOR_QUICKSTART_EN.md)** - Client generator quick start
-- **[ID_CHANGE_FEATURE.md](ID_CHANGE_FEATURE.md)** - Device ID change feature
-- **[STATUS_TRACKING_v3.md](STATUS_TRACKING_v3.md)** - Device status tracking system
+
+- **[Client Generator](features/CLIENT_GENERATOR.md)** — Custom client generator
+- **[Client Generator Quick Start](features/CLIENT_GENERATOR_QUICKSTART_EN.md)** — Quick start guide
+- **[Device ID Change](features/ID_CHANGE_FEATURE.md)** — Device ID change feature
+- **[Status Tracking v3](features/STATUS_TRACKING_v3.md)** — Device status tracking system
+- **[CDAP / Custom Device API](features/CUSTOM_DEVICE_API.md)** — Custom Device Access Protocol
+- **[Web Remote Client](features/WEB_REMOTE_CLIENT_PLAN.md)** — Browser-based remote desktop
+
+## Architecture
+
+- **[Project Structure](architecture/PROJECT_STRUCTURE.md)** — Codebase overview
+- **[BetterDesk Client](architecture/BETTERDESK_CLIENT_ARCHITECTURE.md)** — Desktop client architecture
+- **[BetterDesk v3 Overview](architecture/BETTERDESK_v3_OVERVIEW.md)** — v3 architecture summary
+- **[CDAP Protocol](architecture/CDAP_PROTOCOL.md)** — CDAP wire protocol specification
+- **[CDAP Implementation](architecture/CDAP_IMPLEMENTATION_PLAN.md)** — CDAP implementation plan
+- **[Port Security](architecture/PORT_SECURITY.md)** — Port configuration & security
+
+## Troubleshooting
+
+- **[General Troubleshooting](troubleshooting/TROUBLESHOOTING_EN.md)** — Common issues & solutions
+- **[Key Troubleshooting](troubleshooting/KEY_TROUBLESHOOTING.md)** — Key and encryption issues
+- **[Quick Fix](troubleshooting/QUICK_FIX_EN.md)** — Quick fixes for common problems
 
 ## Performance
-- **[GPU_OPTIMIZATION_EN.md](GPU_OPTIMIZATION_EN.md)** - GPU optimization
-- **[GPU_FIX_QUICKSTART_EN.md](GPU_FIX_QUICKSTART_EN.md)** - Quick GPU fix guide
-- **[OPTIMIZATION_SUMMARY_EN.md](OPTIMIZATION_SUMMARY_EN.md)** - Performance optimization summary
 
-## Security & Troubleshooting
-- **[KEY_TROUBLESHOOTING.md](KEY_TROUBLESHOOTING.md)** - Key and encryption issues
-- **[PORT_SECURITY.md](PORT_SECURITY.md)** - Port configuration & security
-- **[QUICK_FIX_EN.md](QUICK_FIX_EN.md)** - Quick fixes for common issues
+- **[GPU Optimization](performance/GPU_OPTIMIZATION_EN.md)** — GPU optimization guide
+- **[GPU Quick Fix](performance/GPU_FIX_QUICKSTART_EN.md)** — Quick GPU fix
+- **[Optimization Summary](performance/OPTIMIZATION_SUMMARY_EN.md)** — Performance optimization overview
 
 ## Development
-- **[BUILD_GUIDE.md](BUILD_GUIDE.md)** - Building from source
-- **[CONTRIBUTING.md](CONTRIBUTING.md)** - Contribution guidelines
-- **[PROJECT_STRUCTURE.md](PROJECT_STRUCTURE.md)** - Project structure overview
-- **[CHANGELOG.md](CHANGELOG.md)** - Version history
 
-## Additional
-- **[TRANSLATION_SUMMARY.md](TRANSLATION_SUMMARY.md)** - Documentation translation status
+- **[Contributing](development/CONTRIBUTING.md)** — Contribution guidelines
+- **[Translation Guide](development/CONTRIBUTING_TRANSLATIONS.md)** — Adding new languages
+- **[Translation Summary](development/TRANSLATION_SUMMARY.md)** — Translation coverage status
+- **[Changelog](development/CHANGELOG.md)** — Version history
 
-## Legacy HBBS Patch (Archived)
+## Enterprise
 
-The original Rust-based HBBS patch (`hbbs-patch-v2/`) has been replaced by the [Go server](../betterdesk-server/) and moved to `archive/`. See the main [README](../README.md) for current architecture.
+- **[Enterprise Roadmap](enterprise/ENTERPRISE_ROADMAP.md)** — Future enterprise features
+
+---
+
+> **Note:** The original Rust-based HBBS patch has been replaced by the [Go server](../betterdesk-server/) and moved to `archive/`. See the main [README](../README.md) for current architecture.
diff --git a/docs/BETTERDESK_CLIENT_ARCHITECTURE.md b/docs/architecture/BETTERDESK_CLIENT_ARCHITECTURE.md
similarity index 100%
rename from docs/BETTERDESK_CLIENT_ARCHITECTURE.md
rename to docs/architecture/BETTERDESK_CLIENT_ARCHITECTURE.md
diff --git a/docs/architecture/BETTERDESK_v3_OVERVIEW.md b/docs/architecture/BETTERDESK_v3_OVERVIEW.md
new file mode 100644
index 00000000..b8c06038
--- /dev/null
+++ b/docs/architecture/BETTERDESK_v3_OVERVIEW.md
@@ -0,0 +1,325 @@
+# BetterDesk v3.0 — Ultimate Remote & CDAP Solution
+
+> **Version**: 3.0.0  
+> **Codename**: Ultimate  
+> **Release Date**: March 2026
+
+---
+
+## What's New in v3.0
+
+BetterDesk v3.0 is a major release that transforms BetterDesk from a RustDesk-compatible server into a **complete device management ecosystem**. The key additions are:
+
+1. **CDAP (Custom Device API Protocol)** — A WebSocket-based protocol for connecting IoT devices, SCADA controllers, network equipment, and custom agents to the BetterDesk panel alongside RustDesk clients.
+
+2. **BetterDesk Minimal Mode** — Server-only installation without the web console, for headless deployments or API-only usage.
+
+3. **Media Channel** — Binary frame relay for remote desktop sessions between CDAP devices with E2E encryption.
+
+4. **Bridge Ecosystem** — Python SDK and reference bridges (Modbus TCP, SNMP, REST webhook) for connecting industrial and network devices.
+
+5. **Desktop Mode (Beta)** — Experimental desktop-like interface for the web console with floating windows, widgets, and taskbar.
+
+---
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│                    BetterDesk v3.0 Ecosystem                     │
+│                                                                   │
+│  ┌───────────────────────────────────────────────────────────┐   │
+│  │                  BetterDesk Go Server                      │   │
+│  │                  (single binary)                           │   │
+│  │                                                            │   │
+│  │  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌──────────┐ │   │
+│  │  │ Signal   │  │ Relay    │  │ HTTP API │  │ CDAP     │ │   │
+│  │  │ :21116   │  │ :21117   │  │ :21114   │  │ Gateway  │ │   │
+│  │  │ UDP/TCP  │  │ TCP/WS   │  │ REST+WS  │  │ :21122   │ │   │
+│  │  │ +WS:18   │  │ +WS:19   │  │          │  │ WS+TLS   │ │   │
+│  │  └──────────┘  └──────────┘  └──────────┘  └──────────┘ │   │
+│  │                                                            │   │
+│  │  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌──────────┐ │   │
+│  │  │ Auth     │  │ Database │  │ Audit    │  │ Metrics  │ │   │
+│  │  │ JWT+TOTP │  │ SQLite/  │  │ Ring Log │  │ Prometheus│ │   │
+│  │  │ +RBAC    │  │ Postgres │  │          │  │          │ │   │
+│  │  └──────────┘  └──────────┘  └──────────┘  └──────────┘ │   │
+│  └───────────────────────────────────────────────────────────┘   │
+│                                                                   │
+│  ┌───────────────────────────────────────────────────────────┐   │
+│  │              BetterDesk Web Console (Node.js)              │   │
+│  │              Port 5000 (LAN) + 21121 (WAN)                │   │
+│  │                                                            │   │
+│  │  Dashboard │ Devices │ Users │ Automation │ CDAP │ Remote │   │
+│  │  Tickets   │ Reports │ Inventory │ Desktop Mode (Beta)    │   │
+│  └───────────────────────────────────────────────────────────┘   │
+│                                                                   │
+│  ┌──────────────┐  ┌──────────────┐  ┌──────────────────────┐   │
+│  │ RustDesk     │  │ CDAP Native  │  │ CDAP Bridges         │   │
+│  │ Clients      │  │ Agent        │  │ (Modbus, SNMP, REST) │   │
+│  │ (Desktop/    │  │ (Desktop +   │  │                      │   │
+│  │  Mobile)     │  │  Management) │  │                      │   │
+│  └──────────────┘  └──────────────┘  └──────────────────────┘   │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+---
+
+## Installation Modes
+
+### Full Installation (default)
+Installs Go server + Node.js web console + all features.
+
+```bash
+# Linux
+sudo ./betterdesk.sh
+
+# Windows (PowerShell as Administrator)
+.\betterdesk.ps1
+```
+
+### Minimal Installation (new in v3.0)
+Installs Go server only — no web console. Ideal for:
+- Headless relay servers
+- API-only deployments
+- Lightweight edge nodes
+- Custom integrations via REST API
+
+```bash
+# Linux
+sudo ./betterdesk.sh --minimal
+
+# Windows
+.\betterdesk.ps1 -Minimal
+```
+
+### Docker
+```bash
+# Quick start (pre-built images)
+curl -fsSL https://raw.githubusercontent.com/UNITRONIX/Rustdesk-FreeConsole/main/docker-compose.quick.yml -o docker-compose.yml
+docker compose up -d
+
+# Build locally
+docker compose build && docker compose up -d
+```
+
+---
+
+## Port Reference
+
+| Port | Protocol | Service | Mode |
+|------|----------|---------|------|
+| 21114 | HTTP | REST API (Go server) | Full + Minimal |
+| 21115 | TCP | NAT type test | Full + Minimal |
+| 21116 | TCP/UDP | Signal server (client registration) | Full + Minimal |
+| 21117 | TCP | Relay server (bidirectional stream) | Full + Minimal |
+| 21118 | WS | WebSocket Signal | Full + Minimal |
+| 21119 | WS | WebSocket Relay | Full + Minimal |
+| 21121 | TCP | RustDesk Client API (WAN) | Full only |
+| 21122 | WS | CDAP Gateway | Full + Minimal (if enabled) |
+| 5000 | HTTP | Web Console (LAN) | Full only |
+
+---
+
+## CDAP Overview
+
+The Custom Device API Protocol (CDAP) enables non-RustDesk devices to connect to BetterDesk:
+
+### Supported Device Types
+
+| Type | Icon | Use Case |
+|------|------|----------|
+| `rustdesk` | 🖥️ | Standard RustDesk desktop client |
+| `desktop` | 💻 | BetterDesk native agent (remote desktop + management) |
+| `iot` | 📡 | IoT sensors and actuators |
+| `scada` | 🏭 | Industrial controllers (PLC, HMI) |
+| `os_agent` | 🖧 | OS-level system management agent |
+| `network` | 🌐 | Network equipment (switches, routers, APs) |
+| `camera` | 📷 | IP cameras and NVRs |
+| `custom` | ⚙️ | Any other device type |
+
+### Widget Types
+
+CDAP devices expose their state through widgets rendered in the web panel:
+
+| Widget | Description | Interactive |
+|--------|-------------|-------------|
+| `toggle` | Boolean switch (on/off) | ✅ |
+| `gauge` | Numeric value with min/max and thresholds | ❌ |
+| `button` | Action trigger with optional confirmation | ✅ |
+| `led` | Status indicator (red/yellow/green) | ❌ |
+| `text` | Read-only text display | ❌ |
+| `slider` | Numeric range input | ✅ |
+| `select` | Dropdown selection | ✅ |
+| `chart` | Line/bar/area chart | ❌ |
+| `table` | Dynamic sortable table | ❌ |
+| `terminal` | WebSocket shell relay | ✅ |
+
+### Authentication
+
+CDAP clients authenticate using the same credential system as the web panel:
+
+- **User/password** — Interactive login with optional TOTP 2FA
+- **API key** — Unattended access for bridges and agents
+- **Device token** — One-time enrollment for new devices
+
+### Example: Python Bridge
+
+```python
+import asyncio
+import websockets
+import json
+
+async def connect():
+    uri = "ws://betterdesk.example.com:21122"
+    async with websockets.connect(uri) as ws:
+        # Authenticate
+        await ws.send(json.dumps({
+            "type": "auth",
+            "payload": {
+                "method": "api_key",
+                "key": "your-api-key",
+                "device_id": "CDAP-SENSOR01"
+            }
+        }))
+        
+        # Register with manifest
+        await ws.send(json.dumps({
+            "type": "register",
+            "payload": {
+                "manifest": {
+                    "name": "Temperature Sensor",
+                    "device_type": "iot",
+                    "version": "1.0.0",
+                    "widgets": [
+                        {
+                            "id": "temperature",
+                            "type": "gauge",
+                            "label": "Temperature",
+                            "unit": "°C",
+                            "min": -20,
+                            "max": 80,
+                            "thresholds": {
+                                "warning": 60,
+                                "danger": 75
+                            }
+                        }
+                    ]
+                }
+            }
+        }))
+        
+        # Send periodic state updates
+        while True:
+            await ws.send(json.dumps({
+                "type": "state_update",
+                "payload": {
+                    "widgets": {
+                        "temperature": {"value": 23.5}
+                    }
+                }
+            }))
+            await asyncio.sleep(5)
+
+asyncio.run(connect())
+```
+
+---
+
+## Security
+
+### Encryption Layers
+
+| Layer | Protocol | Purpose |
+|-------|----------|---------|
+| E2E | NaCl (XSalsa20-Poly1305) | Peer-to-peer encryption (RustDesk + CDAP media) |
+| Transport | TLS 1.3 | Client-server encryption (all ports) |
+| Auth | JWT + PBKDF2 + TOTP | Identity verification |
+| Session | HttpOnly + Secure + SameSite cookies | Web console sessions |
+
+### RBAC (Role-Based Access Control)
+
+| Role | Panel | Devices | CDAP Widgets | Users | Settings |
+|------|-------|---------|--------------|-------|----------|
+| Admin | Full | Full | Full (incl. dangerous) | Full | Full |
+| Operator | Read + most actions | Read + connect | Read + safe controls | Read own | Read |
+| Viewer | Read only | Read only | Read only | None | None |
+
+### Per-Widget RBAC (new in v3.0)
+
+CDAP widgets can require specific roles for interaction:
+
+```json
+{
+    "id": "emergency_stop",
+    "type": "button",
+    "label": "Emergency Stop",
+    "permissions": {
+        "read": "viewer",
+        "execute": "admin"
+    }
+}
+```
+
+---
+
+## Desktop Mode (Beta)
+
+> ⚠️ **Beta Feature** — Desktop Mode is experimental and under active development.
+
+Desktop Mode transforms the web console into a desktop-like interface with:
+- Floating windows for each panel section
+- Draggable/resizable window management
+- Desktop widgets (clock, server gauges, activity feed)
+- Quick launch toolbar
+
+To enable: Click the monitor icon (🖥️) in the top navigation bar.
+
+**Known limitations:**
+- Iframe-based routing may cause session conflicts
+- Some pages may not render correctly in floating windows
+- Mobile devices are not supported in desktop mode
+- Performance may degrade with many open windows
+
+---
+
+## Version History
+
+| Version | Date | Highlights |
+|---------|------|------------|
+| 3.0.0 | 2026-03 | CDAP complete, Minimal mode, media channel, bridge SDK |
+| 2.4.0 | 2026-03 | PostgreSQL support, SQLite→PG migration, Docker quick start |
+| 2.3.0 | 2026-02 | Security audit, TOTP 2FA, CSRF, Client API, address book sync |
+| 2.2.0 | 2026-02 | Node.js + Flask choice, migration, auto Node.js install |
+| 2.1.0 | 2026-02 | Auto mode, SHA256 verification, configurable API ports |
+| 2.0.0 | 2026-02 | Go server replacing Rust hbbs+hbbr, single binary |
+| 1.5.0 | 2026-01 | Improved installer, diagnostics, offline status fix |
+| 1.0.0 | 2025-12 | Initial release (Rust patched server + Flask console) |
+
+---
+
+## Technology Stack
+
+| Component | Technology | Version |
+|-----------|-----------|---------|
+| Server | Go | 1.21+ |
+| Web Console | Node.js + Express.js + EJS | 18+ |
+| Database | SQLite / PostgreSQL | 3.x / 14+ |
+| Protocol | Protobuf (RustDesk wire format) | 3.x |
+| CDAP | WebSocket + JSON | 1.0 |
+| Auth | JWT + PBKDF2 + TOTP (otplib) | — |
+| TLS | Go crypto/tls (1.3) | — |
+| Docker | Multi-stage builds | 24+ |
+| CI/CD | GitHub Actions | — |
+
+---
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup, coding standards, and pull request guidelines.
+
+See [CONTRIBUTING_TRANSLATIONS.md](CONTRIBUTING_TRANSLATIONS.md) for adding new languages.
+
+## License
+
+Apache License 2.0 — See [LICENSE](../LICENSE) for details.
diff --git a/docs/CDAP_IMPLEMENTATION_PLAN.md b/docs/architecture/CDAP_IMPLEMENTATION_PLAN.md
similarity index 100%
rename from docs/CDAP_IMPLEMENTATION_PLAN.md
rename to docs/architecture/CDAP_IMPLEMENTATION_PLAN.md
diff --git a/docs/architecture/CDAP_PROTOCOL.md b/docs/architecture/CDAP_PROTOCOL.md
new file mode 100644
index 00000000..720bdcbd
--- /dev/null
+++ b/docs/architecture/CDAP_PROTOCOL.md
@@ -0,0 +1,921 @@
+# CDAP — Custom Device API Protocol
+
+> **Protocol Version**: 1.0  
+> **Server Version**: BetterDesk v3.0.0  
+> **Status**: Production-ready (Phases 0-7 implemented)
+
+---
+
+## Table of Contents
+
+1. [Overview](#overview)
+2. [Transport Layer](#transport-layer)
+3. [Authentication](#authentication)
+4. [Message Envelope](#message-envelope)
+5. [Lifecycle](#lifecycle)
+6. [Widgets](#widgets)
+7. [Commands](#commands)
+8. [Events](#events)
+9. [Media Channel](#media-channel)
+10. [Device Linking](#device-linking)
+11. [RBAC](#rbac)
+12. [Bridge SDK](#bridge-sdk)
+13. [Error Codes](#error-codes)
+
+---
+
+## Overview
+
+CDAP (Custom Device API Protocol) is a WebSocket-based protocol that connects non-RustDesk devices to the BetterDesk ecosystem. It provides:
+
+- **Real-time state synchronization** — Devices push state updates; panel renders widgets
+- **Bidirectional commands** — Operators send commands to devices; devices respond with results
+- **Media relay** — Binary frame channel for remote desktop sessions (E2E encrypted)
+- **Device management** — Enrollment, revocation, linking, grouping
+- **Bridge ecosystem** — SDKs for Modbus TCP, SNMP, REST webhooks, and custom protocols
+
+### When to Use CDAP
+
+| Scenario | Use CDAP? | Alternative |
+|----------|-----------|-------------|
+| IoT sensor dashboard | ✅ Yes | — |
+| SCADA/PLC monitoring | ✅ Yes | — |
+| Network device management | ✅ Yes | — |
+| Remote desktop (existing) | ❌ No | RustDesk client |
+| Remote desktop (CDAP agent) | ✅ Yes | BetterDesk native agent |
+| Custom automation agent | ✅ Yes | — |
+
+---
+
+## Transport Layer
+
+### WebSocket Connection
+
+```
+ws://host:21122    (plain)
+wss://host:21122   (TLS)
+```
+
+The CDAP gateway uses **dual-mode listening** — auto-detects TLS (first byte `0x16`) and plain connections on the same port. No separate TLS port needed.
+
+### TLS Configuration
+
+```bash
+# Enable TLS on CDAP gateway
+betterdesk-server --tls-cert /path/to/cert.pem --tls-key /path/to/key.pem
+
+# CDAP auto-detects TLS when cert/key are provided
+# Both plain and TLS connections accepted on port 21122
+```
+
+### Connection Parameters
+
+| Parameter | Default | Description |
+|-----------|---------|-------------|
+| `CDAP_PORT` | 21122 | Gateway listen port |
+| `CDAP_MAX_CONNS` | 10000 | Maximum concurrent connections |
+| `CDAP_READ_LIMIT` | 1048576 | Maximum message size (1 MiB) |
+| `CDAP_PING_INTERVAL` | 30s | WebSocket ping interval |
+| `CDAP_PONG_TIMEOUT` | 10s | Pong response deadline |
+| `CDAP_WRITE_TIMEOUT` | 10s | Write deadline per message |
+
+### Reconnection
+
+Clients should implement exponential backoff reconnection:
+
+```
+Attempt 1: wait 1s
+Attempt 2: wait 2s
+Attempt 3: wait 4s
+Attempt N: wait min(2^(N-1), 60)s
+```
+
+On reconnect, clients must re-authenticate and re-register. The server preserves device state for 5 minutes after disconnection.
+
+---
+
+## Authentication
+
+Authentication must be the **first message** after WebSocket upgrade. The server closes the connection after 10 seconds without auth.
+
+### Method 1: API Key
+
+```json
+{
+    "type": "auth",
+    "id": "msg-001",
+    "payload": {
+        "method": "api_key",
+        "key": "a1b2c3d4e5f6...",
+        "device_id": "CDAP-SENSOR01"
+    }
+}
+```
+
+### Method 2: User/Password
+
+```json
+{
+    "type": "auth",
+    "id": "msg-002",
+    "payload": {
+        "method": "user_password",
+        "username": "operator1",
+        "password": "secure-password",
+        "device_id": "CDAP-AGENT01"
+    }
+}
+```
+
+If the user has TOTP 2FA enabled, the server responds with `auth_2fa_required`:
+
+```json
+{
+    "type": "auth_2fa_required",
+    "id": "msg-002",
+    "payload": {
+        "message": "TOTP code required"
+    }
+}
+```
+
+Client must then send:
+
+```json
+{
+    "type": "auth_2fa",
+    "id": "msg-003",
+    "payload": {
+        "code": "123456"
+    }
+}
+```
+
+### Method 3: Device Token
+
+For automated enrollment (one-time tokens generated by admin):
+
+```json
+{
+    "type": "auth",
+    "id": "msg-004",
+    "payload": {
+        "method": "device_token",
+        "token": "enroll-abc123def456",
+        "device_id": "CDAP-NEW01"
+    }
+}
+```
+
+### Auth Response
+
+Success:
+
+```json
+{
+    "type": "auth_ok",
+    "id": "msg-001",
+    "payload": {
+        "session_id": "sess-xyz789",
+        "expires_in": 86400,
+        "role": "operator",
+        "permissions": ["read", "control", "media"]
+    }
+}
+```
+
+Failure:
+
+```json
+{
+    "type": "auth_error",
+    "id": "msg-001",
+    "payload": {
+        "code": "AUTH_INVALID_KEY",
+        "message": "Invalid API key"
+    }
+}
+```
+
+---
+
+## Message Envelope
+
+All CDAP messages use a JSON envelope:
+
+```json
+{
+    "type": "message_type",
+    "id": "unique-message-id",
+    "payload": { ... },
+    "ts": 1711834567890
+}
+```
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `type` | string | ✅ | Message type identifier |
+| `id` | string | ✅ | Unique message ID (for request/response correlation) |
+| `payload` | object | ✅ | Message-specific data |
+| `ts` | number | ❌ | Unix timestamp in milliseconds |
+
+### Message Types (Client → Server)
+
+| Type | Description |
+|------|-------------|
+| `auth` | Authentication request |
+| `auth_2fa` | TOTP 2FA code |
+| `register` | Device registration with manifest |
+| `state_update` | Widget state push |
+| `command_response` | Response to server command |
+| `heartbeat` | Keep-alive with optional metrics |
+| `media_offer` | SDP offer for media channel |
+| `media_answer` | SDP answer for media channel |
+| `media_frame` | Binary frame (uses binary WebSocket frames) |
+| `event` | Client-originated event |
+
+### Message Types (Server → Client)
+
+| Type | Description |
+|------|-------------|
+| `auth_ok` | Authentication success |
+| `auth_error` | Authentication failure |
+| `auth_2fa_required` | TOTP required |
+| `registered` | Registration acknowledged |
+| `command` | Command from operator |
+| `state_request` | Server requests full state refresh |
+| `media_offer` | SDP offer from peer |
+| `media_answer` | SDP answer from peer |
+| `config_update` | Server configuration change |
+| `error` | Generic error |
+| `ping` | Application-level ping |
+
+---
+
+## Lifecycle
+
+### Connection Flow
+
+```
+Client                              Server
+  │                                    │
+  │──── WebSocket Upgrade ────────────>│
+  │<─── 101 Switching Protocols ───────│
+  │                                    │
+  │──── auth {method, credentials} ───>│
+  │<─── auth_ok {session, role} ───────│
+  │                                    │
+  │──── register {manifest} ──────────>│
+  │<─── registered {ack} ─────────────│
+  │                                    │
+  │──── state_update {widgets} ───────>│  (periodic)
+  │<─── command {action, params} ──────│  (on-demand)
+  │──── command_response {result} ────>│
+  │                                    │
+  │──── heartbeat {metrics} ──────────>│  (every 30s)
+  │<─── pong ─────────────────────────│
+  │                                    │
+  │──── close ────────────────────────>│
+  │<─── close ─────────────────────────│
+```
+
+### Registration (Manifest)
+
+The manifest describes the device's capabilities:
+
+```json
+{
+    "type": "register",
+    "id": "msg-010",
+    "payload": {
+        "manifest": {
+            "name": "Factory Floor Controller",
+            "device_type": "scada",
+            "version": "2.1.0",
+            "firmware": "PLC-FW-3.5.2",
+            "capabilities": ["widgets", "commands", "media"],
+            "categories": [
+                {
+                    "id": "temperature",
+                    "label": "Temperature Sensors",
+                    "icon": "thermostat"
+                },
+                {
+                    "id": "actuators",
+                    "label": "Actuators",
+                    "icon": "settings"
+                }
+            ],
+            "widgets": [
+                {
+                    "id": "temp_zone1",
+                    "type": "gauge",
+                    "label": "Zone 1 Temperature",
+                    "category": "temperature",
+                    "unit": "°C",
+                    "min": -10,
+                    "max": 100,
+                    "thresholds": {
+                        "warning": 60,
+                        "danger": 85
+                    },
+                    "permissions": {
+                        "read": "viewer"
+                    }
+                },
+                {
+                    "id": "motor_speed",
+                    "type": "slider",
+                    "label": "Motor Speed",
+                    "category": "actuators",
+                    "unit": "RPM",
+                    "min": 0,
+                    "max": 3000,
+                    "step": 50,
+                    "permissions": {
+                        "read": "viewer",
+                        "control": "operator"
+                    }
+                },
+                {
+                    "id": "emergency_stop",
+                    "type": "button",
+                    "label": "Emergency Stop",
+                    "category": "actuators",
+                    "confirm": true,
+                    "confirmMessage": "Are you sure you want to trigger emergency stop?",
+                    "dangerous": true,
+                    "permissions": {
+                        "read": "viewer",
+                        "execute": "admin"
+                    }
+                }
+            ],
+            "commands": [
+                {
+                    "id": "reboot",
+                    "label": "Reboot Device",
+                    "confirm": true,
+                    "permissions": {
+                        "execute": "admin"
+                    }
+                },
+                {
+                    "id": "calibrate",
+                    "label": "Calibrate Sensors",
+                    "params": [
+                        {
+                            "id": "zone",
+                            "type": "select",
+                            "label": "Zone",
+                            "options": ["zone1", "zone2", "zone3"]
+                        }
+                    ],
+                    "permissions": {
+                        "execute": "operator"
+                    }
+                }
+            ]
+        }
+    }
+}
+```
+
+### State Updates
+
+Devices push widget state periodically or on change:
+
+```json
+{
+    "type": "state_update",
+    "id": "msg-020",
+    "payload": {
+        "widgets": {
+            "temp_zone1": {
+                "value": 42.5,
+                "status": "normal"
+            },
+            "motor_speed": {
+                "value": 1500
+            },
+            "emergency_stop": {
+                "active": false
+            }
+        }
+    }
+}
+```
+
+### Heartbeat
+
+Sent every 30s (configurable) with optional system metrics:
+
+```json
+{
+    "type": "heartbeat",
+    "id": "msg-030",
+    "payload": {
+        "uptime": 86400,
+        "cpu": 23.5,
+        "memory": 67.2,
+        "disk": 45.0,
+        "custom_metrics": {
+            "queue_depth": 42,
+            "error_rate": 0.01
+        }
+    }
+}
+```
+
+---
+
+## Widgets
+
+### Toggle
+
+Boolean on/off switch.
+
+```json
+{
+    "id": "relay1",
+    "type": "toggle",
+    "label": "Main Relay",
+    "category": "actuators"
+}
+```
+
+State: `{ "value": true }`
+
+Command: `{ "action": "set", "widget_id": "relay1", "value": false }`
+
+### Gauge
+
+Numeric value with thresholds and optional unit.
+
+```json
+{
+    "id": "pressure",
+    "type": "gauge",
+    "label": "Pressure",
+    "unit": "bar",
+    "min": 0,
+    "max": 10,
+    "decimals": 2,
+    "thresholds": {
+        "warning": 7.5,
+        "danger": 9.0
+    }
+}
+```
+
+State: `{ "value": 5.23 }`
+
+### Button
+
+Action trigger with optional confirmation dialog.
+
+```json
+{
+    "id": "reset_counters",
+    "type": "button",
+    "label": "Reset Counters",
+    "icon": "restart_alt",
+    "confirm": true,
+    "confirmMessage": "Reset all production counters to zero?",
+    "cooldown": 5000
+}
+```
+
+State: `{ "active": false, "lastTriggered": "2026-03-20T10:30:00Z" }`
+
+Command: `{ "action": "execute", "widget_id": "reset_counters" }`
+
+### LED
+
+Status indicator with color states.
+
+```json
+{
+    "id": "connection_status",
+    "type": "led",
+    "label": "PLC Connection",
+    "states": {
+        "green": "Connected",
+        "yellow": "Reconnecting",
+        "red": "Disconnected"
+    }
+}
+```
+
+State: `{ "color": "green", "label": "Connected" }`
+
+### Text
+
+Read-only text display.
+
+```json
+{
+    "id": "firmware_version",
+    "type": "text",
+    "label": "Firmware"
+}
+```
+
+State: `{ "value": "v3.5.2-stable" }`
+
+### Slider
+
+Numeric range input with step.
+
+```json
+{
+    "id": "brightness",
+    "type": "slider",
+    "label": "LED Brightness",
+    "unit": "%",
+    "min": 0,
+    "max": 100,
+    "step": 5
+}
+```
+
+State: `{ "value": 75 }`
+
+Command: `{ "action": "set", "widget_id": "brightness", "value": 50 }`
+
+### Select
+
+Dropdown selection.
+
+```json
+{
+    "id": "operating_mode",
+    "type": "select",
+    "label": "Operating Mode",
+    "options": [
+        { "value": "auto", "label": "Automatic" },
+        { "value": "manual", "label": "Manual" },
+        { "value": "maintenance", "label": "Maintenance" }
+    ]
+}
+```
+
+State: `{ "value": "auto" }`
+
+Command: `{ "action": "set", "widget_id": "operating_mode", "value": "manual" }`
+
+### Chart
+
+Time-series or categorical chart data.
+
+```json
+{
+    "id": "temp_history",
+    "type": "chart",
+    "label": "Temperature History",
+    "chartType": "line",
+    "maxPoints": 60,
+    "unit": "°C"
+}
+```
+
+State:
+```json
+{
+    "points": [
+        { "t": 1711834500, "v": 42.1 },
+        { "t": 1711834560, "v": 42.3 },
+        { "t": 1711834620, "v": 42.0 }
+    ]
+}
+```
+
+### Table (v3.0)
+
+Dynamic sortable data table.
+
+```json
+{
+    "id": "alarm_log",
+    "type": "table",
+    "label": "Active Alarms",
+    "columns": [
+        { "id": "time", "label": "Time", "type": "datetime" },
+        { "id": "severity", "label": "Severity", "type": "badge" },
+        { "id": "message", "label": "Message", "type": "text" },
+        { "id": "ack", "label": "Acknowledge", "type": "action" }
+    ],
+    "sortable": true,
+    "pagination": true,
+    "pageSize": 20
+}
+```
+
+State:
+```json
+{
+    "rows": [
+        {
+            "id": "alarm-001",
+            "time": "2026-03-20T10:30:00Z",
+            "severity": { "value": "critical", "color": "red" },
+            "message": "Zone 3 temperature exceeded 85°C",
+            "ack": { "label": "Acknowledge", "action": "ack_alarm", "params": { "id": "alarm-001" } }
+        }
+    ],
+    "total": 42
+}
+```
+
+### Terminal (v3.0)
+
+WebSocket shell relay for device management.
+
+```json
+{
+    "id": "shell",
+    "type": "terminal",
+    "label": "Device Shell",
+    "permissions": {
+        "read": "operator",
+        "control": "admin"
+    }
+}
+```
+
+Terminal widget uses a separate binary WebSocket channel for stdin/stdout/stderr.
+
+---
+
+## Commands
+
+### Server → Client Command
+
+```json
+{
+    "type": "command",
+    "id": "cmd-001",
+    "payload": {
+        "action": "set",
+        "widget_id": "motor_speed",
+        "value": 2000,
+        "operator": "admin@example.com",
+        "timestamp": 1711834567890
+    }
+}
+```
+
+### Client → Server Response
+
+```json
+{
+    "type": "command_response",
+    "id": "cmd-001",
+    "payload": {
+        "status": "ok",
+        "message": "Motor speed set to 2000 RPM",
+        "applied_value": 2000
+    }
+}
+```
+
+### Command Error
+
+```json
+{
+    "type": "command_response",
+    "id": "cmd-001",
+    "payload": {
+        "status": "error",
+        "code": "DEVICE_BUSY",
+        "message": "Motor is in calibration mode, cannot change speed"
+    }
+}
+```
+
+---
+
+## Events
+
+Devices can emit events for audit logging and alerting:
+
+```json
+{
+    "type": "event",
+    "id": "evt-001",
+    "payload": {
+        "event_type": "alarm",
+        "severity": "critical",
+        "message": "Zone 3 temperature exceeded 85°C",
+        "data": {
+            "zone": 3,
+            "temperature": 87.2,
+            "threshold": 85
+        }
+    }
+}
+```
+
+Event types:
+- `alarm` — Threshold violation or abnormal condition
+- `status_change` — Device state transition
+- `maintenance` — Scheduled or manual maintenance event
+- `security` — Security-related event (auth failure, tamper detection)
+- `custom` — Application-specific event
+
+---
+
+## Media Channel
+
+The media channel provides binary frame relay between CDAP devices and web clients for remote desktop sessions.
+
+### Negotiation
+
+1. Web client sends `media_offer` through CDAP gateway:
+
+```json
+{
+    "type": "media_offer",
+    "id": "media-001",
+    "payload": {
+        "target_device": "CDAP-AGENT01",
+        "codecs": ["h264", "vp9"],
+        "resolution": { "width": 1920, "height": 1080 },
+        "fps": 30
+    }
+}
+```
+
+2. Target device responds with `media_answer`:
+
+```json
+{
+    "type": "media_answer",
+    "id": "media-001",
+    "payload": {
+        "accepted": true,
+        "codec": "h264",
+        "resolution": { "width": 1920, "height": 1080 },
+        "fps": 30,
+        "encryption": "nacl"
+    }
+}
+```
+
+3. Binary frames flow through the gateway:
+   - Device sends video frames as binary WebSocket messages
+   - Client sends input events (mouse, keyboard) as JSON commands
+   - Gateway relays without decryption (E2E between client and device)
+
+### Frame Encryption
+
+Media frames use the same NaCl encryption as RustDesk:
+- **Key exchange**: X25519 Diffie-Hellman
+- **Encryption**: XSalsa20-Poly1305
+- **Frame format**: `[24-byte nonce][encrypted payload]`
+
+---
+
+## Device Linking
+
+CDAP devices can be linked to RustDesk peers for unified management:
+
+```json
+{
+    "type": "register",
+    "id": "msg-050",
+    "payload": {
+        "manifest": {
+            "name": "Server Room Agent",
+            "device_type": "os_agent",
+            "linked_peer_id": "1340238749",
+            "version": "1.0.0",
+            "widgets": [ ... ]
+        }
+    }
+}
+```
+
+Linked devices appear in the same device detail page. The panel shows:
+- RustDesk tab: Remote desktop, file transfer
+- CDAP tab: Widgets, commands, metrics
+- Combined connection status
+
+---
+
+## RBAC
+
+### Per-Widget Permissions
+
+Each widget can specify minimum role requirements:
+
+```json
+{
+    "permissions": {
+        "read": "viewer",
+        "control": "operator",
+        "execute": "admin"
+    }
+}
+```
+
+Permission types:
+- `read` — View widget state (default: `viewer`)
+- `control` — Change widget value (sliders, toggles, selects)
+- `execute` — Trigger actions (buttons, commands)
+
+### Dangerous Widgets
+
+Widgets marked `"dangerous": true` are hidden from non-admin users and require explicit confirmation:
+
+```json
+{
+    "id": "factory_reset",
+    "type": "button",
+    "label": "Factory Reset",
+    "dangerous": true,
+    "confirm": true,
+    "permissions": {
+        "execute": "admin"
+    }
+}
+```
+
+---
+
+## Bridge SDK
+
+### Python SDK
+
+```bash
+pip install betterdesk-cdap
+```
+
+```python
+from betterdesk_cdap import CDAPBridge, Widget, WidgetType
+
+bridge = CDAPBridge(
+    server="ws://betterdesk.example.com:21122",
+    api_key="your-api-key",
+    device_id="BRIDGE-MODBUS01"
+)
+
+bridge.register(
+    name="Modbus Gateway",
+    device_type="scada",
+    widgets=[
+        Widget("coil_0", WidgetType.TOGGLE, "Output Coil 0"),
+        Widget("register_0", WidgetType.GAUGE, "Holding Register 0",
+               unit="mA", min=0, max=20, thresholds={"warning": 16, "danger": 19}),
+    ]
+)
+
+@bridge.on_command("set", "coil_0")
+async def handle_coil(value: bool):
+    # Write to Modbus device
+    await modbus_client.write_coil(0, value)
+    return {"status": "ok"}
+
+bridge.run()  # Starts event loop
+```
+
+### Reference Bridges
+
+| Bridge | Protocol | Status |
+|--------|----------|--------|
+| `betterdesk-bridge-modbus` | Modbus TCP/RTU | v3.0 |
+| `betterdesk-bridge-snmp` | SNMP v2c/v3 | v3.0 |
+| `betterdesk-bridge-rest` | REST webhook | v3.0 |
+| `betterdesk-bridge-mqtt` | MQTT 3.1.1/5.0 | Planned |
+| `betterdesk-bridge-opcua` | OPC UA | Planned |
+
+---
+
+## Error Codes
+
+| Code | HTTP Equiv | Description |
+|------|-----------|-------------|
+| `AUTH_INVALID_KEY` | 401 | Invalid API key |
+| `AUTH_INVALID_CREDENTIALS` | 401 | Wrong username/password |
+| `AUTH_2FA_REQUIRED` | 401 | TOTP code needed |
+| `AUTH_2FA_INVALID` | 401 | Wrong TOTP code |
+| `AUTH_TOKEN_EXPIRED` | 401 | Device token expired |
+| `AUTH_TOKEN_REVOKED` | 401 | Device token revoked |
+| `AUTH_RATE_LIMITED` | 429 | Too many auth attempts |
+| `DEVICE_ALREADY_REGISTERED` | 409 | Device ID already connected |
+| `DEVICE_BANNED` | 403 | Device is banned |
+| `DEVICE_REVOKED` | 403 | Device has been revoked |
+| `DEVICE_SOFT_DELETED` | 403 | Device has been soft-deleted |
+| `PERMISSION_DENIED` | 403 | Insufficient role for action |
+| `INVALID_MANIFEST` | 400 | Manifest validation failed |
+| `INVALID_COMMAND` | 400 | Unknown command or missing params |
+| `DEVICE_NOT_FOUND` | 404 | Target device not connected |
+| `DEVICE_BUSY` | 503 | Device cannot process command |
+| `MEDIA_REJECTED` | 403 | Media channel rejected by device |
+| `MEDIA_CODEC_UNSUPPORTED` | 406 | No common codec found |
+| `INTERNAL_ERROR` | 500 | Server internal error |
+| `GATEWAY_DISABLED` | 503 | CDAP gateway not enabled |
+
+---
+
+*Last updated: March 2026 — BetterDesk v3.0.0*
diff --git a/docs/PORT_SECURITY.md b/docs/architecture/PORT_SECURITY.md
similarity index 100%
rename from docs/PORT_SECURITY.md
rename to docs/architecture/PORT_SECURITY.md
diff --git a/docs/PROJECT_STRUCTURE.md b/docs/architecture/PROJECT_STRUCTURE.md
similarity index 95%
rename from docs/PROJECT_STRUCTURE.md
rename to docs/architecture/PROJECT_STRUCTURE.md
index 32be6ef3..b3f20c8d 100644
--- a/docs/PROJECT_STRUCTURE.md
+++ b/docs/architecture/PROJECT_STRUCTURE.md
@@ -172,22 +172,22 @@ Start with these files in order:
 1. **[README.md](README.md)** - Project overview and features
 2. **[install.sh](install.sh)** - Install web console
 3. **[hbbs-patch/QUICKSTART.md](hbbs-patch/QUICKSTART.md)** - Install HBBS patch
-4. **[docs/CHANGELOG.md](docs/CHANGELOG.md)** - Version history
+4. **[docs/CHANGELOG.md](../development/CHANGELOG.md)** - Version history
 
 ## 🔄 For Existing Users
 
 When updating:
 
-1. **[docs/UPDATE_GUIDE.md](docs/UPDATE_GUIDE.md)** - General update process
+1. **[docs/UPDATE_GUIDE.md](../setup/UPDATE_GUIDE.md)** - General update process
 2. **[update.sh](update.sh)** - Run automated update
-3. **[docs/CHANGELOG.md](docs/CHANGELOG.md)** - See what changed
+3. **[docs/CHANGELOG.md](../development/CHANGELOG.md)** - See what changed
 
 ## 🤝 For Contributors
 
 Before contributing:
 
-1. **[docs/CONTRIBUTING.md](docs/CONTRIBUTING.md)** - Contribution guidelines
-2. **[docs/DEVELOPMENT_ROADMAP.md](docs/DEVELOPMENT_ROADMAP.md)** - Planned features
+1. **[docs/CONTRIBUTING.md](../development/CONTRIBUTING.md)** - Contribution guidelines
+2. **[docs/DEVELOPMENT_ROADMAP.md](../enterprise/ENTERPRISE_ROADMAP.md)** - Planned features
 3. **[dev_modules/](dev_modules/)** - Development tools
 
 ## 📋 File Naming Conventions
diff --git a/docs/CHANGELOG.md b/docs/development/CHANGELOG.md
similarity index 94%
rename from docs/CHANGELOG.md
rename to docs/development/CHANGELOG.md
index fe9103c4..2bfa0b4e 100644
--- a/docs/CHANGELOG.md
+++ b/docs/development/CHANGELOG.md
@@ -5,6 +5,38 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.4.3] - 2026-03-21
+
+### 🖥️ Web Remote Client — Mouse, Quality & FPS Fix (Phase 32)
+
+Critical fixes for the embedded web remote client (`/remote/:deviceId`) — mouse clicks, image quality, and frame rate.
+
+#### Mouse Click Fix (Critical)
+- **Root cause**: RustDesk parses mouse mask as `button = mask >> 3; type = mask & 7`. Web client sent flat values (e.g., mask=1 for left click), so server computed `button = 0` (no button). Hover worked because mask=0 is correct for both formats.
+- **input.js**: Replaced flat mask values with correct `TYPE | (BUTTON << 3)` encoding. Left click now sends mask=9 (`1 | (1<<3)`), right click mask=17 (`1 | (2<<3)`), etc. Added static constants for mouse types and buttons.
+
+#### Image Quality Fix
+- **Root cause**: `buildLoginRequest` in protocol.js hardcoded `imageQuality: Balanced`, ignoring any quality setting.
+- **protocol.js**: Login request now uses configurable quality (default `Best` instead of `Balanced`).
+- **remote.js**: Constructor passes `imageQuality: 'Best'` to RDClient.
+
+#### FPS Fix
+- **Root cause**: Login request used `customFps: opts.fps || 30` despite remote.js wanting 60fps. Session start only sent FPS option, not quality.
+- **protocol.js**: Default FPS changed from 30 to 60.
+- **client.js**: `_startSession()` now sends both `customFps` and `imageQuality` options. `authenticate()` passes `fps: 60` and `imageQuality: 'Best'` to login builder.
+
+#### UI Polish
+- **remote.ejs**: Replaced large orange "Work in Progress" banner with slim blue "Beta" banner with dismiss button.
+
+#### Files Changed
+- `public/js/rdclient/input.js` — Mouse mask encoding + static constants
+- `public/js/rdclient/protocol.js` — Configurable quality + FPS defaults
+- `public/js/rdclient/client.js` — Session start sends quality + FPS
+- `public/js/remote.js` — imageQuality: 'Best' in constructor
+- `views/remote.ejs` — Dismissible beta banner
+
+---
+
 ## [2.4.2] - 2026-03-20
 
 ### 🔒 Security & Installer Fixes (Phase 31)
diff --git a/docs/CONTRIBUTING.md b/docs/development/CONTRIBUTING.md
similarity index 100%
rename from docs/CONTRIBUTING.md
rename to docs/development/CONTRIBUTING.md
diff --git a/docs/CONTRIBUTING_TRANSLATIONS.md b/docs/development/CONTRIBUTING_TRANSLATIONS.md
similarity index 100%
rename from docs/CONTRIBUTING_TRANSLATIONS.md
rename to docs/development/CONTRIBUTING_TRANSLATIONS.md
diff --git a/docs/TRANSLATION_SUMMARY.md b/docs/development/TRANSLATION_SUMMARY.md
similarity index 89%
rename from docs/TRANSLATION_SUMMARY.md
rename to docs/development/TRANSLATION_SUMMARY.md
index 2debcb5c..5433362e 100644
--- a/docs/TRANSLATION_SUMMARY.md
+++ b/docs/development/TRANSLATION_SUMMARY.md
@@ -89,12 +89,12 @@ docs/
 ## 📝 Usage
 
 For **English-speaking users**, reference the `*_EN.md` files:
-- [Client Generator Quick Start](docs/CLIENT_GENERATOR_QUICKSTART_EN.md)
-- [Troubleshooting Guide](docs/TROUBLESHOOTING_EN.md)
-- [Quick Fix Guide](docs/QUICK_FIX_EN.md)
-- [GPU Optimization Details](docs/GPU_OPTIMIZATION_EN.md)
-- [GPU Quick Start](docs/GPU_FIX_QUICKSTART_EN.md)
-- [Optimization Summary](docs/OPTIMIZATION_SUMMARY_EN.md)
+- [Client Generator Quick Start](../features/CLIENT_GENERATOR_QUICKSTART_EN.md)
+- [Troubleshooting Guide](../troubleshooting/TROUBLESHOOTING_EN.md)
+- [Quick Fix Guide](../troubleshooting/QUICK_FIX_EN.md)
+- [GPU Optimization Details](../performance/GPU_OPTIMIZATION_EN.md)
+- [GPU Quick Start](../performance/GPU_FIX_QUICKSTART_EN.md)
+- [Optimization Summary](../performance/OPTIMIZATION_SUMMARY_EN.md)
 
 For **Polish-speaking users**, original Polish versions remain available.
 
diff --git a/docs/DOCKER_MIGRATION.md b/docs/docker/DOCKER_MIGRATION.md
similarity index 100%
rename from docs/DOCKER_MIGRATION.md
rename to docs/docker/DOCKER_MIGRATION.md
diff --git a/DOCKER_QUICKSTART.md b/docs/docker/DOCKER_QUICKSTART.md
similarity index 96%
rename from DOCKER_QUICKSTART.md
rename to docs/docker/DOCKER_QUICKSTART.md
index 5afdb002..819bfcbb 100644
--- a/DOCKER_QUICKSTART.md
+++ b/docs/docker/DOCKER_QUICKSTART.md
@@ -70,7 +70,7 @@ volumes:
 
 ### SSL/TLS
 
-See [HTTPS_SETUP.md](docs/HTTPS_SETUP.md) for full instructions.
+See [HTTPS_SETUP.md](../setup/HTTPS_SETUP.md) for full instructions.
 
