[fix] reset stale macOS permissions during install

[fix] improve macOS permission request flow
[fix] bundle Windows Service binaries in Windows portable package
2026-06-10 01:14:53 +08:00 · 2026-05-28 01:34:02 +08:00 · 2026-05-28 01:33:50 +08:00 · 2026-05-27 19:37:06 +08:00 · 2026-05-27 19:32:58 +08:00 · 2026-05-27 17:22:51 +08:00
72 changed files with 10600 additions and 951 deletions
@@ -242,13 +242,42 @@ jobs:
          cd "${{ github.workspace }}\scripts\windows"
          makensis /DVERSION=$env:VERSION_NUM nsis_script.nsi

+      - name: Build Portable CrossDesk
+        run: |
+          xmake f --CROSSDESK_VERSION=${{ env.VERSION_NUM }} --USE_CUDA=true --CROSSDESK_PORTABLE=true -y
+          xmake b -vy crossdesk
+
      - name: Package Portable
        shell: pwsh
        run: |
+          $buildDir = "${{ github.workspace }}\build\windows\x64\release"
          $portableDir = "${{ github.workspace }}\portable"
          New-Item -ItemType Directory -Force -Path $portableDir
-          Copy-Item "${{ github.workspace }}\build\windows\x64\release\crossdesk.exe" "$portableDir\CrossDesk.exe"
-          Copy-Item "${{ github.workspace }}\build\windows\x64\release\*.dll" $portableDir -Force
+
+          $portableFiles = @(
+            @("crossdesk.exe", "CrossDesk.exe"),
+            @("crossdesk_service.exe", "crossdesk_service.exe"),
+            @("crossdesk_session_helper.exe", "crossdesk_session_helper.exe")
+          )
+
+          foreach ($file in $portableFiles) {
+            $source = Join-Path $buildDir $file[0]
+            $destination = Join-Path $portableDir $file[1]
+            if (!(Test-Path $source)) {
+              throw "Missing portable package file: $source"
+            }
+            Copy-Item $source $destination -Force
+          }
+
+          Copy-Item (Join-Path $buildDir "*.dll") $portableDir -Force
+
+          foreach ($file in $portableFiles) {
+            $packagedFile = Join-Path $portableDir $file[1]
+            if (!(Test-Path $packagedFile)) {
+              throw "Portable package is missing: $packagedFile"
+            }
+          }
+
          Compress-Archive -Path "$portableDir\*" -DestinationPath "${{ github.workspace }}\crossdesk-win-x64-portable-${{ env.VERSION_NUM }}.zip"

      - name: Upload artifact
@@ -53,6 +53,29 @@ CrossDesk 是 [MiniRTC](https://github.com/kunkundi/minirtc.git) 实时音视频

 <img width="645" height="300" alt="_cgi-bin_mmwebwx-bin_webwxgetmsgimg__ MsgID=932911462648581698 skey=@crypt_1f5153b1_b550ca7462b5009ce03c991cca2a92a7 mmweb_appid=wx_webfilehelper" src="https://github.com/user-attachments/assets/a5109e6f-752c-4654-9f4e-7e161bddf43e" />

+### Windows 服务（CrossDesk Service）
+CrossDesk 在 Windows 平台提供本地辅助服务 **CrossDesk Service**，服务名为 `CrossDeskService`。该服务用于锁屏、登录界面和安全桌面等受保护场景下的远程控制增强能力，包括：
+- 上报远端当前是否处于锁屏、登录、凭据输入或安全桌面状态；
+- 支持从控制端发送 `Ctrl+Alt+Del`（SAS）；
+- 在锁屏、登录和安全桌面阶段转发键盘、鼠标输入。
+
+Windows 安装包会自动打包 `crossdesk_service.exe` 和 `crossdesk_session_helper.exe`，并在安装时注册为按需启动的 Windows 服务。CrossDesk 客户端启动时会尝试启动已安装的服务；当本机没有 CrossDesk 客户端进程运行时，服务会自动退出。卸载客户端时会同步停止并移除该服务。
+
+如果是手动编译或手动部署 Windows 版本，请确保 `CrossDesk.exe`、`crossdesk_service.exe` 和 `crossdesk_session_helper.exe` 位于同一目录。安装或卸载服务需要使用管理员权限打开 PowerShell：
+```
+# 安装
+.\CrossDesk.exe --service-install
+# 启动
+.\CrossDesk.exe --service-start
+# 查看状态
+.\CrossDesk.exe --service-status
+.\CrossDesk.exe --service-stop
+# 卸载
+.\CrossDesk.exe --service-uninstall
+```
+
+如果远端 Windows 服务未安装、未启动或暂时不可用，基础远程桌面连接仍可使用，但锁屏、登录界面和安全桌面阶段的控制能力会受限，客户端会提示“远端Windows服务不可用”。
+
 ## 如何编译

 依赖：
@@ -262,3 +285,8 @@ sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keyc

 # 常见问题
 见 [常见问题](https://github.com/kunkundi/crossdesk/blob/self-hosted-server/docs/FAQ.md) 。
+
+# 致谢
+- 感谢 [HelloGitHub](https://hellogithub.com/) 的推荐与关注。
+- 感谢 [阮一峰的科技爱好者周刊](https://github.com/ruanyf/weekly) 的收录与推荐。
+- 感谢 [LinuxDo](https://linux.do) 社区的关注、交流与支持，为 CrossDesk 项目的完善提供了帮助。
@@ -56,6 +56,31 @@ Enter the **Remote Device ID** and **Password**, then click Connect to access th

 <img width="645" height="300" alt="_cgi-bin_mmwebwx-bin_webwxgetmsgimg__ MsgID=932911462648581698 skey=@crypt_1f5153b1_b550ca7462b5009ce03c991cca2a92a7 mmweb_appid=wx_webfilehelper" src="https://github.com/user-attachments/assets/a5109e6f-752c-4654-9f4e-7e161bddf43e" />

+### Windows Service (CrossDesk Service)
+CrossDesk provides a local helper service on Windows named **CrossDesk Service**. Its service name is `CrossDeskService`. The service improves remote control in protected Windows states such as the lock screen, sign-in UI, credential UI, and secure desktop. It provides:
+- Remote status reporting for lock screen, sign-in, credential, and secure desktop states.
+- Remote `Ctrl+Alt+Del` (SAS) delivery.
+- Keyboard and mouse input forwarding while the remote Windows device is on the lock screen, sign-in UI, or secure desktop.
+
+The Windows installer bundles `crossdesk_service.exe` and `crossdesk_session_helper.exe`, then registers the service as an on-demand Windows service during installation. When the CrossDesk client starts, it tries to start the installed service automatically. When no CrossDesk client process is running on the machine, the service exits automatically. Uninstalling the client also stops and removes the service.
+
+For manual Windows builds or deployments, make sure `CrossDesk.exe`, `crossdesk_service.exe`, and `crossdesk_session_helper.exe` are placed in the same directory. Open PowerShell with administrator privileges to install or uninstall the service:
+```
+# install
+.\CrossDesk.exe --service-install
+# start
+.\CrossDesk.exe --service-start
+# check status
+.\CrossDesk.exe --service-status
+.\CrossDesk.exe --service-ping
+# stop
+.\CrossDesk.exe --service-stop
+# uninstall
+.\CrossDesk.exe --service-uninstall
+```
+
+If the remote Windows service is not installed, not running, or temporarily unavailable, the basic remote desktop connection still works, but remote control on the lock screen, sign-in UI, and secure desktop is limited. The client will show “Remote Windows service unavailable”.
+
 ## How to build

 Requirements:
@@ -274,3 +299,8 @@ See [CrossDesk Web Client](https://github.com/kunkundi/crossdesk-web-client)。

 # FAQ
 See [FAQ](https://github.com/kunkundi/crosssesk/blob/self-hosted-server/docs/FAQ.md) .
+
+# Acknowledgements
+- Thanks to [HelloGitHub](https://hellogithub.com/) for the recommendation and exposure.
+- Thanks to [Ruanyf Weekly](https://github.com/ruanyf/weekly) for featuring CrossDesk.
+- Thanks to the [LinuxDo](https://linux.do) community for the attention, discussions, and support that helped improve CrossDesk.
@@ -8,6 +8,8 @@ APP_VERSION="$1"
 ARCHITECTURE="amd64"
 MAINTAINER="Junkun Di <junkun.di@hotmail.com>"
 DESCRIPTION="A simple cross-platform remote desktop client."
+ALSA_RUNTIME_DEP="libasound2 | libasound2t64"
+PORTAL_RUNTIME_RECOMMENDS="xdg-desktop-portal, xdg-desktop-portal-gtk | xdg-desktop-portal-kde | xdg-desktop-portal-wlr"

 # Remove 'v' prefix from version for Debian package (Debian version must start with digit)
 DEB_VERSION="${APP_VERSION#v}"
@@ -41,11 +43,9 @@ Maintainer: $MAINTAINER
 Description: $DESCRIPTION
 Depends: libc6 (>= 2.29), libstdc++6 (>= 9), libx11-6, libxcb1,
 libxcb-randr0, libxcb-xtest0, libxcb-xinerama0, libxcb-shape0,
- libxcb-xkb1, libxcb-xfixes0, libxv1, libxtst6, libasound2,
- libsndio7.0, libxcb-shm0, libpulse0, libdrm2, libdbus-1-3,
- libpipewire-0.3-0, xdg-desktop-portal,
- xdg-desktop-portal-gtk | xdg-desktop-portal-kde | xdg-desktop-portal-wlr
-Recommends: nvidia-cuda-toolkit
+ libxcb-xkb1, libxcb-xfixes0, libxv1, libxtst6, $ALSA_RUNTIME_DEP,
+ libsndio7.0, libxcb-shm0, libpulse0, libdrm2, libdbus-1-3
+Recommends: $PORTAL_RUNTIME_RECOMMENDS, nvidia-cuda-toolkit
 Priority: optional
 Section: utils
 EOF
@@ -8,6 +8,8 @@ APP_VERSION="$1"
 ARCHITECTURE="arm64"
 MAINTAINER="Junkun Di <junkun.di@hotmail.com>"
 DESCRIPTION="A simple cross-platform remote desktop client."
+ALSA_RUNTIME_DEP="libasound2 | libasound2t64"
+PORTAL_RUNTIME_RECOMMENDS="xdg-desktop-portal, xdg-desktop-portal-gtk | xdg-desktop-portal-kde | xdg-desktop-portal-wlr"

 # Remove 'v' prefix from version for Debian package (Debian version must start with digit)
 DEB_VERSION="${APP_VERSION#v}"
@@ -41,10 +43,9 @@ Maintainer: $MAINTAINER
 Description: $DESCRIPTION
 Depends: libc6 (>= 2.29), libstdc++6 (>= 9), libx11-6, libxcb1,
 libxcb-randr0, libxcb-xtest0, libxcb-xinerama0, libxcb-shape0,
- libxcb-xkb1, libxcb-xfixes0, libxv1, libxtst6, libasound2,
- libsndio7.0, libxcb-shm0, libpulse0, libdrm2, libdbus-1-3,
- libpipewire-0.3-0, xdg-desktop-portal,
- xdg-desktop-portal-gtk | xdg-desktop-portal-kde | xdg-desktop-portal-wlr
+ libxcb-xkb1, libxcb-xfixes0, libxv1, libxtst6, $ALSA_RUNTIME_DEP,
+ libsndio7.0, libxcb-shm0, libpulse0, libdrm2, libdbus-1-3
+Recommends: $PORTAL_RUNTIME_RECOMMENDS
 Priority: optional
 Section: utils
 EOF
@@ -15,6 +15,7 @@ APP_BUNDLE="${APP_NAME_UPPER}.app"
 CONTENTS_DIR="${APP_BUNDLE}/Contents"
 MACOS_DIR="${CONTENTS_DIR}/MacOS"
 RESOURCES_DIR="${CONTENTS_DIR}/Resources"
+INSTALLER_TITLE="${APP_NAME_UPPER} ${APP_VERSION}"

 PKG_NAME="${APP_NAME}-${PLATFORM}-${ARCH}-${APP_VERSION}.pkg"
 DMG_NAME="${APP_NAME}-${PLATFORM}-${ARCH}-${APP_VERSION}.dmg"
@@ -73,67 +74,82 @@ cat > "${CONTENTS_DIR}/Info.plist" <<EOF
 </plist>
 EOF

+xattr -cr "${APP_BUNDLE}" 2>/dev/null || true
+find "${APP_BUNDLE}" -name '._*' -delete
+
 echo ".app created successfully."

+mkdir -p build_pkg_scripts
+cp scripts/macosx/tcc_postinstall.sh build_pkg_scripts/postinstall
+chmod +x build_pkg_scripts/postinstall
+
+mkdir -p build_pkg_resources
+cat > build_pkg_resources/welcome.html <<EOF
+<!doctype html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <style>
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", sans-serif;
+            font-size: 13px;
+            line-height: 1.5;
+            color: #222;
+            margin: 0;
+            padding: 0;
+        }
+        h1 {
+            font-size: 20px;
+            font-weight: 600;
+            margin: 0 0 12px;
+        }
+        p {
+            margin: 0 0 10px;
+        }
+    </style>
+</head>
+<body>
+    <h1>欢迎安装 ${INSTALLER_TITLE}</h1>
+    <p>CrossDesk 将安装到“应用程序”文件夹。</p>
+    <p>首次启动时，CrossDesk 会引导你在系统设置中授予必要权限，包括辅助功能、录屏与系统录音等。</p>
+    <p>为避免旧版本授权残留造成状态误判，安装后可能需要重新授权。</p>
+    <p>安装完成后，请从“应用程序”文件夹启动 CrossDesk。</p>
+</body>
+</html>
+EOF
+
 echo "building pkg..."
 pkgbuild \
  --identifier "${IDENTIFIER}" \
  --version "${APP_VERSION}" \
  --install-location "/Applications" \
  --component "${APP_BUNDLE}" \
+  --scripts build_pkg_scripts \
  build_pkg_temp/${APP_NAME}-component.pkg

-mkdir -p build_pkg_scripts
-
-cat > build_pkg_scripts/postinstall <<'EOF'
-#!/bin/bash
-set -e
-
-IDENTIFIER="cn.crossdesk.app"
-
-# 获取当前登录用户
-USER_HOME=$( /usr/bin/stat -f "%Su" /dev/console )
-HOME_DIR=$( /usr/bin/dscl . -read /Users/$USER_HOME NFSHomeDirectory | awk '{print $2}' )
-
-# 清除应用的权限授权，以便重新授权
-# 使用 tccutil 重置录屏权限和辅助功能权限
-if command -v tccutil >/dev/null 2>&1; then
-    # 重置录屏权限
-    tccutil reset ScreenCapture "$IDENTIFIER" 2>/dev/null || true
-    # 重置辅助功能权限
-    tccutil reset Accessibility "$IDENTIFIER" 2>/dev/null || true
-    # 重置摄像头权限（如果需要）
-    tccutil reset Camera "$IDENTIFIER" 2>/dev/null || true
-    # 重置麦克风权限（如果需要）
-    tccutil reset Microphone "$IDENTIFIER" 2>/dev/null || true
-fi
-
-# 为所有用户清除权限（可选，如果需要）
-# 遍历所有用户目录并清除权限
-for USER_DIR in /Users/*; do
-    if [ -d "$USER_DIR" ] && [ "$USER_DIR" != "/Users/Shared" ]; then
-        USER_NAME=$(basename "$USER_DIR")
-        # 跳过系统用户
-        if [ "$USER_NAME" != "Shared" ] && [ -d "$USER_DIR/Library" ]; then
-            # 删除 TCC 数据库中的相关条目（需要管理员权限）
-            TCC_DB="$USER_DIR/Library/Application Support/com.apple.TCC/TCC.db"
-            if [ -f "$TCC_DB" ]; then
-                # 使用 sqlite3 删除相关权限记录（如果可用）
-                if command -v sqlite3 >/dev/null 2>&1; then
-                    sqlite3 "$TCC_DB" "DELETE FROM access WHERE client='$IDENTIFIER' AND service IN ('kTCCServiceScreenCapture', 'kTCCServiceAccessibility');" 2>/dev/null || true
-                fi
-            fi
-        fi
-    fi
-done
-
-exit 0
+cat > build_pkg_temp/Distribution <<EOF
+<?xml version="1.0" encoding="utf-8"?>
+<installer-gui-script minSpecVersion="1">
+    <title>${INSTALLER_TITLE}</title>
+    <welcome file="welcome.html" mime-type="text/html"/>
+    <options customize="never" require-scripts="false" hostArchitectures="arm64"/>
+    <choices-outline>
+        <line choice="default">
+            <line choice="${IDENTIFIER}"/>
+        </line>
+    </choices-outline>
+    <choice id="default" title="${INSTALLER_TITLE}"/>
+    <choice id="${IDENTIFIER}" title="${INSTALLER_TITLE}" visible="false">
+        <pkg-ref id="${IDENTIFIER}"/>
+    </choice>
+    <pkg-ref id="${IDENTIFIER}" version="${APP_VERSION}" onConclusion="none">crossdesk-component.pkg</pkg-ref>
+</installer-gui-script>
 EOF

-chmod +x build_pkg_scripts/postinstall
-
 productbuild \
-  --package build_pkg_temp/${APP_NAME}-component.pkg \
+  --distribution build_pkg_temp/Distribution \
+  --package-path build_pkg_temp \
+  --resources build_pkg_resources \
  "${PKG_NAME}"

 echo "PKG package created: ${PKG_NAME}"
@@ -171,8 +187,8 @@ APPLESCRIPT
 fi
 echo "Set icon finished"

-rm -rf build_pkg_temp build_pkg_scripts ${APP_BUNDLE}
+rm -rf build_pkg_temp build_pkg_scripts build_pkg_resources ${APP_BUNDLE}

 echo "PKG package created successfully."
 echo "package ${APP_BUNDLE}"
-echo "installer ${PKG_NAME}"
+echo "installer ${PKG_NAME}"
@@ -15,6 +15,7 @@ APP_BUNDLE="${APP_NAME_UPPER}.app"
 CONTENTS_DIR="${APP_BUNDLE}/Contents"
 MACOS_DIR="${CONTENTS_DIR}/MacOS"
 RESOURCES_DIR="${CONTENTS_DIR}/Resources"
+INSTALLER_TITLE="${APP_NAME_UPPER} ${APP_VERSION}"

 PKG_NAME="${APP_NAME}-${PLATFORM}-${ARCH}-${APP_VERSION}.pkg"
 DMG_NAME="${APP_NAME}-${PLATFORM}-${ARCH}-${APP_VERSION}.dmg"
@@ -73,67 +74,82 @@ cat > "${CONTENTS_DIR}/Info.plist" <<EOF
 </plist>
 EOF

+xattr -cr "${APP_BUNDLE}" 2>/dev/null || true
+find "${APP_BUNDLE}" -name '._*' -delete
+
 echo ".app created successfully."

+mkdir -p build_pkg_scripts
+cp scripts/macosx/tcc_postinstall.sh build_pkg_scripts/postinstall
+chmod +x build_pkg_scripts/postinstall
+
+mkdir -p build_pkg_resources
+cat > build_pkg_resources/welcome.html <<EOF
+<!doctype html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <style>
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", sans-serif;
+            font-size: 13px;
+            line-height: 1.5;
+            color: #222;
+            margin: 0;
+            padding: 0;
+        }
+        h1 {
+            font-size: 20px;
+            font-weight: 600;
+            margin: 0 0 12px;
+        }
+        p {
+            margin: 0 0 10px;
+        }
+    </style>
+</head>
+<body>
+    <h1>欢迎安装 ${INSTALLER_TITLE}</h1>
+    <p>CrossDesk 将安装到“应用程序”文件夹。</p>
+    <p>首次启动时，CrossDesk 会引导你在系统设置中授予必要权限，包括辅助功能、录屏与系统录音等。</p>
+    <p>为避免旧版本授权残留造成状态误判，安装后可能需要重新授权。</p>
+    <p>安装完成后，请从“应用程序”文件夹启动 CrossDesk。</p>
+</body>
+</html>
+EOF
+
 echo "building pkg..."
 pkgbuild \
  --identifier "${IDENTIFIER}" \
  --version "${APP_VERSION}" \
  --install-location "/Applications" \
  --component "${APP_BUNDLE}" \
+  --scripts build_pkg_scripts \
  build_pkg_temp/${APP_NAME}-component.pkg

-mkdir -p build_pkg_scripts
-
-cat > build_pkg_scripts/postinstall <<'EOF'
-#!/bin/bash
-set -e
-
-IDENTIFIER="cn.crossdesk.app"
-
-# 获取当前登录用户
-USER_HOME=$( /usr/bin/stat -f "%Su" /dev/console )
-HOME_DIR=$( /usr/bin/dscl . -read /Users/$USER_HOME NFSHomeDirectory | awk '{print $2}' )
-
-# 清除应用的权限授权，以便重新授权
-# 使用 tccutil 重置录屏权限和辅助功能权限
-if command -v tccutil >/dev/null 2>&1; then
-    # 重置录屏权限
-    tccutil reset ScreenCapture "$IDENTIFIER" 2>/dev/null || true
-    # 重置辅助功能权限
-    tccutil reset Accessibility "$IDENTIFIER" 2>/dev/null || true
-    # 重置摄像头权限（如果需要）
-    tccutil reset Camera "$IDENTIFIER" 2>/dev/null || true
-    # 重置麦克风权限（如果需要）
-    tccutil reset Microphone "$IDENTIFIER" 2>/dev/null || true
-fi
-
-# 为所有用户清除权限（可选，如果需要）
-# 遍历所有用户目录并清除权限
-for USER_DIR in /Users/*; do
-    if [ -d "$USER_DIR" ] && [ "$USER_DIR" != "/Users/Shared" ]; then
-        USER_NAME=$(basename "$USER_DIR")
-        # 跳过系统用户
-        if [ "$USER_NAME" != "Shared" ] && [ -d "$USER_DIR/Library" ]; then
-            # 删除 TCC 数据库中的相关条目（需要管理员权限）
-            TCC_DB="$USER_DIR/Library/Application Support/com.apple.TCC/TCC.db"
-            if [ -f "$TCC_DB" ]; then
-                # 使用 sqlite3 删除相关权限记录（如果可用）
-                if command -v sqlite3 >/dev/null 2>&1; then
-                    sqlite3 "$TCC_DB" "DELETE FROM access WHERE client='$IDENTIFIER' AND service IN ('kTCCServiceScreenCapture', 'kTCCServiceAccessibility');" 2>/dev/null || true
-                fi
-            fi
-        fi
-    fi
-done
-
-exit 0
+cat > build_pkg_temp/Distribution <<EOF
+<?xml version="1.0" encoding="utf-8"?>
+<installer-gui-script minSpecVersion="1">
+    <title>${INSTALLER_TITLE}</title>
+    <welcome file="welcome.html" mime-type="text/html"/>
+    <options customize="never" require-scripts="false" hostArchitectures="x86_64"/>
+    <choices-outline>
+        <line choice="default">
+            <line choice="${IDENTIFIER}"/>
+        </line>
+    </choices-outline>
+    <choice id="default" title="${INSTALLER_TITLE}"/>
+    <choice id="${IDENTIFIER}" title="${INSTALLER_TITLE}" visible="false">
+        <pkg-ref id="${IDENTIFIER}"/>
+    </choice>
+    <pkg-ref id="${IDENTIFIER}" version="${APP_VERSION}" onConclusion="none">crossdesk-component.pkg</pkg-ref>
+</installer-gui-script>
 EOF

-chmod +x build_pkg_scripts/postinstall
-
 productbuild \
-  --package build_pkg_temp/${APP_NAME}-component.pkg \
+  --distribution build_pkg_temp/Distribution \
+  --package-path build_pkg_temp \
+  --resources build_pkg_resources \
  "${PKG_NAME}"

 echo "PKG package created: ${PKG_NAME}"
@@ -171,8 +187,8 @@ APPLESCRIPT
 fi
 echo "Set icon finished"

-rm -rf build_pkg_temp build_pkg_scripts ${APP_BUNDLE}
+rm -rf build_pkg_temp build_pkg_scripts build_pkg_resources ${APP_BUNDLE}

 echo "PKG package created successfully."
 echo "package ${APP_BUNDLE}"
-echo "installer ${PKG_NAME}"
+echo "installer ${PKG_NAME}"
@@ -0,0 +1,112 @@
+#!/bin/bash
+set -e
+
+APP_IDENTIFIER="cn.crossdesk.app"
+
+# Keep known historical identifiers here. tccutil only resets identifiers that
+# Launch Services can currently resolve, so path/db cleanup below remains a
+# best-effort fallback for stale entries from unsigned or removed builds.
+BUNDLE_IDENTIFIERS=(
+    "cn.crossdesk.app"
+    "cn.crossdesk.CrossDesk"
+    "com.crossdesk.app"
+    "com.crossdesk.CrossDesk"
+    "com.kunkundi.crossdesk"
+    "com.kunkundi.CrossDesk"
+)
+
+TCC_SERVICES=(
+    "ScreenCapture"
+    "Accessibility"
+    "Microphone"
+    "AudioCapture"
+)
+
+run_tccutil() {
+    local user_name="$1"
+    local user_id="$2"
+    local service="$3"
+    local bundle_id="$4"
+
+    if [ -n "$user_name" ] && [ -n "$user_id" ]; then
+        /bin/launchctl asuser "$user_id" \
+            /usr/bin/sudo -u "$user_name" \
+            /usr/bin/tccutil reset "$service" "$bundle_id" >/dev/null 2>&1
+    else
+        /usr/bin/tccutil reset "$service" "$bundle_id" >/dev/null 2>&1
+    fi
+}
+
+reset_bundle_tcc() {
+    local user_name="$1"
+    local user_id="$2"
+    local bundle_id
+    local service
+
+    for bundle_id in "${BUNDLE_IDENTIFIERS[@]}"; do
+        if run_tccutil "$user_name" "$user_id" "All" "$bundle_id"; then
+            continue
+        fi
+
+        for service in "${TCC_SERVICES[@]}"; do
+            run_tccutil "$user_name" "$user_id" "$service" "$bundle_id" || true
+        done
+    done
+}
+
+cleanup_tcc_db() {
+    local db_path="$1"
+
+    if [ ! -f "$db_path" ] || ! command -v sqlite3 >/dev/null 2>&1; then
+        return
+    fi
+
+    /usr/bin/sqlite3 "$db_path" <<'SQL' >/dev/null 2>&1 || true
+DELETE FROM access
+WHERE service IN (
+  'kTCCServiceScreenCapture',
+  'kTCCServiceAccessibility',
+  'kTCCServiceMicrophone',
+  'kTCCServiceAudioCapture'
+)
+AND (
+  client IN (
+    'cn.crossdesk.app',
+    'cn.crossdesk.CrossDesk',
+    'com.crossdesk.app',
+    'com.crossdesk.CrossDesk',
+    'com.kunkundi.crossdesk',
+    'com.kunkundi.CrossDesk'
+  )
+  OR lower(client) LIKE '%crossdesk%'
+);
+SQL
+}
+
+cleanup_user_tcc_db() {
+    local user_name="$1"
+    local home_dir
+
+    home_dir=$(/usr/bin/dscl . -read "/Users/${user_name}" NFSHomeDirectory 2>/dev/null |
+        /usr/bin/awk '{print $2}')
+    if [ -z "$home_dir" ]; then
+        return
+    fi
+
+    cleanup_tcc_db "${home_dir}/Library/Application Support/com.apple.TCC/TCC.db"
+}
+
+CONSOLE_USER=$(/usr/bin/stat -f "%Su" /dev/console 2>/dev/null || true)
+if [ -n "$CONSOLE_USER" ] &&
+   [ "$CONSOLE_USER" != "root" ] &&
+   [ "$CONSOLE_USER" != "loginwindow" ]; then
+    CONSOLE_UID=$(/usr/bin/id -u "$CONSOLE_USER" 2>/dev/null || true)
+    reset_bundle_tcc "$CONSOLE_USER" "$CONSOLE_UID"
+    cleanup_user_tcc_db "$CONSOLE_USER"
+fi
+
+# Also clear any system/root-scoped decisions as a harmless fallback.
+reset_bundle_tcc "" ""
+cleanup_tcc_db "/Library/Application Support/com.apple.TCC/TCC.db"
+
+exit 0
@@ -1,17 +1,13 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">

