[fix] route unelevated Windows input through service

apps/desktop/src/platform/windows/service/desktop_transition_policy.h

@@ -19,6 +19,18 @@ inline bool PreferUserDesktopInput(bool user_desktop_active,
   return user_desktop_active && !consent_ui_visible;
 }
 
+inline bool PreferUserDesktopInput(bool user_desktop_active,
+                                   bool consent_ui_visible,
+                                   bool service_available,
+                                   bool process_elevated) {
+  // An elevated application still lives on Default. SendInput only reports
+  // insertion into the input stream, not delivery to that application's UI.
+  // Use the authorized service proactively for an unelevated host, including
+  // clicks on an elevated window that has not become the foreground window.
+  return PreferUserDesktopInput(user_desktop_active, consent_ui_visible) &&
+         (process_elevated || !service_available);
+}
+
 inline bool IsDesktopInputSetupPending(const std::string& error) {
   // These failures explicitly precede injection; timeouts remain ambiguous.
   return error == "secure_input_helper_not_ready" ||

apps/desktop/src/platform/windows/service/session_helper_main.cpp

@@ -1250,6 +1250,7 @@ LONG NormalizeAbsoluteMouseCoordinate(int value, int origin, int size) {
 INPUT BuildAbsoluteMouseMoveInput(int x, int y) {
   INPUT input = {0};
   input.type = INPUT_MOUSE;
+  input.mi.dwExtraInfo = crossdesk::kInjectedMouseInputMarker;
 
   const int virtual_left = GetSystemMetrics(SM_XVIRTUALSCREEN);
   const int virtual_top = GetSystemMetrics(SM_YVIRTUALSCREEN);
@@ -1283,6 +1284,7 @@ InputInjectionResult InjectMouseInput(const SecureMouseRequest& request) {
 
   INPUT action_input = {0};
   action_input.type = INPUT_MOUSE;
+  action_input.mi.dwExtraInfo = crossdesk::kInjectedMouseInputMarker;
   switch (request.flag) {
     case 0:
       break;