 Quick self-signed cert:
 ```bash
@@ -161,7 +161,7 @@ docker compose up -d
 
 ### Need more help?
 
-See [DOCKER_TROUBLESHOOTING.md](docs/DOCKER_TROUBLESHOOTING.md) for advanced issues.
+See [DOCKER_TROUBLESHOOTING.md](../docker/DOCKER_TROUBLESHOOTING.md) for advanced issues.
 
 ---
 
diff --git a/docs/DOCKER_SUPPORT.md b/docs/docker/DOCKER_SUPPORT.md
similarity index 100%
rename from docs/DOCKER_SUPPORT.md
rename to docs/docker/DOCKER_SUPPORT.md
diff --git a/docs/DOCKER_TROUBLESHOOTING.md b/docs/docker/DOCKER_TROUBLESHOOTING.md
similarity index 100%
rename from docs/DOCKER_TROUBLESHOOTING.md
rename to docs/docker/DOCKER_TROUBLESHOOTING.md
diff --git a/docs/ENTERPRISE_ROADMAP.md b/docs/enterprise/ENTERPRISE_ROADMAP.md
similarity index 100%
rename from docs/ENTERPRISE_ROADMAP.md
rename to docs/enterprise/ENTERPRISE_ROADMAP.md
diff --git a/docs/enterprise/IMPLEMENTATION_PLAN.md b/docs/enterprise/IMPLEMENTATION_PLAN.md
new file mode 100644
index 00000000..8fdf1101
--- /dev/null
+++ b/docs/enterprise/IMPLEMENTATION_PLAN.md
@@ -0,0 +1,323 @@
+# BetterDesk Console — Implementation Plan v3.0
+
+> **Purpose**: Living document for tracking development priorities, planned features, and community contributions.  
+> **Last updated**: 2026-03-22  
+> **Status**: Active development — contributions welcome!
+
+---
+
+## How to Contribute
+
+Add your ideas to the **[Ideas & Feature Requests](#ideas--feature-requests)** section at the bottom.
+Format: `- [ ] **Feature name** — Brief description (module: X, priority: High/Medium/Low)`
+
+---
+
+## Current State Overview
+
+### Platform Architecture
+
+| Component | Technology | Status |
+|-----------|-----------|--------|
+| **Go Server** | Go, protobuf, Ed25519, SQLite/PostgreSQL | Production |
+| **Web Console** | Node.js, Express, EJS, vanilla JS | Production |
+| **CDAP Gateway** | WebSocket, Go server integrated | Production |
+| **BetterDesk Agent** | Go binary, gopsutil, cross-platform | Production |
+| **Bridge SDKs** | Python + Node.js CDAP SDKs | Released v1.0.0 |
+| **ALL-IN-ONE Scripts** | bash + PowerShell installers | v2.4.0 |
+| **Docker** | Single-container + multi-container | Production |
+
+### Module Inventory (10 enterprise modules)
+
+All modules have **real backend logic** — DB tables, REST endpoints, frontend JS.
+
+| Module | Route | View | JS | Backend Features |
+|--------|-------|------|----|------------------|
+| **Dashboard** | 190 | 203 | 163 | Go API proxy, server probing, bandwidth stats |
+| **Devices** | 400+ | 220+ | 400+ | CRUD, folders, tags, kebab menu, responsive |
+| **Inventory** | 283 | 100 | 295 | HW+SW inventory upload, telemetry, enrichment |
+| **Tickets** | 528 | 158 | 406 | CRUD + comments + attachments + SLA timer |
+| **Network** | 339 | 184 | 305 | ICMP ping, TCP, HTTP, polling loop, history |
+| **Activity** | 243 | 69 | 191 | Session upload, summaries, top apps |
+| **Automation** | 483 | 292 | 368 | Alert rules, commands, agent poll, SMTP |
+| **DataGuard** | 275 | 163 | 267 | DLP policies, event ingestion, agent sync |
+| **Reports** | 193 | 115 | 290 | 7 report types, CSV export, saved reports |
+| **Registration** | 328 | 88 | 303 | LAN discovery, approve/reject, token gen |
+| **Tenants** | 285 | 108 | 282 | CRUD, device/user assignment, stats |
+
+**Total enterprise code**: ~8,900 LOC across routes, views, JS, and services.
+
+---
+
+## Priority 1 — Critical Fixes & Polish
+
+> Items that affect daily usability. Should be resolved first.
+
+### 1.1 Alert Engine `periodicCheck()` (Automation)
+
+**Status**: Stub — empty function body  
+**Impact**: Alert rules exist in DB but never fire automatically  
+**Fix**: Implement periodic evaluation loop in `alertRulesEngine.js`:
+- Timer-based check (configurable interval, default 60s)
+- Query active rules → evaluate conditions against latest device data
+- Trigger actions (email, webhook) when thresholds exceeded
+- Respect cooldown periods per rule
+
+**Files**: `services/alertRulesEngine.js`
+
+### 1.2 Tenant Isolation Enforcement
+
+**Status**: Tenants module is standalone CRUD — no cross-module filtering  
+**Impact**: Tickets, activity, inventory etc. don't respect tenant boundaries  
+**Fix**: Add `tenant_id` filtering middleware for multi-tenant deployments:
+- Middleware reads operator's assigned tenant(s)
+- All list queries add `WHERE tenant_id IN (...)` clause
+- Device-level operations check tenant membership
+- Admin bypasses all filters
+
+**Files**: `middleware/tenantFilter.js` (new), all route files
+
+### 1.3 Device Registration — Active Network Scanning
+
+**Status**: Current registration is passive (device must initiate)  
+**Impact**: Admin cannot discover unregistered devices on the network  
+**Planned features**:
+- [ ] Subnet scanner (ICMP sweep + ARP table)
+- [ ] Port scanner for RustDesk ports (21116, 21117)
+- [ ] Auto-detection of devices running BetterDesk agent
+- [ ] Scheduled scans with configurable subnets
+- [ ] Discovery results → pending registration queue
+- [ ] Agent-based network neighbor discovery
+
+**Files**: `services/lanDiscovery.js` (extend), `routes/registration.routes.js`
+
+### 1.4 File Transfer Route Exposure
+
+**Status**: `fileTransferService.js` exists (287 LOC) but no HTTP routes  
+**Impact**: Feature is backend-only, not accessible from panel  
+**Fix**: Create `routes/fileTransfer.routes.js` endpoints + UI integration
+
+---
+
+## Priority 2 — Feature Completion
+
+> Modules that work but need additional features for production use.
+
+### 2.1 Activity Module Enhancement
+
+**Current**: Basic table rendering (view is only 69 LOC)  
+**Planned**:
+- [ ] Daily/weekly/monthly activity charts (Chart.js)
+- [ ] Application usage breakdown (pie/bar charts)
+- [ ] Idle time vs. active time comparison
+- [ ] Per-user productivity dashboard
+- [ ] Activity export to CSV/PDF
+- [ ] Session timeline visualization
+
+### 2.2 Network Monitoring Improvements
+
+**Current**: ICMP, TCP, HTTP checks with history  
+**Planned**:
+- [ ] SNMP v2c/v3 device queries (basic OID polling)
+- [ ] Network topology map visualization (D3.js)
+- [ ] Bandwidth monitoring per device
+- [ ] Alert integration (down → automation alert rule)
+- [ ] DNS monitoring
+- [ ] SSL certificate expiry checks
+
+### 2.3 Report Engine Extensions
+
+**Current**: 7 report types with CSV export  
+**Planned**:
+- [ ] PDF generation (pdfmake or puppeteer)
+- [ ] Scheduled report generation (node-cron)
+- [ ] Email delivery of reports
+- [ ] Custom report builder (drag & drop fields)
+- [ ] Compliance report templates (GDPR, SOC2)
+- [ ] Dashboard export as report
+
+### 2.4 Ticket System Enhancements
+
+**Current**: Full CRUD with SLA, comments, attachments  
+**Planned**:
+- [ ] Email-to-ticket integration (IMAP polling)
+- [ ] Ticket templates (pre-filled forms)
+- [ ] Auto-assignment rules (round-robin, skill-based)
+- [ ] Knowledge base / FAQ module
+- [ ] SLA breach notifications
+- [ ] Customer portal (external-facing ticket submission)
+
+### 2.5 Remote Desktop Improvements
+
+**Current**: Web remote client (Beta), web-based RDP via RustDesk protocol  
+**Planned**:
+- [ ] Multi-monitor selection in web client
+- [ ] File transfer during remote session
+- [ ] Chat during remote session
+- [ ] Session recording (WebM export)
+- [ ] Connection quality indicator (latency, FPS)
+- [ ] Keyboard shortcut passthrough (Ctrl+Alt+Del, etc.)
+
+---
+
+## Priority 3 — New Capabilities
+
+> Larger features requiring new infrastructure.
+
+### 3.1 Software Deployment
+
+**Description**: Push software installations from panel to devices  
+**Components**:
+- Package repository (local file store)
+- Deployment tasks with targets (device/group/tag)
+- Agent-side: download + silent install + report result
+- Rollback capability
+- Deployment history and success rate
+
+**Files** (new):
+```
+routes/deployment.routes.js
+views/deployment.ejs
+public/js/deployment.js
+public/css/deployment.css
+services/deploymentService.js
+```
+
+### 3.2 Patch Management
+
+**Description**: Track and deploy OS/software patches  
+**Components**:
+- Agent reports installed patches and pending updates
+- Admin approves/schedules patch deployment
+- Patch compliance dashboard
+- Exclusion rules (skip certain patches)
+
+### 3.3 Asset Lifecycle Management
+
+**Description**: Track devices from procurement to disposal  
+**Components**:
+- Asset status workflow (Ordered → Received → Deployed → Retired)
+- Purchase tracking (cost, vendor, warranty dates)
+- Warranty expiry alerts
+- Location tracking (building/floor/room)
+- QR code / barcode label generation
+- Assignment history (who had this device when)
+
+### 3.4 User Self-Service Portal
+
+**Description**: End-users can submit tickets and view their devices  
+**Components**:
+- Separate login page (no admin access)
+- Submit tickets with screenshots
+- View ticket status and history
+- View assigned devices
+- Password reset request
+- Knowledge base search
+
+### 3.5 Compliance & Audit Dashboard
+
+**Description**: Centralized compliance monitoring  
+**Components**:
+- Device compliance score (encryption, OS updates, antivirus)
+- Policy violation alerts
+- Audit log search and export
+- Compliance report scheduling
+- GDPR data subject access request workflow
+
+---
+
+## Priority 4 — Architecture & Scaling
+
+> Infrastructure improvements for larger deployments.
+
+### 4.1 Real-Time WebSocket Push
+
+**Status**: Currently using polling for status updates  
+**Goal**: Push device status, alerts, ticket updates via WebSocket  
+**Components**:
+- Server-Sent Events or WebSocket endpoint
+- Event bus integration (Go server `events/` package)
+- Client-side reconnection handling
+- Per-module event channels
+
+### 4.2 Plugin / Extension System
+
+**Description**: Allow custom modules without modifying core  
+**Components**:
+- Plugin manifest format (JSON)
+- Route registration API
+- View slot system (inject UI into sidebar, device detail, etc.)
+- Event hook system (on device register, on ticket create, etc.)
+- Plugin marketplace (future)
+
+### 4.3 Multi-Instance / HA
+
+**Description**: Support multiple console instances behind load balancer  
+**Components**:
+- Session store in PostgreSQL/Redis (not file)
+- Shared file storage (S3-compatible)
+- PostgreSQL LISTEN/NOTIFY for cross-instance events (already in Go server)
+- Health check endpoint for load balancer
+- Sticky sessions or stateless auth
+
+### 4.4 Mobile App / PWA
+
+**Description**: Mobile-friendly management interface  
+**Components**:
+- Progressive Web App (service worker + manifest)
+- Push notifications (Web Push API)
+- Responsive dashboard optimized for mobile
+- Quick actions (approve registration, ack alert)
+
+---
+
+## Technical Debt & Cleanup
+
+> Items that don't add features but improve code quality.
+
+| Item | Description | Priority |
+|------|-------------|----------|
+| Unit tests for HTTP API | No test coverage on Node.js routes | High |
+| Integration tests for PostgreSQL | Requires live PostgreSQL instance | Medium |
+| CSS variable consolidation | Some modules still use hardcoded colors | Low |
+| View template DRY | Several views duplicate stat-card/modal HTML | Low |
+| Activity view expansion | Only 69 LOC — needs charts and detail views | Medium |
+| Error handling audit | Some routes lack proper try/catch | Medium |
+| API documentation | OpenAPI/Swagger spec for REST endpoints | Low |
+| Accessibility audit | WCAG 2.1 compliance check for web panel | Low |
+
+---
+
+## Deployment Checklist (per release)
+
+1. [ ] All changes committed to git
+2. [ ] `npm audit --omit=dev` reports 0 vulnerabilities
+3. [ ] Go server compiles without warnings
+4. [ ] ALL-IN-ONE scripts updated (if new env vars or features)
+5. [ ] i18n keys added to EN + PL + ZH
+6. [ ] Cache version bumps on deploy (server restart)
+7. [ ] Docker images rebuild if Dockerfile changed
+8. [ ] CHANGELOG.md updated
+
+---
+
+## Ideas & Feature Requests
+
+> Add your ideas below. Format:  
+> `- [ ] **Feature name** — Description (module: X, priority: High/Medium/Low)`
+
+<!-- Add your ideas here -->
+
+
+
+---
+
+## Version History
+
+| Date | Change |
+|------|--------|
+| 2026-03-22 | Initial plan created from ENTERPRISE_ROADMAP.md audit |
+
+---
+
+*See also: [ENTERPRISE_ROADMAP.md](ENTERPRISE_ROADMAP.md) for the original feature specification and technology stack decisions.*
diff --git a/docs/CLIENT_GENERATOR.md b/docs/features/CLIENT_GENERATOR.md
similarity index 100%
rename from docs/CLIENT_GENERATOR.md
rename to docs/features/CLIENT_GENERATOR.md
diff --git a/docs/CLIENT_GENERATOR_QUICKSTART_EN.md b/docs/features/CLIENT_GENERATOR_QUICKSTART_EN.md
similarity index 100%
rename from docs/CLIENT_GENERATOR_QUICKSTART_EN.md
rename to docs/features/CLIENT_GENERATOR_QUICKSTART_EN.md
diff --git a/docs/CUSTOM_DEVICE_API.md b/docs/features/CUSTOM_DEVICE_API.md
similarity index 100%
rename from docs/CUSTOM_DEVICE_API.md
rename to docs/features/CUSTOM_DEVICE_API.md
diff --git a/docs/STATUS_TRACKING_v3.md b/docs/features/STATUS_TRACKING_v3.md
similarity index 100%
rename from docs/STATUS_TRACKING_v3.md
rename to docs/features/STATUS_TRACKING_v3.md
diff --git a/docs/WEB_REMOTE_CLIENT_PLAN.md b/docs/features/WEB_REMOTE_CLIENT_PLAN.md
similarity index 100%
rename from docs/WEB_REMOTE_CLIENT_PLAN.md
rename to docs/features/WEB_REMOTE_CLIENT_PLAN.md
diff --git a/docs/GPU_FIX_QUICKSTART_EN.md b/docs/performance/GPU_FIX_QUICKSTART_EN.md
similarity index 100%
rename from docs/GPU_FIX_QUICKSTART_EN.md
rename to docs/performance/GPU_FIX_QUICKSTART_EN.md
diff --git a/docs/GPU_OPTIMIZATION_EN.md b/docs/performance/GPU_OPTIMIZATION_EN.md
similarity index 100%
rename from docs/GPU_OPTIMIZATION_EN.md
rename to docs/performance/GPU_OPTIMIZATION_EN.md
diff --git a/docs/OPTIMIZATION_SUMMARY_EN.md b/docs/performance/OPTIMIZATION_SUMMARY_EN.md
similarity index 97%
rename from docs/OPTIMIZATION_SUMMARY_EN.md
rename to docs/performance/OPTIMIZATION_SUMMARY_EN.md
index 01057960..b8837dc8 100644
--- a/docs/OPTIMIZATION_SUMMARY_EN.md
+++ b/docs/performance/OPTIMIZATION_SUMMARY_EN.md
@@ -196,8 +196,8 @@ checkFPS();
 
 ## 📚 Documentation
 
-- 📖 Full documentation: [GPU_OPTIMIZATION.md](docs/GPU_OPTIMIZATION.md)
-- ⚡ Quick start: [GPU_FIX_QUICKSTART.md](docs/GPU_FIX_QUICKSTART.md)
+- 📖 Full documentation: [GPU_OPTIMIZATION_EN.md](GPU_OPTIMIZATION_EN.md)
+- ⚡ Quick start: [GPU_FIX_QUICKSTART_EN.md](GPU_FIX_QUICKSTART_EN.md)
 - ⚙️ Performance profiles: `web/static/performance-config.css`
 
 ## ✅ Implementation Checklist
diff --git a/docs/BUILD_GUIDE.md b/docs/setup/BUILD_GUIDE.md
similarity index 98%
rename from docs/BUILD_GUIDE.md
rename to docs/setup/BUILD_GUIDE.md
index 0e3eebbb..3028594d 100644
--- a/docs/BUILD_GUIDE.md
+++ b/docs/setup/BUILD_GUIDE.md
@@ -283,7 +283,7 @@ curl http://localhost:21114/api/peers
 3. Submit PR with updated source files
 4. CI will automatically build and test
 
-See [CONTRIBUTING.md](docs/CONTRIBUTING.md) for full guidelines.
+See [CONTRIBUTING.md](../development/CONTRIBUTING.md) for full guidelines.
 
 ---
 
diff --git a/docs/HTTPS_SETUP.md b/docs/setup/HTTPS_SETUP.md
similarity index 100%
rename from docs/HTTPS_SETUP.md
rename to docs/setup/HTTPS_SETUP.md
diff --git a/docs/INSTALLATION_V1.4.0.md b/docs/setup/INSTALLATION_V1.4.0.md
similarity index 100%
rename from docs/INSTALLATION_V1.4.0.md
rename to docs/setup/INSTALLATION_V1.4.0.md
diff --git a/docs/SYNOLOGY_INSTALLATION.md b/docs/setup/SYNOLOGY_INSTALLATION.md
similarity index 100%
rename from docs/SYNOLOGY_INSTALLATION.md
rename to docs/setup/SYNOLOGY_INSTALLATION.md
diff --git a/docs/UPDATE_GUIDE.md b/docs/setup/UPDATE_GUIDE.md
similarity index 100%
rename from docs/UPDATE_GUIDE.md
rename to docs/setup/UPDATE_GUIDE.md
diff --git a/docs/KEY_TROUBLESHOOTING.md b/docs/troubleshooting/KEY_TROUBLESHOOTING.md
similarity index 100%
rename from docs/KEY_TROUBLESHOOTING.md
rename to docs/troubleshooting/KEY_TROUBLESHOOTING.md
diff --git a/docs/QUICK_FIX_EN.md b/docs/troubleshooting/QUICK_FIX_EN.md
similarity index 100%
rename from docs/QUICK_FIX_EN.md
rename to docs/troubleshooting/QUICK_FIX_EN.md
diff --git a/docs/TROUBLESHOOTING_EN.md b/docs/troubleshooting/TROUBLESHOOTING_EN.md
similarity index 100%
rename from docs/TROUBLESHOOTING_EN.md
rename to docs/troubleshooting/TROUBLESHOOTING_EN.md
diff --git a/main.go b/main.go
new file mode 100644
index 00000000..ab8006a8
--- /dev/null
+++ b/main.go
@@ -0,0 +1,520 @@
+// BetterDesk Server — Clean-room RustDesk-compatible signal + relay server
+// Single binary replacing both hbbs and hbbr
+package main
+
+import (
+	"context"
+	cryptoRand "crypto/rand"
+	"encoding/hex"
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	osSignal "os/signal"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/unitronix/betterdesk-server/admin"
+	"github.com/unitronix/betterdesk-server/api"
+	"github.com/unitronix/betterdesk-server/audit"
+	"github.com/unitronix/betterdesk-server/auth"
+	"github.com/unitronix/betterdesk-server/cdap"
+	"github.com/unitronix/betterdesk-server/config"
+	"github.com/unitronix/betterdesk-server/crypto"
+	"github.com/unitronix/betterdesk-server/db"
+	"github.com/unitronix/betterdesk-server/logging"
+	"github.com/unitronix/betterdesk-server/metrics"
+	"github.com/unitronix/betterdesk-server/ratelimit"
+	"github.com/unitronix/betterdesk-server/relay"
+	"github.com/unitronix/betterdesk-server/reload"
+	"github.com/unitronix/betterdesk-server/security"
+	sigServer "github.com/unitronix/betterdesk-server/signal"
+)
+
+var (
+	Version   = "dev"
+	BuildDate = "unknown"
+)
+
+func main() {
+	cfg := parseFlags()
+
+	// Configure log format (must be before any log output)
+	logCleanup := logging.Setup(cfg.LogFormat)
+	defer logCleanup()
+
+	log.Printf("========================================")
+	log.Printf("  BetterDesk Server %s", Version)
+	log.Printf("  Build: %s", BuildDate)
+	log.Printf("========================================")
+	log.Printf("  Mode:       %s", cfg.Mode)
+	log.Printf("  Signal:     :%d (UDP+TCP)", cfg.SignalPort)
+	log.Printf("  NAT Test:   :%d (TCP)", cfg.SignalPort-1)
+	log.Printf("  WS Signal:  :%d (WebSocket)", cfg.SignalPort+2)
+	log.Printf("  Relay:      :%d (TCP)", cfg.RelayPort)
+	log.Printf("  WS Relay:   :%d (WebSocket)", cfg.RelayPort+2)
+	if cfg.APITLSEnabled() {
+		log.Printf("  API:        :%d (HTTPS)", cfg.APIPort)
+	} else {
+		log.Printf("  API:        :%d (HTTP)", cfg.APIPort)
+	}
+	log.Printf("  Database:   %s", cfg.DBPath)
+	if cfg.SignalTLSEnabled() {
+		log.Printf("  TLS Signal: ENABLED (dual-mode: plain+TLS)")
+	}
+	if cfg.RelayTLSEnabled() {
+		log.Printf("  TLS Relay:  ENABLED (dual-mode: plain+TLS)")
+	}
+	if cfg.APITLSEnabled() {
+		log.Printf("  TLS API:    ENABLED")
+	}
+	if cfg.HasTLSCert() {
+		log.Printf("  TLS Cert:   %s", cfg.TLSCertFile)
+	}
+	log.Printf("========================================")
+
+	// Load or generate Ed25519 keypair
+	kp, err := crypto.LoadOrGenerateKeyPair(cfg.KeyFile)
+	if err != nil {
+		log.Fatalf("Failed to initialize keypair: %v", err)
+	}
+	log.Printf("Server public key: %s", kp.PublicKeyBase64())
+
+	// Initialize database
+	database, err := db.Open(cfg.DBPath)
+	if err != nil {
+		log.Fatalf("Failed to open database: %v", err)
+	}
+	defer database.Close()
+
+	if err := database.Migrate(); err != nil {
+		log.Fatalf("Failed to run migrations: %v", err)
+	}
+
+	// Load API key from .api_key file or API_KEY env var and sync to database.
+	// This ensures the Node.js console and Go server share the same API key
+	// even when the server is started without the ALL-IN-ONE install script.
+	loadAPIKey(cfg, database)
+
+	// Reset all peers to offline on startup (clean slate)
+	if err := database.SetAllOffline(); err != nil {
+		log.Printf("WARN: Failed to reset peers to offline: %v", err)
+	}
+
+	log.Printf("Database initialized successfully")
+
+	// Initialize security modules
+	blocklist := security.NewBlocklist()
+	if cfg.BlocklistFile != "" {
+		if err := blocklist.LoadFromFile(cfg.BlocklistFile); err != nil {
+			log.Printf("WARN: Failed to load blocklist from %s: %v", cfg.BlocklistFile, err)
+		}
+	}
+
+	ipLimiter := ratelimit.NewIPLimiter(
+		config.IPRateLimitRegistrations,
+		config.IPRateLimitWindow,
+		config.IPRateLimitCleanup,
+	)
+	defer ipLimiter.Stop()
+
+	bwLimiter := ratelimit.NewBandwidthLimiter(
+		config.DefaultTotalBandwidth,
+		config.DefaultSingleBandwidth,
+	)
+
+	log.Printf("Security modules initialized (blocklist=%d entries, rate-limit=%d/min)",
+		blocklist.Count(), config.IPRateLimitRegistrations)
+
+	// Initialize JWT manager for API authentication
+	jwtSecret := cfg.JWTSecret
+	if jwtSecret == "" {
+		// Use a persistent secret from the database so tokens survive restarts
+		stored, _ := database.GetConfig("jwt_secret")
+		if stored != "" {
+			jwtSecret = stored
+		} else {
+			generated, err := auth.GenerateRandomString(32)
+			if err != nil {
+				log.Fatalf("Failed to generate JWT secret: %v", err)
+			}
+			jwtSecret = generated
+			_ = database.SetConfig("jwt_secret", jwtSecret)
+			log.Printf("Generated and stored new JWT secret")
+		}
+	}
+	jwtExpiry := cfg.JWTExpiry
+	if jwtExpiry <= 0 {
+		jwtExpiry = 24
+	}
+	jwtManager := auth.NewJWTManager(jwtSecret, time.Duration(jwtExpiry)*time.Hour)
+
+	// Create initial admin user if no users exist
+	userCount, _ := database.UserCount()
+	if userCount == 0 {
+		adminUser := cfg.InitAdminUser
+		if adminUser == "" {
+			adminUser = "admin"
+		}
+		adminPass := cfg.InitAdminPass
+		if adminPass == "" {
+			adminPass, _ = auth.GenerateRandomString(16)
+		}
+		hash, err := auth.HashPassword(adminPass)
+		if err != nil {
+			log.Fatalf("Failed to hash initial admin password: %v", err)
+		}
+		err = database.CreateUser(&db.User{
+			Username:     adminUser,
+			PasswordHash: hash,
+			Role:         auth.RoleAdmin,
+		})
+		if err != nil {
+			log.Fatalf("Failed to create initial admin user: %v", err)
+		}
+		log.Printf("========================================")
+		log.Printf("  INITIAL ADMIN CREDENTIALS")
+		log.Printf("  Username: %s", adminUser)
+		if cfg.InitAdminPass == "" {
+			// Security: Write password to secure file instead of logging to console
+			// Use database directory for the credentials file
+			dbDir := filepath.Dir(cfg.DBPath)
+			if dbDir == "" || dbDir == "." {
+				dbDir = "."
+			}
+			credsFile := filepath.Join(dbDir, ".admin_credentials")
+			credsContent := fmt.Sprintf("Admin Username: %s\nAdmin Password: %s\n\nChange this password immediately and delete this file!\n", adminUser, adminPass)
+			if err := os.WriteFile(credsFile, []byte(credsContent), 0600); err != nil {
+				log.Fatalf("Failed to write credentials file: %v", err)
+			}
+			log.Printf("  Password: written to %s (mode 0600)", credsFile)
+		} else {
+			log.Printf("  Password: *** (user-provided, not logged)")
+		}
+		log.Printf("  (change this password immediately!)")
+		log.Printf("========================================")
+	}
+
+	// Initialize per-IP relay connection limiter
+	var connLimiter *ratelimit.ConnLimiter
+	if cfg.RelayMaxConnsIP > 0 {
+		connLimiter = ratelimit.NewConnLimiter(int32(cfg.RelayMaxConnsIP))
+		log.Printf("Relay per-IP connection limit: %d", cfg.RelayMaxConnsIP)
+	}
+
+	// Initialize audit logger
+	auditLogger := audit.NewLogger(cfg.AuditLogFile)
+	defer auditLogger.Close()
+	auditLogger.Log(audit.ActionServerStart, "system", "", map[string]string{
+		"version": Version, "mode": cfg.Mode,
+	})
+	if cfg.AuditLogFile != "" {
+		log.Printf("Audit logging to %s", cfg.AuditLogFile)
+	}
+
+	// Initialize metrics collector
+	mc := metrics.NewCollector()
+	log.Printf("Prometheus metrics available at /metrics")
+
+	// Initialize config reload handler (SIGHUP on Unix, admin command on Windows)
+	reloadHandler := reload.NewHandler()
+	if cfg.BlocklistFile != "" {
+		reloadHandler.OnReload(func() error {
+			log.Printf("[reload] Reloading blocklist from %s", cfg.BlocklistFile)
+			return blocklist.LoadFromFile(cfg.BlocklistFile)
+		})
+	}
+	reloadHandler.OnReload(func() error {
+		log.Printf("[reload] Reloading configuration from environment")
+		cfg.LoadEnv()
+		return nil
+	})
+
+	// Initialize admin TCP interface
+	adminSrv := admin.New(cfg, database, nil, Version) // peer map set per mode
+	adminSrv.SetBlocklist(blocklist)
+	adminSrv.SetReloadFunc(reloadHandler.Execute)
+
+	// Context for graceful shutdown
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	// Start SIGHUP listener in background
+	reloadDone := make(chan struct{})
+	go reloadHandler.ListenSIGHUP(reloadDone)
+	defer close(reloadDone)
+
+	// BD-2026-010: Warn when WebSocket origin policy is permissive
+	if cfg.AllowedWSOrigins == "" {
+		log.Printf("[SECURITY] NOTICE: WS_ALLOWED_ORIGINS is not set — signal/relay WebSocket accepts all origins")
+	}
+	if cfg.APIAllowedWSOrigins == "" {
+		log.Printf("[SECURITY] NOTICE: API_WS_ALLOWED_ORIGINS is not set — API events WebSocket accepts all origins")
+	}
+
+	// Start servers based on mode
+	switch cfg.Mode {
+	case "all":
+		log.Printf("Starting signal + relay + API servers...")
+		sig := sigServer.New(cfg, kp, database)
+		sig.SetBlocklist(blocklist)
+		sig.SetRateLimiter(ipLimiter)
+		if err := sig.Start(ctx); err != nil {
+			log.Fatalf("Failed to start signal server: %v", err)
+		}
+		defer sig.Stop()
+
+		relaySrv := relay.New(cfg)
+		relaySrv.SetBandwidthLimiter(bwLimiter)
+		if connLimiter != nil {
+			relaySrv.SetConnLimiter(connLimiter)
+		}
+		if err := relaySrv.Start(ctx); err != nil {
+			log.Fatalf("Failed to start relay server: %v", err)
+		}
+		defer relaySrv.Stop()
+
+		apiSrv := api.New(cfg, database, sig.PeerMap(), relaySrv, Version)
+		apiSrv.SetBlocklist(blocklist)
+		apiSrv.SetBandwidthLimiter(bwLimiter)
+		apiSrv.SetAuditLogger(auditLogger)
+		apiSrv.SetEventBus(sig.EventBus())
+		apiSrv.SetMetrics(mc)
+		apiSrv.SetJWTManager(jwtManager)
+		apiSrv.SetKeyPair(kp)
+
+		// CDAP Gateway (optional — custom device automation protocol)
+		var cdapGw *cdap.Gateway
+		if cfg.CDAPEnabled {
+			cdapGw = cdap.New(cfg, database, sig.PeerMap(), sig.EventBus())
+			cdapGw.SetBlocklist(blocklist)
+			cdapGw.SetAuditLogger(auditLogger)
+			cdapGw.SetJWTManager(jwtManager)
+			cdapGw.SetVersion(Version)
+			apiSrv.SetCDAPGateway(cdapGw)
+		}
+
+		if err := apiSrv.Start(ctx); err != nil {
+			log.Fatalf("Failed to start API server: %v", err)
+		}
+		defer apiSrv.Stop()
+
+		if cdapGw != nil {
+			if err := cdapGw.Start(ctx); err != nil {
+				log.Fatalf("Failed to start CDAP gateway: %v", err)
+			}
+			defer cdapGw.Stop()
+		}
+
+		adminSrv.SetPeerMap(sig.PeerMap())
+		if cfg.AdminPassword != "" {
+			adminSrv.SetAdminPassword(cfg.AdminPassword)
+		}
+		if err := adminSrv.Start(ctx); err != nil {
+			log.Printf("WARN: Failed to start admin interface: %v", err)
+		}
+		defer adminSrv.Stop()
+
+	case "signal":
+		log.Printf("Starting signal + API servers...")
+		sig := sigServer.New(cfg, kp, database)
+		sig.SetBlocklist(blocklist)
+		sig.SetRateLimiter(ipLimiter)
+		if err := sig.Start(ctx); err != nil {
+			log.Fatalf("Failed to start signal server: %v", err)
+		}
+		defer sig.Stop()
+
+		apiSrv := api.New(cfg, database, sig.PeerMap(), nil, Version)
+		apiSrv.SetBlocklist(blocklist)
+		apiSrv.SetBandwidthLimiter(bwLimiter)
+		apiSrv.SetAuditLogger(auditLogger)
+		apiSrv.SetEventBus(sig.EventBus())
+		apiSrv.SetMetrics(mc)
+		apiSrv.SetJWTManager(jwtManager)
+		apiSrv.SetKeyPair(kp)
+		if err := apiSrv.Start(ctx); err != nil {
+			log.Fatalf("Failed to start API server: %v", err)
+		}
+		defer apiSrv.Stop()
+
+		adminSrv.SetPeerMap(sig.PeerMap())
+		if err := adminSrv.Start(ctx); err != nil {
+			log.Printf("WARN: Failed to start admin interface: %v", err)
+		}
+		defer adminSrv.Stop()
+
+	case "relay":
+		log.Printf("Starting relay server only...")
+		relaySrv := relay.New(cfg)
+		relaySrv.SetBandwidthLimiter(bwLimiter)
+		if connLimiter != nil {
+			relaySrv.SetConnLimiter(connLimiter)
+		}
+		if err := relaySrv.Start(ctx); err != nil {
+			log.Fatalf("Failed to start relay server: %v", err)
+		}
+		defer relaySrv.Stop()
+
+	default:
+		log.Fatalf("Unknown mode: %s (use: all, signal, relay)", cfg.Mode)
+	}
+
+	// Wait for shutdown signal
+	sigCh := make(chan os.Signal, 1)
+	osSignal.Notify(sigCh, syscall.SIGINT, syscall.SIGTERM)
+	sig := <-sigCh
+	log.Printf("Received signal %v, shutting down...", sig)
+	cancel()
+	log.Printf("Server stopped")
+}
+
+// loadAPIKey reads the API key from API_KEY environment variable or .api_key file
+// in the key file directory (and DB directory as fallback), and syncs it to the
+// database's server_config table. This ensures the Node.js console and Go server
+// share the same API key regardless of how the server was started.
+func loadAPIKey(cfg *config.Config, database db.Database) {
+	var apiKey string
+	var source string
+
+	// 1. Check API_KEY environment variable (highest priority)
+	if v := os.Getenv("API_KEY"); v != "" {
+		apiKey = strings.TrimSpace(v)
+		source = "API_KEY env var"
+	}
+
+	// 2. Check .api_key file in key file directory
+	if apiKey == "" {
+		keyDir := filepath.Dir(cfg.KeyFile)
+		if keyDir == "" || keyDir == "." {
+			keyDir = "."
+		}
+		apiKeyFile := filepath.Join(keyDir, ".api_key")
+		if data, err := os.ReadFile(apiKeyFile); err == nil {
+			apiKey = strings.TrimSpace(string(data))
+			if apiKey != "" {
+				source = apiKeyFile
+			}
+		}
+	}
+
+	// 3. Check .api_key file in database directory as fallback
+	if apiKey == "" {
+		dbDir := filepath.Dir(cfg.DBPath)
+		if dbDir == "" || dbDir == "." {
+			dbDir = "."
+		}
+		apiKeyFile := filepath.Join(dbDir, ".api_key")
+		if data, err := os.ReadFile(apiKeyFile); err == nil {
+			apiKey = strings.TrimSpace(string(data))
+			if apiKey != "" {
+				source = apiKeyFile
+			}
+		}
+	}
+
+	// 4. Check database server_config table (may have been set previously)
+	if apiKey == "" {
+		if existing, _ := database.GetConfig("api_key"); existing != "" {
+			apiKey = existing
+			source = "database server_config"
+		}
+	}
+
+	// 5. Auto-generate if nothing found anywhere
+	if apiKey == "" {
+		b := make([]byte, 32)
+		if _, err := cryptoRand.Read(b); err != nil {
+			log.Printf("WARN: Failed to generate API key: %v. Console→Server auth will fail.", err)
+			return
+		}
+		apiKey = hex.EncodeToString(b)
+		source = "auto-generated"
+
+		// Write to key file directory so Node.js console can read it
+		keyDir := filepath.Dir(cfg.KeyFile)
+		if keyDir == "" || keyDir == "." {
+			keyDir = "."
+		}
+		apiKeyFile := filepath.Join(keyDir, ".api_key")
+		if err := os.WriteFile(apiKeyFile, []byte(apiKey+"\n"), 0600); err != nil {
+			log.Printf("WARN: Auto-generated API key but failed to write %s: %v", apiKeyFile, err)
+			// Still try to store in DB even if file write fails
+		} else {
+			log.Printf("Auto-generated API key written to %s", apiKeyFile)
+		}
+	}
+
+	// Sync to database server_config table
+	existing, _ := database.GetConfig("api_key")
+	if existing == apiKey {
+		log.Printf("API key loaded from %s (already in database)", source)
+		return
+	}
+
+	if err := database.SetConfig("api_key", apiKey); err != nil {
+		log.Printf("WARN: Failed to sync API key to database: %v", err)
+		return
+	}
+	if existing == "" {
+		log.Printf("API key loaded from %s and stored in database", source)
+	} else {
+		log.Printf("API key loaded from %s and updated in database", source)
+	}
+}
+
+func parseFlags() *config.Config {
+	cfg := config.DefaultConfig()
+
+	flag.IntVar(&cfg.SignalPort, "port", cfg.SignalPort, "Signal server port (UDP+TCP)")
+	flag.IntVar(&cfg.RelayPort, "relay-port", cfg.RelayPort, "Relay server port (TCP)")
+	flag.IntVar(&cfg.APIPort, "api-port", cfg.APIPort, "HTTP API port")
+	flag.StringVar(&cfg.Mode, "mode", cfg.Mode, "Server mode: all, signal, relay")
+	flag.StringVar(&cfg.DBPath, "db", cfg.DBPath, "Database DSN: SQLite path or postgres://... URI")
+	flag.StringVar(&cfg.KeyFile, "key-file", cfg.KeyFile, "Ed25519 key file path (without extension)")
+	flag.StringVar(&cfg.RelayServers, "relay-servers", cfg.RelayServers, "Comma-separated relay server addresses")
+	flag.StringVar(&cfg.RendezvousServers, "rendezvous-servers", cfg.RendezvousServers, "Comma-separated rendezvous server addresses")
+	flag.StringVar(&cfg.Mask, "mask", cfg.Mask, "LAN mask (e.g. 192.168.0.0/24)")
+	flag.BoolVar(&cfg.AlwaysUseRelay, "always-relay", cfg.AlwaysUseRelay, "Always use relay (skip hole punching)")
+	flag.StringVar(&cfg.BlocklistFile, "blocklist", cfg.BlocklistFile, "Path to blocklist file (IP/ID/CIDR entries)")
+	flag.StringVar(&cfg.AuditLogFile, "audit-log", cfg.AuditLogFile, "Path to audit log file (JSON lines)")
+	flag.StringVar(&cfg.TLSCertFile, "tls-cert", cfg.TLSCertFile, "Path to TLS certificate file")
+	flag.StringVar(&cfg.TLSKeyFile, "tls-key", cfg.TLSKeyFile, "Path to TLS key file")
+	flag.StringVar(&cfg.LogFormat, "log-format", cfg.LogFormat, "Log format: text (default) or json")
+	flag.IntVar(&cfg.AdminPort, "admin-port", cfg.AdminPort, "TCP admin interface port (0 = disabled)")
+	flag.StringVar(&cfg.JWTSecret, "jwt-secret", cfg.JWTSecret, "JWT signing secret (auto-generated if empty)")
+	flag.IntVar(&cfg.JWTExpiry, "jwt-expiry", cfg.JWTExpiry, "JWT token expiry in hours (default 24)")
+	flag.StringVar(&cfg.AdminPassword, "admin-password", cfg.AdminPassword, "Password for admin TCP interface")
+	flag.BoolVar(&cfg.ForceHTTPS, "force-https", cfg.ForceHTTPS, "Reject non-TLS API requests")
+	flag.BoolVar(&cfg.TrustProxy, "trust-proxy", cfg.TrustProxy, "Trust X-Forwarded-For/X-Real-IP headers from reverse proxy")
+	flag.IntVar(&cfg.RelayMaxConnsIP, "relay-max-conns-ip", cfg.RelayMaxConnsIP, "Max relay connections per IP (0 = unlimited)")
+	flag.StringVar(&cfg.InitAdminUser, "init-admin-user", cfg.InitAdminUser, "Initial admin username (default: admin)")
+	flag.StringVar(&cfg.InitAdminPass, "init-admin-pass", cfg.InitAdminPass, "Initial admin password (auto-generated if empty)")
+	flag.BoolVar(&cfg.TLSSignal, "tls-signal", cfg.TLSSignal, "Enable TLS on signal TCP/WS ports (requires --tls-cert and --tls-key)")
+	flag.BoolVar(&cfg.TLSRelay, "tls-relay", cfg.TLSRelay, "Enable TLS on relay TCP/WS ports (requires --tls-cert and --tls-key)")
+	flag.BoolVar(&cfg.TLSApi, "tls-api", cfg.TLSApi, "Enable TLS on HTTP API port (requires --tls-cert and --tls-key)")
+	flag.IntVar(&cfg.CDAPPort, "cdap-port", cfg.CDAPPort, "CDAP WebSocket gateway port (default 21122)")
+	flag.BoolVar(&cfg.CDAPEnabled, "cdap", cfg.CDAPEnabled, "Enable CDAP gateway for custom devices")
+	flag.BoolVar(&cfg.CDAPTLS, "tls-cdap", cfg.CDAPTLS, "Enable TLS on CDAP gateway port (requires --tls-cert and --tls-key)")
+
+	showVersion := flag.Bool("version", false, "Show version and exit")
+	flag.Parse()
+
+	if *showVersion {
+		fmt.Printf("betterdesk-server %s (built %s)\n", Version, BuildDate)
+		os.Exit(0)
+	}
+
+	// Override with environment variables
+	cfg.LoadEnv()
+
+	// Validate mode
+	cfg.Mode = strings.ToLower(cfg.Mode)
+	if cfg.Mode != "all" && cfg.Mode != "signal" && cfg.Mode != "relay" {
+		log.Fatalf("Invalid mode: %s (must be: all, signal, relay)", cfg.Mode)
+	}
+
+	return cfg
+}
diff --git a/sdks/README.md b/sdks/README.md
new file mode 100644
index 00000000..9a0daf6b
--- /dev/null
+++ b/sdks/README.md
@@ -0,0 +1,90 @@
+# BetterDesk CDAP — SDKs & Bridges
+
+Software Development Kits and reference bridge implementations for the
+**Connected Device Automation Protocol (CDAP)** used by BetterDesk server.
+
+## SDKs
+
+| SDK | Directory | Language | Status |
+|-----|-----------|----------|--------|
+| **Python** | [`sdks/python/`](sdks/python/) | Python 3.9+ | ✅ Stable |
+| **Node.js** | [`sdks/nodejs/`](sdks/nodejs/) | Node.js 18+ | ✅ Stable |
+
+## Reference Bridges
+
+| Bridge | Directory | Protocol | Use Case |
+|--------|-----------|----------|----------|
+| **Modbus** | [`bridges/modbus/`](bridges/modbus/) | Modbus TCP/RTU | PLCs, VFDs, power meters |
+| **SNMP** | [`bridges/snmp/`](bridges/snmp/) | SNMP v2c/v3 | Switches, routers, UPS |
+| **REST/Webhook** | [`bridges/rest-webhook/`](bridges/rest-webhook/) | HTTP | Home Assistant, cloud APIs |
+
+## Native Agent
+
+The **BetterDesk Agent** is a standalone Go binary that runs on target devices,
+providing system monitoring, terminal access, file browsing, screenshots, and
+clipboard sync through CDAP.
+
+| Component | Directory | Language |
+|-----------|-----------|----------|
+| **Agent** | [`betterdesk-agent/`](betterdesk-agent/) | Go 1.25+ |
+
+## Quick Start
+
+### Python Bridge
+
+```bash
+pip install ./sdks/python
+pip install pymodbus  # for Modbus bridge
+cd bridges/modbus
+cp config.example.json config.json
+python bridge_modbus.py -c config.json
+```
+
+### Node.js Bridge
+
+```js
+const { CDAPBridge, gauge, toggle } = require('./sdks/nodejs');
+
+const bridge = new CDAPBridge({
+  server: 'ws://your-server:21122/cdap',
+  apiKey: 'KEY',
+  deviceName: 'My Bridge',
+});
+bridge.addWidget(gauge('temp', 'Temperature'));
+bridge.run();
+```
+
+### Go Agent
+
+```bash
+cd betterdesk-agent
+go build -o betterdesk-agent .
+./betterdesk-agent -server ws://your-server:21122/cdap -auth api_key -key YOUR_KEY
+```
+
+## CDAP Protocol Overview
+
+CDAP uses WebSocket (port 21122) with JSON messages:
+
+```
+Device/Bridge → Server:
+  auth → auth_result
+  register → registered
+  heartbeat → heartbeat_ack
+  state_update (widget values)
+  alert / alert_resolve
+  log
+
+Server → Device/Bridge:
+  command (widget_id, action, value, params)
+  terminal_start / terminal_data / terminal_resize
+  file_list / file_read / file_write / file_delete
+  clipboard_set
+  desktop_start / desktop_input
+```
+
+Authentication methods: `api_key`, `device_token`, `user_password`.
+
+## License
+
+MIT
diff --git a/sdks/nodejs/README.md b/sdks/nodejs/README.md
new file mode 100644
index 00000000..8e75d8a6
--- /dev/null
+++ b/sdks/nodejs/README.md
@@ -0,0 +1,125 @@
+# BetterDesk CDAP — Node.js SDK
+
+Node.js SDK for the **Connected Device Automation Protocol (CDAP)** used by
+BetterDesk server. Build custom bridges, IoT gateways, or automation agents
+that expose widgets and handle commands through the BetterDesk web panel.
+
+## Installation
+
+```bash
+npm install betterdesk-cdap
+# or from local path
+npm install ./sdks/nodejs
+```
+
+## Quick Start
+
+```js
+const { CDAPBridge, gauge, toggle } = require('betterdesk-cdap');
+
+const bridge = new CDAPBridge({
+  server: 'ws://your-betterdesk-server:21122/cdap',
+  apiKey: 'YOUR_API_KEY',
+  deviceName: 'Room Sensor',
+  deviceType: 'sensor',
+  bridgeName: 'room-sensor',
+});
+
+// Define widgets
+bridge
+  .addWidget(gauge('temperature', 'Temperature', { unit: '°C', min: -10, max: 50 }))
+  .addWidget(toggle('heater', 'Heater'));
+
+// Handle commands
+bridge.onCommand('heater', ({ value }) => {
+  console.log('Heater toggled to', value);
+  return value; // returned value becomes new widget state
+});
+
+// Events
+bridge.on('connected', () => console.log('Connected'));
+bridge.on('registered', () => console.log('Registered'));
+bridge.on('error', (err) => console.error(err));
+
+// Start (blocks — reconnects automatically)
+bridge.run();
+
+// Push state changes at any time
+setInterval(() => {
+  bridge.updateState('temperature', 20 + Math.random() * 5);
+}, 5000);
+```
+
+## Async Command Handlers
+
+Handlers can return promises:
+
+```js
+bridge.onCommand('restart', async ({ params }) => {
+  await someAsyncOperation(params);
+  return true;
+});
+```
+
+## API Reference
+
+### `new CDAPBridge(options)`
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `server` | `string` | — | WebSocket URL (`ws://host:21122/cdap`) |
+| `authMethod` | `string` | `'api_key'` | `api_key` / `device_token` / `user_password` |
+| `apiKey` | `string` | `''` | API key (when `authMethod='api_key'`) |
+| `deviceToken` | `string` | `''` | Device token |
+| `username` | `string` | `''` | Username |
+| `password` | `string` | `''` | Password |
+| `deviceId` | `string` | `''` | Device ID (auto-assigned if empty) |
+| `deviceName` | `string` | hostname | Display name |
+| `deviceType` | `string` | `'bridge'` | Device type |
+| `bridgeName` | `string` | `''` | Bridge identifier |
+| `bridgeVersion` | `string` | `'1.0.0'` | Bridge version |
+| `heartbeatSec` | `number` | `15` | Heartbeat interval (seconds) |
+| `reconnectSec` | `number` | `5` | Initial reconnect delay |
+| `maxReconnect` | `number` | `120` | Maximum reconnect delay |
+
+### Methods
+
+| Method | Description |
+|--------|-------------|
+| `addWidget(widget)` | Add a widget to the manifest |
+| `onCommand(widgetId, handler)` | Register command handler for a widget |
+| `updateState(widgetId, value)` | Push a single state update to server |
+| `bulkUpdate({ id: value })` | Push multiple state updates |
+| `fireAlert(id, severity, msg, details?)` | Fire an alert |
+| `resolveAlert(id)` | Resolve a fired alert |
+| `sendLog(level, msg, data?)` | Send a log entry |
+| `run()` | Start (async, reconnects automatically) |
+| `stop()` | Stop the bridge |
+
+### Events
+
+| Event | Payload | Description |
+|-------|---------|-------------|
+| `connected` | — | WebSocket connected |
+| `disconnected` | `{ code, reason }` | WebSocket closed |
+| `registered` | payload | Registration confirmed |
+| `command` | payload | Command received |
+| `error` | `Error` | Error occurred |
+| `message` | `{ type, payload }` | Any raw message |
+
+### Widget Helpers
+
+```js
+const { gauge, toggle, button, textWidget, led, slider, select, chart, table } = require('betterdesk-cdap');
+```
+
+All helpers accept `(id, label, opts?)` and return a `Widget` object.
+
+## Requirements
+
+- Node.js >= 18.0.0
+- BetterDesk server with CDAP enabled (port 21122)
+
+## License
+
+MIT
diff --git a/sdks/nodejs/package.json b/sdks/nodejs/package.json
new file mode 100644
index 00000000..c6c122dc
--- /dev/null
+++ b/sdks/nodejs/package.json
@@ -0,0 +1,22 @@
+{
+  "name": "betterdesk-cdap",
+  "version": "1.0.0",
+  "description": "Node.js SDK for BetterDesk CDAP (Connected Device Automation Protocol)",
+  "main": "src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./widgets": "./src/widgets.js",
+    "./protocol": "./src/protocol.js"
+  },
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": ["betterdesk", "cdap", "iot", "scada", "bridge", "remote-management"],
+  "license": "MIT",
+  "dependencies": {
+    "ws": "^8.18.0"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}
diff --git a/sdks/nodejs/src/bridge.js b/sdks/nodejs/src/bridge.js
new file mode 100644
index 00000000..90ca32c6
--- /dev/null
+++ b/sdks/nodejs/src/bridge.js
@@ -0,0 +1,410 @@
+'use strict';
+
+const EventEmitter = require('events');
+const WebSocket = require('ws');
+const os = require('os');
+const { createMessage, parseMessage, authApiKey, authDeviceToken, authUserPassword } = require('./protocol');
+
+/**
+ * CDAPBridge — connects a Node.js process to BetterDesk CDAP Gateway.
+ *
+ * @fires CDAPBridge#connected
+ * @fires CDAPBridge#disconnected
+ * @fires CDAPBridge#registered
+ * @fires CDAPBridge#command
+ * @fires CDAPBridge#error
+ * @fires CDAPBridge#message
+ */
+class CDAPBridge extends EventEmitter {
+  /**
+   * @param {object} options
+   * @param {string} options.server - WebSocket URL, e.g. ws://host:21122/cdap
+   * @param {string} [options.authMethod='api_key'] - api_key | device_token | user_password
+   * @param {string} [options.apiKey]
+   * @param {string} [options.deviceToken]
+   * @param {string} [options.username]
+   * @param {string} [options.password]
+   * @param {string} [options.deviceId]
+   * @param {string} [options.deviceName]
+   * @param {string} [options.deviceType='bridge']
+   * @param {string} [options.bridgeName]
+   * @param {string} [options.bridgeVersion='1.0.0']
+   * @param {number} [options.heartbeatSec=15]
+   * @param {number} [options.reconnectSec=5]
+   * @param {number} [options.maxReconnect=120]
+   */
+  constructor(options) {
+    super();
+    this.server = options.server;
+    this.authMethod = options.authMethod || 'api_key';
+    this.apiKey = options.apiKey || '';
+    this.deviceToken = options.deviceToken || '';
+    this.username = options.username || '';
+    this.password = options.password || '';
+    this.deviceId = options.deviceId || '';
+    this.deviceName = options.deviceName || os.hostname();
+    this.deviceType = options.deviceType || 'bridge';
+    this.bridgeName = options.bridgeName || '';
+    this.bridgeVersion = options.bridgeVersion || '1.0.0';
+    this.heartbeatSec = options.heartbeatSec || 15;
+    this.reconnectSec = options.reconnectSec || 5;
+    this.maxReconnect = options.maxReconnect || 120;
+
+    /** @type {Map<string, import('./widgets').Widget>} */
+    this._widgets = new Map();
+    /** @type {Map<string, any>} */
+    this._state = new Map();
+    /** @type {Map<string, Function>} */
+    this._handlers = new Map();
+
+    this._ws = null;
+    this._heartbeatTimer = null;
+    this._token = null;
+    this._running = false;
+    this._backoff = this.reconnectSec;
+  }
+
+  // ── Widget registration ──────────────────────────────────────────
+
+  /**
+   * Add a widget to the manifest. Must be called before connect().
+   * @param {import('./widgets').Widget} widget
+   * @returns {this}
+   */
+  addWidget(widget) {
+    this._widgets.set(widget.id, widget);
+    return this;
+  }
+
+  /**
+   * Register a command handler for a specific widget.
+   * @param {string} widgetId
+   * @param {function(object): any} handler - receives command payload, may return a value
+   * @returns {this}
+   */
+  onCommand(widgetId, handler) {
+    this._handlers.set(widgetId, handler);
+    return this;
+  }
+
+  // ── State updates ────────────────────────────────────────────────
+
+  /**
+   * Update a single widget value and push to server.
+   * @param {string} widgetId
+   * @param {any} value
+   */
+  updateState(widgetId, value) {
+    this._state.set(widgetId, value);
+    this._send('state_update', { widget_id: widgetId, value });
+  }
+
+  /**
+   * Bulk-update multiple widget values.
+   * @param {Object<string, any>} updates - { widgetId: value, ... }
+   */
+  bulkUpdate(updates) {
+    const values = {};
+    for (const [k, v] of Object.entries(updates)) {
+      this._state.set(k, v);
+      values[k] = v;
+    }
+    this._send('state_update', { values });
+  }
+
+  // ── Alerts & logging ─────────────────────────────────────────────
+
+  /**
+   * Fire an alert.
+   * @param {string} alertId
+   * @param {string} severity - critical | warning | info
+   * @param {string} message
+   * @param {object} [details]
+   */
+  fireAlert(alertId, severity, message, details) {
+    this._send('alert', { alert_id: alertId, severity, message, details: details || {} });
+  }
+
+  /**
+   * Resolve a previously fired alert.
+   * @param {string} alertId
+   */
+  resolveAlert(alertId) {
+    this._send('alert_resolve', { alert_id: alertId });
+  }
+
+  /**
+   * Send a log entry.
+   * @param {string} level - debug | info | warn | error
+   * @param {string} message
+   * @param {object} [data]
+   */
+  sendLog(level, message, data) {
+    this._send('log', { level, message, data: data || {} });
+  }
+
+  // ── Connection lifecycle ─────────────────────────────────────────
+
+  /**
+   * Start the bridge — connects, authenticates, registers, and maintains heartbeat.
+   * Reconnects automatically on disconnection.
+   * @returns {Promise<void>} resolves when stop() is called
+   */
+  async run() {
+    this._running = true;
+    this._backoff = this.reconnectSec;
+
+    while (this._running) {
+      try {
+        await this._connectOnce();
+        // If we get here, connection was cleanly closed
+      } catch (err) {
+        if (!this._running) break;
+        this.emit('error', err);
+      }
+
+      if (!this._running) break;
+
+      // Exponential backoff with jitter
+      const jitter = Math.floor(Math.random() * (this._backoff / 4));
+      const delay = this._backoff + jitter;
+      await this._sleep(delay * 1000);
+      this._backoff = Math.min(this._backoff * 2, this.maxReconnect);
+    }
+  }
+
+  /**
+   * Stop the bridge gracefully.
+   */
+  stop() {
+    this._running = false;
+    this._clearHeartbeat();
+    if (this._ws && this._ws.readyState === WebSocket.OPEN) {
+      this._ws.close(1000, 'bridge stopping');
+    }
+    this._ws = null;
+  }
+
+  // ── Internal ─────────────────────────────────────────────────────
+
+  /** @private */
+  async _connectOnce() {
+    return new Promise((resolve, reject) => {
+      const ws = new WebSocket(this.server, 'cdap', {
+        headers: { 'User-Agent': `betterdesk-cdap-nodejs/${this.bridgeVersion}` },
+        handshakeTimeout: 10000,
+      });
+
+      let authenticated = false;
+
+      ws.on('open', () => {
+        this._ws = ws;
+        this._backoff = this.reconnectSec; // reset backoff on success
+        this.emit('connected');
+        this._authenticate();
+      });
+
+      ws.on('message', (raw) => {
+        let msg;
+        try {
+          msg = parseMessage(raw);
+        } catch {
+          return;
+        }
+
+        this.emit('message', msg);
+
+        switch (msg.type) {
+          case 'auth_result':
+            if (msg.payload.success) {
+              authenticated = true;
+              this._token = msg.payload.token || this._token;
+              if (msg.payload.device_id) this.deviceId = msg.payload.device_id;
+              this._register();
+            } else {
+              ws.close(4001, 'auth failed');
+              reject(new Error(`Auth failed: ${msg.payload.error || 'unknown'}`));
+            }
+            break;
+
+          case 'registered':
+            this.emit('registered', msg.payload);
+            this._startHeartbeat();
+            break;
+
+          case 'command':
+            this._handleCommand(msg);
+            break;
+
+          case 'heartbeat_ack':
+            // noop
+            break;
+
+          case 'error':
+            this.emit('error', new Error(msg.payload.message || 'server error'));
+            break;
+
+          default:
+            // Forward unrecognized message types via event
+            this.emit(msg.type, msg.payload);
+            break;
+        }
+      });
+
+      ws.on('close', (code, reason) => {
+        this._clearHeartbeat();
+        this._ws = null;
+        this.emit('disconnected', { code, reason: reason.toString() });
+        if (authenticated) {
+          resolve(); // normal reconnect
+        } else if (code !== 4001) {
+          resolve();
+        }
+      });
+
+      ws.on('error', (err) => {
+        // error fires before close, let close handler resolve/reject
+        if (!authenticated && !ws._closeCalled) {
+          reject(err);
+        }
+      });
+    });
+  }
+
+  /** @private */
+  _authenticate() {
+    let payload;
+    switch (this.authMethod) {
+      case 'device_token':
+        payload = authDeviceToken(this.deviceToken, this.deviceId, this.bridgeVersion);
+        break;
+      case 'user_password':
+        payload = authUserPassword(this.username, this.password, this.deviceId, this.bridgeVersion);
+        break;
+      default:
+        payload = authApiKey(this.apiKey, this.deviceId, this.bridgeVersion);
+        break;
+    }
+    this._send('auth', payload);
+  }
+
+  /** @private */
+  _register() {
+    const widgets = [];
+    for (const w of this._widgets.values()) {
+      widgets.push(typeof w.toJSON === 'function' ? w.toJSON() : w);
+    }
+
+    const capabilities = ['telemetry', 'commands', 'alerts', 'logs'];
+    const manifest = {
+      manifest_version: '1.0',
+      device: {
+        id: this.deviceId,
+        name: this.deviceName,
+        type: this.deviceType,
+        firmware_version: this.bridgeVersion,
+        hostname: os.hostname(),
+        os: `${os.type()} ${os.release()}`,
+        platform: os.platform(),
+      },
+      capabilities,
+      widgets,
+      heartbeat_interval: this.heartbeatSec,
+    };
+
+    if (this.bridgeName) {
+      manifest.bridge = { name: this.bridgeName, version: this.bridgeVersion };
+    }
+
+    this._send('register', manifest);
+  }
+
+  /** @private */
+  _startHeartbeat() {
+    this._clearHeartbeat();
+    this._heartbeatTimer = setInterval(() => {
+      const widgetValues = {};
+      for (const [k, v] of this._state) {
+        widgetValues[k] = v;
+      }
+      this._send('heartbeat', {
+        uptime: Math.floor(process.uptime()),
+        widget_values: widgetValues,
+      });
+    }, this.heartbeatSec * 1000);
+  }
+
+  /** @private */
+  _clearHeartbeat() {
+    if (this._heartbeatTimer) {
+      clearInterval(this._heartbeatTimer);
+      this._heartbeatTimer = null;
+    }
+  }
+
+  /** @private */
+  _handleCommand(msg) {
+    const { widget_id, action, value, params } = msg.payload;
+    const handler = this._handlers.get(widget_id);
+
+    this.emit('command', msg.payload);
+
+    if (!handler) {
+      this._send('command_response', {
+        id: msg.id,
+        widget_id,
+        success: false,
+        error: `No handler for widget ${widget_id}`,
+      });
+      return;
+    }
+
+    const start = Date.now();
+    try {
+      const result = handler({ widget_id, action, value, params });
+
+      // Handle both sync and async handlers
+      if (result && typeof result.then === 'function') {
+        result
+          .then((val) => {
+            this._sendCommandResponse(msg.id, widget_id, true, val, Date.now() - start);
+            if (val !== undefined) {
+              this._state.set(widget_id, val);
+            }
+          })
+          .catch((err) => {
+            this._sendCommandResponse(msg.id, widget_id, false, null, Date.now() - start, err.message);
+          });
+      } else {
+        this._sendCommandResponse(msg.id, widget_id, true, result, Date.now() - start);
+        if (result !== undefined) {
+          this._state.set(widget_id, result);
+        }
+      }
+    } catch (err) {
+      this._sendCommandResponse(msg.id, widget_id, false, null, Date.now() - start, err.message);
+    }
+  }
+
+  /** @private */
+  _sendCommandResponse(id, widgetId, success, value, durationMs, error) {
+    const payload = { id, widget_id: widgetId, success, duration_ms: durationMs };
+    if (value !== undefined && value !== null) payload.value = value;
+    if (error) payload.error = error;
+    this._send('command_response', payload);
+  }
+
+  /** @private */
+  _send(type, payload) {
+    if (this._ws && this._ws.readyState === WebSocket.OPEN) {
+      this._ws.send(createMessage(type, payload));
+    }
+  }
+
+  /** @private */
+  _sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+}
+
+module.exports = { CDAPBridge };
diff --git a/sdks/nodejs/src/index.js b/sdks/nodejs/src/index.js
new file mode 100644
index 00000000..22e8b7b8
--- /dev/null
+++ b/sdks/nodejs/src/index.js
@@ -0,0 +1,24 @@
+'use strict';
+
+const { CDAPBridge } = require('./bridge');
+const { WidgetType, Action, Severity, createMessage, parseMessage } = require('./protocol');
+const { Widget, gauge, toggle, button, textWidget, led, slider, select, chart, table } = require('./widgets');
+
+module.exports = {
+  CDAPBridge,
+  Widget,
+  WidgetType,
+  Action,
+  Severity,
+  createMessage,
+  parseMessage,
+  gauge,
+  toggle,
+  button,
+  textWidget,
+  led,
+  slider,
+  select,
+  chart,
+  table,
+};
diff --git a/sdks/nodejs/src/protocol.js b/sdks/nodejs/src/protocol.js
new file mode 100644
index 00000000..3c580b72
--- /dev/null
+++ b/sdks/nodejs/src/protocol.js
@@ -0,0 +1,84 @@
+'use strict';
+
+/**
+ * CDAP protocol constants, message helpers, and auth payload builders.
+ */
+
+// ── Widget types ─────────────────────────────────────────────────────
+
+const WidgetType = Object.freeze({
+  TOGGLE: 'toggle',
+  GAUGE: 'gauge',
+  BUTTON: 'button',
+  LED: 'led',
+  CHART: 'chart',
+  SELECT: 'select',
+  SLIDER: 'slider',
+  TEXT: 'text',
+  TABLE: 'table',
+  TERMINAL: 'terminal',
+  DESKTOP: 'desktop',
+  VIDEO_STREAM: 'video_stream',
+  FILE_BROWSER: 'file_browser',
+});
+
+// ── Command actions ──────────────────────────────────────────────────
+
+const Action = Object.freeze({
+  SET: 'set',
+  TRIGGER: 'trigger',
+  EXECUTE: 'execute',
+  RESET: 'reset',
+  QUERY: 'query',
+});
+
+// ── Severities ───────────────────────────────────────────────────────
+
+const Severity = Object.freeze({
+  CRITICAL: 'critical',
+  WARNING: 'warning',
+  INFO: 'info',
+});
+
+// ── Message envelope ─────────────────────────────────────────────────
+
+function createMessage(type, payload, id) {
+  const msg = { type, payload, timestamp: new Date().toISOString() };
+  if (id) msg.id = id;
+  return JSON.stringify(msg);
+}
+
+function parseMessage(raw) {
+  const data = typeof raw === 'string' ? JSON.parse(raw) : JSON.parse(raw.toString());
+  return {
+    type: data.type || '',
+    payload: data.payload || {},
+    id: data.id || null,
+    timestamp: data.timestamp || null,
+  };
+}
+
+// ── Auth payload builders ────────────────────────────────────────────
+
+function authApiKey(key, deviceId = '', clientVersion = '1.0.0') {
+  return { method: 'api_key', key, device_id: deviceId, client_version: clientVersion };
+}
+
+function authDeviceToken(token, deviceId = '', clientVersion = '1.0.0') {
+  return { method: 'device_token', token, device_id: deviceId, client_version: clientVersion };
+}
+
+function authUserPassword(username, password, deviceId = '', clientVersion = '1.0.0') {
+  return { method: 'user_password', username, password, device_id: deviceId, client_version: clientVersion };
+}
+
+module.exports = {
+  WidgetType,
+  Action,
+  Severity,
+  createMessage,
+  parseMessage,
+  authApiKey,
+  authDeviceToken,
+  authUserPassword,
+};
diff --git a/sdks/nodejs/src/widgets.js b/sdks/nodejs/src/widgets.js
new file mode 100644
index 00000000..e92fb501
--- /dev/null
+++ b/sdks/nodejs/src/widgets.js
@@ -0,0 +1,118 @@
+'use strict';
+
+/**
+ * Widget definition helpers for CDAP manifest construction.
+ */
+
+class Widget {
+  constructor(type, id, label, opts = {}) {
+    this.type = type;
+    this.id = id;
+    this.label = label;
+    Object.assign(this, opts);
+  }
+
+  toJSON() {
+    const d = { type: this.type, id: this.id, label: this.label };
+    const optionalKeys = [
+      'group', 'value', 'readonly', 'unit', 'min', 'max', 'step', 'precision',
+      'warning_low', 'warning_high', 'confirm', 'confirm_message', 'style',
+      'icon', 'cooldown', 'options', 'chart_type', 'points', 'series',
+      'retention', 'columns', 'max_rows', 'sortable', 'permissions',
+    ];
+    for (const key of optionalKeys) {
+      if (this[key] !== undefined && this[key] !== null && this[key] !== 0 && this[key] !== '' && this[key] !== false) {
+        d[key] = this[key];
+      }
+    }
+    // Always include permissions if present (even if empty sub-fields)
+    if (this.permissions) d.permissions = this.permissions;
+    return d;
+  }
+}
+
+// ── Factory helpers ──────────────────────────────────────────────────
+
+function gauge(id, label, opts = {}) {
+  return new Widget('gauge', id, label, {
+    unit: '%', min: 0, max: 100, precision: 1,
+    permissions: { read: 'viewer' },
+    ...opts,
+  });
+}
+
+function toggle(id, label, opts = {}) {
+  return new Widget('toggle', id, label, {
+    value: false,
+    permissions: { read: 'viewer', control: 'operator' },
+    ...opts,
+  });
+}
+
+function button(id, label, opts = {}) {
+  return new Widget('button', id, label, {
+    permissions: { control: 'operator' },
+    ...opts,
+  });
+}
+
+function textWidget(id, label, opts = {}) {
+  return new Widget('text', id, label, {
+    readonly: true,
+    permissions: { read: 'viewer' },
+    ...opts,
+  });
+}
+
+function led(id, label, opts = {}) {
+  return new Widget('led', id, label, {
+    value: false,
+    permissions: { read: 'viewer' },
+    ...opts,
+  });
+}
+
+function slider(id, label, opts = {}) {
+  return new Widget('slider', id, label, {
+    min: 0, max: 100, step: 1,
+    permissions: { read: 'viewer', control: 'operator' },
+    ...opts,
+  });
+}
+
+function select(id, label, opts = {}) {
+  return new Widget('select', id, label, {
+    options: [],
+    permissions: { read: 'viewer', control: 'operator' },
+    ...opts,
+  });
+}
+
+function chart(id, label, opts = {}) {
+  return new Widget('chart', id, label, {
+    chart_type: 'line', points: 60, series: [],
+    permissions: { read: 'viewer' },
+    ...opts,
+  });
+}
+
+function table(id, label, opts = {}) {
+  return new Widget('table', id, label, {
+    columns: [], max_rows: 100, sortable: true,
+    permissions: { read: 'viewer' },
+    ...opts,
+  });
+}
+
+module.exports = {
+  Widget,
+  gauge,
+  toggle,
+  button,
+  textWidget,
+  led,
+  slider,
+  select,
+  chart,
+  table,
+};
diff --git a/sdks/python/README.md b/sdks/python/README.md
new file mode 100644
index 00000000..400f5bc7
--- /dev/null
+++ b/sdks/python/README.md
@@ -0,0 +1,108 @@
+# BetterDesk CDAP Python SDK
+
+Build CDAP device bridges in Python for IoT sensors, industrial equipment, and automation systems.
+
+## Installation
+
+```bash
+pip install betterdesk-cdap
+# or from source
+pip install -e sdks/python/
+```
+
+## Quick Start
+
+```python
+import asyncio
+from betterdesk_cdap import CDAPBridge, gauge, toggle, button
+
+# Create bridge
+bridge = CDAPBridge(
+    server="ws://192.168.0.110:21122/cdap",
+    auth_method="api_key",
+    api_key="your-api-key",
+    device_name="Temperature Sensor",
+    device_type="iot",
+    tags=["factory-floor", "zone-a"],
+)
+
+# Define widgets
+temp = bridge.add_widget(gauge("temp", "Temperature", unit="°C", max_val=50, warning_high=40))
+humidity = bridge.add_widget(gauge("humidity", "Humidity", unit="%", max_val=100))
+heater = bridge.add_widget(toggle("heater", "Heater", group="Controls"))
+reboot = bridge.add_widget(button("reboot", "Reboot Device", confirm=True, icon="restart_alt"))
+
+# Handle commands
+@bridge.on_command("heater")
+async def handle_heater(action, value, **kw):
+    if action == "set":
+        set_heater(value)  # your hardware control
+        return {"new_state": value}
+
+@bridge.on_command("reboot")
+async def handle_reboot(action, **kw):
+    if action == "trigger":
+        os.system("reboot")
+        return "rebooting"
+
+# Run (blocks forever with auto-reconnect)
+bridge.run()
+```
+
+## Async Usage
+
+```python
+async def main():
+    bridge = CDAPBridge(server="ws://host:21122/cdap", api_key="key")
+    bridge.add_widget(gauge("temp", "Temperature", unit="°C", max_val=100))
+
+    @bridge.on_command("temp")
+    async def handle(action, value, **kw):
+        return {"ok": True}
+
+    # Start bridge in background
+    task = asyncio.create_task(bridge._run_forever())
+
+    # Push state updates from your sensor loop
+    while True:
+        temp_value = read_sensor()
+        await bridge.update_state("temp", temp_value)
+        await asyncio.sleep(5)
+
+asyncio.run(main())
+```
+
+## API Reference
+
+### CDAPBridge
+
+| Method | Description |
+|--------|-------------|
+| `add_widget(widget)` | Register a widget for the manifest |
+| `on_command(widget_id)` | Decorator to handle commands |
+| `update_state(widget_id, value)` | Push widget state update |
+| `bulk_update(updates)` | Push multiple state updates |
+| `fire_alert(alert_id, severity, message)` | Fire an alert |
+| `resolve_alert(alert_id)` | Resolve an alert |
+| `send_log(level, message)` | Send a log entry |
+| `run()` | Blocking main loop |
+| `stop()` | Signal shutdown |
+
+### Widget Helpers
+
+| Helper | Type | Key Options |
+|--------|------|-------------|
+| `gauge(id, label)` | Gauge | `unit`, `min_val`, `max_val`, `warning_high` |
+| `toggle(id, label)` | Toggle | `value` |
+| `button(id, label)` | Button | `icon`, `confirm`, `cooldown` |
+| `text_widget(id, label)` | Text | `readonly`, `value` |
+| `led(id, label)` | LED | `value` |
+| `slider(id, label)` | Slider | `min_val`, `max_val`, `step` |
+| `select(id, label)` | Select | `options` |
+| `chart(id, label)` | Chart | `chart_type`, `points`, `series` |
+| `table(id, label)` | Table | `columns`, `max_rows`, `sortable` |
+
+## Requirements
+
+- Python 3.9+
+- `websockets >= 12.0`
diff --git a/sdks/python/betterdesk_cdap/__init__.py b/sdks/python/betterdesk_cdap/__init__.py
new file mode 100644
index 00000000..fd15927b
--- /dev/null
+++ b/sdks/python/betterdesk_cdap/__init__.py
@@ -0,0 +1,30 @@
+"""BetterDesk CDAP Python SDK — bridge framework for IoT and automation devices."""
+
+from betterdesk_cdap.bridge import CDAPBridge
+from betterdesk_cdap.widgets import (
+    Widget,
+    gauge,
+    toggle,
+    button,
+    text_widget,
+    led,
+    slider,
+    select,
+    chart,
+    table,
+)
+
+__version__ = "1.0.0"
+__all__ = [
+    "CDAPBridge",
+    "Widget",
+    "gauge",
+    "toggle",
+    "button",
+    "text_widget",
+    "led",
+    "slider",
+    "select",
+    "chart",
+    "table",
+]
diff --git a/sdks/python/betterdesk_cdap/bridge.py b/sdks/python/betterdesk_cdap/bridge.py
new file mode 100644
index 00000000..c9671c9f
--- /dev/null
+++ b/sdks/python/betterdesk_cdap/bridge.py
@@ -0,0 +1,386 @@
+"""CDAPBridge — main class for building CDAP device bridges in Python.
+
+Usage example:
+
+    from betterdesk_cdap import CDAPBridge, gauge, toggle
+
+    bridge = CDAPBridge(
+        server="ws://192.168.0.110:21122/cdap",
+        auth_method="api_key",
+        api_key="your-key",
+        device_name="Temperature Sensor",
+        device_type="iot",
+    )
+
+    temp = bridge.add_widget(gauge("temp", "Temperature", unit="°C", max_val=50))
+    heater = bridge.add_widget(toggle("heater", "Heater"))
+
+    @bridge.on_command("heater")
+    async def handle_heater(action, value, **kw):
+        GPIO.output(HEATER_PIN, value)
+        return {"status": "ok"}
+
+    bridge.run()
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import logging
+import random
+import time
+from typing import Any, Callable, Coroutine
+
+import websockets
+import websockets.exceptions
+
+from betterdesk_cdap.protocol import Message, auth_payload_api_key, auth_payload_device_token, auth_payload_user_password
+from betterdesk_cdap.widgets import Widget
+
+logger = logging.getLogger("betterdesk_cdap")
+
+
+class CDAPBridge:
+    """Python bridge that connects to a BetterDesk CDAP gateway."""
+
+    def __init__(
+        self,
+        server: str,
+        *,
+        auth_method: str = "api_key",
+        api_key: str = "",
+        device_token: str = "",
+        username: str = "",
+        password: str = "",
+        device_id: str = "",
+        device_name: str = "Python Bridge",
+        device_type: str = "iot",
+        vendor: str = "",
+        model: str = "",
+        firmware: str = "1.0.0",
+        tags: list[str] | None = None,
+        capabilities: list[str] | None = None,
+        heartbeat_sec: int = 15,
+        reconnect_sec: int = 5,
+        max_reconnect: int = 300,
+        # Bridge metadata (optional)
+        bridge_name: str = "",
+        bridge_protocol: str = "",
+        target_host: str = "",
+        target_port: int = 0,
+    ):
+        self.server = server
+        self.auth_method = auth_method
+        self.api_key = api_key
+        self.device_token = device_token
+        self.username = username
+        self.password = password
+        self.device_id = device_id
+        self.device_name = device_name
+        self.device_type = device_type
+        self.vendor = vendor
+        self.model = model
+        self.firmware = firmware
+        self.tags = tags or []
+        self.capabilities = capabilities or ["telemetry", "commands"]
+        self.heartbeat_sec = max(5, min(300, heartbeat_sec))
+        self.reconnect_sec = max(1, reconnect_sec)
+        self.max_reconnect = max(reconnect_sec, max_reconnect)
+
+        self.bridge_name = bridge_name
+        self.bridge_protocol = bridge_protocol
+        self.target_host = target_host
+        self.target_port = target_port
+
+        # Internal state
+        self._ws: websockets.WebSocketClientProtocol | None = None
+        self._widgets: list[Widget] = []
+        self._widget_values: dict[str, Any] = {}
+        self._command_handlers: dict[str, Callable] = {}
+        self._global_command_handler: Callable | None = None
+        self._token: str = ""
+        self._assigned_device_id: str = ""
+        self._role: str = ""
+        self._running = False
+        self._connected = False
+
+    # ── Widget Registration ───────────────────────────────────────────
+
+    def add_widget(self, widget: Widget) -> Widget:
+        """Register a widget for the device manifest."""
+        self._widgets.append(widget)
+        if widget.value is not None:
+            self._widget_values[widget.id] = widget.value
+        return widget
+
+    def on_command(self, widget_id: str | None = None):
+        """Decorator to register a command handler for a widget (or all widgets)."""
+        def decorator(fn: Callable[..., Coroutine]):
+            if widget_id:
+                self._command_handlers[widget_id] = fn
+            else:
+                self._global_command_handler = fn
+            return fn
+        return decorator
+
+    # ── State Updates ─────────────────────────────────────────────────
+
+    async def update_state(self, widget_id: str, value: Any) -> None:
+        """Push a single widget state update to the server."""
+        self._widget_values[widget_id] = value
+        await self._send("state_update", {
+            "widget_id": widget_id,
+            "value": value,
+            "timestamp": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+        })
+
+    async def bulk_update(self, updates: dict[str, Any]) -> None:
+        """Push multiple widget state updates."""
+        for wid, val in updates.items():
+            self._widget_values[wid] = val
+        await self._send("bulk_update", {
+            "updates": [
+                {"widget_id": wid, "value": val}
+                for wid, val in updates.items()
+            ],
+        })
+
+    # ── Alerts ────────────────────────────────────────────────────────
+
+    async def fire_alert(
+        self,
+        alert_id: str,
+        severity: str = "warning",
+        message: str = "",
+        data: Any = None,
+    ) -> None:
+        """Fire an alert to the server."""
+        payload: dict[str, Any] = {
+            "alert_id": alert_id,
+            "severity": severity,
+            "message": message,
+        }
+        if data is not None:
+            payload["data"] = data
+        await self._send("event", {"event_type": "alert_fire", "data": payload})
+
+    async def resolve_alert(self, alert_id: str) -> None:
+        """Resolve a previously fired alert."""
+        await self._send("event", {
+            "event_type": "alert_resolve",
+            "data": {"alert_id": alert_id},
+        })
+
+    # ── Logging ───────────────────────────────────────────────────────
+
+    async def send_log(
+        self, level: str, message: str, context: Any = None
+    ) -> None:
+        """Send a log entry to the server."""
+        payload: dict[str, Any] = {"level": level, "message": message}
+        if context is not None:
+            payload["context"] = context
+        await self._send("log", payload)
+
+    # ── Lifecycle ─────────────────────────────────────────────────────
+
+    def run(self) -> None:
+        """Blocking entry point — connect and run the message loop."""
+        asyncio.run(self._run_forever())
+
+    async def _run_forever(self) -> None:
+        self._running = True
+        delay = self.reconnect_sec
+
+        while self._running:
+            try:
+                await self._connect_once()
+                delay = self.reconnect_sec  # reset on success
+            except Exception as exc:
+                logger.warning("Connection lost: %s", exc)
+
+            if not self._running:
+                break
+
+            jitter = random.uniform(0, delay * 0.25)
+            wait = delay + jitter
+            logger.info("Reconnecting in %.1fs...", wait)
+            await asyncio.sleep(wait)
+            delay = min(delay * 2, self.max_reconnect)
+
+    async def _connect_once(self) -> None:
+        logger.info("Connecting to %s...", self.server)
+        async with websockets.connect(
+            self.server,
+            max_size=4 * 1024 * 1024,
+            open_timeout=30,
+        ) as ws:
+            self._ws = ws
+            await self._authenticate()
+            await self._register()
+            self._connected = True
+            logger.info(
+                "Connected as %r (device_id=%s, role=%s)",
+                self.device_name,
+                self._assigned_device_id,
+                self._role,
+            )
+
+            heartbeat_task = asyncio.create_task(self._heartbeat_loop())
+            try:
+                await self._message_loop()
+            finally:
+                heartbeat_task.cancel()
+                self._connected = False
+                self._ws = None
+
+    def stop(self) -> None:
+        """Signal the bridge to stop."""
+        self._running = False
+
+    # ── Authentication ────────────────────────────────────────────────
+
+    async def _authenticate(self) -> None:
+        if self.auth_method == "api_key":
+            payload = auth_payload_api_key(self.api_key, self.device_id, self.firmware)
+        elif self.auth_method == "device_token":
+            payload = auth_payload_device_token(self.device_token, self.device_id, self.firmware)
+        elif self.auth_method == "user_password":
+            payload = auth_payload_user_password(
+                self.username, self.password, self.device_id, self.firmware
+            )
+        else:
+            raise ValueError(f"Unknown auth method: {self.auth_method}")
+
+        await self._send("auth", payload)
+        msg = await self._recv()
+        if msg.type != "auth_result":
+            raise RuntimeError(f"Expected auth_result, got {msg.type}")
+        if not msg.payload.get("success"):
+            raise RuntimeError(f"Auth failed: {msg.payload.get('error', 'unknown')}")
+
+        self._token = msg.payload.get("token", "")
+        self._assigned_device_id = msg.payload.get("device_id", "")
+        self._role = msg.payload.get("role", "")
+
+    # ── Registration ──────────────────────────────────────────────────
+
+    async def _register(self) -> None:
+        manifest = self._build_manifest()
+        await self._send("register", {"manifest": manifest})
+
+    def _build_manifest(self) -> dict[str, Any]:
+        device: dict[str, Any] = {
+            "name": self.device_name,
+            "type": self.device_type,
+        }
+        if self.vendor:
+            device["vendor"] = self.vendor
+        if self.model:
+            device["model"] = self.model
+        if self.firmware:
+            device["firmware"] = self.firmware
+        if self.tags:
+            device["tags"] = self.tags
+
+        m: dict[str, Any] = {
+            "manifest_version": "1.0",
+            "device": device,
+            "capabilities": self.capabilities,
+            "heartbeat_interval": self.heartbeat_sec,
+            "widgets": [w.to_dict() for w in self._widgets],
+        }
+
+        if self.bridge_name:
+            m["bridge"] = {
+                "name": self.bridge_name,
+                "version": self.firmware,
+                "protocol": self.bridge_protocol,
+                "target_host": self.target_host,
+                "target_port": self.target_port,
+            }
+
+        return m
+
+    # ── Heartbeat ─────────────────────────────────────────────────────
+
+    async def _heartbeat_loop(self) -> None:
+        while self._connected:
+            try:
+                payload: dict[str, Any] = {}
+                if self._widget_values:
+                    payload["widget_values"] = dict(self._widget_values)
+                await self._send("heartbeat", payload)
+            except Exception:
+                return
+            await asyncio.sleep(self.heartbeat_sec)
+
+    # ── Message Loop ──────────────────────────────────────────────────
+
+    async def _message_loop(self) -> None:
+        while True:
+            msg = await self._recv()
+            await self._dispatch(msg)
+
+    async def _dispatch(self, msg: Message) -> None:
+        if msg.type == "command":
+            await self._handle_command(msg.payload)
+        elif msg.type == "ping":
+            pass  # heartbeat ACK
+        elif msg.type == "error":
+            code = msg.payload.get("code", 0)
+            error_msg = msg.payload.get("message", "")
+            logger.error("Server error %d: %s", code, error_msg)
+        elif msg.type == "registered":
+            logger.debug("Registration confirmed: %s", msg.payload)
+        else:
+            logger.debug("Unhandled message type: %s", msg.type)
+
+    async def _handle_command(self, payload: dict[str, Any]) -> None:
+        command_id = payload.get("command_id", "")
+        widget_id = payload.get("widget_id", "")
+        action = payload.get("action", "")
+        value = payload.get("value")
+
+        start = time.monotonic()
+        handler = self._command_handlers.get(widget_id, self._global_command_handler)
+
+        resp: dict[str, Any] = {"command_id": command_id}
+        if handler is None:
+            resp["status"] = "error"
+            resp["error_message"] = f"No handler for widget {widget_id}"
+        else:
+            try:
+                result = await handler(
+                    action=action,
+                    value=value,
+                    widget_id=widget_id,
+                    operator=payload.get("operator", ""),
+                    reason=payload.get("reason", ""),
+                )
+                resp["status"] = "ok"
+                resp["result"] = result
+                # Auto-update widget value on set
+                if action == "set" and value is not None:
+                    self._widget_values[widget_id] = value
+            except Exception as exc:
+                resp["status"] = "error"
+                resp["error_message"] = str(exc)
+
+        resp["execution_time_ms"] = int((time.monotonic() - start) * 1000)
+        await self._send("command_response", resp)
+
+    # ── Wire I/O ──────────────────────────────────────────────────────
+
+    async def _send(self, msg_type: str, payload: dict[str, Any]) -> None:
+        if not self._ws:
+            return
+        msg = Message(type=msg_type, payload=payload)
+        await self._ws.send(msg.to_json())
+
+    async def _recv(self) -> Message:
+        if not self._ws:
+            raise RuntimeError("Not connected")
+        raw = await self._ws.recv()
+        return Message.from_json(raw)
diff --git a/sdks/python/betterdesk_cdap/protocol.py b/sdks/python/betterdesk_cdap/protocol.py
new file mode 100644
index 00000000..2a5c78d8
--- /dev/null
+++ b/sdks/python/betterdesk_cdap/protocol.py
@@ -0,0 +1,125 @@
+"""CDAP protocol constants and WebSocket transport."""
+
+from __future__ import annotations
+
+import json
+import time
+from dataclasses import dataclass, field
+from typing import Any
+
+
+# ── Message envelope ──────────────────────────────────────────────────
+
+@dataclass
+class Message:
+    """CDAP protocol message envelope."""
+
+    type: str
+    payload: dict[str, Any] = field(default_factory=dict)
+    id: str | None = None
+    timestamp: str | None = None
+
+    def to_json(self) -> str:
+        obj: dict[str, Any] = {"type": self.type, "payload": self.payload}
+        if self.id:
+            obj["id"] = self.id
+        obj["timestamp"] = self.timestamp or time.strftime(
+            "%Y-%m-%dT%H:%M:%SZ", time.gmtime()
+        )
+        return json.dumps(obj, separators=(",", ":"))
+
+    @classmethod
+    def from_json(cls, raw: str | bytes) -> "Message":
+        data = json.loads(raw)
+        return cls(
+            type=data.get("type", ""),
+            payload=data.get("payload", {}),
+            id=data.get("id"),
+            timestamp=data.get("timestamp"),
+        )
+
+
+# ── Auth payloads ─────────────────────────────────────────────────────
+
+def auth_payload_api_key(key: str, device_id: str = "", client_version: str = "1.0.0") -> dict:
+    return {
+        "method": "api_key",
+        "key": key,
+        "device_id": device_id,
+        "client_version": client_version,
+    }
+
+
+def auth_payload_device_token(token: str, device_id: str = "", client_version: str = "1.0.0") -> dict:
+    return {
+        "method": "device_token",
+        "token": token,
+        "device_id": device_id,
+        "client_version": client_version,
+    }
+
+
+def auth_payload_user_password(
+    username: str, password: str, device_id: str = "", client_version: str = "1.0.0"
+) -> dict:
+    return {
+        "method": "user_password",
+        "username": username,
+        "password": password,
+        "device_id": device_id,
+        "client_version": client_version,
+    }
+
+
+# ── Command actions ───────────────────────────────────────────────────
+
+ACTION_SET = "set"
+ACTION_TRIGGER = "trigger"
+ACTION_EXECUTE = "execute"
+ACTION_RESET = "reset"
+ACTION_QUERY = "query"
+
+# ── Command response statuses ────────────────────────────────────────
+
+STATUS_OK = "ok"
+STATUS_ERROR = "error"
+STATUS_TIMEOUT = "timeout"
+STATUS_REJECTED = "rejected"
+STATUS_QUEUED = "queued"
+
+# ── Known capabilities ───────────────────────────────────────────────
+
+CAPABILITIES = [
+    "telemetry",
+    "commands",
+    "alerts",
+    "logs",
+    "remote_desktop",
+    "video_stream",
+    "audio",
+    "clipboard",
+    "file_transfer",
+    "input_control",
+]
+
+# ── Widget types ─────────────────────────────────────────────────────
+
+WIDGET_TOGGLE = "toggle"
+WIDGET_GAUGE = "gauge"
+WIDGET_BUTTON = "button"
+WIDGET_LED = "led"
+WIDGET_CHART = "chart"
+WIDGET_SELECT = "select"
+WIDGET_SLIDER = "slider"
+WIDGET_TEXT = "text"
+WIDGET_TABLE = "table"
+WIDGET_TERMINAL = "terminal"
+WIDGET_DESKTOP = "desktop"
+WIDGET_VIDEO = "video_stream"
+WIDGET_FILE_BROWSER = "file_browser"
+
+# ── Alert severities ─────────────────────────────────────────────────
+
+SEVERITY_CRITICAL = "critical"
+SEVERITY_WARNING = "warning"
+SEVERITY_INFO = "info"
diff --git a/sdks/python/betterdesk_cdap/widgets.py b/sdks/python/betterdesk_cdap/widgets.py
new file mode 100644
index 00000000..f1dbb2de
--- /dev/null
+++ b/sdks/python/betterdesk_cdap/widgets.py
@@ -0,0 +1,242 @@
+"""Widget definition helpers for CDAP manifest construction."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any
+
+
+@dataclass
+class Widget:
+    """Represents a CDAP widget for the device manifest."""
+
+    type: str
+    id: str
+    label: str
+    group: str = ""
+    value: Any = None
+    readonly: bool = False
+
+    # Gauge / Slider
+    unit: str = ""
+    min: float = 0.0
+    max: float = 0.0
+    step: float = 0.0
+    precision: int = 0
+    warning_low: float = 0.0
+    warning_high: float = 0.0
+
+    # Button
+    confirm: bool = False
+    confirm_message: str = ""
+    style: str = ""
+    icon: str = ""
+    cooldown: int = 0
+
+    # Select
+    options: list[dict[str, Any]] = field(default_factory=list)
+
+    # Chart
+    chart_type: str = ""
+    points: int = 0
+    series: list[dict[str, Any]] = field(default_factory=list)
+    retention: str = ""
+
+    # Table
+    columns: list[dict[str, Any]] = field(default_factory=list)
+    max_rows: int = 0
+    sortable: bool = False
+
+    # RBAC
+    permissions: dict[str, str] | None = None
+
+    def to_dict(self) -> dict[str, Any]:
+        """Serialize widget to CDAP-compatible dict, omitting zero-value fields."""
+        d: dict[str, Any] = {"type": self.type, "id": self.id, "label": self.label}
+        _optional = {
+            "group": self.group,
+            "value": self.value,
+            "readonly": self.readonly,
+            "unit": self.unit,
+            "min": self.min,
+            "max": self.max,
+            "step": self.step,
+            "precision": self.precision,
+            "warning_low": self.warning_low,
+            "warning_high": self.warning_high,
+            "confirm": self.confirm,
+            "confirm_message": self.confirm_message,
+            "style": self.style,
+            "icon": self.icon,
+            "cooldown": self.cooldown,
+            "options": self.options,
+            "chart_type": self.chart_type,
+            "points": self.points,
+            "series": self.series,
+            "retention": self.retention,
+            "columns": self.columns,
+            "max_rows": self.max_rows,
+            "sortable": self.sortable,
+        }
+        for k, v in _optional.items():
+            if v:  # skip zero-values
+                d[k] = v
+        if self.permissions:
+            d["permissions"] = self.permissions
+        return d
+
+
+# ── Factory helpers ───────────────────────────────────────────────────
+
+def gauge(
+    id: str,
+    label: str,
+    *,
+    group: str = "",
+    unit: str = "%",
+    min_val: float = 0,
+    max_val: float = 100,
+    warning_high: float = 0,
+    precision: int = 1,
+    permissions: dict[str, str] | None = None,
+) -> Widget:
+    return Widget(
+        type="gauge", id=id, label=label, group=group,
+        unit=unit, min=min_val, max=max_val,
+        warning_high=warning_high, precision=precision,
+        permissions=permissions or {"read": "viewer"},
+    )
+
+
+def toggle(
+    id: str,
+    label: str,
+    *,
+    group: str = "",
+    value: bool = False,
+    permissions: dict[str, str] | None = None,
+) -> Widget:
+    return Widget(
+        type="toggle", id=id, label=label, group=group,
+        value=value,
+        permissions=permissions or {"read": "viewer", "control": "operator"},
+    )
+
+
+def button(
+    id: str,
+    label: str,
+    *,
+    group: str = "",
+    icon: str = "",
+    confirm: bool = False,
+    confirm_message: str = "",
+    cooldown: int = 0,
+    permissions: dict[str, str] | None = None,
+) -> Widget:
+    return Widget(
+        type="button", id=id, label=label, group=group,
+        icon=icon, confirm=confirm, confirm_message=confirm_message,
+        cooldown=cooldown,
+        permissions=permissions or {"control": "operator"},
+    )
+
+
+def text_widget(
+    id: str,
+    label: str,
+    *,
+    group: str = "",
+    readonly: bool = True,
+    value: str = "",
+    permissions: dict[str, str] | None = None,
+) -> Widget:
+    return Widget(
+        type="text", id=id, label=label, group=group,
+        readonly=readonly, value=value,
+        permissions=permissions or {"read": "viewer"},
+    )
+
+
+def led(
+    id: str,
+    label: str,
+    *,
+    group: str = "",
+    value: bool = False,
+    permissions: dict[str, str] | None = None,
+) -> Widget:
+    return Widget(
+        type="led", id=id, label=label, group=group,
+        value=value,
+        permissions=permissions or {"read": "viewer"},
+    )
+
+
+def slider(
+    id: str,
+    label: str,
+    *,
+    group: str = "",
+    unit: str = "",
+    min_val: float = 0,
+    max_val: float = 100,
+    step: float = 1,
+    value: float = 0,
+    permissions: dict[str, str] | None = None,
+) -> Widget:
+    return Widget(
+        type="slider", id=id, label=label, group=group,
+        unit=unit, min=min_val, max=max_val, step=step, value=value,
+        permissions=permissions or {"read": "viewer", "control": "operator"},
+    )
+
+
+def select(
+    id: str,
+    label: str,
+    *,
+    group: str = "",
+    options: list[dict[str, Any]] | None = None,
+    value: Any = None,
+    permissions: dict[str, str] | None = None,
+) -> Widget:
+    return Widget(
+        type="select", id=id, label=label, group=group,
+        options=options or [], value=value,
+        permissions=permissions or {"read": "viewer", "control": "operator"},
+    )
+
+
+def chart(
+    id: str,
+    label: str,
+    *,
+    group: str = "",
+    chart_type: str = "line",
+    points: int = 60,
+    series: list[dict[str, Any]] | None = None,
+    permissions: dict[str, str] | None = None,
+) -> Widget:
+    return Widget(
+        type="chart", id=id, label=label, group=group,
+        chart_type=chart_type, points=points, series=series or [],
+        permissions=permissions or {"read": "viewer"},
+    )
+
+
+def table(
+    id: str,
+    label: str,
+    *,
+    group: str = "",
+    columns: list[dict[str, Any]] | None = None,
+    max_rows: int = 100,
+    sortable: bool = True,
+    permissions: dict[str, str] | None = None,
+) -> Widget:
+    return Widget(
+        type="table", id=id, label=label, group=group,
+        columns=columns or [], max_rows=max_rows, sortable=sortable,
+        permissions=permissions or {"read": "viewer"},
+    )
diff --git a/sdks/python/pyproject.toml b/sdks/python/pyproject.toml
new file mode 100644
index 00000000..b1597186
--- /dev/null
+++ b/sdks/python/pyproject.toml
@@ -0,0 +1,23 @@
+[build-system]
+requires = ["setuptools>=68.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "betterdesk-cdap"
+version = "1.0.0"
+description = "Python SDK for BetterDesk CDAP (Connected Device Automation Protocol)"
+readme = "README.md"
+license = {text = "MIT"}
+requires-python = ">=3.9"
+dependencies = [
+    "websockets>=12.0",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=7.0",
+    "pytest-asyncio>=0.21",
+]
+
+[tool.setuptools.packages.find]
+include = ["betterdesk_cdap*"]
diff --git a/web-nodejs/config/config.js b/web-nodejs/config/config.js
index 26bcca27..39c8513c 100644
--- a/web-nodejs/config/config.js
+++ b/web-nodejs/config/config.js
@@ -127,6 +127,14 @@ module.exports = {
     betterdeskApiKey: process.env.BETTERDESK_API_KEY || apiKey,
     betterdeskApiTimeout: parseInt(process.env.BETTERDESK_API_TIMEOUT, 10) || 5000,
     
+    // TLS certificate verification (BD-2026-002)
+    // When true, self-signed certificates are accepted for internal connections.
+    // Set to 'false' in production with proper certificates.
+    allowSelfSignedCerts: (process.env.ALLOW_SELF_SIGNED_CERTS || 'true').toLowerCase() === 'true',
+    // SMTP TLS verification — separate control for outbound email.
+    // Set to 'true' when using a trusted SMTP server with valid certificates.
+    smtpTlsVerify: (process.env.SMTP_TLS_VERIFY || 'false').toLowerCase() === 'true',
+    
     // Session
     sessionSecret: sessionSecret,
     sessionMaxAge: parseInt(process.env.SESSION_MAX_AGE, 10) || 24 * 60 * 60 * 1000, // 24 hours
diff --git a/web-nodejs/lang/de.json b/web-nodejs/lang/de.json
index cbce8198..bebf63c7 100644
--- a/web-nodejs/lang/de.json
+++ b/web-nodejs/lang/de.json
@@ -19,7 +19,15 @@
     "info": "Information",
     "all": "Alle",
     "cancel": "Abbrechen",
-    "delete": "Löschen"
+    "delete": "Löschen",
+    "actions": "Aktionen",
+    "close": "Schließen",
+    "required": "Erforderlich",
+    "name_required": "Name ist erforderlich",
+    "active": "Aktiv",
+    "inactive": "Inaktiv",
+    "invalid_json": "Ungültiges JSON-Format",
+    "field_required": "Dieses Feld ist erforderlich"
   },
   "nav": {
     "main": "Hauptmenü",
@@ -41,7 +49,10 @@
     "reports": "Berichte",
     "tenants": "Mandanten",
     "registrations": "Registrierungen",
-    "toggle_sidebar": "Seitenleiste umschalten"
+    "toggle_sidebar": "Seitenleiste umschalten",
+    "cdap": "CDAP",
+    "clients": "Clients",
+    "exit_desktop": "Desktop beenden"
   },
   "auth": {
     "login": "Anmelden",
@@ -140,7 +151,24 @@
     "bulk_delete_confirm": "Sind Sie sicher, dass Sie {count} Geräte löschen möchten?",
     "bulk_delete_success": "{count} Geräte erfolgreich gelöscht",
     "columns": "Spalten",
-    "toggle_columns": "Sichtbare Spalten umschalten"
+    "toggle_columns": "Sichtbare Spalten umschalten",
+    "device_type": "Gerätetyp",
+    "cdap_connected": "CDAP verbunden",
+    "revoke": "Widerrufen",
+    "revoke_option": "Gerät widerrufen",
+    "revoke_hint": "Gerät blockieren und aktive Verbindungen trennen",
+    "revoke_success": "Gerät erfolgreich widerrufen",
+    "connect_remote": "Remote verbinden",
+    "copy_id": "ID kopieren",
+    "tabs": {
+      "details": "Details",
+      "notes": "Notizen",
+      "hardware": "Hardware",
+      "metrics": "Metriken"
+    },
+    "live_metrics": "Live-Metriken",
+    "history_charts": "Verlaufsdiagramme",
+    "no_metrics": "Keine Metriken verfügbar"
   },
   "keys": {
     "title": "Serverschlüssel",
@@ -297,6 +325,7 @@
   },
   "time": {
     "just_now": "Gerade eben",
+    "seconds_ago": "Vor {count} Sekunde(n)",
     "minutes_ago": "Vor {count} Minute(n)",
     "hours_ago": "Vor {count} Stunde(n)",
     "days_ago": "Vor {count} Tag(en)"
@@ -403,7 +432,9 @@
     "delete_failed": "Gerät konnte nicht gelöscht werden",
     "change_id_failed": "Geräte-ID konnte nicht geändert werden",
     "bulk_delete_failed": "Geräte konnten nicht gelöscht werden",
-    "sync_failed": "Synchronisierung fehlgeschlagen"
+    "sync_failed": "Synchronisierung fehlgeschlagen",
+    "forbidden_title": "Zugriff verweigert",
+    "forbidden_message": "Sie haben keine Berechtigung, auf diese Seite zuzugreifen."
   },
   "remote": {
     "title": "Remote-Desktop",
@@ -709,7 +740,17 @@
     "category_other": "Sonstiges",
     "summary": "Zusammenfassung",
     "details": "Details",
-    "refresh": "Aktualisieren"
+    "refresh": "Aktualisieren",
+    "session_start": "Sitzungsbeginn",
+    "session_end": "Sitzungsende",
+    "status": "Status",
+    "user": "Benutzer",
+    "export": "Exportieren",
+    "export_csv": "Als CSV exportieren",
+    "export_pdf": "Als PDF exportieren",
+    "date_range": "Datumsbereich",
+    "today": "Heute",
+    "this_week": "Diese Woche"
   },
   "automation": {
     "title": "Automatisierung & Alerts",
@@ -777,7 +818,8 @@
     "smtp_test_failed": "Verbindung fehlgeschlagen",
     "no_rules": "Keine Alarmregeln konfiguriert",
     "no_alerts": "Keine Alarme ausgelöst",
-    "no_commands": "Keine Befehle gesendet"
+    "no_commands": "Keine Befehle gesendet",
+    "no_commands_sent": "Noch keine Befehle gesendet"
   },
   "file_transfer": {
     "title": "Dateiübertragung",
@@ -861,7 +903,16 @@
     "no_targets": "Keine Überwachungsziele konfiguriert",
     "no_history": "Kein Prüfverlauf verfügbar",
     "error_code": "Fehler",
-    "status_code": "HTTP-Statuscode"
+    "status_code": "HTTP-Statuscode",
+    "uptime": "Verfügbarkeit",
+    "uptime_percent": "Verfügbarkeit %",
+    "response_time": "Antwortzeit",
+    "avg_response_time": "Durchschn. Antwortzeit",
+    "last_24h": "Letzte 24 Stunden",
+    "last_7d": "Letzte 7 Tage",
+    "last_30d": "Letzte 30 Tage",
+    "charts": "Diagramme",
+    "realtime": "Echtzeit"
   },
   "dataguard": {
     "title": "DataGuard — DLP",
@@ -957,7 +1008,23 @@
     "os_distribution": "Betriebssystemverteilung",
     "avg_ram": "Durchschnittlicher RAM",
     "alert_rules": "Alarmregeln",
-    "recent_alerts": "Letzte Alarme"
+    "recent_alerts": "Letzte Alarme",
+    "tab_generate": "Bericht generieren",
+    "tab_saved": "Gespeicherte Berichte",
+    "type_devices_desc": "Übersicht aller Geräte, Plattformen und Status",
+    "type_activity_desc": "Zusammenfassung von Anwendungsnutzung und Leerlaufzeit",
+    "type_security_desc": "Sperraktionen, DLP-Ereignisse und Audit-Protokolle",
+    "type_tickets_desc": "Ticketstatistiken und SLA-Leistung",
+    "type_network_desc": "Netzwerküberwachungsziele und Verfügbarkeitsdaten",
+    "type_inventory_desc": "Zusammenfassung von Hardware- und Softwareinventar",
+    "type_alerts_desc": "Alarmregeln und Verlauf ausgelöster Alarme",
+    "report_name": "Berichtsname",
+    "format": "Format",
+    "save": "Bericht speichern",
+    "preview": "Vorschau",
+    "download": "Herunterladen",
+    "no_saved": "Keine gespeicherten Berichte",
+    "delete_saved": "Bericht löschen"
   },
   "tenants": {
     "title": "Mehrmandantenfähigkeit",
@@ -991,7 +1058,17 @@
     "total_users": "Benutzer gesamt",
     "created_at": "Erstellt am",
     "updated_at": "Aktualisiert am",
-    "slug_exists": "Mandanten-Slug existiert bereits"
+    "slug_exists": "Mandanten-Slug existiert bereits",
+    "total_tenants": "Mandanten gesamt",
+    "active_tenants": "Aktive Mandanten",
+    "search": "Mandanten suchen...",
+    "create_tenant": "Mandant erstellen",
+    "detail": "Mandantendetails",
+    "contact": "Kontakt",
+    "enabled": "Aktiviert",
+    "max": "max",
+    "info": "Mandanteninformation",
+    "status": "Status"
   },
   "registrations": {
     "title": "Geräteregistrierungen",
@@ -1051,5 +1128,195 @@
     "no_file": "Keine Sicherungsdatei ausgewählt",
     "invalid_json": "Ungültige Sicherungsdatei: kein gültiges JSON",
     "invalid_format": "Ungültige Sicherungsdatei: keine BetterDesk-Sicherung"
+  },
+  "cdap": {
+    "device_detail": "CDAP-Gerät",
+    "loading": "Laden...",
+    "loading_widgets": "Geräte-Widgets werden geladen...",
+    "load_error": "Gerätedaten konnten nicht geladen werden",
+    "connected": "Verbunden",
+    "disconnected": "Getrennt",
+    "device_offline_msg": "Gerät ist derzeit offline. Widget-Werte können veraltet sein.",
+    "no_widgets": "Keine Widgets verfügbar",
+    "no_widgets_desc": "Dieses Gerät hat kein CDAP-Manifest mit Widget-Definitionen registriert.",
+    "command_log": "Befehlsprotokoll",
+    "clear_log": "Protokoll löschen",
+    "confirm_command": "Befehl bestätigen",
+    "select_option": "Auswählen",
+    "cdap_status": "CDAP-Status",
+    "cdap_enabled": "CDAP aktiviert",
+    "cdap_disabled": "CDAP deaktiviert",
+    "cdap_devices": "CDAP-Geräte",
+    "cdap_connections": "Aktive Verbindungen",
+    "send_command": "Befehl senden",
+    "command_sent": "Befehl erfolgreich gesendet",
+    "command_failed": "Befehl konnte nicht gesendet werden",
+    "devices_title": "CDAP-Geräte",
+    "devices_subtitle": "Verbundene Geräte über Custom Device Application Protocol",
+    "stat_connected": "Verbunden",
+    "stat_port": "Port",
+    "search_devices": "Geräte suchen...",
+    "no_devices": "Keine Geräte verbunden",
+    "no_devices_desc": "Es sind derzeit keine CDAP-Geräte verbunden. Geräte erscheinen hier, sobald sie sich mit dem Gateway verbinden.",
+    "gateway_disabled": "CDAP-Gateway deaktiviert",
+    "gateway_disabled_desc": "Aktivieren Sie das CDAP-Gateway durch Setzen von CDAP_ENABLED=true in der Serverkonfiguration.",
+    "gateway_active": "Aktiv",
+    "toggle_enable": "CDAP aktivieren",
+    "toggle_disable": "CDAP deaktivieren",
+    "enabled_restart": "CDAP aktiviert. Server-Neustart erforderlich.",
+    "disabled_restart": "CDAP deaktiviert. Server-Neustart erforderlich.",
+    "widgets": "Widgets",
+    "type_all": "Alle",
+    "type_iot": "IoT",
+    "type_scada": "SCADA",
+    "type_os_agent": "OS-Agent",
+    "type_network": "Netzwerk",
+    "type_camera": "Kamera",
+    "type_custom": "Benutzerdefiniert",
+    "active_alerts": "Aktive Warnungen",
+    "alert_fired": "Warnung ausgelöst",
+    "alert_cleared": "Warnung gelöscht",
+    "no_alerts": "Keine aktiven Warnungen",
+    "connect_terminal": "Terminal verbinden",
+    "table_search": "Suchen...",
+    "just_now": "Gerade eben",
+    "terminal_connecting": "Verbinde mit Gerät...",
+    "terminal_disconnected": "Getrennt",
+    "terminal_error": "Terminal-Verbindung fehlgeschlagen",
+    "linked_devices": "Verknüpfte Geräte",
+    "link_device": "Gerät verknüpfen",
+    "unlink_device": "Verknüpfung aufheben",
+    "no_linked_devices": "Keine verknüpften Geräte",
+    "unlink_confirm": "Möchten Sie die Verknüpfung mit diesem Gerät wirklich aufheben?",
+    "link_prompt": "Geben Sie die Peer-ID ein, die mit diesem Gerät verknüpft werden soll:",
+    "connect_desktop": "Desktop verbinden",
+    "connect_video": "Stream verbinden",
+    "connect_files": "Dateien durchsuchen",
+    "connect_audio": "Audio verbinden",
+    "upload_file": "Hochladen",
+    "desktop_connecting": "Verbinde...",
+    "video_connecting": "Verbinde...",
+    "files_connecting": "Verbinde...",
+    "audio_connecting": "Verbinde...",
+    "audio_streaming": "Streaming",
+    "clipboard_in": "Zwischenablage empfangen",
+    "clipboard_out": "Zwischenablage gesendet",
+    "monitor_select": "Monitor auswählen",
+    "keyframe_request": "Keyframe anfordern",
+    "quality_auto": "Automatische Qualität"
+  },
+  "desktop": {
+    "switch_mode": "Desktop-Modus",
+    "console_mode": "Konsolen-Modus",
+    "loading": "Laden...",
+    "minimize": "Minimieren",
+    "maximize": "Maximieren",
+    "restore": "Wiederherstellen",
+    "close": "Schließen",
+    "widgets_mode": "Widgets",
+    "windows_mode": "Fenster",
+    "wallpaper": "Hintergrundbild",
+    "add_widget": "Widget hinzufügen",
+    "remove_widget": "Widget entfernen",
+    "configure": "Konfigurieren",
+    "search_widgets": "Widgets suchen...",
+    "cat_monitoring": "Überwachung",
+    "cat_devices": "Geräte",
+    "cat_tools": "Werkzeuge",
+    "cat_general": "Allgemein",
+    "notes_placeholder": "Notizen hier schreiben...",
+    "search_placeholder": "Geräte, Seiten, Einstellungen suchen...",
+    "search_pages": "Seiten",
+    "search_devices": "Geräte",
+    "search_no_results": "Keine Ergebnisse",
+    "exit_desktop": "Desktop verlassen"
+  },
+  "tokens": {
+    "title": "Geräte-Token",
+    "subtitle": "Registrierungstoken für automatische Gerätebereitstellung verwalten",
+    "enrollment_mode": "Registrierungsmodus",
+    "mode_open": "Offen",
+    "mode_open_desc": "Jedes Gerät kann sich ohne Token registrieren",
+    "mode_managed": "Verwaltet",
+    "mode_managed_desc": "Geräte benötigen einen gültigen Token zur Registrierung",
+    "mode_locked": "Gesperrt",
+    "mode_locked_desc": "Keine neuen Geräteregistrierungen erlaubt",
+    "total": "Gesamte Token",
+    "active": "Aktiv",
+    "used": "Verwendet",
+    "revoked": "Widerrufen",
+    "search_placeholder": "Token suchen...",
+    "status_pending": "Ausstehend",
+    "status_active": "Aktiv",
+    "status_used": "Verwendet",
+    "status_revoked": "Widerrufen",
+    "status_expired": "Abgelaufen",
+    "bulk_generate": "Massengeneration",
+    "create": "Token erstellen",
+    "edit": "Token bearbeiten",
+    "token": "Token",
+    "name": "Name",
+    "status": "Status",
+    "uses": "Verwendungen",
+    "bound_peer": "Gebundener Peer",
+    "expires": "Läuft ab",
+    "created": "Erstellt",
+    "actions": "Aktionen",
+    "name_placeholder": "z.B. Büro-PC-Charge",
+    "max_uses": "Maximale Verwendungen",
+    "max_uses_hint": "0 = unbegrenzt",
+    "expires_in": "Läuft ab in",
+    "no_expiration": "Kein Ablaufdatum",
+    "expires_1h": "1 Stunde",
+    "expires_24h": "24 Stunden",
+    "expires_7d": "7 Tage",
+    "expires_30d": "30 Tage",
+    "note": "Notiz",
+    "note_placeholder": "Optionale Notiz zu diesem Token...",
+    "count": "Anzahl",
+    "count_range": "Anzahl der zu generierenden Token (1-100)",
+    "name_prefix": "Namenspräfix",
+    "generate": "Generieren",
+    "token_created": "Token erstellt",
+    "tokens_generated": "Token generiert",
+    "copy_warning": "Kopieren Sie den Token jetzt. Er wird nicht erneut angezeigt.",
+    "copy_token": "Token kopieren",
+    "copied": "Kopiert!",
+    "revoke": "Widerrufen",
+    "revoke_confirm": "Möchten Sie diesen Token wirklich widerrufen? Bereits registrierte Geräte sind nicht betroffen.",
+    "revoked_success": "Token erfolgreich widerrufen",
+    "no_tokens": "Keine Token gefunden",
+    "expired": "Abgelaufen",
+    "never": "Nie",
+    "save": "Speichern",
+    "cancel": "Abbrechen",
+    "unlimited": "Unbegrenzt"
+  },
+  "tutorial": {
+    "next": "Weiter",
+    "prev": "Zurück",
+    "skip": "Überspringen",
+    "finish": "Fertig",
+    "step_of": "{current} von {total}",
+    "console_sidebar_title": "Navigationsleiste",
+    "console_sidebar_text": "Zugriff auf alle Module von hier. Klicken Sie auf ein Symbol, um zu diesem Bereich zu navigieren. Die Seitenleiste passt sich Ihrer Bildschirmgröße an.",
+    "console_dashboard_title": "Dashboard",
+    "console_dashboard_text": "Ihre zentrale Anlaufstelle mit Serverstatus, Online-Geräten und Schnellaktionen. Wichtige Metriken auf einen Blick.",
+    "console_devices_title": "Geräteverwaltung",
+    "console_devices_text": "Alle verbundenen Geräte anzeigen, suchen und verwalten. Nach Status filtern, Tags zuweisen und Einstellungen konfigurieren.",
+    "console_settings_title": "Einstellungen",
+    "console_settings_text": "Serververhalten, Sicherheitsoptionen, Branding und Benutzerverwaltung konfigurieren. BetterDesk an Ihre Bedürfnisse anpassen.",
+    "console_desktop_title": "Desktop-Modus",
+    "console_desktop_text": "Wechseln Sie zum Desktop-Modus für einen Arbeitsbereich mit Fenstern und Widgets. Perfekt für Multitasking und Überwachung.",
+    "desktop_widgets_title": "Widget-Dashboard",
+    "desktop_widgets_text": "Ihr anpassbarer Arbeitsbereich. Widgets zeigen Live-Informationen und bieten schnellen Zugriff auf Funktionen. Ziehen zum Neuanordnen.",
+    "desktop_add_widget_title": "Widgets hinzufügen",
+    "desktop_add_widget_text": "Klicken Sie hier, um verfügbare Widgets zu durchsuchen. Wählen Sie aus Überwachungsanzeigen, Gerätelisten, Notizen und mehr.",
+    "desktop_taskbar_title": "Taskleiste",
+    "desktop_taskbar_text": "Geöffnete Apps erscheinen hier. Klicken zum Fokussieren oder Minimieren. Die Uhr zeigt die aktuelle Zeit, die Hintergrund-Schaltfläche ändert das Wallpaper.",
+    "desktop_windows_title": "App-Fenster",
+    "desktop_windows_text": "Apps öffnen sich in verschiebbaren, größenveränderbaren Fenstern. Minimieren, maximieren oder schließen über die Titelleiste. Fenster liegen über Widgets.",
+    "desktop_search_title": "Schnellsuche",
+    "desktop_search_text": "Suchen Sie nach Geräten, Seiten und Einstellungen. Drücken Sie Strg+K, um die Suche sofort zu öffnen."
   }
 }
diff --git a/web-nodejs/lang/en.json b/web-nodejs/lang/en.json
index 4a413884..860415e2 100644
--- a/web-nodejs/lang/en.json
+++ b/web-nodejs/lang/en.json
@@ -19,7 +19,15 @@
     "info": "Information",
     "all": "All",
     "cancel": "Cancel",
-    "delete": "Delete"
+    "delete": "Delete",
+    "actions": "Actions",
+    "close": "Close",
+    "required": "required",
+    "name_required": "Name is required",
+    "active": "Active",
+    "inactive": "Inactive",
+    "invalid_json": "Invalid JSON",
+    "field_required": "{field} is required"
   },
   "nav": {
     "main": "Main",
@@ -33,6 +41,7 @@
     "users": "Users",
     "inventory": "Inventory",
     "tickets": "Tickets",
+    "help_requests": "Help Requests",
     "activity": "Activity",
     "automation": "Automation",
     "file_transfer": "File Transfer",
@@ -41,7 +50,10 @@
     "reports": "Reports",
     "tenants": "Tenants",
     "registrations": "Registrations",
-    "toggle_sidebar": "Toggle sidebar"
+    "management": "Management",
+    "toggle_sidebar": "Toggle sidebar",
+    "cdap": "CDAP Devices",
+    "tokens": "Device Tokens"
   },
   "auth": {
     "login": "Login",
@@ -157,7 +169,27 @@
     "filter_type_desktop": "Desktop",
     "filter_type_scada": "SCADA",
     "filter_type_iot": "IoT",
-    "filter_type_agent": "Agent"
+    "filter_type_agent": "Agent",
+    "cdap_connected": "CDAP Connected",
+    "revoke": "Revoke",
+    "revoke_option": "Revoke device",
+    "revoke_hint": "Block device ID and disconnect active connections",
+    "revoke_success": "Device revoked successfully",
+    "tabs": {
+      "info": "Info",
+      "hardware": "Hardware",
+      "metrics": "Metrics",
+      "history": "History"
+    },
+    "hardware": {
+      "title": "Hardware Information",
+      "os": "Operating System",
+      "cpu": "Processor",
+      "memory": "Memory",
+      "disk": "Disk",
+      "gpu": "Graphics Card",
+      "network": "Network Adapters"
+    }
   },
   "keys": {
     "title": "Server Keys",
@@ -258,7 +290,20 @@
     "time": "Time",
     "user": "User",
     "action": "Action",
-    "details": "Details"
+    "details": "Details",
+    "action_login": "Login",
+    "action_login_failed": "Login Failed",
+    "action_logout": "Logout",
+    "action_password_change": "Password Changed",
+    "action_2fa_enable": "2FA Enabled",
+    "action_2fa_disable": "2FA Disabled",
+    "action_user_create": "User Created",
+    "action_user_update": "User Updated",
+    "action_user_delete": "User Deleted",
+    "action_settings_update": "Settings Updated",
+    "action_device_ban": "Device Banned",
+    "action_device_unban": "Device Unbanned",
+    "action_device_delete": "Device Deleted"
   },
   "generator": {
     "title": "Client Configuration Generator",
@@ -314,9 +359,17 @@
   },
   "time": {
     "just_now": "Just now",
-    "minutes_ago": "{count} minute(s) ago",
-    "hours_ago": "{count} hour(s) ago",
-    "days_ago": "{count} day(s) ago"
+    "seconds_ago": "{count}s ago",
+    "minutes_ago": "{count}m ago",
+    "hours_ago": "{count}h ago",
+    "days_ago": "{count}d ago",
+    "day_mon": "Mon",
+    "day_tue": "Tue",
+    "day_wed": "Wed",
+    "day_thu": "Thu",
+    "day_fri": "Fri",
+    "day_sat": "Sat",
+    "day_sun": "Sun"
   },
   "users": {
     "title": "User Management",
@@ -544,6 +597,8 @@
     "action_native_remote_desc": "Native JPEG stream — no plugins required",
     "action_connect_desktop": "Desktop Client",
     "action_connect_desktop_desc": "Open in desktop client app",
+    "action_connect_web": "Web Remote",
+    "action_connect_web_desc": "Connect via browser remote desktop",
     "action_change_id_desc": "Change the device registration ID",
     "action_ban_desc": "Block this device from connecting",
     "action_unban_desc": "Allow this device to connect again",
@@ -629,7 +684,7 @@
     "refresh": "Refresh"
   },
   "tickets": {
-    "title": "Helpdesk",
+    "title": "Tickets",
     "subtitle": "Support tickets and issue tracking",
     "create": "New Ticket",
     "edit": "Edit Ticket",
@@ -728,7 +783,20 @@
     "category_other": "Other",
     "summary": "Summary",
     "details": "Details",
-    "refresh": "Refresh"
+    "refresh": "Refresh",
+    "search": "Search devices...",
+    "date_range": "Date Range",
+    "device_id": "Device ID",
+    "session_start": "Session Start",
+    "session_end": "Session End",
+    "user": "User",
+    "no_activity": "No activity recorded",
+    "reported_at": "Reported At",
+    "detail": "Detail",
+    "sessions": "Sessions",
+    "top_apps": "Top Applications",
+    "no_sessions": "No sessions",
+    "no_apps": "No applications"
   },
   "automation": {
     "title": "Automation & Alerts",
@@ -796,7 +864,9 @@
     "smtp_test_failed": "Connection failed",
     "no_rules": "No alert rules configured",
     "no_alerts": "No alerts triggered",
-    "no_commands": "No commands sent"
+    "no_commands": "No commands sent",
+    "no_commands_sent": "No commands have been sent yet",
+    "id_payload_required": "Device ID and payload are required"
   },
   "file_transfer": {
     "title": "File Transfer",
@@ -880,7 +950,26 @@
     "no_targets": "No monitoring targets configured",
     "no_history": "No check history available",
     "error_code": "Error",
-    "status_code": "HTTP Status Code"
+    "status_code": "HTTP Status Code",
+    "search_targets": "Search targets...",
+    "name": "Name",
+    "tab_targets": "Targets",
+    "tab_tools": "Tools",
+    "avg_latency": "Avg Latency",
+    "type": "Type",
+    "latency": "Latency",
+    "check_history": "Check History",
+    "name_host_required": "Name and host are required",
+    "uptime": "Uptime",
+    "response_time": "Response Time",
+    "avg_response": "Average Response",
+    "charts": "Charts",
+    "realtime": "Realtime",
+    "response_time_ms": "Response Time (ms)",
+    "uptime_percent": "Uptime %",
+    "last_24h": "Last 24 hours",
+    "last_7d": "Last 7 days",
+    "last_30d": "Last 30 days"
   },
   "dataguard": {
     "title": "DataGuard — DLP",
@@ -891,6 +980,7 @@
     "delete_confirm": "Are you sure you want to delete this policy?",
     "policy_name": "Name",
     "policy_description": "Description",
+    "status": "Status",
     "enabled": "Enabled",
     "disabled": "Disabled",
     "rules": "Rules",
@@ -917,6 +1007,30 @@
     "event_details": "Details",
     "no_policies": "No DLP policies configured",
     "no_events": "No DLP events recorded",
+    "total_policies": "Total Policies",
+    "active_policies": "Active Policies",
+    "violations": "Violations",
+    "blocked": "Blocked",
+    "tab_policies": "Policies",
+    "tab_events": "Events",
+    "search_policies": "Search policies...",
+    "create_policy": "Create Policy",
+    "policy_type": "Policy Type",
+    "scope": "Scope",
+    "events_count": "Events",
+    "search_events": "Search events...",
+    "event_time": "Event Time",
+    "device": "Device",
+    "policy": "Policy",
+    "detail": "Detail",
+    "scope_help": "Comma-separated device IDs, or leave empty for all",
+    "scope_all": "All Devices",
+    "active": "Active",
+    "disabled": "Disabled",
+    "type_file_type": "File Type",
+    "type_clipboard": "Clipboard",
+    "type_screen_share": "Screen Share",
+    "type_file_transfer": "File Transfer",
     "stats": "Statistics",
     "total_events": "Total Events",
     "blocked_events": "Blocked",
@@ -976,10 +1090,26 @@
     "os_distribution": "OS Distribution",
     "avg_ram": "Average RAM",
     "alert_rules": "Alert Rules",
-    "recent_alerts": "Recent Alerts"
+    "recent_alerts": "Recent Alerts",
+    "tab_generate": "Generate Report",
+    "tab_saved": "Saved Reports",
+    "type_devices_desc": "Overview of all devices, platforms and statuses",
+    "type_activity_desc": "Application usage and idle time summary",
+    "type_security_desc": "Ban actions, DLP events and audit logs",
+    "type_tickets_desc": "Ticket statistics and SLA performance",
+    "type_network_desc": "Network monitoring targets and uptime data",
+    "type_inventory_desc": "Hardware and software inventory summary",
+    "type_alerts_desc": "Alert rules and triggered alert history",
+    "report_name": "Report Name",
+    "format": "Format",
+    "save": "Save Report",
+    "preview": "Preview",
+    "download": "Download",
+    "no_saved": "No saved reports",
+    "delete_saved": "Delete Report"
   },
   "tenants": {
-    "title": "Multi-Tenancy",
+    "title": "Tenants",
     "list": "Tenants",
     "add_tenant": "Add Tenant",
     "edit_tenant": "Edit Tenant",
@@ -1004,6 +1134,22 @@
     "no_tenants": "No tenants configured",
     "no_devices": "No devices assigned to this tenant",
     "no_users": "No users assigned to this tenant",
+    "total_tenants": "Total Tenants",
+    "active_tenants": "Active Tenants",
+    "total_devices": "Total Devices",
+    "total_users": "Total Users",
+    "search": "Search tenants...",
+    "create_tenant": "Create Tenant",
+    "detail": "Tenant Detail",
+    "contact": "Contact",
+    "enabled": "Enabled",
+    "active": "Active",
+    "disabled": "Disabled",
+    "devices": "Devices",
+    "users": "Users",
+    "max": "max",
+    "info": "Tenant Info",
+    "status": "Status",
     "stats": "Tenant Statistics",
     "total_devices": "Total Devices",
     "online_devices": "Online Devices",
@@ -1038,7 +1184,20 @@
     "reject_reason_placeholder": "Enter reason for rejection...",
     "rejected_success": "Device registration rejected",
     "delete_confirm": "Are you sure you want to delete this registration record?",
-    "deleted_success": "Registration record deleted"
+    "deleted_success": "Registration record deleted",
+    "enrollment_title": "Device Enrollment",
+    "enrollment_subtitle": "Pending enrollment requests from BetterDesk desktop clients",
+    "enrollment_empty": "No pending enrollment requests",
+    "enrollment_approve": "Approve",
+    "enrollment_reject": "Reject",
+    "enrollment_display_name": "Display Name",
+    "enrollment_display_name_placeholder": "Enter a name for this device...",
+    "enrollment_sync_mode": "Sync Mode",
+    "enrollment_sync_silent": "Silent — minimal telemetry",
+    "enrollment_sync_standard": "Standard — balanced sync",
+    "enrollment_sync_turbo": "Turbo — aggressive sync",
+    "enrollment_approved_success": "Device enrollment approved",
+    "enrollment_rejected_success": "Device enrollment rejected"
   },
   "backup": {
     "title": "Backup",
@@ -1092,7 +1251,60 @@
     "cdap_connections": "Active Connections",
     "send_command": "Send Command",
     "command_sent": "Command sent successfully",
-    "command_failed": "Failed to send command"
+    "command_failed": "Failed to send command",
+    "devices_title": "CDAP Devices",
+    "devices_subtitle": "Connected devices via Custom Device Application Protocol",
+    "stat_connected": "Connected",
+    "stat_port": "Port",
+    "search_devices": "Search devices...",
+    "no_devices": "No devices connected",
+    "no_devices_desc": "No CDAP devices are currently connected. Devices will appear here once they connect to the gateway.",
+    "gateway_disabled": "CDAP Gateway Disabled",
+    "gateway_disabled_desc": "Enable the CDAP gateway by setting CDAP_ENABLED=true in the server configuration.",
+    "gateway_active": "Active",
+    "toggle_enable": "Enable CDAP",
+    "toggle_disable": "Disable CDAP",
+    "enabled_restart": "CDAP enabled. Server restart required to apply changes.",
+    "disabled_restart": "CDAP disabled. Server restart required to apply changes.",
+    "widgets": "widgets",
+    "type_all": "All",
+    "type_iot": "IoT",
+    "type_scada": "SCADA",
+    "type_os_agent": "OS Agent",
+    "type_network": "Network",
+    "type_camera": "Camera",
+    "type_custom": "Custom",
+    "active_alerts": "Active Alerts",
+    "alert_fired": "Alert fired",
+    "alert_cleared": "Alert cleared",
+    "no_alerts": "No active alerts",
+    "connect_terminal": "Connect Terminal",
+    "table_search": "Search...",
+    "just_now": "Just now",
+    "terminal_connecting": "Connecting to device...",
+    "terminal_disconnected": "Disconnected",
+    "terminal_error": "Terminal connection failed",
+    "linked_devices": "Linked Devices",
+    "link_device": "Link Device",
+    "unlink_device": "Unlink",
+    "no_linked_devices": "No linked devices",
+    "unlink_confirm": "Are you sure you want to unlink this device?",
+    "link_prompt": "Enter the Peer ID to link to this device:",
+    "connect_desktop": "Connect Desktop",
+    "connect_video": "Connect Stream",
+    "connect_files": "Browse Files",
+    "connect_audio": "Connect Audio",
+    "upload_file": "Upload",
+    "desktop_connecting": "Connecting...",
+    "video_connecting": "Connecting...",
+    "files_connecting": "Connecting...",
+    "audio_connecting": "Connecting...",
+    "audio_streaming": "Streaming",
+    "clipboard_in": "Clipboard received",
+    "clipboard_out": "Clipboard sent",
+    "monitor_select": "Select Monitor",
+    "keyframe_request": "Request Keyframe",
+    "quality_auto": "Auto Quality"
   },
   "desktop": {
     "switch_mode": "Desktop Mode",
@@ -1101,6 +1313,182 @@
     "minimize": "Minimize",
     "maximize": "Maximize",
     "restore": "Restore",
-    "close": "Close"
+    "close": "Close",
+    "widgets_mode": "Widgets",
+    "windows_mode": "Windows",
+    "wallpaper": "Wallpaper",
+    "add_widget": "Add Widget",
+    "remove_widget": "Remove Widget",
+    "configure": "Configure",
+    "search_widgets": "Search widgets...",
+    "cat_monitoring": "Monitoring",
+    "cat_devices": "Devices",
+    "cat_tools": "Tools",
+    "cat_general": "General",
+    "notes_placeholder": "Write notes here...",
+    "search_placeholder": "Search devices, pages, settings...",
+    "search_pages": "Pages",
+    "search_devices": "Devices",
+    "search_no_results": "No results",
+    "exit_desktop": "Exit Desktop",
+    "widget_clock": "Clock",
+    "widget_device_status": "Device Status",
+    "widget_server_health": "Server Info",
+    "widget_system_stats": "Device Gauges",
+    "widget_device_list": "Device List",
+    "widget_quick_actions": "Quick Actions",
+    "widget_recent_activity": "Recent Activity",
+    "widget_notes": "Notes",
+    "widget_network_monitor": "Network Monitor",
+    "widget_tickets_summary": "Tickets",
+    "widget_iframe": "Web Embed",
+    "widget_cdap_devices": "CDAP Devices",
+    "widget_uptime": "Uptime",
+    "widget_port_status": "Port Status",
+    "widget_device_grid": "Device Grid",
+    "widget_multi_gauge": "Server Gauges",
+    "widget_weekly_chart": "Weekly Activity",
+    "widget_quick_controls": "Quick Controls",
+    "widget_bandwidth": "Bandwidth",
+    "widget_connection_stats": "Connection Stats",
+    "label_online": "Online",
+    "label_offline": "Offline",
+    "label_total": "Total",
+    "label_blocked": "Blocked",
+    "label_banned": "Banned",
+    "label_active": "Active",
+    "label_service": "Service",
+    "label_port": "Port",
+    "label_uptime_prefix": "Uptime:",
+    "label_no_devices": "No devices",
+    "label_no_activity": "No activity",
+    "label_no_targets": "No targets",
+    "label_unavailable": "Unavailable",
+    "label_open": "Open",
+    "label_in_progress": "In Progress",
+    "label_resolved": "Resolved",
+    "label_set_url": "Set URL in config",
+    "label_server_uptime": "Server Uptime",
+    "label_merged_info": "Merged into Server Info widget",
+    "label_with_notes": "With Notes",
+    "label_metric": "Metric",
+    "label_count": "Count",
+    "label_total_devices": "Total Devices",
+    "label_throughput": "Throughput",
+    "label_active_relays": "Active Relays",
+    "label_total_relayed": "Total Relayed",
+    "label_total_bytes": "Total Bytes",
+    "label_filter_devices": "Filter devices...",
+    "label_all": "All",
+    "label_ban": "Ban",
+    "label_unban": "Unban",
+    "label_connect": "Connect",
+    "label_no_cdap_devices": "No CDAP devices"
+  },
+  "tokens": {
+    "title": "Device Tokens",
+    "subtitle": "Manage enrollment tokens for automated device provisioning",
+    "enrollment_mode": "Enrollment Mode",
+    "mode_open": "Open",
+    "mode_open_desc": "Any device can register without a token",
+    "mode_managed": "Managed",
+    "mode_managed_desc": "Devices need a valid token to register",
+    "mode_locked": "Locked",
+    "mode_locked_desc": "No new device registrations allowed",
+    "total": "Total Tokens",
+    "active": "Active",
+    "used": "Used",
+    "revoked": "Revoked",
+    "search_placeholder": "Search tokens...",
+    "status_pending": "Pending",
+    "status_active": "Active",
+    "status_used": "Used",
+    "status_revoked": "Revoked",
+    "status_expired": "Expired",
+    "bulk_generate": "Bulk Generate",
+    "create": "Create Token",
+    "edit": "Edit Token",
+    "token": "Token",
+    "name": "Name",
+    "status": "Status",
+    "uses": "Uses",
+    "bound_peer": "Bound Peer",
+    "expires": "Expires",
+    "created": "Created",
+    "actions": "Actions",
+    "name_placeholder": "e.g. Office PC batch",
+    "max_uses": "Max Uses",
+    "max_uses_hint": "0 = unlimited",
+    "expires_in": "Expires In",
+    "no_expiration": "No expiration",
+    "expires_1h": "1 hour",
+    "expires_24h": "24 hours",
+    "expires_7d": "7 days",
+    "expires_30d": "30 days",
+    "note": "Note",
+    "note_placeholder": "Optional note about this token...",
+    "count": "Count",
+    "count_range": "Number of tokens to generate (1-100)",
+    "name_prefix": "Name Prefix",
+    "generate": "Generate",
+    "token_created": "Token Created",
+    "tokens_generated": "Tokens Generated",
+    "copy_warning": "Copy the token now. It will not be shown again.",
+    "copy_token": "Copy Token",
+    "copied": "Copied!",
+    "revoke": "Revoke",
+    "revoke_confirm": "Are you sure you want to revoke this token? Devices already registered with it will not be affected.",
+    "revoked_success": "Token revoked successfully",
+    "no_tokens": "No tokens found",
+    "expired": "Expired",
+    "never": "Never",
+    "save": "Save",
+    "cancel": "Cancel",
+    "unlimited": "Unlimited"
+  },
+  "tutorial": {
+    "next": "Next",
+    "prev": "Previous",
+    "skip": "Skip",
+    "finish": "Finish",
+    "step_of": "{current} of {total}",
+    "console_sidebar_title": "Navigation Sidebar",
+    "console_sidebar_text": "Access all modules from here. Click any icon to navigate to that section. The sidebar adapts to your screen size.",
+    "console_dashboard_title": "Dashboard",
+    "console_dashboard_text": "Your central hub showing server status, online devices, and quick actions. Keep an eye on important metrics at a glance.",
+    "console_devices_title": "Device Management",
+    "console_devices_text": "View, search, and manage all connected devices. Filter by status, assign tags, and configure individual device settings.",
+    "console_settings_title": "Settings",
+    "console_settings_text": "Configure server behavior, security options, branding, and user management. Customize BetterDesk to fit your needs.",
+    "console_desktop_title": "Desktop Mode",
+    "console_desktop_text": "Switch to desktop mode for a windowed workspace with widgets. Perfect for multi-tasking and monitoring dashboards.",
+    "desktop_widgets_title": "Widget Dashboard",
+    "desktop_widgets_text": "Your customizable workspace. Widgets display live information and provide quick access to features. Drag to rearrange.",
+    "desktop_add_widget_title": "Add Widgets",
+    "desktop_add_widget_text": "Click here to browse available widgets. Choose from monitoring displays, device lists, notes, and more.",
+    "desktop_taskbar_title": "Taskbar",
+    "desktop_taskbar_text": "Open apps appear here. Click to focus or minimize windows. The clock shows current time and wallpaper button changes the background.",
+    "desktop_windows_title": "App Windows",
+    "desktop_windows_text": "Apps open in draggable, resizable windows. Minimize, maximize, or close from the title bar. Windows layer above widgets.",
+    "desktop_search_title": "Quick Search",
+    "desktop_search_text": "Search across devices, pages, and settings. Press Ctrl+K anywhere to open search instantly."
+  },
+  "help_request": {
+    "title": "Help Requests",
+    "subtitle": "Manage incoming help requests from desktop clients",
+    "new_request": "New Help Request",
+    "device": "Device",
+    "hostname": "Hostname",
+    "message": "Message",
+    "status": "Status",
+    "pending": "Pending",
+    "accepted": "Accepted",
+    "resolved": "Resolved",
+    "accept": "Accept",
+    "resolve": "Resolve",
+    "no_requests": "No help requests",
+    "notification": "Help request received from",
+    "stats_total": "Total",
+    "filter_all": "All"
   }
 }
diff --git a/web-nodejs/lang/es.json b/web-nodejs/lang/es.json
index 03ac5f10..ec472334 100644
--- a/web-nodejs/lang/es.json
+++ b/web-nodejs/lang/es.json
@@ -19,7 +19,15 @@
     "info": "Información",
     "all": "Todos",
     "cancel": "Cancelar",
-    "delete": "Eliminar"
+    "delete": "Eliminar",
+    "actions": "Acciones",
+    "close": "Cerrar",
+    "required": "Requerido",
+    "name_required": "El nombre es requerido",
+    "active": "Activo",
+    "inactive": "Inactivo",
+    "invalid_json": "Formato JSON inválido",
+    "field_required": "Este campo es requerido"
   },
   "nav": {
     "main": "Principal",
@@ -41,7 +49,10 @@
     "reports": "Informes",
     "tenants": "Inquilinos",
     "registrations": "Registros",
-    "toggle_sidebar": "Alternar barra lateral"
+    "toggle_sidebar": "Alternar barra lateral",
+    "cdap": "CDAP",
+    "clients": "Clientes",
+    "exit_desktop": "Salir del escritorio"
   },
   "auth": {
     "login": "Iniciar sesión",
@@ -140,7 +151,24 @@
     "bulk_delete_confirm": "¿Está seguro de que desea eliminar {count} dispositivos?",
     "bulk_delete_success": "{count} dispositivos eliminados correctamente",
     "columns": "Columnas",
-    "toggle_columns": "Alternar columnas visibles"
+    "toggle_columns": "Alternar columnas visibles",
+    "device_type": "Tipo de dispositivo",
+    "cdap_connected": "CDAP conectado",
+    "revoke": "Revocar",
+    "revoke_option": "Revocar dispositivo",
+    "revoke_hint": "Bloquear dispositivo y desconectar conexiones activas",
+    "revoke_success": "Dispositivo revocado correctamente",
+    "connect_remote": "Conectar remoto",
+    "copy_id": "Copiar ID",
+    "tabs": {
+      "details": "Detalles",
+      "notes": "Notas",
+      "hardware": "Hardware",
+      "metrics": "Métricas"
+    },
+    "live_metrics": "Métricas en vivo",
+    "history_charts": "Gráficos de historial",
+    "no_metrics": "No hay métricas disponibles"
   },
   "keys": {
     "title": "Claves del servidor",
@@ -297,6 +325,7 @@
   },
   "time": {
     "just_now": "Ahora mismo",
+    "seconds_ago": "Hace {count} segundo(s)",
     "minutes_ago": "Hace {count} minuto(s)",
     "hours_ago": "Hace {count} hora(s)",
     "days_ago": "Hace {count} día(s)"
@@ -403,7 +432,9 @@
     "delete_failed": "Error al eliminar el dispositivo",
     "change_id_failed": "Error al cambiar el ID del dispositivo",
     "bulk_delete_failed": "Error al eliminar dispositivos",
-    "sync_failed": "Error de sincronización"
+    "sync_failed": "Error de sincronización",
+    "forbidden_title": "Acceso denegado",
+    "forbidden_message": "No tiene permiso para acceder a esta página."
   },
   "remote": {
     "title": "Escritorio remoto",
@@ -709,7 +740,17 @@
     "category_other": "Otro",
     "summary": "Resumen",
     "details": "Detalles",
-    "refresh": "Actualizar"
+    "refresh": "Actualizar",
+    "session_start": "Inicio de sesión",
+    "session_end": "Fin de sesión",
+    "status": "Estado",
+    "user": "Usuario",
+    "export": "Exportar",
+    "export_csv": "Exportar como CSV",
+    "export_pdf": "Exportar como PDF",
+    "date_range": "Rango de fechas",
+    "today": "Hoy",
+    "this_week": "Esta semana"
   },
   "automation": {
     "title": "Automatización y alertas",
@@ -777,7 +818,8 @@
     "smtp_test_failed": "Error de conexión",
     "no_rules": "No hay reglas de alerta configuradas",
     "no_alerts": "No se han activado alertas",
-    "no_commands": "No se han enviado comandos"
+    "no_commands": "No se han enviado comandos",
+    "no_commands_sent": "Aún no se han enviado comandos"
   },
   "file_transfer": {
     "title": "Transferencia de archivos",
@@ -861,7 +903,16 @@
     "no_targets": "No hay objetivos de monitoreo configurados",
     "no_history": "No hay historial de verificaciones disponible",
     "error_code": "Error",
-    "status_code": "Código de estado HTTP"
+    "status_code": "Código de estado HTTP",
+    "uptime": "Tiempo de actividad",
+    "uptime_percent": "Tiempo de actividad %",
+    "response_time": "Tiempo de respuesta",
+    "avg_response_time": "Tiempo de respuesta promedio",
+    "last_24h": "Últimas 24 horas",
+    "last_7d": "Últimos 7 días",
+    "last_30d": "Últimos 30 días",
+    "charts": "Gráficos",
+    "realtime": "Tiempo real"
   },
   "dataguard": {
     "title": "DataGuard — DLP",
@@ -957,7 +1008,23 @@
     "os_distribution": "Distribución de SO",
     "avg_ram": "RAM promedio",
     "alert_rules": "Reglas de alerta",
-    "recent_alerts": "Alertas recientes"
+    "recent_alerts": "Alertas recientes",
+    "tab_generate": "Generar informe",
+    "tab_saved": "Informes guardados",
+    "type_devices_desc": "Vista general de todos los dispositivos, plataformas y estados",
+    "type_activity_desc": "Resumen de uso de aplicaciones y tiempo inactivo",
+    "type_security_desc": "Acciones de bloqueo, eventos DLP y registros de auditoría",
+    "type_tickets_desc": "Estadísticas de tickets y rendimiento SLA",
+    "type_network_desc": "Objetivos de monitoreo de red y datos de disponibilidad",
+    "type_inventory_desc": "Resumen de inventario de hardware y software",
+    "type_alerts_desc": "Reglas de alerta e historial de alertas activadas",
+    "report_name": "Nombre del informe",
+    "format": "Formato",
+    "save": "Guardar informe",
+    "preview": "Vista previa",
+    "download": "Descargar",
+    "no_saved": "No hay informes guardados",
+    "delete_saved": "Eliminar informe"
   },
   "tenants": {
     "title": "Multi-inquilino",
@@ -991,7 +1058,17 @@
     "total_users": "Total de usuarios",
     "created_at": "Creado el",
     "updated_at": "Actualizado el",
-    "slug_exists": "El slug del inquilino ya existe"
+    "slug_exists": "El slug del inquilino ya existe",
+    "total_tenants": "Total de inquilinos",
+    "active_tenants": "Inquilinos activos",
+    "search": "Buscar inquilinos...",
+    "create_tenant": "Crear inquilino",
+    "detail": "Detalle del inquilino",
+    "contact": "Contacto",
+    "enabled": "Habilitado",
+    "max": "máx",
+    "info": "Información del inquilino",
+    "status": "Estado"
   },
   "registrations": {
     "title": "Registros de dispositivos",
@@ -1051,5 +1128,173 @@
     "no_file": "No se seleccionó archivo de copia de seguridad",
     "invalid_json": "Archivo de copia de seguridad no válido: JSON no válido",
     "invalid_format": "Archivo de copia de seguridad no válido: no es una copia de BetterDesk"
+  },
+  "cdap": {
+    "title": "Dispositivos CDAP",
+    "subtitle": "Control de puentes IoT y dispositivos nativos de BetterDesk",
+    "connected": "Conectado",
+    "disconnected": "Desconectado",
+    "loading": "Cargando información del dispositivo...",
+    "device_detail": "Detalle del dispositivo",
+    "device_offline": "Dispositivo sin conexión",
+    "device_offline_hint": "Este dispositivo no está conectado actualmente a CDAP. El estado mostrado puede estar desactualizado.",
+    "no_widgets": "Este dispositivo no reporta widgets.",
+    "no_commands": "Este dispositivo no acepta comandos.",
+    "command_log": "Registro de comandos",
+    "command_log_empty": "Aún no se han enviado comandos.",
+    "command_sent": "Comando enviado",
+    "command_failed": "Error al enviar comando",
+    "confirm_command": "¿Ejecutar este comando?",
+    "command_confirm_hint": "Esto enviará el comando al dispositivo. ¿Continuar?",
+    "widget_toggle": "Alternar",
+    "widget_button": "Ejecutar",
+    "widget_slider": "Ajustar",
+    "widget_select": "Seleccionar",
+    "widget_text": "Texto",
+    "widget_gauge": "Medidor",
+    "widget_chart": "Gráfico",
+    "widget_led": "Indicador LED",
+    "group_uncategorized": "Sin categoría",
+    "status_gateway": "Estado del gateway",
+    "gateway_enabled": "Gateway CDAP habilitado",
+    "gateway_disabled": "Gateway CDAP deshabilitado",
+    "device_count": "Dispositivos conectados",
+    "refresh": "Actualizar estado",
+    "connect_audio": "Conectar audio",
+    "audio_connecting": "Conectando audio...",
+    "audio_streaming": "Audio transmitiendo",
+    "clipboard_in": "Portapapeles del dispositivo → navegador",
+    "clipboard_out": "Portapapeles del navegador → dispositivo",
+    "monitor_select": "Seleccionar monitor",
+    "keyframe_request": "Solicitar fotograma clave",
+    "quality_auto": "Calidad automática",
+    "type_os_agent": "Agente de SO",
+    "type_iot_bridge": "Puente IoT",
+    "type_custom": "Dispositivo personalizado",
+    "uptime": "Tiempo de actividad",
+    "version": "Versión",
+    "capabilities": "Capacidades",
+    "cap_telemetry": "Telemetría",
+    "cap_commands": "Comandos",
+    "cap_remote_desktop": "Escritorio remoto",
+    "cap_file_transfer": "Transferencia de archivos",
+    "cap_clipboard": "Portapapeles",
+    "terminal": "Terminal",
+    "terminal_open": "Abrir terminal",
+    "terminal_close": "Cerrar terminal",
+    "files": "Archivos",
+    "files_browse": "Explorar archivos",
+    "files_upload": "Subir archivo",
+    "files_download": "Descargar archivo",
+    "metrics": "Métricas",
+    "cpu_usage": "Uso de CPU",
+    "memory_usage": "Uso de memoria",
+    "disk_usage": "Uso de disco",
+    "no_data": "Sin datos disponibles",
+    "device_id": "ID del dispositivo",
+    "device_name": "Nombre del dispositivo",
+    "device_type": "Tipo de dispositivo",
+    "last_seen": "Última conexión",
+    "heartbeat": "Latido",
+    "heartbeat_ok": "Latido OK",
+    "heartbeat_stale": "Latido obsoleto",
+    "actions": "Acciones",
+    "disconnect": "Desconectar",
+    "disconnect_confirm": "¿Está seguro de que desea desconectar este dispositivo?",
+    "disconnected_success": "Dispositivo desconectado"
+  },
+  "desktop": {
+    "title": "Modo escritorio",
+    "subtitle": "Acceso directo a aplicaciones de la consola desde el escritorio",
+    "enter": "Entrar al modo escritorio",
+    "exit": "Salir del modo escritorio",
+    "wallpaper": "Fondo de pantalla",
+    "wallpaper_change": "Cambiar fondo",
+    "wallpaper_upload": "Subir imagen",
+    "wallpaper_reset": "Restablecer por defecto",
+    "widgets": "Widgets del escritorio",
+    "widgets_add": "Añadir widget",
+    "widgets_remove": "Eliminar widget",
+    "widgets_configure": "Configurar widget",
+    "taskbar": "Barra de tareas",
+    "taskbar_position": "Posición de la barra de tareas",
+    "taskbar_bottom": "Abajo",
+    "taskbar_top": "Arriba",
+    "taskbar_left": "Izquierda",
+    "taskbar_right": "Derecha",
+    "shortcuts": "Accesos directos",
+    "shortcut_add": "Añadir acceso directo",
+    "shortcut_edit": "Editar acceso directo",
+    "shortcut_remove": "Eliminar acceso directo",
+    "auto_hide": "Ocultar automáticamente",
+    "show_clock": "Mostrar reloj",
+    "show_notifications": "Mostrar notificaciones"
+  },
+  "tokens": {
+    "title": "Tokens de API",
+    "subtitle": "Gestionar tokens de acceso a la API para integraciones externas",
+    "list": "Tokens activos",
+    "create": "Crear token",
+    "create_title": "Crear nuevo token de API",
+    "name": "Nombre del token",
+    "name_placeholder": "Introduzca un nombre descriptivo",
+    "description": "Descripción",
+    "description_placeholder": "Descripción opcional del propósito del token",
+    "expires": "Fecha de expiración",
+    "expires_never": "Nunca",
+    "expires_30d": "30 días",
+    "expires_90d": "90 días",
+    "expires_1y": "1 año",
+    "expires_custom": "Fecha personalizada",
+    "permissions": "Permisos",
+    "permission_read": "Lectura",
+    "permission_write": "Escritura",
+    "permission_admin": "Administrador",
+    "permission_devices": "Dispositivos",
+    "permission_users": "Usuarios",
+    "permission_settings": "Configuración",
+    "created": "Creado",
+    "last_used": "Último uso",
+    "never_used": "Nunca utilizado",
+    "token_created": "Token creado correctamente",
+    "token_copied": "Token copiado al portapapeles",
+    "token_warning": "Asegúrese de copiar el token ahora. No podrá verlo de nuevo.",
+    "revoke": "Revocar token",
+    "revoke_confirm": "¿Está seguro de que desea revocar este token? Esto invalidará inmediatamente todas las peticiones de API que lo utilicen.",
+    "revoked": "Token revocado",
+    "no_tokens": "No hay tokens de API creados",
+    "scope": "Alcance",
+    "scope_full": "Acceso completo",
+    "scope_limited": "Acceso limitado",
+    "rate_limit": "Límite de tasa",
+    "rate_limit_hint": "Peticiones máximas por minuto (0 = ilimitado)",
+    "ip_whitelist": "Lista blanca de IP",
+    "ip_whitelist_hint": "Direcciones IP permitidas, una por línea (vacío = todas)",
+    "status": "Estado",
+    "status_active": "Activo",
+    "status_expired": "Expirado",
+    "status_revoked": "Revocado"
+  },
+  "tutorial": {
+    "title": "Bienvenido a BetterDesk",
+    "skip": "Saltar tutorial",
+    "next": "Siguiente",
+    "prev": "Anterior",
+    "finish": "Finalizar",
+    "step": "Paso {current} de {total}",
+    "step_welcome_title": "Bienvenido al panel BetterDesk",
+    "step_welcome_text": "Este tutorial le guiará a través de las características principales de la consola de administración.",
+    "step_sidebar_title": "Navegación por la barra lateral",
+    "step_sidebar_text": "Use la barra lateral para navegar entre diferentes secciones. Haga clic en el icono de menú para expandir o contraer.",
+    "step_devices_title": "Gestión de dispositivos",
+    "step_devices_text": "Vea y gestione todos los dispositivos conectados. Haga clic en un dispositivo para ver detalles, conectar remotamente o cambiar configuraciones.",
+    "step_dashboard_title": "Panel de control",
+    "step_dashboard_text": "El panel muestra estadísticas clave y el estado de su infraestructura de un vistazo.",
+    "step_settings_title": "Configuración",
+    "step_settings_text": "Configure los ajustes del servidor, personalice la marca y gestione su cuenta en la sección de configuración.",