-  <!-- 应用程序标识 -->
  <assemblyIdentity
      version="1.0.0.0"
-      processorArchitecture="*"
      name="CrossDesk"
      type="win32" />

-  <!-- 描述信息 -->
  <description>CrossDesk Application</description>

-  <!-- 权限：要求管理员运行 -->
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
@@ -20,24 +16,17 @@
    </security>
  </trustInfo>

-  <!-- DPI 感知设置：支持高分屏 -->
  <application xmlns="urn:schemas-microsoft-com:asm.v3">
    <windowsSettings>
-      <!-- Windows Vista/7 风格 DPI 感知 -->
-      <dpiAware>true/pm</dpiAware>
-      <!-- Windows 10/11 高级 DPI 感知 -->
-      <dpiAwareness>PerMonitorV2</dpiAwareness>
+      <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true/pm</dpiAware>
+      <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">PerMonitorV2</dpiAwareness>
    </windowsSettings>
  </application>

-  <!-- Windows 兼容性声明 -->
  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
    <application>
-      <!-- 支持 Windows 10 -->
-      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
-      <!-- 支持 Windows 11（向下兼容 Win10 GUID） -->
      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
    </application>
  </compatibility>

-</assembly>
+</assembly>
@@ -1,2 +1,11 @@
 // Application icon resource; load by the resource name IDI_ICON1.
 IDI_ICON1 ICON "..\\..\\icons\\windows\\crossdesk.ico"
+
+#define CREATEPROCESS_MANIFEST_RESOURCE_ID 1
+#define RT_MANIFEST 24
+
+#ifdef CROSSDESK_DEBUG
+CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST "crossdesk_debug.manifest"
+#else
+CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST "crossdesk.manifest"
+#endif
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+
+  <assemblyIdentity
+      version="1.0.0.0"
+      name="CrossDesk"
+      type="win32" />
+
+  <description>CrossDesk Application</description>
+
+  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
+    <security>
+      <requestedPrivileges>
+        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
+      </requestedPrivileges>
+    </security>
+  </trustInfo>
+
+  <application xmlns="urn:schemas-microsoft-com:asm.v3">
+    <windowsSettings>
+      <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true/pm</dpiAware>
+      <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">PerMonitorV2</dpiAwareness>
+    </windowsSettings>
+  </application>
+
+  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
+    <application>
+      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
+    </application>
+  </compatibility>
+
+</assembly>
@@ -8,6 +8,7 @@
 !define PRODUCT_WEB_SITE "https://www.crossdesk.cn/"
 !define APP_NAME "CrossDesk"
 !define UNINSTALL_REG_KEY "CrossDesk"
+!define PRODUCT_SERVICE_NAME "CrossDeskService"

 ; Installer icon path
 !define MUI_ICON "${__FILEDIR__}\..\..\icons\windows\crossdesk.ico"
@@ -68,14 +69,21 @@ cancelInstall:
    Abort

 installApp:
+    Call StopInstalledService
+
    SetOutPath "$INSTDIR"
    SetOverwrite ifnewer

    ; Main application executable path
    File /oname=CrossDesk.exe "..\..\build\windows\x64\release\crossdesk.exe"
+    ; Bundle service-side binaries required by the Windows service flow
+    File "..\..\build\windows\x64\release\crossdesk_service.exe"
+    File "..\..\build\windows\x64\release\crossdesk_session_helper.exe"
    ; Bundle runtime DLLs from the release output directory
    File "..\..\build\windows\x64\release\*.dll"

+    Call RegisterInstalledService
+
    ; Write uninstall information
    WriteUninstaller "$INSTDIR\uninstall.exe"

@@ -122,8 +130,12 @@ cancelUninstall:
    Abort

 uninstallApp:
+    Call un.UnregisterInstalledService
+
    ; Delete main executable and uninstaller
    Delete "$INSTDIR\CrossDesk.exe"
+    Delete "$INSTDIR\crossdesk_service.exe"
+    Delete "$INSTDIR\crossdesk_session_helper.exe"
    Delete "$INSTDIR\uninstall.exe"

    ; Recursively delete installation directory
@@ -148,3 +160,78 @@ SectionEnd
 Function LaunchApp
    Exec "$INSTDIR\CrossDesk.exe"
 FunctionEnd
+
+Function StopInstalledService
+    IfFileExists "$INSTDIR\CrossDesk.exe" 0 stop_with_sc
+    IfFileExists "$INSTDIR\crossdesk_service.exe" 0 stop_with_sc
+
+    DetailPrint "Stopping existing CrossDesk service"
+    ExecWait '"$INSTDIR\CrossDesk.exe" --service-stop' $0
+    ${If} $0 = 0
+        Return
+    ${EndIf}
+
+stop_with_sc:
+    DetailPrint "Stopping existing CrossDesk service via Service Control Manager"
+    ExecWait '"$SYSDIR\sc.exe" stop ${PRODUCT_SERVICE_NAME}' $0
+    ${If} $0 != 0
+    ${AndIf} $0 != 1060
+    ${AndIf} $0 != 1062
+        MessageBox MB_ICONSTOP|MB_OK "Failed to stop the existing CrossDesk service. The installation will be aborted."
+        Abort
+    ${EndIf}
+    Sleep 1500
+FunctionEnd
+
+Function RegisterInstalledService
+    IfFileExists "$INSTDIR\CrossDesk.exe" 0 missing_service_binary
+    IfFileExists "$INSTDIR\crossdesk_service.exe" 0 missing_service_binary
+    IfFileExists "$INSTDIR\crossdesk_session_helper.exe" 0 missing_service_binary
+
+    DetailPrint "Registering CrossDesk service"
+    ExecWait '"$INSTDIR\CrossDesk.exe" --service-install' $0
+    ${If} $0 != 0
+        MessageBox MB_ICONSTOP|MB_OK "Failed to register the CrossDesk service. The installation will be aborted."
+        Abort
+    ${EndIf}
+
+    DetailPrint "CrossDesk service registered for on-demand start"
+
+    Return
+
+missing_service_binary:
+    MessageBox MB_ICONSTOP|MB_OK "CrossDesk service files are missing from the installer package. The installation will be aborted."
+    Abort
+FunctionEnd
+
+Function un.UnregisterInstalledService
+    IfFileExists "$INSTDIR\CrossDesk.exe" 0 unregister_with_sc
+
+    DetailPrint "Stopping CrossDesk service"
+    ExecWait '"$INSTDIR\CrossDesk.exe" --service-stop' $0
+    ${If} $0 = 0
+        DetailPrint "Removing CrossDesk service"
+        ExecWait '"$INSTDIR\CrossDesk.exe" --service-uninstall' $0
+        ${If} $0 = 0
+            Return
+        ${EndIf}
+    ${EndIf}
+
+unregister_with_sc:
+    DetailPrint "Removing CrossDesk service via Service Control Manager"
+    ExecWait '"$SYSDIR\sc.exe" stop ${PRODUCT_SERVICE_NAME}' $0
+    ${If} $0 != 0
+    ${AndIf} $0 != 1060
+    ${AndIf} $0 != 1062
+        MessageBox MB_ICONSTOP|MB_OK "Failed to stop the CrossDesk service. Uninstall will be aborted."
+        Abort
+    ${EndIf}
+    Sleep 1500
+
+    ExecWait '"$SYSDIR\sc.exe" delete ${PRODUCT_SERVICE_NAME}' $0
+    ${If} $0 != 0
+    ${AndIf} $0 != 1060
+        MessageBox MB_ICONSTOP|MB_OK "Failed to remove the CrossDesk service. Uninstall will be aborted."
+        Abort
+    ${EndIf}
+FunctionEnd
@@ -7,15 +7,179 @@
 #endif

 #include <cstring>
+#include <filesystem>
+#include <iostream>
 #include <memory>
 #include <string>

+#ifdef _WIN32
+#include <cstdio>
+
+#include "service_host.h"
+#endif
+
 #include "config_center.h"
 #include "daemon.h"
 #include "path_manager.h"
 #include "render.h"

+#ifdef _WIN32
+namespace {
+
+void EnsureConsoleForCli() {
+  static bool console_ready = false;
+  if (console_ready) {
+    return;
+  }
+
+  if (!AttachConsole(ATTACH_PARENT_PROCESS)) {
+    DWORD error = GetLastError();
+    if (error != ERROR_ACCESS_DENIED) {
+      AllocConsole();
+    }
+  }
+
+  FILE* stream = nullptr;
+  freopen_s(&stream, "CONOUT$", "w", stdout);
+  freopen_s(&stream, "CONOUT$", "w", stderr);
+  freopen_s(&stream, "CONIN$", "r", stdin);
+  SetConsoleOutputCP(CP_UTF8);
+  console_ready = true;
+}
+
+void PrintServiceCliUsage() {
+  std::cout
+      << "CrossDesk service management commands\n"
+      << "  --service-install    Install the sibling crossdesk_service.exe\n"
+      << "  --service-uninstall  Remove the installed Windows service\n"
+      << "  --service-start      Start the Windows service\n"
+      << "  --service-stop       Stop the Windows service\n"
+      << "  --service-sas        Ask the service to send Secure Attention "
+         "Sequence\n"
+      << "  --service-ping       Ping the service over named pipe IPC\n"
+      << "  --service-status     Query service runtime status\n"
+      << "  --service-help       Show this help\n";
+}
+
+std::wstring GetCurrentExecutablePathW() {
+  wchar_t path[MAX_PATH] = {0};
+  DWORD length = GetModuleFileNameW(nullptr, path, MAX_PATH);
+  if (length == 0 || length >= MAX_PATH) {
+    return L"";
+  }
+  return std::wstring(path, length);
+}
+
+std::filesystem::path GetSiblingServiceExecutablePath() {
+  std::wstring current_executable = GetCurrentExecutablePathW();
+  if (current_executable.empty()) {
+    return {};
+  }
+
+  return std::filesystem::path(current_executable).parent_path() /
+         L"crossdesk_service.exe";
+}
+
+bool IsServiceCliCommand(const char* arg) {
+  if (arg == nullptr) {
+    return false;
+  }
+
+  return std::strcmp(arg, "--service-install") == 0 ||
+         std::strcmp(arg, "--service-uninstall") == 0 ||
+         std::strcmp(arg, "--service-start") == 0 ||
+         std::strcmp(arg, "--service-stop") == 0 ||
+         std::strcmp(arg, "--service-sas") == 0 ||
+         std::strcmp(arg, "--service-ping") == 0 ||
+         std::strcmp(arg, "--service-status") == 0 ||
+         std::strcmp(arg, "--service-help") == 0;
+}
+
+void TryStartManagedWindowsService() {
+  std::filesystem::path service_path = GetSiblingServiceExecutablePath();
+  if (service_path.empty() || !std::filesystem::exists(service_path)) {
+    return;
+  }
+
+  if (!crossdesk::IsCrossDeskServiceInstalled()) {
+    return;
+  }
+
+  crossdesk::StartCrossDeskService();
+}
+
+int HandleServiceCliCommand(const std::string& command) {
+  EnsureConsoleForCli();
+
+  if (command == "--service-help") {
+    PrintServiceCliUsage();
+    return 0;
+  }
+
+  if (command == "--service-install") {
+    std::filesystem::path service_path = GetSiblingServiceExecutablePath();
+    if (service_path.empty()) {
+      std::cerr << "Failed to locate crossdesk_service.exe" << std::endl;
+      return 1;
+    }
+    if (!std::filesystem::exists(service_path)) {
+      std::cerr << "Service binary not found: " << service_path.string()
+                << std::endl;
+      return 1;
+    }
+
+    bool success = crossdesk::InstallCrossDeskService(service_path.wstring());
+    std::cout << (success ? "install ok" : "install failed") << std::endl;
+    return success ? 0 : 1;
+  }
+
+  if (command == "--service-uninstall") {
+    bool success = crossdesk::UninstallCrossDeskService();
+    std::cout << (success ? "uninstall ok" : "uninstall failed") << std::endl;
+    return success ? 0 : 1;
+  }
+
+  if (command == "--service-start") {
+    bool success = crossdesk::StartCrossDeskService();
+    std::cout << (success ? "start ok" : "start failed") << std::endl;
+    return success ? 0 : 1;
+  }
+
+  if (command == "--service-stop") {
+    bool success = crossdesk::StopCrossDeskService();
+    std::cout << (success ? "stop ok" : "stop failed") << std::endl;
+    return success ? 0 : 1;
+  }
+
+  if (command == "--service-sas") {
+    std::cout << crossdesk::QueryCrossDeskService("sas") << std::endl;
+    return 0;
+  }
+
+  if (command == "--service-ping") {
+    std::cout << crossdesk::QueryCrossDeskService("ping") << std::endl;
+    return 0;
+  }
+
+  if (command == "--service-status") {
+    std::cout << crossdesk::QueryCrossDeskService("status") << std::endl;
+    return 0;
+  }
+
+  PrintServiceCliUsage();
+  return 1;
+}
+
+}  // namespace
+#endif
+
 int main(int argc, char* argv[]) {
+#ifdef _WIN32
+  if (argc > 1 && IsServiceCliCommand(argv[1])) {
+    return HandleServiceCliCommand(argv[1]);
+  }
+#endif
+
  // check if running as child process
  bool is_child = false;
  for (int i = 1; i < argc; i++) {
@@ -32,6 +196,10 @@ int main(int argc, char* argv[]) {
    return 0;
  }

+#ifdef _WIN32
+  TryStartManagedWindowsService();
+#endif
+
  bool enable_daemon = false;
  auto path_manager = std::make_unique<crossdesk::PathManager>("CrossDesk");
  if (path_manager) {
@@ -9,6 +9,8 @@

 #include <stdio.h>

+#include <cstdint>
+#include <cstring>
 #include <nlohmann/json.hpp>
 #include <string>

@@ -23,6 +25,8 @@ typedef enum {
  audio_capture,
  host_infomation,
  display_id,
+  service_status,
+  service_command,
 } ControlType;
 typedef enum {
  move = 0,
@@ -36,6 +40,7 @@ typedef enum {
  wheel_horizontal
 } MouseFlag;
 typedef enum { key_down = 0, key_up } KeyFlag;
+typedef enum { send_sas = 0, lock_workstation } ServiceCommandFlag;
 typedef struct {
  float x;
  float y;
@@ -45,6 +50,8 @@ typedef struct {

 typedef struct {
  size_t key_value;
+  uint32_t scan_code;
+  bool extended;
  KeyFlag flag;
 } Key;

@@ -59,6 +66,15 @@ typedef struct {
  int* bottom;
 } HostInfo;

+typedef struct {
+  bool available;
+  char interactive_stage[32];
+} ServiceStatus;
+
+typedef struct {
+  ServiceCommandFlag flag;
+} ServiceCommand;
+
 struct RemoteAction {
  ControlType type;
  union {
@@ -67,6 +83,8 @@ struct RemoteAction {
    HostInfo i;
    bool a;
    int d;
+    ServiceStatus ss;
+    ServiceCommand c;
  };

  // parse
@@ -88,7 +106,10 @@ struct RemoteAction {
            {"x", a.m.x}, {"y", a.m.y}, {"s", a.m.s}, {"flag", a.m.flag}};
        break;
      case ControlType::keyboard:
-        j["keyboard"] = {{"key_value", a.k.key_value}, {"flag", a.k.flag}};
+        j["keyboard"] = {{"key_value", a.k.key_value},
+                         {"scan_code", a.k.scan_code},
+                         {"extended", a.k.extended},
+                         {"flag", a.k.flag}};
        break;
      case ControlType::audio_capture:
        j["audio_capture"] = a.a;
@@ -96,6 +117,13 @@ struct RemoteAction {
      case ControlType::display_id:
        j["display_id"] = a.d;
        break;
+      case ControlType::service_status:
+        j["service_status"] = {{"available", a.ss.available},
+                               {"interactive_stage", a.ss.interactive_stage}};
+        break;
+      case ControlType::service_command:
+        j["service_command"] = {{"flag", a.c.flag}};
+        break;
      case ControlType::host_infomation: {
        json displays = json::array();
        for (size_t idx = 0; idx < a.i.display_num; idx++) {
@@ -129,6 +157,9 @@ struct RemoteAction {
          break;
        case ControlType::keyboard:
          out.k.key_value = j.at("keyboard").at("key_value").get<size_t>();
+          out.k.scan_code =
+              j.at("keyboard").value("scan_code", static_cast<uint32_t>(0));
+          out.k.extended = j.at("keyboard").value("extended", false);
          out.k.flag = (KeyFlag)j.at("keyboard").at("flag").get<int>();
          break;
        case ControlType::audio_capture:
@@ -137,6 +168,20 @@ struct RemoteAction {
        case ControlType::display_id:
          out.d = j.at("display_id").get<int>();
          break;
+        case ControlType::service_status: {
+          const auto& service_status_json = j.at("service_status");
+          out.ss.available = service_status_json.value("available", false);
+          std::string interactive_stage =
+              service_status_json.value("interactive_stage", std::string());
+          std::strncpy(out.ss.interactive_stage, interactive_stage.c_str(),
+                       sizeof(out.ss.interactive_stage) - 1);
+          out.ss.interactive_stage[sizeof(out.ss.interactive_stage) - 1] = '\0';
+          break;
+        }
+        case ControlType::service_command:
+          out.c.flag = static_cast<ServiceCommandFlag>(
+              j.at("service_command").at("flag").get<int>());
+          break;
        case ControlType::host_infomation: {
          std::string host_name =
              j.at("host_info").at("host_name").get<std::string>();
@@ -174,8 +219,8 @@ struct RemoteAction {
  }
 };

-// int key_code, bool is_down
-typedef void (*OnKeyAction)(int, bool, void*);
+// int key_code, bool is_down, uint32_t scan_code, bool extended
+typedef void (*OnKeyAction)(int, bool, uint32_t, bool, void*);

 class DeviceController {
 public:
@@ -190,4 +235,4 @@ class DeviceController {
  // virtual int Unhook();
 };
 }  // namespace crossdesk
-#endif
+#endif
@@ -6,6 +6,7 @@
 #include "keyboard_converter.h"
 #include "platform.h"
 #include "rd_log.h"
+#include "windows_key_metadata.h"

 namespace crossdesk {

@@ -35,9 +36,12 @@ static int KeyboardEventHandler(Display* display, XEvent* event) {

    int key_code = key_it->second;
    bool is_key_down = (event->xkey.type == KeyPress);
+    uint32_t scan_code = 0;
+    bool extended = false;
+    LookupWindowsKeyMetadataFromVk(key_code, &scan_code, &extended);

    if (g_on_key_action) {
-      g_on_key_action(key_code, is_key_down, g_user_ptr);
+      g_on_key_action(key_code, is_key_down, scan_code, extended, g_user_ptr);
    }
  }
  return 0;
@@ -146,7 +150,10 @@ int KeyboardCapturer::Unhook() {
  return 0;
 }

-int KeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down) {
+int KeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down,
+                                          uint32_t scan_code, bool extended) {
+  (void)scan_code;
+  (void)extended;
  if (IsWaylandSession()) {
    if (!use_wayland_portal_ && !wayland_init_attempted_) {
      wayland_init_attempted_ = true;
@@ -154,12 +161,14 @@ int KeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down) {
        use_wayland_portal_ = true;
        LOG_INFO("Keyboard controller initialized with Wayland portal backend");
      } else {
-        LOG_WARN("Wayland keyboard control init failed, falling back to X11/XTest backend");
+        LOG_WARN(
+            "Wayland keyboard control init failed, falling back to X11/XTest "
+            "backend");
      }
    }

    if (use_wayland_portal_) {
-      return SendWaylandKeyboardCommand(key_code, is_down);
+      return SendWaylandKeyboardCommand(key_code, is_down, scan_code, extended);
    }
  }

@@ -32,12 +32,15 @@ class KeyboardCapturer : public DeviceController {
 public:
  virtual int Hook(OnKeyAction on_key_action, void* user_ptr);
  virtual int Unhook();
-  virtual int SendKeyboardCommand(int key_code, bool is_down);
+  virtual int SendKeyboardCommand(int key_code, bool is_down,
+                                  uint32_t scan_code = 0,
+                                  bool extended = false);

 private:
  bool InitWaylandPortal();
  void CleanupWaylandPortal();
-  int SendWaylandKeyboardCommand(int key_code, bool is_down);
+  int SendWaylandKeyboardCommand(int key_code, bool is_down, uint32_t scan_code,
+                                 bool extended);
  bool NotifyWaylandKeyboardKeysym(int keysym, uint32_t state);
  bool NotifyWaylandKeyboardKeycode(int keycode, uint32_t state);
  bool SendWaylandPortalVoidCall(const char* method_name,
@@ -575,8 +575,12 @@ void KeyboardCapturer::CleanupWaylandPortal() {
  wayland_session_handle_.clear();
 }

-int KeyboardCapturer::SendWaylandKeyboardCommand(int key_code, bool is_down) {
+int KeyboardCapturer::SendWaylandKeyboardCommand(int key_code, bool is_down,
+                                                 uint32_t scan_code,
+                                                 bool extended) {
 #if defined(CROSSDESK_HAS_WAYLAND_CAPTURER) && CROSSDESK_HAS_WAYLAND_CAPTURER
+  (void)scan_code;
+  (void)extended;
  if (!dbus_connection_ || wayland_session_handle_.empty()) {
    return -1;
  }
@@ -613,6 +617,8 @@ int KeyboardCapturer::SendWaylandKeyboardCommand(int key_code, bool is_down) {
 #else
  (void)key_code;
  (void)is_down;
+  (void)scan_code;
+  (void)extended;
  return -1;
 #endif
 }
@@ -119,7 +119,7 @@ CGEventRef eventCallback(CGEventTapProxy proxy, CGEventType type,
        CGEventGetIntegerValueField(event, kCGKeyboardEventKeycode));
    int vk_code = ResolveVkCodeFromMacEvent(event, key_code, is_key_down);
    if (vk_code >= 0) {
-      g_on_key_action(vk_code, is_key_down, g_user_ptr);
+      g_on_key_action(vk_code, is_key_down, 0, false, g_user_ptr);
    }
  } else if (type == kCGEventFlagsChanged) {
    CGEventFlags current_flags = CGEventGetFlags(event);
@@ -135,35 +135,40 @@ CGEventRef eventCallback(CGEventTapProxy proxy, CGEventType type,
    bool caps_lock_state = (current_flags & kCGEventFlagMaskAlphaShift) != 0;
    if (caps_lock_state != keyboard_capturer->caps_lock_flag_) {
      keyboard_capturer->caps_lock_flag_ = caps_lock_state;
-      g_on_key_action(vk_code, keyboard_capturer->caps_lock_flag_, g_user_ptr);
+      g_on_key_action(vk_code, keyboard_capturer->caps_lock_flag_, 0, false,
+                      g_user_ptr);
    }

    // shift
    bool shift_state = (current_flags & kCGEventFlagMaskShift) != 0;
    if (shift_state != keyboard_capturer->shift_flag_) {
      keyboard_capturer->shift_flag_ = shift_state;
-      g_on_key_action(vk_code, keyboard_capturer->shift_flag_, g_user_ptr);
+      g_on_key_action(vk_code, keyboard_capturer->shift_flag_, 0, false,
+                      g_user_ptr);
    }

    // control
    bool control_state = (current_flags & kCGEventFlagMaskControl) != 0;
    if (control_state != keyboard_capturer->control_flag_) {
      keyboard_capturer->control_flag_ = control_state;
-      g_on_key_action(vk_code, keyboard_capturer->control_flag_, g_user_ptr);
+      g_on_key_action(vk_code, keyboard_capturer->control_flag_, 0, false,
+                      g_user_ptr);
    }

    // option
    bool option_state = (current_flags & kCGEventFlagMaskAlternate) != 0;
    if (option_state != keyboard_capturer->option_flag_) {
      keyboard_capturer->option_flag_ = option_state;
-      g_on_key_action(vk_code, keyboard_capturer->option_flag_, g_user_ptr);
+      g_on_key_action(vk_code, keyboard_capturer->option_flag_, 0, false,
+                      g_user_ptr);
    }

    // command
    bool command_state = (current_flags & kCGEventFlagMaskCommand) != 0;
    if (command_state != keyboard_capturer->command_flag_) {
      keyboard_capturer->command_flag_ = command_state;
-      g_on_key_action(vk_code, keyboard_capturer->command_flag_, g_user_ptr);
+      g_on_key_action(vk_code, keyboard_capturer->command_flag_, 0, false,
+                      g_user_ptr);
    }
  }

@@ -264,7 +269,30 @@ inline bool IsFunctionKey(int key_code) {
  }
 }

-int KeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down) {
+CGEventFlags ToCGEventFlags(uint32_t injected_flags) {
+  CGEventFlags flags = 0;
+  if ((injected_flags & kMacInjectedModifierShift) != 0) {
+    flags |= kCGEventFlagMaskShift;
+  }
+  if ((injected_flags & kMacInjectedModifierControl) != 0) {
+    flags |= kCGEventFlagMaskControl;
+  }
+  if ((injected_flags & kMacInjectedModifierOption) != 0) {
+    flags |= kCGEventFlagMaskAlternate;
+  }
+  if ((injected_flags & kMacInjectedModifierCommand) != 0) {
+    flags |= kCGEventFlagMaskCommand;
+  }
+  return flags;
+}
+
+int KeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down,
+                                          uint32_t scan_code, bool extended) {
+  (void)scan_code;
+  (void)extended;
+  const uint32_t injected_flags =
+      injected_modifier_state_.Update(key_code, is_down);
+
  if (vkCodeToCGKeyCode.find(key_code) != vkCodeToCGKeyCode.end()) {
    CGKeyCode cg_key_code = vkCodeToCGKeyCode[key_code];
    CGEventRef event = CGEventCreateKeyboardEvent(NULL, cg_key_code, is_down);
@@ -273,7 +301,7 @@ int KeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down) {
      return -1;
    }

-    CGEventSetFlags(event, 0);
+    CGEventSetFlags(event, ToCGEventFlags(injected_flags));
    CGEventPost(kCGHIDEventTap, event);
    CFRelease(event);

@@ -10,6 +10,7 @@
 #include <ApplicationServices/ApplicationServices.h>

 #include "device_controller.h"
+#include "macos_keyboard_modifier_state.h"

 namespace crossdesk {

@@ -21,7 +22,9 @@ class KeyboardCapturer : public DeviceController {
 public:
  virtual int Hook(OnKeyAction on_key_action, void* user_ptr);
  virtual int Unhook();
-  virtual int SendKeyboardCommand(int key_code, bool is_down);
+  virtual int SendKeyboardCommand(int key_code, bool is_down,
+                                  uint32_t scan_code = 0,
+                                  bool extended = false);

 private:
  CFMachPortRef event_tap_ = nullptr;
@@ -34,6 +37,7 @@ class KeyboardCapturer : public DeviceController {
  bool option_flag_ = false;
  bool command_flag_ = false;
  int fn_key_code_ = 0x3F;
+  MacKeyboardModifierState injected_modifier_state_;
 };
 }  // namespace crossdesk
 #endif
@@ -7,14 +7,56 @@ namespace crossdesk {
 static OnKeyAction g_on_key_action = nullptr;
 static void* g_user_ptr = nullptr;