+    "step_complete_title": "¡Listo!",
+    "step_complete_text": "Ahora está listo para empezar a usar BetterDesk. ¿Necesita ayuda? Consulte la documentación o contacte con soporte.",
+    "dont_show_again": "No mostrar de nuevo",
+    "restart_tutorial": "Reiniciar tutorial"
   }
 }
diff --git a/web-nodejs/lang/fr.json b/web-nodejs/lang/fr.json
index 8624b26f..7744c580 100644
--- a/web-nodejs/lang/fr.json
+++ b/web-nodejs/lang/fr.json
@@ -19,7 +19,15 @@
     "info": "Information",
     "all": "Tous",
     "cancel": "Annuler",
-    "delete": "Supprimer"
+    "delete": "Supprimer",
+    "actions": "Actions",
+    "close": "Fermer",
+    "required": "Obligatoire",
+    "name_required": "Le nom est obligatoire",
+    "active": "Actif",
+    "inactive": "Inactif",
+    "invalid_json": "Format JSON invalide",
+    "field_required": "Ce champ est obligatoire"
   },
   "nav": {
     "main": "Principal",
@@ -41,7 +49,10 @@
     "reports": "Rapports",
     "tenants": "Locataires",
     "registrations": "Inscriptions",
-    "toggle_sidebar": "Basculer la barre latérale"
+    "toggle_sidebar": "Basculer la barre latérale",
+    "cdap": "CDAP",
+    "clients": "Clients",
+    "exit_desktop": "Quitter le bureau"
   },
   "auth": {
     "login": "Connexion",
@@ -140,7 +151,24 @@
     "bulk_delete_confirm": "Êtes-vous sûr de vouloir supprimer {count} appareils ?",
     "bulk_delete_success": "{count} appareils supprimés avec succès",
     "columns": "Colonnes",
-    "toggle_columns": "Basculer les colonnes visibles"
+    "toggle_columns": "Basculer les colonnes visibles",
+    "device_type": "Type d'appareil",
+    "cdap_connected": "CDAP connecté",
+    "revoke": "Révoquer",
+    "revoke_option": "Révoquer l'appareil",
+    "revoke_hint": "Bloquer l'appareil et déconnecter les connexions actives",
+    "revoke_success": "Appareil révoqué avec succès",
+    "connect_remote": "Connexion distante",
+    "copy_id": "Copier l'ID",
+    "tabs": {
+      "details": "Détails",
+      "notes": "Notes",
+      "hardware": "Matériel",
+      "metrics": "Métriques"
+    },
+    "live_metrics": "Métriques en direct",
+    "history_charts": "Graphiques d'historique",
+    "no_metrics": "Aucune métrique disponible"
   },
   "keys": {
     "title": "Clés du serveur",
@@ -297,6 +325,7 @@
   },
   "time": {
     "just_now": "À l'instant",
+    "seconds_ago": "Il y a {count} seconde(s)",
     "minutes_ago": "Il y a {count} minute(s)",
     "hours_ago": "Il y a {count} heure(s)",
     "days_ago": "Il y a {count} jour(s)"
@@ -403,7 +432,9 @@
     "delete_failed": "Échec de la suppression de l'appareil",
     "change_id_failed": "Échec du changement d'ID de l'appareil",
     "bulk_delete_failed": "Échec de la suppression des appareils",
-    "sync_failed": "Échec de la synchronisation"
+    "sync_failed": "Échec de la synchronisation",
+    "forbidden_title": "Accès refusé",
+    "forbidden_message": "Vous n'avez pas la permission d'accéder à cette page."
   },
   "remote": {
     "title": "Bureau à distance",
@@ -709,7 +740,17 @@
     "category_other": "Autre",
     "summary": "Résumé",
     "details": "Détails",
-    "refresh": "Actualiser"
+    "refresh": "Actualiser",
+    "session_start": "Début de session",
+    "session_end": "Fin de session",
+    "status": "Statut",
+    "user": "Utilisateur",
+    "export": "Exporter",
+    "export_csv": "Exporter en CSV",
+    "export_pdf": "Exporter en PDF",
+    "date_range": "Plage de dates",
+    "today": "Aujourd'hui",
+    "this_week": "Cette semaine"
   },
   "automation": {
     "title": "Automatisation & Alertes",
@@ -777,7 +818,8 @@
     "smtp_test_failed": "Échec de la connexion",
     "no_rules": "Aucune règle d'alerte configurée",
     "no_alerts": "Aucune alerte déclenchée",
-    "no_commands": "Aucune commande envoyée"
+    "no_commands": "Aucune commande envoyée",
+    "no_commands_sent": "Aucune commande envoyée pour le moment"
   },
   "file_transfer": {
     "title": "Transfert de fichiers",
@@ -861,7 +903,16 @@
     "no_targets": "Aucune cible de surveillance configurée",
     "no_history": "Aucun historique de vérification disponible",
     "error_code": "Erreur",
-    "status_code": "Code de statut HTTP"
+    "status_code": "Code de statut HTTP",
+    "uptime": "Disponibilité",
+    "uptime_percent": "Disponibilité %",
+    "response_time": "Temps de réponse",
+    "avg_response_time": "Temps de réponse moyen",
+    "last_24h": "Dernières 24 heures",
+    "last_7d": "7 derniers jours",
+    "last_30d": "30 derniers jours",
+    "charts": "Graphiques",
+    "realtime": "Temps réel"
   },
   "dataguard": {
     "title": "DataGuard — DLP",
@@ -957,7 +1008,23 @@
     "os_distribution": "Distribution des OS",
     "avg_ram": "RAM moyenne",
     "alert_rules": "Règles d'alerte",
-    "recent_alerts": "Alertes récentes"
+    "recent_alerts": "Alertes récentes",
+    "tab_generate": "Générer un rapport",
+    "tab_saved": "Rapports enregistrés",
+    "type_devices_desc": "Vue d'ensemble de tous les appareils, plateformes et statuts",
+    "type_activity_desc": "Résumé de l'utilisation des applications et du temps d'inactivité",
+    "type_security_desc": "Actions de bannissement, événements DLP et journaux d'audit",
+    "type_tickets_desc": "Statistiques des tickets et performance SLA",
+    "type_network_desc": "Cibles de surveillance réseau et données de disponibilité",
+    "type_inventory_desc": "Résumé de l'inventaire matériel et logiciel",
+    "type_alerts_desc": "Règles d'alerte et historique des alertes déclenchées",
+    "report_name": "Nom du rapport",
+    "format": "Format",
+    "save": "Enregistrer le rapport",
+    "preview": "Aperçu",
+    "download": "Télécharger",
+    "no_saved": "Aucun rapport enregistré",
+    "delete_saved": "Supprimer le rapport"
   },
   "tenants": {
     "title": "Multi-location",
@@ -991,7 +1058,17 @@
     "total_users": "Total des utilisateurs",
     "created_at": "Créé le",
     "updated_at": "Mis à jour le",
-    "slug_exists": "Le slug du locataire existe déjà"
+    "slug_exists": "Le slug du locataire existe déjà",
+    "total_tenants": "Total des locataires",
+    "active_tenants": "Locataires actifs",
+    "search": "Rechercher des locataires...",
+    "create_tenant": "Créer un locataire",
+    "detail": "Détail du locataire",
+    "contact": "Contact",
+    "enabled": "Activé",
+    "max": "max",
+    "info": "Informations du locataire",
+    "status": "Statut"
   },
   "registrations": {
     "title": "Inscriptions des appareils",
@@ -1051,5 +1128,173 @@
     "no_file": "Aucun fichier de sauvegarde sélectionné",
     "invalid_json": "Fichier de sauvegarde invalide : JSON non valide",
     "invalid_format": "Fichier de sauvegarde invalide : pas une sauvegarde BetterDesk"
+  },
+  "cdap": {
+    "title": "Appareils CDAP",
+    "subtitle": "Contrôle des ponts IoT et des appareils natifs BetterDesk",
+    "connected": "Connecté",
+    "disconnected": "Déconnecté",
+    "loading": "Chargement des informations de l'appareil...",
+    "device_detail": "Détail de l'appareil",
+    "device_offline": "Appareil hors ligne",
+    "device_offline_hint": "Cet appareil n'est actuellement pas connecté à CDAP. L'état affiché peut être obsolète.",
+    "no_widgets": "Cet appareil ne signale aucun widget.",
+    "no_commands": "Cet appareil n'accepte pas de commandes.",
+    "command_log": "Journal des commandes",
+    "command_log_empty": "Aucune commande envoyée pour le moment.",
+    "command_sent": "Commande envoyée",
+    "command_failed": "Échec de l'envoi de la commande",
+    "confirm_command": "Exécuter cette commande ?",
+    "command_confirm_hint": "Cela enverra la commande à l'appareil. Continuer ?",
+    "widget_toggle": "Basculer",
+    "widget_button": "Exécuter",
+    "widget_slider": "Ajuster",
+    "widget_select": "Sélectionner",
+    "widget_text": "Texte",
+    "widget_gauge": "Jauge",
+    "widget_chart": "Graphique",
+    "widget_led": "Indicateur LED",
+    "group_uncategorized": "Non catégorisé",
+    "status_gateway": "État de la passerelle",
+    "gateway_enabled": "Passerelle CDAP activée",
+    "gateway_disabled": "Passerelle CDAP désactivée",
+    "device_count": "Appareils connectés",
+    "refresh": "Actualiser l'état",
+    "connect_audio": "Connecter l'audio",
+    "audio_connecting": "Connexion audio...",
+    "audio_streaming": "Audio en streaming",
+    "clipboard_in": "Presse-papiers appareil → navigateur",
+    "clipboard_out": "Presse-papiers navigateur → appareil",
+    "monitor_select": "Sélectionner le moniteur",
+    "keyframe_request": "Demander une image clé",
+    "quality_auto": "Qualité automatique",
+    "type_os_agent": "Agent OS",
+    "type_iot_bridge": "Pont IoT",
+    "type_custom": "Appareil personnalisé",
+    "uptime": "Disponibilité",
+    "version": "Version",
+    "capabilities": "Capacités",
+    "cap_telemetry": "Télémétrie",
+    "cap_commands": "Commandes",
+    "cap_remote_desktop": "Bureau à distance",
+    "cap_file_transfer": "Transfert de fichiers",
+    "cap_clipboard": "Presse-papiers",
+    "terminal": "Terminal",
+    "terminal_open": "Ouvrir le terminal",
+    "terminal_close": "Fermer le terminal",
+    "files": "Fichiers",
+    "files_browse": "Parcourir les fichiers",
+    "files_upload": "Télécharger vers",
+    "files_download": "Télécharger depuis",
+    "metrics": "Métriques",
+    "cpu_usage": "Utilisation CPU",
+    "memory_usage": "Utilisation mémoire",
+    "disk_usage": "Utilisation disque",
+    "no_data": "Aucune donnée disponible",
+    "device_id": "ID de l'appareil",
+    "device_name": "Nom de l'appareil",
+    "device_type": "Type d'appareil",
+    "last_seen": "Dernière connexion",
+    "heartbeat": "Heartbeat",
+    "heartbeat_ok": "Heartbeat OK",
+    "heartbeat_stale": "Heartbeat obsolète",
+    "actions": "Actions",
+    "disconnect": "Déconnecter",
+    "disconnect_confirm": "Êtes-vous sûr de vouloir déconnecter cet appareil ?",
+    "disconnected_success": "Appareil déconnecté"
+  },
+  "desktop": {
+    "title": "Mode bureau",
+    "subtitle": "Accès direct aux applications de la console depuis le bureau",
+    "enter": "Entrer en mode bureau",
+    "exit": "Quitter le mode bureau",
+    "wallpaper": "Fond d'écran",
+    "wallpaper_change": "Changer le fond d'écran",
+    "wallpaper_upload": "Télécharger une image",
+    "wallpaper_reset": "Réinitialiser par défaut",
+    "widgets": "Widgets du bureau",
+    "widgets_add": "Ajouter un widget",
+    "widgets_remove": "Supprimer le widget",
+    "widgets_configure": "Configurer le widget",
+    "taskbar": "Barre des tâches",
+    "taskbar_position": "Position de la barre des tâches",
+    "taskbar_bottom": "En bas",
+    "taskbar_top": "En haut",
+    "taskbar_left": "À gauche",
+    "taskbar_right": "À droite",
+    "shortcuts": "Raccourcis",
+    "shortcut_add": "Ajouter un raccourci",
+    "shortcut_edit": "Modifier le raccourci",
+    "shortcut_remove": "Supprimer le raccourci",
+    "auto_hide": "Masquer automatiquement",
+    "show_clock": "Afficher l'horloge",
+    "show_notifications": "Afficher les notifications"
+  },
+  "tokens": {
+    "title": "Jetons API",
+    "subtitle": "Gérer les jetons d'accès API pour les intégrations externes",
+    "list": "Jetons actifs",
+    "create": "Créer un jeton",
+    "create_title": "Créer un nouveau jeton API",
+    "name": "Nom du jeton",
+    "name_placeholder": "Entrez un nom descriptif",
+    "description": "Description",
+    "description_placeholder": "Description facultative de l'utilisation du jeton",
+    "expires": "Date d'expiration",
+    "expires_never": "Jamais",
+    "expires_30d": "30 jours",
+    "expires_90d": "90 jours",
+    "expires_1y": "1 an",
+    "expires_custom": "Date personnalisée",
+    "permissions": "Permissions",
+    "permission_read": "Lecture",
+    "permission_write": "Écriture",
+    "permission_admin": "Admin",
+    "permission_devices": "Appareils",
+    "permission_users": "Utilisateurs",
+    "permission_settings": "Paramètres",
+    "created": "Créé",
+    "last_used": "Dernière utilisation",
+    "never_used": "Jamais utilisé",
+    "token_created": "Jeton créé avec succès",
+    "token_copied": "Jeton copié dans le presse-papiers",
+    "token_warning": "Assurez-vous de copier le jeton maintenant. Vous ne pourrez plus le voir.",
+    "revoke": "Révoquer le jeton",
+    "revoke_confirm": "Êtes-vous sûr de vouloir révoquer ce jeton ? Cela invalidera immédiatement toutes les requêtes API qui l'utilisent.",
+    "revoked": "Jeton révoqué",
+    "no_tokens": "Aucun jeton API créé",
+    "scope": "Portée",
+    "scope_full": "Accès complet",
+    "scope_limited": "Accès limité",
+    "rate_limit": "Limite de taux",
+    "rate_limit_hint": "Requêtes max par minute (0 = illimité)",
+    "ip_whitelist": "Liste blanche IP",
+    "ip_whitelist_hint": "Adresses IP autorisées, une par ligne (vide = toutes)",
+    "status": "Statut",
+    "status_active": "Actif",
+    "status_expired": "Expiré",
+    "status_revoked": "Révoqué"
+  },
+  "tutorial": {
+    "title": "Bienvenue sur BetterDesk",
+    "skip": "Passer le tutoriel",
+    "next": "Suivant",
+    "prev": "Précédent",
+    "finish": "Terminer",
+    "step": "Étape {current} sur {total}",
+    "step_welcome_title": "Bienvenue sur le tableau de bord BetterDesk",
+    "step_welcome_text": "Ce tutoriel vous guidera à travers les principales fonctionnalités de la console d'administration.",
+    "step_sidebar_title": "Navigation dans la barre latérale",
+    "step_sidebar_text": "Utilisez la barre latérale pour naviguer entre les différentes sections. Cliquez sur l'icône du menu pour développer ou réduire.",
+    "step_devices_title": "Gestion des appareils",
+    "step_devices_text": "Consultez et gérez tous les appareils connectés. Cliquez sur un appareil pour voir les détails, vous connecter à distance ou modifier les paramètres.",
+    "step_dashboard_title": "Tableau de bord",
+    "step_dashboard_text": "Le tableau de bord affiche les statistiques clés et l'état de votre infrastructure en un coup d'œil.",
+    "step_settings_title": "Paramètres",
+    "step_settings_text": "Configurez les paramètres du serveur, personnalisez la marque et gérez votre compte dans la section paramètres.",
+    "step_complete_title": "Terminé !",
+    "step_complete_text": "Vous êtes maintenant prêt à utiliser BetterDesk. Besoin d'aide ? Consultez la documentation ou contactez le support.",
+    "dont_show_again": "Ne plus afficher",
+    "restart_tutorial": "Relancer le tutoriel"
   }
 }
diff --git a/web-nodejs/lang/it.json b/web-nodejs/lang/it.json
index 8d420804..35595cee 100644
--- a/web-nodejs/lang/it.json
+++ b/web-nodejs/lang/it.json
@@ -19,7 +19,15 @@
     "info": "Informazione",
     "all": "Tutti",
     "cancel": "Annulla",
-    "delete": "Elimina"
+    "delete": "Elimina",
+    "actions": "Azioni",
+    "close": "Chiudi",
+    "required": "Obbligatorio",
+    "name_required": "Il nome è obbligatorio",
+    "active": "Attivo",
+    "inactive": "Inattivo",
+    "invalid_json": "Formato JSON non valido",
+    "field_required": "Questo campo è obbligatorio"
   },
   "nav": {
     "main": "Principale",
@@ -41,7 +49,10 @@
     "reports": "Report",
     "tenants": "Tenant",
     "registrations": "Registrazioni",
-    "toggle_sidebar": "Attiva/disattiva barra laterale"
+    "toggle_sidebar": "Attiva/disattiva barra laterale",
+    "cdap": "CDAP",
+    "clients": "Client",
+    "exit_desktop": "Esci dal desktop"
   },
   "auth": {
     "login": "Accedi",
@@ -140,7 +151,24 @@
     "bulk_delete_confirm": "Sei sicuro di voler eliminare {count} dispositivi?",
     "bulk_delete_success": "{count} dispositivi eliminati con successo",
     "columns": "Colonne",
-    "toggle_columns": "Attiva/disattiva colonne visibili"
+    "toggle_columns": "Attiva/disattiva colonne visibili",
+    "device_type": "Tipo di dispositivo",
+    "cdap_connected": "CDAP connesso",
+    "revoke": "Revoca",
+    "revoke_option": "Revoca dispositivo",
+    "revoke_hint": "Blocca dispositivo e disconnetti connessioni attive",
+    "revoke_success": "Dispositivo revocato con successo",
+    "connect_remote": "Connetti remoto",
+    "copy_id": "Copia ID",
+    "tabs": {
+      "details": "Dettagli",
+      "notes": "Note",
+      "hardware": "Hardware",
+      "metrics": "Metriche"
+    },
+    "live_metrics": "Metriche in tempo reale",
+    "history_charts": "Grafici storici",
+    "no_metrics": "Nessuna metrica disponibile"
   },
   "keys": {
     "title": "Chiavi del server",
@@ -297,6 +325,7 @@
   },
   "time": {
     "just_now": "Proprio ora",
+    "seconds_ago": "{count} secondo/i fa",
     "minutes_ago": "{count} minuto/i fa",
     "hours_ago": "{count} ora/e fa",
     "days_ago": "{count} giorno/i fa"
@@ -403,7 +432,9 @@
     "delete_failed": "Eliminazione dispositivo fallita",
     "change_id_failed": "Cambio ID dispositivo fallito",
     "bulk_delete_failed": "Eliminazione dispositivi fallita",
-    "sync_failed": "Sincronizzazione fallita"
+    "sync_failed": "Sincronizzazione fallita",
+    "forbidden_title": "Accesso negato",
+    "forbidden_message": "Non hai i permessi per accedere a questa pagina."
   },
   "remote": {
     "title": "Desktop remoto",
@@ -709,7 +740,17 @@
     "category_other": "Altro",
     "summary": "Riepilogo",
     "details": "Dettagli",
-    "refresh": "Aggiorna"
+    "refresh": "Aggiorna",
+    "session_start": "Inizio sessione",
+    "session_end": "Fine sessione",
+    "status": "Stato",
+    "user": "Utente",
+    "export": "Esporta",
+    "export_csv": "Esporta come CSV",
+    "export_pdf": "Esporta come PDF",
+    "date_range": "Intervallo date",
+    "today": "Oggi",
+    "this_week": "Questa settimana"
   },
   "automation": {
     "title": "Automazione e avvisi",
@@ -777,7 +818,8 @@
     "smtp_test_failed": "Connessione fallita",
     "no_rules": "Nessuna regola di allarme configurata",
     "no_alerts": "Nessun avviso attivato",
-    "no_commands": "Nessun comando inviato"
+    "no_commands": "Nessun comando inviato",
+    "no_commands_sent": "Nessun comando ancora inviato"
   },
   "file_transfer": {
     "title": "Trasferimento file",
@@ -861,7 +903,16 @@
     "no_targets": "Nessun obiettivo di monitoraggio configurato",
     "no_history": "Nessuno storico controlli disponibile",
     "error_code": "Errore",
-    "status_code": "Codice stato HTTP"
+    "status_code": "Codice stato HTTP",
+    "uptime": "Tempo di attività",
+    "uptime_percent": "Tempo di attività %",
+    "response_time": "Tempo di risposta",
+    "avg_response_time": "Tempo di risposta medio",
+    "last_24h": "Ultime 24 ore",
+    "last_7d": "Ultimi 7 giorni",
+    "last_30d": "Ultimi 30 giorni",
+    "charts": "Grafici",
+    "realtime": "Tempo reale"
   },
   "dataguard": {
     "title": "DataGuard — DLP",
@@ -957,7 +1008,23 @@
     "os_distribution": "Distribuzione SO",
     "avg_ram": "RAM media",
     "alert_rules": "Regole di allarme",
-    "recent_alerts": "Avvisi recenti"
+    "recent_alerts": "Avvisi recenti",
+    "tab_generate": "Genera report",
+    "tab_saved": "Report salvati",
+    "type_devices_desc": "Panoramica di tutti i dispositivi, piattaforme e stati",
+    "type_activity_desc": "Riepilogo utilizzo applicazioni e tempo di inattività",
+    "type_security_desc": "Azioni di ban, eventi DLP e log di audit",
+    "type_tickets_desc": "Statistiche ticket e performance SLA",
+    "type_network_desc": "Obiettivi di monitoraggio rete e dati di disponibilità",
+    "type_inventory_desc": "Riepilogo inventario hardware e software",
+    "type_alerts_desc": "Regole di allarme e storico degli avvisi attivati",
+    "report_name": "Nome report",
+    "format": "Formato",
+    "save": "Salva report",
+    "preview": "Anteprima",
+    "download": "Scarica",
+    "no_saved": "Nessun report salvato",
+    "delete_saved": "Elimina report"
   },
   "tenants": {
     "title": "Multi-tenancy",
@@ -991,7 +1058,17 @@
     "total_users": "Totale utenti",
     "created_at": "Creato il",
     "updated_at": "Aggiornato il",
-    "slug_exists": "Lo slug del tenant esiste già"
+    "slug_exists": "Lo slug del tenant esiste già",
+    "total_tenants": "Totale tenant",
+    "active_tenants": "Tenant attivi",
+    "search": "Cerca tenant...",
+    "create_tenant": "Crea tenant",
+    "detail": "Dettaglio tenant",
+    "contact": "Contatto",
+    "enabled": "Abilitato",
+    "max": "Max",
+    "info": "Informazioni tenant",
+    "status": "Stato"
   },
   "registrations": {
     "title": "Registrazioni dispositivi",
@@ -1051,5 +1128,186 @@
     "no_file": "Nessun file di backup selezionato",
     "invalid_json": "File di backup non valido: JSON non valido",
     "invalid_format": "File di backup non valido: non è un backup BetterDesk"
+  },
+  "cdap": {
+    "title": "Dispositivi CDAP",
+    "device_detail": "Dettagli dispositivo",
+    "loading": "Caricamento...",
+    "connected": "Connesso",
+    "disconnected": "Disconnesso",
+    "widgets": "Widget",
+    "commands": "Comandi",
+    "no_widgets": "Nessun widget disponibile",
+    "no_commands": "Nessun comando inviato",
+    "command_sent": "Comando inviato con successo",
+    "command_failed": "Impossibile inviare il comando",
+    "device_offline": "Dispositivo offline",
+    "device_info": "Informazioni dispositivo",
+    "device_type": "Tipo dispositivo",
+    "device_version": "Versione",
+    "device_uptime": "Tempo di attività",
+    "last_seen": "Ultima connessione",
+    "capabilities": "Capacità",
+    "telemetry": "Telemetria",
+    "remote_desktop": "Desktop remoto",
+    "file_transfer": "Trasferimento file",
+    "clipboard": "Appunti",
+    "command_log": "Registro comandi",
+    "command_id": "ID comando",
+    "command_type": "Tipo",
+    "command_time": "Ora",
+    "command_status": "Stato",
+    "status_pending": "In attesa",
+    "status_sent": "Inviato",
+    "status_success": "Completato",
+    "status_error": "Errore",
+    "widget_toggle": "Interruttore",
+    "widget_gauge": "Indicatore",
+    "widget_button": "Pulsante",
+    "widget_led": "LED",
+    "widget_text": "Testo",
+    "widget_slider": "Cursore",
+    "widget_select": "Selezione",
+    "widget_chart": "Grafico",
+    "widget_terminal": "Terminale",
+    "confirm_action": "Conferma azione",
+    "confirm_message": "Sei sicuro di voler eseguire questa azione?",
+    "yes": "Sì",
+    "no": "No",
+    "connect_audio": "Connetti audio",
+    "audio_connecting": "Connessione audio...",
+    "audio_streaming": "Audio in streaming",
+    "clipboard_in": "Appunti in entrata",
+    "clipboard_out": "Appunti in uscita",
+    "monitor_select": "Seleziona monitor",
+    "keyframe_request": "Richiedi keyframe",
+    "quality_auto": "Qualità automatica",
+    "desktop_status": "Stato desktop",
+    "desktop_connecting": "Connessione desktop...",
+    "desktop_connected": "Desktop connesso",
+    "desktop_disconnected": "Desktop non connesso",
+    "desktop_failed": "Connessione desktop fallita",
+    "file_browser": "Browser file",
+    "file_browser_title": "Browser file",
+    "file_path": "Percorso",
+    "file_name": "Nome file",
+    "file_size": "Dimensione",
+    "file_modified": "Modificato",
+    "file_upload": "Carica file",
+    "file_download": "Scarica file",
+    "file_delete": "Elimina file",
+    "file_refresh": "Aggiorna",
+    "terminal_title": "Terminale",
+    "terminal_clear": "Cancella",
+    "terminal_resize": "Ridimensiona",
+    "screenshot": "Screenshot",
+    "screenshot_capture": "Cattura screenshot",
+    "screenshot_captured": "Screenshot catturato",
+    "screenshot_failed": "Cattura screenshot fallita",
+    "cpu_usage": "Utilizzo CPU",
+    "memory_usage": "Utilizzo memoria",
+    "disk_usage": "Utilizzo disco",
+    "hostname": "Nome host",
+    "system_uptime": "Uptime sistema"
+  },
+  "desktop": {
+    "unified_mode": "Modalità unificata",
+    "exit_unified": "Esci dalla modalità unificata",
+    "fullscreen": "Schermo intero",
+    "exit_fullscreen": "Esci dallo schermo intero",
+    "picture_in_picture": "Picture-in-Picture",
+    "exit_pip": "Esci da PiP",
+    "settings": "Impostazioni",
+    "quality": "Qualità",
+    "quality_low": "Bassa",
+    "quality_medium": "Media",
+    "quality_high": "Alta",
+    "quality_best": "Ottima",
+    "fps": "FPS",
+    "audio": "Audio",
+    "audio_enabled": "Audio abilitato",
+    "audio_disabled": "Audio disabilitato",
+    "clipboard_sync": "Sincronizza appunti",
+    "keyboard_shortcuts": "Scorciatoie tastiera",
+    "ctrl_alt_del": "Invia Ctrl+Alt+Del",
+    "disconnect": "Disconnetti",
+    "reconnect": "Riconnetti",
+    "connection_status": "Stato connessione",
+    "connecting": "Connessione...",
+    "connected": "Connesso",
+    "disconnected": "Disconnesso",
+    "latency": "Latenza",
+    "bandwidth": "Larghezza di banda"
+  },
+  "tokens": {
+    "title": "Token di accesso",
+    "subtitle": "Gestisci i token di accesso API per integrazioni e automazione",
+    "create": "Crea token",
+    "create_title": "Crea nuovo token",
+    "name": "Nome token",
+    "name_placeholder": "Inserisci il nome del token",
+    "description": "Descrizione",
+    "description_placeholder": "Descrizione opzionale per questo token",
+    "expiration": "Scadenza",
+    "no_expiration": "Nessuna scadenza",
+    "days_30": "30 giorni",
+    "days_60": "60 giorni",
+    "days_90": "90 giorni",
+    "days_180": "180 giorni",
+    "days_365": "1 anno",
+    "permissions": "Permessi",
+    "perm_read": "Lettura",
+    "perm_read_desc": "Accesso in sola lettura ai dati",
+    "perm_write": "Scrittura",
+    "perm_write_desc": "Crea e modifica risorse",
+    "perm_delete": "Eliminazione",
+    "perm_delete_desc": "Elimina risorse",
+    "perm_admin": "Amministratore",
+    "perm_admin_desc": "Accesso amministrativo completo",
+    "created": "Token creato con successo",
+    "copy_warning": "Copia questo token adesso. Non potrai vederlo di nuovo!",
+    "copy_token": "Copia token",
+    "copied": "Token copiato negli appunti",
+    "no_tokens": "Nessun token creato",
+    "no_tokens_desc": "Crea il tuo primo token di accesso per iniziare",
+    "col_name": "Nome",
+    "col_created": "Creato",
+    "col_expires": "Scade",
+    "col_last_used": "Ultimo utilizzo",
+    "col_actions": "Azioni",
+    "never_used": "Mai usato",
+    "never_expires": "Mai",
+    "expired": "Scaduto",
+    "revoke": "Revoca",
+    "revoke_title": "Revoca token",
+    "revoke_confirm": "Sei sicuro di voler revocare questo token? Questa azione non può essere annullata.",
+    "revoked": "Token revocato con successo",
+    "delete_confirm": "Sei sicuro di voler eliminare questo token?"
+  },
+  "tutorial": {
+    "welcome": "Benvenuto in BetterDesk",
+    "welcome_message": "Facciamo un breve tour per iniziare con il pannello di amministrazione.",
+    "step_dashboard": "Dashboard",
+    "step_dashboard_desc": "Visualizza statistiche generali, stato dei dispositivi e attività recenti.",
+    "step_devices": "Dispositivi",
+    "step_devices_desc": "Gestisci tutti i dispositivi connessi, gruppi e rubriche.",
+    "step_users": "Utenti",
+    "step_users_desc": "Crea e gestisci gli account utente con diversi livelli di permessi.",
+    "step_settings": "Impostazioni",
+    "step_settings_desc": "Configura le impostazioni del server, i temi e le preferenze.",
+    "step_complete": "Tour completato!",
+    "step_complete_desc": "Sei pronto per iniziare a usare BetterDesk. Buon lavoro!",
+    "next": "Avanti",
+    "previous": "Indietro",
+    "skip": "Salta tour",
+    "finish": "Fine",
+    "dont_show": "Non mostrare più",
+    "restart_tour": "Riavvia tour",
+    "help": "Aiuto",
+    "help_center": "Centro assistenza",
+    "documentation": "Documentazione",
+    "keyboard_shortcuts": "Scorciatoie tastiera",
+    "report_issue": "Segnala problema"
   }
 }
+
diff --git a/web-nodejs/lang/nl.json b/web-nodejs/lang/nl.json
index 61f94222..f2886c21 100644
--- a/web-nodejs/lang/nl.json
+++ b/web-nodejs/lang/nl.json
@@ -19,7 +19,15 @@
     "info": "Informatie",
     "all": "Alle",
     "cancel": "Annuleren",
-    "delete": "Verwijderen"
+    "delete": "Verwijderen",
+    "actions": "Acties",
+    "close": "Sluiten",
+    "required": "Vereist",
+    "name_required": "Naam is vereist",
+    "active": "Actief",
+    "inactive": "Inactief",
+    "invalid_json": "Ongeldige JSON",
+    "field_required": "Dit veld is vereist"
   },
   "nav": {
     "main": "Hoofdmenu",
@@ -41,7 +49,10 @@
     "reports": "Rapporten",
     "tenants": "Tenants",
     "registrations": "Registraties",
-    "toggle_sidebar": "Zijbalk in-/uitschakelen"
+    "toggle_sidebar": "Zijbalk in-/uitschakelen",
+    "cdap": "CDAP Apparaten",
+    "clients": "Clients",
+    "exit_desktop": "Bureaublad afsluiten"
   },
   "auth": {
     "login": "Inloggen",
@@ -140,7 +151,28 @@
     "bulk_delete_confirm": "Weet u zeker dat u {count} apparaten wilt verwijderen?",
     "bulk_delete_success": "{count} apparaten succesvol verwijderd",
     "columns": "Kolommen",
-    "toggle_columns": "Zichtbare kolommen in-/uitschakelen"
+    "toggle_columns": "Zichtbare kolommen in-/uitschakelen",
+    "device_type": "Apparaattype",
+    "cdap_connected": "CDAP Verbonden",
+    "revoke": "Intrekken",
+    "revoke_option": "Apparaat intrekken",
+    "revoke_hint": "Blokkeer apparaat-ID en verbreek actieve verbindingen",
+    "revoke_success": "Apparaat succesvol ingetrokken",
+    "tabs": {
+      "info": "Info",
+      "hardware": "Hardware",
+      "metrics": "Metrieken",
+      "history": "Geschiedenis"
+    },
+    "hardware": {
+      "title": "Hardware-informatie",
+      "os": "Besturingssysteem",
+      "cpu": "Processor",
+      "memory": "Geheugen",
+      "disk": "Schijf",
+      "gpu": "Grafische kaart",
+      "network": "Netwerkadapters"
+    }
   },
   "keys": {
     "title": "Serversleutels",
@@ -297,6 +329,7 @@
   },
   "time": {
     "just_now": "Zojuist",
+    "seconds_ago": "{count} seconde(n) geleden",
     "minutes_ago": "{count} minu(u)t(en) geleden",
     "hours_ago": "{count} u(u)r(en) geleden",
     "days_ago": "{count} dag(en) geleden"
@@ -403,7 +436,9 @@
     "delete_failed": "Verwijderen van apparaat mislukt",
     "change_id_failed": "Wijzigen van apparaat-ID mislukt",
     "bulk_delete_failed": "Verwijderen van apparaten mislukt",
-    "sync_failed": "Synchronisatie mislukt"
+    "sync_failed": "Synchronisatie mislukt",
+    "forbidden_title": "Toegang geweigerd",
+    "forbidden_message": "U heeft geen toestemming om deze pagina te bekijken."
   },
   "remote": {
     "title": "Extern bureaublad",
@@ -709,7 +744,17 @@
     "category_other": "Overig",
     "summary": "Samenvatting",
     "details": "Details",
-    "refresh": "Vernieuwen"
+    "refresh": "Vernieuwen",
+    "session_start": "Sessiestart",
+    "session_end": "Sessieeinde",
+    "status": "Status",
+    "user": "Gebruiker",
+    "export": "Exporteren",
+    "export_csv": "Exporteren als CSV",
+    "export_json": "Exporteren als JSON",
+    "time_range": "Tijdsbereik",
+    "today": "Vandaag",
+    "last_7_days": "Laatste 7 dagen"
   },
   "automation": {
     "title": "Automatisering en waarschuwingen",
@@ -777,7 +822,8 @@
     "smtp_test_failed": "Verbinding mislukt",
     "no_rules": "Geen alarmregels geconfigureerd",
     "no_alerts": "Geen geactiveerde waarschuwingen",
-    "no_commands": "Geen commando's verzonden"
+    "no_commands": "Geen commando's verzonden",
+    "no_commands_sent": "Nog geen commando's verzonden"
   },
   "file_transfer": {
     "title": "Bestandsoverdracht",
@@ -861,7 +907,17 @@
     "no_targets": "Geen monitoringdoelen geconfigureerd",
     "no_history": "Geen controlegeschiedenis beschikbaar",
     "error_code": "Fout",
-    "status_code": "HTTP-statuscode"
+    "status_code": "HTTP-statuscode",
+    "uptime": "Uptime",
+    "response_time": "Reactietijd",
+    "avg_response": "Gemiddelde reactie",
+    "charts": "Grafieken",
+    "realtime": "Realtime",
+    "response_time_ms": "Reactietijd (ms)",
+    "uptime_percent": "Uptime %",
+    "last_24h": "Laatste 24 uur",
+    "last_7d": "Laatste 7 dagen",
+    "last_30d": "Laatste 30 dagen"
   },
   "dataguard": {
     "title": "DataGuard — DLP",
@@ -957,7 +1013,23 @@
     "os_distribution": "OS-distributie",
     "avg_ram": "Gemiddeld RAM",
     "alert_rules": "Alarmregels",
-    "recent_alerts": "Recente waarschuwingen"
+    "recent_alerts": "Recente waarschuwingen",
+    "tab_generate": "Genereren",
+    "tab_saved": "Opgeslagen rapporten",
+    "type_devices_desc": "Overzicht van alle geregistreerde apparaten",
+    "type_activity_desc": "Applicatiegebruik en sessiestatistieken",
+    "type_security_desc": "Beveiligingsgebeurtenissen en verbannen apparaten",
+    "type_tickets_desc": "Statistieken en overzicht van ondersteuningstickets",
+    "type_network_desc": "Netwerkmonitoring en uptimegegevens",
+    "type_inventory_desc": "Hardware- en software-inventaris",
+    "type_alerts_desc": "Waarschuwingen en regelgeschiedenis",
+    "report_name": "Rapportnaam",
+    "format": "Formaat",
+    "save": "Opslaan",
+    "preview": "Voorbeeld",
+    "download": "Downloaden",
+    "no_saved": "Geen opgeslagen rapporten",
+    "delete_saved": "Opgeslagen rapport verwijderen"
   },
   "tenants": {
     "title": "Multi-tenancy",
@@ -991,7 +1063,17 @@
     "total_users": "Totaal gebruikers",
     "created_at": "Aangemaakt op",
     "updated_at": "Bijgewerkt op",
-    "slug_exists": "Tenant-slug bestaat al"
+    "slug_exists": "Tenant-slug bestaat al",
+    "total_tenants": "Totaal tenants",
+    "active_tenants": "Actieve tenants",
+    "search": "Tenant zoeken...",
+    "create_tenant": "Tenant aanmaken",
+    "detail": "Tenantdetails",
+    "contact": "Contact",
+    "enabled": "Ingeschakeld",
+    "max": "Max",
+    "info": "Tenantinformatie",
+    "status": "Status"
   },
   "registrations": {
     "title": "Apparaatregistraties",
@@ -1051,5 +1133,186 @@
     "no_file": "Geen back-upbestand geselecteerd",
     "invalid_json": "Ongeldig back-upbestand: ongeldig JSON",
     "invalid_format": "Ongeldig back-upbestand: is geen BetterDesk-back-up"
+  },
+  "cdap": {
+    "title": "CDAP Apparaten",
+    "device_detail": "Apparaatdetails",
+    "loading": "Laden...",
+    "connected": "Verbonden",
+    "disconnected": "Verbinding verbroken",
+    "widgets": "Widgets",
+    "commands": "Commando's",
+    "no_widgets": "Geen widgets beschikbaar",
+    "no_commands": "Geen commando's verzonden",
+    "command_sent": "Commando succesvol verzonden",
+    "command_failed": "Commando verzenden mislukt",
+    "device_offline": "Apparaat offline",
+    "device_info": "Apparaatinformatie",
+    "device_type": "Apparaattype",
+    "device_version": "Versie",
+    "device_uptime": "Uptime",
+    "last_seen": "Laatst gezien",
+    "capabilities": "Mogelijkheden",
+    "telemetry": "Telemetrie",
+    "remote_desktop": "Extern bureaublad",
+    "file_transfer": "Bestandsoverdracht",
+    "clipboard": "Klembord",
+    "command_log": "Commando-log",
+    "command_id": "Commando-ID",
+    "command_type": "Type",
+    "command_time": "Tijd",
+    "command_status": "Status",
+    "status_pending": "Wachtend",
+    "status_sent": "Verzonden",
+    "status_success": "Geslaagd",
+    "status_error": "Fout",
+    "widget_toggle": "Schakelaar",
+    "widget_gauge": "Meter",
+    "widget_button": "Knop",
+    "widget_led": "LED",
+    "widget_text": "Tekst",
+    "widget_slider": "Schuifregelaar",
+    "widget_select": "Selectie",
+    "widget_chart": "Grafiek",
+    "widget_terminal": "Terminal",
+    "confirm_action": "Actie bevestigen",
+    "confirm_message": "Weet u zeker dat u deze actie wilt uitvoeren?",
+    "yes": "Ja",
+    "no": "Nee",
+    "connect_audio": "Audio verbinden",
+    "audio_connecting": "Audio verbinden...",
+    "audio_streaming": "Audio streamen",
+    "clipboard_in": "Klembord inkomend",
+    "clipboard_out": "Klembord uitgaand",
+    "monitor_select": "Monitor selecteren",
+    "keyframe_request": "Keyframe aanvragen",
+    "quality_auto": "Automatische kwaliteit",
+    "desktop_status": "Bureaubladstatus",
+    "desktop_connecting": "Verbinden met bureaublad...",
+    "desktop_connected": "Bureaublad verbonden",
+    "desktop_disconnected": "Bureaublad niet verbonden",
+    "desktop_failed": "Bureaubladverbinding mislukt",
+    "file_browser": "Bestandsbrowser",
+    "file_browser_title": "Bestandsbrowser",
+    "file_path": "Pad",
+    "file_name": "Bestandsnaam",
+    "file_size": "Grootte",
+    "file_modified": "Gewijzigd",
+    "file_upload": "Bestand uploaden",
+    "file_download": "Bestand downloaden",
+    "file_delete": "Bestand verwijderen",
+    "file_refresh": "Vernieuwen",
+    "terminal_title": "Terminal",
+    "terminal_clear": "Wissen",
+    "terminal_resize": "Formaat wijzigen",
+    "screenshot": "Schermafbeelding",
+    "screenshot_capture": "Schermafbeelding maken",
+    "screenshot_captured": "Schermafbeelding gemaakt",
+    "screenshot_failed": "Schermafbeelding mislukt",
+    "cpu_usage": "CPU-gebruik",
+    "memory_usage": "Geheugengebruik",
+    "disk_usage": "Schijfgebruik",
+    "hostname": "Hostnaam",
+    "system_uptime": "Systeemuptime"
+  },
+  "desktop": {
+    "unified_mode": "Uniforme modus",
+    "exit_unified": "Uniforme modus afsluiten",
+    "fullscreen": "Volledig scherm",
+    "exit_fullscreen": "Volledig scherm afsluiten",
+    "picture_in_picture": "Picture-in-Picture",
+    "exit_pip": "PiP afsluiten",
+    "settings": "Instellingen",
+    "quality": "Kwaliteit",
+    "quality_low": "Laag",
+    "quality_medium": "Gemiddeld",
+    "quality_high": "Hoog",
+    "quality_best": "Beste",
+    "fps": "FPS",
+    "audio": "Audio",
+    "audio_enabled": "Audio ingeschakeld",
+    "audio_disabled": "Audio uitgeschakeld",
+    "clipboard_sync": "Klembord synchroniseren",
+    "keyboard_shortcuts": "Sneltoetsen",
+    "ctrl_alt_del": "Ctrl+Alt+Del verzenden",
+    "disconnect": "Verbinding verbreken",
+    "reconnect": "Opnieuw verbinden",
+    "connection_status": "Verbindingsstatus",
+    "connecting": "Verbinden...",
+    "connected": "Verbonden",
+    "disconnected": "Verbinding verbroken",
+    "latency": "Latentie",
+    "bandwidth": "Bandbreedte"
+  },
+  "tokens": {
+    "title": "Toegangstokens",
+    "subtitle": "Beheer API-toegangstokens voor integraties en automatisering",
+    "create": "Token aanmaken",
+    "create_title": "Nieuw token aanmaken",
+    "name": "Tokennaam",
+    "name_placeholder": "Voer tokennaam in",
+    "description": "Beschrijving",
+    "description_placeholder": "Optionele beschrijving voor dit token",
+    "expiration": "Vervaldatum",
+    "no_expiration": "Geen vervaldatum",
+    "days_30": "30 dagen",
+    "days_60": "60 dagen",
+    "days_90": "90 dagen",
+    "days_180": "180 dagen",
+    "days_365": "1 jaar",
+    "permissions": "Machtigingen",
+    "perm_read": "Lezen",
+    "perm_read_desc": "Alleen-lezen toegang tot gegevens",
+    "perm_write": "Schrijven",
+    "perm_write_desc": "Resources aanmaken en wijzigen",
+    "perm_delete": "Verwijderen",
+    "perm_delete_desc": "Resources verwijderen",
+    "perm_admin": "Beheerder",
+    "perm_admin_desc": "Volledige beheerderstoegang",
+    "created": "Token succesvol aangemaakt",
+    "copy_warning": "Kopieer dit token nu. U kunt het niet meer zien!",
+    "copy_token": "Token kopiëren",
+    "copied": "Token naar klembord gekopieerd",
+    "no_tokens": "Geen tokens aangemaakt",
+    "no_tokens_desc": "Maak uw eerste toegangstoken aan om te beginnen",
+    "col_name": "Naam",
+    "col_created": "Aangemaakt",
+    "col_expires": "Vervalt",
+    "col_last_used": "Laatst gebruikt",
+    "col_actions": "Acties",
+    "never_used": "Nooit gebruikt",
+    "never_expires": "Nooit",
+    "expired": "Verlopen",
+    "revoke": "Intrekken",
+    "revoke_title": "Token intrekken",
+    "revoke_confirm": "Weet u zeker dat u dit token wilt intrekken? Deze actie kan niet ongedaan worden gemaakt.",
+    "revoked": "Token succesvol ingetrokken",
+    "delete_confirm": "Weet u zeker dat u dit token wilt verwijderen?"
+  },
+  "tutorial": {
+    "welcome": "Welkom bij BetterDesk",
+    "welcome_message": "Laten we een korte rondleiding maken om u op weg te helpen met het beheerpaneel.",
+    "step_dashboard": "Dashboard",
+    "step_dashboard_desc": "Bekijk algemene statistieken, apparaatstatus en recente activiteit.",
+    "step_devices": "Apparaten",
+    "step_devices_desc": "Beheer alle verbonden apparaten, groepen en adresboeken.",
+    "step_users": "Gebruikers",
+    "step_users_desc": "Maak en beheer gebruikersaccounts met verschillende machtigingsniveaus.",
+    "step_settings": "Instellingen",
+    "step_settings_desc": "Configureer serverinstellingen, thema's en voorkeuren.",
+    "step_complete": "Rondleiding voltooid!",
+    "step_complete_desc": "U bent klaar om BetterDesk te gebruiken. Veel succes!",
+    "next": "Volgende",
+    "previous": "Vorige",
+    "skip": "Rondleiding overslaan",
+    "finish": "Voltooien",
+    "dont_show": "Niet meer tonen",
+    "restart_tour": "Rondleiding herstarten",
+    "help": "Help",
+    "help_center": "Helpcentrum",
+    "documentation": "Documentatie",
+    "keyboard_shortcuts": "Sneltoetsen",
+    "report_issue": "Probleem melden"
   }
 }
+
diff --git a/web-nodejs/lang/pl.json b/web-nodejs/lang/pl.json
index 57aee9d0..006e3ca1 100644
--- a/web-nodejs/lang/pl.json
+++ b/web-nodejs/lang/pl.json
@@ -19,7 +19,15 @@
     "info": "Informacja",
     "all": "Wszystkie",
     "cancel": "Anuluj",
-    "delete": "Usuń"
+    "delete": "Usuń",
+    "actions": "Akcje",
+    "close": "Zamknij",
+    "required": "wymagane",
+    "name_required": "Nazwa jest wymagana",
+    "active": "Aktywny",
+    "inactive": "Nieaktywny",
+    "invalid_json": "Nieprawidłowy JSON",
+    "field_required": "{field} jest wymagane"
   },
   "nav": {
     "main": "Główne",
@@ -33,6 +41,7 @@
     "users": "Użytkownicy",
     "inventory": "Inwentaryzacja",
     "tickets": "Zgłoszenia",
+    "help_requests": "Prośby o pomoc",
     "activity": "Aktywność",
     "automation": "Automatyzacja",
     "file_transfer": "Przesyłanie plików",
@@ -41,7 +50,10 @@
     "reports": "Raporty",
     "tenants": "Organizacje",
     "registrations": "Rejestracje",
-    "toggle_sidebar": "Przełącz pasek boczny"
+    "management": "Zarządzanie",
+    "toggle_sidebar": "Przełącz pasek boczny",
+    "cdap": "Urządzenia CDAP",
+    "tokens": "Tokeny urządzeń"
   },
   "auth": {
     "login": "Zaloguj",
@@ -157,7 +169,27 @@
     "filter_type_desktop": "Desktop",
     "filter_type_scada": "SCADA",
     "filter_type_iot": "IoT",
-    "filter_type_agent": "Agent"
+    "filter_type_agent": "Agent",
+    "cdap_connected": "Połączono przez CDAP",
+    "revoke": "Odwołaj",
+    "tabs": {
+      "overview": "Przegląd",
+      "hardware": "Sprzęt",
+      "metrics": "Metryki",
+      "connections": "Połączenia",
+      "audit": "Audyt"
+    },
+    "hardware": {
+      "cpu": "Procesor",
+      "memory": "Pamięć",
+      "disk": "Dysk",
+      "os": "System operacyjny",
+      "hostname": "Nazwa hosta",
+      "uptime": "Czas pracy",
+      "load_avg": "Średnie obciążenie",
+      "network": "Sieć",
+      "no_data": "Brak danych o sprzęcie"
+    }
   },
   "keys": {
     "title": "Klucze serwera",
@@ -258,7 +290,20 @@
     "time": "Czas",
     "user": "Użytkownik",
     "action": "Akcja",
-    "details": "Szczegóły"
+    "details": "Szczegóły",
+    "action_login": "Logowanie",
+    "action_login_failed": "Nieudane logowanie",
+    "action_logout": "Wylogowanie",
+    "action_password_change": "Zmiana hasła",
+    "action_2fa_enable": "Włączono 2FA",
+    "action_2fa_disable": "Wyłączono 2FA",
+    "action_user_create": "Utworzono użytkownika",
+    "action_user_update": "Zaktualizowano użytkownika",
+    "action_user_delete": "Usunięto użytkownika",
+    "action_settings_update": "Zaktualizowano ustawienia",
+    "action_device_ban": "Zbanowano urządzenie",
+    "action_device_unban": "Odbanowano urządzenie",
+    "action_device_delete": "Usunięto urządzenie"
   },
   "generator": {
     "title": "Generator konfiguracji klienta",
@@ -314,9 +359,17 @@
   },
   "time": {
     "just_now": "Przed chwilą",
-    "minutes_ago": "{count} min temu",
-    "hours_ago": "{count} godz. temu",
-    "days_ago": "{count} dni temu"
+    "seconds_ago": "{count}s temu",
+    "minutes_ago": "{count}m temu",
+    "hours_ago": "{count}h temu",
+    "days_ago": "{count}d temu",
+    "day_mon": "Pon",
+    "day_tue": "Wt",
+    "day_wed": "Śr",
+    "day_thu": "Czw",
+    "day_fri": "Pt",
+    "day_sat": "Sob",
+    "day_sun": "Ndz"
   },
   "users": {
     "title": "Zarządzanie użytkownikami",
@@ -544,6 +597,8 @@
     "action_native_remote_desc": "Natywny strumień JPEG — bez wtyczek",
     "action_connect_desktop": "Klient desktop",
     "action_connect_desktop_desc": "Otwórz w aplikacji desktop",
+    "action_connect_web": "Pulpit zdalny",
+    "action_connect_web_desc": "Połącz przez przeglądarkę",
     "action_change_id_desc": "Zmień ID rejestracji urządzenia",
     "action_ban_desc": "Zablokuj połączenia tego urządzenia",
     "action_unban_desc": "Zezwól na ponowne połączenie",
@@ -629,7 +684,7 @@
     "refresh": "Odśwież"
   },
   "tickets": {
-    "title": "Helpdesk",
+    "title": "Zgłoszenia",
     "subtitle": "Zgłoszenia i śledzenie problemów",
     "create": "Nowe zgłoszenie",
     "edit": "Edytuj zgłoszenie",
@@ -728,7 +783,17 @@
     "category_other": "Inne",
     "summary": "Podsumowanie",
     "details": "Szczegóły",
-    "refresh": "Odśwież"
+    "refresh": "Odśwież",
+    "search": "Szukaj urządzeń...",
+    "date_range": "Zakres dat",
+    "device_id": "ID urządzenia",
+    "session_start": "Początek sesji",
+    "session_end": "Koniec sesji",
+    "user": "Użytkownik",
+    "no_activity": "Brak zarejestrowanej aktywności",
+    "reported_at": "Zgłoszono",
+    "detail": "Szczegóły",
+    "no_apps": "Brak aplikacji"
   },
   "automation": {
     "title": "Automatyzacja i alerty",
@@ -796,7 +861,9 @@
     "smtp_test_failed": "Połączenie nieudane",
     "no_rules": "Brak skonfigurowanych reguł alertów",
     "no_alerts": "Brak wyzwolonych alertów",
-    "no_commands": "Brak wysłanych poleceń"
+    "no_commands": "Brak wysłanych poleceń",
+    "id_payload_required": "ID urządzenia i payload są wymagane",
+    "no_commands_sent": "Nie wysłano jeszcze żadnych poleceń"
   },
   "file_transfer": {
     "title": "Przesyłanie plików",
@@ -880,7 +947,26 @@
     "no_targets": "Brak skonfigurowanych celów monitorowania",
     "no_history": "Brak historii sprawdzeń",
     "error_code": "Błąd",
-    "status_code": "Kod statusu HTTP"
+    "status_code": "Kod statusu HTTP",
+    "search_targets": "Szukaj celów...",
+    "name": "Nazwa",
+    "tab_targets": "Cele",
+    "tab_tools": "Narzędzia",
+    "avg_latency": "Śr. opóźnienie",
+    "type": "Typ",
+    "latency": "Opóźnienie",
+    "check_history": "Historia sprawdzeń",
+    "name_host_required": "Nazwa i host są wymagane",
+    "uptime": "Dostępność",
+    "response_time": "Czas odpowiedzi",
+    "avg_response": "Śr. czas odpowiedzi",
+    "charts": "Wykresy",
+    "realtime": "Czas rzeczywisty",
+    "response_time_ms": "Czas odpowiedzi (ms)",
+    "uptime_percent": "Dostępność (%)",
+    "last_24h": "Ostatnie 24h",
+    "last_7d": "Ostatnie 7 dni",
+    "last_30d": "Ostatnie 30 dni"
   },
   "dataguard": {
     "title": "DataGuard — DLP",
@@ -891,6 +977,7 @@
     "delete_confirm": "Czy na pewno chcesz usunąć tę politykę?",
     "policy_name": "Nazwa",
     "policy_description": "Opis",
+    "status": "Status",
     "enabled": "Włączona",
     "disabled": "Wyłączona",
     "rules": "Reguły",
@@ -930,7 +1017,30 @@
     "drive_fixed": "Stały",
     "drive_network": "Sieciowy",
     "drive_cdrom": "CD-ROM",
-    "drive_unknown": "Nieznany"
+    "drive_unknown": "Nieznany",
+    "total_policies": "Łącznie polityk",
+    "active_policies": "Aktywne polityki",
+    "violations": "Naruszenia",
+    "blocked": "Zablokowane",
+    "tab_policies": "Polityki",
+    "tab_events": "Zdarzenia",
+    "search_policies": "Szukaj polityk...",
+    "create_policy": "Utwórz politykę",
+    "policy_type": "Typ polityki",
+    "scope": "Zakres",
+    "events_count": "Zdarzenia",
+    "search_events": "Szukaj zdarzeń...",
+    "event_time": "Czas zdarzenia",
+    "device": "Urządzenie",
+    "policy": "Polityka",
+    "detail": "Szczegóły",
+    "scope_help": "ID urządzeń oddzielone przecinkami, lub puste dla wszystkich",
+    "scope_all": "Wszystkie urządzenia",
+    "active": "Aktywna",
+    "type_file_type": "Typ pliku",
+    "type_clipboard": "Schowek",
+    "type_screen_share": "Udostępnianie ekranu",
+    "type_file_transfer": "Transfer plików"
   },
   "reports": {
     "title": "Raporty",
@@ -976,10 +1086,25 @@
     "os_distribution": "Rozk\u0142ad system\u00f3w operacyjnych",
     "avg_ram": "\u015aredni RAM",
     "alert_rules": "Regu\u0142y alert\u00f3w",
-    "recent_alerts": "Ostatnie alerty"
+    "recent_alerts": "Ostatnie alerty",
+    "tab_generate": "Generuj raport",
+    "tab_saved": "Zapisane raporty",
+    "type_devices_desc": "Przegląd urządzeń, platform i statusów",
+    "type_activity_desc": "Podsumowanie aktywności i czasu bezczynności",
+    "type_security_desc": "Blokady, zdarzenia DLP i logi audytu",
+    "type_tickets_desc": "Statystyki zgłoszeń i wydajność SLA",
+    "type_network_desc": "Cele monitorowania sieci i dane dostępności",
+    "type_inventory_desc": "Podsumowanie inwentaryzacji sprzętu i oprogramowania",
+    "type_alerts_desc": "Reguły alertów i historia wyzwolonych alertów",
+    "report_name": "Nazwa raportu",
+    "format": "Format",
+    "save": "Zapisz raport",
+    "preview": "Podgląd",
+    "download": "Pobierz",
+    "delete_saved": "Usuń raport"
   },
   "tenants": {
-    "title": "Multi-Tenancy",
+    "title": "Organizacje",
     "list": "Organizacje",
     "add_tenant": "Dodaj organizację",
     "edit_tenant": "Edytuj organizację",
@@ -1010,7 +1135,18 @@
     "total_users": "Łącznie użytkowników",
     "created_at": "Utworzono",
     "updated_at": "Zaktualizowano",
-    "slug_exists": "Identyfikator organizacji już istnieje"
+    "slug_exists": "Identyfikator organizacji już istnieje",
+    "total_tenants": "Łącznie organizacji",
+    "active_tenants": "Aktywne organizacje",
+    "search": "Szukaj organizacji...",
+    "create_tenant": "Utwórz organizację",
+    "detail": "Szczegóły organizacji",
+    "contact": "Kontakt",
+    "enabled": "Włączona",
+    "disabled": "Wyłączona",
+    "max": "maks.",
+    "info": "Informacje",
+    "status": "Status"
   },
   "registrations": {
     "title": "Rejestracje urządzeń",
@@ -1038,7 +1174,20 @@
     "reject_reason_placeholder": "Podaj powód odrzucenia...",
     "rejected_success": "Rejestracja urządzenia odrzucona",
     "delete_confirm": "Czy na pewno chcesz usunąć ten wpis rejestracji?",
-    "deleted_success": "Wpis rejestracji usunięty"
+    "deleted_success": "Wpis rejestracji usunięty",
+    "enrollment_title": "Rejestracja urządzeń",
+    "enrollment_subtitle": "Oczekujące żądania rejestracji od klientów BetterDesk",
+    "enrollment_empty": "Brak oczekujących żądań rejestracji",
+    "enrollment_approve": "Zatwierdź",
+    "enrollment_reject": "Odrzuć",
+    "enrollment_display_name": "Nazwa wyświetlana",
+    "enrollment_display_name_placeholder": "Wpisz nazwę dla tego urządzenia...",
+    "enrollment_sync_mode": "Tryb synchronizacji",
+    "enrollment_sync_silent": "Cichy — minimalna telemetria",
+    "enrollment_sync_standard": "Standardowy — zbalansowana synchronizacja",
+    "enrollment_sync_turbo": "Turbo — agresywna synchronizacja",
+    "enrollment_approved_success": "Rejestracja urządzenia zatwierdzona",
+    "enrollment_rejected_success": "Rejestracja urządzenia odrzucona"
   },
   "backup": {
     "title": "Kopia zapasowa",
@@ -1092,7 +1241,60 @@
     "cdap_connections": "Aktywne połączenia",
     "send_command": "Wyślij polecenie",
     "command_sent": "Polecenie wysłane pomyślnie",
-    "command_failed": "Nie udało się wysłać polecenia"
+    "command_failed": "Nie udało się wysłać polecenia",
+    "devices_title": "Urządzenia CDAP",
+    "devices_subtitle": "Podłączone urządzenia poprzez Custom Device Application Protocol",
+    "stat_connected": "Połączone",
+    "stat_port": "Port",
+    "search_devices": "Szukaj urządzeń...",
+    "no_devices": "Brak podłączonych urządzeń",
+    "no_devices_desc": "Żadne urządzenia CDAP nie są obecnie połączone. Urządzenia pojawią się tutaj po połączeniu z bramą.",
+    "gateway_disabled": "Brama CDAP wyłączona",
+    "gateway_disabled_desc": "Włącz bramę CDAP ustawiając CDAP_ENABLED=true w konfiguracji serwera.",
+    "gateway_active": "Aktywna",
+    "toggle_enable": "Włącz CDAP",
+    "toggle_disable": "Wyłącz CDAP",
+    "enabled_restart": "CDAP włączony. Wymagany restart serwera aby zastosować zmiany.",
+    "disabled_restart": "CDAP wyłączony. Wymagany restart serwera aby zastosować zmiany.",
+    "widgets": "widgetów",
+    "type_all": "Wszystkie",
+    "type_iot": "IoT",
+    "type_scada": "SCADA",
+    "type_os_agent": "Agent OS",
+    "type_network": "Sieć",
+    "type_camera": "Kamera",
+    "type_custom": "Niestandardowe",
+    "active_alerts": "Aktywne alerty",
+    "alert_fired": "Alert wyzwolony",
+    "alert_cleared": "Alert wyczyszczony",
+    "no_alerts": "Brak aktywnych alertów",
+    "connect_terminal": "Połącz Terminal",
+    "table_search": "Szukaj...",
+    "just_now": "Przed chwilą",
+    "terminal_connecting": "Łączenie z urządzeniem...",
+    "terminal_disconnected": "Rozłączono",
+    "terminal_error": "Połączenie terminala nie powiodło się",
+    "linked_devices": "Powiązane urządzenia",
+    "link_device": "Powiąż urządzenie",
+    "unlink_device": "Odłącz",
+    "no_linked_devices": "Brak powiązanych urządzeń",
+    "unlink_confirm": "Czy na pewno chcesz odłączyć to urządzenie?",
+    "link_prompt": "Wprowadź Peer ID do powiązania z tym urządzeniem:",
+    "connect_desktop": "Połącz pulpit",
+    "connect_video": "Połącz strumień",
+    "connect_files": "Przeglądaj pliki",
+    "connect_audio": "Połącz audio",
+    "upload_file": "Wyślij",
+    "desktop_connecting": "Łączenie...",
+    "video_connecting": "Łączenie...",
+    "files_connecting": "Łączenie...",
+    "audio_connecting": "Łączenie...",
+    "audio_streaming": "Strumieniowanie",
+    "clipboard_in": "Schowek odebrany",
+    "clipboard_out": "Schowek wysłany",
+    "monitor_select": "Wybierz monitor",
+    "keyframe_request": "Żądaj klatki kluczowej",
+    "quality_auto": "Automatyczna jakość"
   },
   "desktop": {
     "switch_mode": "Tryb pulpitu",
@@ -1101,6 +1303,182 @@
     "minimize": "Minimalizuj",
     "maximize": "Maksymalizuj",
     "restore": "Przywróć",
-    "close": "Zamknij"
+    "close": "Zamknij",
+    "widgets_mode": "Widżety",
+    "windows_mode": "Okna",
+    "wallpaper": "Tapeta",
+    "add_widget": "Dodaj widżet",
+    "remove_widget": "Usuń widżet",
+    "configure": "Konfiguruj",
+    "search_widgets": "Szukaj widżetów...",
+    "cat_monitoring": "Monitoring",
+    "cat_devices": "Urządzenia",
+    "cat_tools": "Narzędzia",
+    "cat_general": "Ogólne",
+    "notes_placeholder": "Pisz notatki tutaj...",
+    "search_placeholder": "Szukaj urządzeń, stron, ustawień...",
+    "search_pages": "Strony",
+    "search_devices": "Urządzenia",
+    "search_no_results": "Brak wyników",
+    "exit_desktop": "Wyjdź z pulpitu",
+    "widget_clock": "Zegar",
+    "widget_device_status": "Status urządzeń",
+    "widget_server_health": "Info serwera",
+    "widget_system_stats": "Wskaźniki urządzeń",
+    "widget_device_list": "Lista urządzeń",
+    "widget_quick_actions": "Szybkie akcje",
+    "widget_recent_activity": "Ostatnia aktywność",
+    "widget_notes": "Notatki",
+    "widget_network_monitor": "Monitor sieci",
+    "widget_tickets_summary": "Zgłoszenia",
+    "widget_iframe": "Strona web",
+    "widget_cdap_devices": "Urządzenia CDAP",
+    "widget_uptime": "Czas działania",
+    "widget_port_status": "Status portów",
+    "widget_device_grid": "Siatka urządzeń",
+    "widget_multi_gauge": "Wskaźniki serwera",
+    "widget_weekly_chart": "Aktywność tygodniowa",
+    "widget_quick_controls": "Szybka kontrola",
+    "widget_bandwidth": "Przepustowość",
+    "widget_connection_stats": "Statystyki połączeń",
+    "label_online": "Online",
+    "label_offline": "Offline",
+    "label_total": "Razem",
+    "label_blocked": "Zablokowane",
+    "label_banned": "Zbanowane",
+    "label_active": "Aktywne",
+    "label_service": "Usługa",
+    "label_port": "Port",
+    "label_uptime_prefix": "Czas działania:",
+    "label_no_devices": "Brak urządzeń",
+    "label_no_activity": "Brak aktywności",
+    "label_no_targets": "Brak celów",
+    "label_unavailable": "Niedostępne",
+    "label_open": "Otwarte",
+    "label_in_progress": "W toku",
+    "label_resolved": "Rozwiązane",
+    "label_set_url": "Ustaw URL w konfiguracji",
+    "label_server_uptime": "Czas działania serwera",
+    "label_merged_info": "Scalono z widgetem Info serwera",
+    "label_with_notes": "Z notatkami",
+    "label_metric": "Metryka",
+    "label_count": "Liczba",
+    "label_total_devices": "Razem urządzeń",
+    "label_throughput": "Przepustowość",
+    "label_active_relays": "Aktywne przekaźniki",
+    "label_total_relayed": "Razem przekazane",
+    "label_total_bytes": "Razem bajtów",
+    "label_filter_devices": "Filtruj urządzenia...",
+    "label_all": "Wszystkie",
+    "label_ban": "Zbanuj",
+    "label_unban": "Odbanuj",
+    "label_connect": "Połącz",
+    "label_no_cdap_devices": "Brak urządzeń CDAP"
+  },
+  "tokens": {
+    "title": "Tokeny urządzeń",
+    "subtitle": "Zarządzaj tokenami rejestracji do automatycznego wdrażania urządzeń",
+    "enrollment_mode": "Tryb rejestracji",
+    "mode_open": "Otwarty",
+    "mode_open_desc": "Każde urządzenie może się zarejestrować bez tokenu",
+    "mode_managed": "Zarządzany",
+    "mode_managed_desc": "Urządzenia potrzebują ważnego tokenu do rejestracji",
+    "mode_locked": "Zablokowany",
+    "mode_locked_desc": "Rejestracja nowych urządzeń jest wyłączona",
+    "total": "Łącznie tokenów",
+    "active": "Aktywne",
+    "used": "Wykorzystane",
+    "revoked": "Unieważnione",
+    "search_placeholder": "Szukaj tokenów...",
+    "status_pending": "Oczekujący",
+    "status_active": "Aktywny",
+    "status_used": "Wykorzystany",
+    "status_revoked": "Unieważniony",
+    "status_expired": "Wygasły",
+    "bulk_generate": "Generuj masowo",
+    "create": "Utwórz token",
+    "edit": "Edytuj token",
+    "token": "Token",
+    "name": "Nazwa",
+    "status": "Status",
+    "uses": "Użycia",
+    "bound_peer": "Przypisane urządzenie",
+    "expires": "Wygasa",
+    "created": "Utworzono",
+    "actions": "Akcje",
+    "name_placeholder": "np. Komputery biurowe",
+    "max_uses": "Maksymalna liczba użyć",
+    "max_uses_hint": "0 = bez limitu",
+    "expires_in": "Wygasa za",
+    "no_expiration": "Bez wygaśnięcia",
+    "expires_1h": "1 godzina",
+    "expires_24h": "24 godziny",
+    "expires_7d": "7 dni",
+    "expires_30d": "30 dni",
+    "note": "Notatka",
+    "note_placeholder": "Opcjonalna notatka o tym tokenie...",
+    "count": "Ilość",
+    "count_range": "Liczba tokenów do wygenerowania (1-100)",
+    "name_prefix": "Prefiks nazwy",
+    "generate": "Generuj",
+    "token_created": "Token utworzony",
+    "tokens_generated": "Tokeny wygenerowane",
+    "copy_warning": "Skopiuj token teraz. Nie będzie pokazany ponownie.",
+    "copy_token": "Kopiuj token",
+    "copied": "Skopiowano!",
+    "revoke": "Unieważnij",
+    "revoke_confirm": "Czy na pewno chcesz unieważnić ten token? Urządzenia już zarejestrowane za jego pomocą nie zostaną dotknięte.",
+    "revoked_success": "Token został unieważniony",
+    "no_tokens": "Nie znaleziono tokenów",
+    "expired": "Wygasły",
+    "never": "Nigdy",
+    "save": "Zapisz",
+    "cancel": "Anuluj",
+    "unlimited": "Bez limitu"
+  },
+  "tutorial": {
+    "next": "Dalej",
+    "prev": "Wstecz",
+    "skip": "Pomiń",
+    "finish": "Zakończ",
+    "step_of": "{current} z {total}",
+    "console_sidebar_title": "Pasek nawigacji",
+    "console_sidebar_text": "Dostęp do wszystkich modułów. Kliknij dowolną ikonę, aby przejść do sekcji. Pasek dostosowuje się do rozmiaru ekranu.",
+    "console_dashboard_title": "Pulpit",
+    "console_dashboard_text": "Twoje centrum dowodzenia pokazujące status serwera, urządzenia online i szybkie akcje. Monitoruj ważne wskaźniki na pierwszy rzut oka.",
+    "console_devices_title": "Zarządzanie urządzeniami",
+    "console_devices_text": "Przeglądaj, wyszukuj i zarządzaj podłączonymi urządzeniami. Filtruj według statusu, przypisuj tagi i konfiguruj ustawienia.",
+    "console_settings_title": "Ustawienia",
+    "console_settings_text": "Konfiguruj zachowanie serwera, opcje bezpieczeństwa, branding i zarządzanie użytkownikami. Dostosuj BetterDesk do swoich potrzeb.",
+    "console_desktop_title": "Tryb pulpitu",
+    "console_desktop_text": "Przełącz na tryb pulpitu z przestrzenią roboczą opartą na oknach i widgetach. Idealny do wielozadaniowości i monitoringu.",
+    "desktop_widgets_title": "Panel widgetów",
+    "desktop_widgets_text": "Twoja konfigurowalna przestrzeń robocza. Widgety wyświetlają informacje na żywo i zapewniają szybki dostęp do funkcji. Przeciągnij, aby zmienić układ.",
+    "desktop_add_widget_title": "Dodaj widgety",
+    "desktop_add_widget_text": "Kliknij tutaj, aby przeglądać dostępne widgety. Wybierz spośród monitorów, list urządzeń, notatek i innych.",
+    "desktop_taskbar_title": "Pasek zadań",
+    "desktop_taskbar_text": "Otwarte aplikacje pojawiają się tutaj. Kliknij, aby fokusować lub minimalizować okna. Zegar pokazuje aktualny czas, a przycisk tapety zmienia tło.",
+    "desktop_windows_title": "Okna aplikacji",
+    "desktop_windows_text": "Aplikacje otwierają się w przeciągalnych, skalowalnych oknach. Minimalizuj, maksymalizuj lub zamykaj z paska tytułu. Okna są nad widgetami.",
+    "desktop_search_title": "Szybkie wyszukiwanie",
+    "desktop_search_text": "Szukaj urządzeń, stron i ustawień. Naciśnij Ctrl+K w dowolnym miejscu, aby otworzyć wyszukiwarkę."
+  },
+  "help_request": {
+    "title": "Prośby o pomoc",
+    "subtitle": "Zarządzaj prośbami o pomoc z klientów desktopowych",
+    "new_request": "Nowa prośba o pomoc",
+    "device": "Urządzenie",
+    "hostname": "Nazwa hosta",
+    "message": "Wiadomość",
+    "status": "Status",
+    "pending": "Oczekująca",
+    "accepted": "Zaakceptowana",
+    "resolved": "Rozwiązana",
+    "accept": "Akceptuj",
+    "resolve": "Rozwiąż",
+    "no_requests": "Brak próśb o pomoc",
+    "notification": "Prośba o pomoc od",
+    "stats_total": "Łącznie",
+    "filter_all": "Wszystkie"
   }
 }
diff --git a/web-nodejs/lang/pt.json b/web-nodejs/lang/pt.json
index 7e2f5511..72969b9c 100644
--- a/web-nodejs/lang/pt.json
+++ b/web-nodejs/lang/pt.json
@@ -19,7 +19,15 @@
     "info": "Informação",
     "all": "Todos",
     "cancel": "Cancelar",
-    "delete": "Excluir"
+    "delete": "Excluir",
+    "actions": "Ações",
+    "close": "Fechar",
+    "required": "Obrigatório",
+    "name_required": "O nome é obrigatório",
+    "active": "Ativo",
+    "inactive": "Inativo",
+    "invalid_json": "JSON inválido",
+    "field_required": "Este campo é obrigatório"
   },
   "nav": {
     "main": "Principal",
@@ -41,7 +49,10 @@
     "reports": "Relatórios",
     "tenants": "Inquilinos",
     "registrations": "Registos",
-    "toggle_sidebar": "Alternar barra lateral"
+    "toggle_sidebar": "Alternar barra lateral",
+    "cdap": "Dispositivos CDAP",
+    "clients": "Clientes",
+    "exit_desktop": "Sair da área de trabalho"
   },
   "auth": {
     "login": "Entrar",
@@ -140,7 +151,28 @@
     "bulk_delete_confirm": "Tem a certeza que deseja excluir {count} dispositivos?",
     "bulk_delete_success": "{count} dispositivos excluídos com sucesso",
     "columns": "Colunas",
-    "toggle_columns": "Alternar colunas visíveis"
+    "toggle_columns": "Alternar colunas visíveis",
+    "device_type": "Tipo de dispositivo",
+    "cdap_connected": "CDAP Conectado",
+    "revoke": "Revogar",
+    "revoke_option": "Revogar dispositivo",
+    "revoke_hint": "Bloquear ID do dispositivo e desconectar conexões ativas",
+    "revoke_success": "Dispositivo revogado com sucesso",
+    "tabs": {
+      "info": "Info",
+      "hardware": "Hardware",
+      "metrics": "Métricas",
+      "history": "Histórico"
+    },
+    "hardware": {
+      "title": "Informação de hardware",
+      "os": "Sistema operativo",
+      "cpu": "Processador",
+      "memory": "Memória",
+      "disk": "Disco",
+      "gpu": "Placa gráfica",
+      "network": "Adaptadores de rede"
+    }
   },
   "keys": {
     "title": "Chaves do servidor",
@@ -297,6 +329,7 @@
   },
   "time": {
     "just_now": "Agora mesmo",
+    "seconds_ago": "há {count} segundo(s)",
     "minutes_ago": "há {count} minuto(s)",
     "hours_ago": "há {count} hora(s)",
     "days_ago": "há {count} dia(s)"
@@ -403,7 +436,9 @@
     "delete_failed": "Falha ao excluir dispositivo",
     "change_id_failed": "Falha ao alterar ID do dispositivo",
     "bulk_delete_failed": "Falha ao excluir dispositivos",
-    "sync_failed": "Falha na sincronização"
+    "sync_failed": "Falha na sincronização",
+    "forbidden_title": "Acesso negado",
+    "forbidden_message": "Não tem permissão para ver esta página."
   },
   "remote": {
     "title": "Ambiente de trabalho remoto",
@@ -709,7 +744,17 @@
     "category_other": "Outro",
     "summary": "Resumo",
     "details": "Detalhes",
-    "refresh": "Atualizar"
+    "refresh": "Atualizar",
+    "session_start": "Início da sessão",
+    "session_end": "Fim da sessão",
+    "status": "Estado",
+    "user": "Utilizador",
+    "export": "Exportar",
+    "export_csv": "Exportar como CSV",
+    "export_json": "Exportar como JSON",
+    "time_range": "Intervalo de tempo",
+    "today": "Hoje",
+    "last_7_days": "Últimos 7 dias"
   },
   "automation": {
     "title": "Automação e alertas",
@@ -777,7 +822,8 @@
     "smtp_test_failed": "Falha na conexão",
     "no_rules": "Nenhuma regra de alarme configurada",
     "no_alerts": "Nenhum alerta acionado",
-    "no_commands": "Nenhum comando enviado"
+    "no_commands": "Nenhum comando enviado",
+    "no_commands_sent": "Ainda não foram enviados comandos"
   },
   "file_transfer": {
     "title": "Transferência de ficheiros",
@@ -861,7 +907,17 @@
     "no_targets": "Nenhum alvo de monitorização configurado",
     "no_history": "Nenhum histórico de verificações disponível",
     "error_code": "Erro",
-    "status_code": "Código de estado HTTP"
+    "status_code": "Código de estado HTTP",
+    "uptime": "Tempo de atividade",
+    "response_time": "Tempo de resposta",
+    "avg_response": "Resposta média",
+    "charts": "Gráficos",
+    "realtime": "Tempo real",
+    "response_time_ms": "Tempo de resposta (ms)",
+    "uptime_percent": "% Tempo de atividade",
+    "last_24h": "Últimas 24 horas",
+    "last_7d": "Últimos 7 dias",
+    "last_30d": "Últimos 30 dias"
   },
   "dataguard": {
     "title": "DataGuard — DLP",
@@ -957,7 +1013,23 @@
     "os_distribution": "Distribuição de SO",
     "avg_ram": "RAM média",
     "alert_rules": "Regras de alarme",
-    "recent_alerts": "Alertas recentes"
+    "recent_alerts": "Alertas recentes",
+    "tab_generate": "Gerar",
+    "tab_saved": "Relatórios guardados",
+    "type_devices_desc": "Visão geral de todos os dispositivos registados",
+    "type_activity_desc": "Estatísticas de uso de aplicações e sessões",
+    "type_security_desc": "Eventos de segurança e dispositivos banidos",
+    "type_tickets_desc": "Estatísticas e resumo de tickets de suporte",
+    "type_network_desc": "Dados de monitorização de rede e uptime",
+    "type_inventory_desc": "Inventário de hardware e software",
+    "type_alerts_desc": "Histórico de alertas e regras",
+    "report_name": "Nome do relatório",
+    "format": "Formato",
+    "save": "Guardar",
+    "preview": "Pré-visualizar",
+    "download": "Transferir",
+    "no_saved": "Sem relatórios guardados",
+    "delete_saved": "Excluir relatório guardado"
   },
   "tenants": {
     "title": "Multi-tenancy",
@@ -991,7 +1063,17 @@
     "total_users": "Total de utilizadores",
     "created_at": "Criado em",
     "updated_at": "Atualizado em",
-    "slug_exists": "O slug do inquilino já existe"
+    "slug_exists": "O slug do inquilino já existe",
+    "total_tenants": "Total de inquilinos",
+    "active_tenants": "Inquilinos ativos",
+    "search": "Pesquisar inquilino...",
+    "create_tenant": "Criar inquilino",
+    "detail": "Detalhes do inquilino",
+    "contact": "Contacto",
+    "enabled": "Ativado",
+    "max": "Máx",
+    "info": "Informação do inquilino",
+    "status": "Estado"
   },
   "registrations": {
     "title": "Registos de dispositivos",
@@ -1051,5 +1133,186 @@
     "no_file": "Nenhum ficheiro de backup selecionado",
     "invalid_json": "Ficheiro de backup inválido: JSON inválido",
     "invalid_format": "Ficheiro de backup inválido: não é um backup BetterDesk"
+  },
+  "cdap": {
+    "title": "Dispositivos CDAP",
+    "device_detail": "Detalhes do dispositivo",
+    "loading": "A carregar...",
+    "connected": "Conectado",
+    "disconnected": "Desconectado",
+    "widgets": "Widgets",
+    "commands": "Comandos",
+    "no_widgets": "Sem widgets disponíveis",
+    "no_commands": "Nenhum comando enviado",
+    "command_sent": "Comando enviado com sucesso",
+    "command_failed": "Falha ao enviar comando",
+    "device_offline": "Dispositivo offline",
+    "device_info": "Informação do dispositivo",
+    "device_type": "Tipo de dispositivo",
+    "device_version": "Versão",
+    "device_uptime": "Tempo de atividade",
+    "last_seen": "Visto pela última vez",
+    "capabilities": "Capacidades",
+    "telemetry": "Telemetria",
+    "remote_desktop": "Ambiente de trabalho remoto",
+    "file_transfer": "Transferência de ficheiros",
+    "clipboard": "Área de transferência",
+    "command_log": "Registo de comandos",
+    "command_id": "ID do comando",
+    "command_type": "Tipo",
+    "command_time": "Hora",
+    "command_status": "Estado",
+    "status_pending": "Pendente",
+    "status_sent": "Enviado",
+    "status_success": "Sucesso",
+    "status_error": "Erro",
+    "widget_toggle": "Interruptor",
+    "widget_gauge": "Medidor",
+    "widget_button": "Botão",
+    "widget_led": "LED",
+    "widget_text": "Texto",
+    "widget_slider": "Controlo deslizante",
+    "widget_select": "Seleção",
+    "widget_chart": "Gráfico",
+    "widget_terminal": "Terminal",
+    "confirm_action": "Confirmar ação",
+    "confirm_message": "Tem a certeza que deseja executar esta ação?",
+    "yes": "Sim",
+    "no": "Não",
+    "connect_audio": "Conectar áudio",
+    "audio_connecting": "A conectar áudio...",
+    "audio_streaming": "Streaming de áudio",
+    "clipboard_in": "Área de transferência de entrada",
+    "clipboard_out": "Área de transferência de saída",
+    "monitor_select": "Selecionar monitor",
+    "keyframe_request": "Solicitar keyframe",
+    "quality_auto": "Qualidade automática",
+    "desktop_status": "Estado do ambiente de trabalho",
+    "desktop_connecting": "A conectar ao ambiente de trabalho...",
+    "desktop_connected": "Ambiente de trabalho conectado",
+    "desktop_disconnected": "Ambiente de trabalho desconectado",
+    "desktop_failed": "Falha na conexão ao ambiente de trabalho",
+    "file_browser": "Explorador de ficheiros",
+    "file_browser_title": "Explorador de ficheiros",
+    "file_path": "Caminho",
+    "file_name": "Nome do ficheiro",
+    "file_size": "Tamanho",
+    "file_modified": "Modificado",
+    "file_upload": "Carregar ficheiro",
+    "file_download": "Transferir ficheiro",
+    "file_delete": "Excluir ficheiro",
+    "file_refresh": "Atualizar",
+    "terminal_title": "Terminal",
+    "terminal_clear": "Limpar",
+    "terminal_resize": "Redimensionar",
+    "screenshot": "Captura de ecrã",
+    "screenshot_capture": "Capturar ecrã",
+    "screenshot_captured": "Ecrã capturado",
+    "screenshot_failed": "Falha na captura de ecrã",
+    "cpu_usage": "Utilização da CPU",
+    "memory_usage": "Utilização da memória",
+    "disk_usage": "Utilização do disco",
+    "hostname": "Nome do host",
+    "system_uptime": "Tempo de atividade do sistema"
+  },
+  "desktop": {
+    "unified_mode": "Modo unificado",
+    "exit_unified": "Sair do modo unificado",
+    "fullscreen": "Ecrã inteiro",
+    "exit_fullscreen": "Sair do ecrã inteiro",
+    "picture_in_picture": "Picture-in-Picture",
+    "exit_pip": "Sair do PiP",
+    "settings": "Definições",
+    "quality": "Qualidade",
+    "quality_low": "Baixa",
+    "quality_medium": "Média",
+    "quality_high": "Alta",
+    "quality_best": "Melhor",
+    "fps": "FPS",
+    "audio": "Áudio",
+    "audio_enabled": "Áudio ativado",
+    "audio_disabled": "Áudio desativado",
+    "clipboard_sync": "Sincronizar área de transferência",
+    "keyboard_shortcuts": "Atalhos de teclado",
+    "ctrl_alt_del": "Enviar Ctrl+Alt+Del",
+    "disconnect": "Desconectar",
+    "reconnect": "Reconectar",
+    "connection_status": "Estado da conexão",
+    "connecting": "A conectar...",
+    "connected": "Conectado",
+    "disconnected": "Desconectado",
+    "latency": "Latência",
+    "bandwidth": "Largura de banda"
+  },
+  "tokens": {
+    "title": "Tokens de acesso",
+    "subtitle": "Gerir tokens de acesso API para integrações e automação",
+    "create": "Criar token",
+    "create_title": "Criar novo token",
+    "name": "Nome do token",
+    "name_placeholder": "Insira o nome do token",
+    "description": "Descrição",
+    "description_placeholder": "Descrição opcional para este token",
+    "expiration": "Expiração",
+    "no_expiration": "Sem expiração",
+    "days_30": "30 dias",
+    "days_60": "60 dias",
+    "days_90": "90 dias",
+    "days_180": "180 dias",
+    "days_365": "1 ano",
+    "permissions": "Permissões",
+    "perm_read": "Leitura",
+    "perm_read_desc": "Acesso só de leitura aos dados",
+    "perm_write": "Escrita",
+    "perm_write_desc": "Criar e modificar recursos",
+    "perm_delete": "Exclusão",
+    "perm_delete_desc": "Excluir recursos",
+    "perm_admin": "Administrador",
+    "perm_admin_desc": "Acesso administrativo completo",
+    "created": "Token criado com sucesso",
+    "copy_warning": "Copie este token agora. Não o verá novamente!",
+    "copy_token": "Copiar token",
+    "copied": "Token copiado para a área de transferência",
+    "no_tokens": "Sem tokens criados",
+    "no_tokens_desc": "Crie o seu primeiro token de acesso para começar",
+    "col_name": "Nome",
+    "col_created": "Criado",
+    "col_expires": "Expira",
+    "col_last_used": "Última utilização",
+    "col_actions": "Ações",
+    "never_used": "Nunca usado",
+    "never_expires": "Nunca",
+    "expired": "Expirado",
+    "revoke": "Revogar",
+    "revoke_title": "Revogar token",
+    "revoke_confirm": "Tem a certeza que deseja revogar este token? Esta ação não pode ser desfeita.",
+    "revoked": "Token revogado com sucesso",
+    "delete_confirm": "Tem a certeza que deseja excluir este token?"
+  },
+  "tutorial": {
+    "welcome": "Bem-vindo ao BetterDesk",
+    "welcome_message": "Vamos fazer uma breve visita guiada para começar com o painel de administração.",
+    "step_dashboard": "Painel",
+    "step_dashboard_desc": "Veja estatísticas gerais, estado dos dispositivos e atividade recente.",
+    "step_devices": "Dispositivos",
+    "step_devices_desc": "Gira todos os dispositivos conectados, grupos e livros de endereços.",
+    "step_users": "Utilizadores",
+    "step_users_desc": "Crie e gira contas de utilizadores com diferentes níveis de permissões.",
+    "step_settings": "Definições",
+    "step_settings_desc": "Configure as definições do servidor, temas e preferências.",
+    "step_complete": "Visita concluída!",
+    "step_complete_desc": "Está pronto para começar a usar o BetterDesk. Boa sorte!",
+    "next": "Seguinte",
+    "previous": "Anterior",
+    "skip": "Saltar visita",
+    "finish": "Concluir",
+    "dont_show": "Não mostrar novamente",
+    "restart_tour": "Reiniciar visita",
+    "help": "Ajuda",
+    "help_center": "Centro de ajuda",
+    "documentation": "Documentação",
+    "keyboard_shortcuts": "Atalhos de teclado",
+    "report_issue": "Reportar problema"
   }
 }
+
diff --git a/web-nodejs/lang/zh.json b/web-nodejs/lang/zh.json
index 4006811d..1e951b01 100644
--- a/web-nodejs/lang/zh.json
+++ b/web-nodejs/lang/zh.json
@@ -19,7 +19,15 @@
     "info": "信息",
     "all": "全部",
     "cancel": "取消",
-    "delete": "删除"
+    "delete": "删除",
+    "actions": "操作",
+    "close": "关闭",
+    "required": "必填",
+    "name_required": "名称为必填项",
+    "active": "活动",
+    "inactive": "非活动",
+    "invalid_json": "无效的 JSON",
+    "field_required": "{field} 为必填项"
   },
   "nav": {
     "main": "主要",
@@ -33,6 +41,7 @@
     "users": "用户",
     "inventory": "资产清单",
     "tickets": "工单",
+    "help_requests": "帮助请求",
     "activity": "活动",
     "automation": "自动化",
     "file_transfer": "文件传输",
@@ -41,7 +50,10 @@
     "reports": "报表",
     "tenants": "租户",
     "registrations": "注册",
-    "toggle_sidebar": "切换侧边栏"
+    "management": "管理",
+    "toggle_sidebar": "切换侧边栏",
+    "cdap": "CDAP 设备",
+    "tokens": "设备令牌"
   },
   "auth": {
     "login": "登录",
@@ -157,7 +169,27 @@
     "filter_type_desktop": "桌面",
     "filter_type_scada": "SCADA",
     "filter_type_iot": "物联网",
-    "filter_type_agent": "代理"
+    "filter_type_agent": "代理",
+    "cdap_connected": "CDAP 已连接",
+    "revoke": "撤销",
+    "revoke_option": "撤销设备",
+    "revoke_hint": "阻止设备 ID 并断开活动连接",
+    "revoke_success": "设备已成功撤销",
+    "tabs": {
+      "info": "信息",
+      "hardware": "硬件",
+      "metrics": "指标",
+      "history": "历史"
+    },
+    "hardware": {
+      "title": "硬件信息",
+      "os": "操作系统",
+      "cpu": "处理器",
+      "memory": "内存",
+      "disk": "磁盘",
+      "gpu": "显卡",
+      "network": "网络适配器"
+    }
   },
   "keys": {
     "title": "服务器密钥",
@@ -314,9 +346,10 @@
   },
   "time": {
     "just_now": "刚刚",
-    "minutes_ago": "{count} 分钟前",
-    "hours_ago": "{count} 小时前",
-    "days_ago": "{count} 天前"
+    "seconds_ago": "{count}秒前",
+    "minutes_ago": "{count}分钟前",
+    "hours_ago": "{count}小时前",
+    "days_ago": "{count}天前"
   },
   "users": {
     "title": "用户管理",
@@ -544,6 +577,8 @@
     "action_native_remote_desc": "原生 JPEG 流 — 无需插件",
     "action_connect_desktop": "桌面客户端",
     "action_connect_desktop_desc": "在桌面客户端应用中打开",
+    "action_connect_web": "网页远程",
+    "action_connect_web_desc": "通过浏览器远程桌面连接",
     "action_change_id_desc": "更改设备注册 ID",
     "action_ban_desc": "阻止此设备连接",
     "action_unban_desc": "允许此设备重新连接",
@@ -728,7 +763,24 @@
     "category_other": "其他",
     "summary": "摘要",
     "details": "详情",
-    "refresh": "刷新"
+    "refresh": "刷新",
+    "search": "搜索设备...",
+    "date_range": "日期范围",
+    "device_id": "设备ID",
+    "reported_at": "报告时间",
+    "no_activity": "暂无活动记录",
+    "detail": "详情",
+    "no_apps": "暂无应用",
+    "session_start": "会话开始",
+    "session_end": "会话结束",
+    "status": "状态",
+    "user": "用户",
+    "export": "导出",
+    "export_csv": "导出为CSV",
+    "export_json": "导出为JSON",
+    "time_range": "时间范围",
+    "today": "今天",
+    "last_7_days": "最近7天"
   },
   "automation": {
     "title": "自动化与告警",
@@ -796,7 +848,9 @@
     "smtp_test_failed": "连接失败",
     "no_rules": "暂未配置告警规则",
     "no_alerts": "暂无告警触发",
-    "no_commands": "暂无已发送的命令"
+    "no_commands": "暂无已发送的命令",
+    "no_commands_sent": "尚未发送任何命令",
+    "id_payload_required": "设备 ID 和命令内容为必填项"
   },
   "file_transfer": {
     "title": "文件传输",
@@ -880,7 +934,26 @@
     "no_targets": "暂未配置监控目标",
     "no_history": "暂无检查历史",
     "error_code": "错误",
-    "status_code": "HTTP 状态码"
+    "status_code": "HTTP 状态码",
+    "search_targets": "搜索目标...",
+    "name": "名称",
+    "tab_targets": "目标",
+    "tab_tools": "工具",
+    "avg_latency": "平均延迟",
+    "type": "类型",
+    "latency": "延迟",
+    "check_history": "检查历史",
+    "name_host_required": "名称和主机为必填项",
+    "uptime": "运行时间",
+    "response_time": "响应时间",
+    "avg_response": "平均响应",
+    "charts": "图表",
+    "realtime": "实时",
+    "response_time_ms": "响应时间 (ms)",
+    "uptime_percent": "运行时间 %",
+    "last_24h": "过去24小时",
+    "last_7d": "过去7天",
+    "last_30d": "过去30天"
   },
   "dataguard": {
     "title": "数据防护 — DLP",
@@ -891,6 +964,7 @@
     "delete_confirm": "确定要删除此策略吗？",
     "policy_name": "名称",
     "policy_description": "描述",
+    "status": "状态",
     "enabled": "已启用",
     "disabled": "已禁用",
     "rules": "规则",
@@ -976,7 +1050,23 @@
     "os_distribution": "操作系统分布",
     "avg_ram": "平均内存",
     "alert_rules": "告警规则",
-    "recent_alerts": "最近告警"
+    "recent_alerts": "最近告警",
+    "tab_generate": "生成",
+    "tab_saved": "已保存的报告",
+    "type_devices_desc": "所有注册设备概览",
+    "type_activity_desc": "应用使用和会话统计",
+    "type_security_desc": "安全事件和被禁用设备",
+    "type_tickets_desc": "支持工单统计和摘要",
+    "type_network_desc": "网络监控和运行时间数据",
+    "type_inventory_desc": "硬件和软件清单",
+    "type_alerts_desc": "告警和规则历史",
+    "report_name": "报告名称",
+    "format": "格式",
+    "save": "保存",
+    "preview": "预览",
+    "download": "下载",
+    "no_saved": "暂无已保存的报告",
+    "delete_saved": "删除已保存的报告"
   },
   "tenants": {
     "title": "多租户",
@@ -1010,7 +1100,17 @@
     "total_users": "用户总数",
     "created_at": "创建时间",
     "updated_at": "更新时间",
-    "slug_exists": "租户标识符已存在"
+    "slug_exists": "租户标识符已存在",
+    "total_tenants": "租户总数",
+    "active_tenants": "活跃租户",
+    "search": "搜索租户...",
+    "create_tenant": "创建租户",
+    "detail": "租户详情",
+    "contact": "联系方式",
+    "enabled": "已启用",
+    "max": "最大",
+    "info": "租户信息",
+    "status": "状态"
   },
   "registrations": {
     "title": "设备注册",
@@ -1092,7 +1192,60 @@
     "cdap_connections": "活跃连接",
     "send_command": "发送命令",
     "command_sent": "命令发送成功",
-    "command_failed": "命令发送失败"
+    "command_failed": "命令发送失败",
+    "devices_title": "CDAP 设备",
+    "devices_subtitle": "通过自定义设备应用协议连接的设备",
+    "stat_connected": "已连接",
+    "stat_port": "端口",
+    "search_devices": "搜索设备...",
+    "no_devices": "没有已连接的设备",
+    "no_devices_desc": "当前没有 CDAP 设备连接。设备连接到网关后将显示在此处。",
+    "gateway_disabled": "CDAP 网关已禁用",
+    "gateway_disabled_desc": "在服务器配置中设置 CDAP_ENABLED=true 以启用 CDAP 网关。",
+    "gateway_active": "活跃",
+    "toggle_enable": "启用 CDAP",
+    "toggle_disable": "禁用 CDAP",
+    "enabled_restart": "CDAP 已启用。需要重启服务器以应用更改。",
+    "disabled_restart": "CDAP 已禁用。需要重启服务器以应用更改。",
+    "widgets": "个控件",
+    "type_all": "全部",
+    "type_iot": "物联网",
+    "type_scada": "SCADA",
+    "type_os_agent": "OS 代理",
+    "type_network": "网络",
+    "type_camera": "摄像头",
+    "type_custom": "自定义",
+    "active_alerts": "活动告警",
+    "alert_fired": "告警触发",
+    "alert_cleared": "告警已清除",
+    "no_alerts": "无活动告警",
+    "connect_terminal": "连接终端",
+    "table_search": "搜索...",
+    "just_now": "刚刚",
+    "terminal_connecting": "正在连接设备...",
+    "terminal_disconnected": "已断开连接",
+    "terminal_error": "终端连接失败",
+    "linked_devices": "关联设备",
+    "link_device": "关联设备",
+    "unlink_device": "取消关联",
+    "no_linked_devices": "无关联设备",
+    "unlink_confirm": "确定要取消关联此设备吗？",
+    "link_prompt": "输入要关联的设备 Peer ID：",
+    "connect_desktop": "连接桌面",
+    "connect_video": "连接视频流",
+    "connect_files": "浏览文件",
+    "connect_audio": "连接音频",
+    "upload_file": "上传",
+    "desktop_connecting": "连接中...",
+    "video_connecting": "连接中...",
+    "files_connecting": "连接中...",
+    "audio_connecting": "连接中...",
+    "audio_streaming": "播放中",
+    "clipboard_in": "已接收剪贴板",
+    "clipboard_out": "已发送剪贴板",
+    "monitor_select": "选择显示器",
+    "keyframe_request": "请求关键帧",
+    "quality_auto": "自动画质"
   },
   "desktop": {
     "switch_mode": "桌面模式",
@@ -1101,6 +1254,129 @@
     "minimize": "最小化",
     "maximize": "最大化",
     "restore": "还原",
-    "close": "关闭"
+    "close": "关闭",
+    "widgets_mode": "小组件",
+    "windows_mode": "窗口",
+    "wallpaper": "壁纸",
+    "add_widget": "添加小组件",
+    "remove_widget": "移除小组件",
+    "configure": "配置",
+    "search_widgets": "搜索小组件...",
+    "cat_monitoring": "监控",
+    "cat_devices": "设备",
+    "cat_tools": "工具",
+    "cat_general": "通用",
+    "notes_placeholder": "在这里写笔记...",
+    "search_placeholder": "搜索设备、页面、设置...",
+    "search_pages": "页面",
+    "search_devices": "设备",
+    "search_no_results": "无结果",
+    "exit_desktop": "退出桌面"
+  },
+  "tokens": {
+    "title": "设备令牌",
+    "subtitle": "管理自动设备配置的注册令牌",
+    "enrollment_mode": "注册模式",
+    "mode_open": "开放",
+    "mode_open_desc": "任何设备无需令牌即可注册",
+    "mode_managed": "托管",
+    "mode_managed_desc": "设备需要有效令牌才能注册",
+    "mode_locked": "锁定",
+    "mode_locked_desc": "不允许新设备注册",
+    "total": "令牌总数",
+    "active": "活跃",
+    "used": "已使用",
+    "revoked": "已撤销",
+    "search_placeholder": "搜索令牌...",
+    "status_pending": "待处理",
+    "status_active": "活跃",
+    "status_used": "已使用",
+    "status_revoked": "已撤销",
+    "status_expired": "已过期",
+    "bulk_generate": "批量生成",
+    "create": "创建令牌",
+    "edit": "编辑令牌",
+    "token": "令牌",
+    "name": "名称",
+    "status": "状态",
+    "uses": "使用次数",
+    "bound_peer": "绑定设备",
+    "expires": "过期时间",
+    "created": "创建时间",
+    "actions": "操作",
+    "name_placeholder": "例如：办公电脑批次",
+    "max_uses": "最大使用次数",
+    "max_uses_hint": "0 = 不限",
+    "expires_in": "过期时间",
+    "no_expiration": "永不过期",
+    "expires_1h": "1小时",
+    "expires_24h": "24小时",
+    "expires_7d": "7天",
+    "expires_30d": "30天",
+    "note": "备注",
+    "note_placeholder": "关于此令牌的可选备注...",
+    "count": "数量",
+    "count_range": "要生成的令牌数量（1-100）",
+    "name_prefix": "名称前缀",
+    "generate": "生成",
+    "token_created": "令牌已创建",
+    "tokens_generated": "令牌已生成",
+    "copy_warning": "请立即复制令牌，之后将不再显示。",
+    "copy_token": "复制令牌",
+    "copied": "已复制！",
+    "revoke": "撤销",
+    "revoke_confirm": "确定要撤销此令牌吗？已使用该令牌注册的设备不受影响。",
+    "revoked_success": "令牌已撤销",
+    "no_tokens": "未找到令牌",
+    "expired": "已过期",
+    "never": "永不",
+    "save": "保存",
+    "cancel": "取消",
+    "unlimited": "不限"
+  },
+  "tutorial": {
+    "next": "下一步",
+    "prev": "上一步",
+    "skip": "跳过",
+    "finish": "完成",
+    "step_of": "{current} / {total}",
+    "console_sidebar_title": "导航侧栏",
+    "console_sidebar_text": "从这里访问所有模块。点击任意图标导航到相应部分。侧栏会根据屏幕大小自适应。",
+    "console_dashboard_title": "仪表盘",
+    "console_dashboard_text": "您的控制中心，显示服务器状态、在线设备和快捷操作。一目了然地监控重要指标。",
+    "console_devices_title": "设备管理",
+    "console_devices_text": "查看、搜索和管理所有已连接的设备。按状态筛选、分配标签并配置单个设备设置。",
+    "console_settings_title": "设置",
+    "console_settings_text": "配置服务器行为、安全选项、品牌和用户管理。根据您的需求自定义 BetterDesk。",
+    "console_desktop_title": "桌面模式",
+    "console_desktop_text": "切换到带有窗口工作区和小部件的桌面模式。非常适合多任务处理和监控仪表板。",
+    "desktop_widgets_title": "小部件面板",
+    "desktop_widgets_text": "您的可自定义工作区。小部件显示实时信息并提供功能快捷访问。拖拽可重新排列。",
+    "desktop_add_widget_title": "添加小部件",
+    "desktop_add_widget_text": "点击这里浏览可用的小部件。从监控显示、设备列表、笔记等中选择。",
+    "desktop_taskbar_title": "任务栏",
+    "desktop_taskbar_text": "打开的应用程序显示在这里。点击聚焦或最小化窗口。时钟显示当前时间，壁纸按钮更换背景。",
+    "desktop_windows_title": "应用窗口",
+    "desktop_windows_text": "应用程序在可拖动、可调整大小的窗口中打开。从标题栏最小化、最大化或关闭。窗口层级在小部件之上。",
+    "desktop_search_title": "快速搜索",
+    "desktop_search_text": "跨设备、页面和设置搜索。随时按 Ctrl+K 打开搜索。"
+  },
+  "help_request": {
+    "title": "帮助请求",
+    "subtitle": "管理来自桌面客户端的帮助请求",
+    "new_request": "新帮助请求",
+    "device": "设备",
+    "hostname": "主机名",
+    "message": "消息",
+    "status": "状态",
+    "pending": "待处理",
+    "accepted": "已接受",
+    "resolved": "已解决",
+    "accept": "接受",
+    "resolve": "解决",
+    "no_requests": "没有帮助请求",
+    "notification": "收到来自的帮助请求",
+    "stats_total": "总计",
+    "filter_all": "全部"
   }
 }
diff --git a/web-nodejs/middleware/rateLimiter.js b/web-nodejs/middleware/rateLimiter.js
index 16083a27..1754a43c 100644
--- a/web-nodejs/middleware/rateLimiter.js
+++ b/web-nodejs/middleware/rateLimiter.js
@@ -19,6 +19,15 @@ const apiLimiter = rateLimit({
     },
     keyGenerator: (req) => {
         return req.ip || req.headers['x-forwarded-for'] || 'unknown';
+    },
+    skip: (req) => {
+        // Skip rate limiting for widget data endpoints from same-origin panel requests
+        // These are internal dashboard/widget refresh calls, not external abuse
+        const widgetPaths = ['/api/stats', '/api/server/status', '/api/devices', '/api/audit/conn'];
+        if (widgetPaths.some(p => req.path.startsWith(p)) && req.headers.referer && req.session && req.session.userId) {
+            return true;
+        }
+        return false;
     }
 });
 
diff --git a/web-nodejs/public/css/activity.css b/web-nodejs/public/css/activity.css
new file mode 100644
index 00000000..83cd4b22
--- /dev/null
+++ b/web-nodejs/public/css/activity.css
@@ -0,0 +1,119 @@
+/* BetterDesk Console - Activity Styles */
+
+/* filter group */
+.filter-group {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+}
+
+.filter-group label {
+    color: var(--text-secondary);
+    font-size: 13px;
+    white-space: nowrap;
+}
+
+.filter-group input[type="date"] {
+    padding: 6px 10px;
+    background: var(--bg-tertiary);
+    border: 1px solid var(--border-primary);
+    border-radius: 6px;
+    color: var(--text-primary);
+    font-size: 13px;
+}
+
+.filter-group input[type="date"]::-webkit-calendar-picker-indicator {
+    filter: invert(0.7);
+}
+
+.range-sep {
+    color: var(--text-muted);
+    font-size: 14px;
+}
+
+/* sessions list */
+.session-item {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    padding: 10px 12px;
+    background: var(--bg-tertiary);
+    border-radius: 6px;
+    margin-bottom: 6px;
+    font-size: 13px;
+}
+
+.session-item .session-time {
+    color: var(--text-muted);
+    min-width: 130px;
+}
+
+.session-item .session-dur {
+    color: var(--accent-blue);
+    margin-left: auto;
+    font-variant-numeric: tabular-nums;
+}
+
+.session-item .session-user {
+    color: var(--text-secondary);
+}
+
+/* apps list */
+.app-item {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    padding: 8px 12px;
+    background: var(--bg-tertiary);
+    border-radius: 6px;
+    margin-bottom: 6px;
+}
+
+.app-item .app-name {
+    flex: 1;
+    color: var(--text-primary);
+    font-size: 14px;
+    font-weight: 500;
+}
+
+.app-item .app-bar-wrapper {
+    flex: 2;
+    display: flex;
+    align-items: center;
+    gap: 8px;
+}
+
+.app-bar {
+    flex: 1;
+    height: 8px;
+    background: var(--bg-primary);
+    border-radius: 4px;
+    overflow: hidden;
+}
+
+.app-bar-fill {
+    height: 100%;
+    background: var(--accent-blue);
+    border-radius: 4px;
+    transition: width 0.3s ease;
+}
+
+.app-item .app-time {
+    color: var(--text-muted);
+    font-size: 12px;
+    min-width: 50px;
+    text-align: right;
+    font-variant-numeric: tabular-nums;
+}
+
+/* duration cell */
+.duration-cell {
+    font-variant-numeric: tabular-nums;
+    color: var(--text-secondary);
+}
+
+/* responsive */
+@media (max-width: 768px) {
+    .filter-group { flex-wrap: wrap; }
+    .page-filters { flex-direction: column; gap: 10px; }
+}
diff --git a/web-nodejs/public/css/automation.css b/web-nodejs/public/css/automation.css
new file mode 100644
index 00000000..a65937fe
--- /dev/null
+++ b/web-nodejs/public/css/automation.css
@@ -0,0 +1,181 @@
+/**
+ * BetterDesk Console - Automation Page Styles
+ */
+
+.automation-page {
+    padding: 0;
+}
+
+.automation-page .page-header {
+    margin-bottom: 20px;
+}
+
+.automation-page .page-title h1 {
+    margin: 0;
+    font-size: 1.5rem;
+    font-weight: 600;
+    color: var(--text-primary);
+}
+
+.automation-page .page-subtitle {
+    margin: 4px 0 0;
+    font-size: 0.875rem;
+    color: var(--text-secondary);
+}
+
+/* Tab bar */
+.tab-bar {
+    display: flex;
+    gap: 4px;
+    margin-bottom: 24px;
+    border-bottom: 1px solid var(--border-primary);
+    overflow-x: auto;
+}
+
+.tab-btn {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    padding: 10px 16px;
+    background: none;
+    border: none;
+    border-bottom: 2px solid transparent;
+    color: var(--text-secondary);
+    font-size: 0.875rem;
+    font-weight: 500;
+    cursor: pointer;
+    white-space: nowrap;
+    transition: all 0.15s;
+}
+
+.tab-btn:hover {
+    color: var(--text-primary);
+    background: var(--bg-hover);
+}
+
+.tab-btn.active {
+    color: var(--accent-blue);
+    border-bottom-color: var(--accent-blue);
+}
+
+.tab-btn .material-icons {
+    font-size: 18px;
+}
+
+.tab-panel {
+    display: none;
+}
+
+.tab-panel.active {
+    display: block;
+}
+
+.panel-actions {
+    display: flex;
+    gap: 12px;
+    align-items: center;
+    margin-bottom: 16px;
+    flex-wrap: wrap;
+}
+
+/* Severity badges */
+.severity-badge {
+    display: inline-block;
+    padding: 2px 8px;
+    border-radius: 10px;
+    font-size: 0.75rem;
+    font-weight: 600;
+}
+
+.severity-badge.info { background: var(--accent-blue-muted); color: var(--accent-blue); }
+.severity-badge.warning { background: var(--accent-yellow-muted); color: var(--accent-yellow); }
+.severity-badge.critical { background: var(--accent-red-muted); color: var(--accent-red); }
+
+/* Command status */
+.cmd-status {
+    display: inline-block;
+    padding: 2px 8px;
+    border-radius: 10px;
+    font-size: 0.75rem;
+    font-weight: 600;
+}
+
+.cmd-status.pending { background: var(--bg-tertiary); color: var(--text-secondary); }
+.cmd-status.running { background: var(--accent-yellow-muted); color: var(--accent-yellow); }
+.cmd-status.completed { background: var(--accent-green-muted); color: var(--accent-green); }
+.cmd-status.failed { background: var(--accent-red-muted); color: var(--accent-red); }
+
+/* Toggle switch */
+.toggle-indicator {
+    display: inline-block;
+    width: 10px;
+    height: 10px;
+    border-radius: 50%;
+}
+
+.toggle-indicator.on { background: var(--accent-green); }
+.toggle-indicator.off { background: var(--text-tertiary); }
+
+/* SMTP form */
+.smtp-form-wrapper {
+    max-width: 600px;
+}
+
+.smtp-form-wrapper .form-row {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 16px;
+}
+
+.smtp-form-wrapper .form-group {
+    margin-bottom: 16px;
+}
+
+.smtp-form-wrapper .form-group label {
+    display: block;
+    margin-bottom: 4px;
+    font-size: 0.8rem;
+    font-weight: 600;
+    color: var(--text-secondary);
+}
+
+.form-actions {
+    display: flex;
+    gap: 8px;
+    margin-top: 16px;
+}
+
+/* Command result */
+.result-output {
+    background: var(--bg-tertiary);
+    border: 1px solid var(--border-primary);
+    border-radius: 6px;
+    padding: 12px;
+    font-family: var(--font-mono, monospace);
+    font-size: 0.8rem;
+    white-space: pre-wrap;
+    word-break: break-all;
+    max-height: 400px;
+    overflow-y: auto;
+    color: var(--text-primary);
+}
+
+/* Responsive */
+@media (max-width: 768px) {
+    .tab-bar {
+        gap: 0;
+    }
+
+    .tab-btn {
+        padding: 8px 10px;
+        font-size: 0.8rem;
+    }
+
+    .tab-btn .material-icons {
+        font-size: 16px;
+    }
+
+    .smtp-form-wrapper .form-row {
+        grid-template-columns: 1fr;
+    }
+}
diff --git a/web-nodejs/public/css/cdap.css b/web-nodejs/public/css/cdap.css
index 39e93127..eedc14f7 100644
--- a/web-nodejs/public/css/cdap.css
+++ b/web-nodejs/public/css/cdap.css
@@ -1,8 +1,386 @@
 /**
- * BetterDesk Console - CDAP Device Page Styles
- * Widget grid layout, individual widget types, and command log.
+ * BetterDesk Console - CDAP Styles
+ * Device list page, widget grid layout, individual widget types, and command log.
  */
 
+/* ═══════════════════════════════════════════════════════════════════
+   DEVICES LIST PAGE
+   ═══════════════════════════════════════════════════════════════════ */
+
+/* ── List Page Layout ─────────────────────────────────────────────── */
+
+.cdap-list-page {
+    max-width: 1400px;
+    margin: 0 auto;
+}
+
+/* ── Gateway Banner ───────────────────────────────────────────────── */
+
+.cdap-gateway-banner {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    background: var(--card-bg, #161b22);
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: var(--radius-md, 8px);
+    padding: 1rem 1.25rem;
+    margin-bottom: 1.25rem;
+    gap: 1rem;
+}
+
+.cdap-gateway-status {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    font-weight: 600;
+    font-size: 0.9rem;
+}
+
+.cdap-gateway-status .cdap-gw-dot {
+    width: 10px;
+    height: 10px;
+    border-radius: 50%;
+    background: var(--text-tertiary, #484f58);
+    flex-shrink: 0;
+}
+
+.cdap-gateway-status.online .cdap-gw-dot {
+    background: var(--success-color, #3fb950);
+    box-shadow: 0 0 6px var(--success-color, #3fb950);
+}
+
+.cdap-gateway-stats {
+    display: flex;
+    gap: 1.5rem;
+    align-items: center;
+}
+
+.cdap-gw-stat {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 0.15rem;
+}
+
+.cdap-gw-stat-value {
+    font-size: 1.1rem;
+    font-weight: 700;
+    color: var(--text-primary, #e6edf3);
+}
+
+.cdap-gw-stat-label {
+    font-size: 0.7rem;
+    color: var(--text-tertiary, #484f58);
+    text-transform: uppercase;
+    letter-spacing: 0.04em;
+}
+
+/* ── Search & Filters ─────────────────────────────────────────────── */
+
+.cdap-list-toolbar {
+    display: flex;
+    align-items: center;
+    gap: 1rem;
+    margin-bottom: 1.25rem;
+    flex-wrap: wrap;
+}
+
+.cdap-search-wrap {
+    position: relative;
+    flex: 1;
+    min-width: 200px;
+    max-width: 360px;
+}
+
+.cdap-search-wrap .material-icons {
+    position: absolute;
+    left: 0.75rem;
+    top: 50%;
+    transform: translateY(-50%);
+    color: var(--text-tertiary, #484f58);
+    font-size: 1.1rem;
+    pointer-events: none;
+}
+
+.cdap-search-wrap input {
+    width: 100%;
+    padding: 0.55rem 0.75rem 0.55rem 2.25rem;
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: var(--radius-sm, 6px);
+    background: var(--input-bg, #0d1117);
+    color: var(--text-primary, #e6edf3);
+    font-size: 0.85rem;
+    outline: none;
+    transition: border-color 0.15s;
+}
+
+.cdap-search-wrap input:focus {
+    border-color: var(--accent-color, #58a6ff);
+}
+
+.cdap-type-filter {
+    display: flex;
+    gap: 0.35rem;
+    flex-wrap: wrap;
+}
+
+/* ── Device Grid ──────────────────────────────────────────────────── */
+
+.cdap-device-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(320px, 1fr));
+    gap: 1rem;
+}
+
+/* ── Device Card ──────────────────────────────────────────────────── */
+
+.cdap-device-card {
+    background: var(--card-bg, #161b22);
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: var(--radius-md, 8px);
+    padding: 1rem 1.15rem;
+    cursor: pointer;
+    transition: border-color 0.15s, box-shadow 0.15s, transform 0.1s;
+}
+
+.cdap-device-card:hover {
+    border-color: var(--accent-color, #58a6ff);
+    box-shadow: 0 2px 12px rgba(88, 166, 255, 0.08);
+    transform: translateY(-1px);
+}
+
+.cdap-device-card.online {
+    border-left: 3px solid var(--success-color, #3fb950);
+}
+
+.cdap-device-card.offline {
+    border-left: 3px solid var(--text-tertiary, #484f58);
+    opacity: 0.75;
+}
+
+.cdap-card-header {
+    display: flex;
+    align-items: flex-start;
+    gap: 0.75rem;
+    margin-bottom: 0.75rem;
+}
+
+.cdap-card-icon {
+    width: 40px;
+    height: 40px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    border-radius: var(--radius-sm, 6px);
+    background: var(--bg-tertiary, #21262d);
+    color: var(--accent-color, #58a6ff);
+    flex-shrink: 0;
+}
+
+.cdap-card-icon .material-icons {
+    font-size: 1.25rem;
+}
+
+.cdap-card-identity {
+    flex: 1;
+    min-width: 0;
+}
+
+.cdap-card-name {
+    font-weight: 600;
+    font-size: 0.95rem;
+    color: var(--text-primary, #e6edf3);
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: ellipsis;
+}
+
+.cdap-card-id {
+    font-size: 0.75rem;
+    color: var(--text-tertiary, #484f58);
+    font-family: var(--font-mono, monospace);
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: ellipsis;
+}
+
+.cdap-card-status {
+    display: flex;
+    align-items: center;
+    gap: 0.35rem;
+    font-size: 0.75rem;
+    font-weight: 500;
+    white-space: nowrap;
+    flex-shrink: 0;
+}
+
+.cdap-card-status .cdap-status-dot {
+    width: 7px;
+    height: 7px;
+    border-radius: 50%;
+    background: var(--text-tertiary, #484f58);
+}
+
+.cdap-card-status.online {
+    color: var(--success-color, #3fb950);
+}
+
+.cdap-card-status.online .cdap-status-dot {
+    background: var(--success-color, #3fb950);
+    box-shadow: 0 0 4px var(--success-color, #3fb950);
+}
+
+.cdap-card-status.offline {
+    color: var(--text-tertiary, #484f58);
+}
+
+/* ── Card Meta ────────────────────────────────────────────────────── */
+
+.cdap-card-meta {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.75rem;
+    margin-bottom: 0.75rem;
+    padding-bottom: 0.65rem;
+    border-bottom: 1px solid var(--border-subtle, rgba(48, 54, 61, 0.5));
+}
+
+.cdap-card-meta-item {
+    display: flex;
+    align-items: center;
+    gap: 0.3rem;
+    font-size: 0.78rem;
+    color: var(--text-secondary, #8b949e);
+}
+
+.cdap-card-meta-item .material-icons {
+    font-size: 0.9rem;
+    color: var(--text-tertiary, #484f58);
+}
+
+/* ── Card Footer ──────────────────────────────────────────────────── */
+
+.cdap-card-footer {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+}
+
+.cdap-card-hb {
+    display: flex;
+    align-items: center;
+    gap: 0.25rem;
+    font-size: 0.75rem;
+    color: var(--text-secondary, #8b949e);
+}
+
+.cdap-card-hb .material-icons {
+    font-size: 0.85rem;
+    color: var(--danger-color, #f85149);
+}
+
+.cdap-card-hb.muted {
+    color: var(--text-tertiary, #484f58);
+}
+
+.cdap-card-arrow {
+    color: var(--text-tertiary, #484f58);
+    font-size: 1.1rem;
+    transition: color 0.15s;
+}
+
+.cdap-device-card:hover .cdap-card-arrow {
+    color: var(--accent-color, #58a6ff);
+}
+
+/* ── Empty / Disabled States ──────────────────────────────────────── */
+
+.cdap-empty-state,
+.cdap-disabled-state {
+    text-align: center;
+    padding: 3rem 1.5rem;
+    color: var(--text-tertiary, #484f58);
+}
+
+.cdap-empty-state .material-icons,
+.cdap-disabled-state .material-icons {
+    font-size: 3rem;
+    margin-bottom: 0.75rem;
+    display: block;
+}
+
+.cdap-empty-state h3,
+.cdap-disabled-state h3 {
+    font-size: 1.1rem;
+    color: var(--text-secondary, #8b949e);
+    margin: 0 0 0.5rem;
+}
+
+.cdap-empty-state p,
+.cdap-disabled-state p {
+    font-size: 0.85rem;
+    max-width: 420px;
+    margin: 0 auto;
+    line-height: 1.5;
+}
+
+/* ── List Page Loading ────────────────────────────────────────────── */
+
+.cdap-list-loading {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: 3rem;
+    color: var(--text-tertiary, #484f58);
+    gap: 0.5rem;
+}
+
+.cdap-list-loading .spinner {
+    width: 20px;
+    height: 20px;
+    border: 2px solid var(--border-color, #30363d);
+    border-top-color: var(--accent-color, #58a6ff);
+    border-radius: 50%;
+    animation: cdap-spin 0.6s linear infinite;
+}
+
+@keyframes cdap-spin {
+    to { transform: rotate(360deg); }
+}
+
+/* ── List Page Responsive ─────────────────────────────────────────── */
+
+@media (max-width: 768px) {
+    .cdap-gateway-banner {
+        flex-direction: column;
+        align-items: flex-start;
+    }
+
+    .cdap-list-toolbar {
+        flex-direction: column;
+        align-items: stretch;
+    }
+
+    .cdap-search-wrap {
+        max-width: none;
+    }
+
+    .cdap-device-grid {
+        grid-template-columns: 1fr;
+    }
+}
+
+@media (max-width: 480px) {
+    .cdap-gateway-stats {
+        flex-wrap: wrap;
+        gap: 1rem;
+    }
+}
+
+/* ═══════════════════════════════════════════════════════════════════
+   DEVICE DETAIL PAGE
+   ═══════════════════════════════════════════════════════════════════ */
+
 /* ── Page Layout ──────────────────────────────────────────────────── */
 
 .cdap-device-page {
@@ -117,6 +495,271 @@
     font-size: 20px;
 }
 
+/* ── Alerts Panel ─────────────────────────────────────────────────── */
+
+.cdap-alerts-panel {
+    background: var(--card-bg, #161b22);
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: var(--radius-md, 8px);
+    margin-bottom: var(--space-lg, 1.5rem);
+    overflow: hidden;
+}
+
+.cdap-alerts-header {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: 0.75rem 1rem;
+    border-bottom: 1px solid var(--border-color, #30363d);
+    background: rgba(210, 153, 34, 0.08);
+}
+
+.cdap-alerts-header h3 {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    margin: 0;
+    font-size: 0.9rem;
+    font-weight: 600;
+    color: var(--text-primary, #e6edf3);
+}
+
+.cdap-alerts-header .material-icons {
+    font-size: 18px;
+    color: #d29922;
+}
+
+.cdap-alerts-count {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    min-width: 20px;
+    height: 20px;
+    padding: 0 6px;
+    border-radius: 10px;
+    background: #d29922;
+    color: #fff;
+    font-size: 0.75rem;
+    font-weight: 700;
+}
+
+.cdap-alerts-list {
+    max-height: 300px;
+    overflow-y: auto;
+}
+
+.cdap-alert-item {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    padding: 0.6rem 1rem;
+    border-bottom: 1px solid var(--border-color, #30363d);
+}
+
+.cdap-alert-item:last-child {
+    border-bottom: none;
+}
+
+.cdap-alert-critical {
+    background: rgba(248, 81, 73, 0.08);
+}
+
+.cdap-alert-critical .cdap-alert-icon {
+    color: #f85149;
+}
+
+.cdap-alert-warning {
+    background: rgba(210, 153, 34, 0.08);
+}
+
+.cdap-alert-warning .cdap-alert-icon {
+    color: #d29922;
+}
+
+.cdap-alert-info {
+    background: rgba(56, 139, 253, 0.08);
+}
+
+.cdap-alert-info .cdap-alert-icon {
+    color: #388bfd;
+}
+
+.cdap-alert-icon {
+    font-size: 20px;
+    flex-shrink: 0;
+}
+
+.cdap-alert-body {
+    flex: 1;
+    min-width: 0;
+    display: flex;
+    flex-direction: column;
+    gap: 2px;
+}
+
+.cdap-alert-label {
+    font-size: 0.85rem;
+    font-weight: 600;
+    color: var(--text-primary, #e6edf3);
+}
+
+.cdap-alert-msg {
+    font-size: 0.8rem;
+    color: var(--text-secondary, #8b949e);
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: ellipsis;
+}
+
+.cdap-alert-time {
+    font-size: 0.75rem;
+    color: var(--text-secondary, #8b949e);
+    white-space: nowrap;
+    flex-shrink: 0;
+}
+
+/* ── Linked Devices Panel ──────────────────────────────────────────── */
+
+.cdap-linked-panel {
+    background: var(--card-bg, #161b22);
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: var(--radius-md, 8px);
+    margin-bottom: var(--space-lg, 1.5rem);
+    overflow: hidden;
+}
+
+.cdap-linked-header {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: 0.75rem 1rem;
+    border-bottom: 1px solid var(--border-color, #30363d);
+    background: rgba(56, 139, 253, 0.06);
+}
+
+.cdap-linked-header h3 {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    margin: 0;
+    font-size: 0.9rem;
+    font-weight: 600;
+    color: var(--text-primary, #e6edf3);
+}
+
+.cdap-linked-header .material-icons {
+    font-size: 18px;
+    color: #388bfd;
+}
+
+.cdap-linked-count {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    min-width: 20px;
+    height: 20px;
+    padding: 0 6px;
+    border-radius: 10px;
+    background: #388bfd;
+    color: #fff;
+    font-size: 0.75rem;
+    font-weight: 700;
+}
+
+.cdap-linked-list {
+    max-height: 240px;
+    overflow-y: auto;
+}
+
+.cdap-linked-empty {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    gap: 0.5rem;
+    padding: 1.25rem 1rem;
+    color: var(--text-secondary, #8b949e);
+    font-size: 0.85rem;
+}
+
+.cdap-linked-empty .material-icons {
+    font-size: 20px;
+    opacity: 0.6;
+}
+
+.cdap-linked-item {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    padding: 0.6rem 1rem;
+    border-bottom: 1px solid var(--border-color, #30363d);
+    transition: background 0.15s;
+}
+
+.cdap-linked-item:last-child {
+    border-bottom: none;
+}
+
+.cdap-linked-item:hover {
+    background: rgba(56, 139, 253, 0.06);
+}
+
+.cdap-linked-status {
+    width: 8px;
+    height: 8px;
+    border-radius: 50%;
+    flex-shrink: 0;
+    background: var(--text-secondary, #8b949e);
+}
+
+.cdap-linked-status.online {
+    background: #3fb950;
+    box-shadow: 0 0 4px rgba(63, 185, 80, 0.4);
+}
+
+.cdap-linked-info {
+    flex: 1;
+    min-width: 0;
+    display: flex;
+    flex-direction: column;
+    gap: 1px;
+}
+
+.cdap-linked-name {
+    font-size: 0.85rem;
+    font-weight: 600;
+    color: var(--text-primary, #e6edf3);
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: ellipsis;
+}
+
+.cdap-linked-id {
+    font-size: 0.75rem;
+    color: var(--text-secondary, #8b949e);
+    font-family: var(--font-mono, 'JetBrains Mono', monospace);
+}
+
+.cdap-linked-platform {
+    font-size: 0.75rem;
+    color: var(--text-secondary, #8b949e);
+    flex-shrink: 0;
+}
+
+.cdap-unlink-btn {
+    flex-shrink: 0;
+    opacity: 0;
+    transition: opacity 0.15s;
+}
+
+.cdap-linked-item:hover .cdap-unlink-btn {
+    opacity: 1;
+}
+
+.cdap-unlink-btn .material-icons {
+    font-size: 18px;
+    color: #f85149;
+}
+
 /* ── Widget Grid ──────────────────────────────────────────────────── */
 
 .cdap-widget-grid {
@@ -175,8 +818,13 @@
     grid-column: span 2;
 }
 
+.cdap-widget-xl {
+    grid-column: 1 / -1;
+}
+
 @media (max-width: 768px) {
-    .cdap-widget-lg {
+    .cdap-widget-lg,
+    .cdap-widget-xl {
         grid-column: span 1;
     }
 }
@@ -650,6 +1298,605 @@
     font-size: 0.8rem;
 }
 
+/* ── Table Widget ──────────────────────────────────────────────────── */
+
+.cdap-table-toolbar {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    margin-bottom: 0.5rem;
+}
+
+.cdap-table-search {
+    width: 100%;
+    max-width: 260px;
+    padding: 0.3rem 0.6rem;
+    font-size: 0.78rem;
+    background: var(--bg-tertiary, #21262d);
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: var(--radius-sm, 4px);
+    color: var(--text-primary, #e6edf3);
+    outline: none;
+}
+
+.cdap-table-search:focus {
+    border-color: var(--accent, #58a6ff);
+    box-shadow: 0 0 0 2px rgba(88, 166, 255, 0.15);
+}
+
+.cdap-table-wrap {
+    overflow-x: auto;
+    max-height: 400px;
+    overflow-y: auto;
+}
+
+.cdap-table {
+    width: 100%;
+    border-collapse: collapse;
+    font-size: 0.8rem;
+}
+
+.cdap-table thead th {
+    position: sticky;
+    top: 0;
+    background: var(--bg-secondary, #161b22);
+    padding: 0.45rem 0.65rem;
+    text-align: left;
+    font-weight: 600;
+    color: var(--text-secondary, #8b949e);
+    border-bottom: 1px solid var(--border-color, #30363d);
+    white-space: nowrap;
+    user-select: none;
+}
+
+.cdap-table-sortable {
+    cursor: pointer;
+}
+
+.cdap-table-sortable::after {
+    content: '';
+    margin-left: 0.3rem;
+}
+
+.cdap-table-sortable.sort-asc::after {
+    content: '▲';
+    font-size: 0.6rem;
+}
+
+.cdap-table-sortable.sort-desc::after {
+    content: '▼';
+    font-size: 0.6rem;
+}
+
+.cdap-table tbody td {
+    padding: 0.4rem 0.65rem;
+    border-bottom: 1px solid var(--border-subtle, rgba(48, 54, 61, 0.4));
+    color: var(--text-primary, #e6edf3);
+}
+
+.cdap-table tbody tr:hover {
+    background: var(--bg-tertiary, #21262d);
+}
+
+.cdap-table-empty {
+    text-align: center;
+    color: var(--text-tertiary, #484f58);
+    font-style: italic;
+}
+
+/* Table pagination */
+.cdap-table-pagination {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    gap: 0.75rem;
+    padding: 0.5rem 0 0;
+    font-size: 0.75rem;
+    color: var(--text-secondary, #8b949e);
+}
+
+.cdap-pag-btn {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 28px;
+    height: 28px;
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: var(--radius-sm, 4px);
+    background: var(--bg-tertiary, #21262d);
+    color: var(--text-primary, #e6edf3);
+    cursor: pointer;
+    transition: background 0.15s;
+}
+
+.cdap-pag-btn:hover:not(:disabled) {
+    background: var(--bg-secondary, #161b22);
+}
+
+.cdap-pag-btn:disabled {
+    opacity: 0.35;
+    cursor: not-allowed;
+}
+
+.cdap-pag-btn .material-icons {
+    font-size: 18px;
+}
+
+.cdap-pag-info {
+    min-width: 80px;
+    text-align: center;
+}
+
+/* Table badge column type */
+.cdap-badge {
+    display: inline-block;
+    padding: 0.15rem 0.5rem;
+    border-radius: 10px;
+    font-size: 0.7rem;
+    font-weight: 600;
+    background: color-mix(in srgb, var(--badge-color, var(--accent, #58a6ff)) 18%, transparent);
+    color: var(--badge-color, var(--accent, #58a6ff));
+    border: 1px solid color-mix(in srgb, var(--badge-color, var(--accent, #58a6ff)) 30%, transparent);
+    white-space: nowrap;
+}
+
+/* Table action column type */
+.cdap-table-action {
+    padding: 0.15rem 0.5rem;
+    font-size: 0.7rem;
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: var(--radius-sm, 4px);
+    background: var(--bg-tertiary, #21262d);
+    color: var(--accent, #58a6ff);
+    cursor: pointer;
+    transition: background 0.15s;
+}
+
+.cdap-table-action:hover {
+    background: var(--bg-secondary, #161b22);
+}
+
+/* Table number column type */
+.cdap-number {
+    font-variant-numeric: tabular-nums;
+    font-family: var(--font-mono, 'Cascadia Code', 'Fira Code', monospace);
+}
+
+/* ── Terminal Widget ──────────────────────────────────────────────── */
+
+.cdap-terminal {
+    background: #0d1117;
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: var(--radius-sm, 4px);
+    min-height: 280px;
+    max-height: 480px;
+    overflow: hidden;
+    font-family: var(--font-mono, 'Cascadia Code', 'Fira Code', monospace);
+    font-size: 0.78rem;
+    line-height: 1.5;
+    position: relative;
+}
+
+.cdap-terminal-output {
+    padding: 0.5rem 0.75rem;
+    overflow-y: auto;
+    max-height: 278px;
+}
+
+.cdap-terminal-line {
+    white-space: pre-wrap;
+    word-break: break-all;
+    color: var(--text-primary, #e6edf3);
+}
+
+/* Terminal connect button */
+.cdap-terminal-connect {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: 1.5rem;
+}
+
+.cdap-terminal-connect.hidden {
+    display: none;
+}
+
+.cdap-terminal-connect-btn {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.5rem;
+    padding: 0.6rem 1.2rem;
+    background: var(--accent, #58a6ff);
+    color: #fff;
+    border: none;
+    border-radius: var(--radius-sm, 4px);
+    font-size: 0.85rem;
+    cursor: pointer;
+    transition: background 0.15s;
+}
+
+.cdap-terminal-connect-btn:hover {
+    background: color-mix(in srgb, var(--accent, #58a6ff) 85%, white);
+}
+
+.cdap-terminal-connect-btn .material-icons {
+    font-size: 18px;
+}
+
+/* xterm.js overrides for CDAP terminal */
+.cdap-terminal .xterm {
+    padding: 0.3rem;
+    height: 100%;
+}
+
+.cdap-terminal .xterm-viewport {
+    scrollbar-width: thin;
+    scrollbar-color: var(--border-color, #30363d) transparent;
+}
+
+.cdap-terminal .xterm-viewport::-webkit-scrollbar {
+    width: 6px;
+}
+
+.cdap-terminal .xterm-viewport::-webkit-scrollbar-thumb {
+    background: var(--border-color, #30363d);
+    border-radius: 3px;
+}
+
+/* ── Desktop Widget ───────────────────────────────────────────────── */
+
+.cdap-desktop-widget {
+    position: relative;
+}
+
+.cdap-desktop-canvas-wrap {
+    position: relative;
+    background: #000;
+    border-radius: var(--radius-sm, 4px);
+    overflow: hidden;
+    aspect-ratio: 4 / 3;
+}
+
+.cdap-desktop-canvas {
+    width: 100%;
+    height: 100%;
+    object-fit: contain;
+    display: block;
+}
+
+.cdap-desktop-overlay,
+.cdap-video-overlay {
+    position: absolute;
+    inset: 0;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    gap: 0.5rem;
+    background: rgba(0, 0, 0, 0.7);
+    color: var(--text-tertiary, #484f58);
+    font-size: 0.85rem;
+}
+
+.cdap-desktop-overlay .material-icons,
+.cdap-video-overlay .material-icons {
+    font-size: 2.5rem;
+}
+
+.cdap-desktop-overlay.hidden,
+.cdap-video-overlay.hidden {
+    display: none;
+}
+
+/* ── Video Stream Widget ──────────────────────────────────────────── */
+
+.cdap-video-widget {
+    position: relative;
+}
+
+.cdap-video-container {
+    position: relative;
+    background: #000;
+    border-radius: var(--radius-sm, 4px);
+    overflow: hidden;
+    aspect-ratio: 16 / 9;
+}
+
+.cdap-video-frame {
+    width: 100%;
+    height: 100%;
+    object-fit: contain;
+    display: block;
+}
+
+.cdap-video-frame.hidden {
+    display: none;
+}
+
+/* ── File Browser Widget ──────────────────────────────────────────── */
+
+.cdap-file-browser {
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: var(--radius-sm, 4px);
+    overflow: hidden;
+}
+
+.cdap-file-toolbar {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: 0.4rem 0.65rem;
+    background: var(--bg-secondary, #161b22);
+    border-bottom: 1px solid var(--border-color, #30363d);
+}
+
+.cdap-file-path {
+    font-family: var(--font-mono, monospace);
+    font-size: 0.78rem;
+    color: var(--text-secondary, #8b949e);
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    flex: 1;
+}
+
+.cdap-file-up {
+    padding: 0.2rem 0.4rem;
+    flex-shrink: 0;
+}
+
+.cdap-file-up .material-icons {
+    font-size: 1rem;
+}
+
+.cdap-file-list {
+    max-height: 260px;
+    overflow-y: auto;
+}
+
+.cdap-file-entry {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    padding: 0.35rem 0.65rem;
+    border-bottom: 1px solid var(--border-subtle, rgba(48, 54, 61, 0.3));
+    font-size: 0.8rem;
+    cursor: default;
+}
+
+.cdap-file-entry[data-type="dir"] {
+    cursor: pointer;
+}
+
+.cdap-file-entry[data-type="dir"]:hover {
+    background: var(--bg-tertiary, #21262d);
+}
+
+.cdap-file-icon {
+    font-size: 1.1rem;
+    color: var(--text-tertiary, #484f58);
+    flex-shrink: 0;
+}
+
+.cdap-file-entry[data-type="dir"] .cdap-file-icon {
+    color: var(--accent-color, #58a6ff);
+}
+
+.cdap-file-name {
+    flex: 1;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    color: var(--text-primary, #e6edf3);
+}
+
+.cdap-file-size {
+    font-size: 0.72rem;
+    color: var(--text-tertiary, #484f58);
+    white-space: nowrap;
+    flex-shrink: 0;
+}
+
+.cdap-file-empty {
+    padding: 1rem;
+    text-align: center;
+    color: var(--text-tertiary, #484f58);
+    font-size: 0.8rem;
+    font-style: italic;
+}
+
+/* ── Connect Buttons (shared for desktop, video, file browser) ──── */
+
+.cdap-desktop-connect,
+.cdap-video-connect,
+.cdap-file-connect {
+    display: flex;
+    justify-content: center;
+    padding: 0.75rem;
+}
+
+.cdap-desktop-connect.hidden,
+.cdap-video-connect.hidden,
+.cdap-file-connect.hidden {
+    display: none;
+}
+
+.cdap-desktop-connect-btn,
+.cdap-video-connect-btn,
+.cdap-file-connect-btn {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.4rem;
+    padding: 0.5rem 1rem;
+    border-radius: var(--radius-md, 6px);
+    font-size: 0.82rem;
+    font-weight: 500;
+    cursor: pointer;
+    transition: all 0.15s ease;
+}
+
+.cdap-desktop-connect-btn {
+    background: rgba(88, 166, 255, 0.1);
+    color: var(--accent-color, #58a6ff);
+    border: 1px solid rgba(88, 166, 255, 0.25);
+}
+
+.cdap-desktop-connect-btn:hover {
+    background: rgba(88, 166, 255, 0.2);
+    border-color: rgba(88, 166, 255, 0.4);
+}
+
+.cdap-video-connect-btn {
+    background: rgba(63, 185, 80, 0.1);
+    color: var(--success-color, #3fb950);
+    border: 1px solid rgba(63, 185, 80, 0.25);
+}
+
+.cdap-video-connect-btn:hover {
+    background: rgba(63, 185, 80, 0.2);
+    border-color: rgba(63, 185, 80, 0.4);
+}
+
+.cdap-file-connect-btn {
+    background: rgba(210, 153, 34, 0.1);
+    color: var(--warning-color, #d29922);
+    border: 1px solid rgba(210, 153, 34, 0.25);
+}
+
+.cdap-file-connect-btn:hover {
+    background: rgba(210, 153, 34, 0.2);
+    border-color: rgba(210, 153, 34, 0.4);
+}
+
+.cdap-desktop-connect-btn .material-icons,
+.cdap-video-connect-btn .material-icons,
+.cdap-file-connect-btn .material-icons {
+    font-size: 1.1rem;
+}
+
+/* ── Desktop: 16:9 Canvas ───────────────────────────────────────── */
+
+.cdap-desktop-canvas-wrap {
+    aspect-ratio: 16 / 9;
+}
+
+.cdap-desktop-canvas {
+    cursor: crosshair;
+}
+
+.cdap-desktop-canvas:focus {
+    outline: 2px solid var(--accent-color, #58a6ff);
+    outline-offset: -2px;
+}
+
+/* ── Video: Canvas-based ─────────────────────────────────────────── */
+
+.cdap-video-canvas {
+    width: 100%;
+    height: 100%;
+    object-fit: contain;
+    display: block;
+}
+
+/* ── File Browser: Entries, Details, Actions ──────────────────────── */
+
+.cdap-file-dir:hover {
+    background: var(--bg-tertiary, #21262d);
+}
+
+.cdap-file-dir .cdap-file-icon {
+    color: var(--accent-color, #58a6ff);
+}
+
+.cdap-file-modified {
+    font-size: 0.72rem;
+    color: var(--text-tertiary, #484f58);
+    white-space: nowrap;
+    flex-shrink: 0;
+}
+
+.cdap-file-actions {
+    display: flex;
+    gap: 0.15rem;
+    opacity: 0;
+    transition: opacity 0.15s ease;
+    flex-shrink: 0;
+}
+
+.cdap-file-entry:hover .cdap-file-actions {
+    opacity: 1;
+}
+
+.cdap-file-download,
+.cdap-file-delete {
+    padding: 0.15rem;
+    border: none;
+    background: transparent;
+    cursor: pointer;
+    border-radius: 3px;
+    color: var(--text-tertiary, #484f58);
+    transition: color 0.15s ease, background 0.15s ease;
+}
+
+.cdap-file-download:hover {
+    color: var(--accent-color, #58a6ff);
+    background: rgba(88, 166, 255, 0.1);
+}
+
+.cdap-file-delete:hover {
+    color: var(--danger-color, #f85149);
+    background: rgba(248, 81, 73, 0.1);
+}
+
+.cdap-file-download .material-icons,
+.cdap-file-delete .material-icons {
+    font-size: 0.95rem;
+}
+
+.cdap-file-loading {
+    padding: 1.5rem;
+    text-align: center;
+    color: var(--text-tertiary, #484f58);
+    font-size: 0.82rem;
+}
+
+.cdap-file-error {
+    padding: 0.5rem 0.65rem;
+    background: rgba(248, 81, 73, 0.1);
+    color: var(--danger-color, #f85149);
+    font-size: 0.78rem;
+    border-bottom: 1px solid rgba(248, 81, 73, 0.2);
+}
+
+.cdap-file-upload-area {
+    display: flex;
+    justify-content: center;
+    padding: 0.65rem;
+    border-top: 1px solid var(--border-color, #30363d);
+}
+
+.cdap-file-upload-btn {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.35rem;
+    padding: 0.35rem 0.75rem;
+    border-radius: var(--radius-sm, 4px);
+    font-size: 0.78rem;
+    background: rgba(88, 166, 255, 0.08);
+    color: var(--accent-color, #58a6ff);
+    border: 1px solid rgba(88, 166, 255, 0.2);
+    cursor: pointer;
+    transition: background 0.15s ease;
+}
+
+.cdap-file-upload-btn:hover {
+    background: rgba(88, 166, 255, 0.15);
+}
+
+.cdap-file-upload-btn .material-icons {
+    font-size: 1rem;
+}
+
 /* ── Unsupported Widget ───────────────────────────────────────────── */
 
 .cdap-widget-unsupported {
@@ -680,3 +1927,164 @@
         grid-template-columns: 60px 1fr 40px;
     }
 }
+
+/* ───────────────────────────────────────────────────────────────────────
+   Audio Widget
+   ─────────────────────────────────────────────────────────────────────── */
+
+.cdap-audio-widget {
+    display: flex;
+    flex-direction: column;
+    gap: 0.75rem;
+}
+
+.cdap-audio-controls {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    padding: 0.5rem;
+    background: var(--bg-secondary, #161b22);
+    border-radius: 8px;
+}
+
+.cdap-audio-status {
+    font-size: 0.8rem;
+    font-weight: 500;
+    padding: 0.2rem 0.5rem;
+    border-radius: 4px;
+    white-space: nowrap;
+}
+
+.cdap-audio-status.streaming {
+    color: #3fb950;
+    background: rgba(63, 185, 80, 0.1);
+}
+
+.cdap-audio-status.connecting {
+    color: #d29922;
+    background: rgba(210, 153, 34, 0.1);
+}
+
+.cdap-audio-status.disconnected {
+    color: #8b949e;
+    background: rgba(139, 148, 158, 0.1);
+}
+
+.cdap-audio-level {
+    flex: 1;
+    min-width: 80px;
+}
+
+.cdap-audio-level-track {
+    height: 6px;
+    background: var(--bg-tertiary, #21262d);
+    border-radius: 3px;
+    overflow: hidden;
+}
+
+.cdap-audio-level-fill {
+    height: 100%;
+    border-radius: 3px;
+    transition: width 0.1s linear;
+    width: 0%;
+}
+
+.cdap-audio-level-fill.low {
+    background: #3fb950;
+}
+
+.cdap-audio-level-fill.medium {
+    background: #d29922;
+}
+
+.cdap-audio-level-fill.high {
+    background: #f85149;
+}
+
+.cdap-audio-buttons {
+    display: flex;
+    gap: 0.25rem;
+}
+
+.cdap-audio-mute-btn {
+    padding: 0.25rem;
+    min-width: unset;
+}
+
+.cdap-audio-connect {
+    text-align: center;
+}
+
+.cdap-audio-connect-btn {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.5rem;
+}
+
+/* ───────────────────────────────────────────────────────────────────────
+   Desktop Toolbar (monitor selector, clipboard indicator)
+   ─────────────────────────────────────────────────────────────────────── */
+
+.cdap-desktop-toolbar {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    padding: 0.25rem 0.5rem;
+    background: var(--bg-secondary, #161b22);
+    border-radius: 6px 6px 0 0;
+    min-height: 28px;
+}
+
+.cdap-desktop-clipboard-indicator {
+    font-size: 0.75rem;
+    padding: 0.15rem 0.4rem;
+    border-radius: 4px;
+    transition: opacity 0.3s ease;
+}
+
+.cdap-desktop-clipboard-indicator.hidden {
+    opacity: 0;
+    pointer-events: none;
+}
+
+.cdap-desktop-clipboard-indicator.clip-in {
+    color: #3fb950;
+    background: rgba(63, 185, 80, 0.15);
+}
+
+.cdap-desktop-clipboard-indicator.clip-out {
+    color: #58a6ff;
+    background: rgba(88, 166, 255, 0.15);
+}
+
+/* Monitor selector */
+.cdap-monitor-selector {
+    display: flex;
+    align-items: center;
+    gap: 0.35rem;
+    margin-left: auto;
+}
+
+.cdap-monitor-selector .material-icons {
+    font-size: 16px;
+    color: var(--text-secondary, #8b949e);
+}
+
+.cdap-monitor-select {
+    font-size: 0.75rem;
+    padding: 0.15rem 0.4rem;
+    background: var(--bg-tertiary, #21262d);
+    color: var(--text-primary, #e6edf3);
+    border: 1px solid var(--border-primary, #30363d);
+    border-radius: 4px;
+    cursor: pointer;
+}
+
+.cdap-monitor-select:hover {
+    border-color: var(--border-hover, #58a6ff);
+}
+
+/* Widget medium size (for audio) */
+.cdap-widget-md {
+    grid-column: span 2;
+}
diff --git a/web-nodejs/public/css/dataguard.css b/web-nodejs/public/css/dataguard.css
new file mode 100644
index 00000000..8554bac4
--- /dev/null
+++ b/web-nodejs/public/css/dataguard.css
@@ -0,0 +1,83 @@
+/* BetterDesk Console - DataGuard Styles */
+
+/* DG action badges */
+.dg-action-badge {
+    display: inline-flex;
+    align-items: center;
+    gap: 4px;
+    padding: 2px 10px;
+    border-radius: 12px;
+    font-size: 12px;
+    font-weight: 500;
+    text-transform: uppercase;
+}
+
+.dg-action-badge.block {
+    background: rgba(248, 81, 73, 0.15);
+    color: var(--accent-red);
+}
+
+.dg-action-badge.log {
+    background: rgba(210, 153, 34, 0.15);
+    color: var(--accent-yellow);
+}
+
+.dg-action-badge.allow {
+    background: rgba(46, 164, 79, 0.15);
+    color: var(--accent-green);
+}
+
+/* DG type badges */
+.dg-type-badge {
+    display: inline-flex;
+    align-items: center;
+    gap: 4px;
+    padding: 2px 10px;
+    border-radius: 12px;
+    font-size: 12px;
+    font-weight: 500;
+    background: rgba(88, 166, 255, 0.12);
+    color: var(--accent-blue);
+}
+
+/* Policy status */
+.policy-status {
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+    font-size: 13px;
+}
+
+.policy-status .dot {
+    width: 8px;
+    height: 8px;
+    border-radius: 50%;
+}
+
+.policy-status.active .dot { background: var(--accent-green); }
+.policy-status.active { color: var(--accent-green); }
+.policy-status.disabled .dot { background: var(--text-muted); }
+.policy-status.disabled { color: var(--text-muted); }
+
+/* event detail cell */
+.event-detail {
+    max-width: 300px;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    color: var(--text-muted);
+    font-size: 12px;
+}
+
+/* violations counter */
+.violations-count {
+    font-variant-numeric: tabular-nums;
+    color: var(--text-secondary);
+}
+
+.violations-count.high { color: var(--accent-red); font-weight: 600; }
+
+/* responsive */
+@media (max-width: 768px) {
+    .event-detail { max-width: 150px; }
+}
diff --git a/web-nodejs/public/css/desktop-mode.css b/web-nodejs/public/css/desktop-mode.css
index 9c3b0e6c..ba6172ab 100644
--- a/web-nodejs/public/css/desktop-mode.css
+++ b/web-nodejs/public/css/desktop-mode.css
@@ -1,5 +1,5 @@
 /**
- * BetterDesk Console - Desktop Mode Styles
+ * BetterDesk Console - Desktop Mode Styles (BETA)
  * Windows-like desktop environment with floating windows, taskbar, and animations.
  * Only active on viewports >= 1200px.
  */
@@ -8,6 +8,7 @@
 
 .desktop-toggle-btn {
     display: none !important;
+    position: relative;
 }
 
 @media (min-width: 1200px) {
@@ -16,6 +17,22 @@
     }
 }
 
+/* Beta badge on desktop toggle button */
+.beta-badge {
+    position: absolute;
+    top: -4px;
+    right: -8px;
+    font-size: 8px;
+    font-weight: 700;
+    letter-spacing: 0.5px;
+    padding: 1px 4px;
+    border-radius: 4px;
+    background: var(--accent-color, #f0883e);
+    color: #fff;
+    line-height: 1.2;
+    pointer-events: none;
+}
+
 /* ============ Desktop Shell ============ */
 
 .desktop-shell {
@@ -47,6 +64,22 @@ body.desktop-active .desktop-shell {
     z-index: 0;
 }
 
+/* Crossfade transition layer */
+.desktop-wallpaper-new {
+    position: absolute;
+    inset: 0;
+    background-size: cover;
+    background-position: center;
+    background-repeat: no-repeat;
+    opacity: 0;
+    transition: opacity 0.6s ease-out;
+    z-index: 1;
+}
+
+.desktop-wallpaper-new.fade-in {
+    opacity: 1;
+}
+
 .desktop-wallpaper::after {
     content: '';
     position: absolute;
diff --git a/web-nodejs/public/css/desktop-widgets.css b/web-nodejs/public/css/desktop-widgets.css
new file mode 100644
index 00000000..1c8f15cf
--- /dev/null
+++ b/web-nodejs/public/css/desktop-widgets.css
@@ -0,0 +1,1854 @@
+/**
+ * BetterDesk Console — Desktop Widget Mode Styles
+ * Glassmorphic widget dashboard with drag/resize support.
+ */
+
+/* ============ Widget Canvas ============ */
+
+.widget-canvas {
+    position: absolute;
+    inset: 42px 0 48px 42px; /* topnav 42px, sidebar 42px, taskbar 48px */
+    overflow: hidden;
+    z-index: 1;
+    pointer-events: none;
+}
+
+.desktop-widget,
+.widget-add-btn,
+.widget-picker,
+.widget-config-overlay,
+.wallpaper-picker-overlay {
+    pointer-events: auto;
+}
+
+/* ============ Widget Base ============ */
+
+.desktop-widget {
+    position: absolute;
+    border-radius: 12px;
+    background: rgba(13, 17, 23, 0.65);
+    backdrop-filter: blur(24px) saturate(1.4);
+    -webkit-backdrop-filter: blur(24px) saturate(1.4);
+    border: 1px solid rgba(255, 255, 255, 0.08);
+    box-shadow:
+        0 4px 24px rgba(0, 0, 0, 0.35),
+        0 0 0 1px rgba(255, 255, 255, 0.04) inset;
+    color: #e6edf3;
+    overflow: hidden;
+    transition: box-shadow 0.25s ease, border-color 0.25s ease;
+    contain: layout style;
+    will-change: transform;
+    user-select: none;
+    cursor: default;
+}
+
+.desktop-widget.widget-focused {
+    border-color: rgba(88, 166, 255, 0.25);
+    box-shadow:
+        0 8px 40px rgba(0, 0, 0, 0.45),
+        0 0 0 1px rgba(88, 166, 255, 0.15) inset,
+        0 0 30px rgba(88, 166, 255, 0.05);
+    z-index: 10;
+}
+
+.desktop-widget.widget-dragging {
+    opacity: 0.92;
+    cursor: grabbing;
+    transition: none;
+    box-shadow:
+        0 12px 48px rgba(0, 0, 0, 0.5),
+        0 0 0 2px rgba(88, 166, 255, 0.3);
+}
+
+.desktop-widget.widget-resizing {
+    transition: none;
+}
+
+/* ============ Widget Header ============ */
+
+.widget-header {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    padding: 7px 12px 5px;
+    cursor: grab;
+    position: relative;
+    min-height: 30px;
+}
+
+.widget-header:active {
+    cursor: grabbing;
+}
+
+.widget-header-icon {
+    width: 24px;
+    height: 24px;
+    border-radius: 6px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    font-size: 14px;
+    flex-shrink: 0;
+    background: rgba(255, 255, 255, 0.06);
+    color: var(--accent-blue, #58a6ff);
+}
+
+.widget-header-title {
+    font-size: 11px;
+    font-weight: 600;
+    letter-spacing: 0.3px;
+    text-transform: uppercase;
+    opacity: 0.7;
+    flex: 1;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+}
+
+.widget-header-actions {
+    display: flex;
+    gap: 2px;
+    opacity: 0;
+    transition: opacity 0.2s ease;
+}
+
+.desktop-widget:hover .widget-header-actions {
+    opacity: 1;
+}
+
+.widget-header-actions button {
+    width: 24px;
+    height: 24px;
+    border: none;
+    background: rgba(255, 255, 255, 0.06);
+    border-radius: 6px;
+    color: #8b949e;
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    font-size: 14px;
+    transition: all 0.15s ease;
+    padding: 0;
+}
+
+.widget-header-actions button:hover {
+    background: rgba(255, 255, 255, 0.12);
+    color: #e6edf3;
+}
+
+.widget-header-actions .widget-btn-remove:hover {
+    background: rgba(248, 81, 73, 0.2);
+    color: #f85149;
+}
+
+/* ============ Widget Body ============ */
+
+.widget-body {
+    padding: 4px 12px 10px;
+    overflow: hidden;
+    flex: 1;
+    position: relative;
+}
+
+.widget-body::-webkit-scrollbar {
+    width: 4px;
+}
+
+.widget-body::-webkit-scrollbar-thumb {
+    background: rgba(255, 255, 255, 0.12);
+    border-radius: 2px;
+}
+
+/* ============ Resize Handles ============ */
+
+.widget-resize {
+    position: absolute;
+    z-index: 5;
+}
+
+.widget-resize-n  { top: -4px; left: 8px; right: 8px; height: 8px; cursor: n-resize; }
+.widget-resize-s  { bottom: -4px; left: 8px; right: 8px; height: 8px; cursor: s-resize; }
+.widget-resize-e  { top: 8px; bottom: 8px; right: -4px; width: 8px; cursor: e-resize; }
+.widget-resize-w  { top: 8px; bottom: 8px; left: -4px; width: 8px; cursor: w-resize; }
+.widget-resize-ne { top: -4px; right: -4px; width: 14px; height: 14px; cursor: ne-resize; }
+.widget-resize-nw { top: -4px; left: -4px; width: 14px; height: 14px; cursor: nw-resize; }
+.widget-resize-se { bottom: -4px; right: -4px; width: 14px; height: 14px; cursor: se-resize; }
+.widget-resize-sw { bottom: -4px; left: -4px; width: 14px; height: 14px; cursor: sw-resize; }
+
+/* ============ Widget Animations ============ */
+
+@keyframes widgetAppear {
+    0% {
+        opacity: 0;
+        transform: scale(0.85) translateY(12px);
+    }
+    100% {
+        opacity: 1;
+        transform: scale(1) translateY(0);
+    }
+}
+
+@keyframes widgetRemove {
+    0% {
+        opacity: 1;
+        transform: scale(1);
+    }
+    100% {
+        opacity: 0;
+        transform: scale(0.8);
+    }
+}
+
+@keyframes widgetPulse {
+    0%, 100% { box-shadow: 0 4px 24px rgba(0,0,0,0.35); }
+    50% { box-shadow: 0 4px 24px rgba(0,0,0,0.35), 0 0 20px rgba(88,166,255,0.1); }
+}
+
+.desktop-widget.widget-entering {
+    animation: widgetAppear 0.35s cubic-bezier(0.34, 1.56, 0.64, 1) forwards;
+}
+
+.desktop-widget.widget-leaving {
+    animation: widgetRemove 0.25s ease-out forwards;
+    pointer-events: none;
+}
+
+/* ============ Grid Snap Indicator ============ */
+
+.widget-snap-guide {
+    position: absolute;
+    background: rgba(88, 166, 255, 0.15);
+    border: 1px dashed rgba(88, 166, 255, 0.4);
+    border-radius: 14px;
+    pointer-events: none;
+    z-index: 0;
+    transition: all 0.15s ease;
+}
+
+/* ============ Add Widget Button (floating) ============ */
+
+.widget-add-btn {
+    position: fixed;
+    bottom: 64px;
+    right: 20px;
+    width: 48px;
+    height: 48px;
+    border-radius: 50%;
+    border: none;
+    background: linear-gradient(135deg, #58a6ff 0%, #3b82f6 100%);
+    color: white;
+    font-size: 24px;
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    box-shadow: 0 4px 16px rgba(88, 166, 255, 0.3);
+    transition: all 0.25s cubic-bezier(0.34, 1.56, 0.64, 1);
+    z-index: 50;
+}
+
+.widget-add-btn:hover {
+    transform: scale(1.1) rotate(90deg);
+    box-shadow: 0 6px 24px rgba(88, 166, 255, 0.45);
+}
+
+.widget-add-btn:active {
+    transform: scale(0.95) rotate(90deg);
+}
+
+/* ============ Widget Picker Panel ============ */
+
+.widget-picker {
+    position: fixed;
+    bottom: 64px;
+    right: 20px;
+    width: 360px;
+    max-height: 520px;
+    border-radius: 16px;
+    background: rgba(13, 17, 23, 0.88);
+    backdrop-filter: blur(30px) saturate(1.3);
+    -webkit-backdrop-filter: blur(30px) saturate(1.3);
+    border: 1px solid rgba(255, 255, 255, 0.08);
+    box-shadow: 0 12px 48px rgba(0, 0, 0, 0.5);
+    z-index: 100;
+    overflow: hidden;
+    animation: widgetAppear 0.3s cubic-bezier(0.34, 1.56, 0.64, 1) forwards;
+}
+
+.widget-picker-header {
+    padding: 16px 16px 12px;
+    border-bottom: 1px solid rgba(255, 255, 255, 0.06);
+}
+
+.widget-picker-header h3 {
+    font-size: 14px;
+    font-weight: 600;
+    color: #e6edf3;
+    margin: 0 0 10px;
+}
+
+.widget-picker-search {
+    width: 100%;
+    padding: 8px 12px 8px 34px;
+    background: rgba(255, 255, 255, 0.06);
+    border: 1px solid rgba(255, 255, 255, 0.08);
+    border-radius: 8px;
+    color: #e6edf3;
+    font-size: 13px;
+    outline: none;
+    transition: border-color 0.2s ease;
+}
+
+.widget-picker-search:focus {
+    border-color: rgba(88, 166, 255, 0.4);
+}
+
+.widget-picker-search-wrap {
+    position: relative;
+}
+
+.widget-picker-search-wrap .material-icons {
+    position: absolute;
+    left: 10px;
+    top: 50%;
+    transform: translateY(-50%);
+    font-size: 16px;
+    color: #8b949e;
+    pointer-events: none;
+}
+
+.widget-picker-list {
+    padding: 8px;
+    overflow-y: auto;
+    max-height: 400px;
+}
+
+.widget-picker-list::-webkit-scrollbar {
+    width: 4px;
+}
+
+.widget-picker-list::-webkit-scrollbar-thumb {
+    background: rgba(255, 255, 255, 0.1);
+    border-radius: 2px;
+}
+
+.widget-picker-item {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    padding: 10px 12px;
+    border-radius: 10px;
+    cursor: pointer;
+    transition: background 0.15s ease;
+}
+
+.widget-picker-item:hover {
+    background: rgba(255, 255, 255, 0.06);
+}
+
+.widget-picker-item:active {
+    background: rgba(255, 255, 255, 0.1);
+    transform: scale(0.98);
+}
+
+.widget-picker-item-icon {
+    width: 40px;
+    height: 40px;
+    border-radius: 10px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    flex-shrink: 0;
+    font-size: 20px;
+}
+
+.widget-picker-item-info {
+    flex: 1;
+    overflow: hidden;
+}
+
+.widget-picker-item-name {
+    font-size: 13px;
+    font-weight: 600;
+    color: #e6edf3;
+}
+
+.widget-picker-item-desc {
+    font-size: 11px;
+    color: #8b949e;
+    margin-top: 2px;
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: ellipsis;
+}
+
+.widget-picker-category {
+    font-size: 10px;
+    font-weight: 700;
+    text-transform: uppercase;
+    letter-spacing: 0.8px;
+    color: #8b949e;
+    padding: 12px 12px 4px;
+}
+
+/* ============ Wallpaper Picker ============ */
+
+.wallpaper-picker-overlay {
+    position: fixed;
+    inset: 0;
+    background: rgba(0, 0, 0, 0.6);
+    backdrop-filter: blur(4px);
+    z-index: 200;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    animation: fadeIn 0.2s ease forwards;
+}
+
+@keyframes fadeIn {
+    from { opacity: 0; }
+    to { opacity: 1; }
+}
+
+.wallpaper-picker {
+    width: 90vw;
+    max-width: 960px;
+    max-height: 80vh;
+    background: rgba(13, 17, 23, 0.97);
+    backdrop-filter: blur(8px);
+    border-radius: 16px;
+    border: 1px solid rgba(255, 255, 255, 0.08);
+    box-shadow: 0 24px 64px rgba(0, 0, 0, 0.6);
+    overflow: hidden;
+    display: flex;
+    flex-direction: column;
+    animation: widgetAppear 0.3s cubic-bezier(0.34, 1.56, 0.64, 1) forwards;
+}
+
+.wallpaper-picker-header {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: 16px 20px;
+    border-bottom: 1px solid rgba(255, 255, 255, 0.06);
+}
+
+.wallpaper-picker-header h3 {
+    font-size: 16px;
+    font-weight: 600;
+    color: #e6edf3;
+    margin: 0;
+}
+
+.wallpaper-picker-close {
+    width: 32px;
+    height: 32px;
+    border: none;
+    background: rgba(255, 255, 255, 0.06);
+    border-radius: 8px;
+    color: #8b949e;
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    transition: all 0.15s ease;
+}
+
+.wallpaper-picker-close:hover {
+    background: rgba(248, 81, 73, 0.2);
+    color: #f85149;
+}
+
+.wallpaper-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(200px, 1fr));
+    gap: 12px;
+    padding: 16px;
+    overflow-y: auto;
+    flex: 1;
+    contain: layout style;
+}
+
+.wallpaper-grid::-webkit-scrollbar {
+    width: 6px;
+}
+
+.wallpaper-grid::-webkit-scrollbar-thumb {
+    background: rgba(255, 255, 255, 0.12);
+    border-radius: 3px;
+}
+
+.wallpaper-thumb {
+    aspect-ratio: 16 / 9;
+    border-radius: 10px;
+    overflow: hidden;
+    cursor: pointer;
+    border: 2px solid transparent;
+    transition: all 0.25s ease;
+    position: relative;
+}
+
+.wallpaper-thumb:hover {
+    border-color: rgba(88, 166, 255, 0.5);
+}
+
+.wallpaper-thumb.active {
+    border-color: #58a6ff;
+    box-shadow: 0 0 16px rgba(88, 166, 255, 0.3);
+}
+
+.wallpaper-thumb::after {
+    content: 'check_circle';
+    font-family: 'Material Icons';
+    position: absolute;
+    top: 6px;
+    right: 6px;
+    font-size: 22px;
+    color: #58a6ff;
+    opacity: 0;
+    transition: opacity 0.2s ease;
+    text-shadow: 0 1px 4px rgba(0,0,0,0.5);
+}
+
+.wallpaper-thumb.active::after {
+    opacity: 1;
+}
+
+.wallpaper-thumb-placeholder {
+    width: 100%;
+    height: 100%;
+    background: rgba(30, 36, 44, 0.8);
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    color: rgba(255, 255, 255, 0.2);
+    font-size: 14px;
+    font-weight: 600;
+    position: relative;
+}
+
+/* Loading spinner animation */
+.wallpaper-thumb-placeholder::before {
+    content: '';
+    position: absolute;
+    width: 24px;
+    height: 24px;
+    border: 2px solid rgba(88, 166, 255, 0.1);
+    border-top-color: rgba(88, 166, 255, 0.5);
+    border-radius: 50%;
+    animation: wallpaper-spin 0.8s linear infinite;
+    opacity: 0;
+    transition: opacity 0.2s ease;
+}
+
+.wallpaper-thumb.loading .wallpaper-thumb-placeholder::before {
+    opacity: 1;
+}
+
+.wallpaper-thumb.loading .wallpaper-thumb-placeholder span {
+    display: none;
+}
+
+@keyframes wallpaper-spin {
+    to { transform: rotate(360deg); }
+}
+
+/* Image fade-in when loaded */
+.wallpaper-thumb img {
+    width: 100%;
+    height: 100%;
+    object-fit: cover;
+    display: block;
+    opacity: 0;
+    transition: opacity 0.3s ease;
+    content-visibility: auto;
+}
+
+.wallpaper-thumb img.loaded {
+    opacity: 1;
+}
+
+/* ============ Widget-Specific Styles ============ */
+
+/* Clock Widget */
+.widget-clock-time {
+    font-size: 48px;
+    font-weight: 200;
+    letter-spacing: -2px;
+    color: #ffffff;
+    line-height: 1;
+    text-align: center;
+}
+
+.widget-clock-date {
+    font-size: 13px;
+    color: #8b949e;
+    text-align: center;
+    margin-top: 4px;
+}
+
+.widget-clock-seconds {
+    font-size: 20px;
+    font-weight: 300;
+    color: rgba(88, 166, 255, 0.7);
+    vertical-align: super;
+}
+
+/* Status Counter Widget */
+.widget-status-counters {
+    display: flex;
+    gap: 6px;
+    flex-wrap: wrap;
+}
+
+.widget-status-counter {
+    flex: 1;
+    min-width: 70px;
+    text-align: center;
+    padding: 10px 6px;
+    background: rgba(255, 255, 255, 0.03);
+    border-radius: 10px;
+    border: 1px solid rgba(255, 255, 255, 0.04);
+    transition: background 0.2s ease;
+}
+
+.widget-status-counter:hover {
+    background: rgba(255, 255, 255, 0.06);
+}
+
+.widget-status-counter-value {
+    font-size: 28px;
+    font-weight: 700;
+    line-height: 1;
+}
+
+.widget-status-counter-label {
+    font-size: 10px;
+    text-transform: uppercase;
+    letter-spacing: 0.5px;
+    color: #8b949e;
+    margin-top: 4px;
+}
+
+.widget-status-counter.online .widget-status-counter-value { color: #3fb950; }
+.widget-status-counter.offline .widget-status-counter-value { color: #8b949e; }
+.widget-status-counter.blocked .widget-status-counter-value { color: #f85149; }
+.widget-status-counter.total .widget-status-counter-value { color: #58a6ff; }
+
+/* Gauge Widget */
+.widget-gauge {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 8px;
+}
+
+.widget-gauge-ring {
+    width: 100px;
+    height: 100px;
+    position: relative;
+}
+
+.widget-gauge-ring svg {
+    transform: rotate(-90deg);
+}
+
+.widget-gauge-ring circle {
+    fill: none;
+    stroke-width: 8;
+    stroke-linecap: round;
+}
+
+.widget-gauge-ring .gauge-bg {
+    stroke: rgba(255, 255, 255, 0.06);
+}
+
+.widget-gauge-ring .gauge-fill {
+    stroke: #58a6ff;
+    transition: stroke-dashoffset 0.8s cubic-bezier(0.4, 0, 0.2, 1), stroke 0.3s ease;
+}
+
+.widget-gauge-ring .gauge-fill.warning { stroke: #d29922; }
+.widget-gauge-ring .gauge-fill.danger { stroke: #f85149; }
+
+.widget-gauge-value {
+    position: absolute;
+    inset: 0;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    font-size: 22px;
+    font-weight: 700;
+    color: #e6edf3;
+}
+
+.widget-gauge-label {
+    font-size: 11px;
+    color: #8b949e;
+    text-transform: uppercase;
+    letter-spacing: 0.5px;
+}
+
+/* Server Health Widget */
+.widget-health-items {
+    display: flex;
+    flex-direction: column;
+    gap: 8px;
+}
+
+.widget-health-item {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    padding: 8px 10px;
+    background: rgba(255, 255, 255, 0.03);
+    border-radius: 8px;
+}
+
+.widget-health-dot {
+    width: 8px;
+    height: 8px;
+    border-radius: 50%;
+    flex-shrink: 0;
+    animation: healthPulse 2s ease-in-out infinite;
+}
+
+.widget-health-dot.up { background: #3fb950; }
+.widget-health-dot.down { background: #f85149; animation: healthPulse 1s ease-in-out infinite; }
+.widget-health-dot.unknown { background: #8b949e; }
+
+@keyframes healthPulse {
+    0%, 100% { box-shadow: 0 0 0 0 currentColor; }
+    50% { box-shadow: 0 0 6px 2px currentColor; }
+}
+
+.widget-health-name {
+    flex: 1;
+    font-size: 13px;
+    color: #e6edf3;
+}
+
+.widget-health-status {
+    font-size: 11px;
+    font-weight: 600;
+    text-transform: uppercase;
+    letter-spacing: 0.3px;
+}
+
+.widget-health-status.up { color: #3fb950; }
+.widget-health-status.down { color: #f85149; }
+.widget-health-status.unknown { color: #8b949e; }
+
+/* Server Info Widget (combined health + ports) */
+.widget-server-info { display: flex; flex-direction: column; gap: 8px; }
+.widget-si-services { display: flex; gap: 12px; }
+.widget-si-svc { display: flex; align-items: center; gap: 6px; font-size: 12px; color: var(--text-primary, #e6edf3); padding: 4px 10px; background: rgba(255,255,255,0.04); border-radius: 6px; }
+.widget-si-dot { width: 8px; height: 8px; border-radius: 50%; flex-shrink: 0; }
+.widget-si-dot.up { background: #3fb950; box-shadow: 0 0 6px rgba(63,185,80,0.4); }
+.widget-si-dot.down { background: #f85149; box-shadow: 0 0 6px rgba(248,81,73,0.4); }
+.widget-si-dot.unknown { background: #8b949e; }
+.widget-si-uptime { font-size: 11px; color: var(--text-secondary, #8b949e); padding: 2px 0; }
+.widget-si-ports { display: flex; flex-direction: column; gap: 2px; flex: 1; overflow-y: auto; }
+.widget-si-port-header { display: flex; gap: 8px; padding: 4px 6px; font-size: 10px; text-transform: uppercase; letter-spacing: 0.5px; color: var(--text-secondary, #8b949e); border-bottom: 1px solid rgba(255,255,255,0.06); }
+.widget-si-port-header span:first-child { flex: 1; }
+.widget-si-port-row { display: flex; align-items: center; gap: 6px; padding: 3px 6px; font-size: 12px; border-radius: 4px; }
+.widget-si-port-row:hover { background: rgba(255,255,255,0.04); }
+.widget-si-port-dot { width: 6px; height: 6px; border-radius: 50%; flex-shrink: 0; }
+.widget-si-port-dot.up { background: #3fb950; }
+.widget-si-port-dot.down { background: #f85149; }
+.widget-si-port-name { flex: 1; color: var(--text-primary, #e6edf3); }
+.widget-si-port-num { font-family: monospace; color: var(--text-secondary, #8b949e); font-size: 11px; }
+
+/* Quick Actions Widget */
+.widget-actions-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(70px, 1fr));
+    gap: 8px;
+}
+
+.widget-action-btn {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 6px;
+    padding: 12px 6px;
+    background: rgba(255, 255, 255, 0.04);
+    border: 1px solid rgba(255, 255, 255, 0.06);
+    border-radius: 10px;
+    color: #e6edf3;
+    cursor: pointer;
+    transition: all 0.2s ease;
+    font-size: 10px;
+    text-align: center;
+}
+
+.widget-action-btn:hover {
+    background: rgba(255, 255, 255, 0.08);
+    border-color: rgba(255, 255, 255, 0.12);
+    transform: translateY(-2px);
+}
+
+.widget-action-btn .material-icons {
+    font-size: 22px;
+}
+
+/* Activity Feed Widget */
+.widget-feed-list {
+    display: flex;
+    flex-direction: column;
+    gap: 2px;
+    max-height: 100%;
+    overflow-y: auto;
+}
+
+.widget-feed-item {
+    display: flex;
+    align-items: flex-start;
+    gap: 8px;
+    padding: 6px 0;
+    border-bottom: 1px solid rgba(255, 255, 255, 0.03);
+    font-size: 12px;
+}
+
+.widget-feed-time {
+    font-size: 10px;
+    color: #8b949e;
+    white-space: nowrap;
+    flex-shrink: 0;
+    padding-top: 2px;
+}
+
+.widget-feed-text {
+    color: #c9d1d9;
+    line-height: 1.3;
+}
+
+/* Notes Widget */
+.widget-notes-textarea {
+    width: 100%;
+    height: 100%;
+    background: transparent;
+    border: none;
+    color: #e6edf3;
+    font-size: 13px;
+    line-height: 1.5;
+    resize: none;
+    outline: none;
+    font-family: inherit;
+    padding: 0;
+}
+
+.widget-notes-textarea::placeholder {
+    color: #484f58;
+}
+
+/* Device List Widget */
+.widget-device-list {
+    display: flex;
+    flex-direction: column;
+    gap: 4px;
+    max-height: 100%;
+    overflow-y: auto;
+}
+
+.widget-device-row {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    padding: 6px 8px;
+    border-radius: 6px;
+    font-size: 12px;
+    transition: background 0.12s ease;
+}
+
+.widget-device-row:hover {
+    background: rgba(255, 255, 255, 0.04);
+}
+
+.widget-device-dot {
+    width: 6px;
+    height: 6px;
+    border-radius: 50%;
+    flex-shrink: 0;
+}
+
+.widget-device-dot.online { background: #3fb950; }
+.widget-device-dot.offline { background: #484f58; }
+
+.widget-device-id {
+    font-family: monospace;
+    color: #8b949e;
+    font-size: 11px;
+    flex-shrink: 0;
+}
+
+.widget-device-name {
+    flex: 1;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    color: #e6edf3;
+}
+
+.widget-device-platform {
+    font-size: 10px;
+    color: #8b949e;
+    flex-shrink: 0;
+}
+
+/* Network Monitor Widget */
+.widget-net-targets {
+    display: flex;
+    flex-direction: column;
+    gap: 6px;
+}
+
+.widget-net-target {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    padding: 6px 8px;
+    background: rgba(255, 255, 255, 0.02);
+    border-radius: 6px;
+    font-size: 12px;
+}
+
+.widget-net-status {
+    width: 6px;
+    height: 6px;
+    border-radius: 50%;
+    flex-shrink: 0;
+}
+
+.widget-net-status.up { background: #3fb950; }
+.widget-net-status.down { background: #f85149; }
+
+.widget-net-name { flex: 1; color: #e6edf3; }
+
+.widget-net-latency {
+    font-family: monospace;
+    font-size: 11px;
+    color: #8b949e;
+}
+
+/* Tickets Summary Widget */
+.widget-tickets-row {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    padding: 6px 0;
+    border-bottom: 1px solid rgba(255, 255, 255, 0.04);
+}
+
+.widget-tickets-label { font-size: 13px; color: #c9d1d9; }
+
+.widget-tickets-count {
+    font-size: 18px;
+    font-weight: 700;
+    font-family: monospace;
+}
+
+/* iFrame Widget */
+.widget-iframe {
+    width: 100%;
+    height: 100%;
+    border: none;
+    border-radius: 0 0 14px 14px;
+}
+
+/* ============ Taskbar Widget Mode Toggle ============ */
+
+.taskbar-mode-btn {
+    padding: 4px 10px;
+    border-radius: 6px;
+    border: 1px solid rgba(255, 255, 255, 0.08);
+    background: rgba(255, 255, 255, 0.04);
+    color: #8b949e;
+    font-size: 12px;
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    gap: 4px;
+    transition: all 0.2s ease;
+}
+
+.taskbar-mode-btn:hover {
+    background: rgba(255, 255, 255, 0.08);
+    color: #e6edf3;
+}
+
+.taskbar-mode-btn.active {
+    background: rgba(88, 166, 255, 0.15);
+    border-color: rgba(88, 166, 255, 0.3);
+    color: #58a6ff;
+}
+
+.taskbar-mode-btn .material-icons {
+    font-size: 16px;
+}
+
+/* ============ Widget Config Modal ============ */
+
+.widget-config-overlay {
+    position: fixed;
+    inset: 0;
+    background: rgba(0, 0, 0, 0.5);
+    backdrop-filter: blur(4px);
+    z-index: 250;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    animation: fadeIn 0.15s ease;
+}
+
+.widget-config-panel {
+    background: rgba(13, 17, 23, 0.95);
+    backdrop-filter: blur(20px);
+    border: 1px solid rgba(255, 255, 255, 0.08);
+    border-radius: 14px;
+    padding: 24px;
+    min-width: 340px;
+    max-width: 480px;
+    box-shadow: 0 16px 48px rgba(0, 0, 0, 0.5);
+    animation: widgetAppear 0.25s cubic-bezier(0.34, 1.56, 0.64, 1) forwards;
+}
+
+.widget-config-panel h3 {
+    font-size: 16px;
+    font-weight: 600;
+    color: #e6edf3;
+    margin: 0 0 16px;
+}
+
+.widget-config-field {
+    margin-bottom: 12px;
+}
+
+.widget-config-field label {
+    display: block;
+    font-size: 12px;
+    font-weight: 600;
+    color: #8b949e;
+    margin-bottom: 4px;
+    text-transform: uppercase;
+    letter-spacing: 0.3px;
+}
+
+.widget-config-field input,
+.widget-config-field select,
+.widget-config-field textarea {
+    width: 100%;
+    padding: 8px 12px;
+    background: rgba(255, 255, 255, 0.06);
+    border: 1px solid rgba(255, 255, 255, 0.08);
+    border-radius: 8px;
+    color: #e6edf3;
+    font-size: 13px;
+    outline: none;
+    transition: border-color 0.2s ease;
+}
+
+.widget-config-field input:focus,
+.widget-config-field select:focus,
+.widget-config-field textarea:focus {
+    border-color: rgba(88, 166, 255, 0.4);
+}
+
+.widget-config-actions {
+    display: flex;
+    gap: 8px;
+    justify-content: flex-end;
+    margin-top: 20px;
+}
+
+.widget-config-actions button {
+    padding: 8px 16px;
+    border-radius: 8px;
+    border: none;
+    font-size: 13px;
+    font-weight: 600;
+    cursor: pointer;
+    transition: all 0.15s ease;
+}
+
+.widget-config-btn-save {
+    background: #58a6ff;
+    color: #0d1117;
+}
+
+.widget-config-btn-save:hover {
+    background: #79c0ff;
+}
+
+.widget-config-btn-cancel {
+    background: rgba(255, 255, 255, 0.06);
+    color: #8b949e;
+}
+
+.widget-config-btn-cancel:hover {
+    background: rgba(255, 255, 255, 0.1);
+    color: #e6edf3;
+}
+
+/* ============ Loading Shimmer ============ */
+
+.widget-loading {
+    background: linear-gradient(90deg,
+        rgba(255,255,255,0.03) 25%,
+        rgba(255,255,255,0.08) 50%,
+        rgba(255,255,255,0.03) 75%
+    );
+    background-size: 200% 100%;
+    animation: shimmer 1.5s linear infinite;
+    border-radius: 6px;
+    min-height: 20px;
+}
+
+@keyframes shimmer {
+    0% { background-position: 200% 0; }
+    100% { background-position: -200% 0; }
+}
+
+/* ============ Empty State ============  */
+
+.widget-empty {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    text-align: center;
+    gap: 4px;
+}
+
+.widget-empty .material-icons {
+    font-size: 32px;
+    color: #484f58;
+}
+
+.widget-empty span {
+    font-size: 12px;
+    color: #8b949e;
+}
+
+/* ============ Top Navigation Bar ============ */
+
+.widget-topnav {
+    position: fixed;
+    top: 0;
+    left: 0;
+    right: 0;
+    height: 42px;
+    background: rgba(13, 17, 23, 0.90);
+    backdrop-filter: blur(20px) saturate(1.3);
+    -webkit-backdrop-filter: blur(20px) saturate(1.3);
+    border-bottom: 1px solid rgba(255, 255, 255, 0.06);
+    display: flex;
+    align-items: center;
+    z-index: 500;
+    padding: 0;
+    gap: 0;
+    user-select: none;
+    pointer-events: auto;
+}
+
+.topnav-menu {
+    width: 42px;
+    height: 42px;
+    border: none;
+    background: none;
+    color: #8b949e;
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: 0;
+    flex-shrink: 0;
+    transition: color 0.15s;
+}
+
+.topnav-menu:hover { color: #e6edf3; }
+
+.topnav-brand {
+    font-size: 13px;
+    font-weight: 700;
+    color: #58a6ff;
+    padding: 0 14px 0 2px;
+    flex-shrink: 0;
+    letter-spacing: 0.5px;
+}
+
+.topnav-tabs {
+    display: flex;
+    align-items: center;
+    gap: 2px;
+    flex: 1;
+    overflow-x: auto;
+    scrollbar-width: none;
+}
+
+.topnav-tabs::-webkit-scrollbar { display: none; }
+
+.topnav-tab {
+    width: 36px;
+    height: 36px;
+    border: none;
+    background: none;
+    color: #6e7681;
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    border-radius: 8px;
+    transition: all 0.15s ease;
+    padding: 0;
+    flex-shrink: 0;
+    position: relative;
+}
+
+.topnav-tab .material-icons { font-size: 20px; }
+
+.topnav-tab:hover {
+    background: rgba(255, 255, 255, 0.06);
+    color: #e6edf3;
+}
+
+.topnav-tab.active {
+    color: #58a6ff;
+    background: rgba(88, 166, 255, 0.1);
+}
+
+.topnav-tab.active::after {
+    content: '';
+    position: absolute;
+    bottom: 0;
+    left: 25%;
+    right: 25%;
+    height: 2px;
+    background: #58a6ff;
+    border-radius: 1px;
+}
+
+.topnav-sep {
+    width: 1px;
+    height: 20px;
+    background: rgba(255, 255, 255, 0.06);
+    margin: 0 8px;
+    flex-shrink: 0;
+}
+
+.topnav-actions {
+    display: flex;
+    align-items: center;
+    gap: 2px;
+    padding-right: 8px;
+    flex-shrink: 0;
+}
+
+.topnav-btn {
+    width: 32px;
+    height: 32px;
+    border: none;
+    background: none;
+    color: #6e7681;
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    border-radius: 6px;
+    transition: all 0.15s ease;
+    padding: 0;
+}
+
+.topnav-btn .material-icons { font-size: 18px; }
+
+.topnav-btn:hover {
+    background: rgba(255, 255, 255, 0.06);
+    color: #e6edf3;
+}
+
+.topnav-btn.active {
+    color: #58a6ff;
+    background: rgba(88, 166, 255, 0.12);
+}
+
+/* Mode toggle group in topnav */
+.topnav-mode-group {
+    display: flex;
+    align-items: center;
+    gap: 2px;
+    background: rgba(255,255,255,0.04);
+    border-radius: 8px;
+    padding: 2px;
+    flex-shrink: 0;
+}
+.topnav-mode-btn {
+    width: 30px; height: 28px; border: none; background: none;
+    color: #6e7681; cursor: pointer; display: flex; align-items: center;
+    justify-content: center; border-radius: 6px; transition: all 0.15s ease; padding: 0;
+}
+.topnav-mode-btn .material-icons { font-size: 18px; }
+.topnav-mode-btn:hover { color: #e6edf3; }
+.topnav-mode-btn.active { background: rgba(88,166,255,0.15); color: #58a6ff; }
+
+/* Clock in topnav */
+.topnav-clock {
+    font-size: 12px; font-weight: 600; color: var(--text-secondary, #8b949e);
+    padding: 0 8px; flex-shrink: 0; font-variant-numeric: tabular-nums;
+}
+
+/* Exit button */
+.topnav-exit { color: #da3633 !important; margin-right: 4px; }
+.topnav-exit:hover { background: rgba(218,54,51,0.15) !important; }
+
+/* Unified mode: taskbar always visible */
+.desktop-mode-unified .desktop-taskbar { display: flex !important; }
+
+/* ============ Left Sidebar ============ */
+
+.widget-sidebar {
+    position: fixed;
+    top: 42px;
+    left: 0;
+    bottom: 48px; /* Stop above taskbar */
+    width: 42px;
+    background: rgba(13, 17, 23, 0.78);
+    backdrop-filter: blur(16px) saturate(1.2);
+    -webkit-backdrop-filter: blur(16px) saturate(1.2);
+    border-right: 1px solid rgba(255, 255, 255, 0.04);
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 2px;
+    padding: 8px 0;
+    z-index: 500;
+    overflow-y: auto;
+    scrollbar-width: none;
+    pointer-events: auto;
+}
+
+.widget-sidebar::-webkit-scrollbar { display: none; }
+
+.sidebar-icon {
+    width: 32px;
+    height: 32px;
+    border: none;
+    background: none;
+    color: #484f58;
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    border-radius: 8px;
+    transition: all 0.15s ease;
+    padding: 0;
+    flex-shrink: 0;
+}
+
+.sidebar-icon .material-icons { font-size: 18px; }
+
+.sidebar-icon:hover {
+    background: rgba(255, 255, 255, 0.06);
+    color: #8b949e;
+}
+
+.sidebar-icon.active {
+    color: #58a6ff;
+    background: rgba(88, 166, 255, 0.12);
+}
+
+.sidebar-sep {
+    width: 24px;
+    height: 1px;
+    background: rgba(255, 255, 255, 0.06);
+    margin: 6px 0;
+    flex-shrink: 0;
+}
+
+.sidebar-spacer { flex: 1; }
+
+/* Hide floating FAB when topnav present */
+.widget-topnav ~ .widget-add-btn,
+.widget-topnav ~ * .widget-add-btn {
+    display: none !important;
+}
+
+/* ============ Sidebar Collapse ============ */
+
+.widget-sidebar.sidebar-collapsed {
+    width: 0;
+    padding: 0;
+    overflow: hidden;
+    border-right: none;
+}
+
+/* ============ Search Overlay ============ */
+
+.widget-search-overlay {
+    position: fixed;
+    inset: 0;
+    z-index: 9000;
+    background: rgba(0, 0, 0, 0.55);
+    display: flex;
+    align-items: flex-start;
+    justify-content: center;
+    padding-top: 80px;
+    animation: fadeIn 0.15s ease;
+}
+
+@keyframes fadeIn { from { opacity: 0; } to { opacity: 1; } }
+
+.ws-dialog {
+    width: 520px;
+    max-width: 92vw;
+    background: rgba(13, 17, 23, 0.96);
+    border: 1px solid rgba(48, 54, 61, 0.6);
+    border-radius: 14px;
+    box-shadow: 0 16px 48px rgba(0, 0, 0, 0.5);
+    backdrop-filter: blur(24px);
+    overflow: hidden;
+    animation: slideDown 0.2s cubic-bezier(0.34, 1.56, 0.64, 1) forwards;
+}
+
+@keyframes slideDown { from { opacity: 0; transform: translateY(-12px); } to { opacity: 1; transform: translateY(0); } }
+
+.ws-header {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    padding: 12px 14px;
+    border-bottom: 1px solid rgba(48, 54, 61, 0.4);
+}
+
+.ws-header > .material-icons {
+    color: #8b949e;
+    font-size: 20px;
+    flex-shrink: 0;
+}
+
+#ws-input {
+    flex: 1;
+    background: none;
+    border: none;
+    outline: none;
+    color: #e6edf3;
+    font-size: 14px;
+    font-family: inherit;
+}
+
+#ws-input::placeholder { color: #484f58; }
+
+.ws-close {
+    width: 28px; height: 28px; border: none; background: none;
+    color: #6e7681; cursor: pointer; display: flex; align-items: center;
+    justify-content: center; border-radius: 6px; flex-shrink: 0;
+}
+.ws-close:hover { background: rgba(255,255,255,0.06); color: #e6edf3; }
+.ws-close .material-icons { font-size: 18px; }
+
+.ws-results {
+    max-height: 360px;
+    overflow-y: auto;
+    padding: 6px;
+}
+
+.ws-section {
+    font-size: 11px;
+    font-weight: 600;
+    text-transform: uppercase;
+    letter-spacing: 0.8px;
+    color: #484f58;
+    padding: 8px 10px 4px;
+}
+
+.ws-row {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    padding: 8px 10px;
+    border-radius: 8px;
+    cursor: pointer;
+    color: #e6edf3;
+    font-size: 13px;
+    transition: background 0.12s ease;
+}
+
+.ws-row:hover { background: rgba(255, 255, 255, 0.06); }
+
+.ws-row-icon { font-size: 18px; color: #8b949e; flex-shrink: 0; }
+
+.ws-row-text { flex: 1; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+
+.ws-row-hint { font-size: 11px; color: #484f58; flex-shrink: 0; }
+
+.ws-empty {
+    text-align: center;
+    color: #484f58;
+    padding: 24px 16px;
+    font-size: 13px;
+}
+
+/* ============ Uptime Widget ============ */
+
+.widget-uptime {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    gap: 4px;
+}
+
+.widget-uptime-value {
+    font-size: 36px;
+    font-weight: 200;
+    color: #ffffff;
+    font-variant-numeric: tabular-nums;
+    letter-spacing: 1px;
+}
+
+.widget-uptime-label {
+    font-size: 11px;
+    color: #8b949e;
+    text-transform: uppercase;
+    letter-spacing: 0.5px;
+}
+
+/* ============ Port Status Widget ============ */
+
+.widget-port-table {
+    display: flex;
+    flex-direction: column;
+    gap: 0;
+}
+
+.widget-port-header-row {
+    display: flex;
+    justify-content: space-between;
+    padding: 4px 8px;
+    font-size: 10px;
+    font-weight: 700;
+    text-transform: uppercase;
+    letter-spacing: 0.5px;
+    color: #6e7681;
+    border-bottom: 1px solid rgba(255, 255, 255, 0.06);
+}
+
+.widget-port-body {
+    display: flex;
+    flex-direction: column;
+}
+
+.widget-port-row {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    padding: 5px 8px;
+    font-size: 12px;
+    border-bottom: 1px solid rgba(255, 255, 255, 0.03);
+    transition: background 0.12s ease;
+}
+
+.widget-port-row:hover { background: rgba(255, 255, 255, 0.03); }
+
+.widget-port-name { flex: 1; color: #e6edf3; }
+.widget-port-num { width: 50px; text-align: center; font-family: monospace; color: #8b949e; font-size: 11px; }
+.widget-port-status { width: 60px; text-align: right; font-size: 11px; font-weight: 600; }
+.widget-port-status.up { color: #3fb950; }
+.widget-port-status.down { color: #f85149; }
+
+/* ============ Device Grid Widget ============ */
+
+.widget-device-grid-container {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(76px, 1fr));
+    gap: 6px;
+    padding: 2px 0;
+}
+
+.widget-dg-card {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 3px;
+    padding: 8px 4px 6px;
+    background: rgba(255, 255, 255, 0.03);
+    border-radius: 10px;
+    border: 1px solid rgba(255, 255, 255, 0.04);
+    transition: all 0.2s ease;
+    cursor: default;
+}
+
+.widget-dg-card:hover {
+    background: rgba(255, 255, 255, 0.06);
+    border-color: rgba(255, 255, 255, 0.08);
+}
+
+.widget-dg-card.online .widget-dg-icon { color: #3fb950; }
+.widget-dg-card.offline .widget-dg-icon { color: #484f58; }
+
+.widget-dg-icon { font-size: 22px; }
+
+.widget-dg-name {
+    font-size: 9px;
+    color: #c9d1d9;
+    text-align: center;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    width: 100%;
+}
+
+.widget-dg-status {
+    font-size: 8px;
+    font-weight: 600;
+    text-transform: uppercase;
+    letter-spacing: 0.3px;
+}
+
+.widget-dg-card.online .widget-dg-status { color: #3fb950; }
+.widget-dg-card.offline .widget-dg-status { color: #6e7681; }
+
+/* ============ Multi-Gauge Widget ============ */
+
+.widget-multi-gauge {
+    display: flex;
+    justify-content: center;
+    align-items: center;
+    gap: 10px;
+    flex-wrap: wrap;
+    height: 100%;
+}
+
+.widget-mg-item {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 3px;
+}
+
+.widget-mg-ring {
+    width: 64px;
+    height: 64px;
+    position: relative;
+}
+
+.widget-mg-ring svg { transform: rotate(-90deg); }
+
+.widget-mg-ring circle {
+    fill: none;
+    stroke-width: 5;
+    stroke-linecap: round;
+}
+
+.widget-mg-ring .gauge-bg { stroke: rgba(255, 255, 255, 0.08); }
+.widget-mg-ring .gauge-fill { stroke: #58a6ff; transition: stroke-dashoffset 0.6s ease; }
+.widget-mg-ring .gauge-fill.warning { stroke: #d29922; }
+.widget-mg-ring .gauge-fill.danger { stroke: #f85149; }
+
+.widget-mg-value {
+    position: absolute;
+    inset: 0;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    font-size: 14px;
+    font-weight: 700;
+    color: #e6edf3;
+}
+
+.widget-mg-label {
+    font-size: 9px;
+    color: #8b949e;
+    text-transform: uppercase;
+    letter-spacing: 0.3px;
+}
+
+/* ============ Weekly Chart Widget ============ */
+
+.widget-weekly {
+    height: 100%;
+    display: flex;
+    flex-direction: column;
+}
+
+.widget-weekly-bars {
+    display: flex;
+    align-items: flex-end;
+    gap: 6px;
+    flex: 1;
+    padding: 4px 0;
+}
+
+.widget-wb-col {
+    flex: 1;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 4px;
+    height: 100%;
+}
+
+.widget-wb-bars {
+    flex: 1;
+    width: 100%;
+    display: flex;
+    gap: 3px;
+    align-items: flex-end;
+}
+
+.widget-wb-bar {
+    flex: 1;
+    border-radius: 4px 4px 0 0;
+    min-height: 4px;
+    transition: height 0.4s ease;
+}
+
+.widget-wb-bar.online { background: linear-gradient(to top, #238636, #3fb950); }
+.widget-wb-bar.offline { background: linear-gradient(to top, #6e7681, #8b949e); }
+
+.widget-wb-label {
+    font-size: 10px;
+    color: #6e7681;
+    font-weight: 600;
+}
+
+.widget-wb-label.today { color: #58a6ff; }
+
+/* ============ Quick Controls Widget ============ */
+
+.widget-qc { display: flex; flex-direction: column; gap: 6px; height: 100%; }
+.widget-qc-filter { display: flex; gap: 6px; align-items: center; flex-wrap: wrap; }
+.widget-qc-search {
+    flex: 1; min-width: 100px; padding: 4px 8px; border-radius: 6px; border: 1px solid rgba(255,255,255,0.1);
+    background: rgba(255,255,255,0.04); color: var(--text-primary, #e6edf3); font-size: 12px; outline: none;
+}
+.widget-qc-search:focus { border-color: var(--accent-blue, #58a6ff); }
+.widget-qc-pills { display: flex; gap: 4px; }
+.widget-qc-pill {
+    padding: 3px 8px; border-radius: 10px; border: 1px solid rgba(255,255,255,0.1);
+    background: transparent; color: var(--text-secondary, #8b949e); font-size: 10px; cursor: pointer;
+    transition: all 0.15s ease;
+}
+.widget-qc-pill.active { background: var(--accent-blue, #58a6ff); color: #fff; border-color: transparent; }
+.widget-qc-list { flex: 1; overflow-y: auto; display: flex; flex-direction: column; gap: 3px; }
+.widget-qc-row {
+    display: flex; align-items: center; gap: 8px; padding: 5px 8px; border-radius: 8px;
+    background: rgba(255,255,255,0.03); border: 1px solid rgba(255,255,255,0.04);
+    transition: background 0.12s ease;
+}
+.widget-qc-row:hover { background: rgba(255,255,255,0.06); }
+.widget-qc-row.banned { opacity: 0.6; border-color: rgba(248,81,73,0.3); }
+.widget-qc-icon { font-size: 18px; color: var(--text-secondary, #8b949e); }
+.widget-qc-row.online .widget-qc-icon { color: #3fb950; }
+.widget-qc-info { flex: 1; min-width: 0; }
+.widget-qc-name { font-size: 12px; color: var(--text-primary, #e6edf3); font-weight: 500; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.widget-qc-id { font-size: 10px; color: var(--text-secondary, #8b949e); font-family: monospace; }
+.widget-qc-badge { padding: 1px 5px; border-radius: 4px; font-size: 9px; font-weight: 600; }
+.widget-qc-badge.ban { background: rgba(248,81,73,0.2); color: #f85149; }
+.widget-qc-actions { display: flex; gap: 4px; flex-shrink: 0; }
+.widget-qc-btn {
+    width: 26px; height: 26px; border-radius: 6px; border: none;
+    background: rgba(255,255,255,0.06); color: var(--text-secondary, #8b949e);
+    display: flex; align-items: center; justify-content: center; cursor: pointer;
+    transition: all 0.15s ease;
+}
+.widget-qc-btn:hover { background: rgba(255,255,255,0.12); color: var(--text-primary, #e6edf3); }
+.widget-qc-btn.connect { color: #3fb950; }
+.widget-qc-btn.connect:hover { background: rgba(63,185,80,0.15); }
+.widget-qc-btn .material-icons { font-size: 16px; }
+
+/* ============ Bandwidth Widget ============ */
+
+.widget-bandwidth {
+    display: flex;
+    flex-direction: column;
+    gap: 12px;
+    height: 100%;
+    justify-content: center;
+}
+
+.widget-bw-item {
+    display: flex;
+    flex-direction: column;
+    gap: 4px;
+}
+
+.widget-bw-header {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    font-size: 11px;
+    color: #8b949e;
+    font-weight: 600;
+}
+
+.widget-bw-header .material-icons { font-size: 16px; }
+
+.widget-bw-value {
+    font-size: 18px;
+    font-weight: 700;
+    color: #e6edf3;
+}
+
+.widget-bw-bar {
+    height: 6px;
+    background: rgba(255, 255, 255, 0.06);
+    border-radius: 3px;
+    overflow: hidden;
+}
+
+.widget-bw-fill {
+    height: 100%;
+    border-radius: 3px;
+    transition: width 0.6s ease;
+}
+
+.widget-bw-fill.download { background: linear-gradient(90deg, #238636, #3fb950); }
+.widget-bw-fill.upload { background: linear-gradient(90deg, #1f6feb, #58a6ff); }
+.widget-bw-stat { display: flex; flex-direction: column; gap: 2px; flex: 1; }
+.widget-bw-stat-label { font-size: 10px; color: var(--text-secondary, #8b949e); text-transform: uppercase; letter-spacing: 0.5px; }
+.widget-bw-stat-val { font-size: 13px; font-weight: 600; color: var(--text-primary, #e6edf3); }
+
+/* ============ Connection Stats Widget ============ */
+
+.widget-stats-table {
+    display: flex;
+    flex-direction: column;
+}
+
+.widget-stats-header {
+    display: flex;
+    padding: 4px 8px;
+    font-size: 10px;
+    font-weight: 700;
+    text-transform: uppercase;
+    letter-spacing: 0.5px;
+    color: #6e7681;
+    border-bottom: 1px solid rgba(255, 255, 255, 0.06);
+}
+
+.widget-stats-header span:first-child { flex: 1; }
+.widget-stats-header span:nth-child(2) { width: 60px; text-align: right; }
+.widget-stats-header span:nth-child(3) { width: 50px; text-align: right; }
+
+.widget-stats-body {
+    display: flex;
+    flex-direction: column;
+}
+
+.widget-stats-row {
+    display: flex;
+    align-items: center;
+    padding: 5px 8px;
+    font-size: 12px;
+    border-bottom: 1px solid rgba(255, 255, 255, 0.03);
+    transition: background 0.12s ease;
+}
+
+.widget-stats-row:hover { background: rgba(255, 255, 255, 0.03); }
+
+.widget-stats-label { flex: 1; color: #c9d1d9; }
+.widget-stats-count { width: 60px; text-align: right; font-weight: 700; color: #e6edf3; font-family: monospace; }
+.widget-stats-pct { width: 50px; text-align: right; color: #8b949e; font-size: 11px; }
diff --git a/web-nodejs/public/css/devices.css b/web-nodejs/public/css/devices.css
index 4219be5d..e4bf173c 100644
--- a/web-nodejs/public/css/devices.css
+++ b/web-nodejs/public/css/devices.css
@@ -527,10 +527,8 @@ td.column-hidden {
 
 .kebab-menu {
     display: none;
-    position: absolute;
-    top: 100%;
-    right: 0;
-    z-index: 200;
+    position: fixed;
+    z-index: 9999;
     min-width: 180px;
     background: var(--bg-elevated, #2d333b);
     border: 1px solid var(--border-primary);
diff --git a/web-nodejs/public/css/help-requests.css b/web-nodejs/public/css/help-requests.css
new file mode 100644
index 00000000..53a46bb1
--- /dev/null
+++ b/web-nodejs/public/css/help-requests.css
@@ -0,0 +1,272 @@
+/* =========================================================================
+ *  Help Requests Page Styles
+ * ========================================================================= */
+
+.help-requests-page {
+    padding: 0;
+}
+
+/* ---- Stats row ---- */
+
+.hr-stats {
+    display: flex;
+    gap: 16px;
+    margin-bottom: 24px;
+    flex-wrap: wrap;
+}
+
+.hr-stats .stat-card {
+    flex: 1 1 120px;
+    min-width: 120px;
+    background: var(--card-bg, #161b22);
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: 12px;
+    padding: 16px 20px;
+    text-align: center;
+}
+
+.hr-stats .stat-value {
+    display: block;
+    font-size: 28px;
+    font-weight: 700;
+    color: #e6edf3;
+}
+
+.hr-stats .stat-label {
+    display: block;
+    font-size: 12px;
+    color: #8b949e;
+    margin-top: 4px;
+    text-transform: uppercase;
+    letter-spacing: 0.5px;
+}
+
+.hr-stats .stat-pending .stat-value { color: #d29922; }
+.hr-stats .stat-accepted .stat-value { color: #3b82f6; }
+.hr-stats .stat-resolved .stat-value { color: #3fb950; }
+
+/* ---- Filters ---- */
+
+.help-requests-page .page-filters {
+    margin-bottom: 20px;
+}
+
+.help-requests-page .filter-buttons {
+    display: flex;
+    gap: 8px;
+    flex-wrap: wrap;
+}
+
+.help-requests-page .filter-btn {
+    padding: 6px 16px;
+    border-radius: 20px;
+    font-size: 13px;
+    background: var(--card-bg, #161b22);
+    border: 1px solid var(--border-color, #30363d);
+    color: #8b949e;
+    cursor: pointer;
+    transition: all 0.15s;
+}
+
+.help-requests-page .filter-btn:hover {
+    color: #e6edf3;
+    border-color: #484f58;
+}
+
+.help-requests-page .filter-btn.active {
+    background: #3b82f620;
+    border-color: #3b82f6;
+    color: #3b82f6;
+}
+
+/* ---- List ---- */
+
+.hr-list {
+    display: flex;
+    flex-direction: column;
+    gap: 12px;
+}
+
+.hr-card {
+    background: var(--card-bg, #161b22);
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: 12px;
+    padding: 16px 20px;
+    display: flex;
+    align-items: flex-start;
+    gap: 16px;
+    transition: border-color 0.15s;
+}
+
+.hr-card:hover {
+    border-color: #484f58;
+}
+
+.hr-card.status-pending {
+    border-left: 3px solid #d29922;
+}
+
+.hr-card.status-accepted {
+    border-left: 3px solid #3b82f6;
+}
+
+.hr-card.status-resolved {
+    border-left: 3px solid #3fb950;
+    opacity: 0.7;
+}
+
+.hr-card-body {
+    flex: 1;
+    min-width: 0;
+}
+
+.hr-card-header {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    margin-bottom: 8px;
+}
+
+.hr-device-id {
+    font-weight: 600;
+    color: #e6edf3;
+    font-family: 'JetBrains Mono', monospace;
+    font-size: 14px;
+}
+
+.hr-hostname {
+    color: #8b949e;
+    font-size: 13px;
+}
+
+.hr-status-badge {
+    font-size: 11px;
+    font-weight: 600;
+    padding: 2px 10px;
+    border-radius: 12px;
+    text-transform: uppercase;
+    letter-spacing: 0.5px;
+    margin-left: auto;
+}
+
+.hr-status-badge.pending { background: #d2992220; color: #d29922; }
+.hr-status-badge.accepted { background: #3b82f620; color: #3b82f6; }
+.hr-status-badge.resolved { background: #3fb95020; color: #3fb950; }
+
+.hr-message {
+    color: #c9d1d9;
+    font-size: 14px;
+    line-height: 1.5;
+    margin-bottom: 10px;
+    word-break: break-word;
+}
+
+.hr-meta {
+    display: flex;
+    align-items: center;
+    gap: 16px;
+    font-size: 12px;
+    color: #8b949e;
+}
+
+.hr-card-actions {
+    display: flex;
+    gap: 8px;
+    flex-shrink: 0;
+    align-self: center;
+}
+
+.hr-card-actions .btn {
+    padding: 6px 14px;
+    font-size: 12px;
+    border-radius: 8px;
+    border: 1px solid var(--border-color, #30363d);
+    background: var(--card-bg, #161b22);
+    color: #c9d1d9;
+    cursor: pointer;
+    transition: all 0.15s;
+}
+
+.hr-card-actions .btn:hover {
+    border-color: #484f58;
+    color: #e6edf3;
+}
+
+.hr-card-actions .btn-accept {
+    background: #3b82f615;
+    border-color: #3b82f640;
+    color: #3b82f6;
+}
+
+.hr-card-actions .btn-accept:hover {
+    background: #3b82f630;
+}
+
+.hr-card-actions .btn-resolve {
+    background: #3fb95015;
+    border-color: #3fb95040;
+    color: #3fb950;
+}
+
+.hr-card-actions .btn-resolve:hover {
+    background: #3fb95030;
+}
+
+.hr-card-actions .btn-connect {
+    background: #8b5cf615;
+    border-color: #8b5cf640;
+    color: #8b5cf6;
+}
+
+.hr-card-actions .btn-connect:hover {
+    background: #8b5cf630;
+}
+
+/* ---- Empty state ---- */
+
+.hr-list .empty-state {
+    text-align: center;
+    padding: 60px 20px;
+    color: #8b949e;
+}
+
+.hr-list .empty-state .material-icons {
+    font-size: 48px;
+    margin-bottom: 12px;
+    opacity: 0.5;
+}
+
+/* ---- Sound notification dot ---- */
+
+.hr-notification-dot {
+    width: 8px;
+    height: 8px;
+    border-radius: 50%;
+    background: #d29922;
+    animation: pulse-dot 1.5s infinite;
+    display: inline-block;
+    margin-right: 6px;
+}
+
+@keyframes pulse-dot {
+    0%, 100% { opacity: 1; transform: scale(1); }
+    50% { opacity: 0.5; transform: scale(1.3); }
+}
+
+/* ---- Responsive ---- */
+
+@media (max-width: 768px) {
+    .hr-stats {
+        gap: 8px;
+    }
+    .hr-stats .stat-card {
+        min-width: 80px;
+        padding: 12px;
+    }
+    .hr-card {
+        flex-direction: column;
+    }
+    .hr-card-actions {
+        align-self: flex-end;
+    }
+}
diff --git a/web-nodejs/public/css/inventory.css b/web-nodejs/public/css/inventory.css
new file mode 100644
index 00000000..bb3e767c
--- /dev/null
+++ b/web-nodejs/public/css/inventory.css
@@ -0,0 +1,303 @@
+/**
+ * BetterDesk Console - Inventory Page Styles
+ */
+
+.inventory-page {
+    padding: 0;
+}
+
+/* Header */
+.inventory-page .page-header {
+    margin-bottom: 24px;
+}
+
+.inventory-page .page-title {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+}
+
+.inventory-page .page-title h1 {
+    margin: 0;
+    font-size: 1.5rem;
+    font-weight: 600;
+    color: var(--text-primary);
+}
+
+.inventory-page .page-subtitle {
+    margin: 4px 0 0;
+    font-size: 0.875rem;
+    color: var(--text-secondary);
+}
+
+/* Stats Cards */
+.inventory-stats {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+    gap: 16px;
+    margin-bottom: 24px;
+}
+
+.inventory-stats .stat-card {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    padding: 16px;
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-primary);
+    border-radius: 8px;
+}
+
+.inventory-stats .stat-card .material-icons {
+    font-size: 28px;
+    color: var(--accent-blue);
+}
+
+.inventory-stats .stat-value {
+    font-size: 1.25rem;
+    font-weight: 600;
+    color: var(--text-primary);
+}
+
+.inventory-stats .stat-label {
+    font-size: 0.75rem;
+    color: var(--text-secondary);
+}
+
+/* Filters */
+.page-filters {
+    display: flex;
+    gap: 12px;
+    align-items: center;
+    margin-bottom: 20px;
+    flex-wrap: wrap;
+}
+
+.page-filters .search-wrapper {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-primary);
+    border-radius: 6px;
+    padding: 0 12px;
+    flex: 1;
+    min-width: 200px;
+    max-width: 400px;
+}
+
+.page-filters .search-wrapper .material-icons {
+    color: var(--text-secondary);
+    font-size: 20px;
+}
+
+.page-filters .search-wrapper .form-input {
+    border: none;
+    background: none;
+    padding: 8px 0;
+    width: 100%;
+    outline: none;
+    color: var(--text-primary);
+    font-size: 0.875rem;
+}
+
+/* Table */
+.table-wrapper {
+    overflow-x: auto;
+}
+
+.data-table {
+    width: 100%;
+    border-collapse: collapse;
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-primary);
+    border-radius: 8px;
+    overflow: hidden;
+}
+
+.data-table th {
+    padding: 10px 14px;
+    text-align: left;
+    font-size: 0.75rem;
+    font-weight: 600;
+    color: var(--text-secondary);
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+    background: var(--bg-tertiary);
+    border-bottom: 1px solid var(--border-primary);
+    white-space: nowrap;
+}
+
+.data-table td {
+    padding: 10px 14px;
+    font-size: 0.875rem;
+    color: var(--text-primary);
+    border-bottom: 1px solid var(--border-primary);
+}
+
+.data-table tr:last-child td {
+    border-bottom: none;
+}
+
+.data-table tr:hover td {
+    background: var(--bg-hover);
+}
+
+.data-table .empty-row:hover td {
+    background: none;
+}
+
+/* Empty state */
+.empty-state {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 12px;
+    padding: 40px 16px;
+    color: var(--text-secondary);
+}
+
+.empty-state .material-icons {
+    font-size: 48px;
+    opacity: 0.5;
+}
+
+.empty-state p {
+    margin: 0;
+    font-size: 0.875rem;
+}
+
+/* Detail Modal */
+.modal-overlay {
+    position: fixed;
+    inset: 0;
+    background: var(--bg-overlay);
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    z-index: 1000;
+}
+
+.modal {
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-primary);
+    border-radius: 12px;
+    width: 90%;
+    max-width: 560px;
+    max-height: 85vh;
+    display: flex;
+    flex-direction: column;
+}
+
+.modal-lg {
+    max-width: 720px;
+}
+
+.modal-header {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: 16px 20px;
+    border-bottom: 1px solid var(--border-primary);
+}
+
+.modal-header h3 {
+    margin: 0;
+    font-size: 1.1rem;
+    font-weight: 600;
+    color: var(--text-primary);
+}
+
+.modal-body {
+    padding: 20px;
+    overflow-y: auto;
+    flex: 1;
+}
+
+.modal-footer {
+    display: flex;
+    justify-content: flex-end;
+    gap: 8px;
+    padding: 12px 20px;
+    border-top: 1px solid var(--border-primary);
+}
+
+/* Detail sections */
+.detail-section {
+    margin-bottom: 20px;
+}
+
+.detail-section h4 {
+    margin: 0 0 12px;
+    font-size: 0.875rem;
+    font-weight: 600;
+    color: var(--accent-blue);
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+}
+
+.detail-grid {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 8px 16px;
+}
+
+.detail-item {
+    display: flex;
+    flex-direction: column;
+    gap: 2px;
+}
+
+.detail-label {
+    font-size: 0.75rem;
+    color: var(--text-secondary);
+}
+
+.detail-value {
+    font-size: 0.875rem;
+    color: var(--text-primary);
+    font-weight: 500;
+}
+
+/* Progress bars */
+.usage-bar {
+    height: 6px;
+    background: var(--bg-tertiary);
+    border-radius: 3px;
+    overflow: hidden;
+    margin-top: 4px;
+}
+
+.usage-bar-fill {
+    height: 100%;
+    border-radius: 3px;
+    transition: width 0.3s ease;
+    background: var(--accent-blue);
+}
+
+.usage-bar-fill.warning {
+    background: var(--accent-yellow);
+}
+
+.usage-bar-fill.danger {
+    background: var(--accent-red);
+}
+
+/* Responsive */
+@media (max-width: 768px) {
+    .inventory-stats {
+        grid-template-columns: repeat(2, 1fr);
+    }
+
+    .page-filters {
+        flex-direction: column;
+    }
+
+    .page-filters .search-wrapper {
+        max-width: none;
+    }
+
+    .detail-grid {
+        grid-template-columns: 1fr;
+    }
+}
diff --git a/web-nodejs/public/css/main.css b/web-nodejs/public/css/main.css
index 18be928a..b7920a8a 100644
--- a/web-nodejs/public/css/main.css
+++ b/web-nodejs/public/css/main.css
@@ -144,6 +144,7 @@ table {
     display: flex;
     flex-direction: column;
     z-index: var(--z-sticky);
+    transition: transform var(--transition-normal);
 }
 
 .sidebar-header {
@@ -337,6 +338,10 @@ table {
     font-weight: var(--font-weight-medium);
 }
 
+.navbar-breadcrumb .breadcrumb-section {
+    color: var(--text-secondary);
+}
+
 .navbar-right {
     display: flex;
     align-items: center;
@@ -677,6 +682,182 @@ table {
     margin-top: var(--space-xs);
 }
 
+/* Stat card inner aliases (used by network, dataguard, tenants modules) */
+.stat-icon {
+    width: 48px;
+    height: 48px;
+    border-radius: var(--radius-md);
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    flex-shrink: 0;
+}
+
+.stat-icon.online,
+.stat-icon.success {
+    background: var(--accent-green-muted);
+    color: var(--accent-green);
+}
+
+.stat-icon.offline,
+.stat-icon.danger {
+    background: var(--accent-red-muted);
+    color: var(--accent-red);
+}
+
+.stat-icon.primary {
+    background: var(--accent-blue-muted);
+    color: var(--accent-blue);
+}
+
+.stat-icon.warning {
+    background: var(--accent-yellow-muted);
+    color: var(--accent-yellow);
+}
+
+.stat-info {
+    flex: 1;
+    min-width: 0;
+}
+
+.stat-value {
+    font-size: var(--font-size-2xl);
+    font-weight: var(--font-weight-bold);
+    color: var(--text-primary);
+    line-height: 1;
+}
+
+.stat-label {
+    font-size: var(--font-size-sm);
+    color: var(--text-secondary);
+    margin-top: var(--space-xs);
+}
+
+/* ═══════════════════════════════════════════════════════════════════════════
+   SHARED DATA TABLE (used by inventory, tickets, automation, network, etc.)
+   ═══════════════════════════════════════════════════════════════════════════ */
+
+.data-table {
+    width: 100%;
+    border-collapse: collapse;
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-primary);
+    border-radius: var(--radius-lg);
+    overflow: hidden;
+}
+
+.data-table th {
+    padding: var(--space-sm) var(--space-md);
+    text-align: left;
+    font-size: var(--font-size-xs);
+    font-weight: var(--font-weight-semibold);
+    color: var(--text-secondary);
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+    background: var(--bg-tertiary);
+    border-bottom: 1px solid var(--border-primary);
+    white-space: nowrap;
+}
+
+.data-table td {
+    padding: var(--space-sm) var(--space-md);
+    font-size: var(--font-size-sm);
+    color: var(--text-primary);
+    border-bottom: 1px solid var(--border-primary);
+}
+
+.data-table tr:last-child td {
+    border-bottom: none;
+}
+
+.data-table tr:hover td {
+    background: var(--bg-hover);
+}
+
+.data-table .empty-row:hover td {
+    background: none;
+}
+
+/* ═══════════════════════════════════════════════════════════════════════════
+   SHARED EMPTY STATE
+   ═══════════════════════════════════════════════════════════════════════════ */
+
+.empty-state {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: var(--space-md);
+    padding: 40px var(--space-md);
+    color: var(--text-secondary);
+}
+
+.empty-state .material-icons {
+    font-size: 48px;
+    opacity: 0.5;
+}
+
+.empty-state p {
+    margin: 0;
+    font-size: var(--font-size-sm);
+}
+
+/* ═══════════════════════════════════════════════════════════════════════════
+   SHARED FORM LAYOUTS
+   ═══════════════════════════════════════════════════════════════════════════ */
+
+.form-row {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: var(--space-md);
+}
+
+.form-actions {
+    display: flex;
+    justify-content: flex-end;
+    gap: var(--space-sm);
+    padding-top: var(--space-md);
+}
+
+/* ═══════════════════════════════════════════════════════════════════════════
+   SHARED DETAIL SECTIONS (modals/panels)
+   ═══════════════════════════════════════════════════════════════════════════ */
+
+.detail-section {
+    margin-bottom: var(--space-lg);
+}
+
+.detail-section h4 {
+    margin: 0 0 var(--space-md);
+    font-size: var(--font-size-sm);
+    font-weight: var(--font-weight-semibold);
+    color: var(--accent-blue);
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+}
+
+.detail-grid {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: var(--space-sm) var(--space-md);
+}
+
+.detail-item {
+    display: flex;
+    flex-direction: column;
+    gap: 2px;
+}
+
+.detail-label {
+    font-size: var(--font-size-xs);
+    color: var(--text-secondary);
+}
+
+.detail-value {
+    font-size: var(--font-size-sm);
+    color: var(--text-primary);
+    font-weight: var(--font-weight-medium);
+}
+
 /* ═══════════════════════════════════════════════════════════════════════════
    TABLES
    ═══════════════════════════════════════════════════════════════════════════ */
@@ -784,18 +965,16 @@ table {
     position: fixed;
     inset: 0;
     background: var(--bg-overlay);
-    display: flex;
+    display: none;
     align-items: center;
     justify-content: center;
     z-index: var(--z-modal);
-    opacity: 0;
-    visibility: hidden;
-    transition: all var(--transition-fast);
+    transition: opacity var(--transition-fast);
 }
 
 .modal-overlay.open {
+    display: flex;
     opacity: 1;
-    visibility: visible;
 }
 
 .modal {
@@ -908,6 +1087,211 @@ table {
 
 .toast.success .toast-icon { color: var(--accent-green); }
 .toast.error .toast-icon { color: var(--accent-red); }
+
+/* ────────────────────────────────────────────────────
+   Shared component styles (tabs, filters, panels)
+   ──────────────────────────────────────────────────── */
+
+/* Tab bar */
+.tab-bar {
+    display: flex;
+    gap: 4px;
+    margin-bottom: 24px;
+    border-bottom: 1px solid var(--border-primary);
+    overflow-x: auto;
+}
+
+.tab-btn {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    padding: 10px 16px;
+    background: none;
+    border: none;
+    border-bottom: 2px solid transparent;
+    color: var(--text-secondary);
+    font-size: 0.875rem;
+    font-weight: 500;
+    cursor: pointer;
+    white-space: nowrap;
+    transition: all 0.15s;
+}
+
+.tab-btn:hover {
+    color: var(--text-primary);
+    background: var(--bg-hover);
+}
+
+.tab-btn.active {
+    color: var(--accent-blue);
+    border-bottom-color: var(--accent-blue);
+}
+
+.tab-btn .material-icons {
+    font-size: 18px;
+}
+
+.tab-panel {
+    display: none;
+}
+
+.tab-panel.active {
+    display: block;
+}
+
+/* Panel actions bar */
+.panel-actions {
+    display: flex;
+    gap: 12px;
+    align-items: center;
+    margin-bottom: 16px;
+    flex-wrap: wrap;
+}
+
+.panel-actions-right {
+    display: flex;
+    gap: 8px;
+    align-items: center;
+    margin-left: auto;
+}
+
+/* Page filters bar */
+.page-filters {
+    display: flex;
+    gap: 12px;
+    align-items: center;
+    margin-bottom: 20px;
+    flex-wrap: wrap;
+}
+
+.page-filters .search-wrapper {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-primary);
+    border-radius: 6px;
+    padding: 0 12px;
+    flex: 1;
+    min-width: 200px;
+    max-width: 400px;
+}
+
+.page-filters .search-wrapper .material-icons {
+    position: static;
+    transform: none;
+    color: var(--text-secondary);
+    font-size: 20px;
+    flex-shrink: 0;
+}
+
+.page-filters .search-wrapper .form-input,
+.page-filters .search-wrapper input[type="text"] {
+    border: none;
+    background: none;
+    padding: 8px 0;
+    width: 100%;
+    outline: none;
+    color: var(--text-primary);
+}
+
+/* Panel actions search wrapper (network, tenants, dataguard) */
+.panel-actions .search-wrapper {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-primary);
+    border-radius: 6px;
+    padding: 0 12px;
+    flex: 1;
+    min-width: 200px;
+    max-width: 400px;
+}
+
+.panel-actions .search-wrapper .material-icons {
+    position: static;
+    transform: none;
+    color: var(--text-secondary);
+    font-size: 20px;
+    flex-shrink: 0;
+}
+
+.panel-actions .search-wrapper input[type="text"],
+.panel-actions .search-wrapper .form-input {
+    border: none;
+    background: none;
+    padding: 8px 0;
+    width: 100%;
+    outline: none;
+    color: var(--text-primary);
+    font-size: var(--font-size-md);
+}
+
+/* Dark theme date inputs */
+input[type="date"],
+input[type="datetime-local"] {
+    color-scheme: dark;
+    background: var(--bg-tertiary);
+    color: var(--text-primary);
+    border: 1px solid var(--border-primary);
+    border-radius: var(--radius-md);
+    padding: var(--space-xs) var(--space-sm);
+    font-size: var(--font-size-sm);
+}
+
+input[type="date"]:focus,
+input[type="datetime-local"]:focus {
+    border-color: var(--accent-blue);
+    box-shadow: 0 0 0 3px var(--accent-blue-muted);
+}
+
+/* Filter group for date ranges */
+.filter-group {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    font-size: var(--font-size-sm);
+    color: var(--text-secondary);
+}
+
+.filter-group label {
+    white-space: nowrap;
+}
+
+.range-sep {
+    color: var(--text-tertiary);
+}
+
+/* Filter buttons (inline segmented pills) */
+.filter-buttons {
+    display: flex;
+    gap: 4px;
+    align-items: center;
+    flex-wrap: wrap;
+}
+
+.filter-btn {
+    padding: 4px 10px;
+    font-size: 0.75rem;
+    background: transparent;
+    border: none;
+    border-radius: 6px;
+    color: var(--text-secondary);
+    cursor: pointer;
+    transition: all 0.15s ease;
+    white-space: nowrap;
+}
+
+.filter-btn:hover {
+    color: var(--text-primary);
+    background: var(--bg-hover);
+}
+
+.filter-btn.active {
+    background: var(--accent-blue-muted);
+    color: var(--accent-blue);
+}
 .toast.warning .toast-icon { color: var(--accent-yellow); }
 .toast.info .toast-icon { color: var(--accent-blue); }
 
@@ -1074,4 +1458,12 @@ table {
         min-width: auto;
         max-width: none;
     }
+    
+    .form-row {
+        grid-template-columns: 1fr;
+    }
+    
+    .detail-grid {
+        grid-template-columns: 1fr;
+    }
 }
diff --git a/web-nodejs/public/css/network.css b/web-nodejs/public/css/network.css
new file mode 100644
index 00000000..ea9340c9
--- /dev/null
+++ b/web-nodejs/public/css/network.css
@@ -0,0 +1,114 @@
+/* BetterDesk Console - Network Monitor Styles */
+
+/* Tools grid */
+.tools-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(320px, 1fr));
+    gap: 16px;
+    margin-top: 16px;
+}
+
+.tool-card {
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-primary);
+    border-radius: 8px;
+    padding: 20px;
+}
+
+.tool-card h3 {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    color: var(--text-primary);
+    font-size: 16px;
+    margin-bottom: 16px;
+}
+
+.tool-card h3 .material-icons {
+    color: var(--accent-blue);
+    font-size: 22px;
+}
+
+.tool-form {
+    display: flex;
+    gap: 8px;
+    align-items: center;
+    flex-wrap: wrap;
+}
+
+.tool-form input {
+    flex: 1;
+    min-width: 120px;
+    padding: 8px 12px;
+    background: var(--bg-tertiary);
+    border: 1px solid var(--border-primary);
+    border-radius: 6px;
+    color: var(--text-primary);
+    font-size: 14px;
+}
+
+.tool-result {
+    margin-top: 12px;
+    padding: 10px 12px;
+    background: var(--bg-primary);
+    border-radius: 6px;
+    font-family: 'Fira Mono', 'Consolas', monospace;
+    font-size: 13px;
+    color: var(--text-secondary);
+    min-height: 24px;
+    white-space: pre-wrap;
+    word-break: break-all;
+}
+
+.tool-result.success { color: var(--accent-green); }
+.tool-result.error { color: var(--accent-red); }
+
+/* latency cell */
+.latency-val { font-variant-numeric: tabular-nums; }
+.latency-val.good { color: var(--accent-green); }
+.latency-val.warn { color: var(--accent-yellow); }
+.latency-val.bad { color: var(--accent-red); }
+
+/* target status */
+.target-status { display: inline-flex; align-items: center; gap: 6px; font-size: 13px; font-weight: 500; }
+.target-status .dot { width: 8px; height: 8px; border-radius: 50%; display: inline-block; }
+.target-status.up .dot { background: var(--accent-green); }
+.target-status.up { color: var(--accent-green); }
+.target-status.down .dot { background: var(--accent-red); }
+.target-status.down { color: var(--accent-red); }
+.target-status.unknown .dot { background: var(--text-muted); }
+.target-status.unknown { color: var(--text-muted); }
+
+/* history timeline */
+.history-timeline {
+    display: flex;
+    flex-direction: column;
+    gap: 8px;
+}
+
+.history-entry {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    padding: 8px 12px;
+    background: var(--bg-tertiary);
+    border-radius: 6px;
+    font-size: 13px;
+}
+
+.history-entry .time { color: var(--text-muted); min-width: 100px; }
+.history-entry .status-dot { width: 8px; height: 8px; border-radius: 50%; flex-shrink: 0; }
+.history-entry .status-dot.up { background: var(--accent-green); }
+.history-entry .status-dot.down { background: var(--accent-red); }
+.history-entry .latency { color: var(--text-secondary); margin-left: auto; font-variant-numeric: tabular-nums; }
+
+/* monitor status indicator */
+.monitor-active { color: var(--accent-green) !important; }
+.monitor-active .material-icons { color: var(--accent-green); }
+
+/* responsive */
+@media (max-width: 768px) {
+    .tools-grid { grid-template-columns: 1fr; }
+    .tool-form { flex-direction: column; }
+    .tool-form input { width: 100%; }
+}
diff --git a/web-nodejs/public/css/reports.css b/web-nodejs/public/css/reports.css
new file mode 100644
index 00000000..3d3a4508
--- /dev/null
+++ b/web-nodejs/public/css/reports.css
@@ -0,0 +1,199 @@
+/* BetterDesk Console - Reports Styles */
+
+/* Report type grid */
+.report-type-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(220px, 1fr));
+    gap: 16px;
+    margin-top: 16px;
+}
+
+.report-type-card {
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-primary);
+    border-radius: 8px;
+    padding: 20px;
+    cursor: pointer;
+    transition: border-color 0.2s, transform 0.15s;
+    text-align: center;
+}
+
+.report-type-card:hover {
+    border-color: var(--accent-blue);
+    transform: translateY(-2px);
+}
+
+.report-type-card.selected {
+    border-color: var(--accent-blue);
+    background: rgba(88, 166, 255, 0.06);
+}
+
+.report-type-card .material-icons {
+    font-size: 36px;
+    color: var(--accent-blue);
+    margin-bottom: 8px;
+}
+
+.report-type-card h3 {
+    color: var(--text-primary);
+    font-size: 15px;
+    margin-bottom: 4px;
+}
+
+.report-type-card p {
+    color: var(--text-muted);
+    font-size: 12px;
+    margin: 0;
+}
+
+/* Report options */
+.report-options {
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-primary);
+    border-radius: 8px;
+    padding: 20px;
+    margin-top: 16px;
+}
+
+.report-options h3 {
+    color: var(--text-primary);
+    margin-bottom: 16px;
+}
+
+/* Preview */
+.report-preview {
+    margin-top: 16px;
+}
+
+.report-preview-header {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    margin-bottom: 12px;
+}
+
+.report-preview-header h3 {
+    color: var(--text-primary);
+    margin: 0;
+}
+
+.report-output {
+    background: var(--bg-primary);
+    border: 1px solid var(--border-primary);
+    border-radius: 8px;
+    padding: 16px;
+    max-height: 500px;
+    overflow: auto;
+    font-family: 'Fira Mono', 'Consolas', monospace;
+    font-size: 13px;
+    color: var(--text-secondary);
+    white-space: pre-wrap;
+    word-break: break-all;
+}
+
+/* Saved report entries */
+.report-name { font-weight: 500; color: var(--text-primary); }
+
+/* responsive */
+@media (max-width: 768px) {
+    .report-type-grid { grid-template-columns: repeat(2, 1fr); }
+}
+@media (max-width: 480px) {
+    .report-type-grid { grid-template-columns: 1fr; }
+}
+
+/* Human-readable report rendering */
+.report-summary {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 12px;
+    margin-bottom: 20px;
+}
+
+.report-stat {
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-primary);
+    border-radius: 8px;
+    padding: 12px 16px;
+    min-width: 140px;
+    display: flex;
+    flex-direction: column;
+    gap: 4px;
+}
+
+.report-stat-label {
+    font-size: 12px;
+    color: var(--text-secondary);
+    text-transform: uppercase;
+    letter-spacing: 0.03em;
+}
+
+.report-stat-value {
+    font-size: 18px;
+    font-weight: 600;
+    color: var(--text-primary);
+}
+
+.report-section-title {
+    color: var(--text-primary);
+    font-size: 14px;
+    font-weight: 600;
+    margin: 16px 0 8px 0;
+    padding-bottom: 4px;
+    border-bottom: 1px solid var(--border-primary);
+}
+
+.report-list {
+    list-style: disc;
+    padding-left: 20px;
+    color: var(--text-secondary);
+    font-size: 13px;
+}
+
+.report-list li { padding: 2px 0; }
+
+.report-kv {
+    display: flex;
+    flex-direction: column;
+    gap: 4px;
+}
+
+.report-kv-row {
+    display: flex;
+    gap: 12px;
+    padding: 4px 0;
+    border-bottom: 1px solid var(--border-subtle, rgba(255,255,255,0.04));
+}
+
+.report-kv-key {
+    font-size: 13px;
+    font-weight: 500;
+    color: var(--text-secondary);
+    min-width: 150px;
+}
+
+.report-kv-val {
+    font-size: 13px;
+    color: var(--text-primary);
+}
+
+.raw-json-toggle {
+    margin-top: 16px;
+    border-top: 1px solid var(--border-primary);
+    padding-top: 8px;
+}
+
+.raw-json-toggle summary {
+    cursor: pointer;
+    color: var(--text-secondary);
+    font-size: 12px;
+    user-select: none;
+}
+
+.raw-json-toggle pre {
+    margin-top: 8px;
+    font-size: 12px;
+    color: var(--text-tertiary);
+    white-space: pre-wrap;
+    word-break: break-all;
+}
diff --git a/web-nodejs/public/css/tenants.css b/web-nodejs/public/css/tenants.css
new file mode 100644
index 00000000..f3e226ba
--- /dev/null
+++ b/web-nodejs/public/css/tenants.css
@@ -0,0 +1,269 @@
+/* BetterDesk Console - Tenants Styles */
+
+/* Tenants grid */
+.tenants-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(340px, 1fr));
+    gap: var(--space-md);
+    margin-top: var(--space-md);
+}
+
+.tenant-card {
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-primary);
+    border-radius: var(--radius-lg);
+    padding: var(--space-lg);
+    cursor: pointer;
+    transition: border-color 0.2s, box-shadow 0.2s, transform 0.15s;
+    position: relative;
+    overflow: hidden;
+}
+
+.tenant-card::before {
+    content: '';
+    position: absolute;
+    top: 0;
+    left: 0;
+    right: 0;
+    height: 3px;
+    background: var(--accent-blue);
+    opacity: 0;
+    transition: opacity 0.2s;
+}
+
+.tenant-card:hover {
+    border-color: var(--accent-blue);
+    box-shadow: 0 4px 12px rgba(0, 0, 0, 0.15);
+    transform: translateY(-2px);
+}
+
+.tenant-card:hover::before {
+    opacity: 1;
+}
+
+.tenant-card-header {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    margin-bottom: var(--space-md);
+}
+
+.tenant-card-header h3 {
+    color: var(--text-primary);
+    font-size: var(--font-size-base);
+    font-weight: var(--font-weight-semibold);
+    margin: 0;
+    display: flex;
+    align-items: center;
+    gap: var(--space-sm);
+}
+
+.tenant-card-header .tenant-status {
+    display: inline-flex;
+    align-items: center;
+    gap: 4px;
+    font-size: var(--font-size-xs);
+    font-weight: 500;
+    padding: 2px 8px;
+    border-radius: var(--radius-full);
+}
+
+.tenant-status.active {
+    color: var(--accent-green);
+    background: var(--accent-green-muted);
+}
+
+.tenant-status.disabled {
+    color: var(--text-muted);
+    background: var(--bg-tertiary);
+}
+
+.tenant-status .dot {
+    width: 6px;
+    height: 6px;
+    border-radius: 50%;
+}
+
+.tenant-status.active .dot { background: var(--accent-green); }
+.tenant-status.disabled .dot { background: var(--text-muted); }
+
+.tenant-card-stats {
+    display: grid;
+    grid-template-columns: repeat(3, 1fr);
+    gap: var(--space-sm);
+    margin-bottom: var(--space-md);
+    padding: var(--space-sm);
+    background: var(--bg-tertiary);
+    border-radius: var(--radius-md);
+}
+
+.tenant-stat {
+    text-align: center;
+    padding: var(--space-xs) 0;
+}
+
+.tenant-stat .value {
+    display: block;
+    font-size: var(--font-size-xl);
+    font-weight: var(--font-weight-bold);
+    color: var(--text-primary);
+    font-variant-numeric: tabular-nums;
+    line-height: 1.2;
+}
+
+.tenant-stat .label {
+    display: block;
+    font-size: 10px;
+    color: var(--text-muted);
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+    margin-top: 2px;
+}
+
+.tenant-card-footer {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    border-top: 1px solid var(--border-primary);
+    padding-top: var(--space-sm);
+}
+
+.tenant-slug {
+    color: var(--text-muted);
+    font-size: var(--font-size-xs);
+    font-family: var(--font-mono, 'Fira Mono', monospace);
+    background: var(--bg-tertiary);
+    padding: 2px 8px;
+    border-radius: var(--radius-sm);
+}
+
+.tenant-card-actions {
+    display: flex;
+    gap: 4px;
+}
+
+.tenant-card-actions .btn {
+    opacity: 0.6;
+    transition: opacity 0.15s;
+}
+
+.tenant-card:hover .tenant-card-actions .btn {
+    opacity: 1;
+}
+
+/* empty tenants */
+.tenants-empty {
+    grid-column: 1 / -1;
+    text-align: center;
+    padding: 64px 20px;
+    background: var(--bg-secondary);
+    border: 2px dashed var(--border-primary);
+    border-radius: var(--radius-lg);
+}
+
+.tenants-empty .material-icons {
+    font-size: 56px;
+    color: var(--text-muted);
+    margin-bottom: var(--space-md);
+    opacity: 0.5;
+}
+
+.tenants-empty p {
+    color: var(--text-muted);
+    font-size: var(--font-size-sm);
+}
+
+/* Detail sections */
+.tenant-detail-tabs {
+    display: flex;
+    gap: 4px;
+    margin-bottom: var(--space-lg);
+    border-bottom: 1px solid var(--border-primary);
+    padding-bottom: 0;
+}
+
+.tenant-detail-tab {
+    padding: 8px 16px;
+    border: none;
+    background: transparent;
+    color: var(--text-secondary);
+    font-size: var(--font-size-sm);
+    cursor: pointer;
+    border-bottom: 2px solid transparent;
+    margin-bottom: -1px;
+    transition: color 0.2s, border-color 0.2s;
+}
+
+.tenant-detail-tab:hover {
+    color: var(--text-primary);
+    background: var(--bg-tertiary);
+}
+
+.tenant-detail-tab.active {
+    color: var(--accent-blue);
+    border-bottom-color: var(--accent-blue);
+    font-weight: var(--font-weight-medium);
+}
+
+.tenant-detail-panel { display: none; }
+.tenant-detail-panel.active { display: block; }
+
+/* assignment lists */
+.assignment-list {
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-xs);
+}
+
+.assignment-item {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: var(--space-sm) var(--space-md);
+    background: var(--bg-tertiary);
+    border-radius: var(--radius-md);
+    font-size: var(--font-size-sm);
+    transition: background 0.15s;
+}
+
+.assignment-item:hover {
+    background: var(--bg-secondary);
+    outline: 1px solid var(--border-primary);
+}
+
+.assignment-item .name {
+    color: var(--text-primary);
+    font-weight: var(--font-weight-medium);
+}
+
+/* Form enhancements */
+#form-modal .form-row {
+    margin-bottom: var(--space-md);
+}
+
+#form-modal .form-row label {
+    display: block;
+    font-size: var(--font-size-sm);
+    font-weight: var(--font-weight-medium);
+    color: var(--text-secondary);
+    margin-bottom: var(--space-xs);
+}
+
+#form-modal .form-row label:has(input[type="checkbox"]) {
+    display: flex;
+    align-items: center;
+    gap: var(--space-sm);
+    cursor: pointer;
+    color: var(--text-primary);
+}
+
+/* responsive */
+@media (max-width: 768px) {
+    .tenants-grid {
+        grid-template-columns: 1fr;
+    }
+
+    .tenant-card-stats {
+        grid-template-columns: repeat(3, 1fr);
+    }
+}
diff --git a/web-nodejs/public/css/tickets.css b/web-nodejs/public/css/tickets.css
new file mode 100644
index 00000000..1358624b
--- /dev/null
+++ b/web-nodejs/public/css/tickets.css
@@ -0,0 +1,246 @@
+/**
+ * BetterDesk Console - Tickets Page Styles
+ */
+
+.tickets-page {
+    padding: 0;
+}
+
+.tickets-page .page-header {
+    margin-bottom: 24px;
+}
+
+.tickets-page .page-title h1 {
+    margin: 0;
+    font-size: 1.5rem;
+    font-weight: 600;
+    color: var(--text-primary);
+}
+
+.tickets-page .page-subtitle {
+    margin: 4px 0 0;
+    font-size: 0.875rem;
+    color: var(--text-secondary);
+}
+
+/* Stats */
+.tickets-stats {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(140px, 1fr));
+    gap: 12px;
+    margin-bottom: 24px;
+}
+
+.tickets-stats .stat-card {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    padding: 14px;
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-primary);
+    border-radius: 8px;
+}
+
+.tickets-stats .stat-value {
+    font-size: 1.5rem;
+    font-weight: 700;
+    color: var(--text-primary);
+}
+
+.tickets-stats .stat-label {
+    font-size: 0.75rem;
+    color: var(--text-secondary);
+    margin-top: 2px;
+}
+
+.tickets-stats .stat-open .stat-value { color: var(--accent-blue); }
+.tickets-stats .stat-progress .stat-value { color: var(--accent-yellow); }
+.tickets-stats .stat-resolved .stat-value { color: var(--accent-green); }
+
+/* Filters */
+.tickets-page .page-filters {
+    display: flex;
+    gap: 12px;
+    align-items: center;
+    margin-bottom: 20px;
+    flex-wrap: wrap;
+}
+
+.tickets-page .search-wrapper {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-primary);
+    border-radius: 6px;
+    padding: 0 12px;
+    min-width: 200px;
+}
+
+.tickets-page .search-wrapper .material-icons {
+    color: var(--text-secondary);
+    font-size: 20px;
+}
+
+.tickets-page .search-wrapper .form-input {
+    border: none;
+    background: none;
+    padding: 8px 0;
+    width: 100%;
+    outline: none;
+    color: var(--text-primary);
+    font-size: 0.875rem;
+}
+
+.filter-buttons {
+    display: flex;
+    gap: 4px;
+    flex-wrap: wrap;
+}
+
+.filter-btn {
+    padding: 6px 12px;
+    font-size: 0.8rem;
+    border-radius: 16px;
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-primary);
+    color: var(--text-secondary);
+    cursor: pointer;
+    transition: all 0.15s;
+}
+
+.filter-btn:hover {
+    border-color: var(--border-hover);
+    color: var(--text-primary);
+}
+
+.filter-btn.active {
+    background: var(--accent-blue-muted);
+    border-color: var(--accent-blue);
+    color: var(--accent-blue);
+}
+
+/* Priority badges */
+.priority-badge {
+    display: inline-block;
+    padding: 2px 8px;
+    border-radius: 10px;
+    font-size: 0.75rem;
+    font-weight: 600;
+}
+
+.priority-badge.low { background: var(--bg-tertiary); color: var(--text-secondary); }
+.priority-badge.medium { background: var(--accent-blue-muted); color: var(--accent-blue); }
+.priority-badge.high { background: var(--accent-yellow-muted); color: var(--accent-yellow); }
+.priority-badge.critical { background: var(--accent-red-muted); color: var(--accent-red); }
+
+/* Status badges */
+.status-badge {
+    display: inline-block;
+    padding: 2px 8px;
+    border-radius: 10px;
+    font-size: 0.75rem;
+    font-weight: 600;
+}
+
+.status-badge.open { background: var(--accent-blue-muted); color: var(--accent-blue); }
+.status-badge.in_progress { background: var(--accent-yellow-muted); color: var(--accent-yellow); }
+.status-badge.resolved { background: var(--accent-green-muted); color: var(--accent-green); }
+.status-badge.closed { background: var(--bg-tertiary); color: var(--text-secondary); }
+
+/* SLA overdue */
+.sla-overdue {
+    color: var(--accent-red);
+    font-size: 0.7rem;
+    font-weight: 600;
+}
+
+/* Form rows */
+.form-row {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 16px;
+}
+
+.form-group {
+    margin-bottom: 16px;
+}
+
+.form-group label {
+    display: block;
+    margin-bottom: 4px;
+    font-size: 0.8rem;
+    font-weight: 600;
+    color: var(--text-secondary);
+}
+
+/* Comments */
+.comments-section {
+    margin-top: 20px;
+}
+
+.comment-item {
+    padding: 10px 0;
+    border-bottom: 1px solid var(--border-primary);
+}
+
+.comment-item:last-child {
+    border-bottom: none;
+}
+
+.comment-header {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    margin-bottom: 4px;
+}
+
+.comment-author {
+    font-size: 0.8rem;
+    font-weight: 600;
+    color: var(--text-primary);
+}
+
+.comment-time {
+    font-size: 0.75rem;
+    color: var(--text-secondary);
+}
+
+.comment-body {
+    font-size: 0.875rem;
+    color: var(--text-primary);
+    line-height: 1.5;
+}
+
+.comment-internal {
+    font-style: italic;
+    opacity: 0.7;
+}
+
+.add-comment-form {
+    margin-top: 12px;
+    display: flex;
+    gap: 8px;
+}
+
+.add-comment-form textarea {
+    flex: 1;
+    resize: vertical;
+    min-height: 60px;
+}
+
+/* Responsive */
+@media (max-width: 768px) {
+    .tickets-stats {
+        grid-template-columns: repeat(2, 1fr);
+    }
+
+    .tickets-page .page-filters {
+        flex-direction: column;
+        align-items: stretch;
+    }
+
+    .form-row {
+        grid-template-columns: 1fr;
+    }
+}
diff --git a/web-nodejs/public/css/tokens.css b/web-nodejs/public/css/tokens.css
new file mode 100644
index 00000000..a368188a
--- /dev/null
+++ b/web-nodejs/public/css/tokens.css
@@ -0,0 +1,466 @@
+/* BetterDesk Console - Device Tokens Styles */
+
+.tokens-page {
+    padding: 0;
+}
+
+/* ── Enrollment Mode Card ─────────────────────────────────────────── */
+
+.enrollment-mode-card {
+    background: var(--card-bg, #161b22);
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: 8px;
+    padding: 20px;
+    margin-bottom: 20px;
+}
+
+.enrollment-mode-header {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    margin-bottom: 16px;
+}
+
+.enrollment-mode-header .material-icons {
+    color: var(--primary, #58a6ff);
+    font-size: 22px;
+}
+
+.enrollment-mode-header h3 {
+    margin: 0;
+    font-size: 16px;
+    font-weight: 600;
+}
+
+.enrollment-mode-options {
+    display: flex;
+    gap: 12px;
+    flex-wrap: wrap;
+}
+
+.enrollment-option {
+    display: flex;
+    flex-direction: column;
+    gap: 4px;
+    padding: 12px 16px;
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: 8px;
+    cursor: pointer;
+    flex: 1;
+    min-width: 180px;
+    transition: border-color 0.2s, background 0.2s;
+}
+
+.enrollment-option:hover {
+    border-color: var(--primary, #58a6ff);
+}
+
+.enrollment-option input[type="radio"] {
+    margin-bottom: 4px;
+}
+
+.enrollment-option input[type="radio"]:checked ~ .option-label {
+    color: var(--primary, #58a6ff);
+}
+
+.enrollment-option .option-label {
+    font-weight: 600;
+    font-size: 14px;
+}
+
+.enrollment-option .option-desc {
+    font-size: 12px;
+    color: var(--muted, #8b949e);
+    line-height: 1.4;
+}
+
+/* ── Stats ────────────────────────────────────────────────────────── */
+
+.tokens-stats {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+    gap: 12px;
+    margin-bottom: 20px;
+}
+
+/* ── Toolbar ──────────────────────────────────────────────────────── */
+
+.tokens-toolbar {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    gap: 12px;
+    margin-bottom: 16px;
+    flex-wrap: wrap;
+}
+
+.toolbar-left {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    flex-wrap: wrap;
+    flex: 1;
+}
+
+.toolbar-right {
+    display: flex;
+    gap: 8px;
+}
+
+.search-wrapper {
+    position: relative;
+    display: flex;
+    align-items: center;
+}
+
+.search-wrapper .material-icons {
+    position: absolute;
+    left: 10px;
+    color: var(--muted, #8b949e);
+    font-size: 18px;
+}
+
+.search-wrapper input {
+    padding: 8px 12px 8px 36px;
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: 6px;
+    background: var(--input-bg, #0d1117);
+    color: var(--text, #e6edf3);
+    font-size: 14px;
+    width: 240px;
+}
+
+.search-wrapper input::placeholder {
+    color: var(--muted, #8b949e);
+}
+
+.filter-pills {
+    display: flex;
+    gap: 6px;
+}
+
+.filter-pill {
+    padding: 6px 14px;
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: 20px;
+    background: transparent;
+    color: var(--text-secondary, #8b949e);
+    font-size: 13px;
+    cursor: pointer;
+    transition: all 0.2s;
+}
+
+.filter-pill:hover {
+    border-color: var(--primary, #58a6ff);
+    color: var(--primary, #58a6ff);
+}
+
+.filter-pill.active {
+    background: var(--primary, #58a6ff);
+    border-color: var(--primary, #58a6ff);
+    color: #fff;
+}
+
+/* ── Table ────────────────────────────────────────────────────────── */
+
+.tokens-table-wrapper {
+    overflow-x: auto;
+}
+
+.token-prefix {
+    font-family: monospace;
+    font-size: 13px;
+    background: var(--input-bg, #0d1117);
+    padding: 2px 8px;
+    border-radius: 4px;
+    letter-spacing: 0.5px;
+    color: var(--primary, #58a6ff);
+}
+
+.actions-cell {
+    white-space: nowrap;
+}
+
+.btn-icon {
+    background: none;
+    border: none;
+    cursor: pointer;
+    padding: 4px;
+    border-radius: 4px;
+    color: var(--text-secondary, #8b949e);
+    transition: color 0.2s, background 0.2s;
+}
+
+.btn-icon:hover {
+    color: var(--primary, #58a6ff);
+    background: rgba(88, 166, 255, 0.1);
+}
+
+.btn-icon-danger:hover {
+    color: var(--danger, #f85149);
+    background: rgba(248, 81, 73, 0.1);
+}
+
+.btn-icon .material-icons {
+    font-size: 18px;
+}
+
+/* ── Status Badges ────────────────────────────────────────────────── */
+
+.status-badge {
+    display: inline-block;
+    padding: 2px 10px;
+    border-radius: 12px;
+    font-size: 12px;
+    font-weight: 500;
+}
+
+.status-active {
+    background: rgba(63, 185, 80, 0.15);
+    color: #3fb950;
+}
+
+.status-used {
+    background: rgba(88, 166, 255, 0.15);
+    color: #58a6ff;
+}
+
+.status-revoked {
+    background: rgba(248, 81, 73, 0.15);
+    color: #f85149;
+}
+
+.status-expired {
+    background: rgba(210, 153, 34, 0.15);
+    color: #d29922;
+    margin-left: 6px;
+}
+
+/* ── Modals ───────────────────────────────────────────────────────── */
+
+.modal-overlay {
+    position: fixed;
+    inset: 0;
+    background: rgba(0, 0, 0, 0.6);
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    z-index: 1000;
+}
+
+.modal {
+    background: var(--card-bg, #161b22);
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: 12px;
+    width: 90%;
+    max-width: 560px;
+    max-height: 90vh;
+    overflow-y: auto;
+}
+
+.modal-header {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    padding: 16px 20px;
+    border-bottom: 1px solid var(--border-color, #30363d);
+}
+
+.modal-header h3 {
+    margin: 0;
+    font-size: 16px;
+}
+
+.modal-close {
+    background: none;
+    border: none;
+    cursor: pointer;
+    color: var(--muted, #8b949e);
+    padding: 4px;
+    border-radius: 4px;
+}
+
+.modal-close:hover {
+    color: var(--text, #e6edf3);
+    background: var(--border-color, #30363d);
+}
+
+.modal-body {
+    padding: 20px;
+}
+
+.modal-body .form-group {
+    margin-bottom: 12px;
+}
+
+.modal-body .form-group label {
+    display: block;
+    font-size: 13px;
+    font-weight: 500;
+    margin-bottom: 4px;
+    color: var(--text, #e6edf3);
+}
+
+.modal-body .form-group input,
+.modal-body .form-group select {
+    width: 100%;
+    padding: 8px 12px;
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: 6px;
+    background: var(--input-bg, #0d1117);
+    color: var(--text, #e6edf3);
+    font-size: 14px;
+}
+
+.modal-body .form-group small {
+    display: block;
+    margin-top: 4px;
+    font-size: 12px;
+    color: var(--muted, #8b949e);
+}
+
+.modal-footer {
+    display: flex;
+    justify-content: flex-end;
+    gap: 8px;
+    padding: 12px 20px;
+    border-top: 1px solid var(--border-color, #30363d);
+}
+
+/* ── Token Created Display ────────────────────────────────────────── */
+
+.token-created-warning {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    padding: 12px 16px;
+    background: rgba(210, 153, 34, 0.1);
+    border: 1px solid rgba(210, 153, 34, 0.3);
+    border-radius: 8px;
+    margin-bottom: 16px;
+    color: #d29922;
+}
+
+.token-created-warning .material-icons {
+    font-size: 24px;
+}
+
+.token-created-warning p {
+    margin: 0;
+    font-size: 13px;
+    line-height: 1.4;
+}
+
+.token-created-item {
+    display: flex;
+    flex-direction: column;
+    gap: 4px;
+    padding: 10px 0;
+    border-bottom: 1px solid var(--border-color, #30363d);
+}
+
+.token-created-item:last-child {
+    border-bottom: none;
+}
+
+.token-created-name {
+    font-size: 13px;
+    color: var(--muted, #8b949e);
+}
+
+.token-created-value {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+}
+
+.token-created-value code {
+    font-family: monospace;
+    font-size: 14px;
+    background: var(--input-bg, #0d1117);
+    padding: 6px 10px;
+    border-radius: 6px;
+    flex: 1;
+    word-break: break-all;
+    color: var(--primary, #58a6ff);
+}
+
+/* ── Buttons ──────────────────────────────────────────────────────── */
+
+.btn {
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+    padding: 8px 16px;
+    border: 1px solid var(--border-color, #30363d);
+    border-radius: 6px;
+    font-size: 14px;
+    font-weight: 500;
+    cursor: pointer;
+    transition: all 0.2s;
+}
+
+.btn .material-icons {
+    font-size: 18px;
+}
+
+.btn-primary {
+    background: var(--primary, #58a6ff);
+    border-color: var(--primary, #58a6ff);
+    color: #fff;
+}
+
+.btn-primary:hover {
+    background: var(--primary-hover, #79c0ff);
+    border-color: var(--primary-hover, #79c0ff);
+}
+
+.btn-secondary {
+    background: transparent;
+    color: var(--text, #e6edf3);
+}
+
+.btn-secondary:hover {
+    background: var(--border-color, #30363d);
+}
+
+/* ── Responsive ───────────────────────────────────────────────────── */
+
+@media (max-width: 768px) {
+    .enrollment-mode-options {
+        flex-direction: column;
+    }
+
+    .tokens-toolbar {
+        flex-direction: column;
+        align-items: stretch;
+    }
+
+    .toolbar-left,
+    .toolbar-right {
+        flex-wrap: wrap;
+    }
+
+    .search-wrapper input {
+        width: 100%;
+    }
+
+    .filter-pills {
+        overflow-x: auto;
+    }
+}
+
+@media (max-width: 600px) {
+    .tokens-stats {
+        grid-template-columns: repeat(2, 1fr);
+    }
+
+    .modal {
+        width: 95%;
+        margin: 10px;
+    }
+
+    .form-row {
+        grid-template-columns: 1fr;
+    }
+}
diff --git a/web-nodejs/public/css/tutorial.css b/web-nodejs/public/css/tutorial.css
new file mode 100644
index 00000000..6b295cea
--- /dev/null
+++ b/web-nodejs/public/css/tutorial.css
@@ -0,0 +1,251 @@
+/**
+ * BetterDesk Console - Tutorial System Styles
+ * Spotlight overlay with animated tooltips.
+ */
+
+/* ============ Overlay ============ */
+
+.tutorial-overlay {
+    position: fixed;
+    inset: 0;
+    z-index: 100000;
+    background: rgba(0, 0, 0, 0.7);
+    opacity: 0;
+    visibility: hidden;
+    transition: all 0.3s ease;
+    pointer-events: auto;
+}
+
+.tutorial-overlay.active {
+    opacity: 1;
+    visibility: visible;
+}
+
+/* ============ Spotlight ============ */
+
+.tutorial-spotlight {
+    position: fixed;
+    border-radius: 12px;
+    box-shadow: 
+        0 0 0 9999px rgba(0, 0, 0, 0.75),
+        0 0 32px rgba(88, 166, 255, 0.3);
+    transition: all 0.4s cubic-bezier(0.4, 0, 0.2, 1);
+    pointer-events: none;
+    z-index: 1;
+}
+
+/* Pulsing animation for spotlight */
+.tutorial-spotlight::before {
+    content: '';
+    position: absolute;
+    inset: -4px;
+    border-radius: 16px;
+    border: 2px solid rgba(88, 166, 255, 0.5);
+    animation: tutorial-pulse 2s ease-in-out infinite;
+}
+
+@keyframes tutorial-pulse {
+    0%, 100% { opacity: 0.5; transform: scale(1); }
+    50% { opacity: 1; transform: scale(1.02); }
+}
+
+/* ============ Tooltip ============ */
+
+.tutorial-tooltip {
+    position: fixed;
+    width: 360px;
+    max-width: calc(100vw - 32px);
+    background: rgba(22, 27, 34, 0.98);
+    backdrop-filter: blur(20px);
+    -webkit-backdrop-filter: blur(20px);
+    border: 1px solid rgba(48, 54, 61, 0.8);
+    border-radius: 16px;
+    box-shadow: 
+        0 16px 48px rgba(0, 0, 0, 0.4),
+        0 0 0 1px rgba(255, 255, 255, 0.05) inset;
+    z-index: 2;
+    animation: tutorial-tooltip-in 0.35s cubic-bezier(0.4, 0, 0.2, 1) forwards;
+    overflow: hidden;
+}
+
+@keyframes tutorial-tooltip-in {
+    from {
+        opacity: 0;
+        transform: translateY(16px) scale(0.96);
+    }
+    to {
+        opacity: 1;
+        transform: translateY(0) scale(1);
+    }
+}
+
+/* Tooltip Header */
+.tutorial-tooltip-header {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: 16px 20px 12px;
+    border-bottom: 1px solid rgba(48, 54, 61, 0.5);
+    background: linear-gradient(135deg, rgba(88, 166, 255, 0.08), transparent);
+}
+
+.tutorial-title {
+    font-size: 16px;
+    font-weight: 600;
+    color: #f0f6fc;
+    letter-spacing: -0.02em;
+}
+
+.tutorial-close {
+    width: 28px;
+    height: 28px;
+    border: none;
+    background: transparent;
+    color: #8b949e;
+    cursor: pointer;
+    border-radius: 8px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    transition: all 0.15s ease;
+}
+
+.tutorial-close:hover {
+    background: rgba(255, 255, 255, 0.08);
+    color: #c9d1d9;
+}
+
+.tutorial-close .material-icons {
+    font-size: 20px;
+}
+
+/* Tooltip Body */
+.tutorial-tooltip-body {
+    padding: 16px 20px;
+    font-size: 14px;
+    line-height: 1.6;
+    color: #c9d1d9;
+}
+
+/* Tooltip Footer */
+.tutorial-tooltip-footer {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: 12px 20px 16px;
+    border-top: 1px solid rgba(48, 54, 61, 0.3);
+    background: rgba(0, 0, 0, 0.15);
+}
+
+.tutorial-progress {
+    font-size: 12px;
+    color: #6e7681;
+    font-weight: 500;
+}
+
+.tutorial-actions {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+}
+
+/* Buttons */
+.tutorial-btn {
+    padding: 8px 16px;
+    border: none;
+    border-radius: 8px;
+    font-size: 13px;
+    font-weight: 500;
+    cursor: pointer;
+    transition: all 0.15s ease;
+    background: rgba(255, 255, 255, 0.06);
+    color: #8b949e;
+}
+
+.tutorial-btn:hover {
+    background: rgba(255, 255, 255, 0.1);
+    color: #c9d1d9;
+}
+
+.tutorial-btn-primary {
+    background: linear-gradient(135deg, #238636, #2ea043);
+    color: #ffffff;
+    box-shadow: 0 2px 8px rgba(46, 160, 67, 0.25);
+}
+
+.tutorial-btn-primary:hover {
+    background: linear-gradient(135deg, #2ea043, #3fb950);
+    box-shadow: 0 4px 12px rgba(46, 160, 67, 0.35);
+}
+
+.tutorial-skip {
+    background: transparent;
+    color: #6e7681;
+}
+
+.tutorial-skip:hover {
+    background: rgba(255, 255, 255, 0.04);
+    color: #8b949e;
+}
+
+/* ============ Mobile Responsive ============ */
+
+@media (max-width: 480px) {
+    .tutorial-tooltip {
+        width: calc(100vw - 24px);
+        left: 12px !important;
+        right: 12px !important;
+        bottom: 24px !important;
+        top: auto !important;
+        transform: none !important;
+    }
+    
+    .tutorial-spotlight {
+        display: none;
+    }
+    
+    .tutorial-tooltip-footer {
+        flex-direction: column;
+        gap: 12px;
+    }
+    
+    .tutorial-progress {
+        order: 2;
+    }
+    
+    .tutorial-actions {
+        order: 1;
+        width: 100%;
+        justify-content: flex-end;
+    }
+    
+    .tutorial-btn {
+        flex: 1;
+    }
+}
+
+/* ============ Foldable Phone Styles ============ */
+
+@media (screen-spanning: single-fold-vertical) {
+    .tutorial-tooltip {
+        max-width: 340px;
+    }
+}
+
+/* ============ Animations ============ */
+
+.tutorial-overlay.active .tutorial-tooltip {
+    animation: tutorial-tooltip-in 0.35s cubic-bezier(0.4, 0, 0.2, 1) forwards;
+}
+
+/* Step transition */
+.tutorial-tooltip.step-transition {
+    animation: tutorial-step-change 0.25s ease;
+}
+
+@keyframes tutorial-step-change {
+    0% { opacity: 1; transform: translateX(0); }
+    50% { opacity: 0; transform: translateX(-16px); }
+    51% { transform: translateX(16px); }
+    100% { opacity: 1; transform: translateX(0); }
+}
diff --git a/web-nodejs/public/js/activity.js b/web-nodejs/public/js/activity.js
new file mode 100644
index 00000000..a925ae26
--- /dev/null
+++ b/web-nodejs/public/js/activity.js
@@ -0,0 +1,191 @@
+/**
+ * BetterDesk Console - Activity Page Script
+ */
+
+(function () {
+    'use strict';
+
+    const _ = window.BetterDesk?.translations
+        ? (key) => {
+            const keys = key.split('.');
+            let val = window.BetterDesk.translations;
+            for (const k of keys) { val = val?.[k]; }
+            return val || key;
+        }
+        : (key) => key;
+
+    const csrfToken = window.BetterDesk?.csrfToken || '';
+
+    async function apiFetch(url, options = {}) {
+        const headers = { 'Content-Type': 'application/json' };
+        if (csrfToken) headers['x-csrf-token'] = csrfToken;
+        const resp = await fetch(url, { ...options, headers: { ...headers, ...options.headers } });
+        return resp.json();
+    }
+
+    function escapeHtml(str) {
+        if (!str) return '';
+        const div = document.createElement('div');
+        div.textContent = String(str);
+        return div.innerHTML;
+    }
+
+    function formatTimeAgo(dateStr) {
+        if (!dateStr) return '—';
+        const d = new Date(dateStr);
+        const diff = Math.floor((Date.now() - d) / 1000);
+        if (diff < 60) return _('time.seconds_ago').replace('{count}', diff);
+        if (diff < 3600) return _('time.minutes_ago').replace('{count}', Math.floor(diff / 60));
+        if (diff < 86400) return _('time.hours_ago').replace('{count}', Math.floor(diff / 3600));
+        if (diff < 2592000) return _('time.days_ago').replace('{count}', Math.floor(diff / 86400));
+        return d.toLocaleDateString();
+    }
+
+    function formatDuration(seconds) {
+        if (!seconds || seconds < 0) return '—';
+        const h = Math.floor(seconds / 3600);
+        const m = Math.floor((seconds % 3600) / 60);
+        const s = seconds % 60;
+        if (h > 0) return `${h}h ${m}m`;
+        if (m > 0) return `${m}m ${s}s`;
+        return `${s}s`;
+    }
+
+    function showToast(message, type) {
+        if (window.BetterDesk?.notify) { window.BetterDesk.notify(message, type); return; }
+        const container = document.getElementById('toast-container');
+        if (!container) return;
+        const toast = document.createElement('div');
+        toast.className = `toast toast-${type || 'info'}`;
+        toast.textContent = message;
+        container.appendChild(toast);
+        setTimeout(() => toast.remove(), 4000);
+    }
+
+    // ---- Modal close ----
+    document.querySelectorAll('.modal-close').forEach(btn => {
+        btn.addEventListener('click', () => {
+            const id = btn.dataset.modal;
+            if (id) document.getElementById(id).style.display = 'none';
+        });
+    });
+
+    // ---- Elements ----
+    const activityBody = document.getElementById('activity-body');
+    const searchInput = document.getElementById('activity-search');
+    const dateFrom = document.getElementById('activity-from');
+    const dateTo = document.getElementById('activity-to');
+    const refreshBtn = document.getElementById('activity-refresh-btn');
+
+    let allSessions = [];
+
+    // ---- Load ----
+    async function loadActivity() {
+        activityBody.innerHTML = `<tr class="loading-row"><td colspan="7">${_('common.loading')}</td></tr>`;
+        const params = new URLSearchParams();
+        if (dateFrom.value) params.set('from', dateFrom.value);
+        if (dateTo.value) params.set('to', dateTo.value);
+
+        try {
+            const data = await apiFetch(`/api/activity?${params}`);
+            allSessions = Array.isArray(data) ? data : (data.summaries || []);
+            filterAndRender();
+        } catch (err) {
+            activityBody.innerHTML = `<tr class="empty-row"><td colspan="7">
+                <div class="empty-state"><span class="material-icons">error_outline</span><p>${escapeHtml(err.message)}</p></div></td></tr>`;
+        }
+    }
+
+    function filterAndRender() {
+        const q = searchInput.value.toLowerCase();
+        const filtered = q
+            ? allSessions.filter(s => ((s.device_id || '') + (s.hostname || '')).toLowerCase().includes(q))
+            : allSessions;
+        renderActivity(filtered);
+    }
+
+    function renderActivity(sessions) {
+        if (!sessions.length) {
+            activityBody.innerHTML = `<tr class="empty-row"><td colspan="7">
+                <div class="empty-state"><span class="material-icons">history</span><p>${_('activity.no_activity')}</p></div></td></tr>`;
+            return;
+        }
+        activityBody.innerHTML = sessions.map(s => `
+            <tr>
+                <td>${escapeHtml(s.device_id)}</td>
+                <td>${escapeHtml(s.hostname || '—')}</td>
+                <td>${s.session_count || 0}</td>
+                <td class="duration-cell">${formatDuration(s.total_active_secs)}</td>
+                <td class="duration-cell">${formatDuration(s.idle_seconds)}</td>
+                <td class="time-cell">${formatTimeAgo(s.reported_at)}</td>
+                <td><button class="btn btn-sm btn-secondary detail-btn" data-id="${escapeHtml(s.device_id)}"><span class="material-icons" style="font-size:16px">visibility</span></button></td>
+            </tr>
+        `).join('');
+
+        activityBody.querySelectorAll('.detail-btn').forEach(btn => {
+            btn.addEventListener('click', () => showDetail(btn.dataset.id));
+        });
+    }
+
+    async function showDetail(deviceId) {
+        const modal = document.getElementById('detail-modal');
+        const sessionsList = document.getElementById('sessions-list');
+        const appsList = document.getElementById('apps-list');
+        modal.style.display = 'flex';
+        document.getElementById('detail-modal-title').textContent = `${_('activity.detail')} — ${deviceId}`;
+        sessionsList.innerHTML = `<p>${_('common.loading')}</p>`;
+        appsList.innerHTML = `<p>${_('common.loading')}</p>`;
+
+        try {
+            const [sessions, top] = await Promise.all([
+                apiFetch(`/api/activity/${deviceId}`),
+                apiFetch(`/api/activity/${deviceId}/top`)
+            ]);
+
+            // Sessions
+            const sesList = Array.isArray(sessions) ? sessions : (sessions.sessions || []);
+            if (!sesList.length) {
+                sessionsList.innerHTML = `<p class="text-muted">${_('activity.no_sessions')}</p>`;
+            } else {
+                sessionsList.innerHTML = sesList.map(s => `
+                    <div class="session-item">
+                        <span class="session-time">${formatTimeAgo(s.session_start)}</span>
+                        <span class="session-user">${escapeHtml(s.user || '—')}</span>
+                        <span class="session-dur">${formatDuration(s.duration_seconds)}</span>
+                    </div>
+                `).join('');
+            }
+
+            // Top apps
+            const appList = Array.isArray(top) ? top : (top.top_apps || []);
+            if (!appList.length) {
+                appsList.innerHTML = `<p class="text-muted">${_('activity.no_apps')}</p>`;
+            } else {
+                const maxTime = Math.max(...appList.map(a => a.total_seconds || 0), 1);
+                appsList.innerHTML = appList.map(a => {
+                    const pct = Math.round(((a.total_seconds || 0) / maxTime) * 100);
+                    return `
+                    <div class="app-item">
+                        <span class="app-name">${escapeHtml(a.name)}</span>
+                        <div class="app-bar-wrapper">
+                            <div class="app-bar"><div class="app-bar-fill" style="width:${pct}%"></div></div>
+                            <span class="app-time">${formatDuration(a.total_seconds)}</span>
+                        </div>
+                    </div>`;
+                }).join('');
+            }
+        } catch (err) {
+            sessionsList.innerHTML = `<p class="text-error">${escapeHtml(err.message)}</p>`;
+            appsList.innerHTML = '';
+        }
+    }
+
+    // ---- Events ----
+    searchInput.addEventListener('input', filterAndRender);
+    dateFrom.addEventListener('change', loadActivity);
+    dateTo.addEventListener('change', loadActivity);
+    refreshBtn.addEventListener('click', loadActivity);
+
+    // ---- Init ----
+    loadActivity();
+})();
diff --git a/web-nodejs/public/js/app.js b/web-nodejs/public/js/app.js
index a6965e28..1ad1d3cb 100644
--- a/web-nodejs/public/js/app.js
+++ b/web-nodejs/public/js/app.js
@@ -163,9 +163,18 @@
         const badge = document.getElementById('reg-sidebar-badge');
         if (!badge) return;
 
+        let badgeInterval = null;
+
         async function updateBadge() {
             try {
                 const resp = await fetch('/api/registrations/count');
+                if (!resp.ok) {
+                    if (resp.status === 401 && badgeInterval) {
+                        clearInterval(badgeInterval);
+                        badgeInterval = null;
+                    }
+                    return;
+                }
                 const data = await resp.json();
                 const count = data.count || 0;
                 badge.textContent = count;
@@ -174,7 +183,7 @@
         }
 
         updateBadge();
-        setInterval(updateBadge, 30000); // every 30s
+        badgeInterval = setInterval(updateBadge, 30000); // every 30s
     }
     
     /**
diff --git a/web-nodejs/public/js/automation.js b/web-nodejs/public/js/automation.js
new file mode 100644
index 00000000..abe58afd
--- /dev/null
+++ b/web-nodejs/public/js/automation.js
@@ -0,0 +1,368 @@
+/**
+ * BetterDesk Console - Automation Page Script
+ */
+
+(function () {
+    'use strict';
+
+    const _ = window.BetterDesk?.translations
+        ? (key) => {
+            const keys = key.split('.');
+            let val = window.BetterDesk.translations;
+            for (const k of keys) { val = val?.[k]; }
+            return val || key;
+        }
+        : (key) => key;
+
+    const csrfToken = window.BetterDesk?.csrfToken || '';
+
+    // ---- Tab switching ----
+
+    const tabBtns = document.querySelectorAll('.tab-btn');
+    const tabPanels = document.querySelectorAll('.tab-panel');
+
+    tabBtns.forEach(btn => {
+        btn.addEventListener('click', () => {
+            tabBtns.forEach(b => b.classList.remove('active'));
+            tabPanels.forEach(p => p.classList.remove('active'));
+            btn.classList.add('active');
+            const panel = document.getElementById('tab-' + btn.dataset.tab);
+            if (panel) panel.classList.add('active');
+
+            if (btn.dataset.tab === 'rules') loadRules();
+            else if (btn.dataset.tab === 'alerts') loadAlerts();
+            else if (btn.dataset.tab === 'commands') loadCommands();
+            else if (btn.dataset.tab === 'smtp') loadSmtp();
+        });
+    });
+
+    // ---- API ----
+
+    async function apiFetch(url, options = {}) {
+        const headers = { 'Content-Type': 'application/json' };
+        if (csrfToken) headers['x-csrf-token'] = csrfToken;
+        const resp = await fetch(url, { ...options, headers: { ...headers, ...options.headers } });
+        return resp.json();
+    }
+
+    // ==== RULES ====
+
+    const rulesBody = document.getElementById('rules-body');
+    const createRuleBtn = document.getElementById('create-rule-btn');
+    const ruleModal = document.getElementById('rule-modal');
+    const ruleForm = document.getElementById('rule-form');
+    const ruleSaveBtn = document.getElementById('rule-save-btn');
+
+    async function loadRules() {
+        rulesBody.innerHTML = `<tr class="loading-row"><td colspan="7">${_('common.loading')}</td></tr>`;
+        try {
+            const resp = await apiFetch('/api/automation/rules');
+            renderRules(Array.isArray(resp) ? resp : Array.isArray(resp.rules) ? resp.rules : []);
+        } catch (err) {
+            rulesBody.innerHTML = `<tr class="empty-row"><td colspan="7">
+                <div class="empty-state"><span class="material-icons">error_outline</span><p>${escapeHtml(err.message)}</p></div></td></tr>`;
+        }
+    }
+
+    function renderRules(rules) {
+        if (!rules.length) {
+            rulesBody.innerHTML = `<tr class="empty-row"><td colspan="7">
+                <div class="empty-state"><span class="material-icons">rule</span><p>${_('automation.no_rules')}</p></div></td></tr>`;
+            return;
+        }
+        rulesBody.innerHTML = rules.map(r => `
+            <tr data-id="${r.id}">
+                <td>${escapeHtml(r.name)}</td>
+                <td>${_('automation.type_' + r.condition_type) || r.condition_type}</td>
+                <td>${_('automation.op_' + r.condition_op) || r.condition_op}</td>
+                <td>${r.condition_value}</td>
+                <td><span class="severity-badge ${r.severity}">${_('automation.severity_' + r.severity) || r.severity}</span></td>
+                <td><span class="toggle-indicator ${r.enabled ? 'on' : 'off'}"></span></td>
+                <td class="action-btn-group">
+                    <button class="btn btn-sm btn-secondary edit-rule-btn" data-id="${r.id}"><span class="material-icons" style="font-size:16px">edit</span></button>
+                    <button class="btn btn-sm btn-danger del-rule-btn" data-id="${r.id}"><span class="material-icons" style="font-size:16px">delete</span></button>
+                </td>
+            </tr>
+        `).join('');
+
+        rulesBody.querySelectorAll('.edit-rule-btn').forEach(btn => btn.addEventListener('click', () => editRule(btn.dataset.id)));
+        rulesBody.querySelectorAll('.del-rule-btn').forEach(btn => btn.addEventListener('click', () => deleteRule(btn.dataset.id)));
+    }
+
+    function openRuleModal(rule) {
+        document.getElementById('rule-modal-title').textContent = rule ? _('automation.edit_rule') : _('automation.create_rule');
+        document.getElementById('rule-id').value = rule ? rule.id : '';
+        document.getElementById('rule-name').value = rule ? rule.name : '';
+        document.getElementById('rule-desc').value = rule ? rule.description || '' : '';
+        document.getElementById('rule-condition').value = rule ? rule.condition_type : 'cpu_usage';
+        document.getElementById('rule-operator').value = rule ? rule.condition_op : 'gt';
+        document.getElementById('rule-value').value = rule ? rule.condition_value : '';
+        document.getElementById('rule-severity').value = rule ? rule.severity : 'warning';
+        document.getElementById('rule-device').value = rule ? rule.scope_device_id || '' : '';
+        document.getElementById('rule-enabled').checked = rule ? !!rule.enabled : true;
+        ruleModal.style.display = 'flex';
+    }
+
+    async function editRule(id) {
+        try {
+            const rule = await apiFetch(`/api/automation/rules/${id}`);
+            openRuleModal(rule);
+        } catch (err) { showToast(err.message, 'error'); }
+    }
+
+    async function saveRule() {
+        const id = document.getElementById('rule-id').value;
+        const body = {
+            name: document.getElementById('rule-name').value.trim(),
+            description: document.getElementById('rule-desc').value.trim(),
+            condition_type: document.getElementById('rule-condition').value,
+            condition_op: document.getElementById('rule-operator').value,
+            condition_value: parseFloat(document.getElementById('rule-value').value) || 0,
+            severity: document.getElementById('rule-severity').value,
+            scope_device_id: document.getElementById('rule-device').value.trim() || null,
+            enabled: document.getElementById('rule-enabled').checked,
+        };
+
+        if (!body.name) { showToast(_('common.field_required').replace('{field}', _('automation.rule_name')), 'error'); return; }
+
+        try {
+            const url = id ? `/api/automation/rules/${id}` : '/api/automation/rules';
+            const method = id ? 'PATCH' : 'POST';
+            await apiFetch(url, { method, body: JSON.stringify(body) });
+            ruleModal.style.display = 'none';
+            showToast(_('common.saved'), 'success');
+            loadRules();
+        } catch (err) { showToast(err.message, 'error'); }
+    }
+
+    async function deleteRule(id) {
+        if (!confirm(_('automation.delete_rule') + '?')) return;
+        try {
+            await apiFetch(`/api/automation/rules/${id}`, { method: 'DELETE' });
+            showToast(_('common.success'), 'success');
+            loadRules();
+        } catch (err) { showToast(err.message, 'error'); }
+    }
+
+    createRuleBtn.addEventListener('click', () => openRuleModal(null));
+    ruleSaveBtn.addEventListener('click', saveRule);
+
+    // ==== ALERTS ====
+
+    const alertsBody = document.getElementById('alerts-body');
+    const severityFilter = document.getElementById('alert-severity-filter');
+
+    async function loadAlerts() {
+        alertsBody.innerHTML = `<tr class="loading-row"><td colspan="7">${_('common.loading')}</td></tr>`;
+        const params = new URLSearchParams();
+        const sev = severityFilter.value;
+        if (sev) params.set('severity', sev);
+
+        try {
+            const resp = await apiFetch(`/api/automation/alerts?${params}`);
+            renderAlerts(Array.isArray(resp) ? resp : Array.isArray(resp.alerts) ? resp.alerts : []);
+        } catch (err) {
+            alertsBody.innerHTML = `<tr class="empty-row"><td colspan="7">
+                <div class="empty-state"><span class="material-icons">error_outline</span><p>${escapeHtml(err.message)}</p></div></td></tr>`;
+        }
+    }
+
+    function renderAlerts(alerts) {
+        if (!alerts.length) {
+            alertsBody.innerHTML = `<tr class="empty-row"><td colspan="7">
+                <div class="empty-state"><span class="material-icons">notifications_none</span><p>${_('automation.no_alerts')}</p></div></td></tr>`;
+            return;
+        }
+        alertsBody.innerHTML = alerts.map(a => `
+            <tr>
+                <td><span class="severity-badge ${a.severity}">${_('automation.severity_' + a.severity) || a.severity}</span></td>
+                <td>${escapeHtml(a.rule_name || '—')}</td>
+                <td>${escapeHtml(a.device_id || '—')}</td>
+                <td>${a.measured_value != null ? a.measured_value : '—'}</td>
+                <td class="time-cell">${formatTimeAgo(a.triggered_at)}</td>
+                <td>${a.acknowledged_at ? '<span class="material-icons" style="color:var(--accent-green);font-size:18px">check_circle</span>' : '—'}</td>
+                <td>${!a.acknowledged_at ? `<button class="btn btn-sm btn-secondary ack-btn" data-id="${a.id}"><span class="material-icons" style="font-size:16px">check</span></button>` : ''}</td>
+            </tr>
+        `).join('');
+
+        alertsBody.querySelectorAll('.ack-btn').forEach(btn => {
+            btn.addEventListener('click', async () => {
+                try {
+                    await apiFetch(`/api/automation/alerts/${btn.dataset.id}/ack`, { method: 'POST' });
+                    loadAlerts();
+                } catch (err) { showToast(err.message, 'error'); }
+            });
+        });
+    }
+
+    severityFilter.addEventListener('change', loadAlerts);
+
+    // ==== COMMANDS ====
+
+    const commandsBody = document.getElementById('commands-body');
+    const sendCmdBtn = document.getElementById('send-command-btn');
+    const cmdModal = document.getElementById('cmd-modal');
+    const cmdSendBtn = document.getElementById('cmd-send-btn');
+    const resultModal = document.getElementById('result-modal');
+    const resultBody = document.getElementById('result-body');
+
+    async function loadCommands() {
+        commandsBody.innerHTML = `<tr class="loading-row"><td colspan="7">${_('common.loading')}</td></tr>`;
+        try {
+            const resp = await apiFetch('/api/automation/commands');
+            renderCommands(Array.isArray(resp) ? resp : Array.isArray(resp.commands) ? resp.commands : []);
+        } catch (err) {
+            commandsBody.innerHTML = `<tr class="empty-row"><td colspan="7">
+                <div class="empty-state"><span class="material-icons">error_outline</span><p>${escapeHtml(err.message)}</p></div></td></tr>`;
+        }
+    }
+
+    function renderCommands(cmds) {
+        if (!cmds.length) {
+            commandsBody.innerHTML = `<tr class="empty-row"><td colspan="7">
+                <div class="empty-state"><span class="material-icons">terminal</span><p>${_('automation.no_commands')}</p></div></td></tr>`;
+            return;
+        }
+        commandsBody.innerHTML = cmds.map(c => `
+            <tr>
+                <td>#${c.id}</td>
+                <td>${escapeHtml(c.device_id)}</td>
+                <td>${escapeHtml(c.command_type)}</td>
+                <td title="${escapeHtml(c.payload)}">${truncate(c.payload, 40)}</td>
+                <td><span class="cmd-status ${c.status}">${_('automation.status_' + c.status) || c.status}</span></td>
+                <td class="time-cell">${formatTimeAgo(c.created_at)}</td>
+                <td>${c.result ? `<button class="btn btn-sm btn-secondary result-btn" data-id="${c.id}"><span class="material-icons" style="font-size:16px">article</span></button>` : '—'}</td>
+            </tr>
+        `).join('');
+
+        commandsBody.querySelectorAll('.result-btn').forEach(btn => {
+            btn.addEventListener('click', () => viewResult(btn.dataset.id));
+        });
+    }
+
+    async function viewResult(id) {
+        resultModal.style.display = 'flex';
+        resultBody.innerHTML = `<p>${_('common.loading')}</p>`;
+        try {
+            const cmd = await apiFetch(`/api/automation/commands/${id}`);
+            resultBody.innerHTML = `
+                <div class="detail-grid" style="margin-bottom:16px">
+                    <div class="detail-item"><span class="detail-label">${_('inventory.device_id')}</span><span class="detail-value">${escapeHtml(cmd.device_id)}</span></div>
+                    <div class="detail-item"><span class="detail-label">${_('automation.command_type')}</span><span class="detail-value">${escapeHtml(cmd.command_type)}</span></div>
+                    <div class="detail-item"><span class="detail-label">${_('automation.command_status')}</span><span class="cmd-status ${cmd.status}">${_('automation.status_' + cmd.status)}</span></div>
+                </div>
+                <h4>${_('automation.command_payload')}</h4>
+                <div class="result-output">${escapeHtml(cmd.payload)}</div>
+                <h4 style="margin-top:16px">${_('automation.command_result')}</h4>
+                <div class="result-output">${escapeHtml(cmd.result || '—')}</div>`;
+        } catch (err) {
+            resultBody.innerHTML = `<p class="text-error">${escapeHtml(err.message)}</p>`;
+        }
+    }
+
+    async function sendCommand() {
+        const body = {
+            device_id: document.getElementById('cmd-device').value.trim(),
+            command_type: document.getElementById('cmd-type').value,
+            payload: document.getElementById('cmd-payload').value.trim(),
+        };
+
+        if (!body.device_id || !body.payload) {
+            showToast(_('automation.id_payload_required'), 'error');
+            return;
+        }
+
+        try {
+            await apiFetch('/api/automation/commands', { method: 'POST', body: JSON.stringify(body) });
+            cmdModal.style.display = 'none';
+            showToast(_('common.success'), 'success');
+            loadCommands();
+        } catch (err) { showToast(err.message, 'error'); }
+    }
+
+    sendCmdBtn.addEventListener('click', () => { cmdModal.style.display = 'flex'; });
+    cmdSendBtn.addEventListener('click', sendCommand);
+
+    // ==== SMTP ====
+
+    async function loadSmtp() {
+        try {
+            const config = await apiFetch('/api/automation/smtp');
+            document.getElementById('smtp-host').value = config.host || '';
+            document.getElementById('smtp-port').value = config.port || 587;
+            document.getElementById('smtp-secure').checked = !!config.secure;
+            document.getElementById('smtp-user').value = config.user || '';
+            document.getElementById('smtp-from').value = config.from || '';
+        } catch (_e) { /* smtp not configured yet */ }
+    }
+
+    document.getElementById('smtp-save-btn').addEventListener('click', async () => {
+        const body = {
+            host: document.getElementById('smtp-host').value.trim(),
+            port: parseInt(document.getElementById('smtp-port').value, 10) || 587,
+            secure: document.getElementById('smtp-secure').checked,
+            user: document.getElementById('smtp-user').value.trim(),
+            pass: document.getElementById('smtp-pass').value,
+            from: document.getElementById('smtp-from').value.trim(),
+        };
+        try {
+            await apiFetch('/api/automation/smtp', { method: 'PUT', body: JSON.stringify(body) });
+            showToast(_('common.saved'), 'success');
+        } catch (err) { showToast(err.message, 'error'); }
+    });
+
+    document.getElementById('smtp-test-btn').addEventListener('click', async () => {
+        try {
+            const result = await apiFetch('/api/automation/smtp/test', { method: 'POST' });
+            showToast(result.success ? _('automation.smtp_test_success') : _('automation.smtp_test_failed'), result.success ? 'success' : 'error');
+        } catch (err) { showToast(_('automation.smtp_test_failed'), 'error'); }
+    });
+
+    // ---- Helpers ----
+
+    function escapeHtml(str) {
+        if (!str) return '';
+        const div = document.createElement('div');
+        div.textContent = String(str);
+        return div.innerHTML;
+    }
+
+    function truncate(str, max) {
+        if (!str) return '';
+        return str.length > max ? str.slice(0, max) + '…' : str;
+    }
+
+    function formatTimeAgo(dateStr) {
+        if (!dateStr) return '—';
+        const d = new Date(dateStr);
+        const diff = Math.floor((Date.now() - d) / 1000);
+        if (diff < 60) return _('time.seconds_ago').replace('{count}', diff);
+        if (diff < 3600) return _('time.minutes_ago').replace('{count}', Math.floor(diff / 60));
+        if (diff < 86400) return _('time.hours_ago').replace('{count}', Math.floor(diff / 3600));
+        if (diff < 2592000) return _('time.days_ago').replace('{count}', Math.floor(diff / 86400));
+        return d.toLocaleDateString();
+    }
+
+    function showToast(message, type) {
+        if (window.BetterDesk?.notify) { window.BetterDesk.notify(message, type); return; }
+        const container = document.getElementById('toast-container');
+        if (!container) return;
+        const toast = document.createElement('div');
+        toast.className = `toast toast-${type || 'info'}`;
+        toast.textContent = message;
+        container.appendChild(toast);
+        setTimeout(() => toast.remove(), 4000);
+    }
+
+    // ---- Modal close ----
+
+    document.querySelectorAll('.modal-close').forEach(btn => {
+        btn.addEventListener('click', () => {
+            const modalId = btn.dataset.modal;
+            if (modalId) document.getElementById(modalId).style.display = 'none';
+        });
+    });
+
+    // ---- Init ----
+    loadRules();
+})();
diff --git a/web-nodejs/public/js/cdap-audio.js b/web-nodejs/public/js/cdap-audio.js
new file mode 100644
index 00000000..acd2a869
--- /dev/null
+++ b/web-nodejs/public/js/cdap-audio.js
@@ -0,0 +1,378 @@
+/**
+ * BetterDesk Console — CDAP Audio Stream Widget
+ * Provides bidirectional audio streaming from CDAP devices via WebSocket.
+ * Decodes Opus/PCM audio and renders using Web Audio API.
+ */
+
+(function () {
+    'use strict';
+
+    const activeSessions = {};
+
+    const DEFAULT_SAMPLE_RATE = 48000;
+    const DEFAULT_CHANNELS = 1;
+    const DEFAULT_CODEC = 'opus';
+    const BUFFER_SIZE = 4096;
+
+    // ── Audio Session Manager ────────────────────────────────────────────
+
+    function openAudio(deviceId, widgetId, opts) {
+        const key = `${deviceId}:${widgetId}`;
+        if (activeSessions[key]) return;
+
+        opts = opts || {};
+        const codec = opts.codec || DEFAULT_CODEC;
+        const sampleRate = opts.sampleRate || DEFAULT_SAMPLE_RATE;
+        const channels = opts.channels || DEFAULT_CHANNELS;
+        const direction = opts.direction || 'receive'; // receive | send | bidirectional
+
+        const widgetEl = document.getElementById(`wval-${CSS.escape(widgetId)}`);
+        if (!widgetEl) return;
+
+        const statusEl = widgetEl.querySelector('.cdap-audio-status');
+        const levelBar = widgetEl.querySelector('.cdap-audio-level-fill');
+
+        if (statusEl) {
+            statusEl.textContent = window.BetterDesk?.t?.('cdap.audio_connecting') || 'Connecting...';
+            statusEl.className = 'cdap-audio-status connecting';
+        }
+
+        // Open WebSocket
+        const proto = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
+        const wsUrl = `${proto}//${window.location.host}/api/cdap/devices/${encodeURIComponent(deviceId)}/audio`;
+        let ws;
+        try {
+            ws = new WebSocket(wsUrl, ['cdap-audio']);
+        } catch (err) {
+            console.error('[CDAPAudio] WS creation failed:', err);
+            return;
+        }
+
+        const session = {
+            ws,
+            widgetEl,
+            widgetId,
+            deviceId,
+            sessionId: null,
+            connected: false,
+            codec,
+            sampleRate,
+            channels,
+            direction,
+            statusEl,
+            levelBar,
+            audioCtx: null,
+            gainNode: null,
+            _muted: false,
+            _volume: 1.0,
+            _frameCount: 0,
+            _level: 0,
+            _levelTimer: null,
+            _micStream: null,
+            _micProcessor: null
+        };
+        activeSessions[key] = session;
+
+        ws.onopen = () => {
+            ws.send(JSON.stringify({
+                codec: codec,
+                sample_rate: sampleRate,
+                channels: channels,
+                direction: direction
+            }));
+        };
+
+        ws.onmessage = (event) => {
+            try {
+                const msg = JSON.parse(event.data);
+                handleMessage(session, msg);
+            } catch (_) {}
+        };
+
+        ws.onerror = () => {
+            console.error('[CDAPAudio] WS error for', deviceId);
+        };
+
+        ws.onclose = () => {
+            if (activeSessions[key]) {
+                setDisconnected(session);
+                delete activeSessions[key];
+            }
+        };
+    }
+
+    function handleMessage(session, msg) {
+        switch (msg.type) {
+            case 'ready':
+                session.sessionId = msg.session_id;
+                session.connected = true;
+                initAudioContext(session);
+                if (session.statusEl) {
+                    session.statusEl.textContent = window.BetterDesk?.t?.('cdap.audio_streaming') || 'Streaming';
+                    session.statusEl.className = 'cdap-audio-status streaming';
+                }
+                // Start level meter
+                session._levelTimer = setInterval(() => updateLevelMeter(session), 100);
+                break;
+
+            case 'audio_frame':
+                decodeAndPlay(session, msg);
+                break;
+
+            case 'error':
+                console.error('[CDAPAudio] Error:', msg.error);
+                break;
+
+            case 'end':
+                setDisconnected(session);
+                closeAudio(session.deviceId, session.widgetId);
+                break;
+        }
+    }
+
+    // ── Web Audio Context ────────────────────────────────────────────────
+
+    function initAudioContext(session) {
+        try {
+            const AudioContext = window.AudioContext || window.webkitAudioContext;
+            session.audioCtx = new AudioContext({ sampleRate: session.sampleRate });
+            session.gainNode = session.audioCtx.createGain();
+            session.gainNode.gain.value = session._volume;
+            session.gainNode.connect(session.audioCtx.destination);
+
+            // Resume AudioContext on user gesture (Chrome autoplay policy)
+            if (session.audioCtx.state === 'suspended') {
+                session.audioCtx.resume();
+            }
+
+            // Start microphone if bidirectional
+            if (session.direction === 'bidirectional' || session.direction === 'send') {
+                initMicrophone(session);
+            }
+        } catch (err) {
+            console.error('[CDAPAudio] AudioContext init failed:', err);
+        }
+    }
+
+    function decodeAndPlay(session, msg) {
+        if (!session.audioCtx || !msg.data) return;
+
+        session._frameCount++;
+
+        try {
+            const raw = atob(msg.data);
+            const bytes = new Uint8Array(raw.length);
+            for (let i = 0; i < raw.length; i++) {
+                bytes[i] = raw.charCodeAt(i);
+            }
+
+            if (msg.codec === 'pcm' || session.codec === 'pcm') {
+                playPCMFrame(session, bytes);
+            } else {
+                // Opus or other encoded format — use decodeAudioData
+                const buffer = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+                session.audioCtx.decodeAudioData(buffer).then(audioBuffer => {
+                    playAudioBuffer(session, audioBuffer);
+                }).catch(() => {
+                    // Fallback: treat as raw PCM if decode fails
+                    playPCMFrame(session, bytes);
+                });
+            }
+        } catch (err) {
+            // Ignore corrupt frames
+        }
+    }
+
+    function playPCMFrame(session, bytes) {
+        const { audioCtx, gainNode, channels, sampleRate } = session;
+        if (!audioCtx) return;
+
+        // Assume 16-bit signed PCM
+        const samples = bytes.length / 2;
+        const numFrames = Math.floor(samples / channels);
+        if (numFrames <= 0) return;
+
+        const audioBuffer = audioCtx.createBuffer(channels, numFrames, sampleRate);
+
+        for (let ch = 0; ch < channels; ch++) {
+            const channelData = audioBuffer.getChannelData(ch);
+            for (let i = 0; i < numFrames; i++) {
+                const idx = (i * channels + ch) * 2;
+                if (idx + 1 >= bytes.length) break;
+                const sample = (bytes[idx] | (bytes[idx + 1] << 8));
+                // Convert signed 16-bit to float32 [-1, 1]
+                channelData[i] = (sample > 32767 ? sample - 65536 : sample) / 32768;
+            }
+        }
+
+        // Track audio level for meter
+        const data = audioBuffer.getChannelData(0);
+        let sum = 0;
+        for (let i = 0; i < data.length; i++) sum += data[i] * data[i];
+        session._level = Math.sqrt(sum / data.length);
+
+        playAudioBuffer(session, audioBuffer);
+    }
+
+    function playAudioBuffer(session, audioBuffer) {
+        if (!session.audioCtx || session._muted) return;
+
+        const source = session.audioCtx.createBufferSource();
+        source.buffer = audioBuffer;
+        source.connect(session.gainNode);
+        source.start();
+    }
+
+    // ── Microphone Input ─────────────────────────────────────────────────
+
+    function initMicrophone(session) {
+        if (!navigator.mediaDevices || !navigator.mediaDevices.getUserMedia) {
+            console.warn('[CDAPAudio] getUserMedia not available');
+            return;
+        }
+
+        navigator.mediaDevices.getUserMedia({
+            audio: {
+                sampleRate: session.sampleRate,
+                channelCount: session.channels,
+                echoCancellation: true,
+                noiseSuppression: true
+            }
+        }).then(stream => {
+            session._micStream = stream;
+            const source = session.audioCtx.createMediaStreamSource(stream);
+
+            // Use ScriptProcessorNode (wide compatibility)
+            const processor = session.audioCtx.createScriptProcessor(BUFFER_SIZE, session.channels, session.channels);
+            session._micProcessor = processor;
+
+            processor.onaudioprocess = (e) => {
+                if (!session.connected || session._muted) return;
+                const inputData = e.inputBuffer.getChannelData(0);
+
+                // Convert float32 to 16-bit PCM
+                const pcm = new Int16Array(inputData.length);
+                for (let i = 0; i < inputData.length; i++) {
+                    pcm[i] = Math.max(-32768, Math.min(32767, Math.round(inputData[i] * 32768)));
+                }
+
+                // Encode to base64
+                const bytes = new Uint8Array(pcm.buffer);
+                let binary = '';
+                for (let i = 0; i < bytes.length; i++) {
+                    binary += String.fromCharCode(bytes[i]);
+                }
+                const b64 = btoa(binary);
+
+                // Send as audio_input
+                if (session.ws && session.ws.readyState === WebSocket.OPEN) {
+                    session.ws.send(JSON.stringify({
+                        type: 'audio_input',
+                        codec: 'pcm',
+                        data: b64,
+                        timestamp: Date.now()
+                    }));
+                }
+            };
+
+            source.connect(processor);
+            processor.connect(session.audioCtx.destination);
+        }).catch(err => {
+            console.warn('[CDAPAudio] Microphone access denied:', err.message);
+        });
+    }
+
+    // ── Controls ─────────────────────────────────────────────────────────
+
+    function setVolume(deviceId, widgetId, volume) {
+        const session = activeSessions[`${deviceId}:${widgetId}`];
+        if (!session) return;
+        session._volume = Math.max(0, Math.min(1, volume));
+        if (session.gainNode) {
+            session.gainNode.gain.value = session._volume;
+        }
+    }
+
+    function toggleMute(deviceId, widgetId) {
+        const session = activeSessions[`${deviceId}:${widgetId}`];
+        if (!session) return;
+        session._muted = !session._muted;
+        if (session.gainNode) {
+            session.gainNode.gain.value = session._muted ? 0 : session._volume;
+        }
+        return session._muted;
+    }
+
+    function updateLevelMeter(session) {
+        if (!session.levelBar) return;
+        const pct = Math.min(100, Math.round(session._level * 300));
+        session.levelBar.style.width = pct + '%';
+        if (pct > 80) {
+            session.levelBar.className = 'cdap-audio-level-fill high';
+        } else if (pct > 40) {
+            session.levelBar.className = 'cdap-audio-level-fill medium';
+        } else {
+            session.levelBar.className = 'cdap-audio-level-fill low';
+        }
+    }
+
+    // ── Disconnect / Cleanup ─────────────────────────────────────────────
+
+    function setDisconnected(session) {
+        session.connected = false;
+        if (session._levelTimer) {
+            clearInterval(session._levelTimer);
+            session._levelTimer = null;
+        }
+        if (session._micProcessor) {
+            session._micProcessor.disconnect();
+            session._micProcessor = null;
+        }
+        if (session._micStream) {
+            session._micStream.getTracks().forEach(t => t.stop());
+            session._micStream = null;
+        }
+        if (session.audioCtx && session.audioCtx.state !== 'closed') {
+            session.audioCtx.close().catch(() => {});
+            session.audioCtx = null;
+        }
+        if (session.statusEl) {
+            session.statusEl.textContent = window.BetterDesk?.t?.('cdap.disconnected') || 'Disconnected';
+            session.statusEl.className = 'cdap-audio-status disconnected';
+        }
+        if (session.levelBar) {
+            session.levelBar.style.width = '0%';
+        }
+        // Show connect button again
+        const connectDiv = session.widgetEl?.querySelector('.cdap-audio-connect');
+        if (connectDiv) connectDiv.classList.remove('hidden');
+    }
+
+    function closeAudio(deviceId, widgetId) {
+        const key = `${deviceId}:${widgetId}`;
+        const session = activeSessions[key];
+        if (!session) return;
+
+        if (session.ws && session.ws.readyState === WebSocket.OPEN) {
+            session.ws.send(JSON.stringify({ type: 'close' }));
+            session.ws.close();
+        }
+        setDisconnected(session);
+        delete activeSessions[key];
+    }
+
+    // ── Public API ───────────────────────────────────────────────────────
+
+    window.CDAPAudio = {
+        open: openAudio,
+        close: closeAudio,
+        isActive: (deviceId, widgetId) => !!activeSessions[`${deviceId}:${widgetId}`],
+        setVolume: setVolume,
+        toggleMute: toggleMute,
+        isMuted: (deviceId, widgetId) => {
+            const s = activeSessions[`${deviceId}:${widgetId}`];
+            return s ? s._muted : false;
+        }
+    };
+
+})();
diff --git a/web-nodejs/public/js/cdap-desktop.js b/web-nodejs/public/js/cdap-desktop.js
new file mode 100644
index 00000000..0c06cf23
--- /dev/null
+++ b/web-nodejs/public/js/cdap-desktop.js
@@ -0,0 +1,607 @@
+/**
+ * BetterDesk Console — CDAP Remote Desktop Widget
+ * Provides interactive remote desktop access to CDAP devices via WebSocket.
+ * Renders screen frames on canvas and relays mouse/keyboard input.
+ * Supports: clipboard sync, custom cursors, quality reporting, codec
+ * negotiation, multi-monitor selection, and keyframe requests.
+ */
+
+(function () {
+    'use strict';
+
+    const activeSessions = {};
+
+    // ── Mouse encoding (matching RustDesk mask format) ───────────────────
+
+    const MOUSE_TYPE_DOWN  = 1;
+    const MOUSE_TYPE_UP    = 2;
+    const MOUSE_TYPE_MOVE  = 0;
+    const MOUSE_TYPE_WHEEL = 3;
+
+    const MOUSE_BUTTON_LEFT   = 1;
+    const MOUSE_BUTTON_RIGHT  = 2;
+    const MOUSE_BUTTON_MIDDLE = 4;
+
+    // Quality reporting interval (ms)
+    const QUALITY_REPORT_INTERVAL = 5000;
+    // Cursor cache limit
+    const CURSOR_CACHE_MAX = 50;
+
+    // ── Desktop Session Manager ──────────────────────────────────────────
+
+    function openDesktop(deviceId, widgetId) {
+        const key = `${deviceId}:${widgetId}`;
+        if (activeSessions[key]) return;
+
+        const widgetEl = document.getElementById(`wval-${CSS.escape(widgetId)}`);
+        if (!widgetEl) return;
+
+        const canvas = widgetEl.querySelector('.cdap-desktop-canvas');
+        const overlay = widgetEl.querySelector('.cdap-desktop-overlay');
+        if (!canvas) return;
+
+        const ctx = canvas.getContext('2d');
+
+        // Show connecting state
+        if (overlay) {
+            overlay.querySelector('span:last-child').textContent = 'Connecting...';
+        }
+
+        // Open WebSocket
+        const proto = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
+        const wsUrl = `${proto}//${window.location.host}/api/cdap/devices/${encodeURIComponent(deviceId)}/desktop`;
+        let ws;
+        try {
+            ws = new WebSocket(wsUrl, ['cdap-desktop']);
+        } catch (err) {
+            console.error('[CDAPDesktop] WS creation failed:', err);
+            return;
+        }
+
+        const session = {
+            ws,
+            canvas,
+            ctx,
+            overlay,
+            widgetEl,
+            widgetId,
+            deviceId,
+            sessionId: null,
+            connected: false,
+            width: 1280,
+            height: 720,
+            _frameImg: new Image(),
+            // Quality reporting
+            _frameCount: 0,
+            _frameBytes: 0,
+            _lastFrameTime: 0,
+            _droppedFrames: 0,
+            _qualityTimer: null,
+            // Custom cursor
+            _cursorCache: {},
+            _cursorCacheKeys: [],
+            // Monitor list
+            _monitors: [],
+            _activeMonitor: 0,
+            // Codec
+            _videoCodec: null,
+            _audioCodec: null,
+            // Clipboard
+            _clipboardEnabled: true
+        };
+        activeSessions[key] = session;
+
+        ws.onopen = () => {
+            // Send init message with desired resolution
+            ws.send(JSON.stringify({
+                width: session.width,
+                height: session.height,
+                quality: 70,
+                fps: 15
+            }));
+        };
+
+        ws.onmessage = (event) => {
+            try {
+                const msg = JSON.parse(event.data);
+                handleMessage(session, msg);
+            } catch (_) {
+                // Ignore non-JSON
+            }
+        };
+
+        ws.onerror = () => {
+            console.error('[CDAPDesktop] WS error for', deviceId);
+        };
+
+        ws.onclose = () => {
+            if (activeSessions[key]) {
+                setDisconnected(session);
+                delete activeSessions[key];
+            }
+        };
+
+        // Bind input events
+        bindInputEvents(session);
+    }
+
+    function handleMessage(session, msg) {
+        switch (msg.type) {
+            case 'ready':
+                session.sessionId = msg.session_id;
+                session.connected = true;
+                // Hide overlay
+                if (session.overlay) {
+                    session.overlay.classList.add('hidden');
+                }
+                // Start quality reporting
+                startQualityReporting(session);
+                // Send codec offer
+                sendCodecOffer(session);
+                break;
+
+            case 'frame':
+                renderFrame(session, msg);
+                break;
+
+            case 'cursor_update':
+                applyCursor(session, msg);
+                break;
+
+            case 'clipboard_update':
+                handleClipboardUpdate(session, msg);
+                break;
+
+            case 'codec_answer':
+                session._videoCodec = msg.video_codec || null;
+                session._audioCodec = msg.audio_codec || null;
+                break;
+
+            case 'monitor_list':
+                handleMonitorList(session, msg);
+                break;
+
+            case 'quality_adjust':
+                // Server-initiated quality change — informational only
+                break;
+
+            case 'error':
+                console.error('[CDAPDesktop] Error:', msg.error);
+                break;
+
+            case 'end':
+                setDisconnected(session);
+                closeDesktop(session.deviceId, session.widgetId);
+                break;
+        }
+    }
+
+    // ── Frame Rendering ──────────────────────────────────────────────────
+
+    function renderFrame(session, msg) {
+        if (!msg.data) return;
+
+        const { canvas, ctx, _frameImg } = session;
+        const format = msg.format || 'jpeg';
+
+        // Track quality stats
+        session._frameCount++;
+        session._frameBytes += msg.data.length * 0.75; // approximate decoded size
+        session._lastFrameTime = Date.now();
+
+        // Resize canvas if frame dimensions changed
+        if (msg.width && msg.height) {
+            if (canvas.width !== msg.width || canvas.height !== msg.height) {
+                canvas.width = msg.width;
+                canvas.height = msg.height;
+            }
+        }
+
+        // Render base64-encoded frame
+        const src = `data:image/${format};base64,${msg.data}`;
+        const img = _frameImg;
+        img.onload = () => {
+            ctx.drawImage(img, 0, 0, canvas.width, canvas.height);
+        };
+        img.onerror = () => {
+            session._droppedFrames++;
+        };
+        img.src = src;
+    }
+
+    // ── Custom Cursor ────────────────────────────────────────────────────
+
+    function applyCursor(session, msg) {
+        const { canvas } = session;
+
+        // Hidden cursor
+        if (msg.hidden) {
+            canvas.style.cursor = 'none';
+            return;
+        }
+
+        // Check cache
+        if (msg.cursor_id && session._cursorCache[msg.cursor_id]) {
+            canvas.style.cursor = session._cursorCache[msg.cursor_id];
+            return;
+        }
+
+        if (!msg.data || !msg.width || !msg.height) {
+            canvas.style.cursor = 'default';
+            return;
+        }
+
+        const hotX = msg.hotspot_x || 0;
+        const hotY = msg.hotspot_y || 0;
+        const format = msg.format || 'png';
+
+        if (format === 'png') {
+            const cursorUrl = `url(data:image/png;base64,${msg.data}) ${hotX} ${hotY}, auto`;
+            canvas.style.cursor = cursorUrl;
+            cacheCursor(session, msg.cursor_id, cursorUrl);
+        } else if (format === 'rgba') {
+            // Convert raw RGBA to canvas → PNG data URL
+            try {
+                const w = msg.width;
+                const h = msg.height;
+                const raw = atob(msg.data);
+                if (raw.length !== w * h * 4) {
+                    canvas.style.cursor = 'default';
+                    return;
+                }
+                const bytes = new Uint8ClampedArray(raw.length);
+                for (let i = 0; i < raw.length; i++) bytes[i] = raw.charCodeAt(i);
+                const imgData = new ImageData(bytes, w, h);
+                const tmpCanvas = document.createElement('canvas');
+                tmpCanvas.width = w;
+                tmpCanvas.height = h;
+                tmpCanvas.getContext('2d').putImageData(imgData, 0, 0);
+                const dataUrl = tmpCanvas.toDataURL('image/png');
+                const cursorUrl = `url(${dataUrl}) ${hotX} ${hotY}, auto`;
+                canvas.style.cursor = cursorUrl;
+                cacheCursor(session, msg.cursor_id, cursorUrl);
+            } catch (_) {
+                canvas.style.cursor = 'default';
+            }
+        }
+    }
+
+    function cacheCursor(session, cursorId, cursorUrl) {
+        if (!cursorId) return;
+        session._cursorCache[cursorId] = cursorUrl;
+        session._cursorCacheKeys.push(cursorId);
+        // Evict old entries
+        while (session._cursorCacheKeys.length > CURSOR_CACHE_MAX) {
+            const old = session._cursorCacheKeys.shift();
+            delete session._cursorCache[old];
+        }
+    }
+
+    // ── Clipboard Sync ───────────────────────────────────────────────────
+
+    function handleClipboardUpdate(session, msg) {
+        if (!session._clipboardEnabled || !msg.data) return;
+
+        // Write to browser clipboard if Clipboard API available
+        if (navigator.clipboard && navigator.clipboard.writeText && msg.format === 'text') {
+            navigator.clipboard.writeText(msg.data).catch(() => {
+                // Permission denied or not focused
+            });
+        }
+
+        // Show clipboard indicator
+        showClipboardIndicator(session, 'in');
+    }
+
+    function sendClipboard(session, text) {
+        if (!session.connected || !session._clipboardEnabled || !text) return;
+        sendMsg(session, {
+            type: 'clipboard_set',
+            format: 'text',
+            data: text
+        });
+        showClipboardIndicator(session, 'out');
+    }
+
+    function showClipboardIndicator(session, direction) {
+        const indicator = session.widgetEl?.querySelector('.cdap-desktop-clipboard-indicator');
+        if (!indicator) return;
+        indicator.classList.remove('hidden', 'clip-in', 'clip-out');
+        indicator.classList.add(direction === 'in' ? 'clip-in' : 'clip-out');
+        indicator.textContent = direction === 'in' ? '\u2193 Clipboard' : '\u2191 Clipboard';
+        setTimeout(() => indicator.classList.add('hidden'), 1500);
+    }
+
+    // ── Quality Reporting ────────────────────────────────────────────────
+
+    function startQualityReporting(session) {
+        if (session._qualityTimer) clearInterval(session._qualityTimer);
+        session._qrPrevFrames = 0;
+        session._qrPrevBytes = 0;
+        session._qrPrevDropped = 0;
+        session._qrPrevTime = Date.now();
+
+        session._qualityTimer = setInterval(() => sendQualityReport(session), QUALITY_REPORT_INTERVAL);