+static int NormalizeModifierVkCode(const KBDLLHOOKSTRUCT* kb_data) {
+  if (kb_data == nullptr) {
+    return -1;
+  }
+
+  if (kb_data->vkCode != VK_SHIFT && kb_data->vkCode != VK_CONTROL &&
+      kb_data->vkCode != VK_MENU) {
+    return static_cast<int>(kb_data->vkCode);
+  }
+
+  UINT scan_code = static_cast<UINT>(kb_data->scanCode & 0xFF);
+  if ((kb_data->flags & LLKHF_EXTENDED) != 0) {
+    scan_code |= 0xE000;
+  }
+
+  const UINT normalized_vk = MapVirtualKeyW(scan_code, MAPVK_VSC_TO_VK_EX);
+  if (normalized_vk != 0) {
+    return static_cast<int>(normalized_vk);
+  }
+
+  return static_cast<int>(kb_data->vkCode);
+}
+
+static bool PreferSideSpecificVkInjection(int key_code) {
+  switch (key_code) {
+    case VK_LSHIFT:
+    case VK_RSHIFT:
+    case VK_LCONTROL:
+    case VK_RCONTROL:
+    case VK_LMENU:
+    case VK_RMENU:
+    case VK_LWIN:
+    case VK_RWIN:
+      return true;
+    default:
+      return false;
+  }
+}
+
 LRESULT CALLBACK KeyboardProc(int nCode, WPARAM wParam, LPARAM lParam) {
  if (nCode == HC_ACTION && g_on_key_action) {
    KBDLLHOOKSTRUCT* kbData = reinterpret_cast<KBDLLHOOKSTRUCT*>(lParam);
+    const int key_code = NormalizeModifierVkCode(kbData);

    if (wParam == WM_KEYDOWN || wParam == WM_SYSKEYDOWN) {
-      g_on_key_action(kbData->vkCode, true, g_user_ptr);
+      g_on_key_action(key_code, true, kbData->scanCode,
+                      (kbData->flags & LLKHF_EXTENDED) != 0, g_user_ptr);
    } else if (wParam == WM_KEYUP || wParam == WM_SYSKEYUP) {
-      g_on_key_action(kbData->vkCode, false, g_user_ptr);
+      g_on_key_action(key_code, false, kbData->scanCode,
+                      (kbData->flags & LLKHF_EXTENDED) != 0, g_user_ptr);
    }
    return 1;
  }
@@ -49,20 +91,40 @@ int KeyboardCapturer::Unhook() {
 }

 // apply remote keyboard commands to the local machine
-int KeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down) {
+int KeyboardCapturer::SendKeyboardCommand(int key_code, bool is_down,
+                                          uint32_t scan_code, bool extended) {
  INPUT input = {0};
  input.type = INPUT_KEYBOARD;
-  input.ki.wVk = (WORD)key_code;

-  const UINT scan_code =
-      MapVirtualKeyW(static_cast<UINT>(key_code), MAPVK_VK_TO_VSC_EX);
-  if (scan_code != 0) {
+  const bool prefer_vk = PreferSideSpecificVkInjection(key_code);
+  const UINT resolved_scan_code =
+      scan_code != 0
+          ? static_cast<UINT>(scan_code & 0xFF) | (extended ? 0xE000u : 0u)
+          : MapVirtualKeyW(static_cast<UINT>(key_code), MAPVK_VK_TO_VSC_EX);
+
+  if (scan_code != 0 && !prefer_vk) {
    input.ki.wVk = 0;
    input.ki.wScan = static_cast<WORD>(scan_code & 0xFF);
    input.ki.dwFlags |= KEYEVENTF_SCANCODE;
-    if ((scan_code & 0xFF00) != 0) {
+    if (extended) {
      input.ki.dwFlags |= KEYEVENTF_EXTENDEDKEY;
    }
+  } else {
+    input.ki.wVk = (WORD)key_code;
+
+    if (prefer_vk && resolved_scan_code != 0) {
+      input.ki.wScan = static_cast<WORD>(resolved_scan_code & 0xFF);
+      if ((resolved_scan_code & 0xFF00) != 0) {
+        input.ki.dwFlags |= KEYEVENTF_EXTENDEDKEY;
+      }
+    } else if (resolved_scan_code != 0) {
+      input.ki.wVk = 0;
+      input.ki.wScan = static_cast<WORD>(resolved_scan_code & 0xFF);
+      input.ki.dwFlags |= KEYEVENTF_SCANCODE;
+      if ((resolved_scan_code & 0xFF00) != 0) {
+        input.ki.dwFlags |= KEYEVENTF_EXTENDEDKEY;
+      }
+    }
  }

  if (!is_down) {
@@ -21,7 +21,9 @@ class KeyboardCapturer : public DeviceController {
 public:
  virtual int Hook(OnKeyAction on_key_action, void* user_ptr);
  virtual int Unhook();
-  virtual int SendKeyboardCommand(int key_code, bool is_down);
+  virtual int SendKeyboardCommand(int key_code, bool is_down,
+                                  uint32_t scan_code = 0,
+                                  bool extended = false);

 private:
  HHOOK keyboard_hook_ = nullptr;
@@ -98,6 +98,7 @@ std::map<int, int> vkCodeToCGKeyCode = {
    {0x67, 0x59},  // Numpad 7
    {0x68, 0x5B},  // Numpad 8
    {0x69, 0x5C},  // Numpad 9
+    {0x90, 0x47},  // Num Lock / Keypad Clear
    {0x6E, 0x41},  // Numpad .
    {0x6F, 0x4B},  // Numpad /
    {0x6A, 0x43},  // Numpad *
@@ -216,6 +217,7 @@ std::map<int, int> CGKeyCodeToVkCode = {
    {0x59, 0x67},  // Numpad 7
    {0x5B, 0x68},  // Numpad 8
    {0x5C, 0x69},  // Numpad 9
+    {0x47, 0x90},  // Num Lock / Keypad Clear
    {0x41, 0x6E},  // Numpad .
    {0x4B, 0x6F},  // Numpad /
    {0x43, 0x6A},  // Numpad *
@@ -336,6 +338,7 @@ std::map<int, int> vkCodeToX11KeySym = {
    {0x67, 0xFFB7},  // Numpad 7
    {0x68, 0xFFB8},  // Numpad 8
    {0x69, 0xFFB9},  // Numpad 9
+    {0x90, 0xFF7F},  // Num Lock
    {0x6E, 0xFFAE},  // Numpad .
    {0x6F, 0xFFAF},  // Numpad /
    {0x6A, 0xFFAA},  // Numpad *
@@ -464,6 +467,7 @@ std::map<int, int> x11KeySymToVkCode = {
    {0xFFB7, 0x67},  // Numpad 7
    {0xFFB8, 0x68},  // Numpad 8
    {0xFFB9, 0x69},  // Numpad 9
+    {0xFF7F, 0x90},  // Num Lock
    {0xFFAE, 0x6E},  // Numpad .
    {0xFFAF, 0x6F},  // Numpad /
    {0xFFAA, 0x6A},  // Numpad *
@@ -582,6 +586,7 @@ std::map<int, int> cgKeyCodeToX11KeySym = {
    {0x59, 0xFFB7},  // Numpad 7
    {0x5B, 0xFFB8},  // Numpad 8
    {0x5C, 0xFFB9},  // Numpad 9
+    {0x47, 0xFF7F},  // Num Lock / Keypad Clear
    {0x41, 0xFFAE},  // Numpad .
    {0x4B, 0xFFAF},  // Numpad /
    {0x43, 0xFFAA},  // Numpad *
@@ -708,6 +713,7 @@ std::map<int, int> x11KeySymToCgKeyCode = {
    {0xFFB7, 0x59},  // Numpad 7
    {0xFFB8, 0x5B},  // Numpad 8
    {0xFFB9, 0x5C},  // Numpad 9
+    {0xFF7F, 0x47},  // Num Lock / Keypad Clear
    {0xFFAE, 0x41},  // Numpad .
    {0xFFAF, 0x4B},  // Numpad /
    {0xFFAA, 0x43},  // Numpad *
@@ -0,0 +1,93 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-05-21
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _MACOS_KEYBOARD_MODIFIER_STATE_H_
+#define _MACOS_KEYBOARD_MODIFIER_STATE_H_
+
+#include <cstdint>
+
+namespace crossdesk {
+
+inline constexpr uint32_t kMacInjectedModifierShift = 1u << 0;
+inline constexpr uint32_t kMacInjectedModifierControl = 1u << 1;
+inline constexpr uint32_t kMacInjectedModifierOption = 1u << 2;
+inline constexpr uint32_t kMacInjectedModifierCommand = 1u << 3;
+
+class MacKeyboardModifierState {
+ public:
+  uint32_t Update(int key_code, bool is_down) {
+    bool* state = MutableStateForVk(key_code);
+    if (state != nullptr) {
+      *state = is_down;
+    }
+    return flags();
+  }
+
+  uint32_t flags() const {
+    uint32_t result = 0;
+    if (left_shift_down_ || right_shift_down_) {
+      result |= kMacInjectedModifierShift;
+    }
+    if (left_control_down_ || right_control_down_) {
+      result |= kMacInjectedModifierControl;
+    }
+    if (left_option_down_ || right_option_down_) {
+      result |= kMacInjectedModifierOption;
+    }
+    if (left_command_down_ || right_command_down_) {
+      result |= kMacInjectedModifierCommand;
+    }
+    return result;
+  }
+
+  void Clear() {
+    left_shift_down_ = false;
+    right_shift_down_ = false;
+    left_control_down_ = false;
+    right_control_down_ = false;
+    left_option_down_ = false;
+    right_option_down_ = false;
+    left_command_down_ = false;
+    right_command_down_ = false;
+  }
+
+ private:
+  bool* MutableStateForVk(int key_code) {
+    switch (key_code) {
+      case 0xA0:  // VK_LSHIFT
+        return &left_shift_down_;
+      case 0xA1:  // VK_RSHIFT
+        return &right_shift_down_;
+      case 0xA2:  // VK_LCONTROL
+        return &left_control_down_;
+      case 0xA3:  // VK_RCONTROL
+        return &right_control_down_;
+      case 0xA4:  // VK_LMENU / left Option
+        return &left_option_down_;
+      case 0xA5:  // VK_RMENU / right Option
+        return &right_option_down_;
+      case 0x5B:  // VK_LWIN / left Command
+        return &left_command_down_;
+      case 0x5C:  // VK_RWIN / right Command
+        return &right_command_down_;
+      default:
+        return nullptr;
+    }
+  }
+
+  bool left_shift_down_ = false;
+  bool right_shift_down_ = false;
+  bool left_control_down_ = false;
+  bool right_control_down_ = false;
+  bool left_option_down_ = false;
+  bool right_option_down_ = false;
+  bool left_command_down_ = false;
+  bool right_command_down_ = false;
+};
+
+}  // namespace crossdesk
+
+#endif
@@ -11,8 +11,8 @@
 #include <X11/Xutil.h>
 #include <unistd.h>

-#include <functional>
 #include <cstdint>
+#include <functional>
 #include <string>
 #include <vector>

@@ -47,9 +47,9 @@ class MouseController : public DeviceController {
  bool NotifyWaylandPointerMotionAbsolute(uint32_t stream, double x, double y);
  bool NotifyWaylandPointerButton(int button, uint32_t state);
  bool NotifyWaylandPointerAxisDiscrete(uint32_t axis, int32_t steps);
-  bool SendWaylandPortalVoidCall(const char* method_name,
-                                 const std::function<void(DBusMessageIter*)>&
-                                     append_args);
+  bool SendWaylandPortalVoidCall(
+      const char* method_name,
+      const std::function<void(DBusMessageIter*)>& append_args);

  enum class WaylandAbsoluteMode { kUnknown, kPixels, kNormalized, kDisabled };

@@ -72,6 +72,8 @@ class MouseController : public DeviceController {
  WaylandAbsoluteMode wayland_absolute_mode_ = WaylandAbsoluteMode::kUnknown;
  bool wayland_absolute_disabled_logged_ = false;
  uint32_t wayland_absolute_stream_id_ = 0;
+  int wayland_portal_space_width_ = 0;
+  int wayland_portal_space_height_ = 0;
  bool using_shared_wayland_session_ = false;
 };
 }  // namespace crossdesk
@@ -1,5 +1,3 @@
-#include "mouse_controller.h"
-
 #include <algorithm>
 #include <chrono>
 #include <cmath>
@@ -7,6 +5,8 @@
 #include <cstring>
 #include <thread>

+#include "mouse_controller.h"
+
 #if defined(CROSSDESK_HAS_WAYLAND_CAPTURER) && CROSSDESK_HAS_WAYLAND_CAPTURER
 #include <dbus/dbus.h>
 #endif
@@ -22,7 +22,8 @@ void MouseController::OnWaylandDisplayInfoListUpdated() {
      display_info_list_.empty()
          ? 0
          : reinterpret_cast<uintptr_t>(display_info_list_[0].handle);
-  const int width0 = display_info_list_.empty() ? 0 : display_info_list_[0].width;
+  const int width0 =
+      display_info_list_.empty() ? 0 : display_info_list_[0].width;
  const int height0 =
      display_info_list_.empty() ? 0 : display_info_list_[0].height;
  const bool should_log = !logged_wayland_display_info_ ||
@@ -43,8 +44,7 @@ void MouseController::OnWaylandDisplayInfoListUpdated() {
    const auto& display = display_info_list_[i];
    LOG_INFO(
        "Wayland mouse display info [{}]: name={}, rect=({},{})->({},{}) "
-        "size={}x{}, stream={}"
-        ,
+        "size={}x{}, stream={}",
        i, display.name, display.left, display.top, display.right,
        display.bottom, display.width, display.height,
        reinterpret_cast<uintptr_t>(display.handle));
@@ -88,6 +88,13 @@ std::string MakeToken(const char* prefix) {
 }

 void LogDbusError(const char* action, DBusError* error) {
+  if (action && error && dbus_error_is_set(error) &&
+      strcmp(action, "NotifyPointerMotionAbsolute") == 0 && error->name &&
+      strcmp(error->name, "org.freedesktop.DBus.Error.Failed") == 0 &&
+      error->message && strcmp(error->message, "Invalid position") == 0) {
+    return;
+  }
+
  if (error && dbus_error_is_set(error)) {
    LOG_ERROR("{} failed: {} ({})", action,
              error->message ? error->message : "unknown",
@@ -190,6 +197,27 @@ bool ReadUint32Like(DBusMessageIter* iter, uint32_t* value) {
  return false;
 }

+bool ReadIntLike(DBusMessageIter* iter, int* value) {
+  if (!iter || !value) {
+    return false;
+  }
+
+  if (dbus_message_iter_get_arg_type(iter) == DBUS_TYPE_INT32) {
+    int32_t temp = 0;
+    dbus_message_iter_get_basic(iter, &temp);
+    *value = static_cast<int>(temp);
+    return true;
+  }
+
+  uint32_t temp = 0;
+  if (ReadUint32Like(iter, &temp)) {
+    *value = static_cast<int>(temp);
+    return true;
+  }
+
+  return false;
+}
+
 bool ReadFirstStreamId(DBusMessageIter* variant, uint32_t* stream_id) {
  if (!variant || !stream_id) {
    return false;
@@ -215,6 +243,85 @@ bool ReadFirstStreamId(DBusMessageIter* variant, uint32_t* stream_id) {
  return false;
 }

+bool ReadFirstStreamGeometry(DBusMessageIter* variant, int* width,
+                             int* height) {
+  if (!variant || !width || !height) {
+    return false;
+  }
+  if (dbus_message_iter_get_arg_type(variant) != DBUS_TYPE_ARRAY) {
+    return false;
+  }
+
+  int parsed_width = 0;
+  int parsed_height = 0;
+  DBusMessageIter streams;
+  dbus_message_iter_recurse(variant, &streams);
+  while (dbus_message_iter_get_arg_type(&streams) != DBUS_TYPE_INVALID) {
+    if (dbus_message_iter_get_arg_type(&streams) == DBUS_TYPE_STRUCT) {
+      DBusMessageIter stream;
+      dbus_message_iter_recurse(&streams, &stream);
+
+      if (dbus_message_iter_get_arg_type(&stream) == DBUS_TYPE_UINT32) {
+        dbus_message_iter_next(&stream);
+      }
+
+      if (dbus_message_iter_get_arg_type(&stream) == DBUS_TYPE_ARRAY) {
+        int stream_width = 0;
+        int stream_height = 0;
+        int logical_width = 0;
+        int logical_height = 0;
+        DBusMessageIter props;
+        dbus_message_iter_recurse(&stream, &props);
+        while (dbus_message_iter_get_arg_type(&props) != DBUS_TYPE_INVALID) {
+          if (dbus_message_iter_get_arg_type(&props) == DBUS_TYPE_DICT_ENTRY) {
+            DBusMessageIter prop_entry;
+            dbus_message_iter_recurse(&props, &prop_entry);
+
+            const char* prop_key = nullptr;
+            dbus_message_iter_get_basic(&prop_entry, &prop_key);
+            if (prop_key && dbus_message_iter_next(&prop_entry) &&
+                dbus_message_iter_get_arg_type(&prop_entry) ==
+                    DBUS_TYPE_VARIANT) {
+              DBusMessageIter prop_variant;
+              dbus_message_iter_recurse(&prop_entry, &prop_variant);
+              if (dbus_message_iter_get_arg_type(&prop_variant) ==
+                  DBUS_TYPE_STRUCT) {
+                DBusMessageIter size_iter;
+                int candidate_width = 0;
+                int candidate_height = 0;
+                dbus_message_iter_recurse(&prop_variant, &size_iter);
+                if (ReadIntLike(&size_iter, &candidate_width) &&
+                    dbus_message_iter_next(&size_iter) &&
+                    ReadIntLike(&size_iter, &candidate_height)) {
+                  if (strcmp(prop_key, "logical_size") == 0) {
+                    logical_width = candidate_width;
+                    logical_height = candidate_height;
+                  } else if (strcmp(prop_key, "size") == 0) {
+                    stream_width = candidate_width;
+                    stream_height = candidate_height;
+                  }
+                }
+              }
+            }
+          }
+          dbus_message_iter_next(&props);
+        }
+
+        parsed_width = logical_width > 0 ? logical_width : stream_width;
+        parsed_height = logical_height > 0 ? logical_height : stream_height;
+        if (parsed_width > 0 && parsed_height > 0) {
+          *width = parsed_width;
+          *height = parsed_height;
+          return true;
+        }
+      }
+    }
+    dbus_message_iter_next(&streams);
+  }
+
+  return false;
+}
+
 std::string BuildSessionHandleFromRequestPath(
    const std::string& request_path, const std::string& session_handle_token) {
  if (request_path.rfind(kPortalRequestPathPrefix, 0) != 0 ||
@@ -361,8 +468,7 @@ bool ExtractPortalResponse(DBusMessage* message, uint32_t* response_code,

 bool SendPortalRequestAndHandleResponse(
    DBusConnection* connection, const char* interface_name,
-    const char* method_name,
-    const char* action_name,
+    const char* method_name, const char* action_name,
    const std::function<bool(DBusMessage*)>& append_message_args,
    const std::function<bool(uint32_t, DBusMessageIter*)>& handle_results,
    std::string* request_path_out = nullptr) {
@@ -386,8 +492,8 @@ bool SendPortalRequestAndHandleResponse(

  DBusError error;
  dbus_error_init(&error);
-  DBusMessage* reply =
-      dbus_connection_send_with_reply_and_block(connection, message, -1, &error);
+  DBusMessage* reply = dbus_connection_send_with_reply_and_block(
+      connection, message, -1, &error);
  dbus_message_unref(message);
  if (!reply) {
    LogDbusError(action_name ? action_name : method_name, &error);
@@ -438,6 +544,8 @@ bool MouseController::InitWaylandPortal() {
        dbus_connection_ = shared_session.connection;
        wayland_session_handle_ = shared_session.session_handle;
        wayland_absolute_stream_id_ = shared_session.stream_id;
+        wayland_portal_space_width_ = shared_session.width;
+        wayland_portal_space_height_ = shared_session.height;
        last_display_index_ = -1;
        last_norm_x_ = -1.0;
        last_norm_y_ = -1.0;
@@ -448,9 +556,11 @@ bool MouseController::InitWaylandPortal() {
        wayland_absolute_mode_ = WaylandAbsoluteMode::kUnknown;
        wayland_absolute_disabled_logged_ = false;
        using_shared_wayland_session_ = true;
-        LOG_INFO("Mouse controller attached to shared Wayland portal session, "
-                 "stream_id={}",
-                 wayland_absolute_stream_id_);
+        LOG_INFO(
+            "Mouse controller attached to shared Wayland portal session, "
+            "stream_id={}, portal_space={}x{}",
+            wayland_absolute_stream_id_, wayland_portal_space_width_,
+            wayland_portal_space_height_);
        return true;
      };

@@ -469,16 +579,18 @@ bool MouseController::InitWaylandPortal() {

    if (!waiting_logged) {
      waiting_logged = true;
-      LOG_INFO("Waiting for shared Wayland portal session from screen "
-               "capturer before creating a standalone mouse session");
+      LOG_INFO(
+          "Waiting for shared Wayland portal session from screen "
+          "capturer before creating a standalone mouse session");
    }

    std::this_thread::sleep_for(std::chrono::milliseconds(100));
  }

  if (waiting_logged) {
-    LOG_WARN("Shared Wayland portal session did not appear in time; falling "
-             "back to standalone mouse portal session");
+    LOG_WARN(
+        "Shared Wayland portal session did not appear in time; falling "
+        "back to standalone mouse portal session");
  }

  if (AcquireSharedWaylandPortalSession(true, &shared_session)) {
@@ -677,6 +789,8 @@ bool MouseController::InitWaylandPortal() {

        uint32_t granted_devices = 0;
        uint32_t absolute_stream_id = 0;
+        int absolute_space_width = 0;
+        int absolute_space_height = 0;
        DBusMessageIter dict;
        dbus_message_iter_recurse(results, &dict);
        while (dbus_message_iter_get_arg_type(&dict) != DBUS_TYPE_INVALID) {
@@ -694,6 +808,8 @@ bool MouseController::InitWaylandPortal() {
                ReadUint32Like(&variant, &granted_devices);
              } else if (strcmp(key, "streams") == 0) {
                ReadFirstStreamId(&variant, &absolute_stream_id);
+                ReadFirstStreamGeometry(&variant, &absolute_space_width,
+                                        &absolute_space_height);
              }
            }
          }
@@ -703,19 +819,24 @@ bool MouseController::InitWaylandPortal() {
        pointer_granted = (granted_devices & kRemoteDesktopDevicePointer) != 0;
        if (!pointer_granted) {
          LOG_ERROR(
-              "RemoteDesktop.Start granted devices mask={}, pointer not allowed",
+              "RemoteDesktop.Start granted devices mask={}, pointer not "
+              "allowed",
              granted_devices);
          return false;
        }
        if (absolute_stream_id == 0) {
-          LOG_ERROR("RemoteDesktop.Start did not return a screencast stream id");
+          LOG_ERROR(
+              "RemoteDesktop.Start did not return a screencast stream id");
          return false;
        }
        wayland_absolute_stream_id_ = absolute_stream_id;
+        wayland_portal_space_width_ = absolute_space_width;
+        wayland_portal_space_height_ = absolute_space_height;
        wayland_absolute_mode_ = WaylandAbsoluteMode::kUnknown;
        wayland_absolute_disabled_logged_ = false;
-        LOG_INFO("Wayland mouse absolute stream id={}",
-                 wayland_absolute_stream_id_);
+        LOG_INFO("Wayland mouse absolute stream id={}, portal_space={}x{}",
+                 wayland_absolute_stream_id_, wayland_portal_space_width_,
+                 wayland_portal_space_height_);
        return true;
      });

@@ -782,6 +903,8 @@ void MouseController::CleanupWaylandPortal() {
  wayland_absolute_mode_ = WaylandAbsoluteMode::kUnknown;
  wayland_absolute_disabled_logged_ = false;
  wayland_absolute_stream_id_ = 0;
+  wayland_portal_space_width_ = 0;
+  wayland_portal_space_height_ = 0;
  using_shared_wayland_session_ = false;
 }

@@ -835,49 +958,80 @@ int MouseController::SendWaylandMouseCommand(RemoteAction remote_action,
      }

      const uint32_t stream = wayland_absolute_stream_id_;
-      const double abs_x = norm_x * std::max(width - 1, 1);
-      const double abs_y = norm_y * std::max(height - 1, 1);
+      const int portal_width =
+          wayland_portal_space_width_ > 0 ? wayland_portal_space_width_ : width;
+      const int portal_height = wayland_portal_space_height_ > 0
+                                    ? wayland_portal_space_height_
+                                    : height;
+      const double abs_x = norm_x * static_cast<double>(width);
+      const double abs_y = norm_y * static_cast<double>(height);
+      const double max_x = std::nextafter(static_cast<double>(width), 0.0);
+      const double max_y = std::nextafter(static_cast<double>(height), 0.0);
+      const double send_x = std::clamp(abs_x, 0.0, std::max(max_x, 0.0));
+      const double send_y = std::clamp(abs_y, 0.0, std::max(max_y, 0.0));
+      const bool can_use_relative = last_display_index_ == display_index &&
+                                    last_norm_x_ >= 0.0 && last_norm_y_ >= 0.0;
+      const double rel_dx =
+          (norm_x - last_norm_x_) * static_cast<double>(portal_width);
+      const double rel_dy =
+          (norm_y - last_norm_y_) * static_cast<double>(portal_height);

-      auto accept_absolute = [&]() {
+      auto accept_motion = [&]() {
        last_display_index_ = display_index;
        last_norm_x_ = norm_x;
        last_norm_y_ = norm_y;
+        wayland_absolute_disabled_logged_ = false;
        return 0;
      };

+      auto try_relative_fallback = [&]() -> bool {
+        if (!can_use_relative) {
+          return false;
+        }
+        if (std::abs(rel_dx) < 1e-6 && std::abs(rel_dy) < 1e-6) {
+          return false;
+        }
+        if (NotifyWaylandPointerMotion(rel_dx, rel_dy)) {
+          return true;
+        }
+        return false;
+      };
+
+      if (wayland_absolute_mode_ == WaylandAbsoluteMode::kDisabled) {
+        if (try_relative_fallback()) {
+          return accept_motion();
+        }
+        if (!wayland_absolute_disabled_logged_) {
+          wayland_absolute_disabled_logged_ = true;
+          LOG_ERROR("NotifyPointerMotionAbsolute rejected by portal backend");
+        }
+        return -3;
+      }
+
      if (wayland_absolute_mode_ == WaylandAbsoluteMode::kPixels) {
-        if (NotifyWaylandPointerMotionAbsolute(stream, abs_x, abs_y)) {
-          return accept_absolute();
+        if (NotifyWaylandPointerMotionAbsolute(stream, send_x, send_y)) {
+          return accept_motion();
        }
-        wayland_absolute_mode_ = WaylandAbsoluteMode::kDisabled;
-      } else if (wayland_absolute_mode_ == WaylandAbsoluteMode::kNormalized) {
-        if (NotifyWaylandPointerMotionAbsolute(stream, norm_x, norm_y)) {
-          return accept_absolute();
+        if (try_relative_fallback()) {
+          return accept_motion();
        }
-        wayland_absolute_mode_ = WaylandAbsoluteMode::kDisabled;
-      } else {
-        if (NotifyWaylandPointerMotionAbsolute(stream, abs_x, abs_y)) {
+      } else if (wayland_absolute_mode_ == WaylandAbsoluteMode::kUnknown) {
+        if (NotifyWaylandPointerMotionAbsolute(stream, send_x, send_y)) {
          wayland_absolute_mode_ = WaylandAbsoluteMode::kPixels;
-          LOG_INFO("Wayland absolute pointer mode selected: pixel coordinates");
-          return accept_absolute();
-        }
-
-        if (NotifyWaylandPointerMotionAbsolute(stream, norm_x, norm_y)) {
-          wayland_absolute_mode_ = WaylandAbsoluteMode::kNormalized;
          LOG_INFO(
-              "Wayland absolute pointer mode selected: normalized "
-              "coordinates");
-          return accept_absolute();
+              "Wayland absolute pointer mode selected: pixel coordinates "
+              "(pointer space {}x{})",
+              width, height);
+          return accept_motion();
+        }
+        if (try_relative_fallback()) {
+          return accept_motion();
        }
-
-        wayland_absolute_mode_ = WaylandAbsoluteMode::kDisabled;
      }

      if (!wayland_absolute_disabled_logged_) {
        wayland_absolute_disabled_logged_ = true;
-        LOG_ERROR(
-            "NotifyPointerMotionAbsolute rejected by portal backend in both "
-            "pixel and normalized modes");
+        LOG_ERROR("NotifyPointerMotionAbsolute rejected by portal backend");
      }
      return -3;
    }
@@ -1030,9 +1184,9 @@ bool MouseController::SendWaylandPortalVoidCall(
    return false;
  }

-  DBusMessage* message = dbus_message_new_method_call(
-      kPortalBusName, kPortalObjectPath, kPortalRemoteDesktopInterface,
-      method_name);
+  DBusMessage* message =
+      dbus_message_new_method_call(kPortalBusName, kPortalObjectPath,
+                                   kPortalRemoteDesktopInterface, method_name);
  if (!message) {
    LOG_ERROR("Failed to allocate {} message", method_name);
    return false;
@@ -1,5 +1,7 @@
 #include "mouse_controller.h"