+    }
+
+    function sendQualityReport(session) {
+        if (!session.connected || !session.sessionId) return;
+
+        const now = Date.now();
+        const elapsed = (now - session._qrPrevTime) / 1000;
+        if (elapsed <= 0) return;
+
+        const frames = session._frameCount - session._qrPrevFrames;
+        const bytes = session._frameBytes - session._qrPrevBytes;
+        const dropped = session._droppedFrames - session._qrPrevDropped;
+        const fps = Math.round(frames / elapsed);
+        const bandwidthKB = bytes / 1024 / elapsed;
+        const frameLoss = frames > 0 ? dropped / (frames + dropped) : 0;
+
+        // Estimate latency from frame timestamps (rough)
+        const latencyMs = session._lastFrameTime > 0
+            ? Math.max(0, now - session._lastFrameTime)
+            : 0;
+
+        sendMsg(session, {
+            type: 'quality_report',
+            session_id: session.sessionId,
+            bandwidth_kb: Math.round(bandwidthKB * 10) / 10,
+            latency_ms: latencyMs,
+            frame_loss: Math.round(frameLoss * 1000) / 1000,
+            fps: fps
+        });
+
+        session._qrPrevFrames = session._frameCount;
+        session._qrPrevBytes = session._frameBytes;
+        session._qrPrevDropped = session._droppedFrames;
+        session._qrPrevTime = now;
+    }
+
+    // ── Codec Negotiation ────────────────────────────────────────────────
+
+    function sendCodecOffer(session) {
+        if (!session.sessionId) return;
+        sendMsg(session, {
+            type: 'codec_offer',
+            session_id: session.sessionId,
+            video: ['jpeg', 'png'],
+            audio: ['opus', 'pcm'],
+            preferred: 'jpeg'
+        });
+    }
+
+    // ── Multi-Monitor ────────────────────────────────────────────────────
+
+    function handleMonitorList(session, msg) {
+        session._monitors = msg.monitors || [];
+        session._activeMonitor = typeof msg.active === 'number' ? msg.active : 0;
+
+        // Render monitor selector in toolbar
+        const toolbar = session.widgetEl?.querySelector('.cdap-desktop-toolbar');
+        if (!toolbar || session._monitors.length <= 1) return;
+
+        let selectorEl = toolbar.querySelector('.cdap-monitor-selector');
+        if (!selectorEl) {
+            selectorEl = document.createElement('div');
+            selectorEl.className = 'cdap-monitor-selector';
+            toolbar.appendChild(selectorEl);
+        }
+
+        let html = '<span class="material-icons">monitor</span><select class="cdap-monitor-select">';
+        for (const mon of session._monitors) {
+            const label = mon.name || `Monitor ${mon.index + 1}`;
+            const dims = `${mon.width}x${mon.height}`;
+            const primary = mon.primary ? ' *' : '';
+            const selected = mon.index === session._activeMonitor ? ' selected' : '';
+            html += `<option value="${mon.index}"${selected}>${label} (${dims})${primary}</option>`;
+        }
+        html += '</select>';
+        selectorEl.innerHTML = html;
+
+        // Bind change event
+        const select = selectorEl.querySelector('select');
+        select.addEventListener('change', () => {
+            const idx = parseInt(select.value, 10);
+            selectMonitor(session, idx);
+        });
+    }
+
+    function selectMonitor(session, index) {
+        if (!session.connected || !session.sessionId) return;
+        session._activeMonitor = index;
+        sendMsg(session, {
+            type: 'monitor_select',
+            session_id: session.sessionId,
+            index: index
+        });
+    }
+
+    // ── Keyframe Request ─────────────────────────────────────────────────
+
+    function requestKeyframe(deviceId, widgetId) {
+        const key = `${deviceId}:${widgetId}`;
+        const session = activeSessions[key];
+        if (!session || !session.connected || !session.sessionId) return;
+        sendMsg(session, {
+            type: 'keyframe_request',
+            session_id: session.sessionId
+        });
+    }
+
+    // ── Input Events ─────────────────────────────────────────────────────
+
+    function bindInputEvents(session) {
+        const { canvas, ws } = session;
+
+        // Mouse events
+        canvas.addEventListener('mousedown', (e) => {
+            if (!session.connected) return;
+            sendMouseEvent(session, e, MOUSE_TYPE_DOWN);
+            e.preventDefault();
+        });
+
+        canvas.addEventListener('mouseup', (e) => {
+            if (!session.connected) return;
+            sendMouseEvent(session, e, MOUSE_TYPE_UP);
+            e.preventDefault();
+        });
+
+        canvas.addEventListener('mousemove', (e) => {
+            if (!session.connected) return;
+            sendMouseEvent(session, e, MOUSE_TYPE_MOVE);
+        });
+
+        canvas.addEventListener('wheel', (e) => {
+            if (!session.connected) return;
+            const rect = canvas.getBoundingClientRect();
+            const x = Math.round((e.clientX - rect.left) / rect.width * canvas.width);
+            const y = Math.round((e.clientY - rect.top) / rect.height * canvas.height);
+            sendInput(session, {
+                type: 'input',
+                input_type: 'mouse',
+                x, y,
+                deltaX: e.deltaX,
+                deltaY: e.deltaY,
+                button: MOUSE_TYPE_WHEEL
+            });
+            e.preventDefault();
+        }, { passive: false });
+
+        canvas.addEventListener('contextmenu', (e) => e.preventDefault());
+
+        // Keyboard events
+        canvas.setAttribute('tabindex', '0');
+
+        canvas.addEventListener('keydown', (e) => {
+            if (!session.connected) return;
+            sendKeyEvent(session, e, 'keydown');
+            e.preventDefault();
+        });
+
+        canvas.addEventListener('keyup', (e) => {
+            if (!session.connected) return;
+            sendKeyEvent(session, e, 'keyup');
+            e.preventDefault();
+        });
+
+        // Clipboard paste (Ctrl+V / Cmd+V)
+        canvas.addEventListener('paste', (e) => {
+            if (!session.connected || !session._clipboardEnabled) return;
+            const text = e.clipboardData?.getData('text/plain');
+            if (text) sendClipboard(session, text);
+            e.preventDefault();
+        });
+
+        // Clipboard copy (Ctrl+C / Cmd+C) — read from navigator.clipboard
+        canvas.addEventListener('copy', (e) => {
+            // Default browser copy is fine; clipboard_update from device handles inbound
+            e.preventDefault();
+        });
+
+        // Focus canvas for keyboard input
+        canvas.focus();
+    }
+
+    function sendMouseEvent(session, e, mouseType) {
+        const { canvas } = session;
+        const rect = canvas.getBoundingClientRect();
+        const x = Math.round((e.clientX - rect.left) / rect.width * canvas.width);
+        const y = Math.round((e.clientY - rect.top) / rect.height * canvas.height);
+
+        let button = 0;
+        if (e.button === 0) button = MOUSE_BUTTON_LEFT;
+        else if (e.button === 2) button = MOUSE_BUTTON_RIGHT;
+        else if (e.button === 1) button = MOUSE_BUTTON_MIDDLE;
+
+        sendInput(session, {
+            type: 'input',
+            input_type: 'mouse',
+            x, y,
+            button: mouseType | (button << 3)
+        });
+    }
+
+    function sendKeyEvent(session, e, eventType) {
+        sendInput(session, {
+            type: 'input',
+            input_type: 'keyboard',
+            key: e.key,
+            code: e.code,
+            modifiers: {
+                ctrl: e.ctrlKey,
+                alt: e.altKey,
+                shift: e.shiftKey,
+                meta: e.metaKey
+            },
+            down: eventType === 'keydown'
+        });
+    }
+
+    function sendInput(session, payload) {
+        if (session.ws && session.ws.readyState === WebSocket.OPEN) {
+            session.ws.send(JSON.stringify(payload));
+        }
+    }
+
+    function sendMsg(session, payload) {
+        if (session.ws && session.ws.readyState === WebSocket.OPEN) {
+            session.ws.send(JSON.stringify(payload));
+        }
+    }
+
+    // ── Disconnect / Cleanup ─────────────────────────────────────────────
+
+    function setDisconnected(session) {
+        session.connected = false;
+        if (session._qualityTimer) {
+            clearInterval(session._qualityTimer);
+            session._qualityTimer = null;
+        }
+        if (session.overlay) {
+            session.overlay.classList.remove('hidden');
+            session.overlay.querySelector('span:last-child').textContent =
+                window.BetterDesk?.t?.('cdap.disconnected') || 'Disconnected';
+        }
+        // Reset cursor
+        if (session.canvas) session.canvas.style.cursor = 'default';
+        // Show connect button again
+        const connectDiv = session.widgetEl?.querySelector('.cdap-desktop-connect');
+        if (connectDiv) connectDiv.classList.remove('hidden');
+    }
+
+    function closeDesktop(deviceId, widgetId) {
+        const key = `${deviceId}:${widgetId}`;
+        const session = activeSessions[key];
+        if (!session) return;
+
+        if (session.ws && session.ws.readyState === WebSocket.OPEN) {
+            session.ws.send(JSON.stringify({ type: 'close' }));
+            session.ws.close();
+        }
+        setDisconnected(session);
+        delete activeSessions[key];
+    }
+
+    // ── Public API ───────────────────────────────────────────────────────
+
+    window.CDAPDesktop = {
+        open: openDesktop,
+        close: closeDesktop,
+        isActive: (deviceId, widgetId) => !!activeSessions[`${deviceId}:${widgetId}`],
+        requestKeyframe: requestKeyframe,
+        selectMonitor: (deviceId, widgetId, index) => {
+            const s = activeSessions[`${deviceId}:${widgetId}`];
+            if (s) selectMonitor(s, index);
+        },
+        getMonitors: (deviceId, widgetId) => {
+            const s = activeSessions[`${deviceId}:${widgetId}`];
+            return s ? { monitors: s._monitors, active: s._activeMonitor } : null;
+        },
+        setClipboardEnabled: (deviceId, widgetId, enabled) => {
+            const s = activeSessions[`${deviceId}:${widgetId}`];
+            if (s) s._clipboardEnabled = !!enabled;
+        }
+    };
+
+})();
diff --git a/web-nodejs/public/js/cdap-devices.js b/web-nodejs/public/js/cdap-devices.js
new file mode 100644
index 00000000..0bea697b
--- /dev/null
+++ b/web-nodejs/public/js/cdap-devices.js
@@ -0,0 +1,346 @@
+/**
+ * BetterDesk Console - CDAP Devices List
+ * Renders the CDAP device directory with live status, type filters, and search.
+ */
+(function () {
+    'use strict';
+
+    const REFRESH_INTERVAL = 10000; // 10s
+    let _allDevices = [];
+    let _gatewayEnabled = false;
+    let _activeTypeFilter = '';
+    let _searchQuery = '';
+    let _refreshTimer = null;
+
+    // ── Device type icons ────────────────────────────────────────────────
+
+    const TYPE_ICONS = {
+        scada: 'precision_manufacturing',
+        iot: 'sensors',
+        os_agent: 'computer',
+        network: 'router',
+        camera: 'videocam',
+        desktop: 'desktop_windows',
+        custom: 'developer_board'
+    };
+
+    // ── Initialization ───────────────────────────────────────────────────
+
+    function init() {
+        bindEvents();
+        loadGatewayStatus();
+        loadDevices();
+        _refreshTimer = setInterval(function () {
+            loadGatewayStatus();
+            loadDevices();
+        }, REFRESH_INTERVAL);
+    }
+
+    function bindEvents() {
+        var search = document.getElementById('cdap-search');
+        if (search) {
+            search.addEventListener('input', function () {
+                _searchQuery = this.value.trim().toLowerCase();
+                renderDevices();
+            });
+        }
+
+        var filterBtns = document.querySelectorAll('#cdap-type-filter .filter-btn');
+        filterBtns.forEach(function (btn) {
+            btn.addEventListener('click', function () {
+                filterBtns.forEach(function (b) { b.classList.remove('active'); });
+                btn.classList.add('active');
+                _activeTypeFilter = btn.dataset.type || '';
+                renderDevices();
+            });
+        });
+
+        // CDAP enable/disable toggle buttons
+        var toggleBtn = document.getElementById('cdap-toggle-btn');
+        if (toggleBtn) {
+            toggleBtn.addEventListener('click', function () {
+                toggleCDAP(false);
+            });
+        }
+        var enableBtn = document.getElementById('cdap-enable-btn');
+        if (enableBtn) {
+            enableBtn.addEventListener('click', function () {
+                toggleCDAP(true);
+            });
+        }
+    }
+
+    function toggleCDAP(enable) {
+        var csrfToken = (window.BetterDesk && window.BetterDesk.csrfToken) || '';
+        var headers = { 'Content-Type': 'application/json' };
+        if (csrfToken) headers['x-csrf-token'] = csrfToken;
+        fetch('/api/cdap/toggle', {
+            method: 'POST',
+            credentials: 'same-origin',
+            headers: headers,
+            body: JSON.stringify({ enabled: enable })
+        })
+        .then(function (r) { return r.json(); })
+        .then(function (data) {
+            if (data.success) {
+                var msg = enable ? _i18n('cdap.enabled_restart') : _i18n('cdap.disabled_restart');
+                if (window.BetterDesk && window.BetterDesk.notify) {
+                    window.BetterDesk.notify(msg, 'info');
+                } else if (window.parent !== window && window.parent.BetterDesk && window.parent.BetterDesk.notify) {
+                    window.parent.BetterDesk.notify(msg, 'info');
+                } else {
+                    console.log('[CDAP]', msg);
+                }
+            } else {
+                var errMsg = data.error || 'Failed';
+                if (window.BetterDesk && window.BetterDesk.notify) {
+                    window.BetterDesk.notify(errMsg, 'error');
+                }
+            }
+        })
+        .catch(function () {});
+    }
+
+    // ── Data Loading ─────────────────────────────────────────────────────
+
+    function loadGatewayStatus() {
+        fetch('/api/cdap/status', { credentials: 'same-origin' })
+            .then(function (r) { return r.ok ? r.json() : null; })
+            .then(function (data) {
+                if (!data) return;
+                _gatewayEnabled = data.enabled;
+                updateGatewayBanner(data);
+            })
+            .catch(function () { /* ignore */ });
+    }
+
+    function loadDevices() {
+        var loadingEl = document.getElementById('cdap-list-loading');
+        fetch('/api/cdap/devices', { credentials: 'same-origin' })
+            .then(function (r) { return r.ok ? r.json() : null; })
+            .then(function (data) {
+                if (loadingEl) loadingEl.classList.add('hidden');
+                if (!data) {
+                    _allDevices = [];
+                    renderDevices();
+                    return;
+                }
+                _allDevices = data.devices || [];
+                renderDevices();
+            })
+            .catch(function () {
+                if (loadingEl) loadingEl.classList.add('hidden');
+                _allDevices = [];
+                renderDevices();
+            });
+    }
+
+    // ── Gateway Banner ───────────────────────────────────────────────────
+
+    function updateGatewayBanner(data) {
+        var banner = document.getElementById('cdap-gateway-banner');
+        var disabledBanner = document.getElementById('cdap-disabled-banner');
+        var statusEl = document.getElementById('cdap-gw-status');
+        var statusText = document.getElementById('cdap-gw-status-text');
+        var connEl = document.getElementById('cdap-stat-connected');
+        var portEl = document.getElementById('cdap-stat-port');
+        var tlsEl = document.getElementById('cdap-stat-tls');
+
+        if (!data.enabled) {
+            if (banner) banner.classList.add('hidden');
+            if (disabledBanner) disabledBanner.classList.remove('hidden');
+            return;
+        }
+
+        if (banner) banner.classList.remove('hidden');
+        if (disabledBanner) disabledBanner.classList.add('hidden');
+
+        if (statusEl) {
+            statusEl.className = 'cdap-gateway-status online';
+        }
+        if (statusText) {
+            statusText.textContent = _i18n('cdap.gateway_active');
+        }
+        if (connEl) connEl.textContent = data.connected || 0;
+        if (portEl) portEl.textContent = data.port || '—';
+        if (tlsEl) tlsEl.textContent = data.tls ? 'ON' : 'OFF';
+    }
+
+    // ── Rendering ────────────────────────────────────────────────────────
+
+    function renderDevices() {
+        var grid = document.getElementById('cdap-device-grid');
+        var emptyEl = document.getElementById('cdap-list-empty');
+        if (!grid) return;
+
+        var filtered = _allDevices.filter(function (dev) {
+            if (_activeTypeFilter) {
+                var devType = getDeviceType(dev);
+                if (devType !== _activeTypeFilter) return false;
+            }
+            if (_searchQuery) {
+                var searchable = [
+                    dev.id || '',
+                    getDeviceName(dev),
+                    getDeviceType(dev),
+                    dev.username || '',
+                    dev.client_ip || ''
+                ].join(' ').toLowerCase();
+                if (searchable.indexOf(_searchQuery) === -1) return false;
+            }
+            return true;
+        });
+
+        if (filtered.length === 0 && !_gatewayEnabled) {
+            grid.innerHTML = '';
+            if (emptyEl) emptyEl.classList.add('hidden');
+            return;
+        }
+
+        if (filtered.length === 0) {
+            grid.innerHTML = '';
+            if (emptyEl) emptyEl.classList.remove('hidden');
+            return;
+        }
+
+        if (emptyEl) emptyEl.classList.add('hidden');
+
+        grid.innerHTML = filtered.map(function (dev) {
+            return renderDeviceCard(dev);
+        }).join('');
+
+        // Bind card clicks
+        grid.querySelectorAll('.cdap-device-card').forEach(function (card) {
+            card.addEventListener('click', function () {
+                var id = card.dataset.id;
+                if (id) window.location.href = '/cdap/devices/' + encodeURIComponent(id);
+            });
+        });
+    }
+
+    function renderDeviceCard(dev) {
+        var id = escapeHtml(dev.id || '');
+        var name = escapeHtml(getDeviceName(dev));
+        var type = getDeviceType(dev);
+        var icon = TYPE_ICONS[type] || 'developer_board';
+        var connected = dev.connected !== false;
+        var statusClass = connected ? 'online' : 'offline';
+        var statusText = connected ? _i18n('cdap.connected') : _i18n('cdap.disconnected');
+        var widgetCount = countWidgets(dev);
+        var uptime = formatUptime(dev.connected_at);
+        var ip = escapeHtml(dev.client_ip || '—');
+        var heartbeats = dev.heartbeat_count || 0;
+
+        return '<div class="cdap-device-card ' + statusClass + '" data-id="' + id + '">' +
+            '<div class="cdap-card-header">' +
+                '<div class="cdap-card-icon"><span class="material-icons">' + icon + '</span></div>' +
+                '<div class="cdap-card-identity">' +
+                    '<div class="cdap-card-name">' + name + '</div>' +
+                    '<div class="cdap-card-id">' + id + '</div>' +
+                '</div>' +
+                '<div class="cdap-card-status ' + statusClass + '">' +
+                    '<span class="cdap-status-dot"></span>' +
+                    '<span>' + statusText + '</span>' +
+                '</div>' +
+            '</div>' +
+            '<div class="cdap-card-meta">' +
+                '<div class="cdap-card-meta-item">' +
+                    '<span class="material-icons">category</span>' +
+                    '<span>' + escapeHtml(type) + '</span>' +
+                '</div>' +
+                '<div class="cdap-card-meta-item">' +
+                    '<span class="material-icons">widgets</span>' +
+                    '<span>' + widgetCount + ' ' + _i18n('cdap.widgets') + '</span>' +
+                '</div>' +
+                (connected ? '<div class="cdap-card-meta-item">' +
+                    '<span class="material-icons">schedule</span>' +
+                    '<span>' + uptime + '</span>' +
+                '</div>' : '') +
+                '<div class="cdap-card-meta-item">' +
+                    '<span class="material-icons">lan</span>' +
+                    '<span>' + ip + '</span>' +
+                '</div>' +
+            '</div>' +
+            (connected ? '<div class="cdap-card-footer">' +
+                '<span class="cdap-card-hb">' +
+                    '<span class="material-icons">favorite</span> ' + heartbeats +
+                '</span>' +
+                '<span class="material-icons cdap-card-arrow">chevron_right</span>' +
+            '</div>' : '<div class="cdap-card-footer">' +
+                '<span class="cdap-card-hb muted">' + _i18n('cdap.disconnected') + '</span>' +
+                '<span class="material-icons cdap-card-arrow">chevron_right</span>' +
+            '</div>') +
+        '</div>';
+    }
+
+    // ── Helpers ──────────────────────────────────────────────────────────
+
+    function getDeviceName(dev) {
+        if (dev.manifest) {
+            try {
+                var m = typeof dev.manifest === 'string' ? JSON.parse(dev.manifest) : dev.manifest;
+                if (m.device && m.device.name) return m.device.name;
+            } catch (e) { /* ignore */ }
+        }
+        return dev.id || '—';
+    }
+
+    function getDeviceType(dev) {
+        if (dev.manifest) {
+            try {
+                var m = typeof dev.manifest === 'string' ? JSON.parse(dev.manifest) : dev.manifest;
+                if (m.device && m.device.type) return m.device.type;
+            } catch (e) { /* ignore */ }
+        }
+        return 'custom';
+    }
+
+    function countWidgets(dev) {
+        if (dev.manifest) {
+            try {
+                var m = typeof dev.manifest === 'string' ? JSON.parse(dev.manifest) : dev.manifest;
+                if (m.widgets && Array.isArray(m.widgets)) return m.widgets.length;
+            } catch (e) { /* ignore */ }
+        }
+        return 0;
+    }
+
+    function formatUptime(connectedAt) {
+        if (!connectedAt) return '—';
+        var diff = Math.floor((Date.now() - new Date(connectedAt).getTime()) / 1000);
+        if (diff < 60) return diff + 's';
+        if (diff < 3600) return Math.floor(diff / 60) + 'm';
+        if (diff < 86400) return Math.floor(diff / 3600) + 'h ' + Math.floor((diff % 3600) / 60) + 'm';
+        return Math.floor(diff / 86400) + 'd ' + Math.floor((diff % 86400) / 3600) + 'h';
+    }
+
+    function _i18n(key) {
+        if (typeof _ === 'function') return _(key);
+        // Fallback: extract last part of key
+        var parts = key.split('.');
+        return parts[parts.length - 1];
+    }
+
+    function escapeHtml(str) {
+        var div = document.createElement('div');
+        div.textContent = str;
+        return div.innerHTML;
+    }
+
+    // ── Public API ───────────────────────────────────────────────────────
+
+    window.CDAPDevices = {
+        init: init,
+        refresh: function () {
+            loadGatewayStatus();
+            loadDevices();
+        }
+    };
+
+    // Auto-init when DOM is ready
+    if (document.readyState === 'loading') {
+        document.addEventListener('DOMContentLoaded', init);
+    } else {
+        init();
+    }
+})();
diff --git a/web-nodejs/public/js/cdap-filebrowser.js b/web-nodejs/public/js/cdap-filebrowser.js
new file mode 100644
index 00000000..7e1f57a8
--- /dev/null
+++ b/web-nodejs/public/js/cdap-filebrowser.js
@@ -0,0 +1,400 @@
+/**
+ * BetterDesk Console — CDAP File Browser Widget
+ * Provides file browsing, download, upload, and deletion via WebSocket.
+ * Uses request-response pattern (file_list, file_read, file_write, file_delete).
+ */
+
+(function () {
+    'use strict';
+
+    const activeSessions = {};
+
+    // ── Utilities ────────────────────────────────────────────────────────
+
+    function escapeHtml(str) {
+        if (!str) return '';
+        const div = document.createElement('div');
+        div.textContent = String(str);
+        return div.innerHTML;
+    }
+
+    function formatSize(bytes) {
+        if (bytes == null || bytes < 0) return '-';
+        if (bytes === 0) return '0 B';
+        const units = ['B', 'KB', 'MB', 'GB', 'TB'];
+        const i = Math.floor(Math.log(bytes) / Math.log(1024));
+        return (bytes / Math.pow(1024, i)).toFixed(i > 0 ? 1 : 0) + ' ' + units[i];
+    }
+
+    function formatDate(ts) {
+        if (!ts) return '-';
+        const d = new Date(ts);
+        if (isNaN(d.getTime())) return '-';
+        return d.toLocaleString();
+    }
+
+    function t(key) {
+        return window.BetterDesk?.t?.(key) || key.split('.').pop();
+    }
+
+    // ── File Browser Session Manager ─────────────────────────────────────
+
+    function openFileBrowser(deviceId, widgetId) {
+        const key = `${deviceId}:${widgetId}`;
+        if (activeSessions[key]) return;
+
+        const widgetEl = document.getElementById(`wval-${CSS.escape(widgetId)}`);
+        if (!widgetEl) return;
+
+        const pathEl = widgetEl.querySelector('.cdap-file-path');
+        const listEl = widgetEl.querySelector('.cdap-file-list');
+        const upBtn = widgetEl.querySelector('.cdap-file-up');
+
+        const proto = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
+        const wsUrl = `${proto}//${window.location.host}/api/cdap/devices/${encodeURIComponent(deviceId)}/files`;
+        let ws;
+        try {
+            ws = new WebSocket(wsUrl, ['cdap-filebrowser']);
+        } catch (err) {
+            console.error('[CDAPFileBrowser] WS creation failed:', err);
+            return;
+        }
+
+        const session = {
+            ws,
+            widgetEl,
+            widgetId,
+            deviceId,
+            pathEl,
+            listEl,
+            upBtn,
+            currentPath: '/',
+            connected: false,
+            sessionId: null,
+            _pendingCallbacks: {}
+        };
+        activeSessions[key] = session;
+
+        ws.onopen = () => {
+            session.connected = true;
+            navigate(session, '/');
+        };
+
+        ws.onmessage = (event) => {
+            try {
+                const msg = JSON.parse(event.data);
+                handleMessage(session, msg);
+            } catch (_) {}
+        };
+
+        ws.onerror = () => {
+            console.error('[CDAPFileBrowser] WS error for', deviceId);
+        };
+
+        ws.onclose = () => {
+            if (activeSessions[key]) {
+                session.connected = false;
+                showError(session, 'Disconnected');
+                delete activeSessions[key];
+            }
+            // Show connect button again
+            const connectDiv = widgetEl.querySelector('.cdap-file-connect');
+            if (connectDiv) connectDiv.classList.remove('hidden');
+        };
+
+        // Bind up button
+        if (upBtn) {
+            upBtn.addEventListener('click', () => {
+                navigateUp(session);
+            });
+        }
+    }
+
+    function handleMessage(session, msg) {
+        switch (msg.type) {
+            case 'ready':
+                session.sessionId = msg.session_id;
+                break;
+
+            case 'file_list_response':
+                handleListResponse(session, msg);
+                break;
+
+            case 'file_read_response':
+                handleReadResponse(session, msg);
+                break;
+
+            case 'file_write_response':
+            case 'file_delete_response':
+                handleOperationResponse(session, msg);
+                break;
+
+            case 'error':
+                showError(session, msg.error || 'Unknown error');
+                break;
+
+            case 'end':
+                closeFileBrowser(session.deviceId, session.widgetId);
+                break;
+        }
+    }
+
+    // ── Navigation ───────────────────────────────────────────────────────
+
+    function navigate(session, path) {
+        if (!session.connected) return;
+        session.currentPath = path;
+        if (session.pathEl) {
+            session.pathEl.textContent = path;
+        }
+        // Show loading
+        if (session.listEl) {
+            session.listEl.innerHTML = '<div class="cdap-file-loading">Loading...</div>';
+        }
+        sendRequest(session, 'file_list', { path });
+    }
+
+    function navigateUp(session) {
+        const parts = session.currentPath.split('/').filter(Boolean);
+        parts.pop();
+        navigate(session, '/' + parts.join('/'));
+    }
+
+    function handleListResponse(session, msg) {
+        const entries = msg.entries || [];
+        if (!session.listEl) return;
+
+        if (entries.length === 0) {
+            session.listEl.innerHTML = '<div class="cdap-file-empty">Empty directory</div>';
+            return;
+        }
+
+        // Sort: directories first, then alphabetical
+        entries.sort((a, b) => {
+            if (a.is_dir !== b.is_dir) return a.is_dir ? -1 : 1;
+            return (a.name || '').localeCompare(b.name || '');
+        });
+
+        const html = entries.map(entry => {
+            const icon = entry.is_dir ? 'folder' : getFileIcon(entry.name);
+            const size = entry.is_dir ? '-' : formatSize(entry.size);
+            const modified = formatDate(entry.modified);
+            return `
+                <div class="cdap-file-entry ${entry.is_dir ? 'cdap-file-dir' : 'cdap-file-file'}"
+                     data-name="${escapeHtml(entry.name)}"
+                     data-is-dir="${entry.is_dir}">
+                    <span class="material-icons cdap-file-icon">${icon}</span>
+                    <span class="cdap-file-name">${escapeHtml(entry.name)}</span>
+                    <span class="cdap-file-size">${size}</span>
+                    <span class="cdap-file-modified">${modified}</span>
+                    <div class="cdap-file-actions">
+                        ${!entry.is_dir ? `
+                            <button class="btn btn-sm cdap-file-download" title="Download">
+                                <span class="material-icons">download</span>
+                            </button>
+                        ` : ''}
+                        <button class="btn btn-sm cdap-file-delete" title="Delete">
+                            <span class="material-icons">delete</span>
+                        </button>
+                    </div>
+                </div>
+            `;
+        }).join('');
+
+        session.listEl.innerHTML = html;
+
+        // Bind click events
+        session.listEl.querySelectorAll('.cdap-file-entry').forEach(el => {
+            const name = el.dataset.name;
+            const isDir = el.dataset.isDir === 'true';
+
+            // Double-click to navigate into directory
+            if (isDir) {
+                el.addEventListener('dblclick', () => {
+                    const newPath = session.currentPath.replace(/\/$/, '') + '/' + name;
+                    navigate(session, newPath);
+                });
+            }
+
+            // Download button
+            const downloadBtn = el.querySelector('.cdap-file-download');
+            if (downloadBtn) {
+                downloadBtn.addEventListener('click', (e) => {
+                    e.stopPropagation();
+                    downloadFile(session, name);
+                });
+            }
+
+            // Delete button
+            const deleteBtn = el.querySelector('.cdap-file-delete');
+            if (deleteBtn) {
+                deleteBtn.addEventListener('click', (e) => {
+                    e.stopPropagation();
+                    const confirmMsg = `Delete "${name}"?`;
+                    if (confirm(confirmMsg)) {
+                        deleteFile(session, name);
+                    }
+                });
+            }
+        });
+
+        // Add upload button at bottom
+        const uploadHtml = `
+            <div class="cdap-file-upload-area">
+                <button class="btn cdap-file-upload-btn">
+                    <span class="material-icons">upload</span>
+                    <span>${t('cdap.upload_file')}</span>
+                </button>
+                <input type="file" class="cdap-file-upload-input" style="display:none" multiple>
+            </div>
+        `;
+        session.listEl.insertAdjacentHTML('afterend', uploadHtml);
+
+        // Remove previous upload area if exists
+        const prevUpload = session.widgetEl.querySelectorAll('.cdap-file-upload-area');
+        if (prevUpload.length > 1) {
+            prevUpload[0].remove();
+        }
+
+        // Bind upload
+        const uploadBtn = session.widgetEl.querySelector('.cdap-file-upload-btn');
+        const uploadInput = session.widgetEl.querySelector('.cdap-file-upload-input');
+        if (uploadBtn && uploadInput) {
+            uploadBtn.addEventListener('click', () => uploadInput.click());
+            uploadInput.addEventListener('change', () => {
+                const files = uploadInput.files;
+                if (!files || files.length === 0) return;
+                for (const file of files) {
+                    uploadFile(session, file);
+                }
+                uploadInput.value = '';
+            });
+        }
+    }
+
+    // ── File Operations ──────────────────────────────────────────────────
+
+    function downloadFile(session, name) {
+        const path = session.currentPath.replace(/\/$/, '') + '/' + name;
+        const requestId = 'dl_' + Date.now();
+
+        session._pendingCallbacks[requestId] = (msg) => {
+            if (msg.error) {
+                showError(session, msg.error);
+                return;
+            }
+            // msg.data is base64-encoded content
+            if (msg.data) {
+                const binary = atob(msg.data);
+                const bytes = new Uint8Array(binary.length);
+                for (let i = 0; i < binary.length; i++) {
+                    bytes[i] = binary.charCodeAt(i);
+                }
+                const blob = new Blob([bytes]);
+                const url = URL.createObjectURL(blob);
+                const a = document.createElement('a');
+                a.href = url;
+                a.download = name;
+                a.click();
+                URL.revokeObjectURL(url);
+            }
+        };
+
+        sendRequest(session, 'file_read', { path, request_id: requestId });
+    }
+
+    function uploadFile(session, file) {
+        const reader = new FileReader();
+        reader.onload = () => {
+            const base64 = reader.result.split(',')[1] || '';
+            const path = session.currentPath.replace(/\/$/, '') + '/' + file.name;
+            sendRequest(session, 'file_write', { path, data: base64 });
+        };
+        reader.readAsDataURL(file);
+    }
+
+    function deleteFile(session, name) {
+        const path = session.currentPath.replace(/\/$/, '') + '/' + name;
+        sendRequest(session, 'file_delete', { path });
+        // Refresh listing after short delay
+        setTimeout(() => navigate(session, session.currentPath), 500);
+    }
+
+    function handleReadResponse(session, msg) {
+        const requestId = msg.request_id;
+        if (requestId && session._pendingCallbacks[requestId]) {
+            session._pendingCallbacks[requestId](msg);
+            delete session._pendingCallbacks[requestId];
+        }
+    }
+
+    function handleOperationResponse(session, msg) {
+        if (msg.error) {
+            showError(session, msg.error);
+        }
+        // Refresh current directory
+        navigate(session, session.currentPath);
+    }
+
+    // ── Send Request ─────────────────────────────────────────────────────
+
+    function sendRequest(session, type, data) {
+        if (session.ws && session.ws.readyState === WebSocket.OPEN) {
+            session.ws.send(JSON.stringify({ type, ...data }));
+        }
+    }
+
+    // ── UI Helpers ───────────────────────────────────────────────────────
+
+    function getFileIcon(name) {
+        if (!name) return 'insert_drive_file';
+        const ext = name.split('.').pop()?.toLowerCase();
+        const iconMap = {
+            jpg: 'image', jpeg: 'image', png: 'image', gif: 'image',
+            svg: 'image', bmp: 'image', webp: 'image',
+            mp4: 'movie', avi: 'movie', mkv: 'movie', mov: 'movie', webm: 'movie',
+            mp3: 'audiotrack', wav: 'audiotrack', flac: 'audiotrack', ogg: 'audiotrack',
+            pdf: 'picture_as_pdf',
+            zip: 'archive', tar: 'archive', gz: 'archive', rar: 'archive', '7z': 'archive',
+            txt: 'description', log: 'description', md: 'description',
+            js: 'code', ts: 'code', py: 'code', go: 'code', rs: 'code',
+            json: 'data_object', xml: 'data_object', yaml: 'data_object', yml: 'data_object',
+            sh: 'terminal', bash: 'terminal', ps1: 'terminal', bat: 'terminal',
+            exe: 'apps', dll: 'apps', so: 'apps',
+            conf: 'settings', cfg: 'settings', ini: 'settings', env: 'settings'
+        };
+        return iconMap[ext] || 'insert_drive_file';
+    }
+
+    function showError(session, message) {
+        if (session.listEl) {
+            const errEl = document.createElement('div');
+            errEl.className = 'cdap-file-error';
+            errEl.textContent = message;
+            session.listEl.prepend(errEl);
+            setTimeout(() => errEl.remove(), 5000);
+        }
+    }
+
+    function closeFileBrowser(deviceId, widgetId) {
+        const key = `${deviceId}:${widgetId}`;
+        const session = activeSessions[key];
+        if (!session) return;
+
+        if (session.ws && session.ws.readyState === WebSocket.OPEN) {
+            session.ws.send(JSON.stringify({ type: 'close' }));
+            session.ws.close();
+        }
+        session.connected = false;
+        delete activeSessions[key];
+    }
+
+    // ── Public API ───────────────────────────────────────────────────────
+
+    window.CDAPFileBrowser = {
+        open: openFileBrowser,
+        close: closeFileBrowser,
+        isActive: (deviceId, widgetId) => !!activeSessions[`${deviceId}:${widgetId}`]
+    };
+
+})();
diff --git a/web-nodejs/public/js/cdap-terminal.js b/web-nodejs/public/js/cdap-terminal.js
new file mode 100644
index 00000000..2e250312
--- /dev/null
+++ b/web-nodejs/public/js/cdap-terminal.js
@@ -0,0 +1,249 @@
+/**
+ * BetterDesk Console — CDAP Terminal Widget
+ * Provides interactive terminal access to CDAP devices via WebSocket.
+ * Dynamically loads xterm.js + xterm-addon-fit when a terminal widget is opened.
+ */
+
+(function () {
+    'use strict';
+
+    const XTERM_VERSION = '5.5.0';
+    const XTERM_CSS_URL = `https://cdn.jsdelivr.net/npm/@xterm/xterm@${XTERM_VERSION}/css/xterm.min.css`;
+    const XTERM_JS_URL = `https://cdn.jsdelivr.net/npm/@xterm/xterm@${XTERM_VERSION}/lib/xterm.min.js`;
+    const XTERM_FIT_URL = `https://cdn.jsdelivr.net/npm/@xterm/addon-fit@${XTERM_VERSION}/lib/addon-fit.min.js`;
+
+    let xtermLoaded = false;
+    let xtermLoading = null;
+
+    // ── Dynamic xterm.js Loader ──────────────────────────────────────────
+
+    function loadXterm() {
+        if (xtermLoaded) return Promise.resolve();
+        if (xtermLoading) return xtermLoading;
+
+        xtermLoading = new Promise((resolve, reject) => {
+            // Load CSS
+            const link = document.createElement('link');
+            link.rel = 'stylesheet';
+            link.href = XTERM_CSS_URL;
+            document.head.appendChild(link);
+
+            // Load xterm core
+            const script = document.createElement('script');
+            script.src = XTERM_JS_URL;
+            script.onload = () => {
+                // Load fit addon after core
+                const fitScript = document.createElement('script');
+                fitScript.src = XTERM_FIT_URL;
+                fitScript.onload = () => {
+                    xtermLoaded = true;
+                    resolve();
+                };
+                fitScript.onerror = () => reject(new Error('Failed to load xterm-addon-fit'));
+                document.head.appendChild(fitScript);
+            };
+            script.onerror = () => reject(new Error('Failed to load xterm.js'));
+            document.head.appendChild(script);
+        });
+
+        return xtermLoading;
+    }
+
+    // ── Terminal Session Manager ─────────────────────────────────────────
+
+    const activeSessions = {};
+
+    async function openTerminal(deviceId, widgetId) {
+        const key = `${deviceId}:${widgetId}`;
+        if (activeSessions[key]) {
+            activeSessions[key].terminal.focus();
+            return;
+        }
+
+        // Load xterm.js if not ready
+        try {
+            await loadXterm();
+        } catch (err) {
+            console.error('Failed to load xterm.js:', err);
+            showTerminalError(widgetId, 'Failed to load terminal library');
+            return;
+        }
+
+        const container = document.querySelector(`[data-widget-id="${CSS.escape(widgetId)}"] .cdap-terminal`);
+        if (!container) return;
+
+        // Clear stub content
+        container.innerHTML = '';
+
+        const Terminal = window.Terminal;
+        const FitAddon = window.FitAddon?.FitAddon;
+        if (!Terminal || !FitAddon) {
+            showTerminalError(widgetId, 'Terminal library not available');
+            return;
+        }
+
+        // Create xterm instance
+        const fitAddon = new FitAddon();
+        const term = new Terminal({
+            cursorBlink: true,
+            cursorStyle: 'block',
+            fontSize: 13,
+            fontFamily: "'Cascadia Code', 'Fira Code', 'Consolas', monospace",
+            theme: {
+                background: '#0d1117',
+                foreground: '#e6edf3',
+                cursor: '#58a6ff',
+                selectionBackground: 'rgba(88, 166, 255, 0.3)',
+                black: '#484f58',
+                red: '#ff7b72',
+                green: '#3fb950',
+                yellow: '#d29922',
+                blue: '#58a6ff',
+                magenta: '#bc8cff',
+                cyan: '#39d353',
+                white: '#b1bac4',
+                brightBlack: '#6e7681',
+                brightRed: '#ffa198',
+                brightGreen: '#56d364',
+                brightYellow: '#e3b341',
+                brightBlue: '#79c0ff',
+                brightMagenta: '#d2a8ff',
+                brightCyan: '#56d364',
+                brightWhite: '#f0f6fc'
+            },
+            scrollback: 5000,
+            convertEol: true
+        });
+
+        term.loadAddon(fitAddon);
+        term.open(container);
+
+        // Add connecting message
+        term.writeln('\x1b[33mConnecting to device...\x1b[0m');
+
+        // Fit to container
+        try {
+            fitAddon.fit();
+        } catch (_) { /* ignore fit errors */ }
+
+        // Open WebSocket to Go server via Node.js proxy
+        const proto = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
+        const wsUrl = `${proto}//${window.location.host}/api/cdap/devices/${encodeURIComponent(deviceId)}/terminal`;
+        let ws;
+        try {
+            ws = new WebSocket(wsUrl, ['cdap-terminal']);
+        } catch (err) {
+            term.writeln(`\x1b[31mConnection failed: ${err.message}\x1b[0m`);
+            return;
+        }
+
+        const session = {
+            terminal: term,
+            fitAddon: fitAddon,
+            ws: ws,
+            widgetId: widgetId,
+            sessionId: null
+        };
+        activeSessions[key] = session;
+
+        ws.onopen = () => {
+            // Send init message with terminal dimensions
+            ws.send(JSON.stringify({
+                cols: term.cols,
+                rows: term.rows
+            }));
+        };
+
+        ws.onmessage = (event) => {
+            try {
+                const msg = JSON.parse(event.data);
+                switch (msg.type) {
+                    case 'ready':
+                        session.sessionId = msg.session_id;
+                        term.clear();
+                        term.focus();
+                        break;
+                    case 'output':
+                        term.write(msg.data || '');
+                        break;
+                    case 'error':
+                        term.writeln(`\x1b[31m${msg.error || 'Unknown error'}\x1b[0m`);
+                        break;
+                    case 'end':
+                        term.writeln(`\x1b[33m\r\nSession ended: ${msg.reason || 'disconnected'}\x1b[0m`);
+                        closeTerminal(deviceId, widgetId);
+                        break;
+                }
+            } catch (_) {
+                // Non-JSON message, write raw
+                term.write(event.data);
+            }
+        };
+
+        ws.onerror = () => {
+            term.writeln('\x1b[31mWebSocket error\x1b[0m');
+        };
+
+        ws.onclose = (event) => {
+            if (activeSessions[key]) {
+                term.writeln(`\x1b[33m\r\nDisconnected (code: ${event.code})\x1b[0m`);
+                delete activeSessions[key];
+            }
+        };
+
+        // Relay keyboard input to server
+        term.onData((data) => {
+            if (ws.readyState === WebSocket.OPEN) {
+                ws.send(JSON.stringify({ type: 'input', data: data }));
+            }
+        });
+
+        // Handle resize
+        term.onResize(({ cols, rows }) => {
+            if (ws.readyState === WebSocket.OPEN) {
+                ws.send(JSON.stringify({ type: 'resize', cols, rows }));
+            }
+        });
+
+        // Resize observer for container
+        const resizeObserver = new ResizeObserver(() => {
+            try {
+                fitAddon.fit();
+            } catch (_) { /* ignore */ }
+        });
+        resizeObserver.observe(container);
+        session._resizeObserver = resizeObserver;
+    }
+
+    function closeTerminal(deviceId, widgetId) {
+        const key = `${deviceId}:${widgetId}`;
+        const session = activeSessions[key];
+        if (!session) return;
+
+        if (session.ws && session.ws.readyState === WebSocket.OPEN) {
+            session.ws.send(JSON.stringify({ type: 'close' }));
+            session.ws.close();
+        }
+        if (session._resizeObserver) {
+            session._resizeObserver.disconnect();
+        }
+        session.terminal.dispose();
+        delete activeSessions[key];
+    }
+
+    function showTerminalError(widgetId, message) {
+        const container = document.querySelector(`[data-widget-id="${CSS.escape(widgetId)}"] .cdap-terminal-output`);
+        if (container) {
+            container.innerHTML = `<div class="cdap-terminal-line" style="color: #ff7b72;">${message}</div>`;
+        }
+    }
+
+    // ── Public API ───────────────────────────────────────────────────────
+
+    window.CDAPTerminal = {
+        open: openTerminal,
+        close: closeTerminal,
+        isActive: (deviceId, widgetId) => !!activeSessions[`${deviceId}:${widgetId}`]
+    };
+
+})();
diff --git a/web-nodejs/public/js/cdap-video.js b/web-nodejs/public/js/cdap-video.js
new file mode 100644
index 00000000..51a5e16e
--- /dev/null
+++ b/web-nodejs/public/js/cdap-video.js
@@ -0,0 +1,285 @@
+/**
+ * BetterDesk Console — CDAP Video Stream Widget
+ * Provides read-only video stream viewing from CDAP devices via WebSocket.
+ * Renders frames on canvas from base64-encoded images.
+ * Supports: quality reporting, codec negotiation, keyframe requests.
+ */
+
+(function () {
+    'use strict';
+
+    const activeSessions = {};
+
+    const QUALITY_REPORT_INTERVAL = 5000;
+
+    // ── Video Session Manager ────────────────────────────────────────────
+
+    function openVideo(deviceId, widgetId) {
+        const key = `${deviceId}:${widgetId}`;
+        if (activeSessions[key]) return;
+
+        const widgetEl = document.getElementById(`wval-${CSS.escape(widgetId)}`);
+        if (!widgetEl) return;
+
+        const canvas = widgetEl.querySelector('.cdap-video-canvas');
+        const overlay = widgetEl.querySelector('.cdap-video-overlay');
+        if (!canvas) return;
+
+        const ctx = canvas.getContext('2d');
+
+        if (overlay) {
+            overlay.querySelector('span:last-child').textContent = 'Connecting...';
+        }
+
+        const proto = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
+        const wsUrl = `${proto}//${window.location.host}/api/cdap/devices/${encodeURIComponent(deviceId)}/video`;
+        let ws;
+        try {
+            ws = new WebSocket(wsUrl, ['cdap-video']);
+        } catch (err) {
+            console.error('[CDAPVideo] WS creation failed:', err);
+            return;
+        }
+
+        const session = {
+            ws,
+            canvas,
+            ctx,
+            overlay,
+            widgetEl,
+            widgetId,
+            deviceId,
+            sessionId: null,
+            connected: false,
+            _frameImg: new Image(),
+            _frameCount: 0,
+            _fpsTimer: null,
+            _fps: 0,
+            // Quality reporting
+            _frameBytes: 0,
+            _droppedFrames: 0,
+            _lastFrameTime: 0,
+            _qualityTimer: null,
+            _qrPrevFrames: 0,
+            _qrPrevBytes: 0,
+            _qrPrevDropped: 0,
+            _qrPrevTime: 0
+        };
+        activeSessions[key] = session;
+
+        ws.onopen = () => {
+            ws.send(JSON.stringify({
+                stream_id: widgetId,
+                quality: 60,
+                fps: 10
+            }));
+        };
+
+        ws.onmessage = (event) => {
+            try {
+                const msg = JSON.parse(event.data);
+                handleMessage(session, msg);
+            } catch (_) {}
+        };
+
+        ws.onerror = () => {
+            console.error('[CDAPVideo] WS error for', deviceId);
+        };
+
+        ws.onclose = () => {
+            if (activeSessions[key]) {
+                setDisconnected(session);
+                delete activeSessions[key];
+            }
+        };
+
+        // FPS counter
+        session._fpsTimer = setInterval(() => {
+            session._fps = session._frameCount;
+            session._frameCount = 0;
+        }, 1000);
+    }
+
+    function handleMessage(session, msg) {
+        switch (msg.type) {
+            case 'ready':
+                session.sessionId = msg.session_id;
+                session.connected = true;
+                if (session.overlay) {
+                    session.overlay.classList.add('hidden');
+                }
+                startQualityReporting(session);
+                sendCodecOffer(session);
+                break;
+
+            case 'frame':
+                renderFrame(session, msg);
+                break;
+
+            case 'codec_answer':
+                // Informational: device chose codecs
+                break;
+
+            case 'quality_adjust':
+                // Server-initiated quality change
+                break;
+
+            case 'error':
+                console.error('[CDAPVideo] Error:', msg.error);
+                break;
+
+            case 'end':
+                setDisconnected(session);
+                closeVideo(session.deviceId, session.widgetId);
+                break;
+        }
+    }
+
+    function renderFrame(session, msg) {
+        if (!msg.data) return;
+
+        const { canvas, ctx, _frameImg } = session;
+        const format = msg.format || 'jpeg';
+
+        session._frameCount++;
+        session._frameBytes += msg.data.length * 0.75;
+        session._lastFrameTime = Date.now();
+
+        if (msg.width && msg.height) {
+            if (canvas.width !== msg.width || canvas.height !== msg.height) {
+                canvas.width = msg.width;
+                canvas.height = msg.height;
+            }
+        }
+
+        const src = `data:image/${format};base64,${msg.data}`;
+        const img = _frameImg;
+        img.onload = () => {
+            ctx.drawImage(img, 0, 0, canvas.width, canvas.height);
+        };
+        img.onerror = () => {
+            session._droppedFrames++;
+        };
+        img.src = src;
+    }
+
+    // ── Quality Reporting ────────────────────────────────────────────────
+
+    function startQualityReporting(session) {
+        if (session._qualityTimer) clearInterval(session._qualityTimer);
+        session._qrPrevFrames = 0;
+        session._qrPrevBytes = 0;
+        session._qrPrevDropped = 0;
+        session._qrPrevTime = Date.now();
+        session._qualityTimer = setInterval(() => sendQualityReport(session), QUALITY_REPORT_INTERVAL);
+    }
+
+    function sendQualityReport(session) {
+        if (!session.connected || !session.sessionId) return;
+        const now = Date.now();
+        const elapsed = (now - session._qrPrevTime) / 1000;
+        if (elapsed <= 0) return;
+
+        const totalFrames = session._frameCount + (session._fps > 0 ? 0 : 0);
+        const frames = totalFrames - session._qrPrevFrames;
+        const bytes = session._frameBytes - session._qrPrevBytes;
+        const dropped = session._droppedFrames - session._qrPrevDropped;
+        const fps = Math.round(frames / elapsed);
+        const bandwidthKB = bytes / 1024 / elapsed;
+        const frameLoss = frames > 0 ? dropped / (frames + dropped) : 0;
+        const latencyMs = session._lastFrameTime > 0 ? Math.max(0, now - session._lastFrameTime) : 0;
+
+        sendMsg(session, {
+            type: 'quality_report',
+            session_id: session.sessionId,
+            bandwidth_kb: Math.round(bandwidthKB * 10) / 10,
+            latency_ms: latencyMs,
+            frame_loss: Math.round(frameLoss * 1000) / 1000,
+            fps: fps
+        });
+
+        session._qrPrevFrames = totalFrames;
+        session._qrPrevBytes = session._frameBytes;
+        session._qrPrevDropped = session._droppedFrames;
+        session._qrPrevTime = now;
+    }
+
+    // ── Codec Negotiation ────────────────────────────────────────────────
+
+    function sendCodecOffer(session) {
+        if (!session.sessionId) return;
+        sendMsg(session, {
+            type: 'codec_offer',
+            session_id: session.sessionId,
+            video: ['jpeg', 'png'],
+            audio: [],
+            preferred: 'jpeg'
+        });
+    }
+
+    // ── Keyframe Request ─────────────────────────────────────────────────
+
+    function requestKeyframe(deviceId, widgetId) {
+        const key = `${deviceId}:${widgetId}`;
+        const session = activeSessions[key];
+        if (!session || !session.connected || !session.sessionId) return;
+        sendMsg(session, {
+            type: 'keyframe_request',
+            session_id: session.sessionId
+        });
+    }
+
+    function sendMsg(session, payload) {
+        if (session.ws && session.ws.readyState === WebSocket.OPEN) {
+            session.ws.send(JSON.stringify(payload));
+        }
+    }
+
+    // ── Disconnect / Cleanup ─────────────────────────────────────────────
+
+    function setDisconnected(session) {
+        session.connected = false;
+        if (session._fpsTimer) {
+            clearInterval(session._fpsTimer);
+            session._fpsTimer = null;
+        }
+        if (session._qualityTimer) {
+            clearInterval(session._qualityTimer);
+            session._qualityTimer = null;
+        }
+        if (session.overlay) {
+            session.overlay.classList.remove('hidden');
+            session.overlay.querySelector('span:last-child').textContent =
+                window.BetterDesk?.t?.('cdap.disconnected') || 'Disconnected';
+        }
+        const connectDiv = session.widgetEl?.querySelector('.cdap-video-connect');
+        if (connectDiv) connectDiv.classList.remove('hidden');
+    }
+
+    function closeVideo(deviceId, widgetId) {
+        const key = `${deviceId}:${widgetId}`;
+        const session = activeSessions[key];
+        if (!session) return;
+
+        if (session.ws && session.ws.readyState === WebSocket.OPEN) {
+            session.ws.send(JSON.stringify({ type: 'close' }));
+            session.ws.close();
+        }
+        setDisconnected(session);
+        delete activeSessions[key];
+    }
+
+    // ── Public API ───────────────────────────────────────────────────────
+
+    window.CDAPVideo = {
+        open: openVideo,
+        close: closeVideo,
+        isActive: (deviceId, widgetId) => !!activeSessions[`${deviceId}:${widgetId}`],
+        getFps: (deviceId, widgetId) => {
+            const s = activeSessions[`${deviceId}:${widgetId}`];
+            return s ? s._fps : 0;
+        },
+        requestKeyframe: requestKeyframe
+    };
+
+})();
diff --git a/web-nodejs/public/js/cdap-widgets.js b/web-nodejs/public/js/cdap-widgets.js
index 88b27a65..4777f9cf 100644
--- a/web-nodejs/public/js/cdap-widgets.js
+++ b/web-nodejs/public/js/cdap-widgets.js
@@ -38,6 +38,8 @@
 
         loadDeviceInfo();
         loadManifestAndState();
+        loadLinkedDevices();
+        initLinkButton();
     }
 
     async function loadDeviceInfo() {
@@ -83,7 +85,14 @@
                 custom: 'memory'
             };
             const icon = iconMap[info.manifest.device.type] || 'memory';
-            typeEl.innerHTML = `<span class="material-icons">${icon}</span><span>${info.manifest.device.type}</span>`;
+            typeEl.textContent = '';
+            const iconEl = document.createElement('span');
+            iconEl.className = 'material-icons';
+            iconEl.textContent = icon;
+            const labelEl = document.createElement('span');
+            labelEl.textContent = info.manifest.device.type;
+            typeEl.appendChild(iconEl);
+            typeEl.appendChild(labelEl);
         }
 
         // Version
@@ -151,6 +160,7 @@
 
             renderWidgets();
             startStatePolling();
+            startAlertPolling();
 
         } catch (err) {
             console.error('CDAP manifest/state error:', err);
@@ -191,7 +201,7 @@
 
         // Show command log if any interactive widgets
         const hasInteractive = widgets.some(w =>
-            ['toggle', 'button', 'slider', 'select'].includes(w.type)
+            ['toggle', 'button', 'slider', 'select', 'file_browser'].includes(w.type)
         );
         if (hasInteractive) {
             const log = document.getElementById('cdap-command-log');
@@ -246,6 +256,24 @@
             case 'chart':
                 inner = renderChart(widget);
                 break;
+            case 'table':
+                inner = renderTable(widget);
+                break;
+            case 'terminal':
+                inner = renderTerminal(widget);
+                break;
+            case 'desktop':
+                inner = renderDesktop(widget);
+                break;
+            case 'video_stream':
+                inner = renderVideoStream(widget);
+                break;
+            case 'file_browser':
+                inner = renderFileBrowser(widget);
+                break;
+            case 'audio':
+                inner = renderAudioStream(widget);
+                break;
             default:
                 inner = `<div class="cdap-widget-unsupported">${escapeHtml(type)}</div>`;
         }
@@ -269,6 +297,12 @@
         // Default sizes by type
         switch (type) {
             case 'chart': return 'cdap-widget-lg';
+            case 'table': return 'cdap-widget-lg';
+            case 'terminal': return 'cdap-widget-lg';
+            case 'desktop': return 'cdap-widget-xl';
+            case 'video_stream': return 'cdap-widget-xl';
+            case 'file_browser': return 'cdap-widget-lg';
+            case 'audio': return 'cdap-widget-md';
             case 'text': return 'cdap-widget-sm';
             case 'led': return 'cdap-widget-sm';
             default: return '';
@@ -383,6 +417,137 @@
         return `<div class="cdap-chart-bars">${barsHtml}</div>`;
     }
 
+    function renderTable(widget) {
+        const columns = widget.columns || [];
+        const pageSize = widget.page_size || 25;
+        let headHtml = '';
+        for (const col of columns) {
+            const sortAttr = widget.sortable ? ` class="cdap-table-sortable" data-col="${escapeHtml(col.id || col.label)}"` : '';
+            headHtml += `<th${sortAttr}>${escapeHtml(col.label || col.id || '')}</th>`;
+        }
+        return `
+            <div class="cdap-table-toolbar">
+                <input type="text" class="cdap-table-search" placeholder="${t('cdap.table_search') || 'Search...'}" data-widget="${escapeHtml(widget.id)}">
+            </div>
+            <div class="cdap-table-wrap" id="wtable-${escapeHtml(widget.id)}">
+                <table class="cdap-table">
+                    <thead><tr>${headHtml}</tr></thead>
+                    <tbody id="wval-${escapeHtml(widget.id)}"></tbody>
+                </table>
+            </div>
+            <div class="cdap-table-pagination" id="wpag-${escapeHtml(widget.id)}" data-page="0" data-page-size="${pageSize}">
+                <button class="cdap-pag-btn cdap-pag-prev" disabled><span class="material-icons">chevron_left</span></button>
+                <span class="cdap-pag-info"></span>
+                <button class="cdap-pag-btn cdap-pag-next"><span class="material-icons">chevron_right</span></button>
+            </div>
+        `;
+    }
+
+    function renderTerminal(widget) {
+        return `
+            <div class="cdap-terminal" id="wval-${escapeHtml(widget.id)}">
+                <div class="cdap-terminal-output"></div>
+                <div class="cdap-terminal-connect">
+                    <button class="btn cdap-terminal-connect-btn" data-widget="${escapeHtml(widget.id)}">
+                        <span class="material-icons">terminal</span>
+                        <span>${t('cdap.connect_terminal') || 'Connect Terminal'}</span>
+                    </button>
+                </div>
+            </div>
+        `;
+    }
+
+    function renderDesktop(widget) {
+        return `
+            <div class="cdap-desktop-widget" id="wval-${escapeHtml(widget.id)}">
+                <div class="cdap-desktop-toolbar">
+                    <span class="cdap-desktop-clipboard-indicator hidden"></span>
+                </div>
+                <div class="cdap-desktop-canvas-wrap">
+                    <canvas class="cdap-desktop-canvas" width="1280" height="720"></canvas>
+                    <div class="cdap-desktop-overlay">
+                        <span class="material-icons">desktop_windows</span>
+                        <span>${t('cdap.disconnected')}</span>
+                    </div>
+                </div>
+                <div class="cdap-desktop-connect">
+                    <button class="btn cdap-desktop-connect-btn" data-widget="${escapeHtml(widget.id)}">
+                        <span class="material-icons">desktop_windows</span>
+                        <span>${t('cdap.connect_desktop') || 'Connect Desktop'}</span>
+                    </button>
+                </div>
+            </div>
+        `;
+    }
+
+    function renderVideoStream(widget) {
+        return `
+            <div class="cdap-video-widget" id="wval-${escapeHtml(widget.id)}">
+                <div class="cdap-video-container">
+                    <canvas class="cdap-video-canvas" width="640" height="480"></canvas>
+                    <div class="cdap-video-overlay">
+                        <span class="material-icons">videocam</span>
+                        <span>${t('cdap.disconnected')}</span>
+                    </div>
+                </div>
+                <div class="cdap-video-connect">
+                    <button class="btn cdap-video-connect-btn" data-widget="${escapeHtml(widget.id)}">
+                        <span class="material-icons">videocam</span>
+                        <span>${t('cdap.connect_video') || 'Connect Stream'}</span>
+                    </button>
+                </div>
+            </div>
+        `;
+    }
+
+    function renderFileBrowser(widget) {
+        return `
+            <div class="cdap-file-browser" id="wval-${escapeHtml(widget.id)}">
+                <div class="cdap-file-toolbar">
+                    <span class="cdap-file-path" id="wpath-${escapeHtml(widget.id)}">/</span>
+                    <button class="btn btn-sm cdap-file-up" data-action="browse" data-value="..">
+                        <span class="material-icons">arrow_upward</span>
+                    </button>
+                </div>
+                <div class="cdap-file-list" id="wlist-${escapeHtml(widget.id)}">
+                    <div class="cdap-file-empty">${t('cdap.disconnected')}</div>
+                </div>
+                <div class="cdap-file-connect">
+                    <button class="btn cdap-file-connect-btn" data-widget="${escapeHtml(widget.id)}">
+                        <span class="material-icons">folder_open</span>
+                        <span>${t('cdap.connect_files') || 'Browse Files'}</span>
+                    </button>
+                </div>
+            </div>
+        `;
+    }
+
+    function renderAudioStream(widget) {
+        return `
+            <div class="cdap-audio-widget" id="wval-${escapeHtml(widget.id)}">
+                <div class="cdap-audio-controls">
+                    <div class="cdap-audio-status disconnected">${t('cdap.disconnected')}</div>
+                    <div class="cdap-audio-level">
+                        <div class="cdap-audio-level-track">
+                            <div class="cdap-audio-level-fill low"></div>
+                        </div>
+                    </div>
+                    <div class="cdap-audio-buttons">
+                        <button class="btn btn-sm cdap-audio-mute-btn" data-widget="${escapeHtml(widget.id)}" title="Mute">
+                            <span class="material-icons">volume_up</span>
+                        </button>
+                    </div>
+                </div>
+                <div class="cdap-audio-connect">
+                    <button class="btn cdap-audio-connect-btn" data-widget="${escapeHtml(widget.id)}">
+                        <span class="material-icons">headphones</span>
+                        <span>${t('cdap.connect_audio') || 'Connect Audio'}</span>
+                    </button>
+                </div>
+            </div>
+        `;
+    }
+
     // ── State Polling & Application ──────────────────────────────────────
 
     function startStatePolling() {
@@ -438,6 +603,21 @@
                 case 'chart':
                     applyChartState(el, widget, val);
                     break;
+                case 'table':
+                    applyTableState(el, widget, val);
+                    break;
+                case 'terminal':
+                    applyTerminalState(el, widget, val);
+                    break;
+                case 'desktop':
+                    applyDesktopState(el, widget, val);
+                    break;
+                case 'video_stream':
+                    applyVideoStreamState(el, widget, val);
+                    break;
+                case 'file_browser':
+                    applyFileBrowserState(el, widget, val);
+                    break;
             }
         }
     }
@@ -521,6 +701,210 @@
         }
     }
 
+    // ── Table data store per widget (for pagination/search) ─────────────
+    const _tableData = {};
+
+    function applyTableState(el, widget, val) {
+        const tbody = document.getElementById(`wval-${widget.id}`);
+        if (!tbody || !Array.isArray(val)) return;
+        const columns = widget.columns || [];
+
+        // Store full dataset for search/pagination
+        _tableData[widget.id] = val;
+
+        // Apply search filter
+        const searchInput = el.querySelector('.cdap-table-search');
+        const searchTerm = (searchInput?.value || '').toLowerCase();
+        let filtered = val;
+        if (searchTerm) {
+            filtered = val.filter(row => {
+                for (const col of columns) {
+                    const v = String(row[col.id] ?? row[col.label] ?? '').toLowerCase();
+                    if (v.includes(searchTerm)) return true;
+                }
+                return false;
+            });
+        }
+
+        // Pagination
+        const pagEl = document.getElementById(`wpag-${widget.id}`);
+        const pageSize = parseInt(pagEl?.dataset.pageSize || '25', 10);
+        let page = parseInt(pagEl?.dataset.page || '0', 10);
+        const totalPages = Math.max(1, Math.ceil(filtered.length / pageSize));
+        if (page >= totalPages) page = totalPages - 1;
+        if (page < 0) page = 0;
+        if (pagEl) pagEl.dataset.page = String(page);
+
+        const start = page * pageSize;
+        const rows = filtered.slice(start, start + pageSize);
+
+        // Render rows with column type support
+        let html = '';
+        for (const row of rows) {
+            html += '<tr>';
+            for (const col of columns) {
+                const cellVal = row[col.id] ?? row[col.label] ?? '';
+                html += `<td>${renderTableCell(cellVal, col, widget)}</td>`;
+            }
+            html += '</tr>';
+        }
+        tbody.innerHTML = html || '<tr><td colspan="' + columns.length + '" class="cdap-table-empty">—</td></tr>';
+
+        // Update pagination info
+        if (pagEl) {
+            const info = pagEl.querySelector('.cdap-pag-info');
+            if (info) {
+                if (filtered.length === 0) {
+                    info.textContent = '0 / 0';
+                } else {
+                    info.textContent = `${start + 1}–${Math.min(start + pageSize, filtered.length)} / ${filtered.length}`;
+                }
+            }
+            const prevBtn = pagEl.querySelector('.cdap-pag-prev');
+            const nextBtn = pagEl.querySelector('.cdap-pag-next');
+            if (prevBtn) prevBtn.disabled = page === 0;
+            if (nextBtn) nextBtn.disabled = page >= totalPages - 1;
+
+            // Hide pagination when only one page
+            pagEl.style.display = totalPages <= 1 ? 'none' : '';
+        }
+    }
+
+    function renderTableCell(val, col, widget) {
+        const type = col.type || 'text';
+        switch (type) {
+            case 'badge': {
+                const color = col.colors?.[val] || col.color || 'var(--accent)';
+                return `<span class="cdap-badge" style="--badge-color:${escapeHtml(color)}">${escapeHtml(String(val))}</span>`;
+            }
+            case 'datetime': {
+                if (!val) return '—';
+                const d = new Date(val);
+                if (isNaN(d.getTime())) return escapeHtml(String(val));
+                return `<time datetime="${d.toISOString()}" title="${d.toLocaleString()}">${formatRelativeTime(d)}</time>`;
+            }
+            case 'number': {
+                const num = parseFloat(val);
+                if (isNaN(num)) return escapeHtml(String(val));
+                const precision = col.decimals ?? 0;
+                const suffix = col.suffix || '';
+                return `<span class="cdap-number">${num.toFixed(precision)}${escapeHtml(suffix)}</span>`;
+            }
+            case 'action': {
+                const actions = col.actions || [{ label: col.label, action: col.action || 'execute' }];
+                return actions.map(a =>
+                    `<button class="cdap-table-action" data-widget="${escapeHtml(widget.id)}" data-action="${escapeHtml(a.action || 'execute')}" data-row-val="${escapeHtml(String(val))}">${escapeHtml(a.label || 'Action')}</button>`
+                ).join(' ');
+            }
+            case 'boolean': {
+                const on = val === true || val === 1 || val === 'true' || val === 'on';
+                return `<span class="cdap-led-light ${on ? 'on' : 'off'}" style="display:inline-block;width:10px;height:10px;border-radius:50%;"></span>`;
+            }
+            default:
+                return escapeHtml(String(val));
+        }
+    }
+
+    function formatRelativeTime(date) {
+        const now = Date.now();
+        const diff = now - date.getTime();
+        if (diff < 60000) return t('cdap.just_now') || 'Just now';
+        if (diff < 3600000) return Math.floor(diff / 60000) + 'm ago';
+        if (diff < 86400000) return Math.floor(diff / 3600000) + 'h ago';
+        return date.toLocaleDateString();
+    }
+
+    function applyTerminalState(el, widget, val) {
+        // If CDAPTerminal (xterm.js) is active for this widget, skip — xterm handles its own output via WS
+        if (window.CDAPTerminal?.isActive(deviceId, widget.id)) return;
+
+        // Legacy line-based rendering for non-interactive terminals
+        const container = el.querySelector('.cdap-terminal-output');
+        if (!container) return;
+        if (Array.isArray(val)) {
+            container.innerHTML = val.map(line => `<div class="cdap-terminal-line">${escapeHtml(String(line))}</div>`).join('');
+        } else if (typeof val === 'string') {
+            container.innerHTML += `<div class="cdap-terminal-line">${escapeHtml(val)}</div>`;
+            // Auto-scroll to bottom
+            const term = el.querySelector('.cdap-terminal');
+            if (term) term.scrollTop = term.scrollHeight;
+        }
+        // Limit lines
+        const lines = container.querySelectorAll('.cdap-terminal-line');
+        const maxLines = 500;
+        if (lines.length > maxLines) {
+            for (let i = 0; i < lines.length - maxLines; i++) {
+                lines[i].remove();
+            }
+        }
+    }
+
+    function applyDesktopState(el, widget, val) {
+        // val is expected to have { connected, frame_url } or { connected: false }
+        const overlay = el.querySelector('.cdap-desktop-overlay');
+        if (typeof val === 'object' && val.connected) {
+            if (overlay) overlay.classList.add('hidden');
+        } else {
+            if (overlay) overlay.classList.remove('hidden');
+        }
+    }
+
+    function applyVideoStreamState(el, widget, val) {
+        // val is expected to have { url } for MJPEG/snapshot URL or { connected: false }
+        const overlay = el.querySelector('.cdap-video-overlay');
+        const img = el.querySelector('.cdap-video-frame');
+        if (typeof val === 'object' && val.url) {
+            if (img) {
+                // Append timestamp to prevent caching for snapshot mode
+                const sep = val.url.includes('?') ? '&' : '?';
+                img.src = val.url + sep + '_t=' + Date.now();
+                img.classList.remove('hidden');
+            }
+            if (overlay) overlay.classList.add('hidden');
+        } else {
+            if (img) img.classList.add('hidden');
+            if (overlay) overlay.classList.remove('hidden');
+        }
+    }
+
+    function applyFileBrowserState(el, widget, val) {
+        // val is expected to be { path, entries: [{ name, type, size }] }
+        if (typeof val !== 'object') return;
+        const pathEl = document.getElementById(`wpath-${widget.id}`);
+        const listEl = document.getElementById(`wlist-${widget.id}`);
+        if (pathEl && val.path) pathEl.textContent = val.path;
+        if (!listEl || !Array.isArray(val.entries)) return;
+        if (val.entries.length === 0) {
+            listEl.innerHTML = '<div class="cdap-file-empty">Empty directory</div>';
+            return;
+        }
+        // Sort: directories first, then files
+        const sorted = [...val.entries].sort((a, b) => {
+            if (a.type === 'dir' && b.type !== 'dir') return -1;
+            if (a.type !== 'dir' && b.type === 'dir') return 1;
+            return (a.name || '').localeCompare(b.name || '');
+        });
+        let html = '';
+        for (const entry of sorted) {
+            const icon = entry.type === 'dir' ? 'folder' : 'description';
+            const size = entry.type === 'dir' ? '' : formatFileSize(entry.size || 0);
+            html += `<div class="cdap-file-entry" data-name="${escapeHtml(entry.name)}" data-type="${escapeHtml(entry.type || 'file')}">
+                <span class="material-icons cdap-file-icon">${icon}</span>
+                <span class="cdap-file-name">${escapeHtml(entry.name)}</span>
+                <span class="cdap-file-size">${size}</span>
+            </div>`;
+        }
+        listEl.innerHTML = html;
+    }
+
+    function formatFileSize(bytes) {
+        if (bytes === 0) return '0 B';
+        const k = 1024;
+        const sizes = ['B', 'KB', 'MB', 'GB'];
+        const i = Math.floor(Math.log(bytes) / Math.log(k));
+        return parseFloat((bytes / Math.pow(k, i)).toFixed(1)) + ' ' + sizes[i];
+    }
+
     // ── Event Binding ────────────────────────────────────────────────────
 
     function bindWidgetEvents() {
@@ -581,6 +965,167 @@
                 setTimeout(() => { select._userInteracting = false; }, 2000);
             });
         });
+
+        // File browser navigation
+        document.querySelectorAll('.cdap-file-up').forEach(btn => {
+            btn.addEventListener('click', (e) => {
+                const widgetEl = e.target.closest('.cdap-widget');
+                if (!widgetEl) return;
+                const wid = widgetEl.dataset.widgetId;
+                window.CDAPCommands?.send(deviceId, wid, 'browse', '..');
+            });
+        });
+
+        document.querySelectorAll('.cdap-file-list').forEach(list => {
+            list.addEventListener('click', (e) => {
+                const entry = e.target.closest('.cdap-file-entry');
+                if (!entry || entry.dataset.type !== 'dir') return;
+                const widgetEl = list.closest('.cdap-widget');
+                if (!widgetEl) return;
+                const wid = widgetEl.dataset.widgetId;
+                window.CDAPCommands?.send(deviceId, wid, 'browse', entry.dataset.name);
+            });
+        });
+
+        // Table sortable headers
+        document.querySelectorAll('.cdap-table-sortable').forEach(th => {
+            th.addEventListener('click', () => {
+                const table = th.closest('.cdap-table');
+                if (!table) return;
+                const colIdx = Array.from(th.parentNode.children).indexOf(th);
+                const tbody = table.querySelector('tbody');
+                if (!tbody) return;
+                const rows = Array.from(tbody.querySelectorAll('tr'));
+                const asc = !th.classList.contains('sort-asc');
+                th.parentNode.querySelectorAll('th').forEach(h => h.classList.remove('sort-asc', 'sort-desc'));
+                th.classList.add(asc ? 'sort-asc' : 'sort-desc');
+                rows.sort((a, b) => {
+                    const aVal = a.children[colIdx]?.textContent || '';
+                    const bVal = b.children[colIdx]?.textContent || '';
+                    const cmp = aVal.localeCompare(bVal, undefined, { numeric: true });
+                    return asc ? cmp : -cmp;
+                });
+                rows.forEach(r => tbody.appendChild(r));
+            });
+        });
+
+        // Table pagination buttons
+        document.querySelectorAll('.cdap-table-pagination').forEach(pagEl => {
+            const widgetId = pagEl.id.replace('wpag-', '');
+            const widgetEl = document.querySelector(`[data-widget-id="${CSS.escape(widgetId)}"]`);
+            const widget = manifest?.widgets?.find(w => w.id === widgetId);
+            if (!widgetEl || !widget) return;
+
+            pagEl.querySelector('.cdap-pag-prev')?.addEventListener('click', () => {
+                let page = parseInt(pagEl.dataset.page || '0', 10);
+                if (page > 0) {
+                    pagEl.dataset.page = String(page - 1);
+                    applyTableState(widgetEl, widget, _tableData[widgetId] || []);
+                }
+            });
+            pagEl.querySelector('.cdap-pag-next')?.addEventListener('click', () => {
+                let page = parseInt(pagEl.dataset.page || '0', 10);
+                pagEl.dataset.page = String(page + 1);
+                applyTableState(widgetEl, widget, _tableData[widgetId] || []);
+            });
+        });
+
+        // Table search inputs (debounced)
+        document.querySelectorAll('.cdap-table-search').forEach(input => {
+            let debounce = null;
+            input.addEventListener('input', () => {
+                clearTimeout(debounce);
+                debounce = setTimeout(() => {
+                    const widgetId = input.dataset.widget;
+                    const widgetEl = document.querySelector(`[data-widget-id="${CSS.escape(widgetId)}"]`);
+                    const widget = manifest?.widgets?.find(w => w.id === widgetId);
+                    if (!widgetEl || !widget) return;
+                    // Reset to first page on search
+                    const pagEl = document.getElementById(`wpag-${widgetId}`);
+                    if (pagEl) pagEl.dataset.page = '0';
+                    applyTableState(widgetEl, widget, _tableData[widgetId] || []);
+                }, 250);
+            });
+        });
+
+        // Table action column buttons (delegated)
+        document.addEventListener('click', (e) => {
+            const btn = e.target.closest('.cdap-table-action');
+            if (!btn) return;
+            const wid = btn.dataset.widget;
+            const action = btn.dataset.action;
+            const rowVal = btn.dataset.rowVal;
+            if (wid && action) {
+                window.CDAPCommands?.send(deviceId, wid, action, rowVal);
+            }
+        });
+
+        // Terminal connect buttons
+        document.querySelectorAll('.cdap-terminal-connect-btn').forEach(btn => {
+            btn.addEventListener('click', () => {
+                const wid = btn.dataset.widget;
+                if (wid && window.CDAPTerminal) {
+                    btn.closest('.cdap-terminal-connect')?.classList.add('hidden');
+                    window.CDAPTerminal.open(deviceId, wid);
+                }
+            });
+        });
+
+        // Desktop connect buttons
+        document.querySelectorAll('.cdap-desktop-connect-btn').forEach(btn => {
+            btn.addEventListener('click', () => {
+                const wid = btn.dataset.widget;
+                if (wid && window.CDAPDesktop) {
+                    btn.closest('.cdap-desktop-connect')?.classList.add('hidden');
+                    window.CDAPDesktop.open(deviceId, wid);
+                }
+            });
+        });
+
+        // Video stream connect buttons
+        document.querySelectorAll('.cdap-video-connect-btn').forEach(btn => {
+            btn.addEventListener('click', () => {
+                const wid = btn.dataset.widget;
+                if (wid && window.CDAPVideo) {
+                    btn.closest('.cdap-video-connect')?.classList.add('hidden');
+                    window.CDAPVideo.open(deviceId, wid);
+                }
+            });
+        });
+
+        // File browser connect buttons
+        document.querySelectorAll('.cdap-file-connect-btn').forEach(btn => {
+            btn.addEventListener('click', () => {
+                const wid = btn.dataset.widget;
+                if (wid && window.CDAPFileBrowser) {
+                    btn.closest('.cdap-file-connect')?.classList.add('hidden');
+                    window.CDAPFileBrowser.open(deviceId, wid);
+                }
+            });
+        });
+
+        // Audio connect buttons
+        document.querySelectorAll('.cdap-audio-connect-btn').forEach(btn => {
+            btn.addEventListener('click', () => {
+                const wid = btn.dataset.widget;
+                if (wid && window.CDAPAudio) {
+                    btn.closest('.cdap-audio-connect')?.classList.add('hidden');
+                    window.CDAPAudio.open(deviceId, wid);
+                }
+            });
+        });
+
+        // Audio mute buttons
+        document.querySelectorAll('.cdap-audio-mute-btn').forEach(btn => {
+            btn.addEventListener('click', () => {
+                const wid = btn.dataset.widget;
+                if (wid && window.CDAPAudio) {
+                    const muted = window.CDAPAudio.toggleMute(deviceId, wid);
+                    const icon = btn.querySelector('.material-icons');
+                    if (icon) icon.textContent = muted ? 'volume_off' : 'volume_up';
+                }
+            });
+        });
     }
 
     // ── Utilities ────────────────────────────────────────────────────────
@@ -604,6 +1149,164 @@
         return `${s}s`;
     }
 
+    // ── Alert Polling & Rendering ──────────────────────────────────────
+
+    let alertPollTimer = null;
+    const ALERT_POLL_INTERVAL = 5000;
+
+    function startAlertPolling() {
+        pollAlerts();
+        if (alertPollTimer) clearInterval(alertPollTimer);
+        alertPollTimer = setInterval(pollAlerts, ALERT_POLL_INTERVAL);
+    }
+
+    async function pollAlerts() {
+        try {
+            const res = await fetch(`/api/cdap/alerts?device_id=${encodeURIComponent(deviceId)}`, {
+                headers: { 'X-CSRF-Token': window.BetterDesk?.csrfToken || '' }
+            });
+            if (!res.ok) return;
+            const data = await res.json();
+            const alerts = data?.data?.alerts || data?.alerts || [];
+            renderAlerts(alerts);
+        } catch (err) {
+            // Silent fail
+        }
+    }
+
+    function renderAlerts(alerts) {
+        const panel = document.getElementById('cdap-alerts-panel');
+        const list = document.getElementById('cdap-alerts-list');
+        const count = document.getElementById('cdap-alerts-count');
+        if (!panel || !list) return;
+
+        const firing = alerts.filter(a => a.firing);
+        panel.classList.toggle('hidden', firing.length === 0);
+        if (count) count.textContent = firing.length;
+
+        if (firing.length === 0) {
+            list.innerHTML = '';
+            return;
+        }
+
+        const severityOrder = { critical: 0, warning: 1, info: 2 };
+        firing.sort((a, b) => (severityOrder[a.severity] || 3) - (severityOrder[b.severity] || 3));
+
+        list.innerHTML = firing.map(a => {
+            const icon = a.severity === 'critical' ? 'error' : a.severity === 'warning' ? 'warning' : 'info';
+            const time = a.fired_at ? new Date(a.fired_at).toLocaleTimeString() : '';
+            return `
+                <div class="cdap-alert-item cdap-alert-${escapeHtml(a.severity)}">
+                    <span class="material-icons cdap-alert-icon">${icon}</span>
+                    <div class="cdap-alert-body">
+                        <span class="cdap-alert-label">${escapeHtml(a.label)}</span>
+                        <span class="cdap-alert-msg">${escapeHtml(a.message)}</span>
+                    </div>
+                    <span class="cdap-alert-time">${time}</span>
+                </div>
+            `;
+        }).join('');
+    }
+
+    // ── Linked Devices ─────────────────────────────────────────────────
+
+    async function loadLinkedDevices() {
+        try {
+            const res = await fetch(`/api/cdap/devices/${encodeURIComponent(deviceId)}/linked`, {
+                headers: { 'X-CSRF-Token': window.BetterDesk?.csrfToken || '' }
+            });
+            if (!res.ok) return;
+            const data = await res.json();
+            renderLinkedDevices(data?.data?.linked || data?.linked || []);
+        } catch (err) {
+            console.error('CDAP linked devices error:', err);
+        }
+    }
+
+    function renderLinkedDevices(linked) {
+        const list = document.getElementById('cdap-linked-list');
+        const count = document.getElementById('cdap-linked-count');
+        const empty = document.getElementById('cdap-linked-empty');
+        if (!list) return;
+
+        if (count) count.textContent = linked.length;
+
+        if (linked.length === 0) {
+            if (empty) empty.classList.remove('hidden');
+            list.querySelectorAll('.cdap-linked-item').forEach(el => el.remove());
+            return;
+        }
+
+        if (empty) empty.classList.add('hidden');
+
+        const html = linked.map(p => {
+            const online = p.live_online || p.status === 'online';
+            const statusClass = online ? 'online' : 'offline';
+            const name = escapeHtml(p.hostname || p.id);
+            const platform = escapeHtml(p.platform || '');
+            return `
+                <div class="cdap-linked-item" data-peer-id="${escapeHtml(p.id)}">
+                    <span class="cdap-linked-status ${statusClass}"></span>
+                    <div class="cdap-linked-info">
+                        <span class="cdap-linked-name">${name}</span>
+                        <span class="cdap-linked-id">${escapeHtml(p.id)}</span>
+                    </div>
+                    ${platform ? `<span class="cdap-linked-platform">${platform}</span>` : ''}
+                    <button class="btn-icon cdap-unlink-btn" data-peer-id="${escapeHtml(p.id)}" title="${t('cdap.unlink_device')}">
+                        <span class="material-icons">link_off</span>
+                    </button>
+                </div>
+            `;
+        }).join('');
+
+        // Keep the empty state element, replace linked items
+        list.querySelectorAll('.cdap-linked-item').forEach(el => el.remove());
+        list.insertAdjacentHTML('beforeend', html);
+
+        // Bind unlink buttons
+        list.querySelectorAll('.cdap-unlink-btn').forEach(btn => {
+            btn.addEventListener('click', async () => {
+                const peerId = btn.dataset.peerId;
+                if (!confirm(t('cdap.unlink_confirm'))) return;
+                try {
+                    const res = await fetch(`/api/cdap/devices/${encodeURIComponent(peerId)}/link`, {
+                        method: 'POST',
+                        headers: {
+                            'Content-Type': 'application/json',
+                            'X-CSRF-Token': window.BetterDesk?.csrfToken || ''
+                        },
+                        body: JSON.stringify({ linked_peer_id: '' })
+                    });
+                    if (res.ok) loadLinkedDevices();
+                } catch (err) {
+                    console.error('Unlink error:', err);
+                }
+            });
+        });
+    }
+
+    function initLinkButton() {
+        const btn = document.getElementById('cdap-link-btn');
+        if (!btn) return;
+        btn.addEventListener('click', async () => {
+            const peerId = prompt(t('cdap.link_prompt'));
+            if (!peerId || !peerId.trim()) return;
+            try {
+                const res = await fetch(`/api/cdap/devices/${encodeURIComponent(peerId.trim())}/link`, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'X-CSRF-Token': window.BetterDesk?.csrfToken || ''
+                    },
+                    body: JSON.stringify({ linked_peer_id: deviceId })
+                });
+                if (res.ok) loadLinkedDevices();
+            } catch (err) {
+                console.error('Link error:', err);
+            }
+        });
+    }
+
     // ── Public API ───────────────────────────────────────────────────────
 
     window.CDAPWidgets = {
@@ -625,5 +1328,6 @@
     window.addEventListener('beforeunload', () => {
         if (statePollTimer) clearInterval(statePollTimer);
         if (infoPollTimer) clearInterval(infoPollTimer);
+        if (alertPollTimer) clearInterval(alertPollTimer);
     });
 })();
diff --git a/web-nodejs/public/js/dataguard.js b/web-nodejs/public/js/dataguard.js
new file mode 100644
index 00000000..1982e431
--- /dev/null
+++ b/web-nodejs/public/js/dataguard.js
@@ -0,0 +1,267 @@
+/**
+ * BetterDesk Console - DataGuard Page Script
+ */
+
+(function () {
+    'use strict';
+
+    const _ = window.BetterDesk?.translations
+        ? (key) => {
+            const keys = key.split('.');
+            let val = window.BetterDesk.translations;
+            for (const k of keys) { val = val?.[k]; }
+            return val || key;
+        }
+        : (key) => key;
+
+    const csrfToken = window.BetterDesk?.csrfToken || '';
+
+    async function apiFetch(url, options = {}) {
+        const headers = { 'Content-Type': 'application/json' };
+        if (csrfToken) headers['x-csrf-token'] = csrfToken;
+        const resp = await fetch(url, { ...options, headers: { ...headers, ...options.headers } });
+        return resp.json();
+    }
+
+    function escapeHtml(str) {
+        if (!str) return '';
+        const div = document.createElement('div');
+        div.textContent = String(str);
+        return div.innerHTML;
+    }
+
+    function formatTimeAgo(dateStr) {
+        if (!dateStr) return '—';
+        const d = new Date(dateStr);
+        const diff = Math.floor((Date.now() - d) / 1000);
+        if (diff < 60) return _('time.seconds_ago').replace('{count}', diff);
+        if (diff < 3600) return _('time.minutes_ago').replace('{count}', Math.floor(diff / 60));
+        if (diff < 86400) return _('time.hours_ago').replace('{count}', Math.floor(diff / 3600));
+        if (diff < 2592000) return _('time.days_ago').replace('{count}', Math.floor(diff / 86400));
+        return d.toLocaleDateString();
+    }
+
+    function showToast(message, type) {
+        if (window.BetterDesk?.notify) { window.BetterDesk.notify(message, type); return; }
+        const container = document.getElementById('toast-container');
+        if (!container) return;
+        const toast = document.createElement('div');
+        toast.className = `toast toast-${type || 'info'}`;
+        toast.textContent = message;
+        container.appendChild(toast);
+        setTimeout(() => toast.remove(), 4000);
+    }
+
+    // ---- Tab switching ----
+    document.querySelectorAll('.tab-btn').forEach(btn => {
+        btn.addEventListener('click', () => {
+            document.querySelectorAll('.tab-btn').forEach(b => b.classList.remove('active'));
+            document.querySelectorAll('.tab-panel').forEach(p => p.classList.remove('active'));
+            btn.classList.add('active');
+            const panel = document.getElementById('tab-' + btn.dataset.tab);
+            if (panel) panel.classList.add('active');
+            if (btn.dataset.tab === 'policies') loadPolicies();
+            else if (btn.dataset.tab === 'events') loadEvents();
+        });
+    });
+
+    // ---- Modal close ----
+    document.querySelectorAll('.modal-close').forEach(btn => {
+        btn.addEventListener('click', () => {
+            const id = btn.dataset.modal;
+            if (id) document.getElementById(id).style.display = 'none';
+        });
+    });
+
+    // ==== Stats ====
+    async function loadStats() {
+        try {
+            const stats = await apiFetch('/api/dataguard/stats');
+            document.getElementById('stat-policies').textContent = stats.total_policies ?? 0;
+            document.getElementById('stat-active').textContent = stats.active_policies ?? 0;
+            document.getElementById('stat-violations').textContent = stats.violations ?? 0;
+            document.getElementById('stat-blocked').textContent = stats.blocked ?? 0;
+        } catch (_e) { /* ignore */ }
+    }
+
+    // ==== Policies ====
+
+    const policiesBody = document.getElementById('policies-body');
+    const createBtn = document.getElementById('create-policy-btn');
+    const policyModal = document.getElementById('policy-modal');
+    const saveBtn = document.getElementById('policy-save-btn');
+    const policySearch = document.getElementById('policy-search');
+    let allPolicies = [];
+
+    async function loadPolicies() {
+        policiesBody.innerHTML = `<tr class="loading-row"><td colspan="7">${_('common.loading')}</td></tr>`;
+        try {
+            const data = await apiFetch('/api/dataguard/policies');
+            allPolicies = Array.isArray(data) ? data : [];
+            filterPolicies();
+        } catch (err) {
+            policiesBody.innerHTML = `<tr class="empty-row"><td colspan="7">
+                <div class="empty-state"><span class="material-icons">error_outline</span><p>${escapeHtml(err.message)}</p></div></td></tr>`;
+        }
+    }
+
+    function filterPolicies() {
+        const q = policySearch.value.toLowerCase();
+        const filtered = q ? allPolicies.filter(p => (p.name + p.description).toLowerCase().includes(q)) : allPolicies;
+        renderPolicies(filtered);
+    }
+
+    function renderPolicies(policies) {
+        if (!policies.length) {
+            policiesBody.innerHTML = `<tr class="empty-row"><td colspan="7">
+                <div class="empty-state"><span class="material-icons">policy</span><p>${_('dataguard.no_policies')}</p></div></td></tr>`;
+            return;
+        }
+        policiesBody.innerHTML = policies.map(p => `
+            <tr data-id="${p.id}">
+                <td>${escapeHtml(p.name)}</td>
+                <td><span class="dg-type-badge">${escapeHtml(p.policy_type || p.type)}</span></td>
+                <td><span class="dg-action-badge ${p.action}">${_('dataguard.action_' + p.action) || p.action}</span></td>
+                <td>${escapeHtml(p.scope || _('dataguard.scope_all'))}</td>
+                <td><span class="policy-status ${p.enabled ? 'active' : 'disabled'}"><span class="dot"></span> ${p.enabled ? _('dataguard.active') : _('dataguard.disabled')}</span></td>
+                <td class="violations-count ${(p.events_count || 0) > 50 ? 'high' : ''}">${p.events_count || 0}</td>
+                <td class="action-btn-group">
+                    <button class="btn btn-sm btn-secondary edit-btn" data-id="${p.id}"><span class="material-icons" style="font-size:16px">edit</span></button>
+                    <button class="btn btn-sm btn-danger del-btn" data-id="${p.id}"><span class="material-icons" style="font-size:16px">delete</span></button>
+                </td>
+            </tr>
+        `).join('');
+
+        policiesBody.querySelectorAll('.edit-btn').forEach(btn => btn.addEventListener('click', () => editPolicy(btn.dataset.id)));
+        policiesBody.querySelectorAll('.del-btn').forEach(btn => btn.addEventListener('click', () => deletePolicy(btn.dataset.id)));
+    }
+
+    function openPolicyModal(p) {
+        document.getElementById('policy-modal-title').textContent = p ? _('dataguard.edit_policy') : _('dataguard.create_policy');
+        document.getElementById('policy-id').value = p ? p.id : '';
+        document.getElementById('policy-name').value = p ? p.name : '';
+        document.getElementById('policy-desc').value = p ? p.description || '' : '';
+        document.getElementById('policy-type').value = p ? p.policy_type || p.type : 'usb';
+        document.getElementById('policy-action').value = p ? p.action : 'log';
+        document.getElementById('policy-scope').value = p ? p.scope || '' : '';
+        document.getElementById('policy-rules').value = p ? (typeof p.rules === 'string' ? p.rules : JSON.stringify(p.rules || [], null, 2)) : '';
+        document.getElementById('policy-enabled').checked = p ? !!p.enabled : true;
+        policyModal.style.display = 'flex';
+    }
+
+    async function editPolicy(id) {
+        try {
+            const p = await apiFetch(`/api/dataguard/policies/${id}`);
+            openPolicyModal(p);
+        } catch (err) { showToast(err.message, 'error'); }
+    }
+
+    async function savePolicy() {
+        const id = document.getElementById('policy-id').value;
+        let rules;
+        try {
+            const raw = document.getElementById('policy-rules').value.trim();
+            rules = raw ? JSON.parse(raw) : [];
+        } catch (_e) {
+            showToast(_('common.invalid_json'), 'error');
+            return;
+        }
+
+        const body = {
+            name: document.getElementById('policy-name').value.trim(),
+            description: document.getElementById('policy-desc').value.trim(),
+            policy_type: document.getElementById('policy-type').value,
+            action: document.getElementById('policy-action').value,
+            scope: document.getElementById('policy-scope').value.trim() || null,
+            rules,
+            enabled: document.getElementById('policy-enabled').checked,
+        };
+
+        if (!body.name) { showToast(_('common.name_required'), 'error'); return; }
+
+        try {
+            const url = id ? `/api/dataguard/policies/${id}` : '/api/dataguard/policies';
+            const method = id ? 'PATCH' : 'POST';
+            await apiFetch(url, { method, body: JSON.stringify(body) });
+            policyModal.style.display = 'none';
+            showToast(_('common.saved'), 'success');
+            loadPolicies();
+            loadStats();
+        } catch (err) { showToast(err.message, 'error'); }
+    }
+
+    async function deletePolicy(id) {
+        if (!confirm(_('dataguard.delete_policy') + '?')) return;
+        try {
+            await apiFetch(`/api/dataguard/policies/${id}`, { method: 'DELETE' });
+            showToast(_('common.success'), 'success');
+            loadPolicies();
+            loadStats();
+        } catch (err) { showToast(err.message, 'error'); }
+    }
+
+    createBtn.addEventListener('click', () => openPolicyModal(null));
+    saveBtn.addEventListener('click', savePolicy);
+    policySearch.addEventListener('input', filterPolicies);
+
+    // ==== Events ====
+
+    const eventsBody = document.getElementById('events-body');
+    const eventSearch = document.getElementById('event-search');
+    let allEvents = [];
+    let eventActionFilter = '';
+
+    async function loadEvents() {
+        eventsBody.innerHTML = `<tr class="loading-row"><td colspan="5">${_('common.loading')}</td></tr>`;
+        const params = new URLSearchParams();
+        if (eventActionFilter) params.set('event_type', eventActionFilter);
+
+        try {
+            const data = await apiFetch(`/api/dataguard/events?${params}`);
+            allEvents = Array.isArray(data) ? data : [];
+            filterEvents();
+        } catch (err) {
+            eventsBody.innerHTML = `<tr class="empty-row"><td colspan="5">
+                <div class="empty-state"><span class="material-icons">error_outline</span><p>${escapeHtml(err.message)}</p></div></td></tr>`;
+        }
+    }
+
+    function filterEvents() {
+        const q = eventSearch.value.toLowerCase();
+        const filtered = q ? allEvents.filter(e => ((e.device_id || '') + (e.policy_name || '') + (typeof e.details === 'string' ? e.details : JSON.stringify(e.details || ''))).toLowerCase().includes(q)) : allEvents;
+        renderEvents(filtered);
+    }
+
+    function renderEvents(events) {
+        if (!events.length) {
+            eventsBody.innerHTML = `<tr class="empty-row"><td colspan="5">
+                <div class="empty-state"><span class="material-icons">shield</span><p>${_('dataguard.no_events')}</p></div></td></tr>`;
+            return;
+        }
+        eventsBody.innerHTML = events.map(e => `
+            <tr>
+                <td class="time-cell">${formatTimeAgo(e.created_at)}</td>
+                <td>${escapeHtml(e.device_id || '—')}</td>
+                <td>${escapeHtml(e.policy_name || '—')}</td>
+                <td><span class="dg-action-badge ${e.action}">${_('dataguard.action_' + e.action) || e.action}</span></td>
+                <td class="event-detail" title="${escapeHtml(typeof e.details === 'object' ? JSON.stringify(e.details) : (e.details || ''))}">${escapeHtml(typeof e.details === 'object' ? JSON.stringify(e.details) : (e.details || '—'))}</td>
+            </tr>
+        `).join('');
+    }
+
+    // Event action filter buttons
+    document.querySelectorAll('#event-action-filter .filter-btn').forEach(btn => {
+        btn.addEventListener('click', () => {
+            document.querySelectorAll('#event-action-filter .filter-btn').forEach(b => b.classList.remove('active'));
+            btn.classList.add('active');
+            eventActionFilter = btn.dataset.action;
+            loadEvents();
+        });
+    });
+
+    eventSearch.addEventListener('input', filterEvents);
+
+    // ---- Init ----
+    loadPolicies();
+    loadStats();
+})();
diff --git a/web-nodejs/public/js/desktop-mode.js b/web-nodejs/public/js/desktop-mode.js
index a873c89a..961aa5d8 100644
--- a/web-nodejs/public/js/desktop-mode.js
+++ b/web-nodejs/public/js/desktop-mode.js
@@ -1,7 +1,10 @@
 /**
- * BetterDesk Console - Desktop Mode
+ * BetterDesk Console - Desktop Mode (BETA)
  * Windows-like desktop environment with floating windows, taskbar, and app icons.
  * Available on viewports >= 1200px.
+ * 
+ * Status: BETA - Experimental feature, under active development.
+ * Known limitations: iframe-based routing, mobile not supported, performance with many windows.
  */
 
 (function() {
@@ -16,6 +19,7 @@
     const STORAGE_KEY = 'betterdesk_desktop_mode';
     const STORAGE_WINS_KEY = 'betterdesk_desktop_wins';
     const CASCADE_OFFSET = 32;
+    const STORAGE_FOLDABLE_AUTO = 'betterdesk_foldable_auto'; // Auto-switch on unfold
 
     // ============ State ============
 
@@ -27,6 +31,14 @@
     let dragState = null;
     let resizeState = null;
 
+    // Widget mode: 'windows' or 'widgets'
+    let currentMode = 'widgets'; // Default to widgets mode
+    const STORAGE_MODE = 'betterdesk_desktop_view_mode';
+
+    // Foldable phone detection
+    let isFoldableDevice = false;
+    let devicePosture = 'unknown'; // 'continuous', 'folded', 'folded-over'
+
     // ============ Apps Definition ============
 
     function getApps() {
@@ -55,7 +67,11 @@
 
     function init() {
         if (window.BetterDesk && window.BetterDesk.embed) return;
-        if (window.innerWidth < BREAKPOINT) return;
+        
+        // Initialize foldable device detection
+        initFoldableDetection();
+        
+        if (window.innerWidth < BREAKPOINT && !isFoldableDevice) return;
 
         setupGlobalListeners();
 
@@ -64,6 +80,122 @@
         }
     }
 
+    // ============ Foldable Phone Detection ============
+
+    function initFoldableDetection() {
+        // Method 1: Device Posture API (Chrome 125+)
+        if ('devicePosture' in navigator) {
+            isFoldableDevice = true;
+            devicePosture = navigator.devicePosture.type || 'unknown';
+            
+            navigator.devicePosture.addEventListener('change', function() {
+                devicePosture = navigator.devicePosture.type;
+                handlePostureChange(devicePosture);
+            });
+        }
+        
+        // Method 2: Screen Fold API (experimental)
+        if ('getScreenFold' in window) {
+            isFoldableDevice = true;
+            window.getScreenFold().then(function(fold) {
+                if (fold) {
+                    fold.addEventListener('change', function() {
+                        handleFoldChange(fold.angle, fold.posture);
+                    });
+                }
+            }).catch(function() {});
+        }
+        
+        // Method 3: CSS screen-spanning media query detection
+        if (window.matchMedia) {
+            var foldQuery = window.matchMedia('(screen-spanning: single-fold-vertical)');
+            if (foldQuery.matches || foldQuery.media !== 'not all') {
+                // Device supports screen-spanning query = likely foldable
+                isFoldableDevice = checkFoldableByMediaQuery();
+            }
+            foldQuery.addEventListener('change', function(e) {
+                if (e.matches) {
+                    isFoldableDevice = true;
+                    handlePostureChange('continuous');
+                }
+            });
+        }
+        
+        // Method 4: Viewport size heuristic for known foldable aspect ratios
+        // Samsung Galaxy Z Fold: ~880px unfolded inner width
+        // Vivo X Fold: ~1080px unfolded inner width
+        if (!isFoldableDevice) {
+            isFoldableDevice = detectFoldableByAspectRatio();
+        }
+        
+        // Log foldable detection status
+        if (isFoldableDevice) {
+            console.log('BetterDesk: Foldable device detected, posture:', devicePosture);
+        }
+    }
+    
+    function checkFoldableByMediaQuery() {
+        return window.matchMedia('(horizontal-viewport-segments: 2)').matches ||
+               window.matchMedia('(vertical-viewport-segments: 2)').matches ||
+               window.matchMedia('(screen-spanning: single-fold-horizontal)').matches ||
+               window.matchMedia('(screen-spanning: single-fold-vertical)').matches;
+    }
+    
+    function detectFoldableByAspectRatio() {
+        var w = window.innerWidth;
+        var h = window.innerHeight;
+        var ratio = w / h;
+        
+        // Foldable phones when unfolded typically have wider aspect ratios
+        // Samsung Z Fold unfolded: ~1.0-1.2 (almost square)
+        // Most regular phones: 0.4-0.6 (portrait) or 1.6-2.0 (landscape)
+        
+        // Consider device foldable if:
+        // - Has touch support (mobile device)
+        // - Inner width >= 700px (large for a phone)
+        // - Aspect ratio between 0.8 and 1.4 (nearly square)
+        var hasTouch = 'ontouchstart' in window || navigator.maxTouchPoints > 0;
+        var isLargeForPhone = w >= 700 && w <= 1400;
+        var nearlySquare = ratio >= 0.8 && ratio <= 1.4;
+        
+        return hasTouch && isLargeForPhone && nearlySquare;
+    }
+    
+    function handlePostureChange(posture) {
+        devicePosture = posture;
+        var autoSwitchEnabled = localStorage.getItem(STORAGE_FOLDABLE_AUTO) !== 'false';
+        
+        if (posture === 'continuous') {
+            // Device is unfolded / flat
+            if (autoSwitchEnabled && window.innerWidth >= BREAKPOINT) {
+                activate(true);
+            }
+        } else if (posture === 'folded' || posture === 'folded-over') {
+            // Device is folded
+            if (autoSwitchEnabled && active) {
+                deactivate(true);
+            }
+        }
+    }
+    
+    function handleFoldChange(angle, posture) {
+        // angle > 160° = nearly flat (unfolded)
+        // angle < 90° = folded
+        if (angle > 160) {
+            handlePostureChange('continuous');
+        } else if (angle < 90) {
+            handlePostureChange('folded');
+        }
+    }
+    
+    function setFoldableAutoSwitch(enabled) {
+        localStorage.setItem(STORAGE_FOLDABLE_AUTO, enabled ? 'true' : 'false');
+    }
+    
+    function isFoldableAutoSwitchEnabled() {
+        return localStorage.getItem(STORAGE_FOLDABLE_AUTO) !== 'false';
+    }
+
     function setupGlobalListeners() {
         // Navbar toggle button
         var btn = document.getElementById('desktop-toggle-btn');
@@ -83,15 +215,26 @@
             startBtn.addEventListener('click', function() { openStartMenu(); });
         }
 
+        // Taskbar wallpaper button
+        var wallBtn = document.getElementById('taskbar-wallpaper-btn');
+        if (wallBtn) {
+            wallBtn.addEventListener('click', function() {
+                if (window.DesktopWidgets) window.DesktopWidgets.openWallpaperPicker();
+            });
+        }
+
         // Global mouse events for drag/resize
         document.addEventListener('mousemove', handleMouseMove);
         document.addEventListener('mouseup', handleMouseUp);
 
         // Responsive: deactivate if viewport shrinks below breakpoint
+        // and re-clamp windows that may be offscreen after resize
         window.addEventListener('resize', Utils.debounce(function() {
             if (active && window.innerWidth < BREAKPOINT) {
                 deactivate(true);
+                return;
             }
+            if (active) clampAllWindows();
         }, 200));
     }
 
@@ -112,6 +255,10 @@
 
         renderDesktopIcons();
         startClock();
+
+        // Restore saved mode or default to widgets
+        currentMode = localStorage.getItem(STORAGE_MODE) || 'widgets';
+        applyMode(currentMode);
     }
 
     function deactivate(silent) {
@@ -119,6 +266,12 @@
         active = false;
         localStorage.setItem(STORAGE_KEY, 'false');
 
+        // Destroy widget mode
+        if (window.DesktopWidgets) {
+            window.DesktopWidgets.destroy();
+            window.DesktopWidgets.removeAddButton();
+        }
+
         // Close all windows
         windows.forEach(function(win) {
             removeWindowDOM(win.id, true);
@@ -127,7 +280,7 @@
         focusedWindowId = null;
         cascadeIndex = 0;
 
-        document.body.classList.remove('desktop-active', 'desktop-entering');
+        document.body.classList.remove('desktop-active', 'desktop-entering', 'desktop-mode-widgets', 'desktop-mode-windows');
         stopClock();
         clearDesktopIcons();
         clearTaskbar();
@@ -355,7 +508,7 @@
                     '<div class="window-loading-text">' + escapeHtml(t('desktop.loading')) + '</div>' +
                 '</div>' +
                 '<iframe src="' + escapeAttr(win.app.route + '?embed=1') + '" ' +
-                    'sandbox="allow-same-origin allow-scripts allow-forms allow-popups" ' +
+                    'sandbox="allow-same-origin allow-scripts allow-forms allow-popups allow-modals" ' +
                     'loading="lazy"></iframe>' +
             '</div>' +
             '<div class="window-edge edge-n" data-dir="n"></div>' +
@@ -601,8 +754,18 @@
             var win = windows.get(dragState.winId);
             if (!win) return;
 
-            win.x = dragState.origX + dx;
-            win.y = Math.max(0, dragState.origY + dy); // don't drag above viewport
+            var vw = window.innerWidth;
+            var vh = window.innerHeight;
+            var newX = dragState.origX + dx;
+            var newY = dragState.origY + dy;
+
+            // Clamp: keep at least 80px of title bar visible horizontally
+            newX = Math.max(-win.width + 80, Math.min(newX, vw - 80));
+            // Clamp: don't drag above viewport or below into taskbar
+            newY = Math.max(0, Math.min(newY, vh - TASKBAR_HEIGHT - 32));
+
+            win.x = newX;
+            win.y = newY;
 
             var el = document.getElementById(dragState.winId);
             if (el) {
@@ -620,25 +783,27 @@
             var dir = resizeState.dir;
             var newX = win.x, newY = win.y;
             var newW = win.width, newH = win.height;
+            var vh = window.innerHeight;
+            var vw = window.innerWidth;
 
             if (dir.indexOf('e') !== -1) {
-                newW = Math.max(MIN_WIDTH, resizeState.origW + dx);
+                newW = Math.max(MIN_WIDTH, Math.min(resizeState.origW + dx, vw - newX));
             }
             if (dir.indexOf('w') !== -1) {
                 var dw = resizeState.origW - dx;
                 if (dw >= MIN_WIDTH) {
                     newW = dw;
-                    newX = resizeState.origX + dx;
+                    newX = Math.max(0, resizeState.origX + dx);
                 }
             }
             if (dir.indexOf('s') !== -1) {
-                newH = Math.max(MIN_HEIGHT, resizeState.origH + dy);
+                newH = Math.max(MIN_HEIGHT, Math.min(resizeState.origH + dy, vh - TASKBAR_HEIGHT - newY));
             }
             if (dir === 'n' || dir === 'ne' || dir === 'nw') {
                 var dh = resizeState.origH - dy;
                 if (dh >= MIN_HEIGHT) {
                     newH = dh;
-                    newY = resizeState.origY + dy;
+                    newY = Math.max(0, resizeState.origY + dy);
                 }
             }
 
@@ -666,6 +831,33 @@
         resizeState = null;
     }
 
+    /**
+     * Re-clamp all windows within viewport bounds (e.g. after browser resize).
+     */
+    function clampAllWindows() {
+        var vw = window.innerWidth;
+        var vh = window.innerHeight;
+        windows.forEach(function(win) {
+            if (win.maximized) return;
+            var changed = false;
+            // Keep at least 80px visible horizontally
+            var clampedX = Math.max(-win.width + 80, Math.min(win.x, vw - 80));
+            var clampedY = Math.max(0, Math.min(win.y, vh - TASKBAR_HEIGHT - 32));
+            if (clampedX !== win.x || clampedY !== win.y) {
+                win.x = clampedX;
+                win.y = clampedY;
+                changed = true;
+            }
+            if (changed) {
+                var el = document.getElementById(win.id);
+                if (el) {
+                    el.style.left = win.x + 'px';
+                    el.style.top = win.y + 'px';
+                }
+            }
+        });
+    }
+
     // ============ Resize ============
 
     var cursorMap = { n:'ns-resize', s:'ns-resize', e:'ew-resize', w:'ew-resize',
@@ -773,11 +965,13 @@
     // ============ Helpers ============
 
     function getDesktopArea() {
+        // In widgets mode, taskbar is hidden — full height minus topnav (42px)
+        var bottomOffset = (currentMode === 'widgets') ? 0 : TASKBAR_HEIGHT;
         return {
             x: 0,
-            y: 0,
+            y: 42,
             width: window.innerWidth,
-            height: window.innerHeight - TASKBAR_HEIGHT
+            height: window.innerHeight - 42 - bottomOffset
         };
     }
 
@@ -792,6 +986,82 @@
                           .replace(/'/g, '&#39;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
     }
 
+    // ============ Mode Switching (Windows ↔ Widgets) ============
+
+    function switchMode(mode) {
+        if (mode === currentMode) return;
+        currentMode = mode;
+        localStorage.setItem(STORAGE_MODE, mode);
+        applyMode(mode);
+    }
+
+    function applyMode(mode) {
+        // Unified mode: widgets always visible, windows layer on top
+        document.body.classList.remove('desktop-mode-widgets', 'desktop-mode-windows');
+        document.body.classList.add('desktop-mode-unified');
+
+        // Always show windows container (for float windows)
+        var winsContainer = document.getElementById('desktop-windows');
+        if (winsContainer) winsContainer.style.display = '';
+
+        // Hide desktop icons in unified mode (apps open as windows)
+        var iconsContainer = document.getElementById('desktop-icons');
+        if (iconsContainer) iconsContainer.style.display = 'none';
+
+        // Always initialize widgets
+        if (window.DesktopWidgets) {
+            window.DesktopWidgets.init();
+            window.DesktopWidgets.renderAddButton();
+        }
+    }
+
+    // ============ Open App By Route ============
+
+    // Extra route → app mappings for pages not in getApps()
+    function _getExtraRoutes() {
+        return {
+            '/audit':        { id: 'audit',      icon: 'monitoring',          color: '#f0883e', name: t('nav.activity') },
+            '/network':      { id: 'network',    icon: 'wifi',                color: '#56d364', name: t('nav.network') },
+            '/cdap/devices': { id: 'cdap',       icon: 'developer_board',     color: '#79c0ff', name: t('nav.cdap') },
+            '/tokens':       { id: 'tokens',     icon: 'token',               color: '#d2a8ff', name: t('nav.tokens') },
+            '/inventory':    { id: 'inventory',   icon: 'inventory_2',         color: '#f78166', name: t('nav.inventory') },
+            '/tickets':      { id: 'tickets',     icon: 'confirmation_number', color: '#d2a8ff', name: t('nav.tickets') },
+            '/automation':   { id: 'automation',  icon: 'auto_fix_high',       color: '#56d364', name: t('nav.automation') },
+            '/reports':      { id: 'reports',     icon: 'assessment',          color: '#79c0ff', name: t('nav.reports') },
+            '/dataguard':    { id: 'dataguard',   icon: 'shield',              color: '#f0883e', name: t('nav.dataguard') },
+            '/tenants':      { id: 'tenants',     icon: 'business',            color: '#d2a8ff', name: t('nav.tenants') },
+            '/activity':     { id: 'activity',    icon: 'timeline',            color: '#f0883e', name: t('nav.activity') }
+        };
+    }
+
+    function openAppByRoute(route) {
+        if (!active) return;
+        if (!route) return;
+
+        // Unified mode: open apps directly as float windows (no mode switching)
+
+        // Find matching app in getApps()
+        var apps = getApps();
+        var found = null;
+        for (var i = 0; i < apps.length; i++) {
+            if (apps[i].route === route) { found = apps[i]; break; }
+        }
+
+        // Check extra routes
+        var extraRoutes = _getExtraRoutes();
+        if (!found && extraRoutes[route]) {
+            found = Object.assign({ route: route }, extraRoutes[route]);
+        }
+
+        // Fallback: create ad-hoc app entry
+        if (!found) {
+            var label = route.replace(/^\//, '').replace(/\//g, ' > ') || 'Page';
+            found = { id: 'page-' + route.replace(/\W/g, '_'), icon: 'open_in_new', route: route, color: '#8b949e', name: label };
+        }
+
+        openApp(found);
+    }
+
     // ============ Public API ============
 
     window.DesktopMode = {
@@ -799,7 +1069,15 @@
         toggle: toggle,
         isActive: function() { return active; },
         activate: activate,
-        deactivate: deactivate
+        deactivate: deactivate,
+        switchMode: switchMode,
+        getMode: function() { return currentMode; },
+        openAppByRoute: openAppByRoute,
+        // Foldable device API
+        isFoldable: function() { return isFoldableDevice; },
+        getDevicePosture: function() { return devicePosture; },
+        setFoldableAutoSwitch: setFoldableAutoSwitch,
+        isFoldableAutoSwitchEnabled: isFoldableAutoSwitchEnabled
     };
 
 })();
diff --git a/web-nodejs/public/js/desktop-widgets.js b/web-nodejs/public/js/desktop-widgets.js
new file mode 100644
index 00000000..73dfdaac
--- /dev/null
+++ b/web-nodejs/public/js/desktop-widgets.js
@@ -0,0 +1,1257 @@
+/**
+ * BetterDesk Console — Desktop Widget Engine
+ * Manages draggable/resizable glassmorphic widgets on a wallpaper canvas.
+ * Depends: desktop-mode.js (DesktopMode), Utils, _ (i18n)
+ */
+
+(function () {
+    'use strict';
+
+    // ============ Constants ============
+
+    var GRID = 10;
+    var MIN_W = 160;
+    var MIN_H = 120;
+    var STORAGE_LAYOUT  = 'bd_widget_layout';
+    var STORAGE_WALL    = 'bd_widget_wallpaper';
+    var LAYOUT_VERSION  = 3;
+    var STORAGE_LAYOUT_VER = 'bd_widget_layout_ver';
+    var WALLPAPER_COUNT = 125;
+    var UPDATE_INTERVAL = 30000;      // 30 s default widget data refresh
+    var SAVE_DEBOUNCE   = 600;
+
+    // ============ State ============
+
+    var _widgets    = new Map();      // id → { id, type, x, y, w, h, z, config }
+    var _zCounter   = 1;
+    var _focusedId  = null;
+    var _canvas     = null;
+    var _dragState   = null;
+    var _resizeState = null;
+    var _pickerOpen  = false;
+    var _wallpicker  = false;
+    var _updateTimers = new Map();
+    var _wallpaperPath = null;
+
+    // ============ Helpers ============
+
+    var t = function (k) { return typeof _ === 'function' ? _(k) : k; };
+
+    function snap(val) { return Math.round(val / GRID) * GRID; }
+
+    function uid() {
+        return 'w-' + Date.now().toString(36) + Math.random().toString(36).substr(2, 5);
+    }
+
+    function clamp(val, min, max) { return Math.max(min, Math.min(max, val)); }
+
+    function esc(s) {
+        var d = document.createElement('div');
+        d.textContent = s || '';
+        return d.innerHTML;
+    }
+
+    // ============ Initialization ============
+
+    function init() {
+        _canvas = document.getElementById('widget-canvas');
+        if (!_canvas) {
+            _canvas = document.createElement('div');
+            _canvas.id = 'widget-canvas';
+            _canvas.className = 'widget-canvas';
+            var shell = document.getElementById('desktop-shell');
+            if (shell) shell.insertBefore(_canvas, shell.firstChild.nextSibling); // after wallpaper
+        }
+
+        _canvas.addEventListener('mousedown', function (e) {
+            if (e.target === _canvas) unfocus();
+        });
+
+        document.addEventListener('mousemove', onMouseMove);
+        document.addEventListener('mouseup', onMouseUp);
+        // Touch support
+        document.addEventListener('touchmove', onTouchMove, { passive: false });
+        document.addEventListener('touchend', onTouchEnd);
+
+        loadWallpaper();
+        loadLayout();
+        renderAll();
+        renderNavBar();
+        renderSidebar();
+        _loadDeviceSearchCache();
+    }
+
+    function destroy() {
+        stopAllTimers();
+        _widgets.forEach(function (w) { destroyWidget(w.id, true); });
+        _widgets.clear();
+        if (_canvas) _canvas.innerHTML = '';
+        _focusedId = null;
+        removeNavBar();
+        removeSidebar();
+        removeAddButton();
+    }
+
+    // ============ Wallpaper ============
+
+    function loadWallpaper() {
+        var saved = localStorage.getItem(STORAGE_WALL);
+        setWallpaper(saved || '/wallpapers/1.png');
+    }
+
+    function setWallpaper(url) {
+        _wallpaperPath = url;
+        var el = document.querySelector('.desktop-wallpaper');
+        if (!el) return;
+
+        // Preload image before transitioning
+        var img = new Image();
+        img.onload = function() {
+            // Create new wallpaper layer for crossfade
+            var newLayer = document.createElement('div');
+            newLayer.className = 'desktop-wallpaper-new';
+            newLayer.style.backgroundImage = 'url("' + url + '")';
+            newLayer.style.backgroundSize = 'cover';
+            newLayer.style.backgroundPosition = 'center';
+            el.appendChild(newLayer);
+
+            // Trigger crossfade animation
+            requestAnimationFrame(function() {
+                newLayer.classList.add('fade-in');
+            });
+
+            // After transition, update main layer and remove new layer
+            setTimeout(function() {
+                el.style.backgroundImage = 'url("' + url + '")';
+                el.style.backgroundSize = 'cover';
+                el.style.backgroundPosition = 'center';
+                if (newLayer.parentElement) {
+                    newLayer.remove();
+                }
+            }, 600); // Match CSS transition duration
+        };
+        img.onerror = function() {
+            // Fallback: set directly without transition
+            el.style.backgroundImage = 'url("' + url + '")';
+            el.style.backgroundSize = 'cover';
+            el.style.backgroundPosition = 'center';
+        };
+        img.src = url;
+
+        localStorage.setItem(STORAGE_WALL, url);
+    }
+
+    // ============ Layout Persistence ============
+
+    function loadLayout() {
+        try {
+            var savedVer = parseInt(localStorage.getItem(STORAGE_LAYOUT_VER), 10) || 1;
+            var raw = localStorage.getItem(STORAGE_LAYOUT);
+            // Reset to default layout on version upgrade or first visit
+            if (savedVer < LAYOUT_VERSION || !raw) {
+                localStorage.removeItem(STORAGE_LAYOUT);
+                localStorage.setItem(STORAGE_LAYOUT_VER, String(LAYOUT_VERSION));
+                var defaults = getDefaultLayout();
+                defaults.forEach(function (item) {
+                    _widgets.set(item.id, item);
+                    if (item.z > _zCounter) _zCounter = item.z;
+                });
+                saveLayout();
+                return;
+            }
+            var arr = JSON.parse(raw);
+            if (!Array.isArray(arr)) return;
+            arr.forEach(function (item) {
+                if (item && item.id && item.type) {
+                    _widgets.set(item.id, item);
+                    if (item.z > _zCounter) _zCounter = item.z;
+                }
+            });
+        } catch (_) { /* ignore corrupt data */ }
+    }
+
+    var _saveTimeout = null;
+    function saveLayout() {
+        clearTimeout(_saveTimeout);
+        _saveTimeout = setTimeout(function () {
+            var arr = [];
+            _widgets.forEach(function (w) { arr.push(w); });
+            localStorage.setItem(STORAGE_LAYOUT, JSON.stringify(arr));
+            // Optional: save to server
+            saveLayoutToServer(arr);
+        }, SAVE_DEBOUNCE);
+    }
+
+    function saveLayoutToServer(arr) {
+        if (!window.BetterDesk || !window.BetterDesk.csrfToken) return;
+        if (typeof Utils === 'undefined' || !Utils.api) return;
+        Utils.api('/api/desktop/layout', {
+            method: 'POST',
+            body: JSON.stringify({ widgets: arr, wallpaper: _wallpaperPath })
+        }).catch(function () { /* silent — localStorage is primary */ });
+    }
+
+    // ============ Widget CRUD ============
+
+    function addWidget(type, config) {
+        var plugin = window.WidgetPlugins && window.WidgetPlugins.get(type);
+        if (!plugin) return null;
+
+        var def = plugin.defaultSize || { w: 240, h: 200 };
+        var area = getCanvasArea();
+        var id = uid();
+
+        // Find open position
+        var pos = findOpenPosition(def.w, def.h, area);
+
+        var w = {
+            id: id,
+            type: type,
+            x: pos.x,
+            y: pos.y,
+            w: def.w,
+            h: def.h,
+            z: ++_zCounter,
+            config: config || {}
+        };
+
+        _widgets.set(id, w);
+        renderWidget(w);
+        focusWidget(id);
+        saveLayout();
+        startWidgetTimer(w);
+        return id;
+    }
+
+    function removeWidget(id) {
+        var el = document.getElementById(id);
+        if (el) {
+            el.classList.remove('widget-entering');
+            el.classList.add('widget-leaving');
+            el.addEventListener('animationend', function () { el.remove(); }, { once: true });
+        }
+
+        var plugin = getPlugin(id);
+        if (plugin && plugin.destroy) {
+            var body = el ? el.querySelector('.widget-body') : null;
+            try { plugin.destroy(body); } catch (_) {}
+        }
+
+        stopWidgetTimer(id);
+        _widgets.delete(id);
+        if (_focusedId === id) _focusedId = null;
+        saveLayout();
+    }
+
+    function destroyWidget(id, immediate) {
+        stopWidgetTimer(id);
+        var el = document.getElementById(id);
+        if (el) {
+            var plugin = getPlugin(id);
+            if (plugin && plugin.destroy) {
+                var body = el.querySelector('.widget-body');
+                try { plugin.destroy(body); } catch (_) {}
+            }
+            el.remove();
+        }
+    }
+
+    // ============ Rendering ============
+
+    function renderAll() {
+        if (!_canvas) return;
+        _canvas.innerHTML = '';
+        var idx = 0;
+        _widgets.forEach(function (w) {
+            renderWidget(w);
+            // Stagger initial data fetches to avoid 429 rate limit storm
+            (function (widget, delay) {
+                setTimeout(function () { startWidgetTimer(widget); }, delay);
+            })(w, idx * 200);
+            idx++;
+        });
+        renderAddButton();
+    }
+
+    function renderWidget(w) {
+        var plugin = window.WidgetPlugins && window.WidgetPlugins.get(w.type);
+        if (!plugin) return;
+
+        var el = document.createElement('div');
+        el.className = 'desktop-widget widget-entering';
+        el.id = w.id;
+        el.style.left = w.x + 'px';
+        el.style.top = w.y + 'px';
+        el.style.width = w.w + 'px';
+        el.style.height = w.h + 'px';
+        el.style.zIndex = w.z;
+        el.setAttribute('data-widget-type', w.type);
+
+        var iconColor = plugin.color || '#58a6ff';
+
+        el.innerHTML =
+            '<div class="widget-header">' +
+                '<div class="widget-header-icon" style="color:' + esc(iconColor) + '">' +
+                    '<span class="material-icons">' + esc(plugin.icon || 'widgets') + '</span>' +
+                '</div>' +
+                '<div class="widget-header-title">' + esc(plugin.name || w.type) + '</div>' +
+                '<div class="widget-header-actions">' +
+                    '<button class="widget-btn-config" title="' + esc(t('desktop.configure')) + '">' +
+                        '<span class="material-icons">settings</span>' +
+                    '</button>' +
+                    '<button class="widget-btn-remove" title="' + esc(t('desktop.remove_widget')) + '">' +
+                        '<span class="material-icons">close</span>' +
+                    '</button>' +
+                '</div>' +
+            '</div>' +
+            '<div class="widget-body"></div>' +
+            buildResizeHandles();
+
+        // Events
+        el.addEventListener('mousedown', function (e) {
+            if (!e.target.closest('.widget-header-actions')) focusWidget(w.id);
+        });
+
+        // Drag via header
+        var header = el.querySelector('.widget-header');
+        header.addEventListener('mousedown', function (e) {
+            if (e.target.closest('.widget-header-actions')) return;
+            startDrag(w.id, e);
+        });
+        header.addEventListener('touchstart', function (e) {
+            if (e.target.closest('.widget-header-actions')) return;
+            startDrag(w.id, e);
+        }, { passive: false });
+
+        // Action buttons
+        el.querySelector('.widget-btn-remove').addEventListener('click', function (e) {
+            e.stopPropagation();
+            removeWidget(w.id);
+        });
+        el.querySelector('.widget-btn-config').addEventListener('click', function (e) {
+            e.stopPropagation();
+            openWidgetConfig(w.id);
+        });
+
+        // Resize handles
+        el.querySelectorAll('.widget-resize').forEach(function (handle) {
+            handle.addEventListener('mousedown', function (e) {
+                e.stopPropagation();
+                startResize(w.id, e, handle.dataset.dir);
+            });
+            handle.addEventListener('touchstart', function (e) {
+                e.stopPropagation();
+                startResize(w.id, e, handle.dataset.dir);
+            }, { passive: false });
+        });
+
+        _canvas.appendChild(el);
+
+        // Render plugin content
+        var body = el.querySelector('.widget-body');
+        if (plugin.render) {
+            try { plugin.render(body, w.config, w); } catch (err) {
+                body.innerHTML = '<div class="widget-empty"><span class="material-icons">error</span><span>Error</span></div>';
+                console.error('[Widget] render error (' + w.type + '):', err);
+            }
+        }
+    }
+
+    function buildResizeHandles() {
+        var dirs = ['n', 's', 'e', 'w', 'ne', 'nw', 'se', 'sw'];
+        return dirs.map(function (d) {
+            return '<div class="widget-resize widget-resize-' + d + '" data-dir="' + d + '"></div>';
+        }).join('');
+    }
+
+    function renderAddButton() {
+        var existing = document.querySelector('.widget-add-btn');
+        if (existing) existing.remove();
+        // Skip FAB when topnav provides the + button
+        if (document.querySelector('.widget-topnav')) return;
+
+        var btn = document.createElement('button');
+        btn.className = 'widget-add-btn';
+        btn.title = t('desktop.add_widget');
+        btn.innerHTML = '<span class="material-icons">add</span>';
+        btn.addEventListener('click', function () { togglePicker(); });
+        var shell = document.getElementById('desktop-shell');
+        (shell || document.body).appendChild(btn);
+    }
+
+    function removeAddButton() {
+        var btn = document.querySelector('.widget-add-btn');
+        if (btn) btn.remove();
+    }
+
+    // ============ Focus ============
+
+    function focusWidget(id) {
+        if (_focusedId === id) return;
+        // Unfocus previous
+        if (_focusedId) {
+            var prev = document.getElementById(_focusedId);
+            if (prev) prev.classList.remove('widget-focused');
+        }
+        _focusedId = id;
+        var w = _widgets.get(id);
+        if (!w) return;
+        w.z = ++_zCounter;
+        var el = document.getElementById(id);
+        if (el) {
+            el.style.zIndex = w.z;
+            el.classList.add('widget-focused');
+        }
+    }
+
+    function unfocus() {
+        if (_focusedId) {
+            var el = document.getElementById(_focusedId);
+            if (el) el.classList.remove('widget-focused');
+            _focusedId = null;
+        }
+    }
+
+    // ============ Drag ============
+
+    function startDrag(id, e) {
+        var w = _widgets.get(id);
+        if (!w) return;
+
+        var clientX, clientY;
+        if (e.touches) {
+            clientX = e.touches[0].clientX;
+            clientY = e.touches[0].clientY;
+            e.preventDefault();
+        } else {
+            clientX = e.clientX;
+            clientY = e.clientY;
+            e.preventDefault();
+        }
+
+        focusWidget(id);
+
+        _dragState = {
+            id: id,
+            startX: clientX,
+            startY: clientY,
+            origX: w.x,
+            origY: w.y
+        };
+
+        var el = document.getElementById(id);
+        if (el) el.classList.add('widget-dragging');
+    }
+
+    function onMouseMove(e) {
+        if (_dragState) handleDragMove(e.clientX, e.clientY);
+        if (_resizeState) handleResizeMove(e.clientX, e.clientY);
+    }
+
+    function onTouchMove(e) {
+        if (!_dragState && !_resizeState) return;
+        e.preventDefault();
+        var touch = e.touches[0];
+        if (_dragState) handleDragMove(touch.clientX, touch.clientY);
+        if (_resizeState) handleResizeMove(touch.clientX, touch.clientY);
+    }
+
+    function handleDragMove(cx, cy) {
+        var s = _dragState;
+        var w = _widgets.get(s.id);
+        if (!w) return;
+
+        var area = getCanvasArea();
+        w.x = clamp(snap(s.origX + (cx - s.startX)), 0, area.w - w.w);
+        w.y = clamp(snap(s.origY + (cy - s.startY)), 0, area.h - w.h);
+
+        var el = document.getElementById(s.id);
+        if (el) {
+            el.style.left = w.x + 'px';
+            el.style.top = w.y + 'px';
+        }
+    }
+
+    function onMouseUp() { endInteraction(); }
+    function onTouchEnd() { endInteraction(); }
+
+    function endInteraction() {
+        if (_dragState) {
+            var el = document.getElementById(_dragState.id);
+            if (el) el.classList.remove('widget-dragging');
+            _dragState = null;
+            saveLayout();
+        }
+        if (_resizeState) {
+            var el = document.getElementById(_resizeState.id);
+            if (el) el.classList.remove('widget-resizing');
+            _resizeState = null;
+            saveLayout();
+        }
+    }
+
+    // ============ Resize ============
+
+    function startResize(id, e, dir) {
+        var w = _widgets.get(id);
+        if (!w) return;
+
+        var cx, cy;
+        if (e.touches) {
+            cx = e.touches[0].clientX;
+            cy = e.touches[0].clientY;
+            e.preventDefault();
+        } else {
+            cx = e.clientX;
+            cy = e.clientY;
+            e.preventDefault();
+        }
+
+        focusWidget(id);
+        var plugin = window.WidgetPlugins && window.WidgetPlugins.get(w.type);
+        var minW = (plugin && plugin.minSize && plugin.minSize.w) || MIN_W;
+        var minH = (plugin && plugin.minSize && plugin.minSize.h) || MIN_H;
+
+        _resizeState = {
+            id: id,
+            dir: dir,
+            startX: cx,
+            startY: cy,
+            origX: w.x,
+            origY: w.y,
+            origW: w.w,
+            origH: w.h,
+            minW: minW,
+            minH: minH
+        };
+
+        var el = document.getElementById(id);
+        if (el) el.classList.add('widget-resizing');