+#include <Windows.h>
+
 #include "rd_log.h"

 namespace crossdesk {
@@ -18,7 +20,14 @@ int MouseController::Destroy() { return 0; }

 int MouseController::SendMouseCommand(RemoteAction remote_action,
                                      int display_index) {
-  INPUT ip;
+  if (display_index < 0 ||
+      display_index >= static_cast<int>(display_info_list_.size())) {
+    LOG_WARN("Mouse command skipped, invalid display_index={}, displays={}",
+             display_index, display_info_list_.size());
+    return -1;
+  }
+
+  INPUT ip = {0};

  if (remote_action.type == ControlType::mouse) {
    ip.type = INPUT_MOUSE;
@@ -63,13 +72,25 @@ int MouseController::SendMouseCommand(RemoteAction remote_action,

    ip.mi.time = 0;

-    SetCursorPos(ip.mi.dx, ip.mi.dy);
+    if (!SetCursorPos(ip.mi.dx, ip.mi.dy)) {
+      LOG_WARN("SetCursorPos failed for mouse x={}, y={}, flag={}, err={}",
+               ip.mi.dx, ip.mi.dy, static_cast<int>(remote_action.m.flag),
+               GetLastError());
+      return -1;
+    }

    if (ip.mi.dwFlags != MOUSEEVENTF_MOVE) {
-      SendInput(1, &ip, sizeof(INPUT));
+      UINT sent = SendInput(1, &ip, sizeof(INPUT));
+      if (sent != 1) {
+        LOG_WARN(
+            "SendInput failed for mouse x={}, y={}, wheel={}, flag={}, err={}",
+            ip.mi.dx, ip.mi.dy, remote_action.m.s,
+            static_cast<int>(remote_action.m.flag), GetLastError());
+        return -1;
+      }
    }
  }

  return 0;
 }
-}  // namespace crossdesk
+}  // namespace crossdesk
@@ -0,0 +1,89 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-05-07
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _WINDOWS_KEY_METADATA_H_
+#define _WINDOWS_KEY_METADATA_H_
+
+#include <cstdint>
+
+namespace crossdesk {
+
+inline bool LookupWindowsKeyMetadataFromVk(int key_code,
+                                           uint32_t* scan_code_out,
+                                           bool* extended_out) {
+  if (scan_code_out == nullptr || extended_out == nullptr) {
+    return false;
+  }
+
+  switch (key_code) {
+    case 0x21:  // Page Up
+      *scan_code_out = 0x49;
+      *extended_out = true;
+      return true;
+    case 0x22:  // Page Down
+      *scan_code_out = 0x51;
+      *extended_out = true;
+      return true;
+    case 0x23:  // End
+      *scan_code_out = 0x4F;
+      *extended_out = true;
+      return true;
+    case 0x24:  // Home
+      *scan_code_out = 0x47;
+      *extended_out = true;
+      return true;
+    case 0x25:  // Left Arrow
+      *scan_code_out = 0x4B;
+      *extended_out = true;
+      return true;
+    case 0x26:  // Up Arrow
+      *scan_code_out = 0x48;
+      *extended_out = true;
+      return true;
+    case 0x27:  // Right Arrow
+      *scan_code_out = 0x4D;
+      *extended_out = true;
+      return true;
+    case 0x28:  // Down Arrow
+      *scan_code_out = 0x50;
+      *extended_out = true;
+      return true;
+    case 0x2D:  // Insert
+      *scan_code_out = 0x52;
+      *extended_out = true;
+      return true;
+    case 0x2E:  // Delete
+      *scan_code_out = 0x53;
+      *extended_out = true;
+      return true;
+    case 0x6F:  // Numpad /
+      *scan_code_out = 0x35;
+      *extended_out = true;
+      return true;
+    case 0xA3:  // Right Ctrl
+      *scan_code_out = 0x1D;
+      *extended_out = true;
+      return true;
+    case 0xA5:  // Right Alt
+      *scan_code_out = 0x38;
+      *extended_out = true;
+      return true;
+    case 0x5B:  // Left Win
+      *scan_code_out = 0x5B;
+      *extended_out = true;
+      return true;
+    case 0x5C:  // Right Win
+      *scan_code_out = 0x5C;
+      *extended_out = true;
+      return true;
+    default:
+      return false;
+  }
+}
+
+}  // namespace crossdesk
+
+#endif
@@ -19,137 +19,176 @@ struct TranslationRow {
 };

 // Single source of truth for all UI strings.
-#define CROSSDESK_LOCALIZATION_ALL(X)                                          \
-  X(local_desktop, u8"本桌面", "Local Desktop", u8"Локальный рабочий стол")    \
-  X(local_id, u8"本机ID", "Local ID", u8"Локальный ID")                        \
-  X(local_id_copied_to_clipboard, u8"已复制到剪贴板", "Copied to clipboard",   \
-    u8"Скопировано в буфер обмена")                                            \
-  X(password, u8"密码", "Password", u8"Пароль")                                \
-  X(max_password_len, u8"最大6个字符", "Max 6 chars", u8"Макс. 6 символов")    \
-  X(remote_desktop, u8"远程桌面", "Remote Desktop",                            \
-    u8"Удаленный рабочий стол")                                                \
-  X(remote_id, u8"对端ID", "Remote ID", u8"Удаленный ID")                      \
-  X(connect, u8"连接", "Connect", u8"Подключиться")                            \
-  X(recent_connections, u8"近期连接", "Recent Connections",                    \
-    u8"Недавние подключения")                                                  \
-  X(disconnect, u8"断开连接", "Disconnect", u8"Отключить")                     \
-  X(fullscreen, u8"全屏", " Fullscreen", u8"Полный экран")                     \
-  X(show_net_traffic_stats, u8"显示流量统计", "Show Net Traffic Stats",        \
-    u8"Показать статистику трафика")                                           \
-  X(hide_net_traffic_stats, u8"隐藏流量统计", "Hide Net Traffic Stats",        \
-    u8"Скрыть статистику трафика")                                             \
-  X(video, u8"视频", "Video", u8"Видео")                                       \
-  X(audio, u8"音频", "Audio", u8"Аудио")                                       \
-  X(data, u8"数据", "Data", u8"Данные")                                        \
-  X(total, u8"总计", "Total", u8"Итого")                                       \
-  X(in, u8"输入", "In", u8"Вход")                                              \
-  X(out, u8"输出", "Out", u8"Выход")                                           \
-  X(loss_rate, u8"丢包率", "Loss Rate", u8"Потери пакетов")                    \
-  X(exit_fullscreen, u8"退出全屏", "Exit fullscreen",                          \
-    u8"Выйти из полноэкранного режима")                                        \
-  X(control_mouse, u8"控制", "Control", u8"Управление")                        \
-  X(release_mouse, u8"释放", "Release", u8"Освободить")                        \
-  X(audio_capture, u8"声音", "Audio", u8"Звук")                                \
-  X(mute, u8" 静音", " Mute", u8"Без звука")                                   \
-  X(settings, u8"设置", "Settings", u8"Настройки")                             \
-  X(language, u8"语言:", "Language:", u8"Язык:")                               \
-  X(video_quality, u8"视频质量:", "Video Quality:", u8"Качество видео:")       \
-  X(video_frame_rate, u8"画面采集帧率:",                                       \
-    "Video Capture Frame Rate:", u8"Частота захвата видео:")                   \
-  X(video_quality_high, u8"高", "High", u8"Высокое")                           \
-  X(video_quality_medium, u8"中", "Medium", u8"Среднее")                       \
-  X(video_quality_low, u8"低", "Low", u8"Низкое")                              \
-  X(video_encode_format, u8"视频编码格式:",                                    \
-    "Video Encode Format:", u8"Формат кодека видео:")                          \
-  X(av1, u8"AV1", "AV1", "AV1")                                                \
-  X(h264, u8"H.264", "H.264", "H.264")                                         \
-  X(enable_hardware_video_codec, u8"启用硬件编解码器:",                        \
-    "Enable Hardware Video Codec:", u8"Использовать аппаратный кодек:")        \
-  X(enable_turn, u8"启用中继服务:",                                            \
-    "Enable TURN Service:", u8"Включить TURN-сервис:")                         \
-  X(enable_srtp, u8"启用SRTP:", "Enable SRTP:", u8"Включить SRTP:")            \
-  X(self_hosted_server_config, u8"自托管配置", "Self-Hosted Config",           \
-    u8"Конфигурация self-hosted")                                              \
-  X(self_hosted_server_settings, u8"自托管设置", "Self-Hosted Settings",       \
-    u8"Настройки self-hosted")                                                 \
-  X(self_hosted_server_address, u8"服务器地址:",                               \
-    "Server Address:", u8"Адрес сервера:")                                     \
-  X(self_hosted_server_port, u8"信令服务端口:",                                \
-    "Signal Service Port:", u8"Порт сигнального сервиса:")                     \
-  X(self_hosted_server_coturn_server_port, u8"中继服务端口:",                  \
-    "Relay Service Port:", u8"Порт реле-сервиса:")                             \
-  X(ok, u8"确认", "OK", u8"ОК")                                                \
-  X(cancel, u8"取消", "Cancel", u8"Отмена")                                    \
-  X(new_password, u8"请输入六位密码:",                                         \
-    "Please input a six-char password:", u8"Введите шестизначный пароль:")     \
-  X(input_password, u8"请输入密码:",                                           \
-    "Please input password:", u8"Введите пароль:")                             \
-  X(validate_password, u8"验证密码中...", "Validate password ...",             \
-    u8"Проверка пароля...")                                                    \
-  X(reinput_password, u8"请重新输入密码", "Please input password again",       \
-    u8"Повторно введите пароль")                                               \
-  X(remember_password, u8"记住密码", "Remember password",                      \
-    u8"Запомнить пароль")                                                      \
-  X(signal_connected, u8"已连接服务器", "Connected", u8"Подключено к серверу") \
-  X(signal_disconnected, u8"未连接服务器", "Disconnected",                     \
-    u8"Нет подключения к серверу")                                             \
-  X(p2p_connected, u8"对等连接已建立", "P2P Connected", u8"P2P подключено")    \
-  X(p2p_disconnected, u8"对等连接已断开", "P2P Disconnected",                  \
-    u8"P2P отключено")                                                         \
-  X(p2p_connecting, u8"正在建立对等连接...", "P2P Connecting ...",             \
-    u8"Подключение P2P...")                                                    \
-  X(receiving_screen, u8"画面接收中...", "Receiving screen...",                \
-    u8"Получение изображения...")                                              \
-  X(p2p_failed, u8"对等连接失败", "P2P Failed", u8"Сбой P2P")                  \
-  X(p2p_closed, u8"对等连接已关闭", "P2P closed", u8"P2P закрыто")             \
-  X(no_such_id, u8"无此ID", "No such ID", u8"ID не найден")                    \
-  X(about, u8"关于", "About", u8"О программе")                                 \
-  X(notification, u8"通知", "Notification", u8"Уведомление")                   \
-  X(new_version_available, u8"新版本可用", "New Version Available",            \
-    u8"Доступна новая версия")                                                 \
-  X(version, u8"版本", "Version", u8"Версия")                                  \
-  X(release_date, u8"发布日期: ", "Release Date: ", u8"Дата релиза: ")         \
-  X(access_website, u8"访问官网: ",                                            \
-    "Access Website: ", u8"Официальный сайт: ")                                \
-  X(update, u8"更新", "Update", u8"Обновить")                                  \
-  X(confirm_delete_connection, u8"确认删除此连接",                             \
-    "Confirm to delete this connection", u8"Удалить это подключение?")         \
-  X(enable_autostart, u8"开机自启:", "Auto Start:", u8"Автозапуск:")           \
-  X(enable_daemon, u8"启用守护进程:", "Enable Daemon:", u8"Включить демон:")   \
-  X(takes_effect_after_restart, u8"重启后生效", "Takes effect after restart",  \
-    u8"Вступит в силу после перезапуска")                                      \
-  X(select_file, u8"选择文件", "Select File", u8"Выбрать файл")                \
-  X(file_transfer_progress, u8"文件传输进度", "File Transfer Progress",        \
-    u8"Прогресс передачи файлов")                                              \
-  X(queued, u8"队列中", "Queued", u8"В очереди")                               \
-  X(sending, u8"正在传输", "Sending", u8"Передача")                            \
-  X(completed, u8"已完成", "Completed", u8"Завершено")                         \
-  X(failed, u8"失败", "Failed", u8"Ошибка")                                    \
-  X(controller, u8"控制端:", "Controller:", u8"Контроллер:")                   \
-  X(file_transfer, u8"文件传输:", "File Transfer:", u8"Передача файлов:")      \
-  X(connection_status, u8"连接状态:",                                          \
-    "Connection Status:", u8"Состояние соединения:")                           \
-  X(file_transfer_save_path, u8"文件接收保存路径:",                            \
-    "File Transfer Save Path:", u8"Путь сохранения файлов:")                   \
-  X(default_desktop, u8"桌面", "Desktop", u8"Рабочий стол")                    \
-  X(minimize_to_tray, u8"退出时最小化到系统托盘:",                             \
-    "Minimize on Exit:", u8"Сворачивать в трей при выходе:")                   \
-  X(resolution, u8"分辨率", "Res", u8"Разрешение")                             \
-  X(connection_mode, u8"连接模式", "Mode", u8"Режим")                          \
-  X(connection_mode_direct, u8"直连", "Direct", u8"Прямой")                    \
-  X(connection_mode_relay, u8"中继", "Relay", u8"Релейный")                    \
-  X(online, u8"在线", "Online", u8"Онлайн")                                    \
-  X(offline, u8"离线", "Offline", u8"Офлайн")                                  \
-  X(device_offline, u8"设备离线", "Device Offline", u8"Устройство офлайн")     \
-  X(request_permissions, u8"权限请求", "Request Permissions",                  \
-    u8"Запрос разрешений")                                                     \
-  X(screen_recording_permission, u8"屏幕录制权限",                             \
-    "Screen Recording Permission", u8"Разрешение на запись экрана")            \
-  X(accessibility_permission, u8"辅助功能权限", "Accessibility Permission",    \
-    u8"Разрешение специальных возможностей")                                   \
-  X(permission_required_message, u8"该应用需要授权以下权限:",                  \
-    "The application requires the following permissions:",                     \
-    u8"Для работы приложения требуются следующие разрешения:")                 \
+#define CROSSDESK_LOCALIZATION_ALL(X)                                                                                             \
+  X(local_desktop, u8"本桌面", "Local Desktop", u8"Локальный рабочий стол")                                                       \
+  X(local_id, u8"本机ID", "Local ID", u8"Локальный ID")                                                                           \
+  X(local_id_copied_to_clipboard, u8"已复制到剪贴板", "Copied to clipboard",                                                      \
+    u8"Скопировано в буфер обмена")                                                                                               \
+  X(password, u8"密码", "Password", u8"Пароль")                                                                                   \
+  X(max_password_len, u8"最大6个字符", "Max 6 chars", u8"Макс. 6 символов")                                                       \
+  X(remote_desktop, u8"远程桌面", "Remote Desktop",                                                                               \
+    u8"Удаленный рабочий стол")                                                                                                   \
+  X(remote_id, u8"对端ID", "Remote ID", u8"Удаленный ID")                                                                         \
+  X(connect, u8"连接", "Connect", u8"Подключиться")                                                                               \
+  X(recent_connections, u8"近期连接", "Recent Connections",                                                                       \
+    u8"Недавние подключения")                                                                                                     \
+  X(disconnect, u8"断开连接", "Disconnect", u8"Отключить")                                                                        \
+  X(select_display, u8"选择显示器", "Select Display", u8"Выбрать дисплей")                                                        \
+  X(expand_control_bar, u8"展开控制栏", "Expand Control Bar",                                                                     \
+    u8"Развернуть панель управления")                                                                                             \
+  X(collapse_control_bar, u8"收起控制栏", "Collapse Control Bar",                                                                 \
+    u8"Свернуть панель управления")                                                                                               \
+  X(fullscreen, u8"全屏", " Fullscreen", u8"Полный экран")                                                                        \
+  X(show_net_traffic_stats, u8"显示网络状态", "Show Net Traffic Stats",                                                           \
+    u8"Показать статистику трафика")                                                                                              \
+  X(hide_net_traffic_stats, u8"隐藏网络状态", "Hide Net Traffic Stats",                                                           \
+    u8"Скрыть статистику трафика")                                                                                                \
+  X(video, u8"视频", "Video", u8"Видео")                                                                                          \
+  X(audio, u8"音频", "Audio", u8"Аудио")                                                                                          \
+  X(data, u8"数据", "Data", u8"Данные")                                                                                           \
+  X(total, u8"总计", "Total", u8"Итого")                                                                                          \
+  X(in, u8"输入", "In", u8"Вход")                                                                                                 \
+  X(out, u8"输出", "Out", u8"Выход")                                                                                              \
+  X(loss_rate, u8"丢包率", "Loss Rate", u8"Потери пакетов")                                                                       \
+  X(exit_fullscreen, u8"退出全屏", "Exit fullscreen",                                                                             \
+    u8"Выйти из полноэкранного режима")                                                                                           \
+  X(control_mouse, u8"控制鼠标", "Control Mouse", u8"Управление мышью")                                                           \
+  X(release_mouse, u8"释放鼠标", "Release Mouse", u8"Освободить мышь")                                                            \
+  X(audio_capture, u8"播放声音", "Audio Capture", u8"Воспроизведение звука")                                                      \
+  X(mute, u8" 静音", " Mute", u8"Без звука")                                                                                      \
+  X(send_shortcut, u8"发送组合键", "Send Shortcut", u8"Сочетания клавиш")                                                         \
+  X(send_sas, u8"发送SAS", "Send SAS", u8"Отправить SAS")                                                                         \
+  X(lock_remote, u8"锁定远端", "Lock Remote", u8"Заблокировать")                                                                  \
+  X(remote_password_box_visible, u8"远端密码框已出现",                                                                            \
+    "Remote password box visible", u8"Окно ввода пароля видно")                                                                   \
+  X(remote_lock_screen_hint, u8"远端处于锁屏封面，可发送SAS",                                                                     \
+    "Remote lock screen visible, send SAS",                                                                                       \
+    u8"Видна блокировка, отправьте SAS")                                                                                          \
+  X(remote_secure_desktop_active, u8"远端已进入安全桌面",                                                                         \
+    "Remote secure desktop active", u8"Активен защищенный рабочий стол")                                                          \
+  X(remote_service_unavailable, u8"远端Windows服务不可用",                                                                        \
+    "Remote Windows service unavailable",                                                                                         \
+    u8"Служба Windows на удаленной стороне недоступна")                                                                           \
+  X(windows_service_setup_title, u8"安装 CrossDesk Service",                                                                      \
+    "Install CrossDesk Service", u8"Установить CrossDesk Service")                                                               \
+  X(windows_service_setup_message,                                                                                                \
+    u8"便携版需要安装本机Windows服务，以便在锁屏/登录界面/安全桌面下完整控制此电脑。检测到服务尚未安装，可点击安装并允许相关系统权限。", \
+    "The portable version needs the local Windows service for full control on the lock screen, sign-in UI, and secure desktop. The service is not installed. Click Install and approve the system prompt.", \
+    u8"Портативной версии нужна локальная служба Windows для полного управления на экране блокировки, входа и защищенном рабочем столе. Служба не установлена. Нажмите Установить и подтвердите системный запрос.") \
+  X(install_windows_service, u8"安装", "Install",                                                                     \
+    u8"Установить службу")                                                                                                        \
+  X(installing_windows_service, u8"正在安装服务...", "Installing service...",                                                     \
+    u8"Установка службы...")                                                                                                      \
+  X(windows_service_install_success, u8"服务已安装并启动",                                                                        \
+    "Service installed and started", u8"Служба установлена и запущена")                                                          \
+  X(windows_service_install_failed, u8"服务安装失败，请确认便携目录内服务文件完整，并允许管理员权限。",                            \
+    "Service installation failed. Check that the portable folder contains all service files and approve administrator permission.", \
+    u8"Не удалось установить службу. Проверьте файлы службы в папке портативной версии и подтвердите права администратора.")       \
+  X(remote_unlock_requires_secure_desktop,                                                                                        \
+    u8"当前仍需要安全桌面专用采集/输入",                                                                                          \
+    "Secure desktop capture/input is still required",                                                                             \
+    u8"По-прежнему нужен отдельный захват/ввод для защищенного рабочего " \
+    u8"стола")                                                                                                                    \
+  X(settings, u8"设置", "Settings", u8"Настройки")                                                                                \
+  X(language, u8"语言:", "Language:", u8"Язык:")                                                                                  \
+  X(video_quality, u8"视频质量:", "Video Quality:", u8"Качество видео:")                                                          \
+  X(video_frame_rate, u8"画面采集帧率:",                                                                                          \
+    "Video Capture Frame Rate:", u8"Частота захвата видео:")                                                                      \
+  X(video_quality_high, u8"高", "High", u8"Высокое")                                                                              \
+  X(video_quality_medium, u8"中", "Medium", u8"Среднее")                                                                          \
+  X(video_quality_low, u8"低", "Low", u8"Низкое")                                                                                 \
+  X(video_encode_format, u8"视频编码格式:",                                                                                       \
+    "Video Encode Format:", u8"Формат кодека видео:")                                                                             \
+  X(av1, u8"AV1", "AV1", "AV1")                                                                                                   \
+  X(h264, u8"H.264", "H.264", "H.264")                                                                                            \
+  X(enable_hardware_video_codec, u8"启用硬件编解码器:",                                                                           \
+    "Enable Hardware Video Codec:", u8"Использовать аппаратный кодек:")                                                           \
+  X(enable_turn, u8"启用中继服务:",                                                                                               \
+    "Enable TURN Service:", u8"Включить TURN-сервис:")                                                                            \
+  X(enable_srtp, u8"启用SRTP:", "Enable SRTP:", u8"Включить SRTP:")                                                               \
+  X(self_hosted_server_config, u8"自托管配置", "Self-Hosted Config",                                                              \
+    u8"Конфигурация self-hosted")                                                                                                 \
+  X(self_hosted_server_settings, u8"自托管设置", "Self-Hosted Settings",                                                          \
+    u8"Настройки self-hosted")                                                                                                    \
+  X(self_hosted_server_address, u8"服务器地址:",                                                                                  \
+    "Server Address:", u8"Адрес сервера:")                                                                                        \
+  X(self_hosted_server_port, u8"信令服务端口:",                                                                                   \
+    "Signal Service Port:", u8"Порт сигнального сервиса:")                                                                        \
+  X(self_hosted_server_coturn_server_port, u8"中继服务端口:",                                                                     \
+    "Relay Service Port:", u8"Порт реле-сервиса:")                                                                                \
+  X(ok, u8"确认", "OK", u8"ОК")                                                                                                   \
+  X(cancel, u8"取消", "Cancel", u8"Отмена")                                                                                       \
+  X(new_password, u8"请输入六位密码:",                                                                                            \
+    "Please input a six-char password:", u8"Введите шестизначный пароль:")                                                        \
+  X(input_password, u8"请输入密码:",                                                                                              \
+    "Please input password:", u8"Введите пароль:")                                                                                \
+  X(validate_password, u8"验证密码中...", "Validate password ...",                                                                \
+    u8"Проверка пароля...")                                                                                                       \
+  X(reinput_password, u8"请重新输入密码", "Please input password again",                                                          \
+    u8"Повторно введите пароль")                                                                                                  \
+  X(remember_password, u8"记住密码", "Remember password",                                                                         \
+    u8"Запомнить пароль")                                                                                                         \
+  X(signal_connected, u8"已连接服务器", "Connected", u8"Подключено к серверу")                                                    \
+  X(signal_disconnected, u8"未连接服务器", "Disconnected",                                                                        \
+    u8"Нет подключения к серверу")                                                                                                \
+  X(p2p_connected, u8"对等连接已建立", "P2P Connected", u8"P2P подключено")                                                       \
+  X(p2p_disconnected, u8"对等连接已断开", "P2P Disconnected",                                                                     \
+    u8"P2P отключено")                                                                                                            \
+  X(p2p_connecting, u8"正在建立对等连接...", "P2P Connecting ...",                                                                \
+    u8"Подключение P2P...")                                                                                                       \
+  X(receiving_screen, u8"画面接收中...", "Receiving screen...",                                                                   \
+    u8"Получение изображения...")                                                                                                 \
+  X(p2p_failed, u8"对等连接失败", "P2P Failed", u8"Сбой P2P")                                                                     \
+  X(p2p_closed, u8"对等连接已关闭", "P2P closed", u8"P2P закрыто")                                                                \
+  X(no_such_id, u8"无此ID", "No such ID", u8"ID не найден")                                                                       \
+  X(about, u8"关于", "About", u8"О программе")                                                                                    \
+  X(notification, u8"通知", "Notification", u8"Уведомление")                                                                      \
+  X(new_version_available, u8"新版本可用", "New Version Available",                                                               \
+    u8"Доступна новая версия")                                                                                                    \
+  X(version, u8"版本", "Version", u8"Версия")                                                                                     \
+  X(release_date, u8"发布日期: ", "Release Date: ", u8"Дата релиза: ")                                                            \
+  X(access_website, u8"访问官网: ",                                                                                               \
+    "Access Website: ", u8"Официальный сайт: ")                                                                                   \
+  X(update, u8"更新", "Update", u8"Обновить")                                                                                     \
+  X(confirm_delete_connection, u8"确认删除此连接",                                                                                \
+    "Confirm to delete this connection", u8"Удалить это подключение?")                                                            \
+  X(enable_autostart, u8"开机自启:", "Auto Start:", u8"Автозапуск:")                                                              \
+  X(enable_daemon, u8"启用守护进程:", "Enable Daemon:", u8"Включить демон:")                                                      \
+  X(takes_effect_after_restart, u8"重启后生效", "Takes effect after restart",                                                     \
+    u8"Вступит в силу после перезапуска")                                                                                         \
+  X(select_file, u8"选择文件发送", "Select File to Send",                                                                         \
+    u8"Выбрать файл для отправки")                                                                                                \
+  X(file_transfer_progress, u8"文件传输进度", "File Transfer Progress",                                                           \
+    u8"Прогресс передачи файлов")                                                                                                 \
+  X(queued, u8"队列中", "Queued", u8"В очереди")                                                                                  \
+  X(sending, u8"正在传输", "Sending", u8"Передача")                                                                               \
+  X(completed, u8"已完成", "Completed", u8"Завершено")                                                                            \
+  X(failed, u8"失败", "Failed", u8"Ошибка")                                                                                       \
+  X(controller, u8"控制端:", "Controller:", u8"Контроллер:")                                                                      \
+  X(file_transfer, u8"文件传输:", "File Transfer:", u8"Передача файлов:")                                                         \
+  X(connection_status, u8"连接状态:",                                                                                             \
+    "Connection Status:", u8"Состояние соединения:")                                                                              \
+  X(file_transfer_save_path, u8"文件接收保存路径:",                                                                               \
+    "File Transfer Save Path:", u8"Путь сохранения файлов:")                                                                      \
+  X(default_desktop, u8"桌面", "Desktop", u8"Рабочий стол")                                                                       \
+  X(minimize_to_tray, u8"退出时最小化到系统托盘:",                                                                                \
+    "Minimize on Exit:", u8"Сворачивать в трей при выходе:")                                                                      \
+  X(resolution, u8"分辨率", "Res", u8"Разрешение")                                                                                \
+  X(connection_mode, u8"连接模式", "Mode", u8"Режим")                                                                             \
+  X(connection_mode_direct, u8"直连", "Direct", u8"Прямой")                                                                       \
+  X(connection_mode_relay, u8"中继", "Relay", u8"Релейный")                                                                       \
+  X(online, u8"在线", "Online", u8"Онлайн")                                                                                       \
+  X(offline, u8"离线", "Offline", u8"Офлайн")                                                                                     \
+  X(device_offline, u8"设备离线", "Device Offline", u8"Устройство офлайн")                                                        \
+  X(request_permissions, u8"权限请求", "Request Permissions",                                                                     \
+    u8"Запрос разрешений")                                                                                                        \
+  X(screen_recording_permission, u8"屏幕录制权限",                                                                                \
+    "Screen Recording Permission", u8"Разрешение на запись экрана")                                                               \
+  X(accessibility_permission, u8"辅助功能权限", "Accessibility Permission",                                                       \
+    u8"Разрешение специальных возможностей")                                                                                      \
+  X(permission_required_message, u8"该应用需要授权以下权限:",                                                                     \
+    "The application requires the following permissions:",                                                                        \
+    u8"Для работы приложения требуются следующие разрешения:")                                                                    \
  X(exit_program, u8"退出", "Exit", u8"Выход")

 inline constexpr TranslationRow kTranslationRows[] = {
@@ -204,11 +204,11 @@ int Render::ConnectTo(const std::string& remote_id, const char* password,
        props->params_.user_id = props->local_id_.c_str();
        props->peer_ = CreatePeer(&props->params_);

-        props->control_window_width_ = title_bar_height_ * 9.0f;
+        props->control_window_width_ = title_bar_height_ * 10.0f;
        props->control_window_height_ = title_bar_height_ * 1.3f;
        props->control_window_min_width_ = title_bar_height_ * 0.65f;
        props->control_window_min_height_ = title_bar_height_ * 1.3f;
-        props->control_window_max_width_ = title_bar_height_ * 9.0f;
+        props->control_window_max_width_ = title_bar_height_ * 10.0f;
        props->control_window_max_height_ = title_bar_height_ * 7.0f;

        props->connection_status_ = ConnectionStatus::Connecting;
@@ -272,4 +272,4 @@ int Render::ConnectTo(const std::string& remote_id, const char* password,

  return 0;
 }
-}  // namespace crossdesk
+}  // namespace crossdesk
@@ -28,6 +28,10 @@
 #include "screen_capturer_factory.h"
 #include "version_checker.h"

+#if _WIN32
+#include "interactive_state.h"
+#include "service_host.h"
+#endif

 #if defined(__APPLE__)
 #include "window_util_mac.h"
@@ -38,6 +42,8 @@
 namespace crossdesk {

 namespace {
+constexpr uint64_t kCaptureResumeKeyFrameGapMs = 500;
+
 const ImWchar* GetMultilingualGlyphRanges() {
  static std::vector<ImWchar> glyph_ranges;
  if (glyph_ranges.empty()) {
@@ -75,6 +81,76 @@ HICON LoadTrayIcon() {

  return LoadIconW(nullptr, IDI_APPLICATION);
 }
+
+struct WindowsServiceInteractiveStatus {
+  bool available = false;
+  bool sas_secure_desktop_grace_active = false;
+  unsigned int error_code = 0;
+  std::string interactive_stage;
+  std::string error;
+};
+
+constexpr uint32_t kWindowsServiceStatusIntervalMs = 1000;
+constexpr uint32_t kWindowsServiceSasSecureDesktopGraceMs = 2000;
+constexpr DWORD kWindowsServiceQueryTimeoutMs = 500;
+constexpr DWORD kWindowsServiceSasTimeoutMs = 500;
+
+bool IsTransientWindowsServiceStatusError(const std::string& error) {
+  return error == "pipe_unavailable" || error == "pipe_connect_failed" ||
+         error == "pipe_read_failed";
+}
+
+RemoteAction BuildWindowsServiceStatusAction(
+    const WindowsServiceInteractiveStatus& status) {
+  RemoteAction action{};
+  action.type = ControlType::service_status;
+  action.ss.available = status.available;
+  std::strncpy(action.ss.interactive_stage, status.interactive_stage.c_str(),
+               sizeof(action.ss.interactive_stage) - 1);
+  action.ss.interactive_stage[sizeof(action.ss.interactive_stage) - 1] = '\0';
+  return action;
+}
+
+bool QueryWindowsServiceInteractiveStatus(
+    WindowsServiceInteractiveStatus* status) {
+  if (status == nullptr) {
+    return false;
+  }
+
+  *status = WindowsServiceInteractiveStatus{};
+  const std::string response =
+      QueryCrossDeskService("status", kWindowsServiceQueryTimeoutMs);
+  auto json = nlohmann::json::parse(response, nullptr, false);
+  if (json.is_discarded() || !json.is_object()) {
+    status->error = "invalid_service_status_json";
+    return false;
+  }
+
+  status->available = json.value("ok", false);
+  if (!status->available) {
+    status->error = json.value("error", std::string("service_unavailable"));
+    status->error_code = json.value("code", 0u);
+    return true;
+  }
+
+  status->interactive_stage = json.value("interactive_stage", std::string());
+  status->sas_secure_desktop_grace_active =
+      json.value("sas_secure_desktop_grace_active", false);
+
+  if (ShouldNormalizeUnlockToUserDesktop(
+          json.value("interactive_lock_screen_visible", false),
+          status->interactive_stage, json.value("session_locked", false),
+          json.value("interactive_logon_ui_visible", false),
+          json.value("interactive_secure_desktop_active",
+                     json.value("secure_desktop_active", false)),
+          json.value("credential_ui_visible", false),
+          json.value("password_box_visible", false),
+          json.value("unlock_ui_visible", false),
+          json.value("last_session_event", std::string()))) {
+    status->interactive_stage = "user-desktop";
+  }
+  return true;
+}
 #endif

 #if defined(__linux__) && !defined(__APPLE__)
@@ -560,6 +636,12 @@ int Render::LoadSettingsFromCacheFile() {
 }

 int Render::ScreenCapturerInit() {
+#ifdef __APPLE__
+  if (!EnsureMacScreenRecordingPermission()) {
+    return -1;
+  }
+#endif
+
  if (!screen_capturer_) {
    screen_capturer_ = (ScreenCapturer*)screen_capturer_factory_->Create();
  }
@@ -577,18 +659,37 @@ int Render::ScreenCapturerInit() {
      fps,
      [this, fps](unsigned char* data, int size, int width, int height,
                  const char* display_name) -> void {
-        auto now_time = std::chrono::duration_cast<std::chrono::milliseconds>(
-                            std::chrono::steady_clock::now().time_since_epoch())
-                            .count();
+        const auto now_time =
+            static_cast<uint64_t>(std::chrono::duration_cast<
+                                  std::chrono::milliseconds>(
+                                      std::chrono::steady_clock::now()
+                                          .time_since_epoch())
+                                      .count());
        auto duration = now_time - last_frame_time_;
        if (duration * fps >= 1000) {  // ~60 FPS
+          const std::string stream_id = display_name ? display_name : "";
+          const bool resumed_after_gap =
+              last_frame_time_ != 0 &&
+              duration >= kCaptureResumeKeyFrameGapMs;
+          const bool stream_changed =
+              !last_video_frame_stream_id_.empty() &&
+              last_video_frame_stream_id_ != stream_id;
+          if (resumed_after_gap || stream_changed) {
+            if (RequestVideoKeyFrame(peer_, stream_id.c_str()) == 0) {
+              LOG_INFO(
+                  "Request video key frame before sending captured frame, "
+                  "stream='{}', gap_ms={}, stream_changed={}",
+                  stream_id, duration, stream_changed);
+            }
+          }
          XVideoFrame frame;
          frame.data = (const char*)data;
          frame.size = size;
          frame.width = width;
          frame.height = height;
          frame.captured_timestamp = GetSystemTimeMicros(peer_);
-          SendVideoFrame(peer_, &frame, display_name);
+          SendVideoFrame(peer_, &frame, stream_id.c_str());
+          last_video_frame_stream_id_ = stream_id;
          last_frame_time_ = now_time;
        }
      });
@@ -610,6 +711,12 @@ int Render::ScreenCapturerInit() {
 }

 int Render::StartScreenCapturer() {
+#ifdef __APPLE__
+  if (!EnsureMacScreenRecordingPermission()) {
+    return -1;
+  }
+#endif
+
  if (!screen_capturer_) {
    LOG_INFO("Screen capturer instance missing, recreating before start");
    if (0 != ScreenCapturerInit()) {
@@ -674,6 +781,12 @@ int Render::StopSpeakerCapturer() {
 }

 int Render::StartMouseController() {
+#ifdef __APPLE__
+  if (!EnsureMacAccessibilityPermission()) {
+    return -1;
+  }
+#endif
+
  if (!device_controller_factory_) {
    LOG_INFO("Device controller factory is nullptr");
    return -1;
@@ -729,29 +842,58 @@ int Render::StopMouseController() {
 }

 int Render::StartKeyboardCapturer() {
+  keyboard_capturer_uses_sdl_events_ = false;
+
+#ifdef __APPLE__
+  if (!EnsureMacAccessibilityPermission()) {
+    keyboard_capturer_uses_sdl_events_ = true;
+    return 0;
+  }
+#endif
+
+#if defined(__linux__) && !defined(__APPLE__)
+  if (IsWaylandSession()) {
+    keyboard_capturer_uses_sdl_events_ = true;
+    LOG_INFO("Start keyboard capturer with SDL Wayland backend");
+    return 0;
+  }
+#endif
+
  if (!keyboard_capturer_) {
-    LOG_INFO("keyboard capturer is nullptr");
-    return -1;
+    keyboard_capturer_uses_sdl_events_ = true;
+    LOG_WARN(
+        "keyboard capturer is nullptr, falling back to SDL keyboard events");
+    return 0;
  }

  int keyboard_capturer_init_ret = keyboard_capturer_->Hook(
-      [](int key_code, bool is_down, void* user_ptr) {
+      [](int key_code, bool is_down, uint32_t scan_code, bool extended,
+         void* user_ptr) {
        if (user_ptr) {
          Render* render = (Render*)user_ptr;
-          render->SendKeyCommand(key_code, is_down);
+          render->SendKeyCommand(key_code, is_down, scan_code, extended);
        }
      },
      this);
  if (0 != keyboard_capturer_init_ret) {
-    LOG_ERROR("Start keyboard capturer failed");
+    keyboard_capturer_uses_sdl_events_ = true;
+    LOG_WARN(
+        "Start keyboard capturer failed, falling back to SDL keyboard "
+        "events");
  } else {
-    LOG_INFO("Start keyboard capturer");
+    LOG_INFO("Start keyboard capturer with native hook");
  }

-  return keyboard_capturer_init_ret;
+  return 0;
 }

 int Render::StopKeyboardCapturer() {
+  if (keyboard_capturer_uses_sdl_events_) {
+    keyboard_capturer_uses_sdl_events_ = false;
+    LOG_INFO("Stop keyboard capturer with SDL keyboard backend");
+    return 0;
+  }
+
  if (keyboard_capturer_) {
    keyboard_capturer_->Unhook();
    LOG_INFO("Stop keyboard capturer");
@@ -1453,6 +1595,10 @@ int Render::DrawMainWindow() {

  UpdateNotificationWindow();

+#if _WIN32 && CROSSDESK_PORTABLE
+  PortableServiceInstallWindow();
+#endif
+
 #ifdef __APPLE__
  if (show_request_permission_window_) {
    RequestPermissionWindow();
@@ -1615,6 +1761,10 @@ int Render::Run() {
  InitializeModules();
  InitializeMainWindow();

+#if _WIN32 && CROSSDESK_PORTABLE
+  CheckPortableWindowsService();
+#endif
+
  const int scaled_video_width_ = 160;
  const int scaled_video_height_ = 90;

@@ -1746,6 +1896,7 @@ void Render::MainLoop() {
    HandlePendingPresenceProbe();
    HandleStreamWindow();
    HandleServerWindow();
+    HandleWindowsServiceIntegration();

    DrawMainWindow();
    if (stream_window_inited_) {
@@ -1772,6 +1923,176 @@ void Render::UpdateLabels() {
  }
 }

+void Render::ResetRemoteServiceStatus(SubStreamWindowProperties& props) {
+  props.remote_service_status_received_ = false;
+  props.remote_service_available_ = false;
+  props.remote_interactive_stage_.clear();
+}
+
+void Render::ApplyRemoteServiceStatus(SubStreamWindowProperties& props,
+                                      const ServiceStatus& status) {
+  props.remote_service_status_received_ = true;
+  props.remote_service_available_ = status.available;
+  props.remote_interactive_stage_ = status.interactive_stage;
+}
+
+Render::RemoteUnlockState Render::GetRemoteUnlockState(
+    const SubStreamWindowProperties& props) const {
+  if (!props.remote_service_status_received_) {
+    return RemoteUnlockState::none;
+  }
+  if (!props.remote_service_available_) {
+    return RemoteUnlockState::service_unavailable;
+  }
+  if (props.remote_interactive_stage_ == "credential-ui") {
+    return RemoteUnlockState::credential_ui;
+  }
+  if (props.remote_interactive_stage_ == "lock-screen") {
+    return RemoteUnlockState::lock_screen;
+  }
+  if (props.remote_interactive_stage_ == "secure-desktop") {
+    return RemoteUnlockState::secure_desktop;
+  }
+  return RemoteUnlockState::none;
+}
+
+void Render::HandleWindowsServiceIntegration() {
+#if _WIN32
+  static bool last_logged_service_available = true;
+  static unsigned int last_logged_service_error_code = 0;
+  static std::string last_logged_service_error;
+
+  if (!is_server_mode_ || peer_ == nullptr) {
+    ResetLocalWindowsServiceState(true);
+    return;
+  }
+
+  const bool has_connected_remote =
+      std::any_of(connection_status_.begin(), connection_status_.end(),
+                  [](const auto& entry) {
+                    return entry.second == ConnectionStatus::Connected;
+                  });
+  if (!has_connected_remote) {
+    ResetLocalWindowsServiceState(false);
+    return;
+  }
+
+  bool force_broadcast = false;
+  if (pending_windows_service_sas_.exchange(false, std::memory_order_relaxed)) {
+    const std::string response =
+        QueryCrossDeskService("sas", kWindowsServiceSasTimeoutMs);
+    auto json = nlohmann::json::parse(response, nullptr, false);
+    if (json.is_discarded() || !json.value("ok", false)) {
+      LOG_WARN("Remote SAS request failed: {}", response);
+    } else {
+      LOG_INFO("Remote SAS request forwarded to local Windows service");
+      optimistic_windows_secure_desktop_until_tick_ =
+          static_cast<uint32_t>(SDL_GetTicks()) +
+          kWindowsServiceSasSecureDesktopGraceMs;
+      local_service_status_received_ = true;
+      local_service_available_ = true;
+      local_interactive_stage_ = "secure-desktop";
+    }
+    last_windows_service_status_tick_ = 0;
+    force_broadcast = true;
+  }
+
+  const uint32_t now = static_cast<uint32_t>(SDL_GetTicks());
+  if (!force_broadcast && last_windows_service_status_tick_ != 0 &&
+      now - last_windows_service_status_tick_ <
+          kWindowsServiceStatusIntervalMs) {
+    return;
+  }
+  last_windows_service_status_tick_ = now;
+
+  WindowsServiceInteractiveStatus status;
+  const bool status_ok = QueryWindowsServiceInteractiveStatus(&status);
+  WindowsServiceInteractiveStatus broadcast_status = status;
+  const bool previous_secure_desktop_interaction =
+      IsSecureDesktopInteractionRequired(local_interactive_stage_);
+  const bool optimistic_secure_desktop_active =
+      optimistic_windows_secure_desktop_until_tick_ != 0 &&
+      static_cast<int32_t>(optimistic_windows_secure_desktop_until_tick_ -
+                           now) > 0;
+  const bool keep_optimistic_secure_desktop =
+      status_ok && status.available && optimistic_secure_desktop_active &&
+      status.sas_secure_desktop_grace_active &&
+      status.interactive_stage == "user-desktop";
+  local_service_status_received_ =
+      status_ok || previous_secure_desktop_interaction;
+  local_service_available_ = status.available;
+  if (status.available) {
+    if (keep_optimistic_secure_desktop) {
+      local_interactive_stage_ = "secure-desktop";
+      broadcast_status.interactive_stage = local_interactive_stage_;
+    } else {
+      local_interactive_stage_ = status.interactive_stage;
+      optimistic_windows_secure_desktop_until_tick_ = 0;
+    }
+  } else if (!previous_secure_desktop_interaction) {
+    local_interactive_stage_.clear();
+    optimistic_windows_secure_desktop_until_tick_ = 0;
+  }
+
+  if (status_ok) {
+    const bool availability_changed =
+        status.available != last_logged_service_available;
+    const bool error_changed =
+        !status.available &&
+        (status.error != last_logged_service_error ||
+         status.error_code != last_logged_service_error_code);
+    if (availability_changed || error_changed) {
+      if (status.available) {
+        LOG_INFO(
+            "Local Windows service available for secure desktop integration");
+      } else if (IsTransientWindowsServiceStatusError(status.error)) {
+        LOG_INFO(
+            "Local Windows service temporarily unavailable, keeping last "
+            "secure desktop state: error={}, code={}",
+            status.error, status.error_code);
+      } else {
+        LOG_WARN(
+            "Local Windows service unavailable, secure desktop integration "
+            "disabled: error={}, code={}",
+            status.error, status.error_code);
+      }
+      last_logged_service_available = status.available;
+      last_logged_service_error = status.error;
+      last_logged_service_error_code = status.error_code;
+    }
+  } else if (last_logged_service_available ||
+             last_logged_service_error != "invalid_service_status_json") {
+    LOG_WARN(
+        "Local Windows service status query failed, secure desktop integration "
+        "disabled");
+    last_logged_service_available = false;
+    last_logged_service_error = "invalid_service_status_json";
+    last_logged_service_error_code = 0;
+  }
+
+  RemoteAction remote_action = BuildWindowsServiceStatusAction(broadcast_status);
+  std::string msg = remote_action.to_json();
+  int ret = SendReliableDataFrame(peer_, msg.data(), msg.size(),
+                                  control_data_label_.c_str());
+  if (ret != 0) {
+    LOG_WARN("Broadcast Windows service status failed, ret={}", ret);
+  }
+#endif
+}
+
+#if _WIN32
+void Render::ResetLocalWindowsServiceState(bool clear_pending_sas) {
+  last_windows_service_status_tick_ = 0;
+  if (clear_pending_sas) {
+    pending_windows_service_sas_.store(false, std::memory_order_relaxed);
+  }
+  local_service_status_received_ = false;
+  local_service_available_ = false;
+  local_interactive_stage_.clear();
+  optimistic_windows_secure_desktop_until_tick_ = 0;
+}
+#endif
+
 void Render::HandleRecentConnections() {
  if (reload_recent_connections_ && main_renderer_) {
    uint32_t now_time = SDL_GetTicks();
@@ -1959,6 +2280,10 @@ void Render::Cleanup() {
  CleanupFactories();
  CleanupPeers();

+#if _WIN32 && CROSSDESK_PORTABLE
+  JoinPortableWindowsServiceInstallThread();
+#endif
+
  WaitForThumbnailSaveTasks();

  AudioDeviceDestroy();
@@ -2470,7 +2795,7 @@ void Render::ProcessSdlEvent(const SDL_Event& event) {
    case SDL_EVENT_WINDOW_FOCUS_LOST:
      if (stream_window_ &&
          SDL_GetWindowID(stream_window_) == event.window.windowID) {
-        ForceReleasePressedModifiers();
+        ForceReleasePressedKeys();
        focus_on_stream_window_ = false;
      } else if (main_window_ &&
                 SDL_GetWindowID(main_window_) == event.window.windowID) {
@@ -2502,6 +2827,15 @@ void Render::ProcessSdlEvent(const SDL_Event& event) {
      break;
    }

+    case SDL_EVENT_KEY_DOWN:
+    case SDL_EVENT_KEY_UP:
+      if (keyboard_capturer_is_started_ && keyboard_capturer_uses_sdl_events_ &&
+          focus_on_stream_window_ && stream_window_ &&
+          SDL_GetWindowID(stream_window_) == event.key.windowID) {
+        ProcessKeyboardEvent(event);
+      }
+      break;
+
    default:
      if (event.type == STREAM_REFRESH_EVENT) {
        auto* props = static_cast<SubStreamWindowProperties*>(event.user.data1);
@@ -44,6 +44,14 @@
 namespace crossdesk {
 class Render {
 public:
+  enum class RemoteUnlockState {
+    none,
+    service_unavailable,
+    lock_screen,
+    credential_ui,
+    secure_desktop,
+  };
+
  struct FileTransferState {
    std::atomic<bool> file_sending_ = false;
    std::atomic<uint64_t> file_sent_bytes_ = 0;
@@ -54,6 +62,7 @@ class Render {
    std::chrono::steady_clock::time_point file_send_last_update_time_;
    uint64_t file_send_last_bytes_ = 0;
    bool file_transfer_window_visible_ = false;
+    bool file_transfer_window_hovered_ = false;
    std::atomic<uint32_t> current_file_id_{0};

    struct QueuedFile {
@@ -106,6 +115,7 @@ class Render {
    bool is_control_bar_in_left_ = true;
    bool control_bar_hovered_ = false;
    bool display_selectable_hovered_ = false;
+    bool shortcut_selectable_hovered_ = false;
    bool control_bar_expand_ = true;
    bool reset_control_bar_pos_ = false;
    bool control_window_width_is_changing_ = false;
@@ -116,10 +126,10 @@ class Render {
    float sub_stream_window_width_ = 1280;
    float sub_stream_window_height_ = 720;
    float control_window_min_width_ = 20;
-    float control_window_max_width_ = 230;
+    float control_window_max_width_ = 300;
    float control_window_min_height_ = 38;
    float control_window_max_height_ = 180;
-    float control_window_width_ = 230;
+    float control_window_width_ = 300;
    float control_window_height_ = 38;
    float control_bar_pos_x_ = 0;
    float control_bar_pos_y_ = 30;
@@ -159,6 +169,9 @@ class Render {
    std::string mouse_control_button_label_ = "Mouse Control";
    std::string audio_capture_button_label_ = "Audio Capture";
    std::string remote_host_name_ = "";
+    bool remote_service_status_received_ = false;
+    bool remote_service_available_ = false;
+    std::string remote_interactive_stage_ = "";
    std::vector<DisplayInfo> display_info_list_;
    SDL_Texture* stream_texture_ = nullptr;
    uint8_t* argb_buffer_ = nullptr;
@@ -271,6 +284,11 @@ class Render {
      std::shared_ptr<SubStreamWindowProperties>& props);
  void DrawReceivingScreenText(
      std::shared_ptr<SubStreamWindowProperties>& props);
+  void ResetRemoteServiceStatus(SubStreamWindowProperties& props);
+  void ApplyRemoteServiceStatus(SubStreamWindowProperties& props,
+                                const ServiceStatus& status);
+  RemoteUnlockState GetRemoteUnlockState(
+      const SubStreamWindowProperties& props) const;
 #ifdef __APPLE__
  int RequestPermissionWindow();
  bool CheckScreenRecordingPermission();
@@ -278,6 +296,9 @@ class Render {
  void OpenScreenRecordingPreferences();
  void OpenAccessibilityPreferences();
  bool DrawToggleSwitch(const char* id, bool active, bool enabled);
+  void RefreshMacPermissionStatus(bool force);
+  bool EnsureMacScreenRecordingPermission();
+  bool EnsureMacAccessibilityPermission();
 #endif

 public:
@@ -322,10 +343,12 @@ class Render {
  static void FreeRemoteAction(RemoteAction& action);

 private:
-  int SendKeyCommand(int key_code, bool is_down);
+  int SendKeyCommand(int key_code, bool is_down, uint32_t scan_code = 0,
+                     bool extended = false);
  static bool IsModifierVkKey(int key_code);
-  void UpdatePressedModifierState(int key_code, bool is_down);
-  void ForceReleasePressedModifiers();
+  void TrackPressedKeyState(int key_code, bool is_down);
+  void ForceReleasePressedKeys();
+  int ProcessKeyboardEvent(const SDL_Event& event);
  int ProcessMouseEvent(const SDL_Event& event);

  static void SdlCaptureAudioIn(void* userdata, Uint8* stream, int len);
@@ -359,6 +382,23 @@ class Render {

  int AudioDeviceInit();
  int AudioDeviceDestroy();
+  void HandleWindowsServiceIntegration();
+#if _WIN32
+  void ResetLocalWindowsServiceState(bool clear_pending_sas);
+#if CROSSDESK_PORTABLE
+  enum class PortableServiceInstallState {
+    idle,
+    installing,
+    succeeded,
+    failed,
+  };
+
+  void CheckPortableWindowsService();
+  int PortableServiceInstallWindow();
+  void StartPortableWindowsServiceInstall();
+  void JoinPortableWindowsServiceInstallThread();
+#endif
+#endif

 private:
  struct CDCache {
@@ -455,6 +495,7 @@ class Render {
  bool start_keyboard_capturer_ = false;
  bool show_cursor_ = false;
  bool keyboard_capturer_is_started_ = false;
+  bool keyboard_capturer_uses_sdl_events_ = false;
  bool foucs_on_main_window_ = false;
  bool focus_on_stream_window_ = false;
  bool main_window_minimized_ = false;
@@ -510,11 +551,27 @@ class Render {
  std::string controlled_remote_id_ = "";
  std::string focused_remote_id_ = "";
  std::string remote_client_id_ = "";
-  std::unordered_set<int> pressed_modifier_keys_;
-  std::mutex pressed_modifier_keys_mutex_;
+  std::unordered_set<int> pressed_keyboard_keys_;
+  std::mutex pressed_keyboard_keys_mutex_;
  SDL_Event last_mouse_event;
  SDL_AudioStream* output_stream_;
  uint32_t STREAM_REFRESH_EVENT = 0;
+#if _WIN32
+  std::atomic<bool> pending_windows_service_sas_{false};
+  bool local_service_status_received_ = false;
+  bool local_service_available_ = false;
+  std::string local_interactive_stage_;
+  uint32_t last_local_secure_input_block_log_tick_ = 0;
+  uint32_t last_windows_service_status_tick_ = 0;
+  uint32_t optimistic_windows_secure_desktop_until_tick_ = 0;
+#if CROSSDESK_PORTABLE
+  bool portable_service_prompt_checked_ = false;
+  bool show_portable_service_install_window_ = false;
+  std::atomic<PortableServiceInstallState> portable_service_install_state_{
+      PortableServiceInstallState::idle};
+  std::thread portable_service_install_thread_;
+#endif
+#endif

  // stream window render
  SDL_Window* stream_window_ = nullptr;
@@ -638,12 +695,19 @@ class Render {
  KeyboardCapturer* keyboard_capturer_ = nullptr;
  std::vector<DisplayInfo> display_info_list_;
  uint64_t last_frame_time_;
+  std::string last_video_frame_stream_id_;
  bool show_new_version_icon_ = false;
  bool show_new_version_icon_in_menu_ = true;
  double new_version_icon_last_trigger_time_ = 0.0;
  double new_version_icon_render_start_time_ = 0.0;
 #ifdef __APPLE__
  bool show_request_permission_window_ = true;
+  bool mac_permission_status_initialized_ = false;
+  uint32_t mac_permission_last_check_tick_ = 0;
+  bool mac_screen_recording_permission_granted_ = false;
+  bool mac_accessibility_permission_granted_ = false;
+  bool mac_screen_recording_permission_requested_ = false;
+  bool mac_accessibility_permission_requested_ = false;
 #endif
  char client_id_[10] = "";
  char client_id_display_[12] = "";
@@ -17,11 +17,326 @@
 #include "platform.h"
 #include "rd_log.h"
 #include "render.h"
+#include "windows_key_metadata.h"
+#if _WIN32
+#include "interactive_state.h"
+#include "service_host.h"
+#endif