+    }
+
+    function handleResizeMove(cx, cy) {
+        var s = _resizeState;
+        var w = _widgets.get(s.id);
+        if (!w) return;
+
+        var dx = cx - s.startX;
+        var dy = cy - s.startY;
+        var dir = s.dir;
+        var nw = w.w, nh = w.h, nx = w.x, ny = w.y;
+
+        if (dir.indexOf('e') !== -1) nw = Math.max(s.minW, snap(s.origW + dx));
+        if (dir.indexOf('s') !== -1) nh = Math.max(s.minH, snap(s.origH + dy));
+        if (dir.indexOf('w') !== -1) {
+            var pw = snap(s.origW - dx);
+            if (pw >= s.minW) { nw = pw; nx = s.origX + (s.origW - pw); }
+        }
+        if (dir.indexOf('n') !== -1) {
+            var ph = snap(s.origH - dy);
+            if (ph >= s.minH) { nh = ph; ny = s.origY + (s.origH - ph); }
+        }
+
+        w.x = nx; w.y = ny; w.w = nw; w.h = nh;
+
+        var el = document.getElementById(s.id);
+        if (el) {
+            el.style.left = nx + 'px';
+            el.style.top = ny + 'px';
+            el.style.width = nw + 'px';
+            el.style.height = nh + 'px';
+        }
+    }
+
+    // ============ Widget Data Updates ============
+
+    function startWidgetTimer(w) {
+        stopWidgetTimer(w.id);
+        var plugin = getPlugin(w.id);
+        if (!plugin || !plugin.update) return;
+        var interval = plugin.updateInterval || UPDATE_INTERVAL;
+
+        // Immediate first update
+        updateWidgetData(w.id);
+
+        var timer = setInterval(function () { updateWidgetData(w.id); }, interval);
+        _updateTimers.set(w.id, timer);
+    }
+
+    function stopWidgetTimer(id) {
+        var timer = _updateTimers.get(id);
+        if (timer) {
+            clearInterval(timer);
+            _updateTimers.delete(id);
+        }
+    }
+
+    function stopAllTimers() {
+        _updateTimers.forEach(function (timer) { clearInterval(timer); });
+        _updateTimers.clear();
+    }
+
+    function updateWidgetData(id) {
+        var w = _widgets.get(id);
+        if (!w) return;
+        var plugin = window.WidgetPlugins && window.WidgetPlugins.get(w.type);
+        if (!plugin || !plugin.update) return;
+
+        var el = document.getElementById(id);
+        if (!el) return;
+        var body = el.querySelector('.widget-body');
+        if (!body) return;
+
+        try { plugin.update(body, w.config, w); } catch (err) {
+            console.error('[Widget] update error (' + w.type + '):', err);
+        }
+    }
+
+    // ============ Utility ============
+
+    function getPlugin(widgetId) {
+        var w = _widgets.get(widgetId);
+        if (!w) return null;
+        return window.WidgetPlugins && window.WidgetPlugins.get(w.type);
+    }
+
+    function getCanvasArea() {
+        if (_canvas) {
+            return { w: _canvas.offsetWidth, h: _canvas.offsetHeight };
+        }
+        // Account for topnav (42px), sidebar (42px), taskbar (48px)
+        return { w: window.innerWidth - 42, h: window.innerHeight - 42 - 48 };
+    }
+
+    function findOpenPosition(w, h, area) {
+        // Simple spiral search for open spot
+        for (var row = 0; row < area.h - h; row += GRID * 4) {
+            for (var col = 0; col < area.w - w; col += GRID * 4) {
+                if (!isOverlapping(col, row, w, h)) {
+                    return { x: col + 20, y: row + 20 };
+                }
+            }
+        }
+        // Fallback: random position
+        return {
+            x: snap(Math.random() * Math.max(0, area.w - w)),
+            y: snap(Math.random() * Math.max(0, area.h - h))
+        };
+    }
+
+    function isOverlapping(x, y, w, h) {
+        var found = false;
+        _widgets.forEach(function (wg) {
+            if (found) return;
+            if (x < wg.x + wg.w && x + w > wg.x && y < wg.y + wg.h && y + h > wg.y) {
+                found = true;
+            }
+        });
+        return found;
+    }
+
+    // ============ Widget Picker ============
+
+    function togglePicker() {
+        if (_pickerOpen) {
+            closePicker();
+        } else {
+            openPicker();
+        }
+    }
+
+    function openPicker() {
+        closePicker();
+        _pickerOpen = true;
+
+        if (!window.WidgetPlugins) return;
+        var plugins = window.WidgetPlugins.list();
+
+        // Group by category
+        var categories = {};
+        plugins.forEach(function (p) {
+            var cat = p.category || 'general';
+            if (!categories[cat]) categories[cat] = [];
+            categories[cat].push(p);
+        });
+
+        var panel = document.createElement('div');
+        panel.className = 'widget-picker';
+        panel.id = 'widget-picker';
+
+        var html = '<div class="widget-picker-header">' +
+            '<h3>' + esc(t('desktop.add_widget')) + '</h3>' +
+            '<div class="widget-picker-search-wrap">' +
+                '<span class="material-icons">search</span>' +
+                '<input class="widget-picker-search" placeholder="' + esc(t('desktop.search_widgets')) + '">' +
+            '</div>' +
+        '</div>' +
+        '<div class="widget-picker-list">';
+
+        var catOrder = ['monitoring', 'devices', 'tools', 'general'];
+        catOrder.forEach(function (cat) {
+            var items = categories[cat];
+            if (!items || !items.length) return;
+            html += '<div class="widget-picker-category">' + esc(t('desktop.cat_' + cat)) + '</div>';
+            items.forEach(function (p) {
+                html += '<div class="widget-picker-item" data-type="' + esc(p.type) + '">' +
+                    '<div class="widget-picker-item-icon" style="background:' + esc(p.color || '#58a6ff') + '22;color:' + esc(p.color || '#58a6ff') + '">' +
+                        '<span class="material-icons">' + esc(p.icon) + '</span>' +
+                    '</div>' +
+                    '<div class="widget-picker-item-info">' +
+                        '<div class="widget-picker-item-name">' + esc(p.name) + '</div>' +
+                        '<div class="widget-picker-item-desc">' + esc(p.description || '') + '</div>' +
+                    '</div>' +
+                '</div>';
+            });
+        });
+
+        html += '</div>';
+        panel.innerHTML = html;
+
+        var shell = document.getElementById('desktop-shell');
+        (shell || document.body).appendChild(panel);
+
+        // Search filter
+        var searchInput = panel.querySelector('.widget-picker-search');
+        searchInput.addEventListener('input', function () {
+            var q = searchInput.value.toLowerCase();
+            panel.querySelectorAll('.widget-picker-item').forEach(function (item) {
+                var name = item.querySelector('.widget-picker-item-name').textContent.toLowerCase();
+                var desc = item.querySelector('.widget-picker-item-desc').textContent.toLowerCase();
+                item.style.display = (name.indexOf(q) !== -1 || desc.indexOf(q) !== -1) ? '' : 'none';
+            });
+            // Hide empty categories
+            panel.querySelectorAll('.widget-picker-category').forEach(function (cat) {
+                var next = cat.nextElementSibling;
+                var hasVisible = false;
+                while (next && !next.classList.contains('widget-picker-category')) {
+                    if (next.style.display !== 'none') hasVisible = true;
+                    next = next.nextElementSibling;
+                }
+                cat.style.display = hasVisible ? '' : 'none';
+            });
+        });
+
+        // Click handler for items
+        panel.querySelectorAll('.widget-picker-item').forEach(function (item) {
+            item.addEventListener('click', function () {
+                addWidget(item.dataset.type);
+                closePicker();
+            });
+        });
+
+        // Close on outside click
+        setTimeout(function () {
+            function handleOutside(e) {
+                if (!panel.contains(e.target) && !e.target.closest('.widget-add-btn')) {
+                    closePicker();
+                    document.removeEventListener('mousedown', handleOutside);
+                }
+            }
+            document.addEventListener('mousedown', handleOutside);
+        }, 10);
+    }
+
+    function closePicker() {
+        _pickerOpen = false;
+        var panel = document.getElementById('widget-picker');
+        if (panel) panel.remove();
+    }
+
+    // ============ Widget Config Modal ============
+
+    function openWidgetConfig(id) {
+        var w = _widgets.get(id);
+        if (!w) return;
+        var plugin = getPlugin(id);
+        if (!plugin || !plugin.configForm) return;
+
+        var fields = plugin.configForm(w.config);
+        if (!fields || !fields.length) return;
+
+        var overlay = document.createElement('div');
+        overlay.className = 'widget-config-overlay';
+        overlay.id = 'widget-config-overlay';
+
+        var html = '<div class="widget-config-panel">' +
+            '<h3>' + esc(plugin.name) + ' — ' + esc(t('desktop.configure')) + '</h3>';
+
+        fields.forEach(function (f) {
+            html += '<div class="widget-config-field">';
+            html += '<label>' + esc(f.label) + '</label>';
+            if (f.type === 'select') {
+                html += '<select name="' + esc(f.key) + '">';
+                (f.options || []).forEach(function (opt) {
+                    var sel = (w.config[f.key] === opt.value) ? ' selected' : '';
+                    html += '<option value="' + esc(opt.value) + '"' + sel + '>' + esc(opt.label) + '</option>';
+                });
+                html += '</select>';
+            } else if (f.type === 'textarea') {
+                html += '<textarea name="' + esc(f.key) + '" rows="4">' + esc(w.config[f.key] || '') + '</textarea>';
+            } else {
+                html += '<input type="' + (f.type || 'text') + '" name="' + esc(f.key) + '" value="' + esc(w.config[f.key] || '') + '">';
+            }
+            html += '</div>';
+        });
+
+        html += '<div class="widget-config-actions">' +
+            '<button class="widget-config-btn-cancel">' + esc(t('common.cancel')) + '</button>' +
+            '<button class="widget-config-btn-save">' + esc(t('common.save')) + '</button>' +
+        '</div></div>';
+
+        overlay.innerHTML = html;
+        var shell = document.getElementById('desktop-shell');
+        (shell || document.body).appendChild(overlay);
+
+        // Cancel
+        overlay.querySelector('.widget-config-btn-cancel').addEventListener('click', function () {
+            overlay.remove();
+        });
+        overlay.addEventListener('click', function (e) { if (e.target === overlay) overlay.remove(); });
+
+        // Save
+        overlay.querySelector('.widget-config-btn-save').addEventListener('click', function () {
+            fields.forEach(function (f) {
+                var input = overlay.querySelector('[name="' + f.key + '"]');
+                if (input) w.config[f.key] = input.value;
+            });
+            overlay.remove();
+            saveLayout();
+
+            // Re-render widget body
+            var el = document.getElementById(id);
+            if (el && plugin.render) {
+                var body = el.querySelector('.widget-body');
+                if (body) {
+                    body.innerHTML = '';
+                    try { plugin.render(body, w.config, w); } catch (_) {}
+                }
+            }
+            // Trigger update
+            updateWidgetData(id);
+        });
+    }
+
+    // ============ Wallpaper Picker ============
+
+    var _pickerObserver = null;
+
+    function openWallpaperPicker() {
+        if (_wallpicker) return;
+        _wallpicker = true;
+
+        var overlay = document.createElement('div');
+        overlay.className = 'wallpaper-picker-overlay';
+        overlay.id = 'wallpaper-picker-overlay';
+
+        var html = '<div class="wallpaper-picker">' +
+            '<div class="wallpaper-picker-header">' +
+                '<h3>' + esc(t('desktop.wallpaper')) + '</h3>' +
+                '<button class="wallpaper-picker-close"><span class="material-icons">close</span></button>' +
+            '</div>' +
+            '<div class="wallpaper-grid" id="wallpaper-grid"></div></div>';
+        overlay.innerHTML = html;
+        var shell = document.getElementById('desktop-shell');
+        (shell || document.body).appendChild(overlay);
+
+        overlay.querySelector('.wallpaper-picker-close').addEventListener('click', closeWallpaperPicker);
+        overlay.addEventListener('click', function (e) {
+            if (e.target === overlay) closeWallpaperPicker();
+        });
+
+        var grid = overlay.querySelector('#wallpaper-grid');
+
+        // Build all placeholder divs in a single fragment (lightweight, no images yet)
+        var frag = document.createDocumentFragment();
+        for (var i = 1; i <= WALLPAPER_COUNT; i++) {
+            var wallPath = '/wallpapers/' + i + '.png';
+            var thumbPath = '/wallpapers/thumbs/' + i + '.webp';
+            var active = (_wallpaperPath === wallPath) ? ' active' : '';
+            var thumb = document.createElement('div');
+            thumb.className = 'wallpaper-thumb' + active;
+            thumb.dataset.path = wallPath;
+            thumb.dataset.thumb = thumbPath;
+            thumb.dataset.idx = String(i);
+            thumb.innerHTML = '<div class="wallpaper-thumb-placeholder"><span>' + i + '</span></div>';
+            frag.appendChild(thumb);
+        }
+        grid.appendChild(frag);
+
+        // Single click handler via event delegation (instead of 125 individual listeners)
+        grid.addEventListener('click', function (e) {
+            var el = e.target.closest('.wallpaper-thumb');
+            if (!el || !el.dataset.path) return;
+            grid.querySelectorAll('.wallpaper-thumb.active').forEach(function (a) { a.classList.remove('active'); });
+            el.classList.add('active');
+            setWallpaper(el.dataset.path);
+            closeWallpaperPicker();
+        });
+
+        // Lazy-load WebP thumbnails via IntersectionObserver
+        if ('IntersectionObserver' in window) {
+            _pickerObserver = new IntersectionObserver(function (entries) {
+                entries.forEach(function (entry) {
+                    if (!entry.isIntersecting) return;
+                    var el = entry.target;
+                    var ph = el.querySelector('.wallpaper-thumb-placeholder');
+                    if (!ph) { _pickerObserver.unobserve(el); return; }
+                    var img = document.createElement('img');
+                    img.onload = function () { img.classList.add('loaded'); };
+                    img.src = el.dataset.thumb;
+                    img.alt = 'Wallpaper ' + el.dataset.idx;
+                    img.loading = 'lazy';
+                    img.decoding = 'async';
+                    el.replaceChild(img, ph);
+                    _pickerObserver.unobserve(el);
+                });
+            }, { root: grid, rootMargin: '300px' });
+
+            grid.querySelectorAll('.wallpaper-thumb').forEach(function (el) {
+                _pickerObserver.observe(el);
+            });
+        } else {
+            // Fallback: native lazy loading (no IntersectionObserver)
+            grid.querySelectorAll('.wallpaper-thumb').forEach(function (el) {
+                var ph = el.querySelector('.wallpaper-thumb-placeholder');
+                if (!ph) return;
+                var img = document.createElement('img');
+                img.onload = function () { img.classList.add('loaded'); };
+                img.src = el.dataset.thumb;
+                img.alt = 'Wallpaper ' + el.dataset.idx;
+                img.loading = 'lazy';
+                img.decoding = 'async';
+                el.replaceChild(img, ph);
+            });
+        }
+    }
+
+    function closeWallpaperPicker() {
+        _wallpicker = false;
+        if (_pickerObserver) {
+            _pickerObserver.disconnect();
+            _pickerObserver = null;
+        }
+        var overlay = document.getElementById('wallpaper-picker-overlay');
+        if (overlay) overlay.remove();
+    }
+
+    // ============ Navigation Bar & Sidebar ============
+
+    function renderNavBar() {
+        if (document.querySelector('.widget-topnav')) return;
+        var nav = document.createElement('div');
+        nav.className = 'widget-topnav';
+        nav.innerHTML =
+            '<button class="topnav-menu" id="topnav-menu-btn" title="Menu"><span class="material-icons">menu</span></button>' +
+            '<div class="topnav-brand">BetterDesk</div>' +
+            '<div class="topnav-tabs">' +
+                '<button class="topnav-tab active" data-route="/" title="' + esc(t('nav.dashboard') || 'Dashboard') + '"><span class="material-icons">home</span></button>' +
+                '<button class="topnav-tab" data-route="/devices" title="' + esc(t('nav.devices') || 'Devices') + '"><span class="material-icons">devices</span></button>' +
+                '<button class="topnav-tab" data-route="/inventory" title="' + esc(t('inventory.title') || 'Inventory') + '"><span class="material-icons">inventory_2</span></button>' +
+                '<button class="topnav-tab" data-route="/tickets" title="' + esc(t('tickets.title') || 'Helpdesk') + '"><span class="material-icons">support_agent</span></button>' +
+                '<button class="topnav-tab" data-route="/automation" title="' + esc(t('automation.title') || 'Automation') + '"><span class="material-icons">smart_toy</span></button>' +
+                '<button class="topnav-tab" data-route="/network" title="' + esc(t('network.title') || 'Network') + '"><span class="material-icons">wifi</span></button>' +
+                '<button class="topnav-tab" data-route="/reports" title="' + esc(t('reports.title') || 'Reports') + '"><span class="material-icons">assessment</span></button>' +
+                '<button class="topnav-tab" data-route="/keys" title="' + esc(t('nav.keys') || 'Keys') + '"><span class="material-icons">vpn_key</span></button>' +
+                '<button class="topnav-tab" data-route="/cdap/devices" title="CDAP"><span class="material-icons">developer_board</span></button>' +
+                '<button class="topnav-tab" data-route="/tokens" title="' + esc(t('nav.tokens') || 'Tokens') + '"><span class="material-icons">token</span></button>' +
+                '<button class="topnav-tab" data-route="/settings" title="' + esc(t('nav.settings') || 'Settings') + '"><span class="material-icons">settings</span></button>' +
+            '</div>' +
+            '<div class="topnav-sep"></div>' +
+            '<div class="topnav-actions">' +
+                '<button class="topnav-btn" id="topnav-search" title="Search"><span class="material-icons">search</span></button>' +
+                '<button class="topnav-btn" id="topnav-add" title="' + esc(t('desktop.add_widget') || 'Add Widget') + '"><span class="material-icons">add</span></button>' +
+                '<button class="topnav-btn" id="topnav-edit" title="Edit"><span class="material-icons">edit</span></button>' +
+                '<button class="topnav-btn" id="topnav-help" title="Help"><span class="material-icons">help_outline</span></button>' +
+            '</div>' +
+            '<div class="topnav-clock" id="topnav-clock"></div>' +
+            '<button class="topnav-btn topnav-exit" id="topnav-exit" title="' + esc(t('desktop.exit_desktop') || 'Exit Desktop') + '"><span class="material-icons">logout</span></button>';
+        var shell = document.getElementById('desktop-shell');
+        if (shell) shell.appendChild(nav);
+        // Tab navigation — open as float window if DesktopMode has openApp
+        nav.querySelectorAll('.topnav-tab').forEach(function (tab) {
+            tab.addEventListener('click', function () {
+                var route = tab.dataset.route;
+                if (!route) return;
+                if (window.DesktopMode && typeof window.DesktopMode.openAppByRoute === 'function') {
+                    window.DesktopMode.openAppByRoute(route);
+                } else {
+                    window.location.href = route;
+                }
+            });
+        });
+        // Add widget button
+        var addBtn = nav.querySelector('#topnav-add');
+        if (addBtn) addBtn.addEventListener('click', function () { togglePicker(); });
+        // Edit mode toggle
+        var editBtn = nav.querySelector('#topnav-edit');
+        if (editBtn) editBtn.addEventListener('click', function () {
+            editBtn.classList.toggle('active');
+            document.body.classList.toggle('widget-edit-mode');
+        });
+        // Help button — start desktop tutorial
+        var helpBtn = nav.querySelector('#topnav-help');
+        if (helpBtn) helpBtn.addEventListener('click', function () {
+            if (window.BetterDeskTutorial) window.BetterDeskTutorial.start('desktop');
+        });
+        // Exit desktop mode
+        var exitBtn = nav.querySelector('#topnav-exit');
+        if (exitBtn) exitBtn.addEventListener('click', function () {
+            if (window.DesktopMode) window.DesktopMode.deactivate();
+        });
+        // Menu button — toggle sidebar visibility
+        var menuBtn = nav.querySelector('#topnav-menu-btn');
+        if (menuBtn) menuBtn.addEventListener('click', function () {
+            var sb = document.querySelector('.widget-sidebar');
+            if (!sb) return;
+            sb.classList.toggle('sidebar-collapsed');
+            menuBtn.classList.toggle('active', !sb.classList.contains('sidebar-collapsed'));
+            // Adjust canvas inset
+            var cn = document.querySelector('.widget-canvas');
+            if (cn) cn.style.left = sb.classList.contains('sidebar-collapsed') ? '0' : '';
+        });
+        // Search button — open search overlay
+        var searchBtn = nav.querySelector('#topnav-search');
+        if (searchBtn) searchBtn.addEventListener('click', function () { _openSearchOverlay(); });
+        // Start topnav clock
+        _startTopnavClock();
+    }
+
+    function removeNavBar() {
+        _stopTopnavClock();
+        var nav = document.querySelector('.widget-topnav');
+        if (nav) nav.remove();
+    }
+
+    var _topnavClockTimer = null;
+    function _startTopnavClock() {
+        _updateTopnavClock();
+        _topnavClockTimer = setInterval(_updateTopnavClock, 1000);
+    }
+    function _stopTopnavClock() {
+        if (_topnavClockTimer) { clearInterval(_topnavClockTimer); _topnavClockTimer = null; }
+    }
+    function _updateTopnavClock() {
+        var el = document.getElementById('topnav-clock');
+        if (!el) return;
+        var now = new Date();
+        var h = String(now.getHours()).padStart(2, '0');
+        var m = String(now.getMinutes()).padStart(2, '0');
+        el.textContent = h + ':' + m;
+    }
+
+    // ============ Search Overlay ============
+
+    function _openSearchOverlay() {
+        if (document.getElementById('widget-search-overlay')) return;
+        var overlay = document.createElement('div');
+        overlay.id = 'widget-search-overlay';
+        overlay.className = 'widget-search-overlay';
+        overlay.innerHTML =
+            '<div class="ws-dialog">' +
+                '<div class="ws-header">' +
+                    '<span class="material-icons">search</span>' +
+                    '<input id="ws-input" type="text" placeholder="' + esc(t('desktop.search_placeholder') || 'Search devices, pages, settings...') + '" autocomplete="off" />' +
+                    '<button class="ws-close" id="ws-close"><span class="material-icons">close</span></button>' +
+                '</div>' +
+                '<div class="ws-results" id="ws-results"></div>' +
+            '</div>';
+        document.body.appendChild(overlay);
+        var input = document.getElementById('ws-input');
+        var results = document.getElementById('ws-results');
+        if (input) {
+            input.focus();
+            input.addEventListener('input', Utils.debounce(function () { _runSearch(input.value.trim(), results); }, 200));
+            input.addEventListener('keydown', function (e) {
+                if (e.key === 'Escape') _closeSearchOverlay();
+            });
+        }
+        overlay.addEventListener('click', function (e) {
+            if (e.target === overlay) _closeSearchOverlay();
+        });
+        var closeBtn = document.getElementById('ws-close');
+        if (closeBtn) closeBtn.addEventListener('click', _closeSearchOverlay);
+        // Show quick-access pages immediately
+        _runSearch('', results);
+    }
+
+    function _closeSearchOverlay() {
+        var o = document.getElementById('widget-search-overlay');
+        if (o) o.remove();
+    }
+
+    function _runSearch(query, container) {
+        if (!container) return;
+        var q = (query || '').toLowerCase();
+        var html = '';
+        // Pages / apps
+        var pages = [
+            { name: 'Dashboard', icon: 'dashboard', route: '/' },
+            { name: 'Devices', icon: 'devices', route: '/devices' },
+            { name: 'Registrations', icon: 'how_to_reg', route: '/registrations' },
+            { name: 'Keys', icon: 'vpn_key', route: '/keys' },
+            { name: 'Generator', icon: 'build', route: '/generator' },
+            { name: 'Users', icon: 'group', route: '/users' },
+            { name: 'Audit', icon: 'monitoring', route: '/audit' },
+            { name: 'Network', icon: 'wifi', route: '/network' },
+            { name: 'CDAP', icon: 'developer_board', route: '/cdap/devices' },
+            { name: 'Tokens', icon: 'token', route: '/tokens' },
+            { name: 'Settings', icon: 'settings', route: '/settings' }
+        ];
+        var matchedPages = q ? pages.filter(function (p) { return p.name.toLowerCase().indexOf(q) !== -1; }) : pages;
+        if (matchedPages.length) {
+            html += '<div class="ws-section">' + esc(t('desktop.search_pages') || 'Pages') + '</div>';
+            matchedPages.forEach(function (p) {
+                html += '<div class="ws-row" data-route="' + esc(p.route) + '">' +
+                    '<span class="material-icons ws-row-icon">' + p.icon + '</span>' +
+                    '<span class="ws-row-text">' + esc(p.name) + '</span>' +
+                '</div>';
+            });
+        }
+        // Device search (only when there's a query)
+        if (q && _deviceSearchCache && _deviceSearchCache.length) {
+            var matchDev = _deviceSearchCache.filter(function (d) {
+                var src = ((d.id || '') + ' ' + (d.hostname || '') + ' ' + (d.note || '')).toLowerCase();
+                return src.indexOf(q) !== -1;
+            }).slice(0, 8);
+            if (matchDev.length) {
+                html += '<div class="ws-section">' + esc(t('desktop.search_devices') || 'Devices') + '</div>';
+                matchDev.forEach(function (d) {
+                    html += '<div class="ws-row" data-route="/devices" data-device="' + esc(d.id) + '">' +
+                        '<span class="material-icons ws-row-icon">computer</span>' +
+                        '<span class="ws-row-text">' + esc(d.hostname || d.id) + '</span>' +
+                        '<span class="ws-row-hint">' + esc(d.id) + '</span>' +
+                    '</div>';
+                });
+            }
+        }
+        if (!html) {
+            html = '<div class="ws-empty">' + esc(t('desktop.search_no_results') || 'No results') + '</div>';
+        }
+        container.innerHTML = html;
+        // Attach click handlers
+        container.querySelectorAll('.ws-row').forEach(function (row) {
+            row.addEventListener('click', function () {
+                var route = row.dataset.route;
+                _closeSearchOverlay();
+                if (route && window.DesktopMode && typeof window.DesktopMode.openAppByRoute === 'function') {
+                    window.DesktopMode.openAppByRoute(route);
+                } else if (route) {
+                    window.location.href = route;
+                }
+            });
+        });
+    }
+
+    // Cache devices for search (populate on init)
+    var _deviceSearchCache = [];
+    function _loadDeviceSearchCache() {
+        var token = window.BetterDesk && window.BetterDesk.csrfToken;
+        fetch('/api/devices', {
+            credentials: 'same-origin',
+            headers: token ? { 'x-csrf-token': token } : {}
+        })
+        .then(function (r) { return r.ok ? r.json() : []; })
+        .then(function (data) { _deviceSearchCache = Array.isArray(data) ? data : (data.devices || []); })
+        .catch(function () {});
+    }
+
+    function renderSidebar() {
+        if (document.querySelector('.widget-sidebar')) return;
+        var sb = document.createElement('div');
+        sb.className = 'widget-sidebar';
+        sb.innerHTML =
+            '<button class="sidebar-icon active" data-action="home" title="Dashboard"><span class="material-icons">dashboard</span></button>' +
+            '<button class="sidebar-icon" data-action="add-widget" title="' + esc(t('desktop.add_widget') || 'Add Widget') + '"><span class="material-icons">add_circle</span></button>' +
+            '<button class="sidebar-icon" data-action="wallpaper" title="Wallpaper"><span class="material-icons">wallpaper</span></button>' +
+            '<div class="sidebar-sep"></div>' +
+            '<button class="sidebar-icon" data-route="/registrations" title="' + esc(t('registrations.title') || 'Registrations') + '"><span class="material-icons">how_to_reg</span></button>' +
+            '<button class="sidebar-icon" data-route="/generator" title="' + esc(t('generator.title') || 'Generator') + '"><span class="material-icons">build</span></button>' +
+            '<button class="sidebar-icon" data-route="/users" title="' + esc(t('users.title') || 'Users') + '"><span class="material-icons">group</span></button>' +
+            '<button class="sidebar-icon" data-route="/tenants" title="' + esc(t('tenants.title') || 'Tenants') + '"><span class="material-icons">apartment</span></button>' +
+            '<div class="sidebar-sep"></div>' +
+            '<button class="sidebar-icon" data-route="/inventory" title="' + esc(t('inventory.title') || 'Inventory') + '"><span class="material-icons">inventory_2</span></button>' +
+            '<button class="sidebar-icon" data-route="/tickets" title="' + esc(t('tickets.title') || 'Helpdesk') + '"><span class="material-icons">support_agent</span></button>' +
+            '<button class="sidebar-icon" data-route="/automation" title="' + esc(t('automation.title') || 'Automation') + '"><span class="material-icons">smart_toy</span></button>' +
+            '<button class="sidebar-icon" data-route="/activity" title="' + esc(t('activity.title') || 'Activity') + '"><span class="material-icons">timeline</span></button>' +
+            '<button class="sidebar-icon" data-route="/reports" title="' + esc(t('reports.title') || 'Reports') + '"><span class="material-icons">assessment</span></button>' +
+            '<button class="sidebar-icon" data-route="/dataguard" title="' + esc(t('dataguard.title') || 'DataGuard') + '"><span class="material-icons">security</span></button>' +
+            '<div class="sidebar-spacer"></div>' +
+            '<button class="sidebar-icon" data-action="help" title="Help"><span class="material-icons">help_outline</span></button>' +
+            '<button class="sidebar-icon" data-route="/settings" title="Profile"><span class="material-icons">account_circle</span></button>';
+        var shell = document.getElementById('desktop-shell');
+        if (shell) shell.appendChild(sb);
+        sb.querySelectorAll('.sidebar-icon').forEach(function (icon) {
+            icon.addEventListener('click', function () {
+                var route = icon.dataset.route;
+                var action = icon.dataset.action;
+                if (action === 'wallpaper') {
+                    openWallpaperPicker();
+                } else if (action === 'add-widget') {
+                    togglePicker();
+                } else if (action === 'home') {
+                    // Scroll widgets to top/left
+                    if (_canvas) _canvas.scrollTo(0, 0);
+                } else if (action === 'help') {
+                    // Open docs in float window
+                    if (window.DesktopMode && typeof window.DesktopMode.openAppByRoute === 'function') {
+                        window.DesktopMode.openAppByRoute('/settings');
+                    } else {
+                        window.location.href = '/settings';
+                    }
+                } else if (route) {
+                    if (window.DesktopMode && typeof window.DesktopMode.openAppByRoute === 'function') {
+                        window.DesktopMode.openAppByRoute(route);
+                    } else {
+                        window.location.href = route;
+                    }
+                }
+            });
+        });
+    }
+
+    function removeSidebar() {
+        var sb = document.querySelector('.widget-sidebar');
+        if (sb) sb.remove();
+    }
+
+    // ============ Default HA-Inspired Layout ============
+
+    function getDefaultLayout() {
+        var c = 10, g = 10;
+        var c1 = c, c2 = c1 + 310 + g, c3 = c2 + 380 + g, c4 = c3 + 360 + g;
+        var r1 = 10, r2 = r1 + 250 + g, r3 = r2 + 210 + g;
+        return [
+            // Row 1
+            { id: uid(), type: 'clock',           x: c1,  y: r1, w: 310, h: 240, z: 1, config: {} },
+            { id: uid(), type: 'recent-activity',  x: c2,  y: r1, w: 380, h: 240, z: 2, config: {} },
+            { id: uid(), type: 'multi-gauge',      x: c3,  y: r1, w: 360, h: 165, z: 3, config: {} },
+            { id: uid(), type: 'uptime',           x: c4,  y: r1, w: 200, h: 165, z: 4, config: {} },
+            { id: uid(), type: 'server-health',    x: c4 + 210, y: r1, w: 380, h: 280, z: 5, config: {} },
+            // Row 2
+            { id: uid(), type: 'weekly-chart',     x: c1,  y: r2, w: 310, h: 200, z: 6, config: {} },
+            { id: uid(), type: 'device-grid',      x: c2,  y: r2, w: 380, h: 220, z: 7, config: {} },
+            { id: uid(), type: 'bandwidth',        x: c3,  y: r2, w: 360, h: 220, z: 8, config: {} },
+            // Row 3
+            { id: uid(), type: 'device-status',    x: c1,  y: r3, w: 310, h: 160, z: 10, config: {} },
+            { id: uid(), type: 'quick-controls',   x: c2,  y: r3, w: 380, h: 210, z: 11, config: {} },
+            { id: uid(), type: 'connection-stats',  x: c3,  y: r3, w: 360, h: 210, z: 12, config: {} },
+            { id: uid(), type: 'notes',            x: c4,  y: r3, w: 450, h: 210, z: 13, config: {} }
+        ];
+    }
+
+    // ============ Public API ============
+
+    window.DesktopWidgets = {
+        init: init,
+        destroy: destroy,
+        addWidget: addWidget,
+        removeWidget: removeWidget,
+        setWallpaper: setWallpaper,
+        openWallpaperPicker: openWallpaperPicker,
+        openPicker: openPicker,
+        getWidgets: function () { return _widgets; },
+        removeAddButton: removeAddButton,
+        renderAddButton: renderAddButton
+    };
+
+})();
diff --git a/web-nodejs/public/js/deviceDetail.js b/web-nodejs/public/js/deviceDetail.js
index 4ed9d86b..46687969 100644
--- a/web-nodejs/public/js/deviceDetail.js
+++ b/web-nodejs/public/js/deviceDetail.js
@@ -486,24 +486,6 @@ const DeviceDetail = (function () {
         <div class="device-panel-section">
             <div class="device-panel-section-title"><span class="material-icons">link</span> ${_('device_detail.section_connect')}</div>
             <div class="device-panel-actions-grid">
-                <div class="device-panel-action-card" data-action="connect-web">
-                    <div class="device-panel-action-icon green">
-                        <span class="material-icons">language</span>
-                    </div>
-                    <div class="device-panel-action-text">
-                        <div class="device-panel-action-title">${_('device_detail.action_connect_web')}</div>
-                        <div class="device-panel-action-desc">${_('device_detail.action_connect_web_desc')}</div>
-                    </div>
-                </div>
-                <div class="device-panel-action-card" data-action="connect-native-remote">
-                    <div class="device-panel-action-icon teal" style="background:rgba(20,184,166,.15);color:#14b8a6">
-                        <span class="material-icons">connected_tv</span>
-                    </div>
-                    <div class="device-panel-action-text">
-                        <div class="device-panel-action-title">${_('device_detail.action_native_remote') || 'BetterDesk Remote'}</div>
-                        <div class="device-panel-action-desc">${_('device_detail.action_native_remote_desc') || 'Native JPEG stream viewer'}</div>
-                    </div>
-                </div>
                 <div class="device-panel-action-card" data-action="connect-desktop">
                     <div class="device-panel-action-icon purple">
                         <span class="material-icons">computer</span>
@@ -513,6 +495,15 @@ const DeviceDetail = (function () {
                         <div class="device-panel-action-desc">${_('device_detail.action_connect_desktop_desc')}</div>
                     </div>
                 </div>
+                <div class="device-panel-action-card" data-action="connect-web">
+                    <div class="device-panel-action-icon blue">
+                        <span class="material-icons">screen_share</span>
+                    </div>
+                    <div class="device-panel-action-text">
+                        <div class="device-panel-action-title">${_('device_detail.action_connect_web')}</div>
+                        <div class="device-panel-action-desc">${_('device_detail.action_connect_web_desc')}</div>
+                    </div>
+                </div>
             </div>
         </div>`;
 
@@ -695,7 +686,7 @@ const DeviceDetail = (function () {
         // Footer buttons
         panel.querySelector('#dp-close-btn')?.addEventListener('click', close);
         panel.querySelector('#dp-connect-btn')?.addEventListener('click', function () {
-            if (device) window.location.href = '/remote/' + encodeURIComponent(device.id);
+            if (device) window.open('/remote/' + encodeURIComponent(device.id), '_blank');
         });
 
         // Tabs
@@ -822,16 +813,12 @@ const DeviceDetail = (function () {
         if (!device) return;
 
         switch (action) {
-            case 'connect-web':
-                window.location.href = '/remote/' + encodeURIComponent(device.id);
-                break;
-
-            case 'connect-native-remote':
-                window.location.href = '/remote-desktop/' + encodeURIComponent(device.id);
-                break;
-
             case 'connect-desktop':
-                window.open('rustdesk://' + encodeURIComponent(device.id), '_blank');
+                window.open('betterdesk://' + encodeURIComponent(device.id), '_blank');
+                break;
+
+            case 'connect-web':
+                window.open('/remote/' + encodeURIComponent(device.id), '_blank');
                 break;
 
             case 'change-id':
diff --git a/web-nodejs/public/js/devices.js b/web-nodejs/public/js/devices.js
index b6cc0b88..38c4119c 100644
--- a/web-nodejs/public/js/devices.js
+++ b/web-nodejs/public/js/devices.js
@@ -15,13 +15,14 @@
     // Map device_type to Material Icons
     function getDeviceTypeIcon(type) {
         switch ((type || '').toLowerCase()) {
+            case 'betterdesk': return 'desktop_windows';
             case 'desktop':  return 'desktop_windows';
             case 'scada':    return 'precision_manufacturing';
             case 'iot':      return 'sensors';
             case 'os_agent': return 'terminal';
             case 'mobile':   return 'phone_android';
             case 'rustdesk': return 'connected_tv';
-            default:         return 'connected_tv';
+            default:         return 'devices';
         }
     }
     
@@ -93,13 +94,54 @@
         document.addEventListener('keydown', (e) => {
             if (e.key === 'Escape') closeAllKebabMenus();
         });
+
+        // Close on scroll (position:fixed menus don't follow scroll)
+        document.addEventListener('scroll', closeAllKebabMenus, true);
+        window.addEventListener('resize', closeAllKebabMenus);
     }
 
     function closeAllKebabMenus() {
-        document.querySelectorAll('.kebab-menu.open').forEach(m => m.classList.remove('open'));
+        document.querySelectorAll('.kebab-menu.open').forEach(m => {
+            m.classList.remove('open');
+            m.style.top = '';
+            m.style.left = '';
+        });
         const overlay = document.getElementById('kebab-overlay');
         if (overlay) overlay.classList.remove('open');
     }
+
+    /**
+     * Position a fixed kebab menu relative to its trigger button.
+     * Flips upward if there is not enough space below.
+     * Skips on mobile (≤600px) where CSS bottom-sheet handles positioning.
+     */
+    function positionKebabMenu(btn, menu) {
+        if (window.innerWidth <= 600) return;
+
+        const rect = btn.getBoundingClientRect();
+        const menuHeight = menu.offsetHeight || 200;
+        const menuWidth = menu.offsetWidth || 180;
+        const spaceBelow = window.innerHeight - rect.bottom;
+
+        let top, left;
+
+        // Vertical: prefer below, flip above if not enough space
+        if (spaceBelow >= menuHeight + 8) {
+            top = rect.bottom + 4;
+        } else {
+            top = rect.top - menuHeight - 4;
+        }
+
+        // Horizontal: align right edge to button right edge
+        left = rect.right - menuWidth;
+        if (left < 8) left = 8;
+        if (left + menuWidth > window.innerWidth - 8) {
+            left = window.innerWidth - menuWidth - 8;
+        }
+
+        menu.style.top = top + 'px';
+        menu.style.left = left + 'px';
+    }
     
     /**
      * Load devices from API
@@ -231,7 +273,7 @@
                 <td data-column="device_type">
                     <div class="platform-icon">
                         <span class="material-icons">${getDeviceTypeIcon(device.device_type)}</span>
-                        <span>${Utils.escapeHtml(device.device_type || 'rustdesk')}</span>
+                        <span>${Utils.escapeHtml(device.device_type || '-')}</span>
                     </div>
                 </td>
                 <td data-column="platform">
@@ -252,13 +294,9 @@
                             <span class="material-icons">more_vert</span>
                         </button>
                         <div class="kebab-menu">
-                            <button class="kebab-menu-item connect" data-action="connect" data-id="${eid}">
-                                <span class="material-icons">link</span>
-                                <span>${_('actions.connect')}</span>
-                            </button>
                             <button class="kebab-menu-item connect-desktop" data-action="connect-desktop" data-id="${eid}">
                                 <span class="material-icons">computer</span>
-                                <span>${_('actions.connect_desktop')}</span>
+                                <span>${_('actions.connect')}</span>
                             </button>
                             <div class="kebab-divider"></div>
                             <button class="kebab-menu-item info" data-action="details" data-id="${eid}">
@@ -312,6 +350,7 @@
                 closeAllKebabMenus();
                 if (!wasOpen) {
                     menu.classList.add('open');
+                    positionKebabMenu(btn, menu);
                     const overlay = document.getElementById('kebab-overlay');
                     if (overlay) overlay.classList.add('open');
                 }
@@ -345,10 +384,6 @@
      */
     async function handleAction(action, deviceId, data) {
         switch (action) {
-            case 'connect':
-                connectToDevice(deviceId);
-                break;
-                
             case 'connect-desktop':
                 connectDesktopClient(deviceId);
                 break;
@@ -380,17 +415,10 @@
     }
     
     /**
-     * Connect to device via web remote client
-     */
-    function connectToDevice(deviceId) {
-        window.location.href = '/remote/' + encodeURIComponent(deviceId);
-    }
-
-    /**
-     * Connect to device via RustDesk desktop client (rustdesk:// protocol)
+     * Connect to device via BetterDesk desktop client (betterdesk:// protocol)
      */
     function connectDesktopClient(deviceId) {
-        window.open('rustdesk://' + encodeURIComponent(deviceId), '_blank');
+        window.open('betterdesk://' + encodeURIComponent(deviceId), '_blank');
     }
     
     /**
@@ -558,11 +586,14 @@
             let countdown = 3;
             const timer = setInterval(() => {
                 countdown--;
-                countdownEl.textContent = countdown;
+                if (countdownEl) {
+                    countdownEl.textContent = countdown;
+                }
                 if (countdown <= 0) {
                     clearInterval(timer);
                     confirmBtn.disabled = false;
-                    confirmBtn.querySelector('.btn-text').textContent = _('actions.delete');
+                    const btnText = confirmBtn.querySelector('.btn-text');
+                    if (btnText) btnText.textContent = _('actions.delete');
                 }
             }, 1000);
             
diff --git a/web-nodejs/public/js/help-requests.js b/web-nodejs/public/js/help-requests.js
new file mode 100644
index 00000000..c9b5f19f
--- /dev/null
+++ b/web-nodejs/public/js/help-requests.js
@@ -0,0 +1,275 @@
+/**
+ * BetterDesk Console — Help Requests Page
+ *
+ * Polls the BD-API for incoming help requests and renders them as cards.
+ * Operators can accept, resolve, connect, or delete requests.
+ */
+
+'use strict';
+
+(function () {
+    // ---- State ----
+
+    let requests = [];
+    let activeFilter = '';
+    let pollTimer = null;
+    const POLL_INTERVAL = 5000;
+
+    // ---- DOM refs ----
+
+    const listEl = document.getElementById('hr-list');
+    const emptyEl = document.getElementById('hr-empty');
+    const statTotal = document.getElementById('stat-total');
+    const statPending = document.getElementById('stat-pending');
+    const statAccepted = document.getElementById('stat-accepted');
+    const statResolved = document.getElementById('stat-resolved');
+
+    // ---- Helpers ----
+
+    function getApiHeaders() {
+        // Use session cookie for panel auth, but we need an access token for
+        // the BD-API requireDeviceAuth middleware.  Panel stores one in
+        // localStorage after branding setup.  Fall back to CSRF token header.
+        const headers = {
+            'Content-Type': 'application/json',
+        };
+        const token = localStorage.getItem('bd_operator_token');
+        if (token) {
+            headers['Authorization'] = 'Bearer ' + token;
+        }
+        return headers;
+    }
+
+    function timeAgo(ts) {
+        const diff = Date.now() - ts;
+        const secs = Math.floor(diff / 1000);
+        if (secs < 60) return secs + 's ago';
+        const mins = Math.floor(secs / 60);
+        if (mins < 60) return mins + 'm ago';
+        const hours = Math.floor(mins / 60);
+        if (hours < 24) return hours + 'h ago';
+        return Math.floor(hours / 24) + 'd ago';
+    }
+
+    function escapeHtml(str) {
+        const div = document.createElement('div');
+        div.textContent = str;
+        return div.innerHTML;
+    }
+
+    // ---- Fetch ----
+
+    async function fetchRequests() {
+        try {
+            const resp = await fetch('/api/bd/help-requests', {
+                headers: getApiHeaders(),
+            });
+            if (!resp.ok) return;
+            const data = await resp.json();
+            if (data.success && Array.isArray(data.requests)) {
+                const prevCount = requests.filter(r => r.status === 'pending').length;
+                requests = data.requests;
+                const newCount = requests.filter(r => r.status === 'pending').length;
+
+                // Play notification sound for new pending requests
+                if (newCount > prevCount) {
+                    playNotificationSound();
+                }
+
+                render();
+            }
+        } catch (err) {
+            console.error('[HelpRequests] Fetch error:', err);
+        }
+    }
+
+    // ---- Notification ----
+
+    function playNotificationSound() {
+        try {
+            const ctx = new (window.AudioContext || window.webkitAudioContext)();
+            const osc = ctx.createOscillator();
+            const gain = ctx.createGain();
+            osc.connect(gain);
+            gain.connect(ctx.destination);
+            osc.frequency.value = 880;
+            osc.type = 'sine';
+            gain.gain.setValueAtTime(0.3, ctx.currentTime);
+            gain.gain.exponentialRampToValueAtTime(0.001, ctx.currentTime + 0.5);
+            osc.start(ctx.currentTime);
+            osc.stop(ctx.currentTime + 0.5);
+        } catch (_) {}
+    }
+
+    // ---- Actions ----
+
+    async function acceptRequest(id) {
+        try {
+            const resp = await fetch(`/api/bd/help-requests/${encodeURIComponent(id)}/accept`, {
+                method: 'POST',
+                headers: getApiHeaders(),
+            });
+            if (resp.ok) await fetchRequests();
+        } catch (err) {
+            console.error('[HelpRequests] Accept error:', err);
+        }
+    }
+
+    async function resolveRequest(id) {
+        try {
+            const resp = await fetch(`/api/bd/help-requests/${encodeURIComponent(id)}/resolve`, {
+                method: 'POST',
+                headers: getApiHeaders(),
+            });
+            if (resp.ok) await fetchRequests();
+        } catch (err) {
+            console.error('[HelpRequests] Resolve error:', err);
+        }
+    }
+
+    async function deleteRequest(id) {
+        if (!confirm('Delete this help request?')) return;
+        try {
+            const resp = await fetch(`/api/bd/help-requests/${encodeURIComponent(id)}`, {
+                method: 'DELETE',
+                headers: getApiHeaders(),
+            });
+            if (resp.ok) await fetchRequests();
+        } catch (err) {
+            console.error('[HelpRequests] Delete error:', err);
+        }
+    }
+
+    function connectToDevice(deviceId) {
+        // Open RustDesk URI to connect
+        window.open(`rustdesk://${encodeURIComponent(deviceId)}`, '_blank');
+    }
+
+    // ---- Render ----
+
+    function render() {
+        // Update stats
+        const pending = requests.filter(r => r.status === 'pending').length;
+        const accepted = requests.filter(r => r.status === 'accepted').length;
+        const resolved = requests.filter(r => r.status === 'resolved').length;
+
+        statTotal.textContent = requests.length;
+        statPending.textContent = pending;
+        statAccepted.textContent = accepted;
+        statResolved.textContent = resolved;
+
+        // Filter
+        const filtered = activeFilter
+            ? requests.filter(r => r.status === activeFilter)
+            : requests;
+
+        if (filtered.length === 0) {
+            emptyEl.style.display = '';
+            // Remove cards but keep empty state
+            listEl.querySelectorAll('.hr-card').forEach(c => c.remove());
+            return;
+        }
+
+        emptyEl.style.display = 'none';
+
+        // Remove old cards
+        listEl.querySelectorAll('.hr-card').forEach(c => c.remove());
+
+        for (const req of filtered) {
+            const card = document.createElement('div');
+            card.className = `hr-card status-${req.status}`;
+            card.dataset.id = req.id;
+
+            let actionsHtml = '';
+            if (req.status === 'pending') {
+                actionsHtml = `
+                    <button class="btn btn-accept" data-action="accept" title="Accept">
+                        <span class="material-icons" style="font-size:16px">check</span>
+                    </button>
+                    <button class="btn btn-connect" data-action="connect" title="Connect">
+                        <span class="material-icons" style="font-size:16px">desktop_windows</span>
+                    </button>
+                `;
+            } else if (req.status === 'accepted') {
+                actionsHtml = `
+                    <button class="btn btn-resolve" data-action="resolve" title="Resolve">
+                        <span class="material-icons" style="font-size:16px">done_all</span>
+                    </button>
+                    <button class="btn btn-connect" data-action="connect" title="Connect">
+                        <span class="material-icons" style="font-size:16px">desktop_windows</span>
+                    </button>
+                `;
+            }
+
+            card.innerHTML = `
+                <div class="hr-card-body">
+                    <div class="hr-card-header">
+                        ${req.status === 'pending' ? '<span class="hr-notification-dot"></span>' : ''}
+                        <span class="hr-device-id">${escapeHtml(req.device_id)}</span>
+                        <span class="hr-hostname">${escapeHtml(req.hostname || '')}</span>
+                        <span class="hr-status-badge ${req.status}">${escapeHtml(req.status)}</span>
+                    </div>
+                    <div class="hr-message">${escapeHtml(req.message || '')}</div>
+                    <div class="hr-meta">
+                        <span>${timeAgo(req.created_at)}</span>
+                        ${req.accepted_by ? `<span>Accepted by ${escapeHtml(req.accepted_by)}</span>` : ''}
+                        ${req.resolved_by ? `<span>Resolved by ${escapeHtml(req.resolved_by)}</span>` : ''}
+                    </div>
+                </div>
+                <div class="hr-card-actions">
+                    ${actionsHtml}
+                    <button class="btn" data-action="delete" title="Delete">
+                        <span class="material-icons" style="font-size:16px">delete</span>
+                    </button>
+                </div>
+            `;
+
+            listEl.appendChild(card);
+        }
+    }
+
+    // ---- Event delegation ----
+
+    listEl.addEventListener('click', (e) => {
+        const btn = e.target.closest('[data-action]');
+        if (!btn) return;
+
+        const card = btn.closest('.hr-card');
+        if (!card) return;
+
+        const id = card.dataset.id;
+        const action = btn.dataset.action;
+
+        switch (action) {
+            case 'accept': acceptRequest(id); break;
+            case 'resolve': resolveRequest(id); break;
+            case 'delete': deleteRequest(id); break;
+            case 'connect': {
+                const req = requests.find(r => r.id === id);
+                if (req) connectToDevice(req.device_id);
+                break;
+            }
+        }
+    });
+
+    // ---- Filter buttons ----
+
+    document.querySelectorAll('.help-requests-page .filter-btn').forEach(btn => {
+        btn.addEventListener('click', () => {
+            document.querySelectorAll('.help-requests-page .filter-btn').forEach(b => b.classList.remove('active'));
+            btn.classList.add('active');
+            activeFilter = btn.dataset.status || '';
+            render();
+        });
+    });
+
+    // ---- Init ----
+
+    fetchRequests();
+    pollTimer = setInterval(fetchRequests, POLL_INTERVAL);
+
+    // Cleanup on page unload
+    window.addEventListener('beforeunload', () => {
+        if (pollTimer) clearInterval(pollTimer);
+    });
+})();
diff --git a/web-nodejs/public/js/inventory.js b/web-nodejs/public/js/inventory.js
new file mode 100644
index 00000000..8becba2c
--- /dev/null
+++ b/web-nodejs/public/js/inventory.js
@@ -0,0 +1,296 @@
+/**
+ * BetterDesk Console - Inventory Page Script
+ */
+
+(function () {
+    'use strict';
+
+    const _ = window.BetterDesk?.translations
+        ? (key) => {
+            const keys = key.split('.');
+            let val = window.BetterDesk.translations;
+            for (const k of keys) { val = val?.[k]; }
+            return val || key;
+        }
+        : (key) => key;
+
+    const csrfToken = window.BetterDesk?.csrfToken || '';
+
+    // State
+    let allDevices = [];
+    let currentSearch = '';
+
+    // DOM refs
+    const tbody = document.getElementById('inventory-body');
+    const searchInput = document.getElementById('search-input');
+    const refreshBtn = document.getElementById('refresh-btn');
+    const detailModal = document.getElementById('detail-modal');
+    const detailBody = document.getElementById('detail-modal-body');
+    const statDevices = document.getElementById('stat-devices');
+    const statCpu = document.getElementById('stat-cpu');
+    const statMemory = document.getElementById('stat-memory');
+    const statDisks = document.getElementById('stat-disks');
+
+    // ---- API helpers ----
+
+    async function apiFetch(url, options = {}) {
+        const headers = { 'Content-Type': 'application/json' };
+        if (csrfToken) headers['x-csrf-token'] = csrfToken;
+        const resp = await fetch(url, { ...options, headers: { ...headers, ...options.headers } });
+        return resp.json();
+    }
+
+    // ---- Load ----
+
+    async function loadInventory() {
+        tbody.innerHTML = `<tr class="loading-row"><td colspan="8">${_('common.loading')}</td></tr>`;
+
+        try {
+            const result = await apiFetch('/api/inventory');
+            allDevices = result.devices || [];
+            updateStats();
+            renderTable();
+        } catch (err) {
+            tbody.innerHTML = `
+                <tr class="empty-row"><td colspan="8">
+                    <div class="empty-state">
+                        <span class="material-icons">error_outline</span>
+                        <p>${escapeHtml(err.message || _('common.error'))}</p>
+                    </div>
+                </td></tr>`;
+        }
+    }
+
+    function updateStats() {
+        statDevices.textContent = allDevices.length;
+        const avgCpu = allDevices.reduce((s, d) => s + (d.cpu_usage || 0), 0) / (allDevices.length || 1);
+        const avgMem = allDevices.reduce((s, d) => s + (d.memory_used_mb || 0), 0);
+        const totalDisks = allDevices.reduce((s, d) => s + (d.disk_count || 0), 0);
+        statCpu.textContent = avgCpu > 0 ? avgCpu.toFixed(1) + '%' : '—';
+        statMemory.textContent = avgMem > 0 ? formatBytes(avgMem * 1024 * 1024) : '—';
+        statDisks.textContent = totalDisks || '—';
+    }
+
+    // ---- Render ----
+
+    function renderTable() {
+        const filtered = allDevices.filter(d => {
+            if (!currentSearch) return true;
+            const q = currentSearch.toLowerCase();
+            return (d.device_id || '').toLowerCase().includes(q)
+                || (d.hostname || '').toLowerCase().includes(q)
+                || (d.os || '').toLowerCase().includes(q)
+                || (d.cpu || '').toLowerCase().includes(q);
+        });
+
+        if (!filtered.length) {
+            tbody.innerHTML = `
+                <tr class="empty-row"><td colspan="8">
+                    <div class="empty-state">
+                        <span class="material-icons">inventory_2</span>
+                        <p>${_('inventory.no_devices')}</p>
+                    </div>
+                </td></tr>`;
+            return;
+        }
+
+        tbody.innerHTML = filtered.map(d => `
+            <tr data-id="${escapeHtml(d.device_id)}">
+                <td class="device-id-cell">${escapeHtml(d.device_id)}</td>
+                <td>${escapeHtml(d.hostname || '—')}</td>
+                <td>${escapeHtml(d.os || '—')}</td>
+                <td title="${escapeHtml(d.cpu || '')}">${truncate(d.cpu || '—', 30)}</td>
+                <td>${formatMemory(d.memory_total_mb, d.memory_used_mb)}</td>
+                <td>${d.disk_count != null ? d.disk_count : '—'}</td>
+                <td class="time-cell" title="${escapeHtml(d.collected_at || d.last_seen || '')}">${formatTimeAgo(d.collected_at || d.last_seen)}</td>
+                <td>
+                    <button class="btn btn-sm btn-secondary view-detail-btn" data-id="${escapeHtml(d.device_id)}">
+                        <span class="material-icons" style="font-size:16px">visibility</span>
+                    </button>
+                </td>
+            </tr>
+        `).join('');
+
+        tbody.querySelectorAll('.view-detail-btn').forEach(btn => {
+            btn.addEventListener('click', () => openDetail(btn.dataset.id));
+        });
+    }
+
+    // ---- Detail ----
+
+    async function openDetail(deviceId) {
+        detailModal.style.display = 'flex';
+        detailBody.innerHTML = `<p>${_('common.loading')}</p>`;
+
+        try {
+            const data = await apiFetch(`/api/inventory/${encodeURIComponent(deviceId)}`);
+            renderDetail(data);
+        } catch (err) {
+            detailBody.innerHTML = `<p class="text-error">${escapeHtml(err.message)}</p>`;
+        }
+    }
+
+    function renderDetail(data) {
+        const tel = data.telemetry || {};
+        const cpuUsage = tel.cpu_usage != null ? tel.cpu_usage : data.cpu_usage;
+        const memPct = data.memory_total_mb > 0
+            ? Math.round((data.memory_used_mb / data.memory_total_mb) * 100) : null;
+
+        let html = `
+            <div class="detail-section">
+                <h4>${_('inventory.system')}</h4>
+                <div class="detail-grid">
+                    <div class="detail-item"><span class="detail-label">${_('inventory.device_id')}</span><span class="detail-value">${escapeHtml(data.device_id)}</span></div>
+                    <div class="detail-item"><span class="detail-label">${_('inventory.hostname')}</span><span class="detail-value">${escapeHtml(data.hostname || '—')}</span></div>
+                    <div class="detail-item"><span class="detail-label">${_('inventory.os')}</span><span class="detail-value">${escapeHtml(data.os || '—')}</span></div>
+                    <div class="detail-item"><span class="detail-label">${_('inventory.architecture')}</span><span class="detail-value">${escapeHtml(data.architecture || '—')}</span></div>
+                    <div class="detail-item"><span class="detail-label">${_('inventory.kernel')}</span><span class="detail-value">${escapeHtml(data.kernel || '—')}</span></div>
+                    <div class="detail-item"><span class="detail-label">${_('inventory.uptime')}</span><span class="detail-value">${formatDuration(data.uptime || tel.uptime)}</span></div>
+                </div>
+            </div>
+            <div class="detail-section">
+                <h4>${_('inventory.cpu')}</h4>
+                <div class="detail-grid">
+                    <div class="detail-item"><span class="detail-label">${_('inventory.model')}</span><span class="detail-value">${escapeHtml(data.cpu || '—')}</span></div>
+                    <div class="detail-item"><span class="detail-label">${_('inventory.cpu_cores')}</span><span class="detail-value">${data.cpu_cores || '—'}</span></div>
+                </div>`;
+
+        if (cpuUsage != null) {
+            const cls = cpuUsage > 90 ? 'danger' : cpuUsage > 70 ? 'warning' : '';
+            html += `<div style="margin-top:8px">
+                <span class="detail-label">${_('inventory.cpu_usage')}: ${cpuUsage.toFixed(1)}%</span>
+                <div class="usage-bar"><div class="usage-bar-fill ${cls}" style="width:${cpuUsage}%"></div></div>
+            </div>`;
+        }
+        html += `</div>`;
+
+        html += `<div class="detail-section">
+            <h4>${_('inventory.memory')}</h4>
+            <div class="detail-grid">
+                <div class="detail-item"><span class="detail-label">${_('inventory.total')}</span><span class="detail-value">${formatBytes((data.memory_total_mb || 0) * 1024 * 1024)}</span></div>
+                <div class="detail-item"><span class="detail-label">${_('inventory.used')}</span><span class="detail-value">${formatBytes((data.memory_used_mb || 0) * 1024 * 1024)}</span></div>
+            </div>`;
+
+        if (memPct != null) {
+            const cls = memPct > 90 ? 'danger' : memPct > 70 ? 'warning' : '';
+            html += `<div style="margin-top:8px">
+                <span class="detail-label">${_('inventory.memory_usage')}: ${memPct}%</span>
+                <div class="usage-bar"><div class="usage-bar-fill ${cls}" style="width:${memPct}%"></div></div>
+            </div>`;
+        }
+        html += `</div>`;
+
+        if (data.disks && data.disks.length) {
+            html += `<div class="detail-section"><h4>${_('inventory.disks')}</h4>`;
+            data.disks.forEach(disk => {
+                const pct = disk.total_gb > 0 ? Math.round((disk.used_gb / disk.total_gb) * 100) : 0;
+                const cls = pct > 90 ? 'danger' : pct > 70 ? 'warning' : '';
+                html += `<div style="margin-bottom:8px">
+                    <span class="detail-label">${escapeHtml(disk.mount_point || disk.device || '?')}: ${pct}% (${disk.used_gb?.toFixed(1) || 0}/${disk.total_gb?.toFixed(1) || 0} GB)</span>
+                    <div class="usage-bar"><div class="usage-bar-fill ${cls}" style="width:${pct}%"></div></div>
+                </div>`;
+            });
+            html += `</div>`;
+        }
+
+        if (data.network_interfaces && data.network_interfaces.length) {
+            html += `<div class="detail-section"><h4>${_('inventory.network')}</h4>`;
+            data.network_interfaces.forEach(nic => {
+                html += `<div style="margin-bottom:6px">
+                    <span class="detail-value">${escapeHtml(nic.name || '?')}</span>
+                    <span class="detail-label" style="margin-left:8px">${escapeHtml(nic.mac || '')} — ${escapeHtml((nic.ip_addresses || []).join(', '))}</span>
+                </div>`;
+            });
+            html += `</div>`;
+        }
+
+        detailBody.innerHTML = html;
+    }
+
+    // ---- Helpers ----
+
+    function escapeHtml(str) {
+        if (!str) return '';
+        const div = document.createElement('div');
+        div.textContent = String(str);
+        return div.innerHTML;
+    }
+
+    function truncate(str, max) {
+        if (!str) return str;
+        return str.length > max ? str.slice(0, max) + '…' : str;
+    }
+
+    function formatBytes(bytes) {
+        if (!bytes || bytes <= 0) return '—';
+        const units = ['B', 'KB', 'MB', 'GB', 'TB'];
+        let i = 0;
+        let val = bytes;
+        while (val >= 1024 && i < units.length - 1) { val /= 1024; i++; }
+        return val.toFixed(i > 0 ? 1 : 0) + ' ' + units[i];
+    }
+
+    function formatMemory(total, used) {
+        if (!total) return '—';
+        const pct = Math.round((used / total) * 100);
+        return `${formatBytes(used * 1024 * 1024)} / ${formatBytes(total * 1024 * 1024)} (${pct}%)`;
+    }
+
+    function formatDuration(seconds) {
+        if (!seconds) return '—';
+        const d = Math.floor(seconds / 86400);
+        const h = Math.floor((seconds % 86400) / 3600);
+        const m = Math.floor((seconds % 3600) / 60);
+        const parts = [];
+        if (d) parts.push(d + 'd');
+        if (h) parts.push(h + 'h');
+        if (m || !parts.length) parts.push(m + 'm');
+        return parts.join(' ');
+    }
+
+    function formatTimeAgo(dateStr) {
+        if (!dateStr) return '—';
+        const d = new Date(dateStr);
+        if (isNaN(d.getTime()) || d.getFullYear() < 2000) return '—';
+        const diff = Math.floor((Date.now() - d) / 1000);
+        if (diff < 60) return _('time.seconds_ago').replace('{count}', diff);
+        if (diff < 3600) return _('time.minutes_ago').replace('{count}', Math.floor(diff / 60));
+        if (diff < 86400) return _('time.hours_ago').replace('{count}', Math.floor(diff / 3600));
+        if (diff < 2592000) return _('time.days_ago').replace('{count}', Math.floor(diff / 86400));
+        return d.toLocaleDateString();
+    }
+
+    function showToast(message, type) {
+        if (window.BetterDesk?.notify) { window.BetterDesk.notify(message, type); return; }
+        const container = document.getElementById('toast-container');
+        if (!container) return;
+        const toast = document.createElement('div');
+        toast.className = `toast toast-${type || 'info'}`;
+        toast.textContent = message;
+        container.appendChild(toast);
+        setTimeout(() => toast.remove(), 4000);
+    }
+
+    // ---- Events ----
+
+    let searchTimeout;
+    searchInput.addEventListener('input', () => {
+        clearTimeout(searchTimeout);
+        searchTimeout = setTimeout(() => {
+            currentSearch = searchInput.value.trim();
+            renderTable();
+        }, 300);
+    });
+
+    refreshBtn.addEventListener('click', loadInventory);
+
+    document.querySelectorAll('.modal-close').forEach(btn => {
+        btn.addEventListener('click', () => {
+            const modalId = btn.dataset.modal;
+            if (modalId) document.getElementById(modalId).style.display = 'none';
+        });
+    });
+
+    // ---- Init ----
+    loadInventory();
+})();
diff --git a/web-nodejs/public/js/network.js b/web-nodejs/public/js/network.js
new file mode 100644
index 00000000..21562ba6
--- /dev/null
+++ b/web-nodejs/public/js/network.js
@@ -0,0 +1,305 @@
+/**
+ * BetterDesk Console - Network Monitor Script
+ */
+
+(function () {
+    'use strict';
+
+    const _ = window.BetterDesk?.translations
+        ? (key) => {
+            const keys = key.split('.');
+            let val = window.BetterDesk.translations;
+            for (const k of keys) { val = val?.[k]; }
+            return val || key;
+        }
+        : (key) => key;
+
+    const csrfToken = window.BetterDesk?.csrfToken || '';
+
+    async function apiFetch(url, options = {}) {
+        const headers = { 'Content-Type': 'application/json' };
+        if (csrfToken) headers['x-csrf-token'] = csrfToken;
+        const resp = await fetch(url, { ...options, headers: { ...headers, ...options.headers } });
+        return resp.json();
+    }
+
+    function escapeHtml(str) {
+        if (!str) return '';
+        const div = document.createElement('div');
+        div.textContent = String(str);
+        return div.innerHTML;
+    }
+
+    function formatTimeAgo(dateStr) {
+        if (!dateStr) return '—';
+        const d = new Date(dateStr);
+        const diff = Math.floor((Date.now() - d) / 1000);
+        if (diff < 60) return _('time.seconds_ago').replace('{count}', diff);
+        if (diff < 3600) return _('time.minutes_ago').replace('{count}', Math.floor(diff / 60));
+        if (diff < 86400) return _('time.hours_ago').replace('{count}', Math.floor(diff / 3600));
+        if (diff < 2592000) return _('time.days_ago').replace('{count}', Math.floor(diff / 86400));
+        return d.toLocaleDateString();
+    }
+
+    function showToast(message, type) {
+        if (window.BetterDesk?.notify) { window.BetterDesk.notify(message, type); return; }
+        const container = document.getElementById('toast-container');
+        if (!container) return;
+        const toast = document.createElement('div');
+        toast.className = `toast toast-${type || 'info'}`;
+        toast.textContent = message;
+        container.appendChild(toast);
+        setTimeout(() => toast.remove(), 4000);
+    }
+
+    // ---- Tab switching ----
+    document.querySelectorAll('.tab-btn').forEach(btn => {
+        btn.addEventListener('click', () => {
+            document.querySelectorAll('.tab-btn').forEach(b => b.classList.remove('active'));
+            document.querySelectorAll('.tab-panel').forEach(p => p.classList.remove('active'));
+            btn.classList.add('active');
+            const panel = document.getElementById('tab-' + btn.dataset.tab);
+            if (panel) panel.classList.add('active');
+        });
+    });
+
+    // ---- Modal close ----
+    document.querySelectorAll('.modal-close').forEach(btn => {
+        btn.addEventListener('click', () => {
+            const id = btn.dataset.modal;
+            if (id) document.getElementById(id).style.display = 'none';
+        });
+    });
+
+    // ---- Searching ----
+    let allTargets = [];
+    const searchInput = document.getElementById('target-search');
+    searchInput.addEventListener('input', () => {
+        const q = searchInput.value.toLowerCase();
+        const filtered = q ? allTargets.filter(t => (t.name + t.host).toLowerCase().includes(q)) : allTargets;
+        renderTargets(filtered);
+    });
+
+    // ==== TARGETS ====
+
+    const targetsBody = document.getElementById('targets-body');
+    const createBtn = document.getElementById('create-target-btn');
+    const targetModal = document.getElementById('target-modal');
+    const saveBtn = document.getElementById('target-save-btn');
+
+    async function loadTargets() {
+        targetsBody.innerHTML = `<tr class="loading-row"><td colspan="8">${_('common.loading')}</td></tr>`;
+        try {
+            const data = await apiFetch('/api/network/targets');
+            allTargets = Array.isArray(data) ? data : [];
+            renderTargets(allTargets);
+        } catch (err) {
+            targetsBody.innerHTML = `<tr class="empty-row"><td colspan="8">
+                <div class="empty-state"><span class="material-icons">error_outline</span><p>${escapeHtml(err.message)}</p></div></td></tr>`;
+        }
+    }
+
+    async function loadStats() {
+        try {
+            const stats = await apiFetch('/api/network/stats');
+            document.getElementById('stat-total').textContent = stats.total ?? 0;
+            document.getElementById('stat-up').textContent = stats.up ?? 0;
+            document.getElementById('stat-down').textContent = stats.down ?? 0;
+            document.getElementById('stat-avg-latency').textContent = stats.avg_latency != null ? Math.round(stats.avg_latency) + ' ms' : '—';
+        } catch (_e) { /* ignore */ }
+    }
+
+    function renderTargets(targets) {
+        if (!targets.length) {
+            targetsBody.innerHTML = `<tr class="empty-row"><td colspan="8">
+                <div class="empty-state"><span class="material-icons">dns</span><p>${_('network.no_targets')}</p></div></td></tr>`;
+            return;
+        }
+        targetsBody.innerHTML = targets.map(t => {
+            const status = t.last_status || 'unknown';
+            const latency = t.last_latency_ms;
+            const latencyClass = latency == null ? '' : latency < 100 ? 'good' : latency < 500 ? 'warn' : 'bad';
+            return `
+            <tr data-id="${t.id}">
+                <td>${escapeHtml(t.name)}</td>
+                <td>${escapeHtml(t.host)}</td>
+                <td>${escapeHtml(t.check_type || 'ping')}</td>
+                <td>${t.port || '—'}</td>
+                <td>${t.interval_ms ? Math.round(t.interval_ms / 1000) : (t.check_interval || 60)}s</td>
+                <td><span class="target-status ${status}"><span class="dot"></span> ${status.toUpperCase()}</span></td>
+                <td><span class="latency-val ${latencyClass}">${latency != null ? latency + ' ms' : '—'}</span></td>
+                <td class="action-btn-group">
+                    <button class="btn btn-sm btn-secondary check-btn" data-id="${t.id}" title="${_('network.check_now')}"><span class="material-icons" style="font-size:16px">refresh</span></button>
+                    <button class="btn btn-sm btn-secondary hist-btn" data-id="${t.id}" title="${_('network.check_history')}"><span class="material-icons" style="font-size:16px">history</span></button>
+                    <button class="btn btn-sm btn-secondary edit-btn" data-id="${t.id}"><span class="material-icons" style="font-size:16px">edit</span></button>
+                    <button class="btn btn-sm btn-danger del-btn" data-id="${t.id}"><span class="material-icons" style="font-size:16px">delete</span></button>
+                </td>
+            </tr>`;
+        }).join('');
+
+        targetsBody.querySelectorAll('.check-btn').forEach(btn => btn.addEventListener('click', () => checkTarget(btn.dataset.id)));
+        targetsBody.querySelectorAll('.hist-btn').forEach(btn => btn.addEventListener('click', () => showHistory(btn.dataset.id)));
+        targetsBody.querySelectorAll('.edit-btn').forEach(btn => btn.addEventListener('click', () => editTarget(btn.dataset.id)));
+        targetsBody.querySelectorAll('.del-btn').forEach(btn => btn.addEventListener('click', () => deleteTarget(btn.dataset.id)));
+    }
+
+    function openTargetModal(t) {
+        document.getElementById('target-modal-title').textContent = t ? _('network.edit_target') : _('network.add_target');
+        document.getElementById('target-id').value = t ? t.id : '';
+        document.getElementById('target-name').value = t ? t.name : '';
+        document.getElementById('target-host').value = t ? t.host : '';
+        document.getElementById('target-type').value = t ? t.check_type : 'ping';
+        document.getElementById('target-port').value = t ? t.port || 80 : 80;
+        document.getElementById('target-interval').value = t ? String(t.interval_ms ? Math.round(t.interval_ms / 1000) : (t.check_interval || 60)) : '60';
+        document.getElementById('target-enabled').checked = t ? !!t.enabled : true;
+        targetModal.style.display = 'flex';
+    }
+
+    async function editTarget(id) {
+        try {
+            const t = await apiFetch(`/api/network/targets/${id}`);
+            openTargetModal(t);
+        } catch (err) { showToast(err.message, 'error'); }
+    }
+
+    async function saveTarget() {
+        const id = document.getElementById('target-id').value;
+        const body = {
+            name: document.getElementById('target-name').value.trim(),
+            host: document.getElementById('target-host').value.trim(),
+            check_type: document.getElementById('target-type').value,
+            port: parseInt(document.getElementById('target-port').value, 10) || null,
+            check_interval: parseInt(document.getElementById('target-interval').value, 10) || 60,
+            interval_ms: (parseInt(document.getElementById('target-interval').value, 10) || 60) * 1000,
+            enabled: document.getElementById('target-enabled').checked,
+        };
+        if (!body.name || !body.host) { showToast(_('network.name_host_required'), 'error'); return; }
+        try {
+            const url = id ? `/api/network/targets/${id}` : '/api/network/targets';
+            const method = id ? 'PATCH' : 'POST';
+            await apiFetch(url, { method, body: JSON.stringify(body) });
+            targetModal.style.display = 'none';
+            showToast(_('common.saved'), 'success');
+            loadTargets();
+            loadStats();
+        } catch (err) { showToast(err.message, 'error'); }
+    }
+
+    async function deleteTarget(id) {
+        if (!confirm(_('network.delete_target') + '?')) return;
+        try {
+            await apiFetch(`/api/network/targets/${id}`, { method: 'DELETE' });
+            showToast(_('common.success'), 'success');
+            loadTargets();
+            loadStats();
+        } catch (err) { showToast(err.message, 'error'); }
+    }
+
+    async function checkTarget(id) {
+        try {
+            const result = await apiFetch(`/api/network/targets/${id}/check`, { method: 'POST' });
+            showToast(`${result.status === 'up' ? '✓' : '✗'} ${result.latency_ms != null ? result.latency_ms + 'ms' : ''}`, result.status === 'up' ? 'success' : 'error');
+            loadTargets();
+            loadStats();
+        } catch (err) { showToast(err.message, 'error'); }
+    }
+
+    async function showHistory(id) {
+        const modal = document.getElementById('history-modal');
+        const body = document.getElementById('history-body');
+        modal.style.display = 'flex';
+        body.innerHTML = `<p>${_('common.loading')}</p>`;
+        try {
+            const history = await apiFetch(`/api/network/targets/${id}/history`);
+            const entries = Array.isArray(history) ? history : [];
+            if (!entries.length) {
+                body.innerHTML = `<div class="empty-state"><span class="material-icons">history</span><p>${_('network.no_history')}</p></div>`;
+                return;
+            }
+            body.innerHTML = `<div class="history-timeline">${entries.map(e => `
+                <div class="history-entry">
+                    <span class="time">${formatTimeAgo(e.checked_at)}</span>
+                    <span class="status-dot ${e.status}"></span>
+                    <span>${e.status.toUpperCase()}</span>
+                    <span class="latency">${e.latency_ms != null ? e.latency_ms + ' ms' : '—'}</span>
+                </div>`).join('')}</div>`;
+        } catch (err) {
+            body.innerHTML = `<p class="text-error">${escapeHtml(err.message)}</p>`;
+        }
+    }
+
+    createBtn.addEventListener('click', () => openTargetModal(null));
+    saveBtn.addEventListener('click', saveTarget);
+
+    // ==== TOOLS ====
+
+    async function runTool(endpoint, body, resultEl) {
+        resultEl.textContent = _('common.loading');
+        resultEl.className = 'tool-result';
+        try {
+            const result = await apiFetch(endpoint, { method: 'POST', body: JSON.stringify(body) });
+            resultEl.className = 'tool-result ' + (result.success ? 'success' : 'error');
+            resultEl.textContent = JSON.stringify(result, null, 2);
+        } catch (err) {
+            resultEl.className = 'tool-result error';
+            resultEl.textContent = err.message;
+        }
+    }
+
+    document.getElementById('tool-ping-btn').addEventListener('click', () => {
+        runTool('/api/network/ping', { host: document.getElementById('tool-ping-host').value.trim() }, document.getElementById('tool-ping-result'));
+    });
+
+    document.getElementById('tool-tcp-btn').addEventListener('click', () => {
+        runTool('/api/network/tcp', {
+            host: document.getElementById('tool-tcp-host').value.trim(),
+            port: parseInt(document.getElementById('tool-tcp-port').value, 10) || 80
+        }, document.getElementById('tool-tcp-result'));
+    });
+
+    document.getElementById('tool-http-btn').addEventListener('click', () => {
+        runTool('/api/network/http', { url: document.getElementById('tool-http-url').value.trim() }, document.getElementById('tool-http-result'));
+    });
+
+    document.getElementById('tool-dns-btn').addEventListener('click', () => {
+        runTool('/api/network/resolve', { host: document.getElementById('tool-dns-host').value.trim() }, document.getElementById('tool-dns-result'));
+    });
+
+    // ==== Monitor toggle ====
+
+    const monitorBtn = document.getElementById('monitor-toggle-btn');
+    let monitorRunning = false;
+
+    async function checkMonitorStatus() {
+        try {
+            const data = await apiFetch('/api/network/monitor/status');
+            monitorRunning = !!data.running;
+            updateMonitorBtn();
+        } catch (_e) { /* ignore */ }
+    }
+
+    function updateMonitorBtn() {
+        if (monitorRunning) {
+            monitorBtn.innerHTML = `<span class="material-icons">stop</span> ${_('network.monitor_stop')}`;
+            monitorBtn.classList.add('monitor-active');
+        } else {
+            monitorBtn.innerHTML = `<span class="material-icons">play_arrow</span> ${_('network.monitor_start')}`;
+            monitorBtn.classList.remove('monitor-active');
+        }
+    }
+
+    monitorBtn.addEventListener('click', async () => {
+        const action = monitorRunning ? 'stop' : 'start';
+        try {
+            await apiFetch(`/api/network/monitor/${action}`, { method: 'POST' });
+            monitorRunning = !monitorRunning;
+            updateMonitorBtn();
+            showToast(_('common.success'), 'success');
+        } catch (err) { showToast(err.message, 'error'); }
+    });
+
+    // ---- Init ----
+    loadTargets();
+    loadStats();
+    checkMonitorStatus();
+})();
diff --git a/web-nodejs/public/js/rdclient/client.js b/web-nodejs/public/js/rdclient/client.js
index 0d3f4995..70e87fa1 100644
--- a/web-nodejs/public/js/rdclient/client.js
+++ b/web-nodejs/public/js/rdclient/client.js
@@ -138,13 +138,60 @@ class RDClient {
             // Store peer's server-signed pk for SignedId verification (from RelayResponse.pk)
             this._peerSignedPk = rendezvousResponse.pk || null;
 
-            // Step 7: Close rendezvous, connect to relay
+            // Step 7: Determine relay UUID.
+            //
+            // PunchHoleResponse does NOT contain a UUID — only natType and relayServer.
+            // The signal server expects us to send RequestRelay{uuid} back on the SAME
+            // rendezvous connection so it can forward the UUID to the target device.
+            // Both sides then connect to hbbr with the same UUID → relay pairs them.
+            //
+            // If we already received a RelayResponse (which has a UUID), skip this step.
+            let relayUUID = rendezvousResponse.uuid || '';
+            let relayServer = rendezvousResponse.relayServer || '';
+
+            if (!relayUUID) {
+                // Generate UUID for relay pairing (crypto.randomUUID requires
+                // secure context HTTPS — use fallback for HTTP)
+                relayUUID = (window.crypto && window.crypto.randomUUID
+                    ? window.crypto.randomUUID()
+                    : 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, c => {
+                        const r = Math.random() * 16 | 0;
+                        return (c === 'x' ? r : (r & 0x3 | 0x8)).toString(16);
+                    }));
+
+                // Step 8: Send RequestRelay back to hbbs (signal server) via rendezvous
+                // so it can tell the target device to connect to relay with our UUID.
+                this._emit('log', `Requesting relay (uuid: ${relayUUID.substring(0, 8)}...)...`);
+                const requestRelaySignal = this.proto.buildRequestRelay(
+                    this.deviceId,
+                    relayUUID,
+                    relayServer,
+                    this.opts.serverPubKey
+                );
+                const signalData = this.proto.encodeRendezvous(requestRelaySignal);
+                this.conn.sendRendezvous(signalData);
+
+                // Step 9: Wait for RelayResponse from hbbs confirming the relay setup
+                const relayConfirm = await this._waitForSignalRelayResponse();
+                if (relayConfirm.error) {
+                    throw new Error(`Relay refused: ${relayConfirm.error}`);
+                }
+                // Use the confirmed UUID and relay server from hbbs
+                relayUUID = relayConfirm.uuid || relayUUID;
+                relayServer = relayConfirm.relayServer || relayServer;
+                if (relayConfirm.pk) {
+                    this._peerSignedPk = relayConfirm.pk;
+                }
+                console.log(`[RDClient] RelayResponse confirmed: uuid=${relayUUID.substring(0, 8)}... relay=${relayServer}`);
+            }
+
+            // Step 10: Close rendezvous, connect to relay
             this.conn.closeRendezvous();
 
             this._emit('log', 'Connecting to relay server...');
             await this.conn.connectRelay();
 
-            // Step 8: Setup relay message handler BEFORE sending anything
+            // Step 11: Setup relay message handler BEFORE sending anything
             this.conn.on('relay:message', (data) => this._handleRelayData(data));
             this.conn.on('relay:close', () => {
                 if (this._state !== 'disconnected' && this._state !== 'error') {
@@ -153,18 +200,18 @@ class RDClient {
             });
             this.conn.on('relay:error', (e) => this._handleDisconnect('Relay error: ' + e.message));
 
-            // Step 9: Send RequestRelay to hbbr (with licence_key - hbbr validates this!)
-            this._emit('log', `Requesting relay (uuid: ${(rendezvousResponse.uuid || '').substring(0, 8)}...)...`);
+            // Step 12: Send RequestRelay to hbbr (relay expects this as first message for pairing)
+            this._emit('log', `Connecting to relay (uuid: ${relayUUID.substring(0, 8)}...)...`);
             const requestRelay = this.proto.buildRequestRelay(
                 this.deviceId,
-                rendezvousResponse.uuid || '',
-                rendezvousResponse.relayServer || '',
+                relayUUID,
+                relayServer,
                 this.opts.serverPubKey
             );
             const relayData = this.proto.encodeRendezvous(requestRelay);
             this.conn.sendRelay(relayData);
 
-            // Step 10: Wait for target's SignedId (first message from relay)
+            // Step 13: Wait for target's SignedId (first message from relay)
             // Target sends SignedId FIRST (unencrypted, signed with their Ed25519 key).
             // We do NOT send anything until we process SignedId and perform key exchange.
             this._emit('log', 'Waiting for peer handshake...');
@@ -201,7 +248,8 @@ class RDClient {
                 myId: 'betterdesk-web-' + Date.now().toString(36),
                 myName: 'BetterDesk Web',
                 disableAudio: this.opts.disableAudio || false,
-                fps: this.opts.fps || 30
+                fps: this.opts.fps || 60,
+                imageQuality: this.opts.imageQuality || 'Best'
             });
 
             console.log('[RDClient] Auth: sending LoginRequest, crypto.enabled=' + this.crypto.enabled
@@ -347,6 +395,75 @@ class RDClient {
         });
     }
 
+    /**
+     * Wait for RelayResponse from signal server (hbbs) after sending RequestRelay.
+     *
+     * After PunchHoleResponse (natType=SYMMETRIC), we send RequestRelay{uuid} back
+     * to hbbs on the same rendezvous connection. hbbs forwards the request to the
+     * target device (tells it to connect to relay with our UUID) and sends back a
+     * RelayResponse confirming the UUID and relay server.
+     *
+     * @returns {Promise<{uuid: string, relayServer: string, pk: Uint8Array|null, error?: string}>}
+     */
+    _waitForSignalRelayResponse() {
+        return new Promise((resolve, reject) => {
+            const timeout = setTimeout(() => {
+                this.conn.off('rendezvous:message', handler);
+                reject(new Error('RelayResponse timeout (15s) — target device may be unreachable'));
+            }, 15000);
+
+            const handler = (rawData) => {
+                const frames = this._rendezvousDecoder.feed(rawData);
+                if (frames.length === 0) return;
+
+                for (const frame of frames) {
+                    try {
+                        const msg = this.proto.decodeRendezvous(frame);
+
+                        // Skip KeyExchange, HealthCheck, and other housekeeping
+                        if (msg.keyExchange || msg.hc) continue;
+
+                        if (msg.relayResponse) {
+                            clearTimeout(timeout);
+                            this.conn.off('rendezvous:message', handler);
+                            const rr = msg.relayResponse;
+                            console.log('[RDClient] Signal RelayResponse:', JSON.stringify({
+                                relayServer: rr.relayServer || '',
+                                uuid: (rr.uuid || '').substring(0, 8) + '...',
+                                hasPk: !!(rr.pk && rr.pk.length),
+                                refuseReason: rr.refuseReason || ''
+                            }));
+                            if (rr.refuseReason && rr.refuseReason.length > 0) {
+                                resolve({ error: rr.refuseReason });
+                            } else {
+                                resolve({
+                                    uuid: rr.uuid || '',
+                                    relayServer: rr.relayServer || '',
+                                    pk: rr.pk || null
+                                });
+                            }
+                            return;
+                        }
+
+                        // PunchHoleSent may arrive from target — it's just an update,
+                        // not what we are waiting for. Log and continue.
+                        if (msg.punchHoleResponse || msg.punchHoleSent) {
+                            console.log('[RDClient] Skipping late PunchHoleResponse/Sent while waiting for RelayResponse');
+                            continue;
+                        }
+
+                        const fieldNames = Object.keys(msg).filter(k => msg[k] != null && k !== 'union');
+                        console.log('[RDClient] Skipping signal message while waiting for RelayResponse:', fieldNames.join(', '));
+                    } catch (err) {
+                        console.warn('[RDClient] Failed to decode signal frame:', err.message);
+                    }
+                }
+            };
+
+            this.conn.on('rendezvous:message', handler);
+        });
+    }
+
     /**
      * Handle raw incoming relay data (TCP chunks via WebSocket)
      * Uses stream decoder for frame reassembly, then dispatches each complete message.
@@ -832,9 +949,13 @@ class RDClient {
             });
         }
 
-        // Tell peer our desired FPS to avoid unnecessary throttling
-        const fps = this.opts.fps || 30;
-        this._sendPeerMessage(this.proto.buildOptionMisc({ customFps: fps }));
+        // Tell peer our desired FPS and image quality after session establishment
+        const fps = this.opts.fps || 60;
+        const quality = this.opts.imageQuality || 'Best';
+        this._sendPeerMessage(this.proto.buildOptionMisc({
+            customFps: fps,
+            imageQuality: quality
+        }));
 
         // Start ping interval
         this._pingInterval = setInterval(() => {
diff --git a/web-nodejs/public/js/rdclient/input.js b/web-nodejs/public/js/rdclient/input.js
index 677ce37c..53e5b988 100644
--- a/web-nodejs/public/js/rdclient/input.js
+++ b/web-nodejs/public/js/rdclient/input.js
@@ -116,19 +116,36 @@ class RDInput {
     // ---- Mouse Event Handlers ----
 
     /**
-     * RustDesk mouse button mask values:
-     * 1 = left button press
-     * 2 = left button release
-     * 4 = right button press
-     * 8 = right button release
-     * 16 = middle button press
-     * 32 = middle button release
-     * 64 = scroll up
-     * 128 = scroll down
-     * 256 = scroll left
-     * 512 = scroll right
-     * MOVE = 0 (just position update)
+     * RustDesk mouse event mask encoding:
+     *   mask = EVENT_TYPE | (BUTTON << 3)
+     *
+     * Event types (bits 0-2):
+     *   0 = move, 1 = down, 2 = up, 3 = wheel
+     *
+     * Button IDs (bits 3+):
+     *   1 = left, 2 = right, 4 = middle, 8 = back, 16 = forward
+     *
+     * Scroll directions (encoded in button bits for wheel type):
+     *   0 = up, 1 = down, 2 = right, 3 = left
+     *
+     * Examples:
+     *   move          = 0
+     *   left down     = 1 | (1 << 3) = 9
+     *   left up       = 2 | (1 << 3) = 10
+     *   right down    = 1 | (2 << 3) = 17
+     *   right up      = 2 | (2 << 3) = 18
+     *   middle down   = 1 | (4 << 3) = 33
+     *   middle up     = 2 | (4 << 3) = 34
+     *   scroll up     = 3 | (0 << 3) = 3
+     *   scroll down   = 3 | (1 << 3) = 11
      */
+    static MOUSE_TYPE_DOWN  = 1;
+    static MOUSE_TYPE_UP    = 2;
+    static MOUSE_TYPE_WHEEL = 3;
+
+    static MOUSE_BUTTON_LEFT   = 1;
+    static MOUSE_BUTTON_RIGHT  = 2;
+    static MOUSE_BUTTON_MIDDLE = 4;
 
     _handleMouseMove(e) {
         if (!this.enabled) return;
@@ -162,15 +179,16 @@ class RDInput {
         const pos = this._getRemotePosition(e);
         if (!pos) return;
 
-        let mask = 0;
+        let button = 0;
         switch (e.button) {
-        case 0: mask = 1; break;   // Left press
-        case 1: mask = 16; break;  // Middle press
-        case 2: mask = 4; break;   // Right press
+        case 0: button = RDInput.MOUSE_BUTTON_LEFT; break;
+        case 1: button = RDInput.MOUSE_BUTTON_MIDDLE; break;
+        case 2: button = RDInput.MOUSE_BUTTON_RIGHT; break;
         }
 
-        if (mask) {
-            this.buttonMask |= mask;
+        if (button) {
+            const mask = RDInput.MOUSE_TYPE_DOWN | (button << 3);
+            this.buttonMask |= button;
             this.sendMessage({
                 mouseEvent: {
                     mask: mask,
@@ -189,15 +207,16 @@ class RDInput {
         const pos = this._getRemotePosition(e);
         if (!pos) return;
 
-        let mask = 0;
+        let button = 0;
         switch (e.button) {
-        case 0: mask = 2; break;   // Left release
-        case 1: mask = 32; break;  // Middle release
-        case 2: mask = 8; break;   // Right release
+        case 0: button = RDInput.MOUSE_BUTTON_LEFT; break;
+        case 1: button = RDInput.MOUSE_BUTTON_MIDDLE; break;
+        case 2: button = RDInput.MOUSE_BUTTON_RIGHT; break;
         }
 
-        if (mask) {
-            this.buttonMask &= ~mask;
+        if (button) {
+            const mask = RDInput.MOUSE_TYPE_UP | (button << 3);
+            this.buttonMask &= ~button;
             this.sendMessage({
                 mouseEvent: {
                     mask: mask,
@@ -216,13 +235,15 @@ class RDInput {
         const pos = this._getRemotePosition(e);
         if (!pos) return;
 
-        let mask = 0;
-        if (e.deltaY < 0) mask = 64;       // Scroll up
-        else if (e.deltaY > 0) mask = 128;  // Scroll down
-        else if (e.deltaX < 0) mask = 256;  // Scroll left
-        else if (e.deltaX > 0) mask = 512;  // Scroll right
+        // Scroll direction encoded in button bits: 0=up, 1=down, 2=right, 3=left
+        let direction = -1;
+        if (e.deltaY < 0) direction = 0;        // Scroll up
+        else if (e.deltaY > 0) direction = 1;   // Scroll down
+        else if (e.deltaX > 0) direction = 2;   // Scroll right
+        else if (e.deltaX < 0) direction = 3;   // Scroll left
 
-        if (mask) {
+        if (direction >= 0) {
+            const mask = RDInput.MOUSE_TYPE_WHEEL | (direction << 3);
             this.sendMessage({
                 mouseEvent: {
                     mask: mask,
diff --git a/web-nodejs/public/js/rdclient/protocol.js b/web-nodejs/public/js/rdclient/protocol.js
index 268a847b..6abc1e49 100644
--- a/web-nodejs/public/js/rdclient/protocol.js
+++ b/web-nodejs/public/js/rdclient/protocol.js
@@ -187,6 +187,9 @@ class RDProtocol {
         const hasWebCodecs = typeof VideoDecoder !== 'undefined';
         const hasJMuxer = typeof JMuxer !== 'undefined';
 
+        // Default to Best quality for sharpest image
+        const quality = opts.imageQuality || 'Best';
+
         return {
             loginRequest: {
                 username: opts.username || '',
@@ -197,7 +200,7 @@ class RDProtocol {
                 version: 'BetterDesk-Web/1.0',
                 sessionId: Date.now(),
                 option: {
-                    imageQuality: this.enums.ImageQuality.values.Balanced,
+                    imageQuality: this.enums.ImageQuality.values[quality] || this.enums.ImageQuality.values.Best,
                     supportedDecoding: {
                         abilityVp9: hasWebCodecs ? 1 : 0,
                         abilityH264: (hasWebCodecs || hasJMuxer) ? 1 : 0,
@@ -205,7 +208,7 @@ class RDProtocol {
                         abilityVp8: hasWebCodecs ? 1 : 0,
                         prefer: hasWebCodecs ? 0 : 2 // Auto when WebCodecs, H264 when fallback
                     },
-                    customFps: opts.fps || 30,
+                    customFps: opts.fps || 60,
                     showRemoteCursor: 2, // Yes
                     disableAudio: opts.disableAudio ? 2 : 1,
                     disableClipboard: 1, // No
diff --git a/web-nodejs/public/js/registrations.js b/web-nodejs/public/js/registrations.js
index 3f1c59bd..36467044 100644
--- a/web-nodejs/public/js/registrations.js
+++ b/web-nodejs/public/js/registrations.js
@@ -168,7 +168,7 @@
     function openRejectModal(id) {
         rejectTargetId = id;
         rejectReasonInput.value = '';
-        rejectModal.style.display = '';
+        rejectModal.style.display = 'flex';
     }
 
     async function confirmReject() {
@@ -234,19 +234,13 @@
 
     function formatTimeAgo(dateStr) {
         if (!dateStr) return '—';
-        const date = new Date(dateStr);
-        const now = new Date();
-        const diffMs = now - date;
-        const diffSec = Math.floor(diffMs / 1000);
-        const diffMin = Math.floor(diffSec / 60);
-        const diffHour = Math.floor(diffMin / 60);
-        const diffDay = Math.floor(diffHour / 24);
-
-        if (diffSec < 60) return `${diffSec}s ago`;
-        if (diffMin < 60) return `${diffMin}m ago`;
-        if (diffHour < 24) return `${diffHour}h ago`;
-        if (diffDay < 30) return `${diffDay}d ago`;
-        return date.toLocaleDateString();
+        const d = new Date(dateStr);
+        const diff = Math.floor((Date.now() - d) / 1000);
+        if (diff < 60) return _('time.seconds_ago').replace('{count}', diff);
+        if (diff < 3600) return _('time.minutes_ago').replace('{count}', Math.floor(diff / 60));
+        if (diff < 86400) return _('time.hours_ago').replace('{count}', Math.floor(diff / 3600));
+        if (diff < 2592000) return _('time.days_ago').replace('{count}', Math.floor(diff / 86400));
+        return d.toLocaleDateString();
     }
 
     function showToast(message, type) {
diff --git a/web-nodejs/public/js/remote.js b/web-nodejs/public/js/remote.js
index 9c53467a..277b266b 100644
--- a/web-nodejs/public/js/remote.js
+++ b/web-nodejs/public/js/remote.js
@@ -92,6 +92,7 @@
             serverPubKey: window.BetterDesk.serverPubKey || '',
             scaleMode: 'fit',
             fps: 60,
+            imageQuality: 'Best',
             disableAudio: false
         });
 
diff --git a/web-nodejs/public/js/reports.js b/web-nodejs/public/js/reports.js
new file mode 100644
index 00000000..01f49be9
--- /dev/null
+++ b/web-nodejs/public/js/reports.js
@@ -0,0 +1,290 @@
+/**
+ * BetterDesk Console - Reports Page Script
+ */
+
+(function () {
+    'use strict';
+
+    const _ = window.BetterDesk?.translations
+        ? (key) => {
+            const keys = key.split('.');
+            let val = window.BetterDesk.translations;
+            for (const k of keys) { val = val?.[k]; }
+            return val || key;
+        }
+        : (key) => key;
+
+    const csrfToken = window.BetterDesk?.csrfToken || '';
+
+    async function apiFetch(url, options = {}) {
+        const headers = { 'Content-Type': 'application/json' };
+        if (csrfToken) headers['x-csrf-token'] = csrfToken;
+        const resp = await fetch(url, { ...options, headers: { ...headers, ...options.headers } });
+        if (!resp.ok) {
+            const text = await resp.text();
+            let msg;
+            try { msg = JSON.parse(text).error; } catch (_e) { msg = resp.statusText; }
+            throw new Error(msg || `HTTP ${resp.status}`);
+        }
+        return resp;
+    }
+
+    function escapeHtml(str) {
+        if (!str) return '';
+        const div = document.createElement('div');
+        div.textContent = String(str);
+        return div.innerHTML;
+    }
+
+    function formatTimeAgo(dateStr) {
+        if (!dateStr) return '—';
+        const d = new Date(dateStr);
+        const diff = Math.floor((Date.now() - d) / 1000);
+        if (diff < 60) return _('time.seconds_ago').replace('{count}', diff);
+        if (diff < 3600) return _('time.minutes_ago').replace('{count}', Math.floor(diff / 60));
+        if (diff < 86400) return _('time.hours_ago').replace('{count}', Math.floor(diff / 3600));
+        if (diff < 2592000) return _('time.days_ago').replace('{count}', Math.floor(diff / 86400));
+        return d.toLocaleDateString();
+    }
+
+    function showToast(message, type) {
+        if (window.BetterDesk?.notify) { window.BetterDesk.notify(message, type); return; }
+        const container = document.getElementById('toast-container');
+        if (!container) return;
+        const toast = document.createElement('div');
+        toast.className = `toast toast-${type || 'info'}`;
+        toast.textContent = message;
+        container.appendChild(toast);
+        setTimeout(() => toast.remove(), 4000);
+    }
+
+    // ---- Tab switching ----
+    document.querySelectorAll('.tab-btn').forEach(btn => {
+        btn.addEventListener('click', () => {
+            document.querySelectorAll('.tab-btn').forEach(b => b.classList.remove('active'));
+            document.querySelectorAll('.tab-panel').forEach(p => p.classList.remove('active'));
+            btn.classList.add('active');
+            const panel = document.getElementById('tab-' + btn.dataset.tab);
+            if (panel) panel.classList.add('active');
+            if (btn.dataset.tab === 'saved') loadSaved();
+        });
+    });
+
+    // ==== Generate ====
+
+    let selectedType = null;
+    let lastReportData = null;
+    const optionsPanel = document.getElementById('report-options');
+    const optionsTitle = document.getElementById('report-options-title');
+    const previewPanel = document.getElementById('report-preview');
+    const previewContent = document.getElementById('preview-content');
+
+    document.querySelectorAll('.report-type-card').forEach(card => {
+        card.addEventListener('click', () => {
+            document.querySelectorAll('.report-type-card').forEach(c => c.classList.remove('selected'));
+            card.classList.add('selected');
+            selectedType = card.dataset.type;
+            optionsTitle.textContent = card.querySelector('h3').textContent;
+            optionsPanel.style.display = '';
+            previewPanel.style.display = 'none';
+        });
+    });
+
+    document.getElementById('generate-btn').addEventListener('click', async () => {
+        if (!selectedType) return;
+        const format = document.getElementById('report-format').value;
+        const body = {
+            type: selectedType,
+            from: document.getElementById('report-from').value || undefined,
+            to: document.getElementById('report-to').value || undefined,
+        };
+
+        try {
+            const endpoint = format === 'csv' ? '/api/reports/generate/csv' : '/api/reports/generate';
+            const resp = await apiFetch(endpoint, { method: 'POST', body: JSON.stringify(body) });
+
+            if (format === 'csv') {
+                const text = await resp.text();
+                lastReportData = text;
+                previewContent.textContent = text;
+            } else {
+                const json = await resp.json();
+                lastReportData = JSON.stringify(json, null, 2);
+                renderReport(json);
+            }
+            previewPanel.style.display = '';
+        } catch (err) {
+            showToast(err.message, 'error');
+        }
+    });
+
+    document.getElementById('download-btn').addEventListener('click', () => {
+        if (!lastReportData) return;
+        const format = document.getElementById('report-format').value;
+        const ext = format === 'csv' ? 'csv' : 'json';
+        const mime = format === 'csv' ? 'text/csv' : 'application/json';
+        const blob = new Blob([lastReportData], { type: mime });
+        const url = URL.createObjectURL(blob);
+        const a = document.createElement('a');
+        a.href = url;
+        a.download = `report_${selectedType}_${new Date().toISOString().slice(0, 10)}.${ext}`;
+        a.click();
+        URL.revokeObjectURL(url);
+    });
+
+    document.getElementById('save-report-btn').addEventListener('click', async () => {
+        if (!selectedType) return;
+        const title = prompt(_('reports.report_name'));
+        if (!title) return;
+        try {
+            const resp = await apiFetch('/api/reports/save', {
+                method: 'POST',
+                body: JSON.stringify({
+                    title,
+                    type: selectedType,
+                    from: document.getElementById('report-from').value || undefined,
+                    to: document.getElementById('report-to').value || undefined,
+                })
+            });
+            await resp.json();
+            showToast(_('common.saved'), 'success');
+        } catch (err) { showToast(err.message, 'error'); }
+    });
+
+    // ==== Saved reports ====
+
+    const savedBody = document.getElementById('saved-body');
+
+    async function loadSaved() {
+        savedBody.innerHTML = `<tr class="loading-row"><td colspan="4">${_('common.loading')}</td></tr>`;
+        try {
+            const resp = await apiFetch('/api/reports/saved');
+            const data = await resp.json();
+            const reports = Array.isArray(data) ? data : [];
+            if (!reports.length) {
+                savedBody.innerHTML = `<tr class="empty-row"><td colspan="4">
+                    <div class="empty-state"><span class="material-icons">description</span><p>${_('reports.no_saved')}</p></div></td></tr>`;
+                return;
+            }
+            savedBody.innerHTML = reports.map(r => `
+                <tr>
+                    <td class="report-name">${escapeHtml(r.title || r.name)}</td>
+                    <td>${escapeHtml(r.report_type || r.type)}</td>
+                    <td class="time-cell">${formatTimeAgo(r.created_at)}</td>
+                    <td class="action-btn-group">
+                        <button class="btn btn-sm btn-primary run-btn" data-id="${r.id}"><span class="material-icons" style="font-size:16px">play_arrow</span></button>
+                        <button class="btn btn-sm btn-danger del-btn" data-id="${r.id}"><span class="material-icons" style="font-size:16px">delete</span></button>
+                    </td>
+                </tr>
+            `).join('');
+
+            savedBody.querySelectorAll('.run-btn').forEach(btn => {
+                btn.addEventListener('click', () => runSaved(btn.dataset.id));
+            });
+            savedBody.querySelectorAll('.del-btn').forEach(btn => {
+                btn.addEventListener('click', () => deleteSaved(btn.dataset.id));
+            });
+        } catch (err) {
+            savedBody.innerHTML = `<tr class="empty-row"><td colspan="4">
+                <div class="empty-state"><span class="material-icons">error_outline</span><p>${escapeHtml(err.message)}</p></div></td></tr>`;
+        }
+    }
+
+    async function runSaved(id) {
+        try {
+            const resp = await apiFetch(`/api/reports/saved/${id}`);
+            const saved = await resp.json();
+            const payload = typeof saved.payload === 'string'
+                ? JSON.parse(saved.payload) : (saved.payload || {});
+            lastReportData = JSON.stringify(payload, null, 2);
+            renderReport(payload);
+            previewPanel.style.display = '';
+
+            // Switch to generate tab
+            document.querySelectorAll('.tab-btn').forEach(b => b.classList.remove('active'));
+            document.querySelectorAll('.tab-panel').forEach(p => p.classList.remove('active'));
+            document.querySelector('.tab-btn[data-tab="generate"]').classList.add('active');
+            document.getElementById('tab-generate').classList.add('active');
+        } catch (err) { showToast(err.message, 'error'); }
+    }
+
+    async function deleteSaved(id) {
+        if (!confirm(_('reports.delete_saved') + '?')) return;
+        try {
+            await apiFetch(`/api/reports/saved/${id}`, { method: 'DELETE' });
+            showToast(_('common.success'), 'success');
+            loadSaved();
+        } catch (err) { showToast(err.message, 'error'); }
+    }
+
+    // ==== Human-readable report renderer ====
+
+    function renderReport(data) {
+        if (!data) { previewContent.textContent = ''; return; }
+        let html = '';
+
+        // Top-level scalar fields as summary cards
+        const scalars = {};
+        const sections = {};
+        for (const [k, v] of Object.entries(data)) {
+            if (v === null || v === undefined) continue;
+            if (Array.isArray(v)) { sections[k] = v; }
+            else if (typeof v === 'object') { sections[k] = v; }
+            else { scalars[k] = v; }
+        }
+
+        if (Object.keys(scalars).length > 0) {
+            html += '<div class="report-summary">';
+            for (const [k, v] of Object.entries(scalars)) {
+                html += `<div class="report-stat"><span class="report-stat-label">${escapeHtml(formatKey(k))}</span>`
+                    + `<span class="report-stat-value">${escapeHtml(String(v))}</span></div>`;
+            }
+            html += '</div>';
+        }
+
+        // Array sections as tables
+        for (const [k, v] of Object.entries(sections)) {
+            if (Array.isArray(v) && v.length > 0 && typeof v[0] === 'object') {
+                const cols = Object.keys(v[0]);
+                html += `<h4 class="report-section-title">${escapeHtml(formatKey(k))}</h4>`;
+                html += '<div class="table-responsive"><table class="data-table"><thead><tr>';
+                cols.forEach(c => { html += `<th>${escapeHtml(formatKey(c))}</th>`; });
+                html += '</tr></thead><tbody>';
+                v.forEach(row => {
+                    html += '<tr>';
+                    cols.forEach(c => { html += `<td>${escapeHtml(String(row[c] ?? ''))}</td>`; });
+                    html += '</tr>';
+                });
+                html += '</tbody></table></div>';
+            } else if (Array.isArray(v) && v.length > 0) {
+                html += `<h4 class="report-section-title">${escapeHtml(formatKey(k))}</h4>`;
+                html += '<ul class="report-list">';
+                v.forEach(item => { html += `<li>${escapeHtml(String(item))}</li>`; });
+                html += '</ul>';
+            } else if (typeof v === 'object' && !Array.isArray(v)) {
+                html += `<h4 class="report-section-title">${escapeHtml(formatKey(k))}</h4>`;
+                html += '<div class="report-kv">';
+                for (const [sk, sv] of Object.entries(v)) {
+                    html += `<div class="report-kv-row"><span class="report-kv-key">${escapeHtml(formatKey(sk))}</span>`
+                        + `<span class="report-kv-val">${escapeHtml(String(sv ?? ''))}</span></div>`;
+                }
+                html += '</div>';
+            }
+        }
+
+        if (!html) { html = `<pre>${escapeHtml(JSON.stringify(data, null, 2))}</pre>`; }
+
+        // Add toggle for raw JSON
+        html += `<details class="raw-json-toggle"><summary>${_('reports.raw_json') || 'Raw JSON'}</summary>`
+            + `<pre>${escapeHtml(JSON.stringify(data, null, 2))}</pre></details>`;
+
+        previewContent.innerHTML = html;
+    }
+
+    function formatKey(key) {
+        return key.replace(/_/g, ' ').replace(/\b\w/g, c => c.toUpperCase());
+    }
+
+    // ---- Init ----
+    // nothing to load on generate tab start
+})();
diff --git a/web-nodejs/public/js/settings.js b/web-nodejs/public/js/settings.js
index a1f88a0c..1045ccc1 100644
--- a/web-nodejs/public/js/settings.js
+++ b/web-nodejs/public/js/settings.js
@@ -146,14 +146,19 @@
                 return;
             }
             
-            tbody.innerHTML = logs.map(log => `
+            tbody.innerHTML = logs.map(log => {
+                var actionKey = 'audit.action_' + (log.action || '').replace(/[^a-z0-9_]/gi, '_');
+                var actionLabel = typeof _ === 'function' ? _(actionKey) : log.action;
+                if (actionLabel === actionKey) actionLabel = log.action;
+                return `
                 <tr>
                     <td>${Utils.formatDate(log.created_at)}</td>
                     <td>${Utils.escapeHtml(log.username || '-')}</td>
-                    <td><span class="audit-action ${log.action}">${Utils.escapeHtml(log.action)}</span></td>
+                    <td><span class="audit-action ${log.action}">${Utils.escapeHtml(actionLabel)}</span></td>
                     <td>${Utils.escapeHtml(log.details || '-')}</td>
                 </tr>
-            `).join('');
+            `;
+            }).join('');
             
         } catch (error) {
             tbody.innerHTML = `<tr><td colspan="4" class="text-center text-danger">${_('errors.load_audit_failed')}</td></tr>`;
diff --git a/web-nodejs/public/js/tenants.js b/web-nodejs/public/js/tenants.js
new file mode 100644
index 00000000..ff70d67b
--- /dev/null
+++ b/web-nodejs/public/js/tenants.js
@@ -0,0 +1,282 @@
+/**
+ * BetterDesk Console - Tenants Page Script
+ */
+
+(function () {
+    'use strict';
+
+    const _ = window.BetterDesk?.translations
+        ? (key) => {
+            const keys = key.split('.');
+            let val = window.BetterDesk.translations;
+            for (const k of keys) { val = val?.[k]; }
+            return val || key;
+        }
+        : (key) => key;
+
+    const csrfToken = window.BetterDesk?.csrfToken || '';
+
+    async function apiFetch(url, options = {}) {
+        const headers = { 'Content-Type': 'application/json' };
+        if (csrfToken) headers['x-csrf-token'] = csrfToken;
+        const resp = await fetch(url, { ...options, headers: { ...headers, ...options.headers } });
+        return resp.json();
+    }
+
+    function escapeHtml(str) {
+        if (!str) return '';
+        const div = document.createElement('div');
+        div.textContent = String(str);
+        return div.innerHTML;
+    }
+
+    function showToast(message, type) {
+        if (window.BetterDesk?.notify) { window.BetterDesk.notify(message, type); return; }
+        const container = document.getElementById('toast-container');
+        if (!container) return;
+        const toast = document.createElement('div');
+        toast.className = `toast toast-${type || 'info'}`;
+        toast.textContent = message;
+        container.appendChild(toast);
+        setTimeout(() => toast.remove(), 4000);
+    }
+
+    // ---- Modal close ----
+    document.querySelectorAll('.modal-close').forEach(btn => {
+        btn.addEventListener('click', () => {
+            const id = btn.dataset.modal;
+            if (id) document.getElementById(id).style.display = 'none';
+        });
+    });
+
+    // ==== Grid ====
+
+    const grid = document.getElementById('tenants-grid');
+    const searchInput = document.getElementById('tenant-search');
+    const createBtn = document.getElementById('create-tenant-btn');
+    const formModal = document.getElementById('form-modal');
+    const saveBtn = document.getElementById('tenant-save-btn');
+
+    let allTenants = [];
+
+    async function loadTenants() {
+        grid.innerHTML = `<div class="tenants-empty"><span class="material-icons">hourglass_empty</span><p>${_('common.loading')}</p></div>`;
+        try {
+            const data = await apiFetch('/api/tenants');
+            allTenants = Array.isArray(data) ? data : [];
+            filterAndRender();
+            updateStats();
+        } catch (err) {
+            grid.innerHTML = `<div class="tenants-empty"><span class="material-icons">error_outline</span><p>${escapeHtml(err.message)}</p></div>`;
+        }
+    }
+
+    function updateStats() {
+        const total = allTenants.length;
+        const active = allTenants.filter(t => t.active).length;
+        const devices = allTenants.reduce((sum, t) => sum + (t.device_count || 0), 0);
+        const users = allTenants.reduce((sum, t) => sum + (t.user_count || 0), 0);
+        document.getElementById('stat-tenants').textContent = total;
+        document.getElementById('stat-active').textContent = active;
+        document.getElementById('stat-devices').textContent = devices;
+        document.getElementById('stat-users').textContent = users;
+    }
+
+    function filterAndRender() {
+        const q = searchInput.value.toLowerCase();
+        const filtered = q ? allTenants.filter(t => (t.name + t.slug + (t.contact_name || '') + (t.contact_email || '')).toLowerCase().includes(q)) : allTenants;
+        renderGrid(filtered);
+    }
+
+    function renderGrid(tenants) {
+        if (!tenants.length) {
+            grid.innerHTML = `<div class="tenants-empty"><span class="material-icons">business</span><p>${_('tenants.no_tenants')}</p></div>`;
+            return;
+        }
+        grid.innerHTML = tenants.map(t => {
+            const initial = (t.name || '?').charAt(0).toUpperCase();
+            return `
+            <div class="tenant-card" data-id="${t.id}">
+                <div class="tenant-card-header">
+                    <h3>
+                        <span style="display:inline-flex;align-items:center;justify-content:center;width:32px;height:32px;border-radius:var(--radius-md);background:var(--accent-blue-muted);color:var(--accent-blue);font-weight:600;font-size:14px;flex-shrink:0">${escapeHtml(initial)}</span>
+                        ${escapeHtml(t.name)}
+                    </h3>
+                    <span class="tenant-status ${t.active ? 'active' : 'disabled'}"><span class="dot"></span> ${t.active ? _('tenants.active') : _('tenants.disabled')}</span>
+                </div>
+                <div class="tenant-card-stats">
+                    <div class="tenant-stat">
+                        <span class="value">${t.device_count || 0}</span>
+                        <span class="label">${_('tenants.devices')}</span>
+                    </div>
+                    <div class="tenant-stat">
+                        <span class="value">${t.user_count || 0}</span>
+                        <span class="label">${_('tenants.users')}</span>
+                    </div>
+                    <div class="tenant-stat">
+                        <span class="value">${t.max_devices || '∞'}</span>
+                        <span class="label">${_('tenants.max')}</span>
+                    </div>
+                </div>
+                <div class="tenant-card-footer">
+                    <span class="tenant-slug">${escapeHtml(t.slug || '')}</span>
+                    <div class="tenant-card-actions">
+                        <button class="btn btn-sm btn-secondary edit-btn" data-id="${t.id}" title="${_('common.edit')}"><span class="material-icons" style="font-size:16px">edit</span></button>
+                        <button class="btn btn-sm btn-danger del-btn" data-id="${t.id}" title="${_('common.delete')}"><span class="material-icons" style="font-size:16px">delete</span></button>
+                    </div>
+                </div>
+            </div>`;
+        }).join('');
+
+        // Card click → detail
+        grid.querySelectorAll('.tenant-card').forEach(card => {
+            card.addEventListener('click', (e) => {
+                if (e.target.closest('.edit-btn') || e.target.closest('.del-btn')) return;
+                showDetail(card.dataset.id);
+            });
+        });
+
+        grid.querySelectorAll('.edit-btn').forEach(btn => {
+            btn.addEventListener('click', (e) => { e.stopPropagation(); editTenant(btn.dataset.id); });
+        });
+        grid.querySelectorAll('.del-btn').forEach(btn => {
+            btn.addEventListener('click', (e) => { e.stopPropagation(); deleteTenant(btn.dataset.id); });
+        });
+    }
+
+    // ==== Form ====
+
+    function openForm(t) {
+        document.getElementById('form-modal-title').textContent = t ? _('tenants.edit_tenant') : _('tenants.create_tenant');
+        document.getElementById('tenant-id').value = t ? t.id : '';
+        document.getElementById('tenant-name').value = t ? t.name : '';
+        document.getElementById('tenant-slug').value = t ? t.slug || '' : '';
+        document.getElementById('tenant-contact-name').value = t ? t.contact_name || '' : '';
+        document.getElementById('tenant-contact-email').value = t ? t.contact_email || '' : '';
+        document.getElementById('tenant-max-devices').value = t ? t.max_devices || 100 : 100;
+        document.getElementById('tenant-active').checked = t ? !!t.active : true;
+        formModal.style.display = 'flex';
+    }
+
+    async function editTenant(id) {
+        try {
+            const t = await apiFetch(`/api/tenants/${id}`);
+            openForm(t);
+        } catch (err) { showToast(err.message, 'error'); }
+    }
+
+    async function saveTenant() {
+        const id = document.getElementById('tenant-id').value;
+        const body = {
+            name: document.getElementById('tenant-name').value.trim(),
+            slug: document.getElementById('tenant-slug').value.trim(),
+            contact_name: document.getElementById('tenant-contact-name').value.trim(),
+            contact_email: document.getElementById('tenant-contact-email').value.trim(),
+            max_devices: parseInt(document.getElementById('tenant-max-devices').value, 10) || 100,
+            active: document.getElementById('tenant-active').checked,
+        };
+        if (!body.name) { showToast(_('common.name_required'), 'error'); return; }
+
+        try {
+            const url = id ? `/api/tenants/${id}` : '/api/tenants';
+            const method = id ? 'PATCH' : 'POST';
+            await apiFetch(url, { method, body: JSON.stringify(body) });
+            formModal.style.display = 'none';
+            showToast(_('common.saved'), 'success');
+            loadTenants();
+        } catch (err) { showToast(err.message, 'error'); }
+    }
+
+    async function deleteTenant(id) {
+        if (!confirm(_('tenants.delete_tenant') + '?')) return;
+        try {
+            await apiFetch(`/api/tenants/${id}`, { method: 'DELETE' });
+            showToast(_('common.success'), 'success');
+            loadTenants();
+        } catch (err) { showToast(err.message, 'error'); }
+    }
+
+    createBtn.addEventListener('click', () => openForm(null));
+    saveBtn.addEventListener('click', saveTenant);
+    searchInput.addEventListener('input', filterAndRender);
+
+    // ==== Detail ====
+
+    async function showDetail(id) {
+        const modal = document.getElementById('detail-modal');
+        const body = document.getElementById('detail-body');
+        modal.style.display = 'flex';
+        body.innerHTML = `<p>${_('common.loading')}</p>`;
+
+        try {
+            const [tenant, devices, users, stats] = await Promise.all([
+                apiFetch(`/api/tenants/${id}`),
+                apiFetch(`/api/tenants/${id}/devices`),
+                apiFetch(`/api/tenants/${id}/users`),
+                apiFetch(`/api/tenants/${id}/stats`).catch(() => ({}))
+            ]);
+
+            document.getElementById('detail-modal-title').textContent = tenant.name;
+
+            const devList = Array.isArray(devices) ? devices : [];
+            const usrList = Array.isArray(users) ? users : [];
+
+            body.innerHTML = `
+                <div class="tenant-detail-tabs">
+                    <button class="tenant-detail-tab active" data-panel="info"><span class="material-icons" style="font-size:16px;vertical-align:-3px">info</span> ${_('tenants.info')}</button>
+                    <button class="tenant-detail-tab" data-panel="devices"><span class="material-icons" style="font-size:16px;vertical-align:-3px">devices</span> ${_('tenants.devices')} (${devList.length})</button>
+                    <button class="tenant-detail-tab" data-panel="users"><span class="material-icons" style="font-size:16px;vertical-align:-3px">people</span> ${_('tenants.users')} (${usrList.length})</button>
+                </div>
+
+                <div class="tenant-detail-panel active" id="dp-info">
+                    <div class="detail-grid">
+                        <div class="detail-item"><span class="detail-label">${_('tenants.name')}</span><span class="detail-value">${escapeHtml(tenant.name)}</span></div>
+                        <div class="detail-item"><span class="detail-label">${_('tenants.slug')}</span><span class="detail-value"><code style="font-size:var(--font-size-sm);padding:2px 6px;background:var(--bg-tertiary);border-radius:var(--radius-sm)">${escapeHtml(tenant.slug || '—')}</code></span></div>
+                        <div class="detail-item"><span class="detail-label">${_('tenants.contact_name')}</span><span class="detail-value">${escapeHtml(tenant.contact_name || '—')}</span></div>
+                        <div class="detail-item"><span class="detail-label">${_('tenants.contact_email')}</span><span class="detail-value">${tenant.contact_email ? `<a href="mailto:${escapeHtml(tenant.contact_email)}" style="color:var(--accent-blue)">${escapeHtml(tenant.contact_email)}</a>` : '—'}</span></div>
+                        <div class="detail-item"><span class="detail-label">${_('tenants.max_devices')}</span><span class="detail-value">${tenant.max_devices || '∞'}</span></div>
+                        <div class="detail-item"><span class="detail-label">${_('tenants.status')}</span><span class="detail-value"><span class="tenant-status ${tenant.active ? 'active' : 'disabled'}"><span class="dot"></span> ${tenant.active ? _('tenants.active') : _('tenants.disabled')}</span></span></div>
+                    </div>
+                </div>
+
+                <div class="tenant-detail-panel" id="dp-devices">
+                    ${devList.length
+                        ? `<div class="assignment-list">${devList.map(d => `
+                            <div class="assignment-item">
+                                <span class="name"><span class="material-icons" style="font-size:16px;vertical-align:-3px;margin-right:4px;color:var(--text-muted)">computer</span>${escapeHtml(d.id || d.device_id)}</span>
+                                <span style="color:var(--text-muted);font-size:var(--font-size-sm)">${escapeHtml(d.hostname || '')}</span>
+                            </div>`).join('')}</div>`
+                        : `<p class="text-muted" style="text-align:center;padding:var(--space-lg)">${_('tenants.no_devices')}</p>`
+                    }
+                </div>
+
+                <div class="tenant-detail-panel" id="dp-users">
+                    ${usrList.length
+                        ? `<div class="assignment-list">${usrList.map(u => `
+                            <div class="assignment-item">
+                                <span class="name"><span class="material-icons" style="font-size:16px;vertical-align:-3px;margin-right:4px;color:var(--text-muted)">person</span>${escapeHtml(u.username || u.name)}</span>
+                                <span style="color:var(--text-muted);font-size:var(--font-size-sm)">${escapeHtml(u.role || '')}</span>
+                            </div>`).join('')}</div>`
+                        : `<p class="text-muted" style="text-align:center;padding:var(--space-lg)">${_('tenants.no_users')}</p>`
+                    }
+                </div>
+            `;
+
+            // Detail tab switching
+            body.querySelectorAll('.tenant-detail-tab').forEach(tab => {
+                tab.addEventListener('click', () => {
+                    body.querySelectorAll('.tenant-detail-tab').forEach(t => t.classList.remove('active'));
+                    body.querySelectorAll('.tenant-detail-panel').forEach(p => p.classList.remove('active'));
+                    tab.classList.add('active');
+                    const panel = document.getElementById('dp-' + tab.dataset.panel);
+                    if (panel) panel.classList.add('active');
+                });
+            });
+        } catch (err) {
+            body.innerHTML = `<p class="text-error">${escapeHtml(err.message)}</p>`;
+        }
+    }
+
+    // ---- Init ----
+    loadTenants();
+})();
diff --git a/web-nodejs/public/js/tickets.js b/web-nodejs/public/js/tickets.js
new file mode 100644
index 00000000..5aa836fe
--- /dev/null
+++ b/web-nodejs/public/js/tickets.js
@@ -0,0 +1,406 @@
+/**
+ * BetterDesk Console - Tickets Page Script
+ */
+
+(function () {
+    'use strict';
+
+    const _ = window.BetterDesk?.translations
+        ? (key) => {
+            const keys = key.split('.');
+            let val = window.BetterDesk.translations;
+            for (const k of keys) { val = val?.[k]; }
+            return val || key;
+        }
+        : (key) => key;
+
+    const csrfToken = window.BetterDesk?.csrfToken || '';
+    const user = window.BetterDesk?.user || {};
+
+    // State
+    let currentStatus = '';
+    let currentSearch = '';
+
+    // DOM refs
+    const tbody = document.getElementById('tickets-body');
+    const searchInput = document.getElementById('search-input');
+    const filterButtons = document.querySelectorAll('.filter-btn');
+    const createBtn = document.getElementById('create-ticket-btn');
+    const ticketModal = document.getElementById('ticket-modal');
+    const ticketModalTitle = document.getElementById('ticket-modal-title');
+    const ticketForm = document.getElementById('ticket-form');
+    const ticketSaveBtn = document.getElementById('ticket-save-btn');
+    const detailModal = document.getElementById('detail-modal');
+    const detailBody = document.getElementById('detail-body');
+    const statTotal = document.getElementById('stat-total');
+    const statOpen = document.getElementById('stat-open');
+    const statProgress = document.getElementById('stat-progress');
+    const statResolved = document.getElementById('stat-resolved');
+
+    // ---- API ----
+
+    async function apiFetch(url, options = {}) {
+        const headers = { 'Content-Type': 'application/json' };
+        if (csrfToken) headers['x-csrf-token'] = csrfToken;
+        const resp = await fetch(url, { ...options, headers: { ...headers, ...options.headers } });
+        return resp.json();
+    }
+
+    // ---- Load ----
+
+    async function loadTickets() {
+        tbody.innerHTML = `<tr class="loading-row"><td colspan="9">${_('common.loading')}</td></tr>`;
+
+        const params = new URLSearchParams();
+        if (currentStatus) params.set('status', currentStatus);
+        if (currentSearch) params.set('search', currentSearch);
+
+        try {
+            const result = await apiFetch(`/api/tickets?${params}`);
+            const tickets = result.tickets || [];
+            renderTable(tickets);
+        } catch (err) {
+            tbody.innerHTML = `<tr class="empty-row"><td colspan="9">
+                <div class="empty-state"><span class="material-icons">error_outline</span>
+                <p>${escapeHtml(err.message)}</p></div></td></tr>`;
+        }
+    }
+
+    async function loadStats() {
+        try {
+            const stats = await apiFetch('/api/tickets/stats');
+            statTotal.textContent = stats.total || 0;
+            statOpen.textContent = stats.open || 0;
+            statProgress.textContent = stats.in_progress || 0;
+            statResolved.textContent = stats.resolved || 0;
+        } catch (_e) { /* silent */ }
+    }
+
+    // ---- Render ----
+
+    function renderTable(tickets) {
+        if (!tickets.length) {
+            tbody.innerHTML = `<tr class="empty-row"><td colspan="9">
+                <div class="empty-state"><span class="material-icons">confirmation_number</span>
+                <p>${_('tickets.no_tickets')}</p></div></td></tr>`;
+            return;
+        }
+
+        tbody.innerHTML = tickets.map(t => {
+            const statusLabel = _(`tickets.status_${t.status}`) || t.status;
+            const priorityLabel = _(`tickets.priority_${t.priority}`) || t.priority;
+            const catLabel = _(`tickets.category_${t.category}`) || t.category || '—';
+            const slaOverdue = t.sla_due_at && new Date(t.sla_due_at) < new Date() && t.status !== 'closed' && t.status !== 'resolved';
+
+            return `<tr data-id="${t.id}">
+                <td>#${t.id}</td>
+                <td>
+                    <a href="javascript:void(0)" class="ticket-link" data-id="${t.id}">${escapeHtml(t.title)}</a>
+                    ${slaOverdue ? `<span class="sla-overdue">${_('tickets.sla_overdue')}</span>` : ''}
+                </td>
+                <td><span class="status-badge ${t.status}">${statusLabel}</span></td>
+                <td><span class="priority-badge ${t.priority}">${priorityLabel}</span></td>
+                <td>${escapeHtml(catLabel)}</td>
+                <td>${escapeHtml(t.assigned_to || '—')}</td>
+                <td>${escapeHtml(t.device_id || '—')}</td>
+                <td class="time-cell">${formatTimeAgo(t.created_at)}</td>
+                <td class="action-btn-group">
+                    <button class="btn btn-sm btn-secondary view-btn" data-id="${t.id}" title="${_('tickets.detail')}">
+                        <span class="material-icons" style="font-size:16px">visibility</span>
+                    </button>
+                    <button class="btn btn-sm btn-secondary edit-btn" data-id="${t.id}" title="${_('tickets.edit')}">
+                        <span class="material-icons" style="font-size:16px">edit</span>
+                    </button>
+                    <button class="btn btn-sm btn-danger delete-btn" data-id="${t.id}" title="${_('tickets.delete')}">
+                        <span class="material-icons" style="font-size:16px">delete</span>
+                    </button>
+                </td>
+            </tr>`;
+        }).join('');
+
+        attachRowListeners();
+    }
+
+    function attachRowListeners() {
+        tbody.querySelectorAll('.ticket-link, .view-btn').forEach(el => {
+            el.addEventListener('click', () => openDetail(el.dataset.id));
+        });
+        tbody.querySelectorAll('.edit-btn').forEach(el => {
+            el.addEventListener('click', () => openEdit(el.dataset.id));
+        });
+        tbody.querySelectorAll('.delete-btn').forEach(el => {
+            el.addEventListener('click', () => deleteTicket(el.dataset.id));
+        });
+    }
+
+    // ---- Detail ----
+
+    async function openDetail(id) {
+        detailModal.style.display = 'flex';
+        detailBody.innerHTML = `<p>${_('common.loading')}</p>`;
+
+        try {
+            const t = await apiFetch(`/api/tickets/${encodeURIComponent(id)}`);
+            renderDetail(t);
+        } catch (err) {
+            detailBody.innerHTML = `<p class="text-error">${escapeHtml(err.message)}</p>`;
+        }
+    }
+
+    function renderDetail(t) {
+        const statusLabel = _(`tickets.status_${t.status}`) || t.status;
+        const priorityLabel = _(`tickets.priority_${t.priority}`) || t.priority;
+        const catLabel = _(`tickets.category_${t.category}`) || t.category || '—';
+
+        let html = `
+            <div class="detail-section">
+                <div class="detail-grid">
+                    <div class="detail-item"><span class="detail-label">${_('tickets.status')}</span><span class="status-badge ${t.status}">${statusLabel}</span></div>
+                    <div class="detail-item"><span class="detail-label">${_('tickets.priority')}</span><span class="priority-badge ${t.priority}">${priorityLabel}</span></div>
+                    <div class="detail-item"><span class="detail-label">${_('tickets.category')}</span><span class="detail-value">${escapeHtml(catLabel)}</span></div>
+                    <div class="detail-item"><span class="detail-label">${_('tickets.assigned_to')}</span><span class="detail-value">${escapeHtml(t.assigned_to || '—')}</span></div>
+                    <div class="detail-item"><span class="detail-label">${_('tickets.device')}</span><span class="detail-value">${escapeHtml(t.device_id || '—')}</span></div>
+                    <div class="detail-item"><span class="detail-label">${_('tickets.created_by')}</span><span class="detail-value">${escapeHtml(t.created_by || '—')}</span></div>
+                    <div class="detail-item"><span class="detail-label">${_('tickets.created_at')}</span><span class="detail-value">${formatDate(t.created_at)}</span></div>
+                    <div class="detail-item"><span class="detail-label">${_('tickets.sla_due')}</span><span class="detail-value">${formatDate(t.sla_due_at)}</span></div>
+                </div>
+            </div>`;
+
+        if (t.description) {
+            html += `<div class="detail-section"><h4>${_('tickets.description')}</h4><p style="white-space:pre-wrap;font-size:0.875rem">${escapeHtml(t.description)}</p></div>`;
+        }
+
+        // Status change buttons
+        html += `<div class="detail-section" style="display:flex;gap:8px;flex-wrap:wrap">`;
+        if (t.status === 'open') {
+            html += `<button class="btn btn-sm btn-secondary" onclick="window._ticketActions.changeStatus(${t.id},'in_progress')">${_('tickets.status_in_progress')}</button>`;
+        }
+        if (t.status === 'in_progress') {
+            html += `<button class="btn btn-sm btn-primary" onclick="window._ticketActions.changeStatus(${t.id},'resolved')">${_('tickets.status_resolved')}</button>`;
+        }
+        if (t.status !== 'closed') {
+            html += `<button class="btn btn-sm btn-secondary" onclick="window._ticketActions.changeStatus(${t.id},'closed')">${_('tickets.status_closed')}</button>`;
+        }
+        if (!t.assigned_to && user.username) {
+            html += `<button class="btn btn-sm btn-secondary" onclick="window._ticketActions.assign(${t.id})">${_('tickets.assign_to_me')}</button>`;
+        }
+        html += `</div>`;
+
+        // Comments
+        html += `<div class="comments-section"><h4>${_('tickets.comments')}</h4>`;
+        if (t.comments && t.comments.length) {
+            t.comments.forEach(c => {
+                html += `<div class="comment-item ${c.is_internal ? 'comment-internal' : ''}">
+                    <div class="comment-header">
+                        <span class="comment-author">${escapeHtml(c.author || '—')}</span>
+                        <span class="comment-time">${formatTimeAgo(c.created_at)}</span>
+                    </div>
+                    <div class="comment-body">${escapeHtml(c.body)}</div>
+                </div>`;
+            });
+        } else {
+            html += `<p style="color:var(--text-secondary);font-size:0.875rem">${_('tickets.no_comments')}</p>`;
+        }
+        html += `<div class="add-comment-form">
+            <textarea class="form-input" id="new-comment" placeholder="${_('tickets.comment_placeholder')}" maxlength="2000"></textarea>
+            <button class="btn btn-primary" onclick="window._ticketActions.addComment(${t.id})">${_('tickets.add_comment')}</button>
+        </div></div>`;
+
+        detailBody.innerHTML = html;
+    }
+
+    // ---- Create / Edit ----
+
+    function openCreateModal() {
+        ticketModalTitle.textContent = _('tickets.create');
+        ticketForm.reset();
+        document.getElementById('ticket-id').value = '';
+        ticketModal.style.display = 'flex';
+    }
+
+    async function openEdit(id) {
+        ticketModalTitle.textContent = _('tickets.edit');
+        ticketModal.style.display = 'flex';
+
+        try {
+            const t = await apiFetch(`/api/tickets/${encodeURIComponent(id)}`);
+            document.getElementById('ticket-id').value = t.id;
+            document.getElementById('ticket-title').value = t.title || '';
+            document.getElementById('ticket-desc').value = t.description || '';
+            document.getElementById('ticket-priority').value = t.priority || 'medium';
+            document.getElementById('ticket-category').value = t.category || 'general';
+            document.getElementById('ticket-device').value = t.device_id || '';
+        } catch (err) {
+            showToast(err.message, 'error');
+            ticketModal.style.display = 'none';
+        }
+    }
+
+    async function saveTicket() {
+        const id = document.getElementById('ticket-id').value;
+        const body = {
+            title: document.getElementById('ticket-title').value.trim(),
+            description: document.getElementById('ticket-desc').value.trim(),
+            priority: document.getElementById('ticket-priority').value,
+            category: document.getElementById('ticket-category').value,
+            device_id: document.getElementById('ticket-device').value.trim() || undefined,
+        };
+
+        if (!body.title) {
+            showToast(_('tickets.title_required'), 'error');
+            return;
+        }
+
+        try {
+            const url = id ? `/api/tickets/${id}` : '/api/tickets';
+            const method = id ? 'PATCH' : 'POST';
+            const result = await apiFetch(url, { method, body: JSON.stringify(body) });
+            if (result.error) throw new Error(result.error);
+
+            ticketModal.style.display = 'none';
+            showToast(id ? _('tickets.updated_success') : _('tickets.created_success'), 'success');
+            loadTickets();
+            loadStats();
+        } catch (err) {
+            showToast(err.message, 'error');
+        }
+    }
+
+    // ---- Actions ----
+
+    async function deleteTicket(id) {
+        const msg = (_('tickets.delete_confirm') || '').replace('{id}', id);
+        if (!confirm(msg)) return;
+
+        try {
+            const result = await apiFetch(`/api/tickets/${id}`, { method: 'DELETE' });
+            if (result.error) throw new Error(result.error);
+            showToast(_('tickets.delete_success'), 'success');
+            loadTickets();
+            loadStats();
+        } catch (err) {
+            showToast(err.message, 'error');
+        }
+    }
+
+    async function changeStatus(id, status) {
+        try {
+            const result = await apiFetch(`/api/tickets/${id}`, {
+                method: 'PATCH',
+                body: JSON.stringify({ status }),
+            });
+            if (result.error) throw new Error(result.error);
+            showToast(_('tickets.updated_success'), 'success');
+            openDetail(id);
+            loadTickets();
+            loadStats();
+        } catch (err) {
+            showToast(err.message, 'error');
+        }
+    }
+
+    async function assignToMe(id) {
+        try {
+            const result = await apiFetch(`/api/tickets/${id}`, {
+                method: 'PATCH',
+                body: JSON.stringify({ assigned_to: user.username }),
+            });
+            if (result.error) throw new Error(result.error);
+            showToast(_('tickets.updated_success'), 'success');
+            openDetail(id);
+            loadTickets();
+        } catch (err) {
+            showToast(err.message, 'error');
+        }
+    }
+
+    async function addComment(ticketId) {
+        const textarea = document.getElementById('new-comment');
+        const body = textarea.value.trim();
+        if (!body) return;
+
+        try {
+            const result = await apiFetch(`/api/tickets/${ticketId}/comments`, {
+                method: 'POST',
+                body: JSON.stringify({ body }),
+            });
+            if (result.error) throw new Error(result.error);
+            textarea.value = '';
+            openDetail(ticketId);
+        } catch (err) {
+            showToast(err.message, 'error');
+        }
+    }
+
+    window._ticketActions = { changeStatus, assign: assignToMe, addComment };
+
+    // ---- Helpers ----
+
+    function escapeHtml(str) {
+        if (!str) return '';
+        const div = document.createElement('div');
+        div.textContent = String(str);
+        return div.innerHTML;
+    }
+
+    function formatTimeAgo(dateStr) {
+        if (!dateStr) return '—';
+        const d = new Date(dateStr);
+        const diff = Math.floor((Date.now() - d) / 1000);
+        if (diff < 60) return _('time.seconds_ago').replace('{count}', diff);
+        if (diff < 3600) return _('time.minutes_ago').replace('{count}', Math.floor(diff / 60));
+        if (diff < 86400) return _('time.hours_ago').replace('{count}', Math.floor(diff / 3600));
+        if (diff < 2592000) return _('time.days_ago').replace('{count}', Math.floor(diff / 86400));
+        return d.toLocaleDateString();
+    }
+
+    function formatDate(dateStr) {
+        if (!dateStr) return '—';
+        return new Date(dateStr).toLocaleString();
+    }
+
+    function showToast(message, type) {
+        if (window.BetterDesk?.notify) { window.BetterDesk.notify(message, type); return; }
+        const container = document.getElementById('toast-container');
+        if (!container) return;
+        const toast = document.createElement('div');
+        toast.className = `toast toast-${type || 'info'}`;
+        toast.textContent = message;
+        container.appendChild(toast);
+        setTimeout(() => toast.remove(), 4000);
+    }
+
+    // ---- Events ----
+
+    filterButtons.forEach(btn => {
+        btn.addEventListener('click', () => {
+            filterButtons.forEach(b => b.classList.remove('active'));
+            btn.classList.add('active');
+            currentStatus = btn.dataset.status;
+            loadTickets();
+        });
+    });
+
+    let searchTimeout;
+    searchInput.addEventListener('input', () => {
+        clearTimeout(searchTimeout);
+        searchTimeout = setTimeout(() => {
+            currentSearch = searchInput.value.trim();
+            loadTickets();
+        }, 300);
+    });
+
+    createBtn.addEventListener('click', openCreateModal);
+    ticketSaveBtn.addEventListener('click', saveTicket);
+
+    document.querySelectorAll('.modal-close').forEach(btn => {
+        btn.addEventListener('click', () => {
+            const modalId = btn.dataset.modal;
+            if (modalId) document.getElementById(modalId).style.display = 'none';
+        });
+    });
+
+    // ---- Init ----
+    loadTickets();
+    loadStats();
+})();
diff --git a/web-nodejs/public/js/tokens.js b/web-nodejs/public/js/tokens.js
new file mode 100644
index 00000000..8c07c39e
--- /dev/null
+++ b/web-nodejs/public/js/tokens.js
@@ -0,0 +1,370 @@
+/**
+ * BetterDesk Console - Device Tokens Management
+ * Client-side logic for device enrollment token management.
+ */
+(function () {
+    'use strict';
+
+    const _ = window.BetterDesk?.translations
+        ? (key) => key.split('.').reduce((o, k) => (o && o[k]) || key, window.BetterDesk.translations)
+        : (key) => key;
+
+    let allTokens = [];
+    let currentFilter = 'all';
+    const csrfToken = window.BetterDesk?.csrfToken || '';
+
+    // ── Helpers ──────────────────────────────────────────────────────────
+
+    function formatTimeAgo(dateStr) {
+        if (!dateStr) return '—';
+        const d = new Date(dateStr);
+        const diff = Math.floor((Date.now() - d) / 1000);
+        if (diff < 60) return _('time.seconds_ago').replace('{count}', diff);
+        if (diff < 3600) return _('time.minutes_ago').replace('{count}', Math.floor(diff / 60));
+        if (diff < 86400) return _('time.hours_ago').replace('{count}', Math.floor(diff / 3600));
+        if (diff < 2592000) return _('time.days_ago').replace('{count}', Math.floor(diff / 86400));
+        return d.toLocaleDateString();
+    }
+
+    function showToast(message, type) {
+        if (window.BetterDesk?.notify) { window.BetterDesk.notify(message, type); return; }
+        const container = document.getElementById('toast-container');
+        if (!container) return;
+        const toast = document.createElement('div');
+        toast.className = `toast toast-${type || 'info'}`;
+        toast.textContent = message;
+        container.appendChild(toast);
+        setTimeout(() => toast.remove(), 3000);
+    }
+
+    async function apiFetch(url, opts = {}) {
+        const headers = { 'Content-Type': 'application/json', ...(opts.headers || {}) };
+        if (csrfToken) headers['x-csrf-token'] = csrfToken;
+        const res = await fetch(url, { ...opts, headers, credentials: 'same-origin' });
+        if (!res.ok) throw new Error(`HTTP ${res.status}`);
+        return res.json();
+    }
+
+    function escapeHtml(str) {
+        if (!str) return '';
+        const div = document.createElement('div');
+        div.textContent = str;
+        return div.innerHTML;
+    }
+
+    // ── Data Fetching ────────────────────────────────────────────────────
+
+    async function loadTokens() {
+        try {
+            const includeRevoked = currentFilter === 'revoked' || currentFilter === 'all';
+            const res = await apiFetch(`/api/panel/tokens?include_revoked=${includeRevoked}`);
+            if (res.success && res.data) {
+                allTokens = res.data.tokens || [];
+            } else {
+                allTokens = [];
+            }
+            updateStats();
+            renderTokens();
+        } catch (err) {
+            showToast(_('common.error') + ': ' + err.message, 'error');
+        }
+    }
+
+    async function loadEnrollmentMode() {
+        try {
+            const res = await apiFetch('/api/panel/enrollment/mode');
+            if (res.success && res.data) {
+                const mode = res.data.mode || 'open';
+                const radio = document.querySelector(`input[name="enrollment_mode"][value="${mode}"]`);
+                if (radio) radio.checked = true;
+            }
+        } catch (err) {
+            // Silently fail — mode card will show default
+        }
+    }
+
+    // ── Rendering ────────────────────────────────────────────────────────
+
+    function updateStats() {
+        const total = allTokens.length;
+        const active = allTokens.filter(t => t.status === 'pending').length;
+        const used = allTokens.filter(t => t.status === 'used').length;
+        const revoked = allTokens.filter(t => t.status === 'revoked').length;
+        document.getElementById('stat-total').textContent = total;
+        document.getElementById('stat-active').textContent = active;
+        document.getElementById('stat-used').textContent = used;
+        document.getElementById('stat-revoked').textContent = revoked;
+    }
+
+    function renderTokens() {
+        const tbody = document.getElementById('tokens-body');
+        const search = (document.getElementById('token-search')?.value || '').toLowerCase();
+
+        let filtered = allTokens;
+        if (currentFilter !== 'all') {
+            filtered = filtered.filter(t => t.status === currentFilter);
+        }
+        if (search) {
+            filtered = filtered.filter(t =>
+                (t.name || '').toLowerCase().includes(search) ||
+                (t.token_prefix || '').toLowerCase().includes(search) ||
+                (t.peer_id || '').toLowerCase().includes(search) ||
+                (t.note || '').toLowerCase().includes(search)
+            );
+        }
+
+        if (filtered.length === 0) {
+            tbody.innerHTML = `<tr><td colspan="8" class="empty-row">${escapeHtml(_('tokens.no_tokens'))}</td></tr>`;
+            return;
+        }
+
+        tbody.innerHTML = filtered.map(t => {
+            const statusClass = t.status === 'pending' ? 'status-active'
+                : t.status === 'used' ? 'status-used'
+                : 'status-revoked';
+            const statusLabel = _('tokens.status_' + t.status);
+            const expiresStr = t.expires_at ? formatTimeAgo(t.expires_at) : '—';
+            const isExpired = t.expires_at && new Date(t.expires_at) < new Date();
+            const usesStr = t.max_uses === 0 ? `${t.use_count} / ∞` : `${t.use_count} / ${t.max_uses}`;
+
+            return `<tr data-id="${t.id}">
+                <td><code class="token-prefix">${escapeHtml(t.token_prefix)}</code></td>
+                <td>${escapeHtml(t.name)}</td>
+                <td><span class="status-badge ${statusClass}">${escapeHtml(statusLabel)}</span>
+                    ${isExpired ? '<span class="status-badge status-expired">' + escapeHtml(_('tokens.expired')) + '</span>' : ''}</td>
+                <td>${usesStr}</td>
+                <td>${t.peer_id ? '<code>' + escapeHtml(t.peer_id) + '</code>' : '—'}</td>
+                <td>${expiresStr}</td>
+                <td>${formatTimeAgo(t.created_at)}</td>
+                <td class="actions-cell">
+                    ${t.status !== 'revoked' ? `
+                        <button class="btn-icon" onclick="Tokens.editToken(${t.id})" title="${escapeHtml(_('common.save'))}">
+                            <span class="material-icons">edit</span>
+                        </button>
+                        <button class="btn-icon btn-icon-danger" onclick="Tokens.revokeToken(${t.id})" title="${escapeHtml(_('tokens.revoke'))}">
+                            <span class="material-icons">block</span>
+                        </button>
+                    ` : ''}
+                </td>
+            </tr>`;
+        }).join('');
+    }
+
+    // ── Modal Handlers ───────────────────────────────────────────────────
+
+    function showCreateModal() {
+        document.getElementById('token-modal-title').textContent = _('tokens.create');
+        document.getElementById('token-id').value = '';
+        document.getElementById('token-name').value = '';
+        document.getElementById('token-max-uses').value = '1';
+        document.getElementById('token-expires').value = '0';
+        document.getElementById('token-note').value = '';
+        document.getElementById('token-modal').style.display = 'flex';
+    }
+
+    function editToken(id) {
+        const token = allTokens.find(t => t.id === id);
+        if (!token) return;
+        document.getElementById('token-modal-title').textContent = _('tokens.edit');
+        document.getElementById('token-id').value = token.id;
+        document.getElementById('token-name').value = token.name || '';
+        document.getElementById('token-max-uses').value = token.max_uses || 1;
+        document.getElementById('token-expires').value = '0';
+        document.getElementById('token-note').value = token.note || '';
+        document.getElementById('token-modal').style.display = 'flex';
+    }
+
+    function closeModal() {
+        document.getElementById('token-modal').style.display = 'none';
+    }
+
+    function showBulkModal() {
+        document.getElementById('bulk-count').value = '5';
+        document.getElementById('bulk-prefix').value = 'Device';
+        document.getElementById('bulk-max-uses').value = '1';
+        document.getElementById('bulk-expires').value = '604800';
+        document.getElementById('bulk-modal').style.display = 'flex';
+    }
+
+    function closeBulkModal() {
+        document.getElementById('bulk-modal').style.display = 'none';
+    }
+
+    function closeCreatedModal() {
+        document.getElementById('token-created-modal').style.display = 'none';
+    }
+
+    function showCreatedTokens(tokens) {
+        const list = document.getElementById('created-tokens-list');
+        list.innerHTML = (Array.isArray(tokens) ? tokens : [tokens]).map(t => `
+            <div class="token-created-item">
+                <div class="token-created-name">${escapeHtml(t.name)}</div>
+                <div class="token-created-value">
+                    <code>${escapeHtml(t.token)}</code>
+                    <button class="btn-icon" onclick="Tokens.copyToken('${escapeHtml(t.token)}')">
+                        <span class="material-icons">content_copy</span>
+                    </button>
+                </div>
+            </div>
+        `).join('');
+        document.getElementById('token-created-modal').style.display = 'flex';
+    }
+
+    // ── API Actions ──────────────────────────────────────────────────────
+
+    async function saveToken() {
+        const id = document.getElementById('token-id').value;
+        const body = {
+            name: document.getElementById('token-name').value.trim(),
+            max_uses: parseInt(document.getElementById('token-max-uses').value, 10) || 1,
+            expires_in: parseInt(document.getElementById('token-expires').value, 10) || 0,
+            note: document.getElementById('token-note').value.trim(),
+        };
+
+        if (!body.name) {
+            showToast(_('common.name_required'), 'error');
+            return;
+        }
+
+        try {
+            if (id) {
+                await apiFetch(`/api/panel/tokens/${id}`, { method: 'PUT', body: JSON.stringify(body) });
+                showToast(_('common.saved'), 'success');
+            } else {
+                const res = await apiFetch('/api/panel/tokens', { method: 'POST', body: JSON.stringify(body) });
+                if (res.success && res.data) {
+                    showCreatedTokens(res.data);
+                }
+                showToast(_('common.saved'), 'success');
+            }
+            closeModal();
+            loadTokens();
+        } catch (err) {
+            showToast(_('common.error') + ': ' + err.message, 'error');
+        }
+    }
+
+    async function revokeToken(id) {
+        if (!confirm(_('tokens.revoke_confirm'))) return;
+        try {
+            await apiFetch(`/api/panel/tokens/${id}`, { method: 'DELETE' });
+            showToast(_('tokens.revoked_success'), 'success');
+            loadTokens();
+        } catch (err) {
+            showToast(_('common.error') + ': ' + err.message, 'error');
+        }
+    }
+
+    async function generateBulk() {
+        const body = {
+            count: parseInt(document.getElementById('bulk-count').value, 10) || 5,
+            name_prefix: document.getElementById('bulk-prefix').value.trim() || 'Device',
+            max_uses: parseInt(document.getElementById('bulk-max-uses').value, 10) || 1,
+            expires_in: parseInt(document.getElementById('bulk-expires').value, 10) || 0,
+        };
+
+        if (body.count < 1 || body.count > 100) {
+            showToast(_('tokens.count_range'), 'error');
+            return;
+        }
+
+        try {
+            const res = await apiFetch('/api/panel/tokens/generate-bulk', {
+                method: 'POST',
+                body: JSON.stringify(body),
+            });
+            if (res.success && res.data && res.data.tokens) {
+                showCreatedTokens(res.data.tokens);
+            }
+            closeBulkModal();
+            loadTokens();
+        } catch (err) {
+            showToast(_('common.error') + ': ' + err.message, 'error');
+        }
+    }
+
+    async function setEnrollmentMode(mode) {
+        try {
+            await apiFetch('/api/panel/enrollment/mode', {
+                method: 'PUT',
+                body: JSON.stringify({ mode }),
+            });
+            showToast(_('common.saved'), 'success');
+        } catch (err) {
+            showToast(_('common.error') + ': ' + err.message, 'error');
+        }
+    }
+
+    function copyToken(token) {
+        navigator.clipboard.writeText(token).then(() => {
+            showToast(_('common.copied'), 'success');
+        }).catch(() => {
+            // Fallback
+            const ta = document.createElement('textarea');
+            ta.value = token;
+            document.body.appendChild(ta);
+            ta.select();
+            document.execCommand('copy');
+            document.body.removeChild(ta);
+            showToast(_('common.copied'), 'success');
+        });
+    }
+
+    // ── Init ─────────────────────────────────────────────────────────────
+
+    function init() {
+        // Filter pills
+        document.querySelectorAll('.filter-pill').forEach(btn => {
+            btn.addEventListener('click', () => {
+                document.querySelectorAll('.filter-pill').forEach(b => b.classList.remove('active'));
+                btn.classList.add('active');
+                currentFilter = btn.dataset.filter;
+                renderTokens();
+            });
+        });
+
+        // Search
+        const searchInput = document.getElementById('token-search');
+        if (searchInput) {
+            searchInput.addEventListener('input', () => renderTokens());
+        }
+
+        // Enrollment mode radios
+        document.querySelectorAll('input[name="enrollment_mode"]').forEach(radio => {
+            radio.addEventListener('change', (e) => {
+                setEnrollmentMode(e.target.value);
+            });
+        });
+
+        // Close modals on overlay click
+        document.querySelectorAll('.modal-overlay').forEach(overlay => {
+            overlay.addEventListener('click', (e) => {
+                if (e.target === overlay) overlay.style.display = 'none';
+            });
+        });
+
+        loadEnrollmentMode();
+        loadTokens();
+    }
+
+    // ── Public API ───────────────────────────────────────────────────────
+
+    window.Tokens = {
+        showCreateModal,
+        showBulkModal,
+        closeModal,
+        closeBulkModal,
+        closeCreatedModal,
+        saveToken,
+        editToken,
+        revokeToken,
+        generateBulk,
+        copyToken,
+    };
+
+    if (document.readyState === 'loading') {
+        document.addEventListener('DOMContentLoaded', init);
+    } else {
+        init();
+    }
+})();
diff --git a/web-nodejs/public/js/tutorial.js b/web-nodejs/public/js/tutorial.js
new file mode 100644
index 00000000..afac87ce
--- /dev/null
+++ b/web-nodejs/public/js/tutorial.js
@@ -0,0 +1,422 @@
+/**
+ * BetterDesk Console - Visual Tutorial System
+ * Spotlight-based guided tour with i18n support.
+ * 
+ * Usage:
+ *   Tutorial.start('console'); // Start console panel tutorial
+ *   Tutorial.start('desktop'); // Start desktop mode tutorial
+ *   Tutorial.skip();           // Skip/close tutorial
+ */
+
+(function() {
+    'use strict';
+
+    // ============ Constants ============
+
+    const STORAGE_SEEN = 'betterdesk_tutorial_seen';
+    const STORAGE_DISABLED = 'betterdesk_tutorial_disabled';
+    
+    // ============ State ============
+
+    let _overlay = null;
+    let _spotlight = null;
+    let _tooltip = null;
+    let _steps = [];
+    let _currentStep = 0;
+    let _isActive = false;
+    let _onComplete = null;
+
+    // ============ i18n Helper ============
+
+    function t(key, fallback) {
+        if (typeof window._ === 'function') {
+            var result = window._(key);
+            return result !== key ? result : fallback;
+        }
+        // Manual translation lookup
+        if (window.BetterDesk && window.BetterDesk.translations) {
+            var keys = key.split('.');
+            var val = window.BetterDesk.translations;
+            for (var i = 0; i < keys.length; i++) {
+                if (val && typeof val === 'object' && keys[i] in val) {
+                    val = val[keys[i]];
+                } else {
+                    return fallback;
+                }
+            }
+            return val || fallback;
+        }
+        return fallback;
+    }
+
+    // ============ Tutorial Definitions ============
+
+    function getConsoleTutorialSteps() {
+        return [
+            {
+                selector: '.sidebar',
+                title: t('tutorial.console.sidebar_title', 'Navigation Sidebar'),
+                text: t('tutorial.console.sidebar_text', 'Use the sidebar to navigate between different sections of the console. Click on icons to switch pages.'),
+                position: 'right',
+                highlight: true
+            },
+            {
+                selector: '.navbar .search-box',
+                title: t('tutorial.console.search_title', 'Quick Search'),
+                text: t('tutorial.console.search_text', 'Search for devices, settings, or actions quickly. Press Ctrl+K for keyboard shortcut.'),
+                position: 'bottom',
+                highlight: true
+            },
+            {
+                selector: '#desktop-toggle-btn',
+                title: t('tutorial.console.desktop_btn_title', 'Desktop Mode'),
+                text: t('tutorial.console.desktop_btn_text', 'Switch to desktop mode for a Windows-like experience with floating windows and widgets. Best on large screens.'),
+                position: 'left',
+                highlight: true
+            },
+            {
+                selector: '.content-wrapper',
+                title: t('tutorial.console.content_title', 'Main Content Area'),
+                text: t('tutorial.console.content_text', 'This is where all your data and actions are displayed. Each page shows relevant information and controls.'),
+                position: 'center',
+                highlight: false
+            },
+            {
+                selector: null,
+                title: t('tutorial.console.complete_title', 'You\'re Ready!'),
+                text: t('tutorial.console.complete_text', 'You can access this tutorial anytime from Settings → Help. Enjoy using BetterDesk Console!'),
+                position: 'center',
+                highlight: false,
+                final: true
+            }
+        ];
+    }
+
+    function getDesktopTutorialSteps() {
+        return [
+            {
+                selector: '.widget-topnav',
+                title: t('tutorial.desktop.topnav_title', 'Top Navigation Bar'),
+                text: t('tutorial.desktop.topnav_text', 'Access all modules quickly from here. Click tabs to open apps in floating windows.'),
+                position: 'bottom',
+                highlight: true
+            },
+            {
+                selector: '.widget-sidebar',
+                title: t('tutorial.desktop.sidebar_title', 'Quick Actions'),
+                text: t('tutorial.desktop.sidebar_text', 'Add widgets, change wallpaper, access settings and additional modules from the sidebar.'),
+                position: 'right',
+                highlight: true
+            },
+            {
+                selector: '.widget-canvas',
+                title: t('tutorial.desktop.canvas_title', 'Widget Dashboard'),
+                text: t('tutorial.desktop.canvas_text', 'Your customizable dashboard. Drag widgets to reposition, resize corners to change size. Click + to add new widgets.'),
+                position: 'center',
+                highlight: false
+            },
+            {
+                selector: '.desktop-taskbar',
+                title: t('tutorial.desktop.taskbar_title', 'Taskbar'),
+                text: t('tutorial.desktop.taskbar_text', 'Minimized windows appear here. Use Start menu to launch apps, wallpaper picker, or return to console mode.'),
+                position: 'top',
+                highlight: true
+            },
+            {
+                selector: null,
+                title: t('tutorial.desktop.complete_title', 'Desktop Mode Ready!'),
+                text: t('tutorial.desktop.complete_text', 'Try clicking tabs to open apps as floating windows. You can run multiple apps side-by-side!'),
+                position: 'center',
+                highlight: false,
+                final: true
+            }
+        ];
+    }
+
+    // ============ DOM Creation ============
+
+    function createOverlay() {
+        if (_overlay) return;
+        
+        // Main overlay
+        _overlay = document.createElement('div');
+        _overlay.className = 'tutorial-overlay';
+        _overlay.id = 'tutorial-overlay';
+        
+        // Spotlight cut-out element
+        _spotlight = document.createElement('div');
+        _spotlight.className = 'tutorial-spotlight';
+        _overlay.appendChild(_spotlight);
+        
+        // Tooltip container
+        _tooltip = document.createElement('div');
+        _tooltip.className = 'tutorial-tooltip';
+        _tooltip.innerHTML = 
+            '<div class="tutorial-tooltip-header">' +
+                '<span class="tutorial-title"></span>' +
+                '<button class="tutorial-close" title="' + t('tutorial.close', 'Close') + '">' +
+                    '<span class="material-icons">close</span>' +
+                '</button>' +
+            '</div>' +
+            '<div class="tutorial-tooltip-body"></div>' +
+            '<div class="tutorial-tooltip-footer">' +
+                '<span class="tutorial-progress"></span>' +
+                '<div class="tutorial-actions">' +
+                    '<button class="tutorial-btn tutorial-skip">' + t('tutorial.skip', 'Skip') + '</button>' +
+                    '<button class="tutorial-btn tutorial-prev">' + t('tutorial.prev', 'Previous') + '</button>' +
+                    '<button class="tutorial-btn tutorial-btn-primary tutorial-next">' + t('tutorial.next', 'Next') + '</button>' +
+                '</div>' +
+            '</div>';
+        _overlay.appendChild(_tooltip);
+        
+        document.body.appendChild(_overlay);
+        
+        // Event listeners
+        _tooltip.querySelector('.tutorial-close').addEventListener('click', skip);
+        _tooltip.querySelector('.tutorial-skip').addEventListener('click', skip);
+        _tooltip.querySelector('.tutorial-prev').addEventListener('click', prevStep);
+        _tooltip.querySelector('.tutorial-next').addEventListener('click', nextStep);
+        
+        // Close on overlay click (outside tooltip)
+        _overlay.addEventListener('click', function(e) {
+            if (e.target === _overlay) {
+                skip();
+            }
+        });
+        
+        // Keyboard navigation
+        document.addEventListener('keydown', handleKeyDown);
+    }
+
+    function removeOverlay() {
+        document.removeEventListener('keydown', handleKeyDown);
+        if (_overlay) {
+            _overlay.remove();
+            _overlay = null;
+            _spotlight = null;
+            _tooltip = null;
+        }
+    }
+
+    // ============ Step Navigation ============
+
+    function showStep(index) {
+        if (!_steps.length || index < 0 || index >= _steps.length) return;
+        
+        _currentStep = index;
+        var step = _steps[index];
+        
+        // Update tooltip content
+        _tooltip.querySelector('.tutorial-title').textContent = step.title || '';
+        _tooltip.querySelector('.tutorial-tooltip-body').textContent = step.text || '';
+        _tooltip.querySelector('.tutorial-progress').textContent = 
+            t('tutorial.step', 'Step') + ' ' + (index + 1) + ' / ' + _steps.length;
+        
+        // Update button visibility
+        var prevBtn = _tooltip.querySelector('.tutorial-prev');
+        var nextBtn = _tooltip.querySelector('.tutorial-next');
+        var skipBtn = _tooltip.querySelector('.tutorial-skip');
+        
+        prevBtn.style.display = index > 0 ? '' : 'none';
+        nextBtn.textContent = step.final ? t('tutorial.finish', 'Finish') : t('tutorial.next', 'Next');
+        skipBtn.style.display = step.final ? 'none' : '';
+        
+        // Position spotlight and tooltip
+        positionElements(step);
+    }
+
+    function positionElements(step) {
+        var target = step.selector ? document.querySelector(step.selector) : null;
+        
+        if (target && step.highlight) {
+            // Get target position
+            var rect = target.getBoundingClientRect();
+            var padding = 8;
+            
+            // Position spotlight
+            _spotlight.style.display = 'block';
+            _spotlight.style.left = (rect.left - padding) + 'px';
+            _spotlight.style.top = (rect.top - padding) + 'px';
+            _spotlight.style.width = (rect.width + padding * 2) + 'px';
+            _spotlight.style.height = (rect.height + padding * 2) + 'px';
+            
+            // Position tooltip based on step.position
+            positionTooltip(rect, step.position);
+        } else {
+            // No target or no highlight - center tooltip
+            _spotlight.style.display = 'none';
+            _tooltip.style.left = '50%';
+            _tooltip.style.top = '50%';
+            _tooltip.style.transform = 'translate(-50%, -50%)';
+        }
+    }
+
+    function positionTooltip(targetRect, position) {
+        var tooltipRect = _tooltip.getBoundingClientRect();
+        var gap = 16;
+        var left, top;
+        
+        switch (position) {
+            case 'top':
+                left = targetRect.left + targetRect.width / 2 - tooltipRect.width / 2;
+                top = targetRect.top - tooltipRect.height - gap;
+                break;
+            case 'bottom':
+                left = targetRect.left + targetRect.width / 2 - tooltipRect.width / 2;
+                top = targetRect.bottom + gap;
+                break;
+            case 'left':
+                left = targetRect.left - tooltipRect.width - gap;
+                top = targetRect.top + targetRect.height / 2 - tooltipRect.height / 2;
+                break;
+            case 'right':
+                left = targetRect.right + gap;
+                top = targetRect.top + targetRect.height / 2 - tooltipRect.height / 2;
+                break;
+            default: // center
+                left = window.innerWidth / 2 - tooltipRect.width / 2;
+                top = window.innerHeight / 2 - tooltipRect.height / 2;
+        }
+        
+        // Keep tooltip in viewport
+        left = Math.max(16, Math.min(left, window.innerWidth - tooltipRect.width - 16));
+        top = Math.max(16, Math.min(top, window.innerHeight - tooltipRect.height - 16));
+        
+        _tooltip.style.left = left + 'px';
+        _tooltip.style.top = top + 'px';
+        _tooltip.style.transform = 'none';
+    }
+
+    function nextStep() {
+        if (_currentStep < _steps.length - 1) {
+            showStep(_currentStep + 1);
+        } else {
+            complete();
+        }
+    }
+
+    function prevStep() {
+        if (_currentStep > 0) {
+            showStep(_currentStep - 1);
+        }
+    }
+
+    function handleKeyDown(e) {
+        if (!_isActive) return;
+        
+        if (e.key === 'Escape') {
+            skip();
+        } else if (e.key === 'ArrowRight' || e.key === 'Enter') {
+            nextStep();
+        } else if (e.key === 'ArrowLeft') {
+            prevStep();
+        }
+    }
+
+    // ============ Public API ============
+
+    function start(type, callback) {
+        if (_isActive) return;
+        
+        // Get tutorial steps based on type
+        if (type === 'desktop') {
+            _steps = getDesktopTutorialSteps();
+        } else {
+            _steps = getConsoleTutorialSteps();
+        }
+        
+        if (!_steps.length) return;
+        
+        _isActive = true;
+        _currentStep = 0;
+        _onComplete = callback;
+        
+        createOverlay();
+        
+        // Animate in
+        requestAnimationFrame(function() {
+            _overlay.classList.add('active');
+            showStep(0);
+        });
+    }
+
+    function skip() {
+        if (!_isActive) return;
+        
+        _isActive = false;
+        _overlay.classList.remove('active');
+        
+        setTimeout(function() {
+            removeOverlay();
+            _steps = [];
+            _currentStep = 0;
+        }, 300);
+    }
+
+    function complete() {
+        // Mark as seen
+        var seen = JSON.parse(localStorage.getItem(STORAGE_SEEN) || '{}');
+        seen[_steps === getDesktopTutorialSteps() ? 'desktop' : 'console'] = true;
+        localStorage.setItem(STORAGE_SEEN, JSON.stringify(seen));
+        
+        _isActive = false;
+        _overlay.classList.remove('active');
+        
+        setTimeout(function() {
+            removeOverlay();
+            if (typeof _onComplete === 'function') {
+                _onComplete();
+            }
+            _steps = [];
+            _currentStep = 0;
+            _onComplete = null;
+        }, 300);
+    }
+
+    function hasSeenTutorial(type) {
+        var seen = JSON.parse(localStorage.getItem(STORAGE_SEEN) || '{}');
+        return seen[type || 'console'] === true;
+    }
+
+    function resetTutorial(type) {
+        var seen = JSON.parse(localStorage.getItem(STORAGE_SEEN) || '{}');
+        if (type) {
+            delete seen[type];
+        } else {
+            seen = {};
+        }
+        localStorage.setItem(STORAGE_SEEN, JSON.stringify(seen));
+    }
+
+    function setDisabled(disabled) {
+        localStorage.setItem(STORAGE_DISABLED, disabled ? 'true' : 'false');
+    }
+
+    function isDisabled() {
+        return localStorage.getItem(STORAGE_DISABLED) === 'true';
+    }
+
+    // Auto-start on first visit (if not disabled)
+    function autoStart(type) {
+        if (isDisabled()) return;
+        if (hasSeenTutorial(type)) return;
+        
+        // Small delay to let the page settle
+        setTimeout(function() {
+            start(type);
+        }, 1000);
+    }
+
+    // ============ Export ============
+
+    window.Tutorial = {
+        start: start,
+        skip: skip,
+        hasSeenTutorial: hasSeenTutorial,
+        resetTutorial: resetTutorial,
+        setDisabled: setDisabled,
+        isDisabled: isDisabled,
+        autoStart: autoStart
+    };
+
+})();
diff --git a/web-nodejs/public/js/widget-plugins.js b/web-nodejs/public/js/widget-plugins.js
new file mode 100644
index 00000000..ff6e3a90
--- /dev/null
+++ b/web-nodejs/public/js/widget-plugins.js
@@ -0,0 +1,968 @@
+/**
+ * BetterDesk Console — Widget Plugin System
+ * Registry + 12 built-in widget types for the desktop dashboard.
+ * Depends: desktop-widgets.js, Utils, _ (i18n)
+ */
+
+(function () {
+    'use strict';
+
+    var _registry = new Map();
+    var t = function (k) { return typeof _ === 'function' ? _(k) : k; };
+
+    function esc(s) {
+        var d = document.createElement('div');
+        d.textContent = s || '';
+        return d.innerHTML;
+    }
+
+    // ============ Registry API ============
+
+    function register(type, config) {
+        if (!type || !config) return;
+        config.type = type;
+        _registry.set(type, config);
+    }
+
+    function get(type) { return _registry.get(type); }
+
+    function list() {
+        var arr = [];
+        _registry.forEach(function (v) { arr.push(v); });
+        return arr;
+    }
+
+    // ============ Helpers ============
+
+    function apiGet(url) {
+        if (typeof Utils !== 'undefined' && Utils.api) {
+            return Utils.api(url).then(function (res) {
+                if (res && typeof res.json === 'function') return res.json();
+                return res;
+            });
+        }
+        return fetch(url, { credentials: 'same-origin' }).then(function (r) { return r.json(); });
+    }
+
+    function buildGaugeSVG(pct, size) {
+        size = size || 100;
+        var r = (size - 8) / 2;
+        var circ = 2 * Math.PI * r;
+        var off = circ * (1 - pct / 100);
+        var cls = pct > 85 ? 'danger' : (pct > 65 ? 'warning' : '');
+        return '<svg width="' + size + '" height="' + size + '" viewBox="0 0 ' + size + ' ' + size + '">' +
+            '<circle class="gauge-bg" cx="' + (size / 2) + '" cy="' + (size / 2) + '" r="' + r + '"/>' +
+            '<circle class="gauge-fill ' + cls + '" cx="' + (size / 2) + '" cy="' + (size / 2) + '" r="' + r + '" ' +
+                'stroke-dasharray="' + circ + '" stroke-dashoffset="' + off + '"/>' +
+        '</svg>';
+    }
+
+    function timeSince(date) {
+        var seconds = Math.floor((Date.now() - new Date(date).getTime()) / 1000);
+        if (seconds < 60) return seconds + 's';
+        if (seconds < 3600) return Math.floor(seconds / 60) + 'm';
+        if (seconds < 86400) return Math.floor(seconds / 3600) + 'h';
+        return Math.floor(seconds / 86400) + 'd';
+    }
+
+    // ============ Built-in Widgets ============
+
+    // 1. Clock
+    register('clock', {
+        name: t('desktop.widget_clock'),
+        icon: 'schedule',
+        color: '#58a6ff',
+        category: 'general',
+        description: 'Digital clock with date',
+        defaultSize: { w: 240, h: 160 },
+        minSize: { w: 180, h: 120 },
+        _interval: null,
+        render: function (body) {
+            body.innerHTML = '<div class="widget-clock-time"></div><div class="widget-clock-date"></div>';
+            this._tick(body);
+            var self = this;
+            body._clockInterval = setInterval(function () { self._tick(body); }, 1000);
+        },
+        _tick: function (body) {
+            var now = new Date();
+            var timeEl = body.querySelector('.widget-clock-time');
+            var dateEl = body.querySelector('.widget-clock-date');
+            if (timeEl) {
+                var h = String(now.getHours()).padStart(2, '0');
+                var m = String(now.getMinutes()).padStart(2, '0');
+                var s = String(now.getSeconds()).padStart(2, '0');
+                timeEl.innerHTML = h + ':' + m + '<span class="widget-clock-seconds">:' + s + '</span>';
+            }
+            if (dateEl) {
+                dateEl.textContent = now.toLocaleDateString(undefined, { weekday: 'long', year: 'numeric', month: 'long', day: 'numeric' });
+            }
+        },
+        destroy: function (body) {
+            if (body && body._clockInterval) {
+                clearInterval(body._clockInterval);
+                body._clockInterval = null;
+            }
+        }
+    });
+
+    // 2. Device Status (counters)
+    register('device-status', {
+        name: t('desktop.widget_device_status'),
+        icon: 'devices',
+        color: '#3fb950',
+        category: 'monitoring',
+        description: 'Online / offline / total device counters',
+        defaultSize: { w: 320, h: 160 },
+        minSize: { w: 240, h: 130 },
+        updateInterval: 15000,
+        render: function (body) {
+            body.innerHTML = '<div class="widget-status-counters">' +
+                '<div class="widget-status-counter online"><div class="widget-status-counter-value">-</div><div class="widget-status-counter-label">' + t('desktop.label_online') + '</div></div>' +
+                '<div class="widget-status-counter offline"><div class="widget-status-counter-value">-</div><div class="widget-status-counter-label">' + t('desktop.label_offline') + '</div></div>' +
+                '<div class="widget-status-counter total"><div class="widget-status-counter-value">-</div><div class="widget-status-counter-label">' + t('desktop.label_total') + '</div></div>' +
+            '</div>';
+        },
+        update: function (body) {
+            apiGet('/api/stats').then(function (data) {
+                if (!data || !data.devices) return;
+                var d = data.devices;
+                var online = body.querySelector('.online .widget-status-counter-value');
+                var offline = body.querySelector('.offline .widget-status-counter-value');
+                var total = body.querySelector('.total .widget-status-counter-value');
+                if (online) online.textContent = d.online || 0;
+                if (offline) offline.textContent = d.offline || 0;
+                if (total) total.textContent = d.total || 0;
+            }).catch(function () {});
+        }
+    });
+
+    // 3. Server Info (combined health + ports + uptime)
+    register('server-health', {
+        name: t('desktop.widget_server_health'),
+        icon: 'dns',
+        color: '#f0883e',
+        category: 'monitoring',
+        description: 'Services, ports, and uptime overview',
+        defaultSize: { w: 380, h: 280 },
+        minSize: { w: 300, h: 220 },
+        updateInterval: 20000,
+        render: function (body) {
+            body.innerHTML = '<div class="widget-server-info">' +
+                '<div class="widget-si-services">' +
+                    '<div class="widget-si-svc" data-svc="signal"><div class="widget-si-dot unknown"></div><span>Signal</span></div>' +
+                    '<div class="widget-si-svc" data-svc="relay"><div class="widget-si-dot unknown"></div><span>Relay</span></div>' +
+                    '<div class="widget-si-svc" data-svc="console"><div class="widget-si-dot up"></div><span>Console</span></div>' +
+                '</div>' +
+                '<div class="widget-si-uptime" data-si="uptime">' + t('desktop.label_uptime') + ': -</div>' +
+                '<div class="widget-si-ports">' +
+                    '<div class="widget-si-port-header"><span>' + t('desktop.label_service') + '</span><span>' + t('desktop.label_port') + '</span></div>' +
+                '</div></div>';
+        },
+        update: function (body) {
+            apiGet('/api/server/status').then(function (data) {
+                if (!data) return;
+                // Services
+                var sig = (data.signal || data.hbbs || {}).status || 'unknown';
+                var rel = (data.hbbr || {}).status || 'unknown';
+                var sigEl = body.querySelector('[data-svc="signal"]');
+                var relEl = body.querySelector('[data-svc="relay"]');
+                if (sigEl) { var d = sigEl.querySelector('.widget-si-dot'); if (d) d.className = 'widget-si-dot ' + (sig === 'running' ? 'up' : 'down'); }
+                if (relEl) { var d = relEl.querySelector('.widget-si-dot'); if (d) d.className = 'widget-si-dot ' + (rel === 'running' ? 'up' : 'down'); }
+                // Uptime
+                var ut = body.querySelector('[data-si="uptime"]');
+                if (ut && data.uptime != null) {
+                    var s = data.uptime;
+                    var days = Math.floor(s / 86400); s %= 86400;
+                    var hrs = Math.floor(s / 3600); s %= 3600;
+                    var mins = Math.floor(s / 60);
+                    var parts = [];
+                    if (days) parts.push(days + 'd');
+                    if (hrs) parts.push(hrs + 'h');
+                    parts.push(mins + 'm');
+                    ut.textContent = t('desktop.label_uptime') + ': ' + parts.join(' ');
+                }
+                // Ports
+                var pc = body.querySelector('.widget-si-ports');
+                if (!pc) return;
+                var rows = [
+                    { name: 'Signal', port: data.signal_port || 21116, up: sig === 'running' },
+                    { name: 'Relay', port: data.relay_port || 21117, up: rel === 'running' },
+                    { name: 'WS Signal', port: data.ws_signal_port || 21118, up: sig === 'running' },
+                    { name: 'WS Relay', port: data.ws_relay_port || 21119, up: rel === 'running' },
+                    { name: 'API', port: data.api_port || 21114, up: true },
+                    { name: 'Client API', port: data.client_api_port || 21121, up: true },
+                    { name: 'Console', port: data.console_port || 5000, up: true }
+                ];
+                var html = '<div class="widget-si-port-header"><span>' + t('desktop.label_service') + '</span><span>' + t('desktop.label_port') + '</span></div>';
+                rows.forEach(function (r) {
+                    html += '<div class="widget-si-port-row"><span class="widget-si-port-dot ' + (r.up ? 'up' : 'down') + '"></span><span class="widget-si-port-name">' + esc(r.name) + '</span><span class="widget-si-port-num">' + r.port + '</span></div>';
+                });
+                pc.innerHTML = html;
+            }).catch(function () {});
+        }
+    });
+
+    // 4. Device Stats Gauges
+    register('system-stats', {
+        name: t('desktop.widget_system_stats'),
+        icon: 'speed',
+        color: '#bc8cff',
+        category: 'monitoring',
+        description: 'Online, offline, and blocked device ratios',
+        defaultSize: { w: 360, h: 200 },
+        minSize: { w: 300, h: 160 },
+        updateInterval: 10000,
+        render: function (body) {
+            body.innerHTML = '<div style="display:flex;gap:16px;justify-content:center;align-items:center;height:100%;">' +
+                '<div class="widget-gauge" id="gauge-cpu"><div class="widget-gauge-ring">' + buildGaugeSVG(0) + '<div class="widget-gauge-value">-</div></div><div class="widget-gauge-label">' + t('desktop.label_online') + '</div></div>' +
+                '<div class="widget-gauge" id="gauge-mem"><div class="widget-gauge-ring">' + buildGaugeSVG(0) + '<div class="widget-gauge-value">-</div></div><div class="widget-gauge-label">' + t('desktop.label_offline') + '</div></div>' +
+                '<div class="widget-gauge" id="gauge-disk"><div class="widget-gauge-ring">' + buildGaugeSVG(0) + '<div class="widget-gauge-value">-</div></div><div class="widget-gauge-label">' + t('desktop.label_blocked') + '</div></div>' +
+            '</div>';
+        },
+        update: function (body) {
+            apiGet('/api/stats').then(function (data) {
+                if (!data || !data.devices) return;
+                var d = data.devices;
+                var total = d.total || 1;
+                var onlinePct = Math.round(((d.online || 0) / total) * 100);
+                var offlinePct = Math.round(((d.offline || 0) / total) * 100);
+                var blockedPct = Math.round(((d.banned || d.blocked || 0) / total) * 100);
+                _updateGauge(body, 'gauge-cpu', onlinePct);
+                _updateGauge(body, 'gauge-mem', offlinePct);
+                _updateGauge(body, 'gauge-disk', blockedPct);
+            }).catch(function () {});
+        }
+    });
+
+    function _updateGauge(body, id, pct) {
+        var gauge = body.querySelector('#' + id);
+        if (!gauge) return;
+        var ring = gauge.querySelector('.widget-gauge-ring');
+        var val  = gauge.querySelector('.widget-gauge-value');
+        if (ring) {
+            // Replace SVG
+            var svg = ring.querySelector('svg');
+            var newRing = document.createElement('div');
+            newRing.innerHTML = buildGaugeSVG(pct);
+            if (svg) ring.replaceChild(newRing.firstChild, svg);
+        }
+        if (val) val.textContent = Math.round(pct) + '%';
+    }
+
+    // 5. Device List (mini table)
+    register('device-list', {
+        name: t('desktop.widget_device_list'),
+        icon: 'list',
+        color: '#79c0ff',
+        category: 'devices',
+        description: 'Scrollable list of all devices',
+        defaultSize: { w: 360, h: 300 },
+        minSize: { w: 280, h: 200 },
+        updateInterval: 20000,
+        render: function (body) {
+            body.innerHTML = '<div class="widget-device-list"><div class="widget-loading" style="height:40px"></div></div>';
+            body.style.overflow = 'auto';
+        },
+        update: function (body) {
+            apiGet('/api/devices').then(function (data) {
+                var peers = [];
+                if (data && data.devices) peers = data.devices;
+                else if (Array.isArray(data)) peers = data;
+                if (!peers.length) return;
+
+                var list = body.querySelector('.widget-device-list');
+                if (!list) return;
+                if (!peers.length) {
+                    list.innerHTML = '<div class="widget-empty"><span class="material-icons">devices</span><span>' + t('desktop.label_no_devices') + '</span></div>';
+                    return;
+                }
+
+                var html = '';
+                peers.slice(0, 50).forEach(function (p) {
+                    var online = p.live_online || p.online || false;
+                    var status = online ? 'online' : 'offline';
+                    html += '<div class="widget-device-row">' +
+                        '<div class="widget-device-dot ' + status + '"></div>' +
+                        '<div class="widget-device-id">' + esc(p.id) + '</div>' +
+                        '<div class="widget-device-name">' + esc(p.hostname || p.name || '-') + '</div>' +
+                        '<div class="widget-device-platform">' + esc(p.platform || p.os || '') + '</div>' +
+                    '</div>';
+                });
+                list.innerHTML = html;
+            }).catch(function () {});
+        }
+    });
+
+    // 6. Quick Actions
+    register('quick-actions', {
+        name: t('desktop.widget_quick_actions'),
+        icon: 'flash_on',
+        color: '#d29922',
+        category: 'tools',
+        description: 'Common management shortcuts',
+        defaultSize: { w: 260, h: 210 },
+        minSize: { w: 200, h: 160 },
+        render: function (body) {
+            var actions = [
+                { icon: 'add', label: t('desktop.action_add_widget'), action: 'add-widget', color: '#58a6ff' },
+                { icon: 'wallpaper', label: t('desktop.wallpaper'), action: 'wallpaper', color: '#bc8cff' },
+                { icon: 'devices', label: t('nav.devices'), action: 'nav', route: '/devices', color: '#3fb950' },
+                { icon: 'dashboard', label: t('nav.dashboard'), action: 'nav', route: '/', color: '#f0883e' },
+                { icon: 'vpn_key', label: t('nav.keys'), action: 'nav', route: '/keys', color: '#d29922' },
+                { icon: 'settings', label: t('nav.settings'), action: 'nav', route: '/settings', color: '#8b949e' }
+            ];
+
+            var html = '<div class="widget-actions-grid">';
+            actions.forEach(function (a) {
+                html += '<div class="widget-action-btn" data-action="' + esc(a.action) + '" data-route="' + esc(a.route || '') + '">' +
+                    '<span class="material-icons" style="color:' + esc(a.color) + '">' + esc(a.icon) + '</span>' +
+                    '<span>' + esc(a.label) + '</span>' +
+                '</div>';
+            });
+            html += '</div>';
+            body.innerHTML = html;
+
+            body.querySelectorAll('.widget-action-btn').forEach(function (btn) {
+                btn.addEventListener('click', function () {
+                    var action = btn.dataset.action;
+                    if (action === 'nav' && btn.dataset.route) {
+                        window.location.href = btn.dataset.route;
+                    } else if (action === 'wallpaper' && window.DesktopWidgets) {
+                        window.DesktopWidgets.openWallpaperPicker();
+                    } else if (action === 'add-widget' && window.DesktopWidgets) {
+                        window.DesktopWidgets.openPicker();
+                    }
+                });
+            });
+        }
+    });
+
+    // 7. Recent Activity (feed)
+    register('recent-activity', {
+        name: t('desktop.widget_recent_activity'),
+        icon: 'history',
+        color: '#f778ba',
+        category: 'monitoring',
+        description: 'Latest audit events',
+        defaultSize: { w: 320, h: 280 },
+        minSize: { w: 240, h: 180 },
+        updateInterval: 15000,
+        render: function (body) {
+            body.innerHTML = '<div class="widget-feed-list"><div class="widget-loading" style="height:40px"></div></div>';
+            body.style.overflow = 'auto';
+        },
+        update: function (body) {
+            apiGet('/api/audit/conn?limit=20').then(function (data) {
+                var events = data;
+                if (data && data.data) events = data.data;
+                if (!Array.isArray(events)) return;
+
+                var list = body.querySelector('.widget-feed-list');
+                if (!list) return;
+                if (!events.length) {
+                    list.innerHTML = '<div class="widget-empty"><span class="material-icons">history</span><span>' + t('desktop.label_no_activity') + '</span></div>';
+                    return;
+                }
+
+                var html = '';
+                events.slice(0, 15).forEach(function (ev) {
+                    var time = ev.created_at || ev.timestamp || '';
+                    html += '<div class="widget-feed-item">' +
+                        '<div class="widget-feed-time">' + esc(timeSince(time)) + '</div>' +
+                        '<div class="widget-feed-text">' + esc(ev.action || ev.event_type || '') + ' — ' + esc(ev.details || ev.description || '') + '</div>' +
+                    '</div>';
+                });
+                list.innerHTML = html;
+            }).catch(function () {});
+        }
+    });
+
+    // 8. Notes (sticky)
+    register('notes', {
+        name: t('desktop.widget_notes'),
+        icon: 'sticky_note_2',
+        color: '#d29922',
+        category: 'general',
+        description: 'Personal sticky note',
+        defaultSize: { w: 260, h: 240 },
+        minSize: { w: 180, h: 140 },
+        render: function (body, config) {
+            body.innerHTML = '<textarea class="widget-notes-textarea" placeholder="' + esc(t('desktop.notes_placeholder')) + '"></textarea>';
+            var ta = body.querySelector('.widget-notes-textarea');
+            ta.value = config.text || '';
+            var debounce = null;
+            ta.addEventListener('input', function () {
+                clearTimeout(debounce);
+                debounce = setTimeout(function () {
+                    config.text = ta.value;
+                    // Trigger layout save through widget engine
+                    if (window.DesktopWidgets && window.DesktopWidgets.getWidgets) {
+                        // save is triggered by config change
+                        localStorage.setItem('bd_widget_layout', JSON.stringify(
+                            Array.from(window.DesktopWidgets.getWidgets().values())
+                        ));
+                    }
+                }, 500);
+            });
+        },
+        configForm: function (config) {
+            return [
+                { key: 'text', label: 'Note text', type: 'textarea' }
+            ];
+        }
+    });
+
+    // 9. Network Monitor
+    register('network-monitor', {
+        name: t('desktop.widget_network_monitor'),
+        icon: 'wifi',
+        color: '#3fb950',
+        category: 'monitoring',
+        description: 'Network target ping status',
+        defaultSize: { w: 300, h: 240 },
+        minSize: { w: 240, h: 180 },
+        updateInterval: 30000,
+        render: function (body) {
+            body.innerHTML = '<div class="widget-net-targets"><div class="widget-loading" style="height:40px"></div></div>';
+        },
+        update: function (body) {
+            apiGet('/api/network/targets').then(function (data) {
+                var targets = data;
+                if (data && data.data) targets = data.data;
+                if (!Array.isArray(targets)) { targets = []; }
+
+                var container = body.querySelector('.widget-net-targets');
+                if (!container) return;
+                if (!targets.length) {
+                    container.innerHTML = '<div class="widget-empty"><span class="material-icons">wifi</span><span>' + t('desktop.label_no_targets') + '</span></div>';
+                    return;
+                }
+
+                var html = '';
+                targets.slice(0, 10).forEach(function (tgt) {
+                    var status = tgt.is_up ? 'up' : 'down';
+                    html += '<div class="widget-net-target">' +
+                        '<div class="widget-net-status ' + status + '"></div>' +
+                        '<div class="widget-net-name">' + esc(tgt.name || tgt.host) + '</div>' +
+                        '<div class="widget-net-latency">' + (tgt.avg_latency != null ? tgt.avg_latency + 'ms' : '-') + '</div>' +
+                    '</div>';
+                });
+                container.innerHTML = html;
+            }).catch(function () {
+                var container = body.querySelector('.widget-net-targets');
+                if (container) container.innerHTML = '<div class="widget-empty"><span class="material-icons">wifi_off</span><span>' + t('desktop.label_unavailable') + '</span></div>';
+            });
+        }
+    });
+
+    // 10. Tickets Summary
+    register('tickets-summary', {
+        name: t('desktop.widget_tickets_summary'),
+        icon: 'confirmation_number',
+        color: '#f85149',
+        category: 'tools',
+        description: 'Open and resolved ticket counts',
+        defaultSize: { w: 260, h: 190 },
+        minSize: { w: 200, h: 150 },
+        updateInterval: 30000,
+        render: function (body) {
+            body.innerHTML = '<div>' +
+                '<div class="widget-tickets-row"><span class="widget-tickets-label">' + t('desktop.label_open') + '</span><span class="widget-tickets-count" style="color:#f85149" id="tickets-open">-</span></div>' +
+                '<div class="widget-tickets-row"><span class="widget-tickets-label">' + t('desktop.label_in_progress') + '</span><span class="widget-tickets-count" style="color:#d29922" id="tickets-progress">-</span></div>' +
+                '<div class="widget-tickets-row"><span class="widget-tickets-label">' + t('desktop.label_resolved') + '</span><span class="widget-tickets-count" style="color:#3fb950" id="tickets-resolved">-</span></div>' +
+            '</div>';
+        },
+        update: function (body) {
+            apiGet('/api/tickets/stats').then(function (data) {
+                if (!data) return;
+                var open = body.querySelector('#tickets-open');
+                var prog = body.querySelector('#tickets-progress');
+                var res  = body.querySelector('#tickets-resolved');
+                if (open) open.textContent = data.open_count || data.open || 0;
+                if (prog) prog.textContent = data.in_progress_count || data.in_progress || 0;
+                if (res)  res.textContent = data.resolved_count || data.resolved || 0;
+            }).catch(function () {});
+        }
+    });
+
+    // 11. iFrame
+    register('iframe', {
+        name: t('desktop.widget_iframe'),
+        icon: 'language',
+        color: '#8b949e',
+        category: 'general',
+        description: 'Embed any URL in a widget',
+        defaultSize: { w: 400, h: 300 },
+        minSize: { w: 200, h: 150 },
+        render: function (body, config) {
+            var url = config.url || '';
+            if (url) {
+                body.style.padding = '0';
+                body.innerHTML = '<iframe class="widget-iframe" src="' + esc(url) + '" sandbox="allow-same-origin allow-scripts"></iframe>';
+            } else {
+                body.innerHTML = '<div class="widget-empty"><span class="material-icons">language</span><span>' + t('desktop.label_set_url') + '</span></div>';
+            }
+        },
+        configForm: function (config) {
+            return [
+                { key: 'url', label: 'URL', type: 'text' }
+            ];
+        }
+    });
+
+    // 12. CDAP Integration Widget
+    register('cdap-devices', {
+        name: t('desktop.widget_cdap_devices'),
+        icon: 'developer_board',
+        color: '#bc8cff',
+        category: 'devices',
+        description: 'Connected CDAP devices & widgets',
+        defaultSize: { w: 320, h: 260 },
+        minSize: { w: 240, h: 180 },
+        updateInterval: 15000,
+        render: function (body) {
+            body.innerHTML = '<div class="widget-device-list"><div class="widget-loading" style="height:40px"></div></div>';
+            body.style.overflow = 'auto';
+        },
+        update: function (body) {
+            apiGet('/api/cdap/devices').then(function (data) {
+                var devices = data;
+                if (data && data.data) devices = data.data;
+                if (!Array.isArray(devices)) devices = [];
+
+                var list = body.querySelector('.widget-device-list');
+                if (!list) return;
+                if (!devices.length) {
+                    list.innerHTML = '<div class="widget-empty"><span class="material-icons">developer_board</span><span>' + t('desktop.label_no_cdap_devices') + '</span></div>';
+                    return;
+                }
+
+                var html = '';
+                devices.forEach(function (d) {
+                    var status = d.connected ? 'online' : 'offline';
+                    html += '<div class="widget-device-row">' +
+                        '<div class="widget-device-dot ' + status + '"></div>' +
+                        '<div class="widget-device-id">' + esc(d.id || d.device_id || '') + '</div>' +
+                        '<div class="widget-device-name">' + esc(d.name || d.hostname || '-') + '</div>' +
+                        '<div class="widget-device-platform">' + esc(d.type || d.device_type || '') + '</div>' +
+                    '</div>';
+                });
+                list.innerHTML = html;
+            }).catch(function () {
+                var list = body.querySelector('.widget-device-list');
+                if (list) list.innerHTML = '<div class="widget-empty"><span class="material-icons">developer_board</span><span>' + t('desktop.label_unavailable') + '</span></div>';
+            });
+        }
+    });
+
+    // ============ 13. Uptime Timer ============
+
+    register('uptime', {
+        name: t('desktop.widget_uptime'),
+        icon: 'timer',
+        color: '#58a6ff',
+        category: 'monitoring',
+        description: 'Server uptime counter',
+        defaultSize: { w: 200, h: 160 },
+        minSize: { w: 160, h: 120 },
+        render: function (body) {
+            body.innerHTML = '<div class="widget-uptime">' +
+                '<div class="widget-uptime-value">--:--:--</div>' +
+                '<div class="widget-uptime-label">' + t('desktop.label_server_uptime') + '</div></div>';
+            body._uptimeStart = null;
+            body._uptimeBase = 0;
+            var self = this;
+            this._fetch(body);
+            body._uptimeTimer = setInterval(function () { self._tick(body); }, 1000);
+        },
+        _fetch: function (body) {
+            apiGet('/api/server/status').then(function (d) {
+                if (d && d.uptime) { body._uptimeBase = parseInt(d.uptime, 10) || 0; body._uptimeStart = Date.now(); }
+                else if (d && d.started_at) { body._uptimeStart = Date.now(); body._uptimeBase = Math.floor((Date.now() - new Date(d.started_at).getTime()) / 1000); }
+            }).catch(function () {});
+        },
+        _tick: function (body) {
+            var s = body._uptimeBase;
+            if (body._uptimeStart) s = body._uptimeBase + Math.floor((Date.now() - body._uptimeStart) / 1000);
+            if (!s && s !== 0) return;
+            var h = String(Math.floor(s / 3600)).padStart(2, '0');
+            var m = String(Math.floor((s % 3600) / 60)).padStart(2, '0');
+            var sec = String(s % 60).padStart(2, '0');
+            var el = body.querySelector('.widget-uptime-value');
+            if (el) el.textContent = h + ':' + m + ':' + sec;
+        },
+        update: function (body) { this._fetch(body); },
+        destroy: function (body) {
+            if (body && body._uptimeTimer) { clearInterval(body._uptimeTimer); body._uptimeTimer = null; }
+        }
+    });
+
+    // ============ 14. Port Status Table ============
+
+    // ============ 14. Port Status (deprecated — merged into server-health) ============
+
+    register('port-status', {
+        name: t('desktop.widget_port_status'),
+        icon: 'lan',
+        color: '#79c0ff',
+        category: 'monitoring',
+        description: 'Network port status (use Server Info instead)',
+        defaultSize: { w: 380, h: 220 },
+        minSize: { w: 300, h: 160 },
+        updateInterval: 20000,
+        render: function (body) {
+            body.innerHTML = '<div class="widget-empty"><span class="material-icons">info</span><span>' + t('desktop.label_merged_server_info') + '</span></div>';
+        },
+        update: function () {}
+    });
+
+    // ============ 15. Device Icon Grid ============
+
+    register('device-grid', {
+        name: t('desktop.widget_device_grid'),
+        icon: 'grid_view',
+        color: '#3fb950',
+        category: 'devices',
+        description: 'Device icons with status indicators',
+        defaultSize: { w: 340, h: 240 },
+        minSize: { w: 260, h: 160 },
+        updateInterval: 15000,
+        render: function (body) {
+            body.innerHTML = '<div class="widget-device-grid-container"><div class="widget-loading" style="height:40px"></div></div>';
+        },
+        update: function (body) {
+            apiGet('/api/devices').then(function (data) {
+                var peers = data && data.devices ? data.devices : (Array.isArray(data) ? data : []);
+                var c = body.querySelector('.widget-device-grid-container');
+                if (!c) return;
+                if (!peers.length) {
+                    c.innerHTML = '<div class="widget-empty"><span class="material-icons">devices</span><span>' + t('desktop.label_no_devices') + '</span></div>';
+                    return;
+                }
+                var pi = { windows: 'laptop_windows', linux: 'computer', mac: 'laptop_mac', macos: 'laptop_mac', android: 'phone_android', ios: 'phone_iphone' };
+                var html = '';
+                peers.slice(0, 24).forEach(function (p) {
+                    var on = p.live_online || p.online || false;
+                    var plat = (p.platform || p.os || '').toLowerCase();
+                    var icon = 'devices';
+                    for (var k in pi) { if (plat.indexOf(k) !== -1) { icon = pi[k]; break; } }
+                    html += '<div class="widget-dg-card ' + (on ? 'online' : 'offline') + '" title="' + esc(p.id + ' — ' + (p.hostname || '')) + '">' +
+                        '<span class="material-icons widget-dg-icon">' + icon + '</span>' +
+                        '<div class="widget-dg-name">' + esc(p.hostname || p.id || '-') + '</div>' +
+                        '<div class="widget-dg-status">' + (on ? t('desktop.label_online') : t('desktop.label_offline')) + '</div></div>';
+                });
+                c.innerHTML = html;
+            }).catch(function () {});
+        }
+    });
+
+    // ============ 16. Multi-Gauge Cluster ============
+
+    register('multi-gauge', {
+        name: t('desktop.widget_multi_gauge'),
+        icon: 'donut_large',
+        color: '#f0883e',
+        category: 'monitoring',
+        description: 'Multiple resource gauges',
+        defaultSize: { w: 400, h: 180 },
+        minSize: { w: 320, h: 140 },
+        updateInterval: 10000,
+        render: function (body) {
+            var names = [t('desktop.label_online'), t('desktop.label_offline'), t('desktop.label_banned'), t('desktop.label_active'), t('desktop.label_total')];
+            var html = '<div class="widget-multi-gauge">';
+            names.forEach(function (n, i) {
+                html += '<div class="widget-mg-item" data-idx="' + i + '">' +
+                    '<div class="widget-mg-ring">' + buildGaugeSVG(0, 64) + '<div class="widget-mg-value">-</div></div>' +
+                    '<div class="widget-mg-label">' + n + '</div></div>';
+            });
+            body.innerHTML = html + '</div>';
+        },
+        update: function (body) {
+            apiGet('/api/stats').then(function (data) {
+                if (!data || !data.devices) return;
+                var d = data.devices;
+                var t = d.total || 1;
+                var vals = [
+                    { idx: 0, pct: Math.round(((d.online || 0) / t) * 100), raw: d.online || 0 },
+                    { idx: 1, pct: Math.round(((d.offline || 0) / t) * 100), raw: d.offline || 0 },
+                    { idx: 2, pct: Math.round(((d.banned || 0) / t) * 100), raw: d.banned || 0 },
+                    { idx: 3, pct: Math.round(((d.withNotes || 0) / t) * 100), raw: d.withNotes || 0 },
+                    { idx: 4, pct: 100, raw: d.total || 0 }
+                ];
+                vals.forEach(function (v) {
+                    var item = body.querySelector('[data-idx="' + v.idx + '"]');
+                    if (!item) return;
+                    var ring = item.querySelector('.widget-mg-ring');
+                    var val = item.querySelector('.widget-mg-value');
+                    if (ring) {
+                        var svg = ring.querySelector('svg');
+                        var tmp = document.createElement('div');
+                        tmp.innerHTML = buildGaugeSVG(v.pct, 64);
+                        if (svg && tmp.firstChild) ring.replaceChild(tmp.firstChild, svg);
+                    }
+                    if (val) val.textContent = v.raw;
+                });
+            }).catch(function () {});
+        }
+    });
+
+    // ============ 17. Weekly Activity Chart ============
+
+    register('weekly-chart', {
+        name: t('desktop.widget_weekly_chart'),
+        icon: 'bar_chart',
+        color: '#bc8cff',
+        category: 'monitoring',
+        description: 'Daily device activity bars',
+        defaultSize: { w: 340, h: 200 },
+        minSize: { w: 260, h: 160 },
+        updateInterval: 60000,
+        render: function (body) {
+            body.innerHTML = '<div class="widget-weekly"><div class="widget-weekly-bars"></div></div>';
+            this._draw(body);
+        },
+        _draw: function (body) {
+            var c = body.querySelector('.widget-weekly-bars');
+            if (!c) return;
+            var days = [t('time.day_mon'), t('time.day_tue'), t('time.day_wed'), t('time.day_thu'), t('time.day_fri'), t('time.day_sat'), t('time.day_sun')];
+            var dow = new Date().getDay();
+            var todayIdx = dow === 0 ? 6 : dow - 1;
+            var html = '';
+            days.forEach(function (d, i) {
+                var h1 = 30 + (i * 13) % 60;
+                var h2 = 20 + ((i + 3) * 17) % 50;
+                html += '<div class="widget-wb-col">' +
+                    '<div class="widget-wb-bars">' +
+                        '<div class="widget-wb-bar online" style="height:' + h1 + '%"></div>' +
+                        '<div class="widget-wb-bar offline" style="height:' + h2 + '%"></div>' +
+                    '</div>' +
+                    '<div class="widget-wb-label' + (i === todayIdx ? ' today' : '') + '">' + d + '</div></div>';
+            });
+            c.innerHTML = html;
+        },
+        update: function (body) { this._draw(body); }
+    });
+
+    // ============ 18. Quick Controls ============
+
+    register('quick-controls', {
+        name: t('desktop.widget_quick_controls'),
+        icon: 'tune',
+        color: '#d29922',
+        category: 'devices',
+        description: 'Device management shortcuts',
+        defaultSize: { w: 400, h: 280 },
+        minSize: { w: 300, h: 200 },
+        updateInterval: 15000,
+        render: function (body) {
+            body.innerHTML = '<div class="widget-qc"><div class="widget-qc-filter">' +
+                '<input type="text" class="widget-qc-search" placeholder="' + t('desktop.label_filter_devices') + '">' +
+                '<div class="widget-qc-pills">' +
+                    '<button class="widget-qc-pill active" data-filter="all">' + t('desktop.label_all') + '</button>' +
+                    '<button class="widget-qc-pill" data-filter="online">' + t('desktop.label_online') + '</button>' +
+                    '<button class="widget-qc-pill" data-filter="offline">' + t('desktop.label_offline') + '</button>' +
+                '</div></div>' +
+                '<div class="widget-qc-list"><div class="widget-loading" style="height:40px"></div></div></div>';
+            // Filter pills
+            body.querySelector('.widget-qc-pills').addEventListener('click', function (e) {
+                var pill = e.target.closest('.widget-qc-pill');
+                if (!pill) return;
+                body.querySelectorAll('.widget-qc-pill').forEach(function (p) { p.classList.remove('active'); });
+                pill.classList.add('active');
+                _filterQC(body);
+            });
+            // Search
+            body.querySelector('.widget-qc-search').addEventListener('input', function () { _filterQC(body); });
+        },
+        update: function (body) {
+            apiGet('/api/devices').then(function (data) {
+                var peers = (data && data.devices ? data.devices : []);
+                var c = body.querySelector('.widget-qc-list');
+                if (!c) return;
+                if (!peers.length) {
+                    c.innerHTML = '<div class="widget-empty"><span class="material-icons">devices</span><span>' + t('desktop.label_no_devices') + '</span></div>';
+                    return;
+                }
+                var pi = { windows: 'laptop_windows', linux: 'computer', mac: 'laptop_mac', macos: 'laptop_mac', android: 'phone_android', ios: 'phone_iphone' };
+                var html = '';
+                peers.forEach(function (p) {
+                    var on = p.live_online || p.online || false;
+                    var banned = p.banned || false;
+                    var plat = (p.platform || p.os || '').toLowerCase();
+                    var icon = 'devices';
+                    for (var k in pi) { if (plat.indexOf(k) !== -1) { icon = pi[k]; break; } }
+                    var name = p.hostname || p.id || '-';
+                    html += '<div class="widget-qc-row' + (on ? ' online' : ' offline') + (banned ? ' banned' : '') + '" data-id="' + esc(p.id) + '" data-status="' + (on ? 'online' : 'offline') + '" data-name="' + esc(name.toLowerCase()) + '">' +
+                        '<span class="material-icons widget-qc-icon">' + icon + '</span>' +
+                        '<div class="widget-qc-info">' +
+                            '<div class="widget-qc-name">' + esc(name) + '</div>' +
+                            '<div class="widget-qc-id">' + esc(p.id) + (banned ? ' <span class="widget-qc-badge ban">' + t('desktop.label_banned') + '</span>' : '') + '</div>' +
+                        '</div>' +
+                        '<div class="widget-qc-actions">' +
+                            '<button class="widget-qc-btn" data-action="toggle-ban" title="' + (banned ? t('desktop.label_unban') : t('desktop.label_ban')) + '"><span class="material-icons">' + (banned ? 'lock_open' : 'block') + '</span></button>' +
+                            (on ? '<button class="widget-qc-btn connect" data-action="connect" title="' + t('desktop.label_connect') + '"><span class="material-icons">launch</span></button>' : '') +
+                        '</div></div>';
+                });
+                c.innerHTML = html;
+                _filterQC(body);
+                // Action handlers
+                c.querySelectorAll('.widget-qc-btn').forEach(function (btn) {
+                    btn.addEventListener('click', function (e) {
+                        e.stopPropagation();
+                        var row = btn.closest('.widget-qc-row');
+                        var id = row ? row.dataset.id : '';
+                        var action = btn.dataset.action;
+                        if (action === 'connect' && id) {
+                            window.open('rustdesk://' + id, '_blank');
+                        } else if (action === 'toggle-ban' && id) {
+                            var isBanned = row.classList.contains('banned');
+                            var url = '/api/devices/' + encodeURIComponent(id) + (isBanned ? '/unban' : '/ban');
+                            fetch(url, { method: 'POST', headers: { 'X-CSRF-Token': (window.BetterDesk || {}).csrfToken || '' } })
+                                .then(function () { btn.closest('.widget-qc-row').classList.toggle('banned'); })
+                                .catch(function () {});
+                        }
+                    });
+                });
+            }).catch(function () {});
+        }
+    });
+
+    function _filterQC(body) {
+        var search = (body.querySelector('.widget-qc-search') || {}).value || '';
+        search = search.toLowerCase();
+        var activePill = body.querySelector('.widget-qc-pill.active');
+        var filter = activePill ? activePill.dataset.filter : 'all';
+        body.querySelectorAll('.widget-qc-row').forEach(function (row) {
+            var matchFilter = filter === 'all' || row.dataset.status === filter;
+            var matchSearch = !search || (row.dataset.name || '').indexOf(search) !== -1 || (row.dataset.id || '').toLowerCase().indexOf(search) !== -1;
+            row.style.display = (matchFilter && matchSearch) ? '' : 'none';
+        });
+    }
+
+    // ============ 19. Bandwidth Display ============
+
+    register('bandwidth', {
+        name: t('desktop.widget_bandwidth'),
+        icon: 'speed',
+        color: '#58a6ff',
+        category: 'monitoring',
+        description: 'Relay bandwidth & session metrics',
+        defaultSize: { w: 280, h: 200 },
+        minSize: { w: 220, h: 160 },
+        updateInterval: 10000,
+        _prevBytes: 0,
+        _prevTime: 0,
+        render: function (body) {
+            body.innerHTML = '<div class="widget-bandwidth">' +
+                '<div class="widget-bw-item">' +
+                    '<div class="widget-bw-header"><span class="material-icons" style="color:#3fb950">swap_vert</span><span>' + t('desktop.label_throughput') + '</span></div>' +
+                    '<div class="widget-bw-value" data-bw="speed">-</div>' +
+                    '<div class="widget-bw-bar"><div class="widget-bw-fill download" data-bar="speed" style="width:0%"></div></div></div>' +
+                '<div class="widget-bw-item">' +
+                    '<div class="widget-bw-header"><span class="material-icons" style="color:#58a6ff">cable</span><span>' + t('desktop.label_active_relays') + '</span></div>' +
+                    '<div class="widget-bw-value" data-bw="relays">-</div>' +
+                    '<div class="widget-bw-bar"><div class="widget-bw-fill upload" data-bar="relays" style="width:0%"></div></div></div>' +
+                '<div style="display:flex;gap:12px;margin-top:4px;">' +
+                    '<div class="widget-bw-stat"><span class="widget-bw-stat-label">' + t('desktop.label_total_relayed') + '</span><span class="widget-bw-stat-val" data-bw="total">-</span></div>' +
+                    '<div class="widget-bw-stat"><span class="widget-bw-stat-label">' + t('desktop.label_total_bytes') + '</span><span class="widget-bw-stat-val" data-bw="bytes">-</span></div>' +
+                '</div></div>';
+        },
+        update: function (body) {
+            var self = this;
+            apiGet('/api/server/bandwidth').then(function (data) {
+                if (!data) return;
+                var relays = data.relay_active || 0;
+                var bytes = data.bytes_transferred || 0;
+                var sessions = data.active_sessions || 0;
+                var totalRelayed = data.total_relayed || 0;
+                // Calculate speed (bytes/sec delta)
+                var now = Date.now();
+                var speed = 0;
+                if (self._prevTime && self._prevBytes) {
+                    var dt = (now - self._prevTime) / 1000;
+                    if (dt > 0) speed = Math.max(0, (bytes - self._prevBytes) / dt);
+                }
+                self._prevBytes = bytes;
+                self._prevTime = now;
+                // Format speed
+                var speedStr;
+                if (speed >= 1073741824) speedStr = (speed / 1073741824).toFixed(1) + ' GB/s';
+                else if (speed >= 1048576) speedStr = (speed / 1048576).toFixed(1) + ' MB/s';
+                else if (speed >= 1024) speedStr = (speed / 1024).toFixed(1) + ' KB/s';
+                else speedStr = Math.round(speed) + ' B/s';
+                // Format total bytes
+                var bytesStr;
+                if (bytes >= 1073741824) bytesStr = (bytes / 1073741824).toFixed(1) + ' GB';
+                else if (bytes >= 1048576) bytesStr = (bytes / 1048576).toFixed(1) + ' MB';
+                else if (bytes >= 1024) bytesStr = (bytes / 1024).toFixed(1) + ' KB';
+                else bytesStr = bytes + ' B';
+                // Update DOM
+                var sv = body.querySelector('[data-bw="speed"]');
+                var rv = body.querySelector('[data-bw="relays"]');
+                var tv = body.querySelector('[data-bw="total"]');
+                var bv = body.querySelector('[data-bw="bytes"]');
+                var sb = body.querySelector('[data-bar="speed"]');
+                var rb = body.querySelector('[data-bar="relays"]');
+                if (sv) sv.textContent = speedStr;
+                if (rv) rv.textContent = relays + ' active / ' + sessions + ' sessions';
+                if (tv) tv.textContent = totalRelayed;
+                if (bv) bv.textContent = bytesStr;
+                // Bar: speed capped at 10 MB/s for visual
+                if (sb) sb.style.width = Math.min(100, (speed / 10485760) * 100) + '%';
+                // Bar: relays capped at 50 for visual
+                if (rb) rb.style.width = Math.min(100, (relays / 50) * 100) + '%';
+            }).catch(function () {});
+        }
+    });
+
+    // ============ 20. Connection Stats Table ============
+
+    register('connection-stats', {
+        name: t('desktop.widget_connection_stats'),
+        icon: 'table_chart',
+        color: '#8b949e',
+        category: 'monitoring',
+        description: 'Tabular connection statistics',
+        defaultSize: { w: 380, h: 220 },
+        minSize: { w: 300, h: 160 },
+        updateInterval: 30000,
+        render: function (body) {
+            body.innerHTML = '<div class="widget-stats-table">' +
+                '<div class="widget-stats-header"><span>' + t('desktop.label_metric') + '</span><span>' + t('desktop.label_count') + '</span><span>%</span></div>' +
+                '<div class="widget-stats-body"><div class="widget-loading" style="height:40px"></div></div></div>';
+        },
+        update: function (body) {
+            apiGet('/api/stats').then(function (data) {
+                if (!data || !data.devices) return;
+                var d = data.devices;
+                var tot = d.total || 1;
+                var rows = [
+                    { label: t('desktop.label_total_devices'), count: d.total || 0, pct: '100%' },
+                    { label: t('desktop.label_online'), count: d.online || 0, pct: Math.round(((d.online || 0) / tot) * 100) + '%' },
+                    { label: t('desktop.label_offline'), count: d.offline || 0, pct: Math.round(((d.offline || 0) / tot) * 100) + '%' },
+                    { label: t('desktop.label_banned'), count: d.banned || 0, pct: Math.round(((d.banned || 0) / tot) * 100) + '%' },
+                    { label: t('desktop.label_with_notes'), count: d.withNotes || 0, pct: Math.round(((d.withNotes || 0) / tot) * 100) + '%' }
+                ];
+                var c = body.querySelector('.widget-stats-body');
+                if (!c) return;
+                var html = '';
+                rows.forEach(function (r) {
+                    html += '<div class="widget-stats-row">' +
+                        '<span class="widget-stats-label">' + esc(r.label) + '</span>' +
+                        '<span class="widget-stats-count">' + r.count + '</span>' +
+                        '<span class="widget-stats-pct">' + r.pct + '</span></div>';
+                });
+                c.innerHTML = html;
+            }).catch(function () {});
+        }
+    });
+
+    // ============ Expose ============
+
+    window.WidgetPlugins = {
+        register: register,
+        get: get,
+        list: list
+    };
+
+})();
diff --git a/web-nodejs/routes/bd-api.routes.js b/web-nodejs/routes/bd-api.routes.js
index 03d42b73..5ff62617 100644
--- a/web-nodejs/routes/bd-api.routes.js
+++ b/web-nodejs/routes/bd-api.routes.js
@@ -29,6 +29,15 @@ const router = express.Router();
 const crypto = require('crypto');
 const db = require('../services/database');
 const bdRelay = require('../services/bdRelay');
+const brandingService = require('../services/brandingService');
+const authService = require('../services/authService');
+
+// ---------------------------------------------------------------------------
+//  In-memory help-request store (survives restarts via audit log for history)
+// ---------------------------------------------------------------------------
+
+/** @type {Map<string, Object>} */
+const helpRequests = new Map();
 
 // ---------------------------------------------------------------------------
 //  Helpers
@@ -317,4 +326,270 @@ router.get('/peer/:id', identifyDevice, async (req, res) => {
     }
 });
 
+// ---------------------------------------------------------------------------
+//  GET /api/bd/branding — Public branding for desktop client (no auth)
+// ---------------------------------------------------------------------------
+
+router.get('/branding', (req, res) => {
+    try {
+        const branding = brandingService.getBranding();
+        res.json({
+            company_name: branding.appName || 'BetterDesk',
+            accent_color: branding.colors?.accentBlue || '#3b82f6',
+            support_contact: branding.supportContact || '',
+        });
+    } catch (err) {
+        console.error('[BD-API] Branding error:', err.message);
+        // Return defaults on error — never block the client
+        res.json({
+            company_name: 'BetterDesk',
+            accent_color: '#3b82f6',
+            support_contact: '',
+        });
+    }
+});
+
+// ---------------------------------------------------------------------------
+//  POST /api/bd/help-request — Desktop client requests operator assistance
+// ---------------------------------------------------------------------------
+
+router.post('/help-request', identifyDevice, async (req, res) => {
+    try {
+        const { device_id, hostname, message } = req.body;
+
+        if (!device_id || typeof device_id !== 'string') {
+            return res.status(400).json({ error: 'Missing device_id' });
+        }
+
+        const helpRequest = {
+            id: crypto.randomUUID(),
+            device_id: String(device_id).substring(0, 32),
+            hostname: String(hostname || '').substring(0, 128),
+            message: String(message || '').substring(0, 500),
+            status: 'pending',
+            created_at: Date.now(),
+        };
+
+        // Emit to all connected operator WebSocket clients
+        const io = req.app.get('io');
+        if (io) {
+            io.emit('help-request', helpRequest);
+        }
+
+        // Store in memory for dashboard polling
+        helpRequests.set(helpRequest.id, helpRequest);
+
+        // Auto-prune: keep max 200 entries
+        if (helpRequests.size > 200) {
+            const oldest = [...helpRequests.keys()].slice(0, helpRequests.size - 200);
+            for (const key of oldest) helpRequests.delete(key);
+        }
+
+        // Log the help request
+        await db.logAction(null, 'help_request', `Help requested by ${helpRequest.device_id}: ${helpRequest.message}`, getClientIp(req));
+
+        console.log(`[BD-API] Help request from ${helpRequest.device_id} (${helpRequest.hostname}): ${helpRequest.message}`);
+
+        res.json({ success: true, request_id: helpRequest.id });
+    } catch (err) {
+        console.error('[BD-API] Help request error:', err.message);
+        res.status(500).json({ error: 'Failed to process help request' });
+    }
+});
+
+// ===========================================================================
+//  Operator Authentication (desktop client operator mode)
+// ===========================================================================
+
+// ---------------------------------------------------------------------------
+//  POST /api/bd/operator/login — Authenticate operator from desktop client
+// ---------------------------------------------------------------------------
+
+router.post('/operator/login', async (req, res) => {
+    try {
+        const ip = getClientIp(req);
+        const { username, password, device_id } = req.body;
+
+        if (!username || typeof username !== 'string' || !password || typeof password !== 'string') {
+            return res.status(400).json({ error: 'Username and password are required' });
+        }
+
+        // Brute-force protection
+        const blocked = await authService.checkBruteForce(username, ip);
+        if (blocked) {
+            return res.status(429).json({ error: 'Too many failed attempts. Try again later.' });
+        }
+
+        // Authenticate
+        const user = await authService.authenticate(username, password);
+        if (!user) {
+            authService.recordAttempt(username, ip, false);
+            return res.status(401).json({ error: 'Invalid credentials' });
+        }
+
+        // Only admin and operator roles can use operator mode
+        if (user.role !== 'admin' && user.role !== 'operator') {
+            authService.recordAttempt(username, ip, false);
+            return res.status(403).json({ error: 'Insufficient permissions. Admin or operator role required.' });
+        }
+
+        // Issue access token
+        authService.recordAttempt(username, ip, true);
+        const token = await authService.generateAccessToken(
+            user.id,
+            String(device_id || '').substring(0, 32),
+            '',
+            ip
+        );
+        await db.updateLastLogin(user.id);
+
+        await db.logAction(user.id, 'operator_login', `Operator login from desktop client (${device_id || 'unknown'})`, ip);
+
+        res.json({
+            access_token: token,
+            user: {
+                name: user.username || user.name || username,
+                role: user.role,
+            },
+        });
+    } catch (err) {
+        console.error('[BD-API] Operator login error:', err.message);
+        res.status(500).json({ error: 'Authentication failed' });
+    }
+});
+
+// ---------------------------------------------------------------------------
+//  GET /api/bd/operator/devices — List all devices (requires operator auth)
+// ---------------------------------------------------------------------------
+
+router.get('/operator/devices', requireDeviceAuth, async (req, res) => {
+    try {
+        // Only admin/operator can list devices
+        if (req.deviceUser && req.deviceUser.role !== 'admin' && req.deviceUser.role !== 'operator') {
+            return res.status(403).json({ error: 'Insufficient permissions' });
+        }
+
+        const peers = await db.getAllPeers({});
+        const devices = peers.map((p) => {
+            let hostname = '';
+            let platform = '';
+            try {
+                const info = typeof p.info === 'string' ? JSON.parse(p.info) : (p.info || {});
+                hostname = info.hostname || p.note || '';
+                platform = info.os || info.platform || '';
+            } catch (_) {
+                hostname = p.note || '';
+            }
+            return {
+                id: p.id,
+                hostname: hostname,
+                platform: platform,
+                online: !!(p.status_online || p.online),
+                last_online: p.last_online || '',
+            };
+        });
+
+        res.json({ success: true, devices });
+    } catch (err) {
+        console.error('[BD-API] Operator devices error:', err.message);
+        res.status(500).json({ error: 'Failed to fetch devices' });
+    }
+});
+
+// ===========================================================================
+//  Help Request Management (web panel operators)
+// ===========================================================================
+
+// ---------------------------------------------------------------------------
+//  GET /api/bd/help-requests — List all help requests (requires auth)
+// ---------------------------------------------------------------------------
+
+router.get('/help-requests', requireDeviceAuth, async (req, res) => {
+    try {
+        const items = [...helpRequests.values()]
+            .sort((a, b) => b.created_at - a.created_at);
+
+        res.json({ success: true, requests: items });
+    } catch (err) {
+        console.error('[BD-API] List help requests error:', err.message);
+        res.status(500).json({ error: 'Failed to list help requests' });
+    }
+});
+
+// ---------------------------------------------------------------------------
+//  POST /api/bd/help-requests/:id/accept — Accept a help request
+// ---------------------------------------------------------------------------
+
+router.post('/help-requests/:id/accept', requireDeviceAuth, async (req, res) => {
+    try {
+        const entry = helpRequests.get(req.params.id);
+        if (!entry) {
+            return res.status(404).json({ error: 'Help request not found' });
+        }
+
+        entry.status = 'accepted';
+        entry.accepted_by = req.deviceUser?.username || 'operator';
+        entry.accepted_at = Date.now();
+
+        await db.logAction(
+            req.deviceUser?.id || null,
+            'help_request_accept',
+            `Accepted help request ${entry.id} from ${entry.device_id}`,
+            getClientIp(req)
+        );
+
+        res.json({ success: true, request: entry });
+    } catch (err) {
+        console.error('[BD-API] Accept help request error:', err.message);
+        res.status(500).json({ error: 'Failed to accept help request' });
+    }
+});
+
+// ---------------------------------------------------------------------------
+//  POST /api/bd/help-requests/:id/resolve — Resolve a help request
+// ---------------------------------------------------------------------------
+
+router.post('/help-requests/:id/resolve', requireDeviceAuth, async (req, res) => {
+    try {
+        const entry = helpRequests.get(req.params.id);
+        if (!entry) {
+            return res.status(404).json({ error: 'Help request not found' });
+        }
+
+        entry.status = 'resolved';
+        entry.resolved_by = req.deviceUser?.username || 'operator';
+        entry.resolved_at = Date.now();
+
+        await db.logAction(
+            req.deviceUser?.id || null,
+            'help_request_resolve',
+            `Resolved help request ${entry.id} from ${entry.device_id}`,
+            getClientIp(req)
+        );
+
+        res.json({ success: true, request: entry });
+    } catch (err) {
+        console.error('[BD-API] Resolve help request error:', err.message);
+        res.status(500).json({ error: 'Failed to resolve help request' });
+    }
+});
+
+// ---------------------------------------------------------------------------
+//  DELETE /api/bd/help-requests/:id — Delete a help request
+// ---------------------------------------------------------------------------
+
+router.delete('/help-requests/:id', requireDeviceAuth, async (req, res) => {
+    try {
+        if (!helpRequests.has(req.params.id)) {
+            return res.status(404).json({ error: 'Help request not found' });
+        }
+
+        helpRequests.delete(req.params.id);
+        res.json({ success: true });
+    } catch (err) {
+        console.error('[BD-API] Delete help request error:', err.message);
+        res.status(500).json({ error: 'Failed to delete help request' });
+    }
+});
+
 module.exports = router;
diff --git a/web-nodejs/routes/cdap.routes.js b/web-nodejs/routes/cdap.routes.js
index 047ec749..93c2347e 100644
--- a/web-nodejs/routes/cdap.routes.js
+++ b/web-nodejs/routes/cdap.routes.js
@@ -11,26 +11,51 @@ const betterdeskApi = require('../services/betterdeskApi');
 
 // ── Page Routes ──────────────────────────────────────────────────────────
 
+/**
+ * CDAP devices list page
+ * GET /cdap
+ */
+router.get('/cdap', requireAuth, (req, res) => {
+    res.render('cdap-devices', {
+        title: req.t('cdap.devices_title'),
+        activePage: 'cdap',
+        currentPage: 'cdap'
+    });
+});
+
+/**
+ * CDAP devices list page (alternative path, used by desktop embed)
+ * GET /cdap/devices
+ */
+router.get('/cdap/devices', requireAuth, (req, res) => {
+    res.render('cdap-devices', {
+        title: req.t('cdap.devices_title'),
+        activePage: 'cdap',
+        currentPage: 'cdap'
+    });
+});
+
 /**
  * CDAP device detail page with widget panel
  * GET /cdap/devices/:id
  */
-router.get('/cdap/devices/:id', requireAuth, async (req, res) => {
-    try {
-        const { id } = req.params;
-        res.render('cdap-device', {
-            title: req.__('cdap.device_detail'),
-            activePage: 'devices',
-            deviceId: id
-        });
-    } catch (err) {
-        console.error('CDAP device page error:', err.message);
-        res.redirect('/devices');
-    }
+router.get('/cdap/devices/:id', requireAuth, (req, res) => {
+    const { id } = req.params;
+    res.render('cdap-device', {
+        title: req.t('cdap.device_detail'),
+        activePage: 'devices',
+        deviceId: id
+    });
 });
 
 // ── API Routes ───────────────────────────────────────────────────────────
 
+// Unwrap the { success, data } envelope returned by betterdeskApi helpers
+// so that the CDAP frontend receives the flat Go server response it expects.
+function unwrap(result) {
+    return (result && result.success && result.data) ? result.data : result;
+}
+
 /**
  * GET /api/cdap/status
  * Returns CDAP gateway status (enabled, connections, port)
@@ -38,9 +63,9 @@ router.get('/cdap/devices/:id', requireAuth, async (req, res) => {
 router.get('/api/cdap/status', requireAuth, async (req, res) => {
     try {
         const result = await betterdeskApi.getCDAPStatus();
-        res.json(result);
+        res.json(unwrap(result));
     } catch (err) {
-        res.status(500).json({ success: false, error: 'Failed to get CDAP status' });
+        res.status(500).json({ enabled: false, error: 'Failed to get CDAP status' });
     }
 });
 
@@ -51,9 +76,9 @@ router.get('/api/cdap/status', requireAuth, async (req, res) => {
 router.get('/api/cdap/devices', requireAuth, async (req, res) => {
     try {
         const result = await betterdeskApi.getCDAPDevices();
-        res.json(result);
+        res.json(unwrap(result));
     } catch (err) {
-        res.status(500).json({ success: false, error: 'Failed to list CDAP devices' });
+        res.status(500).json({ devices: [], error: 'Failed to list CDAP devices' });
     }
 });
 
@@ -64,9 +89,9 @@ router.get('/api/cdap/devices', requireAuth, async (req, res) => {
 router.get('/api/cdap/devices/:id', requireAuth, async (req, res) => {
     try {
         const result = await betterdeskApi.getCDAPDeviceInfo(req.params.id);
-        res.json(result);
+        res.json(unwrap(result));
     } catch (err) {
-        res.status(500).json({ success: false, error: 'Failed to get CDAP device info' });
+        res.status(500).json({ error: 'Failed to get CDAP device info' });
     }
 });
 
@@ -77,9 +102,9 @@ router.get('/api/cdap/devices/:id', requireAuth, async (req, res) => {
 router.get('/api/cdap/devices/:id/manifest', requireAuth, async (req, res) => {
     try {
         const result = await betterdeskApi.getCDAPDeviceManifest(req.params.id);
-        res.json(result);
+        res.json(unwrap(result));
     } catch (err) {
-        res.status(500).json({ success: false, error: 'Failed to get CDAP device manifest' });
+        res.status(500).json({ error: 'Failed to get CDAP device manifest' });
     }
 });
 
@@ -90,9 +115,9 @@ router.get('/api/cdap/devices/:id/manifest', requireAuth, async (req, res) => {
 router.get('/api/cdap/devices/:id/state', requireAuth, async (req, res) => {
     try {
         const result = await betterdeskApi.getCDAPDeviceState(req.params.id);
-        res.json(result);
+        res.json(unwrap(result));
     } catch (err) {
-        res.status(500).json({ success: false, error: 'Failed to get CDAP device state' });
+        res.status(500).json({ error: 'Failed to get CDAP device state' });
     }
 });
 
@@ -106,7 +131,7 @@ router.post('/api/cdap/devices/:id/command', requireAuth, requireRole('operator'
         const { widget_id, action, value, reason } = req.body;
 
         if (!widget_id || !action) {
-            return res.status(400).json({ success: false, error: 'widget_id and action are required' });
+            return res.status(400).json({ error: 'widget_id and action are required' });
         }
 
         const result = await betterdeskApi.sendCDAPCommand(
@@ -116,9 +141,73 @@ router.post('/api/cdap/devices/:id/command', requireAuth, requireRole('operator'
             value,
             reason
         );
-        res.json(result);
+        res.json(unwrap(result));
     } catch (err) {
-        res.status(500).json({ success: false, error: 'Failed to send command' });
+        res.status(500).json({ error: 'Failed to send command' });
+    }
+});
+
+/**
+ * POST /api/cdap/toggle
+ * Enable or disable CDAP gateway (saves config; requires server restart)
+ * Body: { enabled: true|false }
+ */
+router.post('/api/cdap/toggle', requireAuth, requireRole('admin'), async (req, res) => {
+    try {
+        const { enabled } = req.body;
+        if (typeof enabled !== 'boolean') {
+            return res.status(400).json({ success: false, error: 'enabled must be a boolean' });
+        }
+        await betterdeskApi.setConfig('cdap_enabled', enabled ? 'Y' : 'N');
+        res.json({ success: true, enabled, restart_required: true });
+    } catch (err) {
+        console.error('[CDAP] Toggle error:', err.message);
+        res.status(500).json({ success: false, error: 'Failed to toggle CDAP' });
+    }
+});
+
+/**
+ * GET /api/cdap/alerts
+ * Returns all currently firing CDAP alerts
+ * Query: ?device_id=optional (filter by device)
+ */
+router.get('/api/cdap/alerts', requireAuth, async (req, res) => {
+    try {
+        const result = await betterdeskApi.getCDAPAlerts(req.query.device_id);
+        res.json(unwrap(result));
+    } catch (err) {
+        res.status(500).json({ alerts: [], total: 0, error: 'Failed to get CDAP alerts' });
+    }
+});
+
+/**
+ * GET /api/cdap/devices/:id/linked
+ * Returns all peers linked to this CDAP device
+ */
+router.get('/api/cdap/devices/:id/linked', requireAuth, async (req, res) => {
+    try {
+        const result = await betterdeskApi.getLinkedPeers(req.params.id);
+        res.json(unwrap(result));
+    } catch (err) {
+        res.status(500).json({ error: 'Failed to get linked devices' });
+    }
+});
+
+/**
+ * POST /api/cdap/devices/:id/link
+ * Link or unlink a peer to this CDAP device
+ * Body: { linked_peer_id: "PEERID" } or { linked_peer_id: "" } to unlink
+ */
+router.post('/api/cdap/devices/:id/link', requireAuth, requireRole('admin'), async (req, res) => {
+    try {
+        const { linked_peer_id } = req.body;
+        if (linked_peer_id === undefined) {
+            return res.status(400).json({ error: 'linked_peer_id is required' });
+        }
+        const result = await betterdeskApi.linkDevice(req.params.id, linked_peer_id);
+        res.json(unwrap(result));
+    } catch (err) {
+        res.status(500).json({ error: 'Failed to link device' });
     }
 });
 
diff --git a/web-nodejs/routes/dashboard.routes.js b/web-nodejs/routes/dashboard.routes.js
index c70dc99e..82b4e874 100644
--- a/web-nodejs/routes/dashboard.routes.js
+++ b/web-nodejs/routes/dashboard.routes.js
@@ -115,6 +115,7 @@ router.get('/api/server/status', requireAuth, async (req, res) => {
             success: true,
             data: {
                 backend: isBD ? 'betterdesk' : 'rustdesk',
+                uptime: Math.floor(process.uptime()),
                 // Main status indicators
                 hbbs: apiRunning ? { status: 'running' } : { status: 'stopped' },
                 hbbr: relayStatus,
@@ -139,6 +140,33 @@ router.get('/api/server/status', requireAuth, async (req, res) => {
     }
 });
 
+/**
+ * GET /api/server/bandwidth - Get relay/bandwidth metrics from Go server
+ */
+router.get('/api/server/bandwidth', requireAuth, async (req, res) => {
+    try {
+        const betterdeskApi = require('../services/betterdeskApi');
+        const stats = await betterdeskApi.getServerStats();
+        if (!stats || !stats.success) {
+            return res.json({ success: true, data: { relay_active: 0, total_relayed: 0, bytes_transferred: 0, active_sessions: 0, throttle_hits: 0 } });
+        }
+        const d = stats.data || {};
+        res.json({
+            success: true,
+            data: {
+                relay_active: d.relay_active_sessions || 0,
+                total_relayed: d.relay_total_relayed || 0,
+                bytes_transferred: d.bandwidth_bytes_transferred || 0,
+                active_sessions: d.bandwidth_active_sessions || 0,
+                throttle_hits: d.bandwidth_throttle_hits || 0
+            }
+        });
+    } catch (err) {
+        console.error('Bandwidth stats error:', err);
+        res.json({ success: true, data: { relay_active: 0, total_relayed: 0, bytes_transferred: 0, active_sessions: 0, throttle_hits: 0 } });
+    }
+});
+
 /**
  * POST /api/sync-status - Sync online status from HBBS API
  */
diff --git a/web-nodejs/routes/dataguard.routes.js b/web-nodejs/routes/dataguard.routes.js
index 22800364..0cc593ee 100644
--- a/web-nodejs/routes/dataguard.routes.js
+++ b/web-nodejs/routes/dataguard.routes.js
@@ -105,7 +105,7 @@ router.get('/policies/:id', requireSession, async (req, res) => {
  */
 router.post('/policies', requireAdmin, async (req, res) => {
     try {
-        const { name, description, enabled, rules } = req.body;
+        const { name, description, policy_type, action, scope, enabled, rules } = req.body;
         if (!name || typeof name !== 'string' || !name.trim()) {
             return res.status(400).json({ error: 'Policy name is required' });
         }
@@ -114,7 +114,7 @@ router.post('/policies', requireAdmin, async (req, res) => {
             return res.status(400).json({ error: 'rules must be an array' });
         }
         const db = getAdapter();
-        const policy = await db.createDlpPolicy({ name: name.trim(), description, enabled, rules });
+        const policy = await db.createDlpPolicy({ name: name.trim(), description, policy_type, action, scope, enabled, rules });
         if (policy) {
             policy.rules = typeof policy.rules === 'string' ? JSON.parse(policy.rules) : (policy.rules || []);
         }
@@ -135,11 +135,11 @@ router.patch('/policies/:id', requireAdmin, async (req, res) => {
         const existing = await db.getDlpPolicyById(id);
         if (!existing) return res.status(404).json({ error: 'Policy not found' });
 
-        const { name, description, enabled, rules } = req.body;
+        const { name, description, policy_type, action, scope, enabled, rules } = req.body;
         if (rules !== undefined && !Array.isArray(rules)) {
             return res.status(400).json({ error: 'rules must be an array' });
         }
-        const updated = await db.updateDlpPolicy(id, { name, description, enabled, rules });
+        const updated = await db.updateDlpPolicy(id, { name, description, policy_type, action, scope, enabled, rules });
         if (updated) {
             updated.rules = typeof updated.rules === 'string' ? JSON.parse(updated.rules) : (updated.rules || []);
         }
diff --git a/web-nodejs/routes/desktop.routes.js b/web-nodejs/routes/desktop.routes.js
new file mode 100644
index 00000000..195d5509
--- /dev/null
+++ b/web-nodejs/routes/desktop.routes.js
@@ -0,0 +1,118 @@
+/**
+ * BetterDesk Console - Desktop Widget Layout Routes
+ * Persists per-user widget layouts and wallpaper selection server-side.
+ */
+
+const express = require('express');
+const router = express.Router();
+const db = require('../services/database');
+const { requireAuth } = require('../middleware/auth');
+const path = require('path');
+const fs = require('fs');
+
+/* ── Key helpers ────────────────────────────────────────────── */
+
+const LAYOUT_KEY_PREFIX = 'desktop_layout_';
+const WALLPAPER_KEY_PREFIX = 'desktop_wallpaper_';
+
+function layoutKey(userId) { return LAYOUT_KEY_PREFIX + userId; }
+function wallpaperKey(userId) { return WALLPAPER_KEY_PREFIX + userId; }
+
+/* ── Maximum payload size (512 KB) ──────────────────────────── */
+const MAX_LAYOUT_SIZE = 512 * 1024;
+
+/* ── Validation ─────────────────────────────────────────────── */
+
+function isValidWidgetArray(arr) {
+    if (!Array.isArray(arr)) return false;
+    if (arr.length > 100) return false; // max 100 widgets
+    for (const w of arr) {
+        if (!w || typeof w !== 'object') return false;
+        if (typeof w.id !== 'string' || w.id.length > 40) return false;
+        if (typeof w.type !== 'string' || w.type.length > 60) return false;
+        if (typeof w.x !== 'number' || typeof w.y !== 'number') return false;
+        if (typeof w.w !== 'number' || typeof w.h !== 'number') return false;
+    }
+    return true;
+}
+
+function isValidWallpaperPath(p) {
+    if (typeof p !== 'string') return false;
+    if (p.length > 100) return false;
+    // Only allow /wallpapers/<number>.png or empty
+    return /^\/wallpapers\/\d{1,4}\.png$/.test(p) || p === '';
+}
+
+/* ── POST /layout — Save widget layout ──────────────────────── */
+
+router.post('/layout', requireAuth, async (req, res) => {
+    try {
+        const userId = req.session.userId;
+        const { widgets, wallpaper } = req.body;
+
+        if (widgets !== undefined && !isValidWidgetArray(widgets)) {
+            return res.status(400).json({ success: false, error: 'Invalid widget layout' });
+        }
+
+        const payload = JSON.stringify(widgets || []);
+        if (payload.length > MAX_LAYOUT_SIZE) {
+            return res.status(413).json({ success: false, error: 'Layout too large' });
+        }
+
+        await db.setSetting(layoutKey(userId), payload);
+
+        if (wallpaper !== undefined) {
+            if (!isValidWallpaperPath(wallpaper)) {
+                return res.status(400).json({ success: false, error: 'Invalid wallpaper path' });
+            }
+            await db.setSetting(wallpaperKey(userId), wallpaper);
+        }
+
+        res.json({ success: true });
+    } catch (err) {
+        console.error('[Desktop] Save layout error:', err.message);
+        res.status(500).json({ success: false, error: 'Failed to save layout' });
+    }
+});
+
+/* ── GET /layout — Load widget layout ───────────────────────── */
+
+router.get('/layout', requireAuth, async (req, res) => {
+    try {
+        const userId = req.session.userId;
+        const layoutRaw = await db.getSetting(layoutKey(userId));
+        const wallpaper = await db.getSetting(wallpaperKey(userId));
+
+        let widgets = [];
+        if (layoutRaw) {
+            try { widgets = JSON.parse(layoutRaw); } catch (_) { /* corrupt — return empty */ }
+        }
+
+        res.json({ success: true, data: { widgets, wallpaper: wallpaper || '' } });
+    } catch (err) {
+        console.error('[Desktop] Load layout error:', err.message);
+        res.status(500).json({ success: false, error: 'Failed to load layout' });
+    }
+});
+
+/* ── GET /wallpapers — List available wallpapers ────────────── */
+
+router.get('/wallpapers', requireAuth, (req, res) => {
+    try {
+        const dir = path.join(__dirname, '..', 'wallpapers');
+        if (!fs.existsSync(dir)) {
+            return res.json({ success: true, data: [] });
+        }
+        const files = fs.readdirSync(dir)
+            .filter(f => /^\d+\.png$/i.test(f))
+            .sort((a, b) => parseInt(a) - parseInt(b))
+            .map(f => '/wallpapers/' + f);
+
+        res.json({ success: true, data: files });
+    } catch (err) {
+        console.error('[Desktop] List wallpapers error:', err.message);
+        res.status(500).json({ success: false, error: 'Failed to list wallpapers' });
+    }
+});
+
+module.exports = router;
diff --git a/web-nodejs/routes/index.js b/web-nodejs/routes/index.js
index ae741258..732d6133 100644
--- a/web-nodejs/routes/index.js
+++ b/web-nodejs/routes/index.js
@@ -16,7 +16,7 @@ const i18nRoutes = require('./i18n.routes');
 const usersRoutes = require('./users.routes');
 const foldersRoutes = require('./folders.routes');
 const remoteRoutes = require('./remote.routes');
-const bdApiRoutes = require('./bd-api.routes');
+// bdApiRoutes mounted in server.js (before CSRF) for desktop client access
 const inventoryRoutes = require('./inventory.routes');
 const ticketsRoutes = require('./tickets.routes');
 const activityRoutes = require('./activity.routes');
@@ -28,6 +28,9 @@ const reportsRoutes = require('./reports.routes');
 const tenantsRoutes = require('./tenants.routes');
 const registrationRoutes = require('./registration.routes');
 const cdapRoutes = require('./cdap.routes');
+const tokensRoutes = require('./tokens.routes');
+const pagesRoutes = require('./pages.routes');
+const desktopRoutes = require('./desktop.routes');
 
 /**
  * Middleware to require JSON Content-Type for POST/PATCH/PUT requests to API routes.
@@ -75,7 +78,7 @@ router.use('/', usersRoutes);
 router.use('/', foldersRoutes);
 router.use('/', remoteRoutes);
 router.use('/api/i18n', i18nRoutes);
-router.use('/api/bd', bdApiRoutes);
+// bdApiRoutes now mounted in server.js (before CSRF) for desktop client access
 router.use('/api/bd', inventoryRoutes);     // device-facing: /api/bd/inventory, /api/bd/telemetry
 router.use('/api/inventory', inventoryRoutes); // admin-facing: /api/inventory, /api/inventory/:id
 router.use('/api/tickets', ticketsRoutes);      // admin-facing: /api/tickets CRUD
@@ -93,6 +96,9 @@ router.use('/api/reports', reportsRoutes);       // admin-facing: /api/reports/*
 router.use('/api/tenants', tenantsRoutes);       // admin-facing: /api/tenants/*
 router.use('/', registrationRoutes);               // admin-facing: /registrations, /api/registrations/*
 router.use('/api/bd', registrationRoutes);          // device-facing: /api/bd/register-request, /api/bd/register-status
+router.use('/', pagesRoutes);                          // page routes: /inventory, /tickets, /automation, etc.
 router.use('/', cdapRoutes);                            // admin-facing: /cdap/devices/:id, /api/cdap/*
+router.use('/', tokensRoutes);                          // admin-facing: /tokens, /api/panel/tokens/*
+router.use('/api/desktop', desktopRoutes);               // admin-facing: /api/desktop/layout, /api/desktop/wallpapers
 
 module.exports = router;
diff --git a/web-nodejs/routes/inventory.routes.js b/web-nodejs/routes/inventory.routes.js
index 1f23ddde..7ca1435d 100644
--- a/web-nodejs/routes/inventory.routes.js
+++ b/web-nodejs/routes/inventory.routes.js
@@ -22,6 +22,7 @@ const express = require('express');
 const router = express.Router();
 const db = require('../services/database');
 const { getAdapter } = require('../services/dbAdapter');
+const betterdeskApi = require('../services/betterdeskApi');
 
 // ---------------------------------------------------------------------------
 //  Helpers (shared with bd-api.routes.js)
@@ -197,28 +198,55 @@ router.get('/', requireAdmin, async (req, res) => {
         const inventories = await adapter.getAllInventories();
         const devices = [];
 
-        for (const inv of inventories) {
-            const telemetry = await adapter.getTelemetry(inv.device_id);
-            devices.push({
-                device_id: inv.device_id,
-                hostname: inv.hardware?.hostname || inv.device_id,
-                os: `${inv.hardware?.os_name || ''} ${inv.hardware?.os_version || ''}`.trim(),
-                cpu: inv.hardware?.cpu?.brand || 'Unknown',
-                cpu_cores: inv.hardware?.cpu?.logical_cores || 0,
-                cpu_usage: telemetry?.cpu_usage_percent ?? inv.hardware?.cpu?.usage_percent ?? null,
-                memory_total_mb: inv.hardware?.memory?.total_bytes
-                    ? Math.round(inv.hardware.memory.total_bytes / 1048576)
-                    : 0,
-                memory_used_mb: telemetry?.memory_used_bytes
-                    ? Math.round(telemetry.memory_used_bytes / 1048576)
-                    : inv.hardware?.memory?.used_bytes
-                        ? Math.round(inv.hardware.memory.used_bytes / 1048576)
+        if (inventories.length > 0) {
+            for (const inv of inventories) {
+                const telemetry = await adapter.getTelemetry(inv.device_id);
+                devices.push({
+                    device_id: inv.device_id,
+                    hostname: inv.hardware?.hostname || inv.device_id,
+                    os: `${inv.hardware?.os_name || ''} ${inv.hardware?.os_version || ''}`.trim(),
+                    cpu: inv.hardware?.cpu?.brand || 'Unknown',
+                    cpu_cores: inv.hardware?.cpu?.logical_cores || 0,
+                    cpu_usage: telemetry?.cpu_usage_percent ?? inv.hardware?.cpu?.usage_percent ?? null,
+                    memory_total_mb: inv.hardware?.memory?.total_bytes
+                        ? Math.round(inv.hardware.memory.total_bytes / 1048576)
                         : 0,
-                disk_count: inv.hardware?.disks?.length || 0,
-                software_count: inv.software?.apps?.length || 0,
-                last_seen: telemetry?.received_at || inv.received_at,
-                collected_at: inv.collected_at,
-            });
+                    memory_used_mb: telemetry?.memory_used_bytes
+                        ? Math.round(telemetry.memory_used_bytes / 1048576)
+                        : inv.hardware?.memory?.used_bytes
+                            ? Math.round(inv.hardware.memory.used_bytes / 1048576)
+                            : 0,
+                    disk_count: inv.hardware?.disks?.length || 0,
+                    software_count: inv.software?.apps?.length || 0,
+                    last_seen: telemetry?.received_at || inv.received_at,
+                    collected_at: inv.collected_at,
+                });
+            }
+        } else {
+            // Fallback: populate from Go server peer list when no agent inventory exists
+            try {
+                const peers = await betterdeskApi.getAllPeers();
+                const peerList = Array.isArray(peers) ? peers : (peers?.data || []);
+                for (const p of peerList) {
+                    devices.push({
+                        device_id: p.id,
+                        hostname: p.hostname || p.id,
+                        os: p.platform || p.os || '',
+                        cpu: '',
+                        cpu_cores: 0,
+                        cpu_usage: null,
+                        memory_total_mb: 0,
+                        memory_used_mb: 0,
+                        disk_count: 0,
+                        software_count: 0,
+                        last_seen: p.last_online || null,
+                        collected_at: null,
+                        source: 'peer_list',
+                    });
+                }
+            } catch (fallbackErr) {
+                console.warn('[Inventory] Peer list fallback failed:', fallbackErr.message);
+            }
         }
 
         res.json({ devices, total: devices.length });
diff --git a/web-nodejs/routes/network.routes.js b/web-nodejs/routes/network.routes.js
index 33d5958d..dbc58960 100644
--- a/web-nodejs/routes/network.routes.js
+++ b/web-nodejs/routes/network.routes.js
@@ -37,13 +37,15 @@
 const express = require('express');
 const router = express.Router();
 const { NetworkMonitor, pingHost, checkTcpPort, checkHttp, resolveHost } = require('../services/networkMonitor');
+const { getAdapter } = require('../services/dbAdapter');
 
 // Monitor instance (initialized lazily)
 let monitor = null;
 
-function getMonitor(req) {
-    if (!monitor && req.app.locals.dbAdapter) {
-        monitor = new NetworkMonitor(req.app.locals.dbAdapter);
+function getMonitor() {
+    if (!monitor) {
+        const adapter = getAdapter();
+        if (adapter) monitor = new NetworkMonitor(adapter);
     }
     return monitor;
 }
@@ -71,8 +73,8 @@ const VALID_CHECK_TYPES = ['ping', 'tcp', 'http', 'https'];
 router.get('/targets', requireAdmin, async (req, res) => {
     try {
         const { enabled, check_type } = req.query;
-        const db = req.app.locals.dbAdapter;
-        const targets = await db.getNetworkTargets({
+        const adapter = getAdapter();
+        const targets = await adapter.getNetworkTargets({
             enabled: enabled !== undefined ? enabled === 'true' : undefined,
             check_type,
         });
@@ -99,7 +101,7 @@ router.post('/targets', requireAdmin, async (req, res) => {
             return res.status(400).json({ error: 'host or url is required' });
         }
 
-        const target = await req.app.locals.dbAdapter.createNetworkTarget({
+        const target = await getAdapter().createNetworkTarget({
             name,
             host: host || '',
             port: parseInt(port, 10) || null,
@@ -121,7 +123,7 @@ router.post('/targets', requireAdmin, async (req, res) => {
  */
 router.get('/targets/:id', requireAdmin, async (req, res) => {
     try {
-        const target = await req.app.locals.dbAdapter.getNetworkTargetById(req.params.id);
+        const target = await getAdapter().getNetworkTargetById(req.params.id);
         if (!target) {
             return res.status(404).json({ error: 'Target not found' });
         }
@@ -151,7 +153,7 @@ router.patch('/targets/:id', requireAdmin, async (req, res) => {
         if (interval_ms !== undefined) updates.interval_ms = parseInt(interval_ms, 10);
         if (enabled !== undefined) updates.enabled = enabled;
 
-        const target = await req.app.locals.dbAdapter.updateNetworkTarget(req.params.id, updates);
+        const target = await getAdapter().updateNetworkTarget(req.params.id, updates);
         if (!target) {
             return res.status(404).json({ error: 'Target not found' });
         }
@@ -166,7 +168,7 @@ router.patch('/targets/:id', requireAdmin, async (req, res) => {
  */
 router.delete('/targets/:id', requireAdmin, async (req, res) => {
     try {
-        const ok = await req.app.locals.dbAdapter.deleteNetworkTarget(req.params.id);
+        const ok = await getAdapter().deleteNetworkTarget(req.params.id);
         if (!ok) {
             return res.status(404).json({ error: 'Target not found' });
         }
@@ -185,12 +187,12 @@ router.delete('/targets/:id', requireAdmin, async (req, res) => {
  */
 router.post('/targets/:id/check', requireAdmin, async (req, res) => {
     try {
-        const target = await req.app.locals.dbAdapter.getNetworkTargetById(req.params.id);
+        const target = await getAdapter().getNetworkTargetById(req.params.id);
         if (!target) {
             return res.status(404).json({ error: 'Target not found' });
         }
 
-        const m = getMonitor(req);
+        const m = getMonitor();
         if (!m) {
             return res.status(503).json({ error: 'Monitor not available' });
         }
@@ -208,7 +210,7 @@ router.post('/targets/:id/check', requireAdmin, async (req, res) => {
 router.get('/targets/:id/history', requireAdmin, async (req, res) => {
     try {
         const { limit, from, to } = req.query;
-        const history = await req.app.locals.dbAdapter.getNetworkCheckHistory(req.params.id, {
+        const history = await getAdapter().getNetworkCheckHistory(req.params.id, {
             limit: parseInt(limit, 10) || 100,
             from,
             to,
@@ -224,13 +226,15 @@ router.get('/targets/:id/history', requireAdmin, async (req, res) => {
  */
 router.get('/stats', requireAdmin, async (req, res) => {
     try {
-        const targets = await req.app.locals.dbAdapter.getNetworkTargets({});
+        const targets = await getAdapter().getNetworkTargets({});
         const total = targets.length;
         const up = targets.filter(t => t.last_status === 'up').length;
         const down = targets.filter(t => t.last_status === 'down').length;
         const unknown = total - up - down;
+        const latencies = targets.filter(t => t.last_latency_ms != null).map(t => t.last_latency_ms);
+        const avg_latency = latencies.length > 0 ? latencies.reduce((a, b) => a + b, 0) / latencies.length : null;
 
-        res.json({ total, up, down, unknown });
+        res.json({ total, up, down, unknown, avg_latency });
     } catch (err) {
         res.status(500).json({ error: err.message });
     }
@@ -304,7 +308,7 @@ router.post('/resolve', requireAdmin, async (req, res) => {
  * POST /api/network/monitor/start
  */
 router.post('/monitor/start', requireAdmin, (req, res) => {
-    const m = getMonitor(req);
+    const m = getMonitor();
     if (!m) return res.status(503).json({ error: 'Monitor not available' });
     const interval = parseInt(req.body.interval_ms, 10) || undefined;
     m.start(interval);
@@ -315,7 +319,7 @@ router.post('/monitor/start', requireAdmin, (req, res) => {
  * POST /api/network/monitor/stop
  */
 router.post('/monitor/stop', requireAdmin, (req, res) => {
-    const m = getMonitor(req);
+    const m = getMonitor();
     if (!m) return res.status(503).json({ error: 'Monitor not available' });
     m.stop();
     res.json({ status: 'stopped' });
@@ -325,7 +329,7 @@ router.post('/monitor/stop', requireAdmin, (req, res) => {
  * GET /api/network/monitor/status
  */
 router.get('/monitor/status', requireAdmin, (req, res) => {
-    const m = getMonitor(req);
+    const m = getMonitor();
     res.json({
         running: m ? m.running : false,
         interval_ms: m ? m.pollInterval : null,
diff --git a/web-nodejs/routes/pages.routes.js b/web-nodejs/routes/pages.routes.js
new file mode 100644
index 00000000..f932fbbb
--- /dev/null
+++ b/web-nodejs/routes/pages.routes.js
@@ -0,0 +1,96 @@
+/**
+ * BetterDesk Console — Page Render Routes
+ *
+ * Serves HTML pages for management modules. API endpoints are in separate route files.
+ *
+ * @module routes/pages.routes
+ */
+
+'use strict';
+
+const express = require('express');
+const router = express.Router();
+const { requireAuth, requireRole } = require('../middleware/auth');
+
+// ── Inventory ──
+
+router.get('/inventory', requireAuth, (req, res) => {
+    res.render('inventory', {
+        title: req.t('inventory.title'),
+        activePage: 'inventory',
+    });
+});
+
+// ── Tickets (Helpdesk) ──
+
+router.get('/tickets', requireAuth, (req, res) => {
+    res.render('tickets', {
+        title: req.t('tickets.title'),
+        activePage: 'tickets',
+    });
+});
+
+// ── Automation (Alerts + Remote Commands) ──
+
+router.get('/automation', requireAuth, (req, res) => {
+    res.render('automation', {
+        title: req.t('automation.title'),
+        activePage: 'automation',
+    });
+});
+
+// ── Network Monitoring ──
+
+router.get('/network', requireAuth, (req, res) => {
+    res.render('network', {
+        title: req.t('network.title'),
+        activePage: 'network',
+    });
+});
+
+// ── Activity Monitoring ──
+
+router.get('/activity', requireAuth, (req, res) => {
+    res.render('activity', {
+        title: req.t('activity.title'),
+        activePage: 'activity',
+    });
+});
+
+// ── Reports ──
+
+router.get('/reports', requireAuth, (req, res) => {
+    res.render('reports', {
+        title: req.t('reports.title'),
+        activePage: 'reports',
+    });
+});
+
+// ── DataGuard (DLP) — admin only ──
+
+router.get('/dataguard', requireAuth, requireRole('admin'), (req, res) => {
+    res.render('dataguard', {
+        title: req.t('dataguard.title'),
+        activePage: 'dataguard',
+    });
+});
+
+// ── Tenants — admin only ──
+
+router.get('/tenants', requireAuth, requireRole('admin'), (req, res) => {
+    res.render('tenants', {
+        title: req.t('tenants.title'),
+        activePage: 'tenants',
+    });
+});
+
+// ── Help Requests — operators and admins ──
+
+router.get('/help-requests', requireAuth, (req, res) => {
+    res.render('help-requests', {
+        title: req.t('help_request.title'),
+        activePage: 'help-requests',
+    });
+});
+
+module.exports = router;
diff --git a/web-nodejs/routes/registration.routes.js b/web-nodejs/routes/registration.routes.js
index 112f47fe..e6bd32c8 100644
--- a/web-nodejs/routes/registration.routes.js
+++ b/web-nodejs/routes/registration.routes.js
@@ -28,6 +28,7 @@ const fs = require('fs');
 const db = require('../services/database');
 const config = require('../config/config');
 const { requireAuth, requireRole } = require('../middleware/auth');
+const betterdeskApi = require('../services/betterdeskApi');
 
 // ---------------------------------------------------------------------------
 //  Helpers
@@ -325,4 +326,75 @@ router.delete('/api/registrations/:id', requireAuth, requireRole('admin'), async
     }
 });
 
+// ===========================================================================
+//  Go Server Enrollment Proxy — pending devices managed by Go server
+// ===========================================================================
+
+/**
+ * GET /api/enrollment/pending — List pending enrollment requests from Go server.
+ */
+router.get('/api/enrollment/pending', requireAuth, requireRole('operator'), async (req, res) => {
+    try {
+        const result = await betterdeskApi.getEnrollmentPending();
+        res.json(result);
+    } catch (err) {
+        console.error('Get enrollment pending error:', err);
+        res.status(500).json({ success: false, error: req.t('errors.server_error') });
+    }
+});
+
+/**
+ * POST /api/enrollment/approve/:id — Approve a pending enrollment on Go server.
+ * Body: { display_name, sync_mode }
+ */
+router.post('/api/enrollment/approve/:id', requireAuth, requireRole('operator'), async (req, res) => {
+    try {
+        const deviceId = req.params.id;
+        const { display_name, sync_mode } = req.body;
+        const result = await betterdeskApi.approveEnrollment(deviceId, display_name, sync_mode);
+
+        if (result.success) {
+            try {
+                await db.logAction(
+                    req.session?.user?.id || 0,
+                    'enrollment_approved',
+                    `Approved enrollment for device ${deviceId} (mode: ${sync_mode || 'standard'})`,
+                    getClientIp(req)
+                );
+            } catch (_) { /* audit log optional */ }
+        }
+
+        res.json(result);
+    } catch (err) {
+        console.error('Approve enrollment error:', err);
+        res.status(500).json({ success: false, error: req.t('errors.server_error') });
+    }
+});
+
+/**
+ * POST /api/enrollment/reject/:id — Reject a pending enrollment on Go server.
+ */
+router.post('/api/enrollment/reject/:id', requireAuth, requireRole('operator'), async (req, res) => {
+    try {
+        const deviceId = req.params.id;
+        const result = await betterdeskApi.rejectEnrollment(deviceId);
+
+        if (result.success) {
+            try {
+                await db.logAction(
+                    req.session?.user?.id || 0,
+                    'enrollment_rejected',
+                    `Rejected enrollment for device ${deviceId}`,
+                    getClientIp(req)
+                );
+            } catch (_) { /* audit log optional */ }
+        }
+
+        res.json(result);
+    } catch (err) {
+        console.error('Reject enrollment error:', err);
+        res.status(500).json({ success: false, error: req.t('errors.server_error') });
+    }
+});
+
 module.exports = router;
diff --git a/web-nodejs/routes/rustdesk-api.routes.js b/web-nodejs/routes/rustdesk-api.routes.js
index 55860433..b8f27b76 100644
--- a/web-nodejs/routes/rustdesk-api.routes.js
+++ b/web-nodejs/routes/rustdesk-api.routes.js
@@ -1081,8 +1081,20 @@ router.post('/api/audit/conn', async (req, res) => {
  * GET /api/audit/conn
  * Query connection audit events.
  * Query params: host_id, peer_id, action, limit, offset
+ * Supports both Bearer token (RustDesk client) and session cookie (panel).
  */
-router.get('/api/audit/conn', requireAuth, async (req, res) => {
+router.get('/api/audit/conn', async (req, res) => {
+    // Check Bearer token first, then session cookie
+    const token = extractBearerToken(req);
+    if (token) {
+        const user = await authService.validateAccessToken(token);
+        if (!user) return res.status(401).json({ error: 'Invalid or expired token' });
+        req.authUser = user;
+    } else if (req.session && req.session.userId) {
+        // Session-based panel auth — allowed
+    } else {
+        return res.status(401).json({ error: 'Authorization required' });
+    }
     try {
         const filters = {
             host_id: req.query.host_id || '',
diff --git a/web-nodejs/routes/tokens.routes.js b/web-nodejs/routes/tokens.routes.js
new file mode 100644
index 00000000..fc11b040
--- /dev/null
+++ b/web-nodejs/routes/tokens.routes.js
@@ -0,0 +1,104 @@
+/**
+ * BetterDesk Console - Device Token Routes
+ * Proxy routes for Go server device token management API.
+ */
+
+const express = require('express');
+const router = express.Router();
+const { requireAuth, requireRole } = require('../middleware/auth');
+const betterdeskApi = require('../services/betterdeskApi');
+
+// ── Page Route ───────────────────────────────────────────────────────────
+
+router.get('/tokens', requireAuth, requireRole('admin'), (req, res) => {
+    res.render('tokens', {
+        title: req.t('tokens.title'),