 #define NV12_BUFFER_SIZE 1280 * 720 * 3 / 2

 namespace crossdesk {

+namespace {
+
+int TranslateSdlKeypadScancodeToVk(const SDL_KeyboardEvent& event) {
+  const bool numlock_enabled = (event.mod & SDL_KMOD_NUM) != 0;
+
+  switch (event.scancode) {
+    case SDL_SCANCODE_NUMLOCKCLEAR:
+      return 0x90;
+    case SDL_SCANCODE_KP_ENTER:
+      return 0x0D;
+    case SDL_SCANCODE_KP_0:
+      if (!numlock_enabled) {
+        return 0x2D;
+      }
+      return 0x60;
+    case SDL_SCANCODE_KP_1:
+      if (!numlock_enabled) {
+        return 0x23;
+      }
+      return 0x61;
+    case SDL_SCANCODE_KP_2:
+      if (!numlock_enabled) {
+        return 0x28;
+      }
+      return 0x62;
+    case SDL_SCANCODE_KP_3:
+      if (!numlock_enabled) {
+        return 0x22;
+      }
+      return 0x63;
+    case SDL_SCANCODE_KP_4:
+      if (!numlock_enabled) {
+        return 0x25;
+      }
+      return 0x64;
+    case SDL_SCANCODE_KP_5:
+      return 0x65;
+    case SDL_SCANCODE_KP_6:
+      if (!numlock_enabled) {
+        return 0x27;
+      }
+      return 0x66;
+    case SDL_SCANCODE_KP_7:
+      if (!numlock_enabled) {
+        return 0x24;
+      }
+      return 0x67;
+    case SDL_SCANCODE_KP_8:
+      if (!numlock_enabled) {
+        return 0x26;
+      }
+      return 0x68;
+    case SDL_SCANCODE_KP_9:
+      if (!numlock_enabled) {
+        return 0x21;
+      }
+      return 0x69;
+    case SDL_SCANCODE_KP_PERIOD:
+    case SDL_SCANCODE_KP_COMMA:
+      if (!numlock_enabled) {
+        return 0x2E;
+      }
+      return 0x6E;
+    case SDL_SCANCODE_KP_DIVIDE:
+      return 0x6F;
+    case SDL_SCANCODE_KP_MULTIPLY:
+      return 0x6A;
+    case SDL_SCANCODE_KP_MINUS:
+      return 0x6D;
+    case SDL_SCANCODE_KP_PLUS:
+      return 0x6B;
+    case SDL_SCANCODE_KP_EQUALS:
+      return 0xBB;
+    default:
+      return -1;
+  }
+}
+
+int TranslateSdlKeyboardEventToVk(const SDL_KeyboardEvent& event) {
+  const int keypad_key_code = TranslateSdlKeypadScancodeToVk(event);
+  if (keypad_key_code >= 0) {
+    return keypad_key_code;
+  }
+
+  const int key = static_cast<int>(event.key);
+  if (key >= 'a' && key <= 'z') {
+    return key - 'a' + 0x41;
+  }
+  if (key >= 'A' && key <= 'Z') {
+    return key;
+  }
+  if (key >= '0' && key <= '9') {
+    return key;
+  }
+
+  switch (key) {
+    case ';':
+      return 0xBA;
+    case '\'':
+      return 0xDE;
+    case '`':
+      return 0xC0;
+    case ',':
+      return 0xBC;
+    case '.':
+      return 0xBE;
+    case '/':
+      return 0xBF;
+    case '\\':
+      return 0xDC;
+    case '[':
+      return 0xDB;
+    case ']':
+      return 0xDD;
+    case '-':
+      return 0xBD;
+    case '=':
+      return 0xBB;
+    default:
+      break;
+  }
+
+  switch (event.scancode) {
+    case SDL_SCANCODE_ESCAPE:
+      return 0x1B;
+    case SDL_SCANCODE_RETURN:
+      return 0x0D;
+    case SDL_SCANCODE_SPACE:
+      return 0x20;
+    case SDL_SCANCODE_BACKSPACE:
+      return 0x08;
+    case SDL_SCANCODE_TAB:
+      return 0x09;
+    case SDL_SCANCODE_PRINTSCREEN:
+      return 0x2C;
+    case SDL_SCANCODE_SCROLLLOCK:
+      return 0x91;
+    case SDL_SCANCODE_PAUSE:
+      return 0x13;
+    case SDL_SCANCODE_INSERT:
+      return 0x2D;
+    case SDL_SCANCODE_DELETE:
+      return 0x2E;
+    case SDL_SCANCODE_HOME:
+      return 0x24;
+    case SDL_SCANCODE_END:
+      return 0x23;
+    case SDL_SCANCODE_PAGEUP:
+      return 0x21;
+    case SDL_SCANCODE_PAGEDOWN:
+      return 0x22;
+    case SDL_SCANCODE_LEFT:
+      return 0x25;
+    case SDL_SCANCODE_RIGHT:
+      return 0x27;
+    case SDL_SCANCODE_UP:
+      return 0x26;
+    case SDL_SCANCODE_DOWN:
+      return 0x28;
+    case SDL_SCANCODE_F1:
+      return 0x70;
+    case SDL_SCANCODE_F2:
+      return 0x71;
+    case SDL_SCANCODE_F3:
+      return 0x72;
+    case SDL_SCANCODE_F4:
+      return 0x73;
+    case SDL_SCANCODE_F5:
+      return 0x74;
+    case SDL_SCANCODE_F6:
+      return 0x75;
+    case SDL_SCANCODE_F7:
+      return 0x76;
+    case SDL_SCANCODE_F8:
+      return 0x77;
+    case SDL_SCANCODE_F9:
+      return 0x78;
+    case SDL_SCANCODE_F10:
+      return 0x79;
+    case SDL_SCANCODE_F11:
+      return 0x7A;
+    case SDL_SCANCODE_F12:
+      return 0x7B;
+    case SDL_SCANCODE_CAPSLOCK:
+      return 0x14;
+    case SDL_SCANCODE_LSHIFT:
+      return 0xA0;
+    case SDL_SCANCODE_RSHIFT:
+      return 0xA1;
+    case SDL_SCANCODE_LCTRL:
+      return 0xA2;
+    case SDL_SCANCODE_RCTRL:
+      return 0xA3;
+    case SDL_SCANCODE_LALT:
+      return 0xA4;
+    case SDL_SCANCODE_RALT:
+      return 0xA5;
+    case SDL_SCANCODE_LGUI:
+      return 0x5B;
+    case SDL_SCANCODE_RGUI:
+      return 0x5C;
+    default:
+      return -1;
+  }
+}
+
+int NormalizeWindowsModifierVk(int key_code, uint32_t scan_code,
+                               bool extended) {
+#if _WIN32
+  if (key_code != 0x10 && key_code != 0x11 && key_code != 0x12) {
+    return key_code;
+  }
+
+  UINT scan_code_with_prefix = static_cast<UINT>(scan_code & 0xFF);
+  if (extended) {
+    scan_code_with_prefix |= 0xE000;
+  }
+
+  const UINT normalized_vk =
+      MapVirtualKeyW(scan_code_with_prefix, MAPVK_VSC_TO_VK_EX);
+  return normalized_vk != 0 ? static_cast<int>(normalized_vk) : key_code;
+#else
+  (void)scan_code;
+  (void)extended;
+  return key_code;
+#endif
+}
+
+void PopulateWindowsKeyMetadataFromVk(int key_code, uint32_t* scan_code_out,
+                                      bool* extended_out) {
+  if (scan_code_out == nullptr || extended_out == nullptr) {
+    return;
+  }
+
+#if _WIN32
+  const UINT scan_code =
+      MapVirtualKeyW(static_cast<UINT>(key_code), MAPVK_VK_TO_VSC_EX);
+  if (scan_code == 0) {
+    LookupWindowsKeyMetadataFromVk(key_code, scan_code_out, extended_out);
+    return;
+  }
+
+  *scan_code_out = static_cast<uint32_t>(scan_code & 0xFF);
+  *extended_out = (scan_code & 0xFF00) != 0;
+#else
+  LookupWindowsKeyMetadataFromVk(key_code, scan_code_out, extended_out);
+#endif
+}
+
+#if _WIN32
+constexpr uint32_t kSecureDesktopInputLogIntervalMs = 2000;
+
+bool BuildAbsoluteMousePosition(const std::vector<DisplayInfo>& displays,
+                                int display_index, float normalized_x,
+                                float normalized_y, int* absolute_x_out,
+                                int* absolute_y_out) {
+  if (absolute_x_out == nullptr || absolute_y_out == nullptr ||
+      display_index < 0 || display_index >= static_cast<int>(displays.size())) {
+    return false;
+  }
+
+  const DisplayInfo& display = displays[display_index];
+  if (display.width <= 0 || display.height <= 0) {
+    return false;
+  }
+
+  const float clamped_x = std::clamp(normalized_x, 0.0f, 1.0f);
+  const float clamped_y = std::clamp(normalized_y, 0.0f, 1.0f);
+  *absolute_x_out = static_cast<int>(clamped_x * display.width) + display.left;
+  *absolute_y_out = static_cast<int>(clamped_y * display.height) + display.top;
+  return true;
+}
+
+void LogSecureDesktopInputBlocked(uint32_t* last_tick, const char* side,
+                                  const char* stage) {
+  if (last_tick == nullptr) {
+    return;
+  }
+
+  const uint32_t now = static_cast<uint32_t>(SDL_GetTicks());
+  if (*last_tick != 0 && now - *last_tick < kSecureDesktopInputLogIntervalMs) {
+    return;
+  }
+
+  *last_tick = now;
+  LOG_WARN(
+      "{} secure-desktop input blocked, stage={}, normal SendInput path "
+      "cannot drive the Windows password UI",
+      side != nullptr ? side : "unknown", stage != nullptr ? stage : "");
+}
+
+bool IsTransientSecureDesktopInputFailure(const nlohmann::json& response,
+                                          const RemoteAction& action) {
+  if (!response.is_object()) {
+    return false;
+  }
+  if (response.value("error", std::string()) != "send_input_failed") {
+    return false;
+  }
+  if (response.value("code", 0u) != ERROR_ACCESS_DENIED) {
+    return false;
+  }
+
+  return action.type == ControlType::keyboard &&
+         action.k.flag == KeyFlag::key_up;
+}
+#endif
+
+}  // namespace
+
 void Render::OnSignalMessageCb(const char* message, size_t size,
                               void* user_data) {
  Render* render = (Render*)user_data;
@@ -100,29 +415,29 @@ bool Render::IsModifierVkKey(int key_code) {
  }
 }

-void Render::UpdatePressedModifierState(int key_code, bool is_down) {
-  if (!IsModifierVkKey(key_code)) {
+void Render::TrackPressedKeyState(int key_code, bool is_down) {
+  if (!IsWaylandSession() && !IsModifierVkKey(key_code)) {
    return;
  }

-  std::lock_guard<std::mutex> lock(pressed_modifier_keys_mutex_);
+  std::lock_guard<std::mutex> lock(pressed_keyboard_keys_mutex_);
  if (is_down) {
-    pressed_modifier_keys_.insert(key_code);
+    pressed_keyboard_keys_.insert(key_code);
  } else {
-    pressed_modifier_keys_.erase(key_code);
+    pressed_keyboard_keys_.erase(key_code);
  }
 }

-void Render::ForceReleasePressedModifiers() {
+void Render::ForceReleasePressedKeys() {
  std::vector<int> pressed_keys;
  {
-    std::lock_guard<std::mutex> lock(pressed_modifier_keys_mutex_);
-    if (pressed_modifier_keys_.empty()) {
+    std::lock_guard<std::mutex> lock(pressed_keyboard_keys_mutex_);
+    if (pressed_keyboard_keys_.empty()) {
      return;
    }
-    pressed_keys.assign(pressed_modifier_keys_.begin(),
-                        pressed_modifier_keys_.end());
-    pressed_modifier_keys_.clear();
+    pressed_keys.assign(pressed_keyboard_keys_.begin(),
+                        pressed_keyboard_keys_.end());
+    pressed_keyboard_keys_.clear();
  }

  for (int key_code : pressed_keys) {
@@ -130,15 +445,26 @@ void Render::ForceReleasePressedModifiers() {
  }
 }

-int Render::SendKeyCommand(int key_code, bool is_down) {
-  RemoteAction remote_action;
+int Render::SendKeyCommand(int key_code, bool is_down, uint32_t scan_code,
+                           bool extended) {
+  RemoteAction remote_action{};
  remote_action.type = ControlType::keyboard;
  if (is_down) {
    remote_action.k.flag = KeyFlag::key_down;
  } else {
    remote_action.k.flag = KeyFlag::key_up;
  }
+
+  if (scan_code == 0) {
+    PopulateWindowsKeyMetadataFromVk(key_code, &scan_code, &extended);
+  }
+#if _WIN32
+  key_code = NormalizeWindowsModifierVk(key_code, scan_code, extended);
+#endif
+
  remote_action.k.key_value = key_code;
+  remote_action.k.scan_code = scan_code;
+  remote_action.k.extended = extended;

  std::string target_id = controlled_remote_id_.empty() ? focused_remote_id_
                                                        : controlled_remote_id_;
@@ -158,14 +484,31 @@ int Render::SendKeyCommand(int key_code, bool is_down) {
    }
  }

-  UpdatePressedModifierState(key_code, is_down);
+  TrackPressedKeyState(key_code, is_down);

  return 0;
 }

+int Render::ProcessKeyboardEvent(const SDL_Event& event) {
+  if (event.type != SDL_EVENT_KEY_DOWN && event.type != SDL_EVENT_KEY_UP) {
+    return -1;
+  }
+
+  if (event.type == SDL_EVENT_KEY_DOWN && event.key.repeat) {
+    return 0;
+  }
+
+  const int key_code = TranslateSdlKeyboardEventToVk(event.key);
+  if (key_code < 0) {
+    return 0;
+  }
+
+  return SendKeyCommand(key_code, event.type == SDL_EVENT_KEY_DOWN);
+}
+
 int Render::ProcessMouseEvent(const SDL_Event& event) {
  controlled_remote_id_ = "";
-  RemoteAction remote_action;
+  RemoteAction remote_action{};
  float cursor_x = last_mouse_event.motion.x;
  float cursor_y = last_mouse_event.motion.y;

@@ -234,13 +577,20 @@ int Render::ProcessMouseEvent(const SDL_Event& event) {
      continue;
    }

+    const bool file_transfer_window_hovered =
+        props->file_transfer_.file_transfer_window_hovered_;
+    const bool overlay_hovered =
+        props->control_bar_hovered_ || props->display_selectable_hovered_ ||
+        props->shortcut_selectable_hovered_ || file_transfer_window_hovered;
+
    const SDL_FRect render_rect = props->stream_render_rect_f_;
    if (render_rect.w <= 1.0f || render_rect.h <= 1.0f) {
      continue;
    }

    if (is_pointer_position_event && cursor_x >= render_rect.x &&
-        cursor_x <= render_rect.x + render_rect.w && cursor_y >= render_rect.y &&
+        cursor_x <= render_rect.x + render_rect.w &&
+        cursor_y >= render_rect.y &&
        cursor_y <= render_rect.y + render_rect.h) {
      controlled_remote_id_ = it.first;
      last_mouse_event.motion.x = cursor_x;
@@ -276,7 +626,7 @@ int Render::ProcessMouseEvent(const SDL_Event& event) {
        remote_action.m.flag = MouseFlag::move;
      }

-      if (props->control_bar_hovered_ || props->display_selectable_hovered_) {
+      if (overlay_hovered) {
        break;
      }
      if (props->peer_) {
@@ -322,7 +672,7 @@ int Render::ProcessMouseEvent(const SDL_Event& event) {
      remote_action.m.x = std::clamp(remote_action.m.x, 0.0f, 1.0f);
      remote_action.m.y = std::clamp(remote_action.m.y, 0.0f, 1.0f);

-      if (props->control_bar_hovered_) {
+      if (overlay_hovered) {
        continue;
      }
      if (props->peer_) {
@@ -709,16 +1059,36 @@ void Render::OnReceiveDataBufferCb(const char* data, size_t size,
  }

  std::string json_str(data, size);
-  RemoteAction remote_action;
-
-  try {
-    remote_action.from_json(json_str);
-  } catch (const std::exception& e) {
-    LOG_ERROR("Failed to parse RemoteAction JSON: {}", e.what());
+  RemoteAction remote_action{};
+  if (!remote_action.from_json(json_str)) {
+    LOG_ERROR("Failed to parse RemoteAction JSON payload");
    return;
  }

  std::string remote_id(user_id, user_id_size);
+  if (remote_action.type == ControlType::service_status) {
+    auto props_it = render->client_properties_.find(remote_id);
+    if (props_it != render->client_properties_.end()) {
+      render->ApplyRemoteServiceStatus(*props_it->second, remote_action.ss);
+    }
+    return;
+  }
+
+  if (remote_action.type == ControlType::service_command) {
+#if _WIN32
+    if (remote_action.c.flag == ServiceCommandFlag::send_sas) {
+      render->pending_windows_service_sas_.store(true,
+                                                 std::memory_order_relaxed);
+    } else if (remote_action.c.flag == ServiceCommandFlag::lock_workstation) {
+      if (!LockWorkStation()) {
+        LOG_WARN("Remote lock workstation request failed, error={}",
+                 GetLastError());
+      }
+    }
+#endif
+    return;
+  }
+
  // std::shared_lock lock(render->client_properties_mutex_);
  if (remote_action.type == ControlType::host_infomation) {
    if (render->client_properties_.find(remote_id) !=
@@ -748,6 +1118,68 @@ void Render::OnReceiveDataBufferCb(const char* data, size_t size,
    }
  } else {
    // remote
+#if _WIN32
+    if (render->local_service_status_received_ &&
+        IsSecureDesktopInteractionRequired(render->local_interactive_stage_)) {
+      if (remote_action.type == ControlType::mouse) {
+        int absolute_x = 0;
+        int absolute_y = 0;
+        if (!BuildAbsoluteMousePosition(render->display_info_list_,
+                                        render->selected_display_,
+                                        remote_action.m.x, remote_action.m.y,
+                                        &absolute_x, &absolute_y)) {
+          LOG_WARN(
+              "Secure desktop mouse injection skipped, invalid display "
+              "mapping: display_index={}, x={}, y={}",
+              render->selected_display_, remote_action.m.x, remote_action.m.y);
+          return;
+        }
+
+        const std::string response = SendCrossDeskSecureDesktopMouseInput(
+            absolute_x, absolute_y, remote_action.m.s,
+            static_cast<int>(remote_action.m.flag), 1000);
+        auto json = nlohmann::json::parse(response, nullptr, false);
+        if (json.is_discarded() || !json.value("ok", false)) {
+          LogSecureDesktopInputBlocked(
+              &render->last_local_secure_input_block_log_tick_, "local",
+              render->local_interactive_stage_.c_str());
+          LOG_WARN(
+              "Secure desktop mouse injection failed, x={}, y={}, wheel={}, "
+              "flag={}, response={}",
+              absolute_x, absolute_y, remote_action.m.s,
+              static_cast<int>(remote_action.m.flag), response);
+        }
+        return;
+      }
+
+      if (remote_action.type == ControlType::keyboard) {
+        const int key_code = static_cast<int>(remote_action.k.key_value);
+        const bool is_down = remote_action.k.flag == KeyFlag::key_down;
+        const std::string response = SendCrossDeskSecureDesktopKeyInput(
+            key_code, is_down, remote_action.k.scan_code,
+            remote_action.k.extended, 1000);
+        auto json = nlohmann::json::parse(response, nullptr, false);
+        if (json.is_discarded() || !json.value("ok", false)) {
+          if (!json.is_discarded() &&
+              IsTransientSecureDesktopInputFailure(json, remote_action)) {
+            LOG_INFO(
+                "Secure desktop keyboard injection transient failure, "
+                "key_code={}, is_down={}, response={}",
+                key_code, is_down, response);
+            return;
+          }
+          LogSecureDesktopInputBlocked(
+              &render->last_local_secure_input_block_log_tick_, "local",
+              render->local_interactive_stage_.c_str());
+          LOG_WARN(
+              "Secure desktop keyboard injection failed, key_code={}, "
+              "is_down={}, response={}",
+              key_code, is_down, response);
+        }
+        return;
+      }
+    }
+#endif
    if (remote_action.type == ControlType::mouse && render->mouse_controller_) {
      render->mouse_controller_->SendMouseCommand(remote_action,
                                                  render->selected_display_);
@@ -760,7 +1192,8 @@ void Render::OnReceiveDataBufferCb(const char* data, size_t size,
               render->keyboard_capturer_) {
      render->keyboard_capturer_->SendKeyboardCommand(
          (int)remote_action.k.key_value,
-          remote_action.k.flag == KeyFlag::key_down);
+          remote_action.k.flag == KeyFlag::key_down, remote_action.k.scan_code,
+          remote_action.k.extended);
    } else if (remote_action.type == ControlType::display_id &&
               render->screen_capturer_) {
      render->selected_display_ = remote_action.d;
@@ -841,6 +1274,7 @@ void Render::OnConnectionStatusCb(ConnectionStatus status, const char* user_id,

    switch (status) {
      case ConnectionStatus::Connected: {
+        render->ResetRemoteServiceStatus(*props);
        {
          RemoteAction remote_action;
          remote_action.i.display_num = render->display_info_list_.size();
@@ -904,6 +1338,7 @@ void Render::OnConnectionStatusCb(ConnectionStatus status, const char* user_id,
      case ConnectionStatus::Closed: {
        props->connection_established_ = false;
        props->enable_mouse_control_ = false;
+        render->ResetRemoteServiceStatus(*props);

        {
          std::lock_guard<std::mutex> lock(props->video_frame_mutex_);
@@ -954,6 +1389,9 @@ void Render::OnConnectionStatusCb(ConnectionStatus status, const char* user_id,

    switch (status) {
      case ConnectionStatus::Connected: {
+#if _WIN32
+        render->last_windows_service_status_tick_ = 0;
+#endif
        {
          RemoteAction remote_action;
          remote_action.i.display_num = render->display_info_list_.size();
@@ -1028,8 +1466,9 @@ void Render::OnConnectionStatusCb(ConnectionStatus status, const char* user_id,
            // Keep Wayland capture session warm to avoid black screen on
            // subsequent reconnects.
            render->start_screen_capturer_ = true;
-            LOG_INFO("Keeping Wayland screen capturer running after "
-                     "disconnect to preserve reconnect stability");
+            LOG_INFO(
+                "Keeping Wayland screen capturer running after "
+                "disconnect to preserve reconnect stability");
          } else {
            render->start_screen_capturer_ = false;
          }
@@ -15,6 +15,22 @@

 namespace crossdesk {

+namespace {
+
+void ShowControlBarTooltip(const std::string& text) {
+  if (!ImGui::IsItemHovered() || text.empty()) {
+    return;
+  }
+
+  ImGui::BeginTooltip();
+  ImGui::SetWindowFontScale(0.5f);
+  ImGui::Text("%s", text.c_str());
+  ImGui::SetWindowFontScale(1.0f);
+  ImGui::EndTooltip();
+}
+
+}  // namespace
+
 int CountDigits(int number) {
  if (number == 0) return 1;
  return (int)std::floor(std::log10(std::abs(number))) + 1;
@@ -162,7 +178,10 @@ int Render::ControlBar(std::shared_ptr<SubStreamWindowProperties>& props) {

    ImVec2 btn_min = ImGui::GetItemRectMin();
    ImVec2 btn_size_actual = ImGui::GetItemRectSize();
+    ShowControlBarTooltip(
+        localization::select_display[localization_language_index_]);

+    props->display_selectable_hovered_ = false;
    if (ImGui::BeginPopup("display")) {
      ImGui::SetWindowFontScale(0.5f);
      for (int i = 0; i < props->display_info_list_.size(); i++) {
@@ -178,21 +197,66 @@ int Render::ControlBar(std::shared_ptr<SubStreamWindowProperties>& props) {
                                  props->control_data_label_.c_str());
          }
        }
-        props->display_selectable_hovered_ = ImGui::IsWindowHovered();
      }
+      props->display_selectable_hovered_ =
+          ImGui::IsWindowHovered(ImGuiHoveredFlags_RootAndChildWindows);
      ImGui::EndPopup();
    }

-    ImGui::SetWindowFontScale(0.5f);
+    ImGui::SetWindowFontScale(0.35f);
    ImVec2 text_size = ImGui::CalcTextSize(
        std::to_string(props->selected_display_ + 1).c_str());
    ImVec2 text_pos =
-        ImVec2(btn_min.x + (btn_size_actual.x - text_size.x) * 0.5f,
-               btn_min.y + (btn_size_actual.y - text_size.y) * 0.35f);
+        ImVec2(btn_min.x + (btn_size_actual.x - text_size.x) * 0.55f,
+               btn_min.y + (btn_size_actual.y - text_size.y) * 0.33f);
    ImGui::GetWindowDrawList()->AddText(
        text_pos, IM_COL32(0, 0, 0, 255),
        std::to_string(props->selected_display_ + 1).c_str());

+    auto send_service_command = [&](ServiceCommandFlag flag,
+                                    const char* log_action) {
+      if (props->connection_status_ == ConnectionStatus::Connected &&
+          props->peer_) {
+        RemoteAction remote_action;
+        remote_action.type = ControlType::service_command;
+        remote_action.c.flag = flag;
+        std::string msg = remote_action.to_json();
+        int ret = SendReliableDataFrame(props->peer_, msg.c_str(), msg.size(),
+                                        props->control_data_label_.c_str());
+        if (ret != 0) {
+          LOG_WARN("Send {} command failed, remote_id={}, ret={}", log_action,
+                   props->remote_id_, ret);
+        }
+      }
+    };
+
+    ImGui::SameLine();
+    std::string shortcut = ICON_FA_KEYBOARD;
+    ImGui::SetWindowFontScale(0.5f);
+    if (ImGui::Button(shortcut.c_str(), ImVec2(button_width, button_height))) {
+      ImGui::OpenPopup("shortcut");
+    }
+    ShowControlBarTooltip(
+        localization::send_shortcut[localization_language_index_]);
+
+    props->shortcut_selectable_hovered_ = false;
+    if (ImGui::BeginPopup("shortcut")) {
+      ImGui::SetWindowFontScale(0.5f);
+      std::string sas_label = "Ctrl+Alt+Del";
+      std::string lock_label = "Win+L";
+      if (ImGui::Selectable(sas_label.c_str())) {
+        send_service_command(ServiceCommandFlag::send_sas, "SAS");
+      }
+      if (ImGui::Selectable(lock_label.c_str())) {
+        send_service_command(ServiceCommandFlag::lock_workstation,
+                             "remote lock");
+      }
+      props->shortcut_selectable_hovered_ =
+          ImGui::IsWindowHovered(ImGuiHoveredFlags_RootAndChildWindows);
+      ImGui::SetWindowFontScale(1.0f);
+      ImGui::EndPopup();
+    }
+
    ImGui::SameLine();
    float mouse_x = ImGui::GetCursorScreenPos().x;
    float mouse_y = ImGui::GetCursorScreenPos().y;
@@ -211,6 +275,12 @@ int Render::ControlBar(std::shared_ptr<SubStreamWindowProperties>& props) {
                : localization::control_mouse[localization_language_index_];
      }
    }
+    const bool mouse_button_hovered = ImGui::IsItemHovered();
+    const std::string mouse_tooltip =
+        props->enable_mouse_control_
+            ? localization::release_mouse[localization_language_index_]
+            : localization::control_mouse[localization_language_index_];
+    ShowControlBarTooltip(mouse_tooltip);

    if (!props->enable_mouse_control_) {
      draw_list->AddLine(ImVec2(disable_mouse_x, disable_mouse_y),
@@ -223,8 +293,8 @@ int Render::ControlBar(std::shared_ptr<SubStreamWindowProperties>& props) {
          ImVec2(
              mouse_x + button_width - line_padding - line_thickness * 0.7f,
              mouse_y + button_height - line_padding + line_thickness * 0.7f),
-          ImGui::IsItemHovered() ? IM_COL32(66, 150, 250, 255)
-                                 : IM_COL32(179, 213, 253, 255),
+          mouse_button_hovered ? IM_COL32(66, 150, 250, 255)
+                               : IM_COL32(179, 213, 253, 255),
          line_thickness);
    }

@@ -256,6 +326,12 @@ int Render::ControlBar(std::shared_ptr<SubStreamWindowProperties>& props) {
                              props->control_data_label_.c_str());
      }
    }
+    const bool audio_button_hovered = ImGui::IsItemHovered();
+    const std::string audio_tooltip =
+        props->audio_capture_button_pressed_
+            ? localization::mute[localization_language_index_]
+            : localization::audio_capture[localization_language_index_];
+    ShowControlBarTooltip(audio_tooltip);

    if (!props->audio_capture_button_pressed_) {
      draw_list->AddLine(ImVec2(disable_audio_x, disable_audio_y),
@@ -268,8 +344,8 @@ int Render::ControlBar(std::shared_ptr<SubStreamWindowProperties>& props) {
          ImVec2(
              audio_x + button_width - line_padding - line_thickness * 0.7f,
              audio_y + button_height - line_padding + line_thickness * 0.7f),
-          ImGui::IsItemHovered() ? IM_COL32(66, 150, 250, 255)
-                                 : IM_COL32(179, 213, 253, 255),
+          audio_button_hovered ? IM_COL32(66, 150, 250, 255)
+                               : IM_COL32(179, 213, 253, 255),
          line_thickness);
    }

@@ -282,6 +358,8 @@ int Render::ControlBar(std::shared_ptr<SubStreamWindowProperties>& props) {
      std::string path = OpenFileDialog(title);
      ProcessSelectedFile(path, props, file_label_);
    }
+    ShowControlBarTooltip(
+        localization::select_file[localization_language_index_]);

    ImGui::SameLine();
    // net traffic stats button
@@ -306,6 +384,12 @@ int Render::ControlBar(std::shared_ptr<SubStreamWindowProperties>& props) {
              : localization::show_net_traffic_stats
                    [localization_language_index_];
    }
+    const std::string net_traffic_stats_tooltip =
+        props->net_traffic_stats_button_pressed_
+            ? localization::hide_net_traffic_stats[localization_language_index_]
+            : localization::show_net_traffic_stats
+                  [localization_language_index_];
+    ShowControlBarTooltip(net_traffic_stats_tooltip);

    if (button_color_style_pushed) {
      ImGui::PopStyleColor();
@@ -332,6 +416,11 @@ int Render::ControlBar(std::shared_ptr<SubStreamWindowProperties>& props) {
      }
      props->reset_control_bar_pos_ = true;
    }
+    const std::string fullscreen_tooltip =
+        fullscreen_button_pressed_
+            ? localization::exit_fullscreen[localization_language_index_]
+            : localization::fullscreen[localization_language_index_];
+    ShowControlBarTooltip(fullscreen_tooltip);

    ImGui::SameLine();
    // close button
@@ -341,6 +430,8 @@ int Render::ControlBar(std::shared_ptr<SubStreamWindowProperties>& props) {
                      ImVec2(button_width, button_height))) {
      CleanupPeer(props);
    }
+    ShowControlBarTooltip(
+        localization::disconnect[localization_language_index_]);

    ImGui::SameLine();

@@ -370,6 +461,10 @@ int Render::ControlBar(std::shared_ptr<SubStreamWindowProperties>& props) {
                                            : ICON_FA_ANGLE_RIGHT)
          : (props->is_control_bar_in_left_ ? ICON_FA_ANGLE_RIGHT
                                            : ICON_FA_ANGLE_LEFT);
+  const std::string control_bar_tooltip =
+      props->control_bar_expand_
+          ? localization::collapse_control_bar[localization_language_index_]
+          : localization::expand_control_bar[localization_language_index_];
  if (ImGui::Button(control_bar.c_str(),
                    ImVec2(button_height * 0.6f, button_height))) {
    props->control_bar_expand_ = !props->control_bar_expand_;
@@ -381,6 +476,7 @@ int Render::ControlBar(std::shared_ptr<SubStreamWindowProperties>& props) {
      props->net_traffic_stats_button_pressed_ = false;
    }
  }
+  ShowControlBarTooltip(control_bar_tooltip);

  if (props->net_traffic_stats_button_pressed_ && props->control_bar_expand_) {
    NetTrafficStats(props);
@@ -486,4 +582,4 @@ int Render::NetTrafficStats(std::shared_ptr<SubStreamWindowProperties>& props) {

  return 0;
 }
-}  // namespace crossdesk
+}  // namespace crossdesk
@@ -104,7 +104,7 @@ int Render::AboutWindow() {
    ImGui::SetCursorPosX(about_window_width * 0.1f);
    ImGui::Text("%s", text.c_str());

-    if (0) {
+    if (update_available_ && show_new_version_icon_in_menu_) {
      std::string new_version_available =
          localization::new_version_available[localization_language_index_] +
          ": ";
@@ -257,4 +257,3 @@ int Render::ControlWindow(std::shared_ptr<SubStreamWindowProperties>& props) {
  return 0;
 }
 }  // namespace crossdesk
-
@@ -31,6 +31,7 @@ int BitrateDisplay(int bitrate) {
 int Render::FileTransferWindow(
    std::shared_ptr<SubStreamWindowProperties>& props) {
  FileTransferState* state = props ? &props->file_transfer_ : &file_transfer_;
+  state->file_transfer_window_hovered_ = false;

  // Only show window if there are files in transfer list or currently
  // transferring
@@ -72,8 +73,6 @@ int Render::FileTransferWindow(
    return 0;
  }

-  ImGuiIO& io = ImGui::GetIO();
-
  // Position window at bottom-left of stream window
  // Adjust window size based on number of files
  float file_transfer_window_width = main_window_width_ * 0.6f;
@@ -82,15 +81,25 @@ int Render::FileTransferWindow(
  float pos_x = file_transfer_window_width * 0.05f;
  float pos_y = stream_window_height_ - file_transfer_window_height -
                file_transfer_window_width * 0.05;
-  float same_line_width = file_transfer_window_width * 0.1f;
+
+  const ImVec2 mouse_pos = ImGui::GetMousePos();
+  const bool mouse_in_window_rect =
+      mouse_pos.x >= pos_x &&
+      mouse_pos.x <= pos_x + file_transfer_window_width &&
+      mouse_pos.y >= pos_y &&
+      mouse_pos.y <= pos_y + file_transfer_window_height;

  ImGui::SetNextWindowPos(ImVec2(pos_x, pos_y), ImGuiCond_Always);
  ImGui::SetNextWindowSize(
      ImVec2(file_transfer_window_width, file_transfer_window_height),
      ImGuiCond_Always);
+  if (mouse_in_window_rect) {
+    ImGui::SetNextWindowFocus();
+  }

  // Set Chinese font for proper display
-  if (stream_windows_system_chinese_font_) {
+  const bool has_chinese_font = stream_windows_system_chinese_font_ != nullptr;
+  if (has_chinese_font) {
    ImGui::PushFont(stream_windows_system_chinese_font_);
  }

@@ -103,24 +112,27 @@ int Render::FileTransferWindow(

  ImGui::SetWindowFontScale(0.5f);
  bool window_opened = true;
-  if (ImGui::Begin(
-          localization::file_transfer_progress[localization_language_index_]
-              .c_str(),
-          &window_opened,
-          ImGuiWindowFlags_NoCollapse | ImGuiWindowFlags_NoResize |
-              ImGuiWindowFlags_NoMove | ImGuiWindowFlags_NoSavedSettings |
-              ImGuiWindowFlags_NoScrollbar)) {
+  const bool show_contents = ImGui::Begin(
+      localization::file_transfer_progress[localization_language_index_]
+          .c_str(),
+      &window_opened,
+      ImGuiWindowFlags_NoCollapse | ImGuiWindowFlags_NoResize |
+          ImGuiWindowFlags_NoMove | ImGuiWindowFlags_NoSavedSettings |
+          ImGuiWindowFlags_NoScrollbar);
+  ImGui::PopStyleColor(4);
+  ImGui::PopStyleVar(2);
+
+  state->file_transfer_window_hovered_ =
+      mouse_in_window_rect ||
+      ImGui::IsWindowHovered(ImGuiHoveredFlags_RootAndChildWindows);
+
+  if (!window_opened) {
+    state->file_transfer_window_visible_ = false;
+  }
+
+  if (show_contents && window_opened) {
    ImGui::SetWindowFontScale(1.0f);
    ImGui::SetWindowFontScale(0.5f);
-    ImGui::PopStyleColor(4);
-    ImGui::PopStyleVar(2);
-
-    // Close button handling
-    if (!window_opened) {
-      state->file_transfer_window_visible_ = false;
-      ImGui::End();
-      return 0;
-    }

    // Display file list
    if (file_list.empty()) {
@@ -225,21 +237,16 @@ int Render::FileTransferWindow(
    }
    ImGui::SetWindowFontScale(1.0f);
    ImGui::SetWindowFontScale(0.5f);
-    ImGui::End();
-    ImGui::SetWindowFontScale(1.0f);
-
-    // Pop Chinese font if it was pushed
-    if (stream_windows_system_chinese_font_) {
-      ImGui::PopFont();
-    }
-  } else {
-    ImGui::PopStyleColor(4);
-    ImGui::PopStyleVar(2);
  }
+
+  ImGui::End();
  ImGui::SetWindowFontScale(1.0f);

+  if (has_chinese_font) {
+    ImGui::PopFont();
+  }
+
  return 0;
 }

 }  // namespace crossdesk
-
@@ -0,0 +1,279 @@
+#include "render.h"
+
+#if _WIN32 && CROSSDESK_PORTABLE
+
+#include <shellapi.h>
+
+#include <vector>
+
+#include "localization.h"
+#include "rd_log.h"
+#include "service_host.h"
+
+namespace crossdesk {
+namespace {
+
+std::filesystem::path GetCurrentExecutablePath() {
+  std::vector<wchar_t> buffer(MAX_PATH);
+  while (true) {
+    DWORD length =
+        GetModuleFileNameW(nullptr, buffer.data(),
+                           static_cast<DWORD>(buffer.size()));
+    if (length == 0) {
+      return {};
+    }
+    if (length < buffer.size()) {
+      return std::filesystem::path(buffer.data(), buffer.data() + length);
+    }
+    if (buffer.size() >= 32768) {
+      return {};
+    }
+    buffer.resize(buffer.size() * 2);
+  }
+}
+
+bool InstallServiceWithElevation() {
+  const std::filesystem::path executable_path = GetCurrentExecutablePath();
+  if (executable_path.empty()) {
+    LOG_ERROR("Portable service install failed: current executable not found");
+    return false;
+  }
+
+  const std::filesystem::path service_path =
+      executable_path.parent_path() / L"crossdesk_service.exe";
+  const std::filesystem::path helper_path =
+      executable_path.parent_path() / L"crossdesk_session_helper.exe";
+  if (!std::filesystem::exists(service_path) ||
+      !std::filesystem::exists(helper_path)) {
+    LOG_ERROR(
+        "Portable service install failed: service binaries missing, service={}, "
+        "helper={}",
+        service_path.string(), helper_path.string());
+    return false;
+  }
+
+  std::wstring executable = executable_path.wstring();
+  std::wstring working_dir = executable_path.parent_path().wstring();
+  std::wstring parameters = L"--service-install";
+
+  SHELLEXECUTEINFOW execute_info{};
+  execute_info.cbSize = sizeof(execute_info);
+  execute_info.fMask = SEE_MASK_NOCLOSEPROCESS;
+  execute_info.hwnd = nullptr;
+  execute_info.lpVerb = L"runas";
+  execute_info.lpFile = executable.c_str();
+  execute_info.lpParameters = parameters.c_str();
+  execute_info.lpDirectory = working_dir.c_str();
+  execute_info.nShow = SW_HIDE;
+
+  if (!ShellExecuteExW(&execute_info)) {
+    LOG_ERROR("Portable service install failed: ShellExecuteExW error={}",
+              GetLastError());
+    return false;
+  }
+
+  DWORD wait_result = WaitForSingleObject(execute_info.hProcess, INFINITE);
+  DWORD exit_code = 1;
+  if (wait_result == WAIT_OBJECT_0) {
+    GetExitCodeProcess(execute_info.hProcess, &exit_code);
+  } else {
+    LOG_ERROR("Portable service install wait failed, result={}", wait_result);
+  }
+  CloseHandle(execute_info.hProcess);
+
+  if (exit_code != 0) {
+    LOG_ERROR("Portable service install command failed, exit_code={}",
+              exit_code);
+    return false;
+  }
+
+  const bool started = StartCrossDeskService();
+  if (!started) {
+    LOG_WARN("Portable service installed but start failed");
+  }
+  return IsCrossDeskServiceInstalled() && started;
+}
+
+}  // namespace
+
+void Render::CheckPortableWindowsService() {
+  if (portable_service_prompt_checked_) {
+    return;
+  }
+  portable_service_prompt_checked_ = true;
+
+  if (IsCrossDeskServiceInstalled()) {
+    return;
+  }
+
+  portable_service_install_state_.store(PortableServiceInstallState::idle,
+                                        std::memory_order_relaxed);
+  show_portable_service_install_window_ = true;
+}
+
+void Render::StartPortableWindowsServiceInstall() {
+  PortableServiceInstallState expected = PortableServiceInstallState::idle;
+  if (!portable_service_install_state_.compare_exchange_strong(
+          expected, PortableServiceInstallState::installing,
+          std::memory_order_acq_rel)) {
+    if (expected != PortableServiceInstallState::failed) {
+      return;
+    }
+    portable_service_install_state_.store(
+        PortableServiceInstallState::installing, std::memory_order_release);
+  }
+
+  JoinPortableWindowsServiceInstallThread();
+  portable_service_install_thread_ = std::thread([this]() {
+    const bool installed = InstallServiceWithElevation();
+    portable_service_install_state_.store(
+        installed ? PortableServiceInstallState::succeeded
+                  : PortableServiceInstallState::failed,
+        std::memory_order_release);
+  });
+}
+
+void Render::JoinPortableWindowsServiceInstallThread() {
+  if (portable_service_install_thread_.joinable()) {
+    portable_service_install_thread_.join();
+  }
+}
+
+int Render::PortableServiceInstallWindow() {
+  if (!show_portable_service_install_window_) {
+    return 0;
+  }
+
+  const ImGuiViewport* viewport = ImGui::GetMainViewport();
+  const float window_width = title_bar_button_width_ * 12.0f;
+  const float window_height = title_bar_button_width_ * 4.0f;
+  ImGui::SetNextWindowPos(
+      ImVec2((viewport->WorkSize.x - viewport->WorkPos.x - window_width) /
+                 2.0f,
+             (viewport->WorkSize.y - viewport->WorkPos.y - window_height) /
+                 2.0f),
+      ImGuiCond_Appearing);
+  ImGui::SetNextWindowSize(ImVec2(window_width, window_height),
+                           ImGuiCond_Always);
+
+  ImGui::PushStyleColor(ImGuiCol_WindowBg, ImVec4(1.0f, 1.0f, 1.0f, 1.0f));
+  ImGui::PushStyleVar(ImGuiStyleVar_WindowBorderSize, 1.0f);
+  ImGui::PushStyleVar(ImGuiStyleVar_WindowRounding, window_rounding_);
+  ImGui::PushStyleVar(ImGuiStyleVar_FrameRounding, window_rounding_ * 0.5f);
+
+  ImGui::Begin(
+      localization::windows_service_setup_title[localization_language_index_]
+          .c_str(),
+      nullptr,
+      ImGuiWindowFlags_NoResize | ImGuiWindowFlags_NoCollapse |
+          ImGuiWindowFlags_NoMove | ImGuiWindowFlags_NoSavedSettings |
+          ImGuiWindowFlags_NoTitleBar);
+
+  ImGui::Spacing();
+  ImGui::SetWindowFontScale(0.55f);
+  ImGui::SetCursorPosX(window_width * 0.08f);
+  ImGui::Text(
+      "%s",
+      localization::windows_service_setup_title[localization_language_index_]
+          .c_str());
+
+  const PortableServiceInstallState state =
+      portable_service_install_state_.load(std::memory_order_acquire);
+  const char* status_text = nullptr;
+  if (state == PortableServiceInstallState::installing ||
+      state == PortableServiceInstallState::succeeded ||
+      state == PortableServiceInstallState::failed) {
+    status_text =
+        localization::installing_windows_service[localization_language_index_]
+            .c_str();
+    if (state == PortableServiceInstallState::succeeded) {
+      status_text =
+          localization::windows_service_install_success
+              [localization_language_index_]
+                  .c_str();
+    } else if (state == PortableServiceInstallState::failed) {
+      status_text =
+          localization::windows_service_install_failed
+              [localization_language_index_]
+                  .c_str();
+    }
+  }
+
+  ImGui::SetWindowFontScale(0.45f);
+  ImGui::SetCursorPosX(window_width * 0.04f);
+  ImGui::SetCursorPosY(window_height * 0.22f);
+  ImGui::BeginChild("PortableServiceInstallContent",
+                    ImVec2(window_width * 0.92f, window_height * 0.5f),
+                    ImGuiChildFlags_Borders, ImGuiWindowFlags_None);
+  ImGui::SetWindowFontScale(0.5f);
+  const float wrap_pos = ImGui::GetContentRegionAvail().x;
+  ImGui::PushTextWrapPos(wrap_pos);
+  ImGui::TextWrapped(
+      "%s",
+      localization::windows_service_setup_message[localization_language_index_]
+          .c_str());
+  if (status_text != nullptr) {
+    ImGui::Spacing();
+    ImGui::TextWrapped("%s", status_text);
+  }
+  ImGui::PopTextWrapPos();
+  ImGui::EndChild();
+
+  ImGui::SetWindowFontScale(0.5f);
+  const float button_y = window_height * 0.76f;
+  const ImGuiStyle& style = ImGui::GetStyle();
+  const auto default_button_width = [&style](const std::string& label) {
+    return ImGui::CalcTextSize(label.c_str()).x + style.FramePadding.x * 2.0f;
+  };
+  const std::string install_label =
+      localization::install_windows_service[localization_language_index_];
+  const std::string cancel_label =
+      localization::cancel[localization_language_index_];
+  const std::string ok_label = localization::ok[localization_language_index_];
+  const float buttons_width = state == PortableServiceInstallState::succeeded
+                                  ? default_button_width(ok_label)
+                                  : default_button_width(install_label) +
+                                        style.ItemSpacing.x +
+                                        default_button_width(cancel_label);
+  ImGui::SetCursorPosX((window_width - buttons_width) * 0.5f);
+  ImGui::SetCursorPosY(button_y);
+
+  if (state == PortableServiceInstallState::succeeded) {
+    if (ImGui::Button(ok_label.c_str())) {
+      show_portable_service_install_window_ = false;
+      JoinPortableWindowsServiceInstallThread();
+    }
+  } else {
+    if (state == PortableServiceInstallState::installing) {
+      ImGui::BeginDisabled();
+    }
+    if (ImGui::Button(install_label.c_str())) {
+      StartPortableWindowsServiceInstall();
+    }
+    if (state == PortableServiceInstallState::installing) {
+      ImGui::EndDisabled();
+    }
+
+    ImGui::SameLine();
+    if (state == PortableServiceInstallState::installing) {
+      ImGui::BeginDisabled();
+    }
+    if (ImGui::Button(cancel_label.c_str())) {
+      show_portable_service_install_window_ = false;
+    }
+    if (state == PortableServiceInstallState::installing) {
+      ImGui::EndDisabled();
+    }
+  }
+
+  ImGui::SetWindowFontScale(1.0f);
+  ImGui::End();
+  ImGui::PopStyleVar(3);
+  ImGui::PopStyleColor();
+
+  return 0;
+}
+
+}  // namespace crossdesk
+
+#endif
@@ -6,11 +6,27 @@
 #include <ApplicationServices/ApplicationServices.h>
 #include <CoreGraphics/CoreGraphics.h>
 #import <Foundation/Foundation.h>
-#include <unistd.h>
 #include <cstdlib>
+#include <string>

 namespace crossdesk {

+namespace {
+constexpr uint32_t kPermissionRefreshIntervalVisibleMs = 500;
+
+void OpenPrivacyPreferences(const char* pane) {
+  if (pane == nullptr || pane[0] == '\0') {
+    return;
+  }
+
+  std::string command =
+      "open \"x-apple.systempreferences:com.apple.preference.security?";
+  command += pane;
+  command += "\"";
+  system(command.c_str());
+}
+}  // namespace
+
 bool Render::DrawToggleSwitch(const char* id, bool active, bool enabled) {
  const float TRACK_HEIGHT = ImGui::GetFrameHeight();
  const float TRACK_WIDTH = TRACK_HEIGHT * 1.8f;
@@ -35,16 +51,19 @@ bool Render::DrawToggleSwitch(const char* id, bool active, bool enabled) {
  bool hovered = ImGui::IsItemHovered();
  bool clicked = ImGui::IsItemClicked() && enabled;

-  ImVec4 track_color = active ? (hovered && enabled ? COLOR_ACTIVE_HOVER : COLOR_ACTIVE)
-                              : (hovered && enabled ? COLOR_INACTIVE_HOVER : COLOR_INACTIVE);
+  ImVec4 track_color =
+      active ? (hovered && enabled ? COLOR_ACTIVE_HOVER : COLOR_ACTIVE)
+             : (hovered && enabled ? COLOR_INACTIVE_HOVER : COLOR_INACTIVE);

  if (!enabled) {
    track_color.w *= DISABLED_ALPHA;
  }

  ImVec2 track_min = ImVec2(track_pos.x, track_pos.y + 0.5f);
-  ImVec2 track_max = ImVec2(track_pos.x + TRACK_WIDTH, track_pos.y + TRACK_HEIGHT - 0.5f);
-  draw_list->AddRectFilled(track_min, track_max, ImGui::GetColorU32(track_color), TRACK_RADIUS);
+  ImVec2 track_max = ImVec2(track_pos.x + TRACK_WIDTH,
+                            track_pos.y + TRACK_HEIGHT - 0.5f);
+  draw_list->AddRectFilled(track_min, track_max,
+                           ImGui::GetColorU32(track_color), TRACK_RADIUS);

  float knob_position = active ? 1.0f : 0.0f;
  float knob_min_x = track_pos.x + KNOB_PADDING;
@@ -59,7 +78,8 @@ bool Render::DrawToggleSwitch(const char* id, bool active, bool enabled) {

  ImVec2 knob_min = ImVec2(knob_x, knob_y);
  ImVec2 knob_max = ImVec2(knob_x + KNOB_WIDTH, knob_y + KNOB_HEIGHT);
-  draw_list->AddRectFilled(knob_min, knob_max, ImGui::GetColorU32(knob_color), KNOB_RADIUS);
+  draw_list->AddRectFilled(knob_min, knob_max,
+                           ImGui::GetColorU32(knob_color), KNOB_RADIUS);

  return clicked;
 }
@@ -81,29 +101,82 @@ bool Render::CheckAccessibilityPermission() {
 }

 void Render::OpenAccessibilityPreferences() {
-  NSDictionary* options = @{(__bridge id)kAXTrustedCheckOptionPrompt : @YES};
-  AXIsProcessTrustedWithOptions((__bridge CFDictionaryRef)options);
-
-  system("open "
-         "\"x-apple.systempreferences:com.apple.preference.security?Privacy_"
-         "Accessibility\"");
+  if (!mac_accessibility_permission_requested_) {
+    NSDictionary* options = @{(__bridge id)kAXTrustedCheckOptionPrompt : @YES};
+    AXIsProcessTrustedWithOptions((__bridge CFDictionaryRef)options);
+  } else {
+    OpenPrivacyPreferences("Privacy_Accessibility");
+  }
 }

 void Render::OpenScreenRecordingPreferences() {
  if (@available(macOS 10.15, *)) {
-    CGRequestScreenCaptureAccess();
+    if (!mac_screen_recording_permission_requested_) {
+      CGRequestScreenCaptureAccess();
+    } else {
+      OpenPrivacyPreferences("Privacy_ScreenCapture");
+    }
+  } else {
+    OpenPrivacyPreferences("Privacy_ScreenCapture");
+  }
+}
+
+void Render::RefreshMacPermissionStatus(bool force) {
+  const uint32_t now = static_cast<uint32_t>(SDL_GetTicks());
+  if (!force && mac_permission_status_initialized_ &&
+      now - mac_permission_last_check_tick_ <
+          kPermissionRefreshIntervalVisibleMs) {
+    return;
  }

-  system("open "
-         "\"x-apple.systempreferences:com.apple.preference.security?Privacy_"
-         "ScreenCapture\"");
+  const bool old_screen_recording_granted =
+      mac_screen_recording_permission_granted_;
+  const bool old_accessibility_granted = mac_accessibility_permission_granted_;
+
+  mac_screen_recording_permission_granted_ =
+      CheckScreenRecordingPermission();
+  mac_accessibility_permission_granted_ = CheckAccessibilityPermission();
+  mac_permission_last_check_tick_ = now;
+  mac_permission_status_initialized_ = true;
+
+  if (old_screen_recording_granted !=
+          mac_screen_recording_permission_granted_ ||
+      old_accessibility_granted != mac_accessibility_permission_granted_) {
+    LOG_INFO("macOS permission status: screen_recording={}, accessibility={}",
+             mac_screen_recording_permission_granted_,
+             mac_accessibility_permission_granted_);
+  }
+}
+
+bool Render::EnsureMacScreenRecordingPermission() {
+  RefreshMacPermissionStatus(false);
+  if (mac_screen_recording_permission_granted_) {
+    return true;
+  }
+
+  show_request_permission_window_ = true;
+  return false;
+}
+
+bool Render::EnsureMacAccessibilityPermission() {
+  RefreshMacPermissionStatus(false);
+  if (mac_accessibility_permission_granted_) {
+    return true;
+  }
+
+  show_request_permission_window_ = true;
+  return false;
 }

 int Render::RequestPermissionWindow() {
-  bool screen_recording_granted = CheckScreenRecordingPermission();
-  bool accessibility_granted = CheckAccessibilityPermission();
+  RefreshMacPermissionStatus(false);

-  show_request_permission_window_ = !screen_recording_granted || !accessibility_granted;
+  const bool screen_recording_granted =
+      mac_screen_recording_permission_granted_;
+  const bool accessibility_granted = mac_accessibility_permission_granted_;
+
+  show_request_permission_window_ =
+      !screen_recording_granted || !accessibility_granted;

  if (!show_request_permission_window_) {
    return 0;
@@ -162,8 +235,10 @@ int Render::RequestPermissionWindow() {
  if (accessibility_granted) {
    DrawToggleSwitch("accessibility_toggle_on", true, false);
  } else {
-    if (DrawToggleSwitch("accessibility_toggle", accessibility_granted, !accessibility_granted)) {
+    if (DrawToggleSwitch("accessibility_toggle", false, true)) {
      OpenAccessibilityPreferences();
+      mac_accessibility_permission_requested_ = true;
+      RefreshMacPermissionStatus(true);
    }
  }

@@ -178,12 +253,12 @@ int Render::RequestPermissionWindow() {
  ImGui::AlignTextToFramePadding();
  ImGui::SetCursorPosX(checkbox_padding);
  if (screen_recording_granted) {
-    ImGui::SetCursorPosX(ImGui::GetCursorPosX() + 10.0f);
    DrawToggleSwitch("screen_recording_toggle_on", true, false);
  } else {
-    if (DrawToggleSwitch("screen_recording_toggle", screen_recording_granted,
-                         !screen_recording_granted)) {
+    if (DrawToggleSwitch("screen_recording_toggle", false, true)) {
      OpenScreenRecordingPreferences();
+      mac_screen_recording_permission_requested_ = true;
+      RefreshMacPermissionStatus(true);
    }
  }

@@ -202,4 +277,4 @@ int Render::RequestPermissionWindow() {

  return 0;
 }
-}  // namespace crossdesk
+}  // namespace crossdesk
@@ -92,7 +92,7 @@ int Render::UpdateNotificationWindow() {
    ImGui::SetWindowFontScale(0.55f);
    std::string title =
        localization::new_version_available[localization_language_index_] +
-        ": v" + latest_version_;
+        ": " + latest_version_;
    ImGui::Text("%s", title.c_str());
    ImGui::SetWindowFontScale(0.1f);

@@ -1,12 +1,98 @@
 #include "path_manager.h"