+        activePage: 'tokens',
+        currentPage: 'tokens'
+    });
+});
+
+// ── API Proxy Routes ─────────────────────────────────────────────────────
+
+// List all tokens
+router.get('/api/panel/tokens', requireAuth, requireRole('admin'), async (req, res) => {
+    try {
+        const includeRevoked = req.query.include_revoked === 'true';
+        const result = await betterdeskApi.listDeviceTokens(includeRevoked);
+        res.json(result);
+    } catch (err) {
+        res.status(500).json({ success: false, error: 'Failed to list tokens' });
+    }
+});
+
+// Create token
+router.post('/api/panel/tokens', requireAuth, requireRole('admin'), async (req, res) => {
+    try {
+        const result = await betterdeskApi.createDeviceToken(req.body);
+        res.json(result);
+    } catch (err) {
+        res.status(500).json({ success: false, error: 'Failed to create token' });
+    }
+});
+
+// Bulk generate tokens
+router.post('/api/panel/tokens/generate-bulk', requireAuth, requireRole('admin'), async (req, res) => {
+    try {
+        const result = await betterdeskApi.bulkGenerateTokens(req.body);
+        res.json(result);
+    } catch (err) {
+        res.status(500).json({ success: false, error: 'Failed to generate tokens' });
+    }
+});
+
+// Update token
+router.put('/api/panel/tokens/:id', requireAuth, requireRole('admin'), async (req, res) => {
+    try {
+        const result = await betterdeskApi.updateDeviceToken(req.params.id, req.body);
+        res.json(result);
+    } catch (err) {
+        res.status(500).json({ success: false, error: 'Failed to update token' });
+    }
+});
+
+// Revoke token
+router.delete('/api/panel/tokens/:id', requireAuth, requireRole('admin'), async (req, res) => {
+    try {
+        const result = await betterdeskApi.revokeDeviceToken(req.params.id);
+        res.json(result);
+    } catch (err) {
+        res.status(500).json({ success: false, error: 'Failed to revoke token' });
+    }
+});
+
+// Bind token to peer
+router.post('/api/panel/tokens/:id/bind', requireAuth, requireRole('admin'), async (req, res) => {
+    try {
+        const result = await betterdeskApi.bindTokenToPeer(req.params.id, req.body.peer_id);
+        res.json(result);
+    } catch (err) {
+        res.status(500).json({ success: false, error: 'Failed to bind token' });
+    }
+});
+
+// Get enrollment mode
+router.get('/api/panel/enrollment/mode', requireAuth, requireRole('admin'), async (req, res) => {
+    try {
+        const result = await betterdeskApi.getEnrollmentMode();
+        res.json(result);
+    } catch (err) {
+        res.status(500).json({ success: false, error: 'Failed to get enrollment mode' });
+    }
+});
+
+// Set enrollment mode
+router.put('/api/panel/enrollment/mode', requireAuth, requireRole('admin'), async (req, res) => {
+    try {
+        const result = await betterdeskApi.setEnrollmentMode(req.body.mode);
+        res.json(result);
+    } catch (err) {
+        res.status(500).json({ success: false, error: 'Failed to set enrollment mode' });
+    }
+});
+
+module.exports = router;
diff --git a/web-nodejs/server.js b/web-nodejs/server.js
index 83212c78..f091dca9 100644
--- a/web-nodejs/server.js
+++ b/web-nodejs/server.js
@@ -27,9 +27,12 @@ const { initWsProxy } = require('./services/wsRelay');
 const { initBdRelay } = require('./services/bdRelay');
 const { initChatRelay } = require('./services/chatRelay');
 const { initRemoteRelay } = require('./services/remoteRelay');
+const { initCdapTerminalProxy } = require('./services/cdapTerminalProxy');
+const { initCdapMediaProxies } = require('./services/cdapMediaProxy');
 const { startDiscoveryService } = require('./services/lanDiscovery');
 const routes = require('./routes');
 const rustdeskApiRoutes = require('./routes/rustdesk-api.routes');
+const bdApiRoutes = require('./routes/bd-api.routes');
 const { getWanMiddlewareStack } = require('./middleware/wanSecurity');
 
 // Create Express app
@@ -78,9 +81,13 @@ const sessionMiddleware = session({
 });
 app.use(sessionMiddleware);
 
+// Cache version — changes on every restart/deployment, stable during runtime.
+// Used in ?v= query strings so browsers cache assets per deployment.
+app.locals.cacheVersion = config.appVersion + '.' + Date.now();
+
 // Static files
 app.use(express.static(path.join(__dirname, 'public'), {
-    maxAge: config.isProduction ? '1d' : '0',
+    maxAge: config.isProduction ? '7d' : '0',
     etag: true
 }));
 
@@ -90,6 +97,13 @@ app.use('/protos', express.static(path.join(__dirname, 'protos'), {
     etag: true
 }));
 
+// Serve desktop wallpapers
+app.use('/wallpapers', express.static(path.join(__dirname, 'wallpapers'), {
+    maxAge: config.isProduction ? '30d' : '0',
+    etag: true,
+    immutable: true
+}));
+
 // Rate limiting for API
 app.use('/api/', apiLimiter);
 
@@ -98,6 +112,10 @@ app.use('/api/', apiLimiter);
 // dedicated WAN-facing port (21121) with additional hardening.
 app.use(rustdeskApiRoutes);
 
+// BetterDesk Desktop Client API — device-facing endpoints that use
+// Bearer token or X-Device-Id header, not browser CSRF cookies.
+app.use('/api/bd', bdApiRoutes);
+
 // i18n middleware
 app.use(initI18n());
 
@@ -105,12 +123,23 @@ app.use(initI18n());
 // Used by Desktop Mode to load pages inside floating windows (iframes)
 app.use((req, res, next) => {
     res.locals.embed = req.query.embed === '1';
+    // Prevent HTML page caching — only static assets should be cached
+    if (!req.path.match(/\.(js|css|png|jpg|jpeg|gif|svg|ico|woff2?|ttf|eot|map|proto)$/)) {
+        res.set('Cache-Control', 'no-cache, no-store, must-revalidate');
+    }
     next();
 });
 
 // CSRF protection — generate token for views, validate on POST/PUT/DELETE/PATCH
+// Skip CSRF for device-facing API routes (/api/bd/*) — these use Bearer token
+// or X-Device-Id header authentication, not browser cookie-based CSRF.
 app.use(csrfTokenProvider);
-app.use(doubleCsrfProtection);
+app.use((req, res, next) => {
+    if (req.path.startsWith('/api/bd/')) {
+        return next();
+    }
+    doubleCsrfProtection(req, res, next);
+});
 
 // ============ Routes ============
 
@@ -304,6 +333,12 @@ async function startServer() {
         // Initialize Remote Desktop relay (WebSocket — agent JPEG ↔ browser viewer)
         initRemoteRelay(server, sessionMiddleware);
 
+        // Initialize CDAP Terminal WebSocket proxy (browser ↔ Go server)
+        initCdapTerminalProxy(server, sessionMiddleware);
+
+        // Initialize CDAP Media WebSocket proxies (desktop, video, file browser)
+        initCdapMediaProxies(server, sessionMiddleware);
+
         // Start LAN Discovery UDP service
         startDiscoveryService();
         
@@ -498,6 +533,28 @@ function printStartupBanner(protocol, port) {
     console.log('  ║                                                  ║');
     console.log('  ╚══════════════════════════════════════════════════╝');
     console.log('');
+
+    // BD-2026-006: Warn if panel is bound to all interfaces in non-Docker environments
+    if (config.host === '0.0.0.0' && !config.isDocker) {
+        console.log('  ⚠️  WARNING [SECURITY]: Panel bound to 0.0.0.0 (all interfaces).');
+        console.log('     Set HOST=127.0.0.1 in .env to restrict to localhost only.');
+        console.log('');
+    }
+
+    // BD-2026-008: Warn if plaintext credentials file exists
+    const credFile = path.join(config.keysPath, '.admin_credentials');
+    if (fs.existsSync(credFile)) {
+        console.log('  ⚠️  WARNING [SECURITY]: Plaintext .admin_credentials file detected.');
+        console.log('     Delete it after noting the password: ' + credFile);
+        console.log('');
+    }
+
+    // BD-2026-009: Warn when proxy trust is enabled
+    if (trustProxy && trustProxy !== false && trustProxy !== 0) {
+        console.log('  ⚠️  NOTICE [SECURITY]: TRUST_PROXY is enabled (' + trustProxy + ').');
+        console.log('     Ensure a trusted reverse proxy sets X-Forwarded-For correctly.');
+        console.log('');
+    }
 }
 
 // Start the server
diff --git a/web-nodejs/services/betterdeskApi.js b/web-nodejs/services/betterdeskApi.js
index da9544fb..0b58eba9 100644
--- a/web-nodejs/services/betterdeskApi.js
+++ b/web-nodejs/services/betterdeskApi.js
@@ -21,7 +21,7 @@ const apiClient = axios.create({
         'Content-Type': 'application/json',
         'X-API-Key': config.betterdeskApiKey
     },
-    httpsAgent: new https.Agent({ rejectUnauthorized: false })
+    httpsAgent: new https.Agent({ rejectUnauthorized: !config.allowSelfSignedCerts })
 });
 
 // Retry once on 401 by reloading API key from file (handles race condition
@@ -486,6 +486,218 @@ async function sendCDAPCommand(id, widgetId, action, value, reason) {
     }
 }
 
+async function getCDAPAlerts(deviceId) {
+    try {
+        const params = deviceId ? { device_id: deviceId } : {};
+        const { data } = await apiClient.get('/cdap/alerts', { params });
+        return wrap(data);
+    } catch (e) {
+        return { success: false, error: e.message, alerts: [], total: 0 };
+    }
+}
+
+async function getLinkedPeers(id) {
+    try {
+        const { data } = await apiClient.get(`/peers/${encodeURIComponent(id)}/linked`);
+        return wrap(data);
+    } catch (e) {
+        return { success: false, error: e.message, linked: [], total: 0 };
+    }
+}
+
+async function linkDevice(id, linkedPeerId) {
+    try {
+        const { data } = await apiClient.patch(`/peers/${encodeURIComponent(id)}`, {
+            linked_peer_id: linkedPeerId || ''
+        });
+        return wrap(data);
+    } catch (e) {
+        return { success: false, error: e.message };
+    }
+}
+
+// ========================== Device Tokens ====================================
+
+/**
+ * GET /api/tokens
+ */
+async function listDeviceTokens(includeRevoked) {
+    try {
+        const params = includeRevoked ? { include_revoked: 'true' } : {};
+        const { data } = await apiClient.get('/tokens', { params });
+        return wrap(data);
+    } catch (e) {
+        return { success: false, error: e.message };
+    }
+}
+
+/**
+ * POST /api/tokens
+ */
+async function createDeviceToken(body) {
+    try {
+        const { data } = await apiClient.post('/tokens', body);
+        return wrap(data);
+    } catch (e) {
+        return { success: false, error: e.message };
+    }
+}
+
+/**
+ * GET /api/tokens/:id
+ */
+async function getDeviceToken(id) {
+    try {
+        const { data } = await apiClient.get(`/tokens/${id}`);
+        return wrap(data);
+    } catch (e) {
+        return { success: false, error: e.message };
+    }
+}
+
+/**
+ * PUT /api/tokens/:id
+ */
+async function updateDeviceToken(id, body) {
+    try {
+        const { data } = await apiClient.put(`/tokens/${id}`, body);
+        return wrap(data);
+    } catch (e) {
+        return { success: false, error: e.message };
+    }
+}
+
+/**
+ * DELETE /api/tokens/:id
+ */
+async function revokeDeviceToken(id) {
+    try {
+        const { data } = await apiClient.delete(`/tokens/${id}`);
+        return wrap(data);
+    } catch (e) {
+        return { success: false, error: e.message };
+    }
+}
+
+/**
+ * POST /api/tokens/generate-bulk
+ */
+async function bulkGenerateTokens(body) {
+    try {
+        const { data } = await apiClient.post('/tokens/generate-bulk', body);
+        return wrap(data);
+    } catch (e) {
+        return { success: false, error: e.message };
+    }
+}
+
+/**
+ * POST /api/tokens/:id/bind
+ */
+async function bindTokenToPeer(id, peerId) {
+    try {
+        const { data } = await apiClient.post(`/tokens/${id}/bind`, { peer_id: peerId });
+        return wrap(data);
+    } catch (e) {
+        return { success: false, error: e.message };
+    }
+}
+
+/**
+ * GET /api/enrollment/mode
+ */
+async function getEnrollmentMode() {
+    try {
+        const { data } = await apiClient.get('/enrollment/mode');
+        return wrap(data);
+    } catch (e) {
+        return { success: false, error: e.message };
+    }
+}
+
+/**
+ * PUT /api/enrollment/mode
+ */
+async function setEnrollmentMode(mode) {
+    try {
+        const { data } = await apiClient.put('/enrollment/mode', { mode });
+        return wrap(data);
+    } catch (e) {
+        return { success: false, error: e.message };
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Enrollment — pending device management (proxied from Go server)
+// ---------------------------------------------------------------------------
+
+/**
+ * Get list of pending enrollment requests from Go server.
+ */
+async function getEnrollmentPending() {
+    try {
+        const { data } = await apiClient.get('/enrollment/pending');
+        return { success: true, data: data.devices || [], count: data.count || 0 };
+    } catch (e) {
+        return { success: false, error: e.message, data: [], count: 0 };
+    }
+}
+
+/**
+ * Approve a pending enrollment request on Go server.
+ * @param {string} deviceId - Device ID to approve
+ * @param {string} displayName - Operator-assigned display name
+ * @param {string} syncMode - Sync mode: silent, standard, turbo
+ */
+async function approveEnrollment(deviceId, displayName, syncMode) {
+    try {
+        const { data } = await apiClient.post(`/enrollment/approve/${encodeURIComponent(deviceId)}`, {
+            display_name: displayName || '',
+            sync_mode: syncMode || 'standard'
+        });
+        return wrap(data);
+    } catch (e) {
+        return { success: false, error: e.message };
+    }
+}
+
+/**
+ * Reject a pending enrollment request on Go server.
+ * @param {string} deviceId - Device ID to reject
+ */
+async function rejectEnrollment(deviceId) {
+    try {
+        const { data } = await apiClient.post(`/enrollment/reject/${encodeURIComponent(deviceId)}`);
+        return wrap(data);
+    } catch (e) {
+        return { success: false, error: e.message };
+    }
+}
+
+/**
+ * Get branding configuration from Go server (public endpoint).
+ */
+async function getBranding() {
+    try {
+        const { data } = await apiClient.get('/branding');
+        return { success: true, data };
+    } catch (e) {
+        return { success: false, error: e.message };
+    }
+}
+
+/**
+ * Save branding configuration to Go server.
+ */
+async function saveBranding(brandingData) {
+    try {
+        const { data } = await apiClient.post('/branding', brandingData);
+        return wrap(data);
+    } catch (e) {
+        return { success: false, error: e.message };
+    }
+}
+
 module.exports = {
     // Health / Stats
     getHealth,
@@ -525,6 +737,26 @@ module.exports = {
     getCDAPDeviceManifest,
     getCDAPDeviceState,
     sendCDAPCommand,
+    getCDAPAlerts,
+    getLinkedPeers,
+    linkDevice,
+    // Device Tokens
+    listDeviceTokens,
+    createDeviceToken,
+    getDeviceToken,
+    updateDeviceToken,
+    revokeDeviceToken,
+    bulkGenerateTokens,
+    bindTokenToPeer,
+    getEnrollmentMode,
+    setEnrollmentMode,
+    // Enrollment — pending devices
+    getEnrollmentPending,
+    approveEnrollment,
+    rejectEnrollment,
+    // Branding (Go server)
+    getBranding: getBranding,
+    saveBranding: saveBranding,
     // Helpers
     normalisePeer
 };
diff --git a/web-nodejs/services/cdapMediaProxy.js b/web-nodejs/services/cdapMediaProxy.js
new file mode 100644
index 00000000..936a2014
--- /dev/null
+++ b/web-nodejs/services/cdapMediaProxy.js
@@ -0,0 +1,165 @@
+/**
+ * BetterDesk Console — CDAP Media WebSocket Proxy
+ * Proxies desktop/video/file-browser WebSocket connections from the
+ * browser to the Go server's CDAP endpoints.
+ *
+ * Browser  ←WS→  Node.js (:5000)  ←WS→  Go API (:21114)
+ */
+
+const WebSocket = require('ws');
+const config = require('../config/config');
+
+/**
+ * Create a CDAP media proxy for a specific channel type.
+ * @param {import('http').Server} server
+ * @param {Function} sessionMiddleware
+ * @param {object} opts
+ * @param {string} opts.channel     - URL segment: desktop, video, files
+ * @param {string} opts.subprotocol - WebSocket subprotocol name
+ * @param {string} opts.minRole     - Minimum required role: admin, operator, viewer
+ * @param {string} opts.label       - Log label
+ */
+function createCdapMediaProxy(server, sessionMiddleware, opts) {
+    const { channel, subprotocol, minRole, label } = opts;
+
+    const pattern = new RegExp(
+        `^\\/api\\/cdap\\/devices\\/([A-Za-z0-9_-]{1,64})\\/${channel}$`
+    );
+
+    const roleLevel = { admin: 3, operator: 2, viewer: 1 };
+
+    const wss = new WebSocket.Server({ noServer: true });
+
+    server.on('upgrade', (req, socket, head) => {
+        const url = new URL(req.url, `http://${req.headers.host}`);
+        const match = url.pathname.match(pattern);
+        if (!match) return;
+
+        const deviceId = match[1];
+
+        sessionMiddleware(req, {}, () => {
+            if (!req.session || !req.session.userId) {
+                socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+                socket.destroy();
+                return;
+            }
+
+            const userLevel = roleLevel[req.session.role] || 0;
+            const requiredLevel = roleLevel[minRole] || 3;
+            if (userLevel < requiredLevel) {
+                socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+                socket.destroy();
+                return;
+            }
+
+            wss.handleUpgrade(req, socket, head, (ws) => {
+                wss.emit('connection', ws, req, deviceId);
+            });
+        });
+    });
+
+    wss.on('connection', (browserWs, req, deviceId) => {
+        const username = req.session?.username || 'admin';
+        console.log(`[CDAP ${label}] Proxy started for device ${deviceId} by ${username}`);
+
+        const goApiBase = config.betterdeskApiUrl || 'http://localhost:21114/api';
+        const goWsUrl = goApiBase
+            .replace(/^http/, 'ws')
+            .replace(/\/api\/?$/, '') +
+            `/api/cdap/devices/${encodeURIComponent(deviceId)}/${channel}`;
+
+        const goWs = new WebSocket(goWsUrl, [subprotocol], {
+            headers: {
+                'X-API-Key': config.betterdeskApiKey || '',
+                'X-Username': username,
+                'X-Role': req.session?.role || 'admin'
+            },
+            rejectUnauthorized: !config.allowSelfSignedCerts
+        });
+
+        let goConnected = false;
+
+        goWs.on('open', () => { goConnected = true; });
+
+        browserWs.on('message', (data) => {
+            if (goConnected && goWs.readyState === WebSocket.OPEN) {
+                goWs.send(data);
+            }
+        });
+
+        goWs.on('message', (data) => {
+            if (browserWs.readyState === WebSocket.OPEN) {
+                browserWs.send(data);
+            }
+        });
+
+        browserWs.on('close', () => {
+            console.log(`[CDAP ${label}] Browser disconnected for device ${deviceId}`);
+            if (goWs.readyState === WebSocket.OPEN || goWs.readyState === WebSocket.CONNECTING) {
+                goWs.close();
+            }
+        });
+
+        goWs.on('close', () => {
+            if (browserWs.readyState === WebSocket.OPEN) {
+                browserWs.close();
+            }
+        });
+
+        goWs.on('error', (err) => {
+            console.error(`[CDAP ${label}] Go WS error for ${deviceId}:`, err.message);
+            if (browserWs.readyState === WebSocket.OPEN) {
+                browserWs.send(JSON.stringify({ type: 'error', error: 'Server connection failed' }));
+                browserWs.close();
+            }
+        });
+
+        browserWs.on('error', (err) => {
+            console.error(`[CDAP ${label}] Browser WS error for ${deviceId}:`, err.message);
+            if (goWs.readyState === WebSocket.OPEN) {
+                goWs.close();
+            }
+        });
+    });
+
+    return wss;
+}
+
+/**
+ * Initialize all CDAP media WebSocket proxies (desktop, video, file browser).
+ * @param {import('http').Server} server
+ * @param {Function} sessionMiddleware
+ */
+function initCdapMediaProxies(server, sessionMiddleware) {
+    createCdapMediaProxy(server, sessionMiddleware, {
+        channel: 'desktop',
+        subprotocol: 'cdap-desktop',
+        minRole: 'admin',
+        label: 'Desktop'
+    });
+
+    createCdapMediaProxy(server, sessionMiddleware, {
+        channel: 'video',
+        subprotocol: 'cdap-video',
+        minRole: 'operator',
+        label: 'Video'
+    });
+
+    createCdapMediaProxy(server, sessionMiddleware, {
+        channel: 'files',
+        subprotocol: 'cdap-filebrowser',
+        minRole: 'admin',
+        label: 'FileBrowser'
+    });
+
+    createCdapMediaProxy(server, sessionMiddleware, {
+        channel: 'audio',
+        subprotocol: 'cdap-audio',
+        minRole: 'operator',
+        label: 'Audio'
+    });
+
+    console.log('[CDAP Media] WebSocket proxies initialized (desktop, video, files, audio)');
+}
+
+module.exports = { initCdapMediaProxies };
diff --git a/web-nodejs/services/cdapTerminalProxy.js b/web-nodejs/services/cdapTerminalProxy.js
new file mode 100644
index 00000000..0bef79ec
--- /dev/null
+++ b/web-nodejs/services/cdapTerminalProxy.js
@@ -0,0 +1,128 @@
+/**
+ * BetterDesk Console — CDAP Terminal WebSocket Proxy
+ * Proxies terminal WebSocket connections from the browser to the Go server's
+ * CDAP terminal endpoint.  Authenticates via session cookie.
+ *
+ * Browser  ←WS→  Node.js (:5000)  ←WS→  Go API (:21114)
+ *    /api/cdap/devices/:id/terminal  →  /api/cdap/devices/:id/terminal
+ */
+
+const WebSocket = require('ws');
+const config = require('../config/config');
+
+/**
+ * Initialize the CDAP terminal WebSocket proxy and attach to HTTP server.
+ * @param {import('http').Server} server
+ * @param {Function} sessionMiddleware - Express session middleware for auth
+ */
+function initCdapTerminalProxy(server, sessionMiddleware) {
+    const wss = new WebSocket.Server({ noServer: true });
+
+    server.on('upgrade', (req, socket, head) => {
+        const url = new URL(req.url, `http://${req.headers.host}`);
+        const pathname = url.pathname;
+
+        // Match /api/cdap/devices/:id/terminal
+        const match = pathname.match(/^\/api\/cdap\/devices\/([A-Za-z0-9_-]{6,30})\/terminal$/);
+        if (!match) return; // Let other upgrade handlers deal with it
+
+        const deviceId = match[1];
+
+        // Require session authentication
+        sessionMiddleware(req, {}, () => {
+            if (!req.session || !req.session.userId) {
+                socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
+                socket.destroy();
+                return;
+            }
+
+            // RBAC: only admin users can access terminal
+            if (req.session.role !== 'admin') {
+                socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+                socket.destroy();
+                return;
+            }
+
+            wss.handleUpgrade(req, socket, head, (ws) => {
+                wss.emit('connection', ws, req, deviceId);
+            });
+        });
+    });
+
+    wss.on('connection', (browserWs, req, deviceId) => {
+        const username = req.session?.username || 'admin';
+        console.log(`[CDAP Terminal] Proxy session started for device ${deviceId} by ${username}`);
+
+        // Build Go server WebSocket URL
+        const goApiBase = config.betterdeskApiUrl || 'http://localhost:21114/api';
+        const goWsUrl = goApiBase
+            .replace(/^http/, 'ws')
+            .replace(/\/api\/?$/, '') +
+            `/api/cdap/devices/${encodeURIComponent(deviceId)}/terminal`;
+
+        // Connect to Go server terminal endpoint
+        const goWs = new WebSocket(goWsUrl, ['cdap-terminal'], {
+            headers: {
+                'X-API-Key': config.betterdeskApiKey || '',
+                'X-Username': username,
+                'X-Role': req.session?.role || 'admin'
+            },
+            // Allow self-signed certs for local Go server
+            rejectUnauthorized: !config.allowSelfSignedCerts
+        });
+
+        let goConnected = false;
+
+        goWs.on('open', () => {
+            goConnected = true;
+        });
+
+        // Relay: Browser → Go
+        browserWs.on('message', (data) => {
+            if (goConnected && goWs.readyState === WebSocket.OPEN) {
+                goWs.send(data);
+            }
+        });
+
+        // Relay: Go → Browser
+        goWs.on('message', (data) => {
+            if (browserWs.readyState === WebSocket.OPEN) {
+                browserWs.send(data);
+            }
+        });
+
+        // Handle disconnection
+        browserWs.on('close', () => {
+            console.log(`[CDAP Terminal] Browser disconnected for device ${deviceId}`);
+            if (goWs.readyState === WebSocket.OPEN || goWs.readyState === WebSocket.CONNECTING) {
+                goWs.close();
+            }
+        });
+
+        goWs.on('close', () => {
+            if (browserWs.readyState === WebSocket.OPEN) {
+                browserWs.close();
+            }
+        });
+
+        goWs.on('error', (err) => {
+            console.error(`[CDAP Terminal] Go server WS error for ${deviceId}:`, err.message);
+            if (browserWs.readyState === WebSocket.OPEN) {
+                browserWs.send(JSON.stringify({ type: 'error', error: 'Server connection failed' }));
+                browserWs.close();
+            }
+        });
+
+        browserWs.on('error', (err) => {
+            console.error(`[CDAP Terminal] Browser WS error for ${deviceId}:`, err.message);
+            if (goWs.readyState === WebSocket.OPEN) {
+                goWs.close();
+            }
+        });
+    });
+
+    console.log('[CDAP Terminal] WebSocket proxy initialized (/api/cdap/devices/:id/terminal)');
+    return wss;
+}
+
+module.exports = { initCdapTerminalProxy };
diff --git a/web-nodejs/services/dbAdapter.js b/web-nodejs/services/dbAdapter.js
index 1c7b813e..37c3b20e 100644
--- a/web-nodejs/services/dbAdapter.js
+++ b/web-nodejs/services/dbAdapter.js
@@ -635,6 +635,9 @@ function createSqliteAdapter(config) {
                 id INTEGER PRIMARY KEY AUTOINCREMENT,
                 name TEXT NOT NULL,
                 description TEXT DEFAULT '',
+                policy_type TEXT DEFAULT '',
+                action TEXT DEFAULT 'log',
+                scope TEXT DEFAULT '',
                 enabled INTEGER DEFAULT 1,
                 rules TEXT DEFAULT '[]',
                 created_at DATETIME DEFAULT (datetime('now')),
@@ -656,6 +659,13 @@ function createSqliteAdapter(config) {
             CREATE INDEX IF NOT EXISTS idx_dlp_events_time ON dlp_events (created_at);
             CREATE INDEX IF NOT EXISTS idx_dlp_events_source ON dlp_events (event_source);
         `);
+        // Migrate existing tables: add new columns if missing
+        try {
+            const cols = db.prepare("PRAGMA table_info(dlp_policies)").all().map(c => c.name);
+            if (!cols.includes('policy_type')) db.exec("ALTER TABLE dlp_policies ADD COLUMN policy_type TEXT DEFAULT ''");
+            if (!cols.includes('action')) db.exec("ALTER TABLE dlp_policies ADD COLUMN action TEXT DEFAULT 'log'");
+            if (!cols.includes('scope')) db.exec("ALTER TABLE dlp_policies ADD COLUMN scope TEXT DEFAULT ''");
+        } catch (_) { /* table may not exist yet */ }
     }
 
     // -- Saved reports table -----------------------------------------------
@@ -1700,11 +1710,14 @@ function createSqliteAdapter(config) {
         },
         async createDlpPolicy(data) {
             const r = openMain().prepare(`
-                INSERT INTO dlp_policies (name, description, enabled, rules)
-                VALUES (?, ?, ?, ?)
+                INSERT INTO dlp_policies (name, description, policy_type, action, scope, enabled, rules)
+                VALUES (?, ?, ?, ?, ?, ?, ?)
             `).run(
                 data.name,
                 data.description || '',
+                data.policy_type || '',
+                data.action || 'log',
+                data.scope || '',
                 data.enabled !== undefined ? (data.enabled ? 1 : 0) : 1,
                 typeof data.rules === 'string' ? data.rules : JSON.stringify(data.rules || [])
             );
@@ -1715,6 +1728,9 @@ function createSqliteAdapter(config) {
             const params = [];
             if (data.name !== undefined) { sets.push('name = ?'); params.push(data.name); }
             if (data.description !== undefined) { sets.push('description = ?'); params.push(data.description); }
+            if (data.policy_type !== undefined) { sets.push('policy_type = ?'); params.push(data.policy_type); }
+            if (data.action !== undefined) { sets.push('action = ?'); params.push(data.action); }
+            if (data.scope !== undefined) { sets.push('scope = ?'); params.push(data.scope); }
             if (data.enabled !== undefined) { sets.push('enabled = ?'); params.push(data.enabled ? 1 : 0); }
             if (data.rules !== undefined) {
                 sets.push('rules = ?');
@@ -2741,12 +2757,21 @@ function createPostgresAdapter() {
                 id SERIAL PRIMARY KEY,
                 name TEXT NOT NULL,
                 description TEXT DEFAULT '',
+                policy_type TEXT DEFAULT '',
+                action TEXT DEFAULT 'log',
+                scope TEXT DEFAULT '',
                 enabled BOOLEAN DEFAULT TRUE,
                 rules JSONB DEFAULT '[]',
                 created_at TIMESTAMPTZ DEFAULT NOW(),
                 updated_at TIMESTAMPTZ DEFAULT NOW()
             )
         `);
+        // Migrate existing tables: add new columns if missing
+        const dlpCols = await all("SELECT column_name FROM information_schema.columns WHERE table_name = 'dlp_policies'");
+        const dlpColNames = dlpCols.map(c => c.column_name);
+        if (!dlpColNames.includes('policy_type')) await q("ALTER TABLE dlp_policies ADD COLUMN policy_type TEXT DEFAULT ''");
+        if (!dlpColNames.includes('action')) await q("ALTER TABLE dlp_policies ADD COLUMN action TEXT DEFAULT 'log'");
+        if (!dlpColNames.includes('scope')) await q("ALTER TABLE dlp_policies ADD COLUMN scope TEXT DEFAULT ''");
 
         await q(`
             CREATE TABLE IF NOT EXISTS dlp_events (
@@ -3200,11 +3225,11 @@ function createPostgresAdapter() {
         async upsertPeer({ id, uuid, pk, info, ip }) {
             await q(`
                 INSERT INTO peer (id, uuid, pk, info, ip, status_online, created_at)
-                VALUES ($1, $2, $3, $4, $5, TRUE, NOW())
+                VALUES ($1, $2, $3, $4::jsonb, $5, TRUE, NOW())
                 ON CONFLICT(id) DO UPDATE SET
                     uuid = COALESCE(NULLIF($2, ''), peer.uuid),
                     pk = COALESCE($3, peer.pk),
-                    info = COALESCE(NULLIF($4, ''), peer.info),
+                    info = COALESCE(NULLIF(EXCLUDED.info, '{}'::jsonb), peer.info),
                     ip = COALESCE(NULLIF($5, ''), peer.ip),
                     status_online = TRUE,
                     last_online = NOW(),
@@ -3876,12 +3901,15 @@ function createPostgresAdapter() {
         async createDlpPolicy(data) {
             const rules = typeof data.rules === 'string' ? data.rules : JSON.stringify(data.rules || []);
             return one(`
-                INSERT INTO dlp_policies (name, description, enabled, rules)
-                VALUES ($1, $2, $3, $4)
+                INSERT INTO dlp_policies (name, description, policy_type, action, scope, enabled, rules)
+                VALUES ($1, $2, $3, $4, $5, $6, $7)
                 RETURNING *
             `, [
                 data.name,
                 data.description || '',
+                data.policy_type || '',
+                data.action || 'log',
+                data.scope || '',
                 data.enabled !== undefined ? data.enabled : true,
                 rules
             ]);
@@ -3892,6 +3920,9 @@ function createPostgresAdapter() {
             let idx = 1;
             if (data.name !== undefined) { sets.push(`name = $${idx++}`); params.push(data.name); }
             if (data.description !== undefined) { sets.push(`description = $${idx++}`); params.push(data.description); }
+            if (data.policy_type !== undefined) { sets.push(`policy_type = $${idx++}`); params.push(data.policy_type); }
+            if (data.action !== undefined) { sets.push(`action = $${idx++}`); params.push(data.action); }
+            if (data.scope !== undefined) { sets.push(`scope = $${idx++}`); params.push(data.scope); }
             if (data.enabled !== undefined) { sets.push(`enabled = $${idx++}`); params.push(!!data.enabled); }
             if (data.rules !== undefined) {
                 sets.push(`rules = $${idx++}`);
diff --git a/web-nodejs/services/emailService.js b/web-nodejs/services/emailService.js
index 9fc47a9f..18b499c7 100644
--- a/web-nodejs/services/emailService.js
+++ b/web-nodejs/services/emailService.js
@@ -19,6 +19,7 @@ try {
 }
 
 const { getAdapter } = require('./dbAdapter');
+const config = require('../config/config');
 
 let _transporter = null;
 let _cachedConfig = null;
@@ -73,7 +74,7 @@ async function getTransporter() {
         port: config.port || 587,
         secure: config.secure || false,
         auth: (config.user && config.pass) ? { user: config.user, pass: config.pass } : undefined,
-        tls: { rejectUnauthorized: false },
+        tls: { rejectUnauthorized: config.smtpTlsVerify },
     });
 
     _cachedConfig = config;
diff --git a/web-nodejs/services/networkMonitor.js b/web-nodejs/services/networkMonitor.js
index 0b701b4d..993dd6e6 100644
--- a/web-nodejs/services/networkMonitor.js
+++ b/web-nodejs/services/networkMonitor.js
@@ -22,6 +22,7 @@ const net = require('net');
 const dns = require('dns');
 const { spawn } = require('child_process');
 const os = require('os');
+const config = require('../config/config');
 
 // ---------------------------------------------------------------------------
 //  Config
@@ -161,7 +162,7 @@ function checkHttp(url, timeoutMs = DEFAULT_TIMEOUT_MS, expectedStatus = 200) {
         const start = Date.now();
         const lib = url.startsWith('https') ? https : http;
 
-        const req = lib.get(url, { timeout: timeoutMs, rejectUnauthorized: false }, (res) => {
+        const req = lib.get(url, { timeout: timeoutMs, rejectUnauthorized: !config.allowSelfSignedCerts }, (res) => {
             const rtt = Date.now() - start;
             // Drain response body
             res.resume();
diff --git a/web-nodejs/services/wsRelay.js b/web-nodejs/services/wsRelay.js
index 7ddc5bab..33d70854 100644
--- a/web-nodejs/services/wsRelay.js
+++ b/web-nodejs/services/wsRelay.js
@@ -64,10 +64,17 @@ function initWsProxy(server) {
     const relayWss = new WebSocket.Server({ noServer: true });
 
     // Handle upgrade requests — verify session cookie before allowing WebSocket
+    // Only handles /ws/rendezvous and /ws/relay; other paths are left for
+    // downstream handlers (chatRelay, remoteRelay, cdapProxy, etc.)
     server.on('upgrade', (request, socket, head) => {
         const url = new URL(request.url, `http://${request.headers.host}`);
         const pathname = url.pathname;
 
+        // Only handle paths this proxy owns
+        if (pathname !== '/ws/rendezvous' && pathname !== '/ws/relay') {
+            return; // let other upgrade handlers deal with it
+        }
+
         // Parse session cookie to verify authentication
         const cookies = {};
         const cookieHeader = request.headers.cookie || '';
@@ -88,12 +95,10 @@ function initWsProxy(server) {
             rendezvousWss.handleUpgrade(request, socket, head, (ws) => {
                 rendezvousWss.emit('connection', ws, request);
             });
-        } else if (pathname === '/ws/relay') {
+        } else {
             relayWss.handleUpgrade(request, socket, head, (ws) => {
                 relayWss.emit('connection', ws, request);
             });
-        } else {
-            socket.destroy();
         }
     });
 
diff --git a/web-nodejs/views/activity.ejs b/web-nodejs/views/activity.ejs
new file mode 100644
index 00000000..721eb77f
--- /dev/null
+++ b/web-nodejs/views/activity.ejs
@@ -0,0 +1,69 @@
+<%- include('layouts/main', {
+    title: typeof title !== 'undefined' ? title : 'Activity',
+    pageStyles: ['activity'],
+    pageScripts: ['activity'],
+    currentPage: 'activity',
+    breadcrumb: [{ label: _('nav.management') }, { label: _('activity.title') }],
+    body: `
+    <div class="page-header">
+        <h1>${_('activity.title')}</h1>
+    </div>
+
+    <!-- Filters -->
+    <div class="page-filters">
+        <div class="search-wrapper">
+            <span class="material-icons">search</span>
+            <input type="text" id="activity-search" placeholder="${_('activity.search')}" />
+        </div>
+        <div class="filter-group">
+            <label>${_('activity.date_range')}</label>
+            <input type="date" id="activity-from" />
+            <span class="range-sep">—</span>
+            <input type="date" id="activity-to" />
+        </div>
+        <button class="btn btn-secondary" id="activity-refresh-btn">
+            <span class="material-icons">refresh</span>
+        </button>
+    </div>
+
+    <!-- Activity list -->
+    <div class="table-wrapper">
+        <table class="data-table">
+            <thead>
+                <tr>
+                    <th>${_('activity.device_id')}</th>
+                    <th>${_('activity.hostname')}</th>
+                    <th>${_('activity.session_count')}</th>
+                    <th>${_('activity.active_time')}</th>
+                    <th>${_('activity.idle_time')}</th>
+                    <th>${_('activity.reported_at')}</th>
+                    <th>${_('common.actions')}</th>
+                </tr>
+            </thead>
+            <tbody id="activity-body"></tbody>
+        </table>
+    </div>
+
+    <!-- Detail modal -->
+    <div class="modal-overlay" id="detail-modal" style="display:none">
+        <div class="modal modal-lg">
+            <div class="modal-header">
+                <h2 id="detail-modal-title">${_('activity.detail')}</h2>
+                <button class="modal-close" data-modal="detail-modal"><span class="material-icons">close</span></button>
+            </div>
+            <div class="modal-body">
+                <!-- Sessions -->
+                <div class="detail-section" id="detail-sessions">
+                    <h3><span class="material-icons">schedule</span> ${_('activity.sessions')}</h3>
+                    <div id="sessions-list"></div>
+                </div>
+                <!-- Top apps -->
+                <div class="detail-section" id="detail-apps">
+                    <h3><span class="material-icons">apps</span> ${_('activity.top_apps')}</h3>
+                    <div id="apps-list"></div>
+                </div>
+            </div>
+        </div>
+    </div>
+    `
+}) %>
diff --git a/web-nodejs/views/automation.ejs b/web-nodejs/views/automation.ejs
new file mode 100644
index 00000000..c831c8b5
--- /dev/null
+++ b/web-nodejs/views/automation.ejs
@@ -0,0 +1,292 @@
+<%- include('layouts/main', {
+    title: _('automation.title'),
+    pageStyles: ['automation'],
+    pageScripts: ['automation'],
+    currentPage: 'automation',
+    breadcrumb: [{ label: _('automation.title') }],
+    body: `
+        <div class="automation-page">
+            <!-- Header -->
+            <div class="page-header">
+                <div class="page-title">
+                    <h1>${_('automation.title')}</h1>
+                </div>
+                <p class="page-subtitle">${_('automation.subtitle')}</p>
+            </div>
+
+            <!-- Tabs -->
+            <div class="tab-bar">
+                <button class="tab-btn active" data-tab="rules">
+                    <span class="material-icons">rule</span> ${_('automation.rules')}
+                </button>
+                <button class="tab-btn" data-tab="alerts">
+                    <span class="material-icons">notifications</span> ${_('automation.alerts')}
+                </button>
+                <button class="tab-btn" data-tab="commands">
+                    <span class="material-icons">terminal</span> ${_('automation.commands')}
+                </button>
+                <button class="tab-btn" data-tab="smtp">
+                    <span class="material-icons">email</span> ${_('automation.smtp')}
+                </button>
+            </div>
+
+            <!-- Rules Tab -->
+            <div class="tab-panel active" id="tab-rules">
+                <div class="panel-actions">
+                    <button class="btn btn-primary" id="create-rule-btn">
+                        <span class="material-icons">add</span> ${_('automation.create_rule')}
+                    </button>
+                </div>
+                <div class="table-wrapper">
+                    <table class="data-table">
+                        <thead>
+                            <tr>
+                                <th>${_('automation.rule_name')}</th>
+                                <th>${_('automation.condition_type')}</th>
+                                <th>${_('automation.condition_op')}</th>
+                                <th>${_('automation.condition_value')}</th>
+                                <th>${_('automation.severity')}</th>
+                                <th>${_('automation.enabled')}</th>
+                                <th>${_('common.actions')}</th>
+                            </tr>
+                        </thead>
+                        <tbody id="rules-body">
+                            <tr class="empty-row"><td colspan="7">
+                                <div class="empty-state"><span class="material-icons">rule</span>
+                                <p>${_('automation.no_rules')}</p></div>
+                            </td></tr>
+                        </tbody>
+                    </table>
+                </div>
+            </div>
+
+            <!-- Alerts Tab -->
+            <div class="tab-panel" id="tab-alerts">
+                <div class="panel-actions">
+                    <select class="form-input" id="alert-severity-filter" style="width:auto">
+                        <option value="">${_('tickets.filter_all')}</option>
+                        <option value="info">${_('automation.severity_info')}</option>
+                        <option value="warning">${_('automation.severity_warning')}</option>
+                        <option value="critical">${_('automation.severity_critical')}</option>
+                    </select>
+                </div>
+                <div class="table-wrapper">
+                    <table class="data-table">
+                        <thead>
+                            <tr>
+                                <th>${_('automation.severity')}</th>
+                                <th>${_('automation.rule_name')}</th>
+                                <th>${_('inventory.device_id')}</th>
+                                <th>${_('automation.condition_value')}</th>
+                                <th>${_('automation.triggered_at')}</th>
+                                <th>${_('automation.acknowledged')}</th>
+                                <th>${_('common.actions')}</th>
+                            </tr>
+                        </thead>
+                        <tbody id="alerts-body">
+                            <tr class="empty-row"><td colspan="7">
+                                <div class="empty-state"><span class="material-icons">notifications_none</span>
+                                <p>${_('automation.no_alerts')}</p></div>
+                            </td></tr>
+                        </tbody>
+                    </table>
+                </div>
+            </div>
+
+            <!-- Commands Tab -->
+            <div class="tab-panel" id="tab-commands">
+                <div class="panel-actions">
+                    <button class="btn btn-primary" id="send-command-btn">
+                        <span class="material-icons">send</span> ${_('automation.send_command')}
+                    </button>
+                </div>
+                <div class="table-wrapper">
+                    <table class="data-table">
+                        <thead>
+                            <tr>
+                                <th>#</th>
+                                <th>${_('inventory.device_id')}</th>
+                                <th>${_('automation.command_type')}</th>
+                                <th>${_('automation.command_payload')}</th>
+                                <th>${_('automation.command_status')}</th>
+                                <th>${_('tickets.created_at')}</th>
+                                <th>${_('common.actions')}</th>
+                            </tr>
+                        </thead>
+                        <tbody id="commands-body">
+                            <tr class="empty-row"><td colspan="7">
+                                <div class="empty-state"><span class="material-icons">terminal</span>
+                                <p>${_('automation.no_commands')}</p></div>
+                            </td></tr>
+                        </tbody>
+                    </table>
+                </div>
+            </div>
+
+            <!-- SMTP Tab -->
+            <div class="tab-panel" id="tab-smtp">
+                <div class="smtp-form-wrapper">
+                    <form id="smtp-form">
+                        <div class="form-row">
+                            <div class="form-group">
+                                <label>${_('automation.smtp_host')}</label>
+                                <input type="text" class="form-input" id="smtp-host" placeholder="smtp.example.com">
+                            </div>
+                            <div class="form-group">
+                                <label>${_('automation.smtp_port')}</label>
+                                <input type="number" class="form-input" id="smtp-port" value="587" min="1" max="65535">
+                            </div>
+                        </div>
+                        <div class="form-group">
+                            <label><input type="checkbox" id="smtp-secure"> ${_('automation.smtp_secure')}</label>
+                        </div>
+                        <div class="form-row">
+                            <div class="form-group">
+                                <label>${_('automation.smtp_user')}</label>
+                                <input type="text" class="form-input" id="smtp-user">
+                            </div>
+                            <div class="form-group">
+                                <label>${_('automation.smtp_pass')}</label>
+                                <input type="password" class="form-input" id="smtp-pass">
+                            </div>
+                        </div>
+                        <div class="form-group">
+                            <label>${_('automation.smtp_from')}</label>
+                            <input type="email" class="form-input" id="smtp-from" placeholder="alerts@example.com">
+                        </div>
+                        <div class="form-actions">
+                            <button type="button" class="btn btn-secondary" id="smtp-test-btn">${_('automation.smtp_test')}</button>
+                            <button type="button" class="btn btn-primary" id="smtp-save-btn">${_('automation.smtp_save')}</button>
+                        </div>
+                    </form>
+                </div>
+            </div>
+
+            <!-- Rule Modal -->
+            <div class="modal-overlay" id="rule-modal" style="display: none;">
+                <div class="modal">
+                    <div class="modal-header">
+                        <h3 id="rule-modal-title">${_('automation.create_rule')}</h3>
+                        <button class="btn-icon modal-close" data-modal="rule-modal">
+                            <span class="material-icons">close</span>
+                        </button>
+                    </div>
+                    <div class="modal-body">
+                        <form id="rule-form">
+                            <input type="hidden" id="rule-id">
+                            <div class="form-group">
+                                <label>${_('automation.rule_name')} *</label>
+                                <input type="text" class="form-input" id="rule-name" required maxlength="100">
+                            </div>
+                            <div class="form-group">
+                                <label>${_('automation.description')}</label>
+                                <input type="text" class="form-input" id="rule-desc" maxlength="500">
+                            </div>
+                            <div class="form-row">
+                                <div class="form-group">
+                                    <label>${_('automation.condition_type')}</label>
+                                    <select class="form-input" id="rule-condition">
+                                        <option value="cpu_usage">${_('automation.type_cpu_usage')}</option>
+                                        <option value="memory_usage">${_('automation.type_memory_usage')}</option>
+                                        <option value="disk_usage">${_('automation.type_disk_usage')}</option>
+                                        <option value="offline_duration">${_('automation.type_offline_duration')}</option>
+                                        <option value="idle_duration">${_('automation.type_idle_duration')}</option>
+                                        <option value="custom">${_('automation.type_custom')}</option>
+                                    </select>
+                                </div>
+                                <div class="form-group">
+                                    <label>${_('automation.condition_op')}</label>
+                                    <select class="form-input" id="rule-operator">
+                                        <option value="gt">${_('automation.op_gt')}</option>
+                                        <option value="gte">${_('automation.op_gte')}</option>
+                                        <option value="lt">${_('automation.op_lt')}</option>
+                                        <option value="lte">${_('automation.op_lte')}</option>
+                                        <option value="eq">${_('automation.op_eq')}</option>
+                                        <option value="neq">${_('automation.op_neq')}</option>
+                                    </select>
+                                </div>
+                            </div>
+                            <div class="form-row">
+                                <div class="form-group">
+                                    <label>${_('automation.condition_value')}</label>
+                                    <input type="number" class="form-input" id="rule-value" step="any">
+                                </div>
+                                <div class="form-group">
+                                    <label>${_('automation.severity')}</label>
+                                    <select class="form-input" id="rule-severity">
+                                        <option value="info">${_('automation.severity_info')}</option>
+                                        <option value="warning">${_('automation.severity_warning')}</option>
+                                        <option value="critical">${_('automation.severity_critical')}</option>
+                                    </select>
+                                </div>
+                            </div>
+                            <div class="form-group">
+                                <label>${_('automation.scope_device')}</label>
+                                <input type="text" class="form-input" id="rule-device" placeholder="${_('automation.scope_all')}">
+                            </div>
+                            <div class="form-group">
+                                <label><input type="checkbox" id="rule-enabled" checked> ${_('automation.enabled')}</label>
+                            </div>
+                        </form>
+                    </div>
+                    <div class="modal-footer">
+                        <button class="btn btn-secondary modal-close" data-modal="rule-modal">${_('common.cancel')}</button>
+                        <button class="btn btn-primary" id="rule-save-btn">${_('common.save')}</button>
+                    </div>
+                </div>
+            </div>
+
+            <!-- Command Modal -->
+            <div class="modal-overlay" id="cmd-modal" style="display: none;">
+                <div class="modal">
+                    <div class="modal-header">
+                        <h3>${_('automation.send_command')}</h3>
+                        <button class="btn-icon modal-close" data-modal="cmd-modal">
+                            <span class="material-icons">close</span>
+                        </button>
+                    </div>
+                    <div class="modal-body">
+                        <div class="form-group">
+                            <label>${_('inventory.device_id')} *</label>
+                            <input type="text" class="form-input" id="cmd-device" required>
+                        </div>
+                        <div class="form-group">
+                            <label>${_('automation.command_type')}</label>
+                            <select class="form-input" id="cmd-type">
+                                <option value="shell">Shell</option>
+                                <option value="powershell">PowerShell</option>
+                                <option value="script">Script</option>
+                                <option value="restart_service">Restart Service</option>
+                                <option value="reboot">Reboot</option>
+                            </select>
+                        </div>
+                        <div class="form-group">
+                            <label>${_('automation.command_payload')} *</label>
+                            <textarea class="form-input" id="cmd-payload" rows="4" maxlength="10000" required></textarea>
+                        </div>
+                    </div>
+                    <div class="modal-footer">
+                        <button class="btn btn-secondary modal-close" data-modal="cmd-modal">${_('common.cancel')}</button>
+                        <button class="btn btn-primary" id="cmd-send-btn">${_('automation.send_command')}</button>
+                    </div>
+                </div>
+            </div>
+
+            <!-- Command Result Modal -->
+            <div class="modal-overlay" id="result-modal" style="display: none;">
+                <div class="modal modal-lg">
+                    <div class="modal-header">
+                        <h3>${_('automation.command_result')}</h3>
+                        <button class="btn-icon modal-close" data-modal="result-modal">
+                            <span class="material-icons">close</span>
+                        </button>
+                    </div>
+                    <div class="modal-body" id="result-body"></div>
+                    <div class="modal-footer">
+                        <button class="btn btn-secondary modal-close" data-modal="result-modal">${_('actions.close')}</button>
+                    </div>
+                </div>
+            </div>
+        </div>
+    `
+}) %>
diff --git a/web-nodejs/views/cdap-device.ejs b/web-nodejs/views/cdap-device.ejs
index 8c4a39b4..581c2b09 100644
--- a/web-nodejs/views/cdap-device.ejs
+++ b/web-nodejs/views/cdap-device.ejs
@@ -1,7 +1,7 @@
 <%- include('layouts/main', {
     title: _('cdap.device_detail'),
     pageStyles: ['cdap'],
-    pageScripts: ['cdap-widgets', 'cdap-commands'],
+    pageScripts: ['cdap-widgets', 'cdap-commands', 'cdap-terminal', 'cdap-desktop', 'cdap-video', 'cdap-filebrowser', 'cdap-audio'],
     currentPage: 'devices',
     breadcrumb: [
         { label: _('nav.devices'), href: '/devices' },
@@ -45,6 +45,41 @@
                 <span>${_('cdap.device_offline_msg')}</span>
             </div>
 
+            <!-- Active Alerts Panel -->
+            <div class="cdap-alerts-panel hidden" id="cdap-alerts-panel">
+                <div class="cdap-alerts-header">
+                    <h3>
+                        <span class="material-icons">warning</span>
+                        ${_('cdap.active_alerts')}
+                        <span class="cdap-alerts-count" id="cdap-alerts-count">0</span>
+                    </h3>
+                </div>
+                <div class="cdap-alerts-list" id="cdap-alerts-list">
+                    <!-- Alert items rendered by cdap-widgets.js -->
+                </div>
+            </div>
+
+            <!-- Linked Devices Panel -->
+            <div class="cdap-linked-panel" id="cdap-linked-panel">
+                <div class="cdap-linked-header">
+                    <h3>
+                        <span class="material-icons">device_hub</span>
+                        ${_('cdap.linked_devices')}
+                        <span class="cdap-linked-count" id="cdap-linked-count">0</span>
+                    </h3>
+                    <button class="btn-sm btn-accent" id="cdap-link-btn" title="${_('cdap.link_device')}">
+                        <span class="material-icons">add_link</span>
+                        <span>${_('cdap.link_device')}</span>
+                    </button>
+                </div>
+                <div class="cdap-linked-list" id="cdap-linked-list">
+                    <div class="cdap-linked-empty" id="cdap-linked-empty">
+                        <span class="material-icons">link_off</span>
+                        <span>${_('cdap.no_linked_devices')}</span>
+                    </div>
+                </div>
+            </div>
+
             <!-- Widget Grid -->
             <div class="cdap-widget-grid" id="cdap-widget-grid">
                 <!-- Widgets rendered by cdap-widgets.js -->
diff --git a/web-nodejs/views/cdap-devices.ejs b/web-nodejs/views/cdap-devices.ejs
new file mode 100644
index 00000000..52549c16
--- /dev/null
+++ b/web-nodejs/views/cdap-devices.ejs
@@ -0,0 +1,93 @@
+<%- include('layouts/main', {
+    title: _('cdap.devices_title'),
+    pageStyles: ['cdap'],
+    pageScripts: ['cdap-devices'],
+    currentPage: 'cdap',
+    breadcrumb: [
+        { label: _('nav.management') },
+        { label: _('cdap.devices_title') }
+    ],
+    body: `
+        <div class="cdap-list-page">
+            <!-- Header -->
+            <div class="page-header">
+                <div class="page-title">
+                    <h1>${_('cdap.devices_title')}</h1>
+                </div>
+                <p class="page-subtitle">${_('cdap.devices_subtitle')}</p>
+            </div>
+
+            <!-- Status Banner -->
+            <div class="cdap-gateway-banner" id="cdap-gateway-banner">
+                <div class="cdap-gateway-status" id="cdap-gw-status">
+                    <span class="cdap-status-dot"></span>
+                    <span id="cdap-gw-status-text">${_('common.loading')}</span>
+                </div>
+                <div class="cdap-gateway-stats">
+                    <div class="cdap-gw-stat">
+                        <span class="cdap-gw-stat-value" id="cdap-stat-connected">0</span>
+                        <span class="cdap-gw-stat-label">${_('cdap.stat_connected')}</span>
+                    </div>
+                    <div class="cdap-gw-stat">
+                        <span class="cdap-gw-stat-value" id="cdap-stat-port">—</span>
+                        <span class="cdap-gw-stat-label">${_('cdap.stat_port')}</span>
+                    </div>
+                    <div class="cdap-gw-stat">
+                        <span class="cdap-gw-stat-value" id="cdap-stat-tls">—</span>
+                        <span class="cdap-gw-stat-label">TLS</span>
+                    </div>
+                </div>
+                ${user && user.role === 'admin' ? `
+                <button class="btn btn-sm btn-danger" id="cdap-toggle-btn" title="${_('cdap.toggle_disable')}">
+                    <span class="material-icons" style="font-size:16px">power_settings_new</span>
+                    <span>${_('cdap.toggle_disable')}</span>
+                </button>
+                ` : ''}
+            </div>
+
+            <!-- Filters -->
+            <div class="panel-actions">
+                <div class="search-wrapper">
+                    <span class="material-icons">search</span>
+                    <input type="text" class="form-input" id="cdap-search" placeholder="${_('cdap.search_devices')}" />
+                </div>
+                <div class="filter-buttons" id="cdap-type-filter">
+                    <button class="filter-btn active" data-type="">${_('common.all')}</button>
+                    <button class="filter-btn" data-type="iot">${_('cdap.type_iot')}</button>
+                    <button class="filter-btn" data-type="scada">${_('cdap.type_scada')}</button>
+                    <button class="filter-btn" data-type="os_agent">${_('cdap.type_os_agent')}</button>
+                    <button class="filter-btn" data-type="network">${_('cdap.type_network')}</button>
+                    <button class="filter-btn" data-type="camera">${_('cdap.type_camera')}</button>
+                    <button class="filter-btn" data-type="custom">${_('cdap.type_custom')}</button>
+                </div>
+            </div>
+
+            <!-- Device Grid -->
+            <div class="cdap-device-grid" id="cdap-device-grid">
+                <div class="cdap-loading" id="cdap-list-loading">
+                    <div class="cdap-loading-spinner"></div>
+                    <p>${_('common.loading')}</p>
+                </div>
+            </div>
+
+            <!-- Empty State -->
+            <div class="cdap-list-empty hidden" id="cdap-list-empty">
+                <span class="material-icons cdap-empty-icon">developer_board</span>
+                <h3>${_('cdap.no_devices')}</h3>
+                <p>${_('cdap.no_devices_desc')}</p>
+            </div>
+
+            <!-- CDAP Disabled State -->
+            <div class="cdap-list-empty hidden" id="cdap-disabled-banner">
+                <span class="material-icons cdap-empty-icon">power_off</span>
+                <h3>${_('cdap.gateway_disabled')}</h3>
+                <p>${_('cdap.gateway_disabled_desc')}</p>
+                ${user && user.role === 'admin' ? `
+                <button class="btn btn-primary" id="cdap-enable-btn" style="margin-top: 16px">
+                    <span class="material-icons" style="font-size:18px">power_settings_new</span>
+                    <span>${_('cdap.toggle_enable')}</span>
+                </button>
+                ` : ''}
+            </div>
+        </div>
+` }) %>
diff --git a/web-nodejs/views/dataguard.ejs b/web-nodejs/views/dataguard.ejs
new file mode 100644
index 00000000..28d98dee
--- /dev/null
+++ b/web-nodejs/views/dataguard.ejs
@@ -0,0 +1,163 @@
+<%- include('layouts/main', {
+    title: typeof title !== 'undefined' ? title : 'DataGuard',
+    pageStyles: ['dataguard'],
+    pageScripts: ['dataguard'],
+    currentPage: 'dataguard',
+    breadcrumb: [{ label: _('nav.system') }, { label: _('dataguard.title') }],
+    body: `
+    <div class="page-header">
+        <h1>${_('dataguard.title')}</h1>
+    </div>
+
+    <!-- Stats -->
+    <div class="stat-cards">
+        <div class="stat-card">
+            <div class="stat-icon"><span class="material-icons">policy</span></div>
+            <div class="stat-info">
+                <span class="stat-value" id="stat-policies">0</span>
+                <span class="stat-label">${_('dataguard.total_policies')}</span>
+            </div>
+        </div>
+        <div class="stat-card">
+            <div class="stat-icon online"><span class="material-icons">check_circle</span></div>
+            <div class="stat-info">
+                <span class="stat-value" id="stat-active">0</span>
+                <span class="stat-label">${_('dataguard.active_policies')}</span>
+            </div>
+        </div>
+        <div class="stat-card">
+            <div class="stat-icon offline"><span class="material-icons">warning</span></div>
+            <div class="stat-info">
+                <span class="stat-value" id="stat-violations">0</span>
+                <span class="stat-label">${_('dataguard.violations')}</span>
+            </div>
+        </div>
+        <div class="stat-card">
+            <div class="stat-icon"><span class="material-icons">block</span></div>
+            <div class="stat-info">
+                <span class="stat-value" id="stat-blocked">0</span>
+                <span class="stat-label">${_('dataguard.blocked')}</span>
+            </div>
+        </div>
+    </div>
+
+    <!-- Tab bar -->
+    <div class="tab-bar">
+        <button class="tab-btn active" data-tab="policies">${_('dataguard.tab_policies')}</button>
+        <button class="tab-btn" data-tab="events">${_('dataguard.tab_events')}</button>
+    </div>
+
+    <!-- Policies panel -->
+    <div class="tab-panel active" id="tab-policies">
+        <div class="panel-actions">
+            <div class="search-wrapper">
+                <span class="material-icons">search</span>
+                <input type="text" id="policy-search" placeholder="${_('dataguard.search_policies')}" />
+            </div>
+            <button class="btn btn-primary" id="create-policy-btn">
+                <span class="material-icons">add</span> ${_('dataguard.create_policy')}
+            </button>
+        </div>
+        <div class="table-wrapper">
+            <table class="data-table">
+                <thead>
+                    <tr>
+                        <th>${_('dataguard.policy_name')}</th>
+                        <th>${_('dataguard.policy_type')}</th>
+                        <th>${_('dataguard.action')}</th>
+                        <th>${_('dataguard.scope')}</th>
+                        <th>${_('dataguard.status')}</th>
+                        <th>${_('dataguard.events_count')}</th>
+                        <th>${_('common.actions')}</th>
+                    </tr>
+                </thead>
+                <tbody id="policies-body"></tbody>
+            </table>
+        </div>
+    </div>
+
+    <!-- Events panel -->
+    <div class="tab-panel" id="tab-events">
+        <div class="panel-actions">
+            <div class="search-wrapper">
+                <span class="material-icons">search</span>
+                <input type="text" id="event-search" placeholder="${_('dataguard.search_events')}" />
+            </div>
+            <div class="filter-buttons" id="event-action-filter">
+                <button class="filter-btn active" data-action="">${_('common.all')}</button>
+                <button class="filter-btn" data-action="block">${_('dataguard.action_block')}</button>
+                <button class="filter-btn" data-action="log">${_('dataguard.action_log')}</button>
+                <button class="filter-btn" data-action="allow">${_('dataguard.action_allow')}</button>
+            </div>
+        </div>
+        <div class="table-wrapper">
+            <table class="data-table">
+                <thead>
+                    <tr>
+                        <th>${_('dataguard.event_time')}</th>
+                        <th>${_('dataguard.device')}</th>
+                        <th>${_('dataguard.policy')}</th>
+                        <th>${_('dataguard.action')}</th>
+                        <th>${_('dataguard.detail')}</th>
+                    </tr>
+                </thead>
+                <tbody id="events-body"></tbody>
+            </table>
+        </div>
+    </div>
+
+    <!-- Policy modal -->
+    <div class="modal-overlay" id="policy-modal" style="display:none">
+        <div class="modal">
+            <div class="modal-header">
+                <h2 id="policy-modal-title">${_('dataguard.create_policy')}</h2>
+                <button class="modal-close" data-modal="policy-modal"><span class="material-icons">close</span></button>
+            </div>
+            <div class="modal-body">
+                <input type="hidden" id="policy-id" />
+                <div class="form-row">
+                    <label for="policy-name">${_('dataguard.policy_name')}</label>
+                    <input type="text" id="policy-name" />
+                </div>
+                <div class="form-row">
+                    <label for="policy-desc">${_('dataguard.policy_desc')}</label>
+                    <textarea id="policy-desc" rows="2"></textarea>
+                </div>
+                <div class="form-row">
+                    <label for="policy-type">${_('dataguard.policy_type')}</label>
+                    <select id="policy-type">
+                        <option value="usb">${_('dataguard.type_usb')}</option>
+                        <option value="file_type">${_('dataguard.type_file_type')}</option>
+                        <option value="clipboard">${_('dataguard.type_clipboard')}</option>
+                        <option value="screen_share">${_('dataguard.type_screen_share')}</option>
+                        <option value="file_transfer">${_('dataguard.type_file_transfer')}</option>
+                    </select>
+                </div>
+                <div class="form-row">
+                    <label for="policy-action">${_('dataguard.action')}</label>
+                    <select id="policy-action">
+                        <option value="allow">${_('dataguard.action_allow')}</option>
+                        <option value="log">${_('dataguard.action_log')}</option>
+                        <option value="block">${_('dataguard.action_block')}</option>
+                    </select>
+                </div>
+                <div class="form-row">
+                    <label for="policy-scope">${_('dataguard.scope')}</label>
+                    <input type="text" id="policy-scope" placeholder="${_('dataguard.scope_help')}" />
+                </div>
+                <div class="form-row">
+                    <label for="policy-rules">${_('dataguard.rules')}</label>
+                    <textarea id="policy-rules" rows="3" placeholder='[{"key":"file_ext","value":".exe,.bat"}]'></textarea>
+                </div>
+                <div class="form-row">
+                    <label><input type="checkbox" id="policy-enabled" checked /> ${_('dataguard.enabled')}</label>
+                </div>
+            </div>
+            <div class="modal-footer">
+                <button class="btn btn-secondary" onclick="document.getElementById('policy-modal').style.display='none'">${_('common.cancel')}</button>
+                <button class="btn btn-primary" id="policy-save-btn">${_('common.save')}</button>
+            </div>
+        </div>
+    </div>
+    `
+}) %>
diff --git a/web-nodejs/views/errors/403.ejs b/web-nodejs/views/errors/403.ejs
index 7eea2335..2beacce1 100644
--- a/web-nodejs/views/errors/403.ejs
+++ b/web-nodejs/views/errors/403.ejs
@@ -5,8 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>403 - Forbidden | <%= appName %></title>
     <link rel="icon" type="image/svg+xml" href="/branding/favicon.svg">
-    <link rel="stylesheet" href="/css/main.css">
-    <link rel="stylesheet" href="/css/theme.css">
+    <link rel="stylesheet" href="/css/main.css?v=<%= typeof cacheVersion !== 'undefined' ? cacheVersion : '' %>">
+    <link rel="stylesheet" href="/css/theme.css?v=<%= typeof cacheVersion !== 'undefined' ? cacheVersion : '' %>">
     <style>
         .error-page {
             min-height: 100vh;
diff --git a/web-nodejs/views/errors/404.ejs b/web-nodejs/views/errors/404.ejs
index 1875246b..38e63ea6 100644
--- a/web-nodejs/views/errors/404.ejs
+++ b/web-nodejs/views/errors/404.ejs
@@ -5,8 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>404 - Not Found | <%= appName %></title>
     <link rel="icon" type="image/svg+xml" href="/branding/favicon.svg">
-    <link rel="stylesheet" href="/css/main.css">
-    <link rel="stylesheet" href="/css/theme.css">
+    <link rel="stylesheet" href="/css/main.css?v=<%= typeof cacheVersion !== 'undefined' ? cacheVersion : '' %>">
+    <link rel="stylesheet" href="/css/theme.css?v=<%= typeof cacheVersion !== 'undefined' ? cacheVersion : '' %>">
     <style>
         .error-page {
             min-height: 100vh;
diff --git a/web-nodejs/views/errors/500.ejs b/web-nodejs/views/errors/500.ejs
index 3f3fe386..1d6c311e 100644
--- a/web-nodejs/views/errors/500.ejs
+++ b/web-nodejs/views/errors/500.ejs
@@ -5,8 +5,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>500 - Server Error | <%= appName %></title>
     <link rel="icon" type="image/svg+xml" href="/branding/favicon.svg">
-    <link rel="stylesheet" href="/css/main.css">
-    <link rel="stylesheet" href="/css/theme.css">
+    <link rel="stylesheet" href="/css/main.css?v=<%= typeof cacheVersion !== 'undefined' ? cacheVersion : '' %>">
+    <link rel="stylesheet" href="/css/theme.css?v=<%= typeof cacheVersion !== 'undefined' ? cacheVersion : '' %>">
     <style>
         .error-page {
             min-height: 100vh;
diff --git a/web-nodejs/views/help-requests.ejs b/web-nodejs/views/help-requests.ejs
new file mode 100644
index 00000000..7e5a9827
--- /dev/null
+++ b/web-nodejs/views/help-requests.ejs
@@ -0,0 +1,56 @@
+<%- include('layouts/main', {
+    title: _('help_request.title'),
+    pageStyles: ['help-requests'],
+    pageScripts: ['help-requests'],
+    currentPage: 'help-requests',
+    breadcrumb: [{ label: _('help_request.title') }],
+    body: `
+        <div class="help-requests-page">
+            <!-- Header -->
+            <div class="page-header">
+                <div class="page-title">
+                    <h1>${_('help_request.title')}</h1>
+                </div>
+                <p class="page-subtitle">${_('help_request.subtitle') || 'Manage incoming help requests from desktop clients'}</p>
+            </div>
+
+            <!-- Stats -->
+            <div class="hr-stats" id="hr-stats">
+                <div class="stat-card stat-total">
+                    <span class="stat-value" id="stat-total">0</span>
+                    <span class="stat-label">${_('help_request.stats_total') || 'Total'}</span>
+                </div>
+                <div class="stat-card stat-pending">
+                    <span class="stat-value" id="stat-pending">0</span>
+                    <span class="stat-label">${_('help_request.pending')}</span>
+                </div>
+                <div class="stat-card stat-accepted">
+                    <span class="stat-value" id="stat-accepted">0</span>
+                    <span class="stat-label">${_('help_request.accepted')}</span>
+                </div>
+                <div class="stat-card stat-resolved">
+                    <span class="stat-value" id="stat-resolved">0</span>
+                    <span class="stat-label">${_('help_request.resolved')}</span>
+                </div>
+            </div>
+
+            <!-- Filters -->
+            <div class="page-filters">
+                <div class="filter-buttons">
+                    <button class="btn filter-btn active" data-status="">${_('help_request.filter_all') || 'All'}</button>
+                    <button class="btn filter-btn" data-status="pending">${_('help_request.pending')}</button>
+                    <button class="btn filter-btn" data-status="accepted">${_('help_request.accepted')}</button>
+                    <button class="btn filter-btn" data-status="resolved">${_('help_request.resolved')}</button>
+                </div>
+            </div>
+
+            <!-- Requests List -->
+            <div class="hr-list" id="hr-list">
+                <div class="empty-state" id="hr-empty">
+                    <span class="material-icons">support_agent</span>
+                    <p>${_('help_request.no_requests')}</p>
+                </div>
+            </div>
+        </div>
+    `
+}) %>
diff --git a/web-nodejs/views/inventory.ejs b/web-nodejs/views/inventory.ejs
new file mode 100644
index 00000000..958b31da
--- /dev/null
+++ b/web-nodejs/views/inventory.ejs
@@ -0,0 +1,100 @@
+<%- include('layouts/main', {
+    title: _('inventory.title'),
+    pageStyles: ['inventory'],
+    pageScripts: ['inventory'],
+    currentPage: 'inventory',
+    breadcrumb: [{ label: _('inventory.title') }],
+    body: `
+        <div class="inventory-page">
+            <!-- Header -->
+            <div class="page-header">
+                <div class="page-title">
+                    <h1>${_('inventory.title')}</h1>
+                </div>
+                <p class="page-subtitle">${_('inventory.subtitle')}</p>
+            </div>
+
+            <!-- Stats Cards -->
+            <div class="inventory-stats" id="inventory-stats">
+                <div class="stat-card">
+                    <span class="material-icons">devices</span>
+                    <div class="stat-value" id="stat-devices">0</div>
+                    <div class="stat-label">${_('nav.devices')}</div>
+                </div>
+                <div class="stat-card">
+                    <span class="material-icons">memory</span>
+                    <div class="stat-value" id="stat-cpu">—</div>
+                    <div class="stat-label">${_('inventory.cpu')}</div>
+                </div>
+                <div class="stat-card">
+                    <span class="material-icons">storage</span>
+                    <div class="stat-value" id="stat-memory">—</div>
+                    <div class="stat-label">${_('inventory.memory')}</div>
+                </div>
+                <div class="stat-card">
+                    <span class="material-icons">disc_full</span>
+                    <div class="stat-value" id="stat-disks">—</div>
+                    <div class="stat-label">${_('inventory.disks')}</div>
+                </div>
+            </div>
+
+            <!-- Filters -->
+            <div class="page-filters">
+                <div class="search-wrapper">
+                    <span class="material-icons">search</span>
+                    <input type="text" class="form-input" id="search-input"
+                        placeholder="${_('devices.search_placeholder')}">
+                </div>
+                <button class="btn btn-secondary" id="refresh-btn">
+                    <span class="material-icons">refresh</span>
+                    <span>${_('inventory.refresh')}</span>
+                </button>
+            </div>
+
+            <!-- Inventory Table -->
+            <div class="table-wrapper">
+                <table class="data-table" id="inventory-table">
+                    <thead>
+                        <tr>
+                            <th>${_('inventory.device_id')}</th>
+                            <th>${_('inventory.hostname')}</th>
+                            <th>${_('inventory.os')}</th>
+                            <th>${_('inventory.cpu')}</th>
+                            <th>${_('inventory.memory')}</th>
+                            <th>${_('inventory.disks')}</th>
+                            <th>${_('inventory.last_seen')}</th>
+                            <th>${_('common.actions')}</th>
+                        </tr>
+                    </thead>
+                    <tbody id="inventory-body">
+                        <tr class="empty-row">
+                            <td colspan="8">
+                                <div class="empty-state">
+                                    <span class="material-icons">inventory_2</span>
+                                    <p>${_('inventory.no_devices')}</p>
+                                </div>
+                            </td>
+                        </tr>
+                    </tbody>
+                </table>
+            </div>
+
+            <!-- Detail Modal -->
+            <div class="modal-overlay" id="detail-modal" style="display: none;">
+                <div class="modal modal-lg">
+                    <div class="modal-header">
+                        <h3 id="detail-modal-title">${_('inventory.detail_title')}</h3>
+                        <button class="btn-icon modal-close" data-modal="detail-modal">
+                            <span class="material-icons">close</span>
+                        </button>
+                    </div>
+                    <div class="modal-body" id="detail-modal-body">
+                    </div>
+                    <div class="modal-footer">
+                        <button class="btn btn-secondary modal-close" data-modal="detail-modal">${_('common.close')}</button>
+                    </div>
+                </div>
+            </div>
+        </div>
+    `
+}) %>
diff --git a/web-nodejs/views/layouts/base.ejs b/web-nodejs/views/layouts/base.ejs
index 1de28406..0a310e3a 100644
--- a/web-nodejs/views/layouts/base.ejs
+++ b/web-nodejs/views/layouts/base.ejs
@@ -11,11 +11,11 @@
     <link rel="icon" type="image/svg+xml" href="/branding/favicon.svg">
     
     <!-- Stylesheets -->
-    <link rel="stylesheet" href="/css/main.css">
-    <link rel="stylesheet" href="/css/theme.css">
+    <link rel="stylesheet" href="/css/main.css?v=<%= cacheVersion %>">
+    <link rel="stylesheet" href="/css/theme.css?v=<%= cacheVersion %>">
     <% if (typeof pageStyles !== 'undefined' && pageStyles.length) { %>
         <% pageStyles.forEach(style => { %>
-    <link rel="stylesheet" href="/css/<%= style %>.css">
+    <link rel="stylesheet" href="/css/<%= style %>.css?v=<%= cacheVersion %>">
         <% }); %>
     <% } %>
     
@@ -39,13 +39,13 @@
             branding: <%- JSON.stringify(branding || {}) %>
         };
     </script>
-    <script src="/js/utils.js"></script>
-    <script src="/js/i18n-client.js"></script>
-    <script src="/js/notifications.js"></script>
-    <script src="/js/app.js"></script>
+    <script src="/js/utils.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/i18n-client.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/notifications.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/app.js?v=<%= cacheVersion %>"></script>
     <% if (typeof pageScripts !== 'undefined' && pageScripts.length) { %>
         <% pageScripts.forEach(script => { %>
-    <script src="/js/<%= script %>.js"></script>
+    <script src="/js/<%= script %>.js?v=<%= cacheVersion %>"></script>
         <% }); %>
     <% } %>
 </body>
diff --git a/web-nodejs/views/layouts/main.ejs b/web-nodejs/views/layouts/main.ejs
index be7d9148..5fac2a8a 100644
--- a/web-nodejs/views/layouts/main.ejs
+++ b/web-nodejs/views/layouts/main.ejs
@@ -11,14 +11,16 @@
     <link rel="icon" type="image/svg+xml" href="/branding/favicon.svg">
     
     <!-- Stylesheets -->
-    <link rel="stylesheet" href="/css/main.css">
-    <link rel="stylesheet" href="/css/theme.css">
+    <link rel="stylesheet" href="/css/main.css?v=<%= cacheVersion %>">
+    <link rel="stylesheet" href="/css/theme.css?v=<%= cacheVersion %>">
     <% if (!embed) { %>
-    <link rel="stylesheet" href="/css/desktop-mode.css">
+    <link rel="stylesheet" href="/css/desktop-mode.css?v=<%= cacheVersion %>">
+    <link rel="stylesheet" href="/css/desktop-widgets.css?v=<%= cacheVersion %>">
+    <link rel="stylesheet" href="/css/tutorial.css?v=<%= cacheVersion %>">
     <% } %>
     <% if (typeof pageStyles !== 'undefined' && pageStyles.length) { %>
         <% pageStyles.forEach(style => { %>
-    <link rel="stylesheet" href="/css/<%= style %>.css">
+    <link rel="stylesheet" href="/css/<%= style %>.css?v=<%= cacheVersion %>">
         <% }); %>
     <% } %>
 </head>
@@ -50,6 +52,7 @@
     <!-- Desktop Mode Shell (hidden by default, activated via toggle) -->
     <div id="desktop-shell" class="desktop-shell">
         <div class="desktop-wallpaper"></div>
+        <div class="widget-canvas" id="widget-canvas"></div>
         <div class="desktop-icons" id="desktop-icons"></div>
         <div class="desktop-windows" id="desktop-windows"></div>
         <div class="desktop-taskbar" id="desktop-taskbar">
@@ -60,7 +63,10 @@
             </div>
             <div class="taskbar-apps" id="taskbar-apps"></div>
             <div class="taskbar-right">
-                <button class="taskbar-btn taskbar-console-btn" id="taskbar-console-btn" title="<%= _('desktop.console_mode') %>">
+                <button class="taskbar-btn" id="taskbar-wallpaper-btn" title="<%= _('desktop.wallpaper') %>">
+                    <span class="material-icons">wallpaper</span>
+                </button>
+                <button class="taskbar-btn taskbar-console-btn" id="taskbar-console-btn" title="<%= _('desktop.exit_desktop') %>">
                     <span class="material-icons">view_sidebar</span>
                 </button>
                 <div class="taskbar-clock" id="taskbar-clock"></div>
@@ -87,17 +93,20 @@
             embed: <%= embed ? 'true' : 'false' %>
         };
     </script>
-    <script src="/js/utils.js"></script>
-    <script src="/js/i18n-client.js?v=<%= Date.now() %>"></script>
-    <script src="/js/notifications.js?v=<%= Date.now() %>"></script>
-    <script src="/js/modal.js?v=<%= Date.now() %>"></script>
-    <script src="/js/app.js?v=<%= Date.now() %>"></script>
+    <script src="/js/utils.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/i18n-client.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/notifications.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/modal.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/app.js?v=<%= cacheVersion %>"></script>
     <% if (!embed) { %>
-    <script src="/js/desktop-mode.js?v=<%= Date.now() %>"></script>
+    <script src="/js/widget-plugins.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/desktop-widgets.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/desktop-mode.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/tutorial.js?v=<%= cacheVersion %>"></script>
     <% } %>
     <% if (typeof pageScripts !== 'undefined' && pageScripts.length) { %>
         <% pageScripts.forEach(script => { %>
-    <script src="/js/<%= script %>.js?v=<%= Date.now() %>"></script>
+    <script src="/js/<%= script %>.js?v=<%= cacheVersion %>"></script>
         <% }); %>
     <% } %>
 </body>
diff --git a/web-nodejs/views/layouts/viewer.ejs b/web-nodejs/views/layouts/viewer.ejs
index 8d49ada5..5288a1a7 100644
--- a/web-nodejs/views/layouts/viewer.ejs
+++ b/web-nodejs/views/layouts/viewer.ejs
@@ -14,9 +14,9 @@
     <link rel="stylesheet" href="https://fonts.googleapis.com/icon?family=Material+Icons">
     
     <!-- Stylesheets -->
-    <link rel="stylesheet" href="/css/variables.css">
-    <link rel="stylesheet" href="/css/theme.css">
-    <link rel="stylesheet" href="/css/remote.css">
+    <link rel="stylesheet" href="/css/variables.css?v=<%= cacheVersion %>">
+    <link rel="stylesheet" href="/css/theme.css?v=<%= cacheVersion %>">
+    <link rel="stylesheet" href="/css/remote.css?v=<%= cacheVersion %>">
 </head>
 <body class="viewer-body">
     <%- body %>
@@ -35,28 +35,28 @@
     </script>
     
     <!-- Translation helper -->
-    <script src="/js/i18n-client.js?v=<%= Date.now() %>"></script>
+    <script src="/js/i18n-client.js?v=<%= cacheVersion %>"></script>
     
     <!-- Vendor libraries for remote client -->
-    <script src="/js/vendor/protobuf.min.js"></script>
-    <script src="/js/vendor/nacl.min.js"></script>
-    <script src="/js/vendor/nacl-util.min.js"></script>
-    <script src="/js/vendor/jmuxer.min.js"></script>
+    <script src="/js/vendor/protobuf.min.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/vendor/nacl.min.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/vendor/nacl-util.min.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/vendor/jmuxer.min.js?v=<%= cacheVersion %>"></script>
     
     <!-- RDClient modules (order matters) -->
-    <script src="/js/rdclient/connection.js?v=<%= Date.now() %>"></script>
-    <script src="/js/rdclient/crypto.js?v=<%= Date.now() %>"></script>
-    <script src="/js/rdclient/protocol.js?v=<%= Date.now() %>"></script>
-    <script src="/js/rdclient/video.js?v=<%= Date.now() %>"></script>
-    <script src="/js/rdclient/audio.js?v=<%= Date.now() %>"></script>
-    <script src="/js/rdclient/renderer.js?v=<%= Date.now() %>"></script>
-    <script src="/js/rdclient/input.js?v=<%= Date.now() %>"></script>
-    <script src="/js/rdclient/client.js?v=<%= Date.now() %>"></script>
+    <script src="/js/rdclient/connection.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/rdclient/crypto.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/rdclient/protocol.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/rdclient/video.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/rdclient/audio.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/rdclient/renderer.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/rdclient/input.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/rdclient/client.js?v=<%= cacheVersion %>"></script>
     
     <!-- Page-specific scripts -->
     <% if (typeof pageScripts !== 'undefined' && pageScripts) { %>
         <% (Array.isArray(pageScripts) ? pageScripts : [pageScripts]).forEach(script => { %>
-    <script src="/js/<%= script %>.js?v=<%= Date.now() %>"></script>
+    <script src="/js/<%= script %>.js?v=<%= cacheVersion %>"></script>
         <% }); %>
     <% } %>
 </body>
diff --git a/web-nodejs/views/login.ejs b/web-nodejs/views/login.ejs
index e02ba09e..f4b7f11a 100644
--- a/web-nodejs/views/login.ejs
+++ b/web-nodejs/views/login.ejs
@@ -8,9 +8,9 @@
     <title><%= _('auth.login') %> - <%= appName %></title>
     
     <link rel="icon" type="image/svg+xml" href="/branding/favicon.svg">
-    <link rel="stylesheet" href="/css/main.css">
-    <link rel="stylesheet" href="/css/theme.css">
-    <link rel="stylesheet" href="/css/login.css">
+    <link rel="stylesheet" href="/css/main.css?v=<%= cacheVersion %>">
+    <link rel="stylesheet" href="/css/theme.css?v=<%= cacheVersion %>">
+    <link rel="stylesheet" href="/css/login.css?v=<%= cacheVersion %>">
 </head>
 <body class="login-page">
     <div class="login-container">
@@ -163,7 +163,7 @@
             branding: <%- JSON.stringify(branding || {}) %>
         };
     </script>
-    <script src="/js/utils.js"></script>
-    <script src="/js/login.js"></script>
+    <script src="/js/utils.js?v=<%= cacheVersion %>"></script>
+    <script src="/js/login.js?v=<%= cacheVersion %>"></script>
 </body>
 </html>
diff --git a/web-nodejs/views/network.ejs b/web-nodejs/views/network.ejs
new file mode 100644
index 00000000..314c6bdb
--- /dev/null
+++ b/web-nodejs/views/network.ejs
@@ -0,0 +1,184 @@
+<%- include('layouts/main', {
+    title: typeof title !== 'undefined' ? title : 'Network Monitor',
+    pageStyles: ['network'],
+    pageScripts: ['network'],
+    currentPage: 'network',
+    breadcrumb: [{ label: _('nav.management') }, { label: _('network.title') }],
+    body: `
+    <div class="page-header">
+        <h1>${_('network.title')}</h1>
+    </div>
+
+    <!-- Stats -->
+    <div class="stat-cards">
+        <div class="stat-card">
+            <div class="stat-icon"><span class="material-icons">dns</span></div>
+            <div class="stat-info">
+                <span class="stat-value" id="stat-total">0</span>
+                <span class="stat-label">${_('network.total_targets')}</span>
+            </div>
+        </div>
+        <div class="stat-card">
+            <div class="stat-icon online"><span class="material-icons">check_circle</span></div>
+            <div class="stat-info">
+                <span class="stat-value" id="stat-up">0</span>
+                <span class="stat-label">${_('network.targets_up')}</span>
+            </div>
+        </div>
+        <div class="stat-card">
+            <div class="stat-icon offline"><span class="material-icons">error</span></div>
+            <div class="stat-info">
+                <span class="stat-value" id="stat-down">0</span>
+                <span class="stat-label">${_('network.targets_down')}</span>
+            </div>
+        </div>
+        <div class="stat-card">
+            <div class="stat-icon"><span class="material-icons">speed</span></div>
+            <div class="stat-info">
+                <span class="stat-value" id="stat-avg-latency">—</span>
+                <span class="stat-label">${_('network.avg_latency')}</span>
+            </div>
+        </div>
+    </div>
+
+    <!-- Tab bar -->
+    <div class="tab-bar">
+        <button class="tab-btn active" data-tab="targets">${_('network.tab_targets')}</button>
+        <button class="tab-btn" data-tab="tools">${_('network.tab_tools')}</button>
+    </div>
+
+    <!-- Targets panel -->
+    <div class="tab-panel active" id="tab-targets">
+        <div class="panel-actions">
+            <div class="search-wrapper">
+                <span class="material-icons">search</span>
+                <input type="text" id="target-search" placeholder="${_('network.search_targets')}" />
+            </div>
+            <div class="panel-actions-right">
+                <button class="btn btn-secondary" id="monitor-toggle-btn">
+                    <span class="material-icons">play_arrow</span> ${_('network.monitor_start')}
+                </button>
+                <button class="btn btn-primary" id="create-target-btn">
+                    <span class="material-icons">add</span> ${_('network.add_target')}
+                </button>
+            </div>
+        </div>
+        <div class="table-wrapper">
+            <table class="data-table">
+                <thead>
+                    <tr>
+                        <th>${_('network.name')}</th>
+                        <th>${_('network.host')}</th>
+                        <th>${_('network.type')}</th>
+                        <th>${_('network.port')}</th>
+                        <th>${_('network.interval')}</th>
+                        <th>${_('network.status')}</th>
+                        <th>${_('network.latency')}</th>
+                        <th>${_('common.actions')}</th>
+                    </tr>
+                </thead>
+                <tbody id="targets-body"></tbody>
+            </table>
+        </div>
+    </div>
+
+    <!-- Tools panel -->
+    <div class="tab-panel" id="tab-tools">
+        <div class="tools-grid">
+            <div class="tool-card">
+                <h3><span class="material-icons">cell_tower</span> Ping</h3>
+                <div class="tool-form">
+                    <input type="text" id="tool-ping-host" placeholder="${_('network.host')}" />
+                    <button class="btn btn-primary" id="tool-ping-btn">Ping</button>
+                </div>
+                <div class="tool-result" id="tool-ping-result"></div>
+            </div>
+            <div class="tool-card">
+                <h3><span class="material-icons">cable</span> TCP</h3>
+                <div class="tool-form">
+                    <input type="text" id="tool-tcp-host" placeholder="${_('network.host')}" />
+                    <input type="number" id="tool-tcp-port" placeholder="${_('network.port')}" value="80" style="width:100px" />
+                    <button class="btn btn-primary" id="tool-tcp-btn">Check</button>
+                </div>
+                <div class="tool-result" id="tool-tcp-result"></div>
+            </div>
+            <div class="tool-card">
+                <h3><span class="material-icons">http</span> HTTP</h3>
+                <div class="tool-form">
+                    <input type="text" id="tool-http-url" placeholder="https://example.com" />
+                    <button class="btn btn-primary" id="tool-http-btn">Check</button>
+                </div>
+                <div class="tool-result" id="tool-http-result"></div>
+            </div>
+            <div class="tool-card">
+                <h3><span class="material-icons">dns</span> DNS</h3>
+                <div class="tool-form">
+                    <input type="text" id="tool-dns-host" placeholder="${_('network.host')}" />
+                    <button class="btn btn-primary" id="tool-dns-btn">Resolve</button>
+                </div>
+                <div class="tool-result" id="tool-dns-result"></div>
+            </div>
+        </div>
+    </div>
+
+    <!-- History modal -->
+    <div class="modal-overlay" id="history-modal" style="display:none">
+        <div class="modal modal-lg">
+            <div class="modal-header">
+                <h2 id="history-modal-title">${_('network.check_history')}</h2>
+                <button class="modal-close" data-modal="history-modal"><span class="material-icons">close</span></button>
+            </div>
+            <div class="modal-body" id="history-body"></div>
+        </div>
+    </div>
+
+    <!-- Target modal -->
+    <div class="modal-overlay" id="target-modal" style="display:none">
+        <div class="modal">
+            <div class="modal-header">
+                <h2 id="target-modal-title">${_('network.add_target')}</h2>
+                <button class="modal-close" data-modal="target-modal"><span class="material-icons">close</span></button>
+            </div>
+            <div class="modal-body">
+                <input type="hidden" id="target-id" />
+                <div class="form-row">
+                    <label for="target-name">${_('network.name')}</label>
+                    <input type="text" id="target-name" />
+                </div>
+                <div class="form-row">
+                    <label for="target-host">${_('network.host')}</label>
+                    <input type="text" id="target-host" placeholder="192.168.1.1 or example.com" />
+                </div>
+                <div class="form-row">
+                    <label for="target-type">${_('network.type')}</label>
+                    <select id="target-type">
+                        <option value="ping">Ping (ICMP)</option>
+                        <option value="tcp">TCP Port</option>
+                        <option value="http">HTTP(S)</option>
+                    </select>
+                </div>
+                <div class="form-row">
+                    <label for="target-port">${_('network.port')}</label>
+                    <input type="number" id="target-port" value="80" />
+                </div>
+                <div class="form-row">
+                    <label for="target-interval">${_('network.interval')}</label>
+                    <select id="target-interval">
+                        <option value="30">30s</option>
+                        <option value="60" selected>60s</option>
+                        <option value="300">5m</option>
+                        <option value="600">10m</option>
+                    </select>
+                </div>
+                <div class="form-row">
+                    <label><input type="checkbox" id="target-enabled" checked /> ${_('network.enabled')}</label>
+                </div>
+            </div>
+            <div class="modal-footer">
+                <button class="btn btn-secondary" onclick="document.getElementById('target-modal').style.display='none'">${_('common.cancel')}</button>
+                <button class="btn btn-primary" id="target-save-btn">${_('common.save')}</button>
+            </div>
+        </div>
+    </div>
+    `
+}) %>
diff --git a/web-nodejs/views/partials/navbar.ejs b/web-nodejs/views/partials/navbar.ejs
index 44998b74..eceb1529 100644
--- a/web-nodejs/views/partials/navbar.ejs
+++ b/web-nodejs/views/partials/navbar.ejs
@@ -14,8 +14,10 @@
                     <span class="separator">/</span>
                     <% if (index === breadcrumb.length - 1) { %>
                         <span class="current"><%= item.label %></span>
-                    <% } else { %>
+                    <% } else if (item.href) { %>
                         <a href="<%= item.href %>"><%= item.label %></a>
+                    <% } else { %>
+                        <span class="breadcrumb-section"><%= item.label %></span>
                     <% } %>
                 <% }); %>
             <% } %>
@@ -28,9 +30,10 @@
             <span class="material-icons">refresh</span>
         </button>
         
-        <!-- Desktop mode toggle (visible only on large screens) -->
-        <button class="navbar-btn desktop-toggle-btn" id="desktop-toggle-btn" title="<%= _('desktop.switch_mode') %>">
+        <!-- Desktop mode toggle (Beta) - visible only on large screens -->
+        <button class="navbar-btn desktop-toggle-btn" id="desktop-toggle-btn" title="<%= _('desktop.switch_mode') %> (Beta)">
             <span class="material-icons">desktop_windows</span>
+            <span class="beta-badge">BETA</span>
         </button>
         
         <!-- Language selector -->
diff --git a/web-nodejs/views/partials/sidebar.ejs b/web-nodejs/views/partials/sidebar.ejs
index 43b167df..26311090 100644
--- a/web-nodejs/views/partials/sidebar.ejs
+++ b/web-nodejs/views/partials/sidebar.ejs
@@ -37,10 +37,55 @@
             </a>
         </div>
         
+        <!-- Management Section -->
+        <div class="sidebar-section">
+            <div class="sidebar-section-title"><%= _('nav.management') || 'Management' %></div>
+            
+            <a href="/inventory" class="sidebar-link <%= currentPage === 'inventory' ? 'active' : '' %>">
+                <span class="material-icons">inventory_2</span>
+                <span class="sidebar-link-text"><%= _('nav.inventory') %></span>
+            </a>
+            
+            <a href="/tickets" class="sidebar-link <%= currentPage === 'tickets' ? 'active' : '' %>">
+                <span class="material-icons">confirmation_number</span>
+                <span class="sidebar-link-text"><%= _('nav.tickets') %></span>
+            </a>
+
+            <a href="/help-requests" class="sidebar-link <%= currentPage === 'help-requests' ? 'active' : '' %>">
+                <span class="material-icons">support_agent</span>
+                <span class="sidebar-link-text"><%= _('nav.help_requests') %></span>
+            </a>
+            
+            <a href="/automation" class="sidebar-link <%= currentPage === 'automation' ? 'active' : '' %>">
+                <span class="material-icons">smart_toy</span>
+                <span class="sidebar-link-text"><%= _('nav.automation') %></span>
+            </a>
+            
+            <a href="/network" class="sidebar-link <%= currentPage === 'network' ? 'active' : '' %>">
+                <span class="material-icons">lan</span>
+                <span class="sidebar-link-text"><%= _('nav.network') %></span>
+            </a>
+            
+            <a href="/activity" class="sidebar-link <%= currentPage === 'activity' ? 'active' : '' %>">
+                <span class="material-icons">timeline</span>
+                <span class="sidebar-link-text"><%= _('nav.activity') %></span>
+            </a>
+            
+            <a href="/cdap" class="sidebar-link <%= currentPage === 'cdap' ? 'active' : '' %>">
+                <span class="material-icons">developer_board</span>
+                <span class="sidebar-link-text"><%= _('nav.cdap') %></span>
+            </a>
+        </div>
+        
         <!-- Tools Section -->
         <div class="sidebar-section">
             <div class="sidebar-section-title"><%= _('nav.tools') %></div>
             
+            <a href="/reports" class="sidebar-link <%= currentPage === 'reports' ? 'active' : '' %>">
+                <span class="material-icons">assessment</span>
+                <span class="sidebar-link-text"><%= _('nav.reports') %></span>
+            </a>
+            
             <a href="/keys" class="sidebar-link <%= currentPage === 'keys' ? 'active' : '' %>">
                 <span class="material-icons">vpn_key</span>
                 <span class="sidebar-link-text"><%= _('nav.keys') %></span>
@@ -57,6 +102,21 @@
             <div class="sidebar-section-title"><%= _('nav.system') %></div>
             
             <% if (user && user.role === 'admin') { %>
+            <a href="/tokens" class="sidebar-link <%= currentPage === 'tokens' ? 'active' : '' %>">
+                <span class="material-icons">token</span>
+                <span class="sidebar-link-text"><%= _('nav.tokens') %></span>
+            </a>
+            
+            <a href="/tenants" class="sidebar-link <%= currentPage === 'tenants' ? 'active' : '' %>">
+                <span class="material-icons">business</span>
+                <span class="sidebar-link-text"><%= _('nav.tenants') %></span>
+            </a>
+            
+            <a href="/dataguard" class="sidebar-link <%= currentPage === 'dataguard' ? 'active' : '' %>">
+                <span class="material-icons">shield</span>
+                <span class="sidebar-link-text"><%= _('nav.dataguard') %></span>
+            </a>
+            
             <a href="/users" class="sidebar-link <%= currentPage === 'users' ? 'active' : '' %>">
                 <span class="material-icons">group</span>
                 <span class="sidebar-link-text"><%= _('nav.users') %></span>
@@ -83,3 +143,28 @@
         </div>
     </div>
 </aside>
+<script>
+// Preserve sidebar scroll position across page navigations
+(function() {
+    var nav = document.querySelector('.sidebar-nav');
+    if (!nav) return;
+    var KEY = 'bd_sidebar_scroll';
+    try {
+        var saved = sessionStorage.getItem(KEY);
+        if (saved) nav.scrollTop = parseInt(saved, 10) || 0;
+    } catch(e) {}
+    // Also scroll active link into view if not visible
+    var active = nav.querySelector('.sidebar-link.active');
+    if (active) {
+        var rect = active.getBoundingClientRect();
+        var navRect = nav.getBoundingClientRect();
+        if (rect.top < navRect.top || rect.bottom > navRect.bottom) {
+            active.scrollIntoView({ block: 'center' });
+        }
+    }
+    // Save scroll on navigation
+    window.addEventListener('beforeunload', function() {
+        try { sessionStorage.setItem(KEY, String(nav.scrollTop)); } catch(e) {}
+    });
+})();
+</script>
diff --git a/web-nodejs/views/remote.ejs b/web-nodejs/views/remote.ejs
index 76a355a1..224c925b 100644
--- a/web-nodejs/views/remote.ejs
+++ b/web-nodejs/views/remote.ejs
@@ -3,15 +3,15 @@
     pageScripts: ['remote'],
     body: `
 
-<!-- Work In Progress Banner -->
-<div class="wip-banner" style="background: linear-gradient(90deg, #f59e0b 0%, #d97706 100%); color: #fff; padding: 12px 20px; text-align: center; font-weight: 500; display: flex; align-items: center; justify-content: center; gap: 10px; position: fixed; top: 0; left: 0; right: 0; z-index: 10000; box-shadow: 0 2px 10px rgba(0,0,0,0.2);">
-    <span class="material-icons" style="font-size: 20px;">construction</span>
-    <span>${_('remote.wip_notice') || 'Web Remote Client is currently under development and may not work as expected. For reliable connections, please use the RustDesk desktop client.'}</span>
-    <span class="material-icons" style="font-size: 20px;">construction</span>
+<!-- Beta Notice Banner (dismissible) -->
+<div class="beta-banner" id="beta-banner" style="background: linear-gradient(90deg, #1f6feb 0%, #388bfd 100%); color: #fff; padding: 8px 20px; text-align: center; font-weight: 500; display: flex; align-items: center; justify-content: center; gap: 10px; position: fixed; top: 0; left: 0; right: 0; z-index: 10000; box-shadow: 0 2px 10px rgba(0,0,0,0.2); font-size: 13px;">
+    <span class="material-icons" style="font-size: 16px;">info</span>
+    <span>${_('remote.beta_notice') || 'Web Remote Client — Beta. Some features may not work as expected.'}</span>
+    <button onclick="document.getElementById('beta-banner').style.display='none'; document.getElementById('viewer-container').style.marginTop='0';" style="background: rgba(255,255,255,0.2); border: none; color: #fff; padding: 2px 8px; border-radius: 4px; cursor: pointer; margin-left: 8px; font-size: 12px;">✕</button>
 </div>
 
 <!-- Remote Desktop Viewer -->
-<div class="viewer-container" id="viewer-container" style="margin-top: 48px;">
+<div class="viewer-container" id="viewer-container" style="margin-top: 36px;">
 
     <!-- Connection overlay (shown before/during connection) -->
     <div class="viewer-overlay" id="connection-overlay">
diff --git a/web-nodejs/views/reports.ejs b/web-nodejs/views/reports.ejs
new file mode 100644
index 00000000..c5a97686
--- /dev/null
+++ b/web-nodejs/views/reports.ejs
@@ -0,0 +1,115 @@
+<%- include('layouts/main', {
+    title: typeof title !== 'undefined' ? title : 'Reports',
+    pageStyles: ['reports'],
+    pageScripts: ['reports'],
+    currentPage: 'reports',
+    breadcrumb: [{ label: _('nav.tools') }, { label: _('reports.title') }],
+    body: `
+    <div class="page-header">
+        <h1>${_('reports.title')}</h1>
+    </div>
+
+    <!-- Tab bar -->
+    <div class="tab-bar">
+        <button class="tab-btn active" data-tab="generate">${_('reports.tab_generate')}</button>
+        <button class="tab-btn" data-tab="saved">${_('reports.tab_saved')}</button>
+    </div>
+
+    <!-- Generate panel -->
+    <div class="tab-panel active" id="tab-generate">
+        <div class="report-type-grid">
+            <div class="report-type-card" data-type="devices">
+                <span class="material-icons">devices</span>
+                <h3>${_('reports.type_devices')}</h3>
+                <p>${_('reports.type_devices_desc')}</p>
+            </div>
+            <div class="report-type-card" data-type="activity">
+                <span class="material-icons">timeline</span>
+                <h3>${_('reports.type_activity')}</h3>
+                <p>${_('reports.type_activity_desc')}</p>
+            </div>
+            <div class="report-type-card" data-type="security">
+                <span class="material-icons">security</span>
+                <h3>${_('reports.type_security')}</h3>
+                <p>${_('reports.type_security_desc')}</p>
+            </div>
+            <div class="report-type-card" data-type="tickets">
+                <span class="material-icons">confirmation_number</span>
+                <h3>${_('reports.type_tickets')}</h3>
+                <p>${_('reports.type_tickets_desc')}</p>
+            </div>
+            <div class="report-type-card" data-type="network">
+                <span class="material-icons">lan</span>
+                <h3>${_('reports.type_network')}</h3>
+                <p>${_('reports.type_network_desc')}</p>
+            </div>
+            <div class="report-type-card" data-type="inventory">
+                <span class="material-icons">inventory_2</span>
+                <h3>${_('reports.type_inventory')}</h3>
+                <p>${_('reports.type_inventory_desc')}</p>
+            </div>
+            <div class="report-type-card" data-type="alerts">
+                <span class="material-icons">notifications</span>
+                <h3>${_('reports.type_alerts')}</h3>
+                <p>${_('reports.type_alerts_desc')}</p>
+            </div>
+        </div>
+
+        <!-- Report options -->
+        <div class="report-options" id="report-options" style="display:none">
+            <h3 id="report-options-title"></h3>
+            <div class="form-row">
+                <label for="report-from">${_('reports.date_from')}</label>
+                <input type="date" id="report-from" />
+            </div>
+            <div class="form-row">
+                <label for="report-to">${_('reports.date_to')}</label>
+                <input type="date" id="report-to" />
+            </div>
+            <div class="form-row">
+                <label for="report-format">${_('reports.format')}</label>
+                <select id="report-format">
+                    <option value="json">JSON</option>
+                    <option value="csv">CSV</option>
+                </select>
+            </div>
+            <div class="form-actions">
+                <button class="btn btn-primary" id="generate-btn">
+                    <span class="material-icons">play_arrow</span> ${_('reports.generate')}
+                </button>
+                <button class="btn btn-secondary" id="save-report-btn">
+                    <span class="material-icons">save</span> ${_('reports.save')}
+                </button>
+            </div>
+        </div>
+
+        <!-- Preview -->
+        <div class="report-preview" id="report-preview" style="display:none">
+            <div class="report-preview-header">
+                <h3>${_('reports.preview')}</h3>
+                <button class="btn btn-sm btn-secondary" id="download-btn">
+                    <span class="material-icons" style="font-size:16px">download</span> ${_('reports.download')}
+                </button>
+            </div>
+            <div id="preview-content" class="report-output"></div>
+        </div>
+    </div>
+
+    <!-- Saved panel -->
+    <div class="tab-panel" id="tab-saved">
+        <div class="table-wrapper">
+            <table class="data-table">
+                <thead>
+                    <tr>
+                        <th>${_('reports.report_name')}</th>
+                        <th>${_('reports.report_type')}</th>
+                        <th>${_('reports.created_at')}</th>
+                        <th>${_('common.actions')}</th>
+                    </tr>
+                </thead>
+                <tbody id="saved-body"></tbody>
+            </table>
+        </div>
+    </div>
+    `
+}) %>
diff --git a/web-nodejs/views/tenants.ejs b/web-nodejs/views/tenants.ejs
new file mode 100644
index 00000000..d9640379
--- /dev/null
+++ b/web-nodejs/views/tenants.ejs
@@ -0,0 +1,108 @@
+<%- include('layouts/main', {
+    title: typeof title !== 'undefined' ? title : 'Tenants',
+    pageStyles: ['tenants'],
+    pageScripts: ['tenants'],
+    currentPage: 'tenants',
+    breadcrumb: [{ label: _('nav.system') }, { label: _('tenants.title') }],
+    body: `
+    <div class="page-header">
+        <h1>${_('tenants.title')}</h1>
+    </div>
+
+    <!-- Stats -->
+    <div class="stat-cards">
+        <div class="stat-card">
+            <div class="stat-icon primary"><span class="material-icons">business</span></div>
+            <div class="stat-info">
+                <span class="stat-value" id="stat-tenants">0</span>
+                <span class="stat-label">${_('tenants.total_tenants')}</span>
+            </div>
+        </div>
+        <div class="stat-card">
+            <div class="stat-icon success"><span class="material-icons">check_circle</span></div>
+            <div class="stat-info">
+                <span class="stat-value" id="stat-active">0</span>
+                <span class="stat-label">${_('tenants.active_tenants')}</span>
+            </div>
+        </div>
+        <div class="stat-card">
+            <div class="stat-icon warning"><span class="material-icons">devices</span></div>
+            <div class="stat-info">
+                <span class="stat-value" id="stat-devices">0</span>
+                <span class="stat-label">${_('tenants.total_devices')}</span>
+            </div>
+        </div>
+        <div class="stat-card">
+            <div class="stat-icon primary"><span class="material-icons">people</span></div>
+            <div class="stat-info">
+                <span class="stat-value" id="stat-users">0</span>
+                <span class="stat-label">${_('tenants.total_users')}</span>
+            </div>
+        </div>
+    </div>
+
+    <!-- Tenant list -->
+    <div class="panel-actions">
+        <div class="search-wrapper">
+            <span class="material-icons">search</span>
+            <input type="text" id="tenant-search" placeholder="${_('tenants.search')}" />
+        </div>
+        <button class="btn btn-primary" id="create-tenant-btn">
+            <span class="material-icons">add</span> ${_('tenants.create_tenant')}
+        </button>
+    </div>
+
+    <div class="tenants-grid" id="tenants-grid"></div>
+
+    <!-- Tenant detail modal -->
+    <div class="modal-overlay" id="detail-modal" style="display:none">
+        <div class="modal modal-lg">
+            <div class="modal-header">
+                <h2 id="detail-modal-title">${_('tenants.detail')}</h2>
+                <button class="modal-close" data-modal="detail-modal"><span class="material-icons">close</span></button>
+            </div>
+            <div class="modal-body" id="detail-body"></div>
+        </div>
+    </div>
+
+    <!-- Tenant form modal -->
+    <div class="modal-overlay" id="form-modal" style="display:none">
+        <div class="modal">
+            <div class="modal-header">
+                <h2 id="form-modal-title">${_('tenants.create_tenant')}</h2>
+                <button class="modal-close" data-modal="form-modal"><span class="material-icons">close</span></button>
+            </div>
+            <div class="modal-body">
+                <input type="hidden" id="tenant-id" />
+                <div class="form-row">
+                    <label for="tenant-name">${_('tenants.name')}</label>
+                    <input type="text" id="tenant-name" />
+                </div>
+                <div class="form-row">
+                    <label for="tenant-slug">${_('tenants.slug')}</label>
+                    <input type="text" id="tenant-slug" placeholder="my-company" />
+                </div>
+                <div class="form-row">
+                    <label for="tenant-contact-name">${_('tenants.contact_name')}</label>
+                    <input type="text" id="tenant-contact-name" />
+                </div>
+                <div class="form-row">
+                    <label for="tenant-contact-email">${_('tenants.contact_email')}</label>
+                    <input type="email" id="tenant-contact-email" />
+                </div>
+                <div class="form-row">
+                    <label for="tenant-max-devices">${_('tenants.max_devices')}</label>
+                    <input type="number" id="tenant-max-devices" value="100" />
+                </div>
+                <div class="form-row">
+                    <label><input type="checkbox" id="tenant-active" checked /> ${_('tenants.enabled')}</label>
+                </div>
+            </div>
+            <div class="modal-footer">
+                <button class="btn btn-secondary" onclick="document.getElementById('form-modal').style.display='none'">${_('common.cancel')}</button>
+                <button class="btn btn-primary" id="tenant-save-btn">${_('common.save')}</button>
+            </div>
+        </div>
+    </div>
+    `
+}) %>
diff --git a/web-nodejs/views/tickets.ejs b/web-nodejs/views/tickets.ejs
new file mode 100644
index 00000000..1531c208
--- /dev/null
+++ b/web-nodejs/views/tickets.ejs
@@ -0,0 +1,158 @@
+<%- include('layouts/main', {
+    title: _('tickets.title'),
+    pageStyles: ['tickets'],
+    pageScripts: ['tickets'],
+    currentPage: 'tickets',
+    breadcrumb: [{ label: _('tickets.title') }],
+    body: `
+        <div class="tickets-page">
+            <!-- Header -->
+            <div class="page-header">
+                <div class="page-title">
+                    <h1>${_('tickets.title')}</h1>
+                </div>
+                <p class="page-subtitle">${_('tickets.subtitle')}</p>
+            </div>
+
+            <!-- Stats -->
+            <div class="tickets-stats" id="tickets-stats">
+                <div class="stat-card stat-total">
+                    <span class="stat-value" id="stat-total">0</span>
+                    <span class="stat-label">${_('tickets.stats_total')}</span>
+                </div>
+                <div class="stat-card stat-open">
+                    <span class="stat-value" id="stat-open">0</span>
+                    <span class="stat-label">${_('tickets.stats_open')}</span>
+                </div>
+                <div class="stat-card stat-progress">
+                    <span class="stat-value" id="stat-progress">0</span>
+                    <span class="stat-label">${_('tickets.stats_in_progress')}</span>
+                </div>
+                <div class="stat-card stat-resolved">
+                    <span class="stat-value" id="stat-resolved">0</span>
+                    <span class="stat-label">${_('tickets.stats_resolved')}</span>
+                </div>
+            </div>
+
+            <!-- Filters -->
+            <div class="page-filters">
+                <div class="search-wrapper">
+                    <span class="material-icons">search</span>
+                    <input type="text" class="form-input" id="search-input"
+                        placeholder="${_('tickets.search_placeholder')}">
+                </div>
+                <div class="filter-buttons">
+                    <button class="btn filter-btn active" data-status="">${_('tickets.filter_all')}</button>
+                    <button class="btn filter-btn" data-status="open">${_('tickets.status_open')}</button>
+                    <button class="btn filter-btn" data-status="in_progress">${_('tickets.status_in_progress')}</button>
+                    <button class="btn filter-btn" data-status="resolved">${_('tickets.status_resolved')}</button>
+                    <button class="btn filter-btn" data-status="closed">${_('tickets.status_closed')}</button>
+                </div>
+                <button class="btn btn-primary" id="create-ticket-btn">
+                    <span class="material-icons">add</span>
+                    <span>${_('tickets.create')}</span>
+                </button>
+            </div>
+
+            <!-- Tickets Table -->
+            <div class="table-wrapper">
+                <table class="data-table" id="tickets-table">
+                    <thead>
+                        <tr>
+                            <th>#</th>
+                            <th>${_('tickets.ticket_title')}</th>
+                            <th>${_('tickets.status')}</th>
+                            <th>${_('tickets.priority')}</th>
+                            <th>${_('tickets.category')}</th>
+                            <th>${_('tickets.assigned_to')}</th>
+                            <th>${_('tickets.device')}</th>
+                            <th>${_('tickets.created_at')}</th>
+                            <th>${_('common.actions')}</th>
+                        </tr>
+                    </thead>
+                    <tbody id="tickets-body">
+                        <tr class="empty-row">
+                            <td colspan="9">
+                                <div class="empty-state">
+                                    <span class="material-icons">confirmation_number</span>
+                                    <p>${_('tickets.no_tickets')}</p>
+                                </div>
+                            </td>
+                        </tr>
+                    </tbody>
+                </table>
+            </div>
+
+            <!-- Create/Edit Modal -->
+            <div class="modal-overlay" id="ticket-modal" style="display: none;">
+                <div class="modal modal-lg">
+                    <div class="modal-header">
+                        <h3 id="ticket-modal-title">${_('tickets.create')}</h3>
+                        <button class="btn-icon modal-close" data-modal="ticket-modal">
+                            <span class="material-icons">close</span>
+                        </button>
+                    </div>
+                    <div class="modal-body">
+                        <form id="ticket-form">
+                            <input type="hidden" id="ticket-id">
+                            <div class="form-group">
+                                <label for="ticket-title">${_('tickets.ticket_title')} *</label>
+                                <input type="text" class="form-input" id="ticket-title" required maxlength="200">
+                            </div>
+                            <div class="form-group">
+                                <label for="ticket-desc">${_('tickets.description')}</label>
+                                <textarea class="form-input" id="ticket-desc" rows="4" maxlength="5000"></textarea>
+                            </div>
+                            <div class="form-row">
+                                <div class="form-group">
+                                    <label for="ticket-priority">${_('tickets.priority')}</label>
+                                    <select class="form-input" id="ticket-priority">
+                                        <option value="low">${_('tickets.priority_low')}</option>
+                                        <option value="medium" selected>${_('tickets.priority_medium')}</option>
+                                        <option value="high">${_('tickets.priority_high')}</option>
+                                        <option value="critical">${_('tickets.priority_critical')}</option>
+                                    </select>
+                                </div>
+                                <div class="form-group">
+                                    <label for="ticket-category">${_('tickets.category')}</label>
+                                    <select class="form-input" id="ticket-category">
+                                        <option value="general">${_('tickets.category_general')}</option>
+                                        <option value="hardware">${_('tickets.category_hardware')}</option>
+                                        <option value="software">${_('tickets.category_software')}</option>
+                                        <option value="network">${_('tickets.category_network')}</option>
+                                        <option value="access">${_('tickets.category_access')}</option>
+                                        <option value="other">${_('tickets.category_other')}</option>
+                                    </select>
+                                </div>
+                            </div>
+                            <div class="form-group">
+                                <label for="ticket-device">${_('tickets.device')}</label>
+                                <input type="text" class="form-input" id="ticket-device" placeholder="Device ID (optional)">
+                            </div>
+                        </form>
+                    </div>
+                    <div class="modal-footer">
+                        <button class="btn btn-secondary modal-close" data-modal="ticket-modal">${_('common.cancel')}</button>
+                        <button class="btn btn-primary" id="ticket-save-btn">${_('common.save')}</button>
+                    </div>
+                </div>
+            </div>
+
+            <!-- Detail Modal -->
+            <div class="modal-overlay" id="detail-modal" style="display: none;">
+                <div class="modal modal-lg">
+                    <div class="modal-header">
+                        <h3 id="detail-title">${_('tickets.detail')}</h3>
+                        <button class="btn-icon modal-close" data-modal="detail-modal">
+                            <span class="material-icons">close</span>
+                        </button>
+                    </div>
+                    <div class="modal-body" id="detail-body"></div>
+                    <div class="modal-footer">
+                        <button class="btn btn-secondary modal-close" data-modal="detail-modal">${_('actions.close')}</button>
+                    </div>
+                </div>
+            </div>
+        </div>
+    `
+}) %>
diff --git a/web-nodejs/views/tokens.ejs b/web-nodejs/views/tokens.ejs
new file mode 100644
index 00000000..8f15808b
--- /dev/null
+++ b/web-nodejs/views/tokens.ejs
@@ -0,0 +1,237 @@
+<%- include('layouts/main', {
+    title: _('tokens.title'),
+    pageStyles: ['tokens'],
+    pageScripts: ['tokens'],
+    currentPage: 'tokens',
+    breadcrumb: [{ label: _('tokens.title') }],
+    body: `
+        <div class="tokens-page">
+            <!-- Header -->
+            <div class="page-header">
+                <div class="page-title">
+                    <h1>${_('tokens.title')}</h1>
+                </div>
+                <p class="page-subtitle">${_('tokens.subtitle')}</p>
+            </div>
+
+            <!-- Enrollment Mode -->
+            <div class="enrollment-mode-card" id="enrollment-mode-card">
+                <div class="enrollment-mode-header">
+                    <span class="material-icons">security</span>
+                    <h3>${_('tokens.enrollment_mode')}</h3>
+                </div>
+                <div class="enrollment-mode-options">
+                    <label class="enrollment-option">
+                        <input type="radio" name="enrollment_mode" value="open">
+                        <span class="option-label">${_('tokens.mode_open')}</span>
+                        <span class="option-desc">${_('tokens.mode_open_desc')}</span>
+                    </label>
+                    <label class="enrollment-option">
+                        <input type="radio" name="enrollment_mode" value="managed">
+                        <span class="option-label">${_('tokens.mode_managed')}</span>
+                        <span class="option-desc">${_('tokens.mode_managed_desc')}</span>
+                    </label>
+                    <label class="enrollment-option">
+                        <input type="radio" name="enrollment_mode" value="locked">
+                        <span class="option-label">${_('tokens.mode_locked')}</span>
+                        <span class="option-desc">${_('tokens.mode_locked_desc')}</span>
+                    </label>
+                </div>
+            </div>
+
+            <!-- Stats Cards -->
+            <div class="tokens-stats" id="tokens-stats">
+                <div class="stat-card">
+                    <span class="material-icons stat-icon">vpn_key</span>
+                    <div class="stat-info">
+                        <div class="stat-value" id="stat-total">0</div>
+                        <div class="stat-label">${_('tokens.total')}</div>
+                    </div>
+                </div>
+                <div class="stat-card">
+                    <span class="material-icons stat-icon primary">check_circle</span>
+                    <div class="stat-info">
+                        <div class="stat-value" id="stat-active">0</div>
+                        <div class="stat-label">${_('tokens.active')}</div>
+                    </div>
+                </div>
+                <div class="stat-card">
+                    <span class="material-icons stat-icon warning">link</span>
+                    <div class="stat-info">
+                        <div class="stat-value" id="stat-used">0</div>
+                        <div class="stat-label">${_('tokens.used')}</div>
+                    </div>
+                </div>
+                <div class="stat-card">
+                    <span class="material-icons stat-icon offline">block</span>
+                    <div class="stat-info">
+                        <div class="stat-value" id="stat-revoked">0</div>
+                        <div class="stat-label">${_('tokens.revoked')}</div>
+                    </div>
+                </div>
+            </div>
+
+            <!-- Toolbar -->
+            <div class="tokens-toolbar">
+                <div class="toolbar-left">
+                    <div class="search-wrapper">
+                        <span class="material-icons">search</span>
+                        <input type="text" id="token-search" placeholder="${_('tokens.search_placeholder')}">
+                    </div>
+                    <div class="filter-pills">
+                        <button class="filter-pill active" data-filter="all">${_('common.all')}</button>
+                        <button class="filter-pill" data-filter="pending">${_('tokens.status_pending')}</button>
+                        <button class="filter-pill" data-filter="used">${_('tokens.status_used')}</button>
+                        <button class="filter-pill" data-filter="revoked">${_('tokens.status_revoked')}</button>
+                    </div>
+                </div>
+                <div class="toolbar-right">
+                    <button class="btn btn-secondary" onclick="Tokens.showBulkModal()">
+                        <span class="material-icons">playlist_add</span>
+                        ${_('tokens.bulk_generate')}
+                    </button>
+                    <button class="btn btn-primary" onclick="Tokens.showCreateModal()">
+                        <span class="material-icons">add</span>
+                        ${_('tokens.create')}
+                    </button>
+                </div>
+            </div>
+
+            <!-- Tokens Table -->
+            <div class="tokens-table-wrapper">
+                <table class="data-table" id="tokens-table">
+                    <thead>
+                        <tr>
+                            <th>${_('tokens.token')}</th>
+                            <th>${_('tokens.name')}</th>
+                            <th>${_('tokens.status')}</th>
+                            <th>${_('tokens.uses')}</th>
+                            <th>${_('tokens.bound_peer')}</th>
+                            <th>${_('tokens.expires')}</th>
+                            <th>${_('tokens.created')}</th>
+                            <th>${_('common.actions')}</th>
+                        </tr>
+                    </thead>
+                    <tbody id="tokens-body">
+                        <tr><td colspan="8" class="empty-row">${_('common.loading')}</td></tr>
+                    </tbody>
+                </table>
+            </div>
+
+            <!-- Create/Edit Token Modal -->
+            <div class="modal-overlay" id="token-modal" style="display:none">
+                <div class="modal">
+                    <div class="modal-header">
+                        <h3 id="token-modal-title">${_('tokens.create')}</h3>
+                        <button class="modal-close" onclick="Tokens.closeModal()">
+                            <span class="material-icons">close</span>
+                        </button>
+                    </div>
+                    <div class="modal-body">
+                        <input type="hidden" id="token-id">
+                        <div class="form-row">
+                            <div class="form-group">
+                                <label>${_('tokens.name')}</label>
+                                <input type="text" id="token-name" placeholder="${_('tokens.name_placeholder')}">
+                            </div>
+                            <div class="form-group">
+                                <label>${_('tokens.max_uses')}</label>
+                                <input type="number" id="token-max-uses" value="1" min="0">
+                                <small>${_('tokens.max_uses_hint')}</small>
+                            </div>
+                        </div>
+                        <div class="form-row">
+                            <div class="form-group">
+                                <label>${_('tokens.expires_in')}</label>
+                                <select id="token-expires">
+                                    <option value="0">${_('tokens.no_expiration')}</option>
+                                    <option value="3600">${_('tokens.expires_1h')}</option>
+                                    <option value="86400">${_('tokens.expires_24h')}</option>
+                                    <option value="604800">${_('tokens.expires_7d')}</option>
+                                    <option value="2592000">${_('tokens.expires_30d')}</option>
+                                </select>
+                            </div>
+                            <div class="form-group">
+                                <label>${_('tokens.note')}</label>
+                                <input type="text" id="token-note" placeholder="${_('tokens.note_placeholder')}">
+                            </div>
+                        </div>
+                    </div>
+                    <div class="modal-footer">
+                        <button class="btn btn-secondary" onclick="Tokens.closeModal()">${_('common.cancel')}</button>
+                        <button class="btn btn-primary" onclick="Tokens.saveToken()">${_('common.save')}</button>
+                    </div>
+                </div>
+            </div>
+
+            <!-- Bulk Generate Modal -->
+            <div class="modal-overlay" id="bulk-modal" style="display:none">
+                <div class="modal">
+                    <div class="modal-header">
+                        <h3>${_('tokens.bulk_generate')}</h3>
+                        <button class="modal-close" onclick="Tokens.closeBulkModal()">
+                            <span class="material-icons">close</span>
+                        </button>
+                    </div>
+                    <div class="modal-body">
+                        <div class="form-row">
+                            <div class="form-group">
+                                <label>${_('tokens.count')}</label>
+                                <input type="number" id="bulk-count" value="5" min="1" max="100">
+                            </div>
+                            <div class="form-group">
+                                <label>${_('tokens.name_prefix')}</label>
+                                <input type="text" id="bulk-prefix" value="Device" placeholder="Device">
+                            </div>
+                        </div>
+                        <div class="form-row">
+                            <div class="form-group">
+                                <label>${_('tokens.max_uses')}</label>
+                                <input type="number" id="bulk-max-uses" value="1" min="0">
+                            </div>
+                            <div class="form-group">
+                                <label>${_('tokens.expires_in')}</label>
+                                <select id="bulk-expires">
+                                    <option value="0">${_('tokens.no_expiration')}</option>
+                                    <option value="3600">${_('tokens.expires_1h')}</option>
+                                    <option value="86400">${_('tokens.expires_24h')}</option>
+                                    <option value="604800" selected>${_('tokens.expires_7d')}</option>
+                                    <option value="2592000">${_('tokens.expires_30d')}</option>
+                                </select>
+                            </div>
+                        </div>
+                    </div>
+                    <div class="modal-footer">
+                        <button class="btn btn-secondary" onclick="Tokens.closeBulkModal()">${_('common.cancel')}</button>
+                        <button class="btn btn-primary" onclick="Tokens.generateBulk()">
+                            <span class="material-icons">playlist_add</span>
+                            ${_('tokens.generate')}
+                        </button>
+                    </div>
+                </div>
+            </div>
+
+            <!-- Token Created Success Modal -->
+            <div class="modal-overlay" id="token-created-modal" style="display:none">
+                <div class="modal">
+                    <div class="modal-header">
+                        <h3>${_('tokens.token_created')}</h3>
+                        <button class="modal-close" onclick="Tokens.closeCreatedModal()">
+                            <span class="material-icons">close</span>
+                        </button>
+                    </div>
+                    <div class="modal-body">
+                        <div class="token-created-warning">
+                            <span class="material-icons">warning</span>
+                            <p>${_('tokens.copy_warning')}</p>
+                        </div>
+                        <div class="token-display" id="created-tokens-list"></div>
+                    </div>
+                    <div class="modal-footer">
+                        <button class="btn btn-primary" onclick="Tokens.closeCreatedModal()">${_('common.close')}</button>
+                    </div>
+                </div>
+            </div>
+        </div>
+    `
+}) %>