+#include <cstdint>
 #include <cstdlib>
+#include <vector>
+
+#ifndef CROSSDESK_PORTABLE
+#define CROSSDESK_PORTABLE 0
+#endif
+
+#if CROSSDESK_PORTABLE
+#if defined(__APPLE__)
+#include <mach-o/dyld.h>
+#elif !defined(_WIN32)
+#include <limits.h>
+#include <unistd.h>
+#endif
+#endif
+
+namespace {
+
+#if CROSSDESK_PORTABLE
+std::filesystem::path GetExecutableDirectory() {
+#ifdef _WIN32
+  std::vector<wchar_t> buffer(MAX_PATH);
+  while (true) {
+    DWORD length =
+        GetModuleFileNameW(nullptr, buffer.data(),
+                           static_cast<DWORD>(buffer.size()));
+    if (length == 0) {
+      return {};
+    }
+    if (length < buffer.size()) {
+      return std::filesystem::path(buffer.data(), buffer.data() + length)
+          .parent_path();
+    }
+    if (buffer.size() >= 32768) {
+      return {};
+    }
+    buffer.resize(buffer.size() * 2);
+  }
+#elif defined(__APPLE__)
+  uint32_t size = 0;
+  _NSGetExecutablePath(nullptr, &size);
+  std::vector<char> buffer(size + 1);
+  if (_NSGetExecutablePath(buffer.data(), &size) != 0) {
+    return {};
+  }
+
+  std::error_code ec;
+  std::filesystem::path executable =
+      std::filesystem::weakly_canonical(buffer.data(), ec);
+  if (ec) {
+    executable = buffer.data();
+  }
+  return executable.parent_path();
+#else
+  std::vector<char> buffer(PATH_MAX);
+  while (true) {
+    ssize_t length = readlink("/proc/self/exe", buffer.data(),
+                              buffer.size() - 1);
+    if (length <= 0) {
+      return {};
+    }
+    if (static_cast<size_t>(length) < buffer.size() - 1) {
+      buffer[static_cast<size_t>(length)] = '\0';
+      return std::filesystem::path(buffer.data()).parent_path();
+    }
+    buffer.resize(buffer.size() * 2);
+  }
+#endif
+}
+
+std::filesystem::path GetPortableRootPath() {
+  std::filesystem::path executable_dir = GetExecutableDirectory();
+  if (!executable_dir.empty()) {
+    return executable_dir;
+  }
+
+  std::error_code ec;
+  std::filesystem::path current = std::filesystem::current_path(ec);
+  return ec ? std::filesystem::path(".") : current;
+}
+#endif
+
+}  // namespace

 namespace crossdesk {

 PathManager::PathManager(const std::string& app_name) : app_name_(app_name) {}

 std::filesystem::path PathManager::GetConfigPath() {
+#if CROSSDESK_PORTABLE
+  return GetPortableRootPath() / "data";
+#else
 #ifdef _WIN32
  return GetKnownFolder(FOLDERID_RoamingAppData) / app_name_;
 #elif __APPLE__
@@ -14,9 +100,13 @@ std::filesystem::path PathManager::GetConfigPath() {
 #else
  return GetEnvOrDefault("XDG_CONFIG_HOME", GetHome() + "/.config") / app_name_;
 #endif
+#endif
 }

 std::filesystem::path PathManager::GetCachePath() {
+#if CROSSDESK_PORTABLE
+  return GetPortableRootPath() / "data";
+#else
 #ifdef _WIN32
 #ifdef CROSSDESK_DEBUG
  return "cache";
@@ -28,9 +118,13 @@ std::filesystem::path PathManager::GetCachePath() {
 #else
  return GetEnvOrDefault("XDG_CACHE_HOME", GetHome() + "/.cache") / app_name_;
 #endif
+#endif
 }

 std::filesystem::path PathManager::GetLogPath() {
+#if CROSSDESK_PORTABLE
+  return GetPortableRootPath() / "logs";
+#else
 #ifdef _WIN32
  return GetKnownFolder(FOLDERID_LocalAppData) / app_name_ / "logs";
 #elif __APPLE__
@@ -38,6 +132,7 @@ std::filesystem::path PathManager::GetLogPath() {
 #else
  return GetCachePath() / "logs";
 #endif
+#endif
 }

 bool PathManager::CreateDirectories(const std::filesystem::path& p) {
@@ -93,4 +188,4 @@ std::filesystem::path PathManager::GetEnvOrDefault(const char* env_var,

  return std::filesystem::path(def);
 }
-}  // namespace crossdesk
+}  // namespace crossdesk
@@ -177,8 +177,8 @@ int ScreenCapturerLinux::Start(bool show_cursor) {
    backend_name = "Wayland";
  }

-  LOG_WARN("Linux screen capturer backend {} start failed: {}",
-           backend_name, ret);
+  LOG_WARN("Linux screen capturer backend {} start failed: {}", backend_name,
+           ret);

  if (backend_ == BackendType::kX11 && kDrmBuildEnabled &&
      TryFallbackToDrm(show_cursor)) {
@@ -484,7 +484,8 @@ void ScreenCapturerLinux::UpdateAliasesFromBackend(ScreenCapturer* backend) {
  }
 }

-std::string ScreenCapturerLinux::MapDisplayName(const char* display_name) const {
+std::string ScreenCapturerLinux::MapDisplayName(
+    const char* display_name) const {
  std::string input_name = display_name ? display_name : "";
  if (input_name.empty()) {
    return input_name;
@@ -3,13 +3,13 @@
 #include "screen_capturer_wayland_build.h"

 #if !CROSSDESK_WAYLAND_BUILD_ENABLED
-#error "Wayland capturer requires USE_WAYLAND=true and Wayland development headers"
+#error \
+    "Wayland capturer requires USE_WAYLAND=true and Wayland development headers"
 #endif

+#include <chrono>
 #include <cstdlib>
 #include <cstring>
-
-#include <chrono>
 #include <thread>

 #include "platform.h"
@@ -57,6 +57,11 @@ int ScreenCapturerWayland::Init(const int fps, cb_desktop_data cb) {
    return -1;
  }

+  if (!EnsurePipeWireRuntimeAvailable()) {
+    LOG_ERROR("Wayland screen capturer requires PipeWire 0.3 runtime");
+    return -1;
+  }
+
  fps_ = fps;
  callback_ = cb;
  pointer_granted_ = false;
@@ -69,6 +74,9 @@ int ScreenCapturerWayland::Init(const int fps, cb_desktop_data cb) {
  frame_width_ = kFallbackWidth;
  frame_height_ = kFallbackHeight;
  frame_stride_ = kFallbackWidth * 4;
+  portal_has_logical_size_ = false;
+  portal_stream_width_ = 0;
+  portal_stream_height_ = 0;
  logical_width_ = kFallbackWidth;
  logical_height_ = kFallbackHeight;
  y_plane_.resize(kFallbackWidth * kFallbackHeight);
@@ -94,9 +102,9 @@ int ScreenCapturerWayland::Start(bool show_cursor) {
  show_cursor_ = show_cursor;
  paused_ = false;
  pipewire_node_id_ = 0;
-  UpdateDisplayGeometry(logical_width_ > 0 ? logical_width_ : kFallbackWidth,
-                        logical_height_ > 0 ? logical_height_
-                                            : kFallbackHeight);
+  UpdateDisplayGeometry(
+      logical_width_ > 0 ? logical_width_ : kFallbackWidth,
+      logical_height_ > 0 ? logical_height_ : kFallbackHeight);
  pipewire_format_ready_.store(false);
  pipewire_stream_start_ms_.store(0);
  pipewire_last_frame_ms_.store(0);
@@ -111,9 +119,9 @@ int ScreenCapturerWayland::Stop() {
    thread_.join();
  }
  pipewire_node_id_ = 0;
-  UpdateDisplayGeometry(logical_width_ > 0 ? logical_width_ : kFallbackWidth,
-                        logical_height_ > 0 ? logical_height_
-                                            : kFallbackHeight);
+  UpdateDisplayGeometry(
+      logical_width_ > 0 ? logical_width_ : kFallbackWidth,
+      logical_height_ > 0 ? logical_height_ : kFallbackHeight);
  return 0;
 }

@@ -182,9 +190,9 @@ void ScreenCapturerWayland::Run() {

      const bool format_timeout =
          stream_start > 0 && !format_ready && (now - stream_start) > 1200;
-      const bool first_frame_timeout =
-          stream_start > 0 && format_ready && last_frame == 0 &&
-          (now - stream_start) > 4000;
+      const bool first_frame_timeout = stream_start > 0 && format_ready &&
+                                       last_frame == 0 &&
+                                       (now - stream_start) > 4000;
      const bool frame_stall = last_frame > 0 && (now - last_frame) > 5000;

      if (format_timeout || first_frame_timeout || frame_stall) {
@@ -200,10 +208,10 @@ void ScreenCapturerWayland::Run() {
        }

        ++recovery_index;
-        const char* reason = format_timeout
-                                 ? "format-timeout"
-                                 : (first_frame_timeout ? "first-frame-timeout"
-                                                        : "frame-stall");
+        const char* reason =
+            format_timeout
+                ? "format-timeout"
+                : (first_frame_timeout ? "first-frame-timeout" : "frame-stall");
        const auto& config = kRecoveryConfigs[recovery_index];
        LOG_WARN(
            "Wayland capture stalled ({}) - retrying PipeWire only, "
@@ -52,6 +52,7 @@ class ScreenCapturerWayland : public ScreenCapturer {
  bool SelectPortalDevices();
  bool SelectPortalSource();
  bool StartPortalSession();
+  bool EnsurePipeWireRuntimeAvailable() const;
  bool OpenPipeWireRemote();
  bool SetupPipeWireStream(bool relaxed_connect, PipeWireConnectMode mode);

@@ -94,10 +95,13 @@ class ScreenCapturerWayland : public ScreenCapturer {
  bool pipewire_thread_loop_started_ = false;
  bool pointer_granted_ = false;
  bool shared_session_registered_ = false;
+  bool portal_has_logical_size_ = false;
  uint32_t spa_video_format_ = 0;
  int frame_width_ = 0;
  int frame_height_ = 0;
  int frame_stride_ = 0;
+  int portal_stream_width_ = 0;
+  int portal_stream_height_ = 0;
  int logical_width_ = 0;
  int logical_height_ = 0;

@@ -1,14 +1,18 @@
 #include "screen_capturer_wayland.h"
-
 #include "screen_capturer_wayland_build.h"

 #if CROSSDESK_WAYLAND_BUILD_ENABLED

-#include <chrono>
-#include <cstdint>
-#include <thread>
+#include <dlfcn.h>
 #include <unistd.h>

+#include <algorithm>
+#include <chrono>
+#include <cmath>
+#include <cstdint>
+#include <limits>
+#include <mutex>
+#include <thread>
 #include <vector>

 #include "libyuv.h"
@@ -18,6 +22,143 @@ namespace crossdesk {

 namespace {

+struct PipeWireDynamicApi {
+  void* library = nullptr;
+  bool available = false;
+
+  decltype(&::pw_init) init = nullptr;
+  decltype(&::pw_deinit) deinit = nullptr;
+  decltype(&::pw_thread_loop_new) thread_loop_new = nullptr;
+  decltype(&::pw_thread_loop_destroy) thread_loop_destroy = nullptr;
+  decltype(&::pw_thread_loop_get_loop) thread_loop_get_loop = nullptr;
+  decltype(&::pw_thread_loop_start) thread_loop_start = nullptr;
+  decltype(&::pw_thread_loop_stop) thread_loop_stop = nullptr;
+  decltype(&::pw_thread_loop_lock) thread_loop_lock = nullptr;
+  decltype(&::pw_thread_loop_unlock) thread_loop_unlock = nullptr;
+  decltype(&::pw_thread_loop_wait) thread_loop_wait = nullptr;
+  decltype(&::pw_thread_loop_signal) thread_loop_signal = nullptr;
+  decltype(&::pw_context_new) context_new = nullptr;
+  decltype(&::pw_context_destroy) context_destroy = nullptr;
+  decltype(&::pw_context_connect_fd) context_connect_fd = nullptr;
+  decltype(&::pw_properties_new) properties_new = nullptr;
+  decltype(&::pw_properties_set) properties_set = nullptr;
+  decltype(&::pw_stream_new) stream_new = nullptr;
+  decltype(&::pw_stream_add_listener) stream_add_listener = nullptr;
+  decltype(&::pw_stream_state_as_string) stream_state_as_string = nullptr;
+  decltype(&::pw_stream_connect) stream_connect = nullptr;
+  decltype(&::pw_stream_update_params) stream_update_params = nullptr;
+  decltype(&::pw_stream_set_active) stream_set_active = nullptr;
+  decltype(&::pw_stream_disconnect) stream_disconnect = nullptr;
+  decltype(&::pw_stream_destroy) stream_destroy = nullptr;
+  decltype(&::pw_stream_dequeue_buffer) stream_dequeue_buffer = nullptr;
+  decltype(&::pw_stream_queue_buffer) stream_queue_buffer = nullptr;
+  decltype(&::pw_core_disconnect) core_disconnect = nullptr;
+  decltype(&::pw_proxy_destroy) proxy_destroy = nullptr;
+};
+
+template <typename T>
+bool LoadPipeWireSymbol(void* library, T* function, const char* symbol_name) {
+  *function = reinterpret_cast<T>(dlsym(library, symbol_name));
+  if (*function != nullptr) {
+    return true;
+  }
+
+  LOG_ERROR("Unable to find PipeWire symbol {}", symbol_name);
+  return false;
+}
+
+void UnloadPipeWireApi(PipeWireDynamicApi* api) {
+  if (api->library != nullptr) {
+    dlclose(api->library);
+  }
+  *api = PipeWireDynamicApi{};
+}
+
+bool LoadPipeWireApi(PipeWireDynamicApi* api) {
+  static constexpr const char* kPipeWireLibraries[] = {
+      "libpipewire-0.3.so.0",
+      "libpipewire-0.3.so",
+  };
+
+  for (const char* library_name : kPipeWireLibraries) {
+    api->library = dlopen(library_name, RTLD_LAZY | RTLD_LOCAL);
+    if (api->library != nullptr) {
+      break;
+    }
+  }
+
+  if (api->library == nullptr) {
+    LOG_WARN("PipeWire 0.3 runtime library is unavailable");
+    return false;
+  }
+
+  if (!LoadPipeWireSymbol(api->library, &api->init, "pw_init") ||
+      !LoadPipeWireSymbol(api->library, &api->deinit, "pw_deinit") ||
+      !LoadPipeWireSymbol(api->library, &api->thread_loop_new,
+                          "pw_thread_loop_new") ||
+      !LoadPipeWireSymbol(api->library, &api->thread_loop_destroy,
+                          "pw_thread_loop_destroy") ||
+      !LoadPipeWireSymbol(api->library, &api->thread_loop_get_loop,
+                          "pw_thread_loop_get_loop") ||
+      !LoadPipeWireSymbol(api->library, &api->thread_loop_start,
+                          "pw_thread_loop_start") ||
+      !LoadPipeWireSymbol(api->library, &api->thread_loop_stop,
+                          "pw_thread_loop_stop") ||
+      !LoadPipeWireSymbol(api->library, &api->thread_loop_lock,
+                          "pw_thread_loop_lock") ||
+      !LoadPipeWireSymbol(api->library, &api->thread_loop_unlock,
+                          "pw_thread_loop_unlock") ||
+      !LoadPipeWireSymbol(api->library, &api->thread_loop_wait,
+                          "pw_thread_loop_wait") ||
+      !LoadPipeWireSymbol(api->library, &api->thread_loop_signal,
+                          "pw_thread_loop_signal") ||
+      !LoadPipeWireSymbol(api->library, &api->context_new, "pw_context_new") ||
+      !LoadPipeWireSymbol(api->library, &api->context_destroy,
+                          "pw_context_destroy") ||
+      !LoadPipeWireSymbol(api->library, &api->context_connect_fd,
+                          "pw_context_connect_fd") ||
+      !LoadPipeWireSymbol(api->library, &api->properties_new,
+                          "pw_properties_new") ||
+      !LoadPipeWireSymbol(api->library, &api->properties_set,
+                          "pw_properties_set") ||
+      !LoadPipeWireSymbol(api->library, &api->stream_new, "pw_stream_new") ||
+      !LoadPipeWireSymbol(api->library, &api->stream_add_listener,
+                          "pw_stream_add_listener") ||
+      !LoadPipeWireSymbol(api->library, &api->stream_state_as_string,
+                          "pw_stream_state_as_string") ||
+      !LoadPipeWireSymbol(api->library, &api->stream_connect,
+                          "pw_stream_connect") ||
+      !LoadPipeWireSymbol(api->library, &api->stream_update_params,
+                          "pw_stream_update_params") ||
+      !LoadPipeWireSymbol(api->library, &api->stream_set_active,
+                          "pw_stream_set_active") ||
+      !LoadPipeWireSymbol(api->library, &api->stream_disconnect,
+                          "pw_stream_disconnect") ||
+      !LoadPipeWireSymbol(api->library, &api->stream_destroy,
+                          "pw_stream_destroy") ||
+      !LoadPipeWireSymbol(api->library, &api->stream_dequeue_buffer,
+                          "pw_stream_dequeue_buffer") ||
+      !LoadPipeWireSymbol(api->library, &api->stream_queue_buffer,
+                          "pw_stream_queue_buffer") ||
+      !LoadPipeWireSymbol(api->library, &api->core_disconnect,
+                          "pw_core_disconnect") ||
+      !LoadPipeWireSymbol(api->library, &api->proxy_destroy,
+                          "pw_proxy_destroy")) {
+    UnloadPipeWireApi(api);
+    return false;
+  }
+
+  api->available = true;
+  return true;
+}
+
+const PipeWireDynamicApi* GetPipeWireApi() {
+  static PipeWireDynamicApi api;
+  static std::once_flag once;
+  std::call_once(once, []() { LoadPipeWireApi(&api); });
+  return api.available ? &api : nullptr;
+}
+
 const char* PipeWireFormatName(uint32_t spa_format) {
  switch (spa_format) {
    case SPA_VIDEO_FORMAT_BGRx:
@@ -57,7 +198,24 @@ int64_t NowMs() {
      .count();
 }

+double SnapLikelyFractionalScale(double observed_scale) {
+  static constexpr double kCandidates[] = {
+      1.0, 1.25, 1.3333333333, 1.5, 1.6666666667, 1.75, 2.0, 2.25, 2.5, 3.0};
+  double best = observed_scale;
+  double best_error = std::numeric_limits<double>::max();
+  for (double candidate : kCandidates) {
+    const double error = std::abs(candidate - observed_scale);
+    if (error < best_error) {
+      best = candidate;
+      best_error = error;
+    }
+  }
+
+  return best_error <= 0.08 ? best : observed_scale;
+}
+
 struct PipeWireTargetLookupState {
+  const PipeWireDynamicApi* pipewire = nullptr;
  pw_thread_loop* loop = nullptr;
  uint32_t target_node_id = 0;
  int sync_seq = -1;
@@ -69,11 +227,13 @@ struct PipeWireTargetLookupState {
 std::string LookupPipeWireTargetObjectSerial(pw_core* core,
                                             pw_thread_loop* loop,
                                             uint32_t node_id) {
-  if (!core || !loop || node_id == 0) {
+  const PipeWireDynamicApi* pipewire = GetPipeWireApi();
+  if (!pipewire || !core || !loop || node_id == 0) {
    return "";
  }

  PipeWireTargetLookupState state;
+  state.pipewire = pipewire;
  state.loop = loop;
  state.target_node_id = node_id;

@@ -87,30 +247,30 @@ std::string LookupPipeWireTargetObjectSerial(pw_core* core,

  pw_registry_events registry_events{};
  registry_events.version = PW_VERSION_REGISTRY_EVENTS;
-  registry_events.global =
-      [](void* userdata, uint32_t id, uint32_t permissions, const char* type,
-         uint32_t version, const spa_dict* props) {
-        (void)permissions;
-        (void)version;
-        auto* state = static_cast<PipeWireTargetLookupState*>(userdata);
-        if (!state || !props || id != state->target_node_id || !type) {
-          return;
-        }
-        if (strcmp(type, PW_TYPE_INTERFACE_Node) != 0) {
-          return;
-        }
+  registry_events.global = [](void* userdata, uint32_t id, uint32_t permissions,
+                              const char* type, uint32_t version,
+                              const spa_dict* props) {
+    (void)permissions;
+    (void)version;
+    auto* state = static_cast<PipeWireTargetLookupState*>(userdata);
+    if (!state || !props || id != state->target_node_id || !type) {
+      return;
+    }
+    if (strcmp(type, PW_TYPE_INTERFACE_Node) != 0) {
+      return;
+    }

-        const char* object_serial = spa_dict_lookup(props, PW_KEY_OBJECT_SERIAL);
-        if (!object_serial || object_serial[0] == '\0') {
-          object_serial = spa_dict_lookup(props, "object.serial");
-        }
-        if (!object_serial || object_serial[0] == '\0') {
-          return;
-        }
+    const char* object_serial = spa_dict_lookup(props, PW_KEY_OBJECT_SERIAL);
+    if (!object_serial || object_serial[0] == '\0') {
+      object_serial = spa_dict_lookup(props, "object.serial");
+    }
+    if (!object_serial || object_serial[0] == '\0') {
+      return;
+    }

-        state->object_serial = object_serial;
-        state->found = true;
-      };
+    state->object_serial = object_serial;
+    state->found = true;
+  };

  pw_core_events core_events{};
  core_events.version = PW_VERSION_CORE_EVENTS;
@@ -120,7 +280,7 @@ std::string LookupPipeWireTargetObjectSerial(pw_core* core,
      return;
    }
    state->done = true;
-    pw_thread_loop_signal(state->loop, false);
+    state->pipewire->thread_loop_signal(state->loop, false);
  };
  core_events.error = [](void* userdata, uint32_t id, int seq, int res,
                         const char* message) {
@@ -134,7 +294,7 @@ std::string LookupPipeWireTargetObjectSerial(pw_core* core,
    LOG_WARN("PipeWire registry lookup error: {}",
             message ? message : "unknown");
    state->done = true;
-    pw_thread_loop_signal(state->loop, false);
+    state->pipewire->thread_loop_signal(state->loop, false);
  };

  pw_registry_add_listener(registry, &registry_listener, &registry_events,
@@ -143,12 +303,12 @@ std::string LookupPipeWireTargetObjectSerial(pw_core* core,
  state.sync_seq = pw_core_sync(core, PW_ID_CORE, 0);

  while (!state.done) {
-    pw_thread_loop_wait(loop);
+    pipewire->thread_loop_wait(loop);
  }

  spa_hook_remove(&registry_listener);
  spa_hook_remove(&core_listener);
-  pw_proxy_destroy(reinterpret_cast<pw_proxy*>(registry));
+  pipewire->proxy_destroy(reinterpret_cast<pw_proxy*>(registry));
  return state.found ? state.object_serial : "";
 }

@@ -170,82 +330,94 @@ int BytesPerPixel(uint32_t spa_format) {

 }  // namespace

+bool ScreenCapturerWayland::EnsurePipeWireRuntimeAvailable() const {
+  return GetPipeWireApi() != nullptr;
+}
+
 bool ScreenCapturerWayland::SetupPipeWireStream(bool relaxed_connect,
                                                PipeWireConnectMode mode) {
+  const PipeWireDynamicApi* pipewire = GetPipeWireApi();
+  if (!pipewire) {
+    LOG_ERROR("PipeWire 0.3 runtime library is unavailable");
+    return false;
+  }
+
  if (pipewire_fd_ < 0 || pipewire_node_id_ == 0) {
    return false;
  }

  if (!pipewire_initialized_) {
-    pw_init(nullptr, nullptr);
+    pipewire->init(nullptr, nullptr);
    pipewire_initialized_ = true;
  }

-  pw_thread_loop_ = pw_thread_loop_new("crossdesk-wayland-capture", nullptr);
+  pw_thread_loop_ =
+      pipewire->thread_loop_new("crossdesk-wayland-capture", nullptr);
  if (!pw_thread_loop_) {
    LOG_ERROR("Failed to create PipeWire thread loop");
    return false;
  }

-  if (pw_thread_loop_start(pw_thread_loop_) < 0) {
+  if (pipewire->thread_loop_start(pw_thread_loop_) < 0) {
    LOG_ERROR("Failed to start PipeWire thread loop");
    CleanupPipeWire();
    return false;
  }
  pipewire_thread_loop_started_ = true;

-  pw_thread_loop_lock(pw_thread_loop_);
+  pipewire->thread_loop_lock(pw_thread_loop_);

-  pw_context_ =
-      pw_context_new(pw_thread_loop_get_loop(pw_thread_loop_), nullptr, 0);
+  pw_context_ = pipewire->context_new(
+      pipewire->thread_loop_get_loop(pw_thread_loop_), nullptr, 0);
  if (!pw_context_) {
    LOG_ERROR("Failed to create PipeWire context");
-    pw_thread_loop_unlock(pw_thread_loop_);
+    pipewire->thread_loop_unlock(pw_thread_loop_);
    CleanupPipeWire();
    return false;
  }

-  pw_core_ = pw_context_connect_fd(pw_context_, pipewire_fd_, nullptr, 0);
+  pw_core_ =
+      pipewire->context_connect_fd(pw_context_, pipewire_fd_, nullptr, 0);
  if (!pw_core_) {
    LOG_ERROR("Failed to connect to PipeWire remote");
-    pw_thread_loop_unlock(pw_thread_loop_);
+    pipewire->thread_loop_unlock(pw_thread_loop_);
    CleanupPipeWire();
    return false;
  }
  pipewire_fd_ = -1;

-  pw_properties* stream_props =
-      pw_properties_new(PW_KEY_MEDIA_TYPE, "Video", PW_KEY_MEDIA_CATEGORY,
-                        "Capture", PW_KEY_MEDIA_ROLE, "Screen", nullptr);
+  pw_properties* stream_props = pipewire->properties_new(
+      PW_KEY_MEDIA_TYPE, "Video", PW_KEY_MEDIA_CATEGORY, "Capture",
+      PW_KEY_MEDIA_ROLE, "Screen", nullptr);
  if (!stream_props) {
    LOG_ERROR("Failed to allocate PipeWire stream properties");
-    pw_thread_loop_unlock(pw_thread_loop_);
+    pipewire->thread_loop_unlock(pw_thread_loop_);
    CleanupPipeWire();
    return false;
  }

  std::string target_object_serial;
  if (mode == PipeWireConnectMode::kTargetObject) {
-    target_object_serial =
-        LookupPipeWireTargetObjectSerial(pw_core_, pw_thread_loop_,
-                                         pipewire_node_id_);
+    target_object_serial = LookupPipeWireTargetObjectSerial(
+        pw_core_, pw_thread_loop_, pipewire_node_id_);
    if (!target_object_serial.empty()) {
-      pw_properties_set(stream_props, PW_KEY_TARGET_OBJECT,
-                        target_object_serial.c_str());
+      pipewire->properties_set(stream_props, PW_KEY_TARGET_OBJECT,
+                               target_object_serial.c_str());
      LOG_INFO("PipeWire target object serial for node {} is {}",
               pipewire_node_id_, target_object_serial);
    } else {
-      LOG_WARN("PipeWire target object serial lookup failed for node {}, "
-               "falling back to direct target id in target-object mode",
-               pipewire_node_id_);
+      LOG_WARN(
+          "PipeWire target object serial lookup failed for node {}, "
+          "falling back to direct target id in target-object mode",
+          pipewire_node_id_);
    }
  }

-  pw_stream_ = pw_stream_new(pw_core_, "CrossDesk Wayland Capture",
-                             stream_props);
+  pw_stream_ =
+      pipewire->stream_new(pw_core_, "CrossDesk Wayland Capture", stream_props);
  if (!pw_stream_) {
    LOG_ERROR("Failed to create PipeWire stream");
-    pw_thread_loop_unlock(pw_thread_loop_);
+    pipewire->thread_loop_unlock(pw_thread_loop_);
    CleanupPipeWire();
    return false;
  }
@@ -256,123 +428,185 @@ bool ScreenCapturerWayland::SetupPipeWireStream(bool relaxed_connect,
  static const pw_stream_events stream_events = [] {
    pw_stream_events events{};
    events.version = PW_VERSION_STREAM_EVENTS;
-    events.state_changed =
-        [](void* userdata, enum pw_stream_state old_state,
-           enum pw_stream_state state, const char* error_message) {
-          auto* self = static_cast<ScreenCapturerWayland*>(userdata);
-          if (!self) {
-            return;
-          }
+    events.state_changed = [](void* userdata, enum pw_stream_state old_state,
+                              enum pw_stream_state state,
+                              const char* error_message) {
+      auto* self = static_cast<ScreenCapturerWayland*>(userdata);
+      if (!self) {
+        return;
+      }

-          if (state == PW_STREAM_STATE_ERROR) {
-            LOG_ERROR("PipeWire stream error: {}",
-                      error_message ? error_message : "unknown");
-            self->running_ = false;
-            return;
-          }
+      if (state == PW_STREAM_STATE_ERROR) {
+        LOG_ERROR("PipeWire stream error: {}",
+                  error_message ? error_message : "unknown");
+        self->running_ = false;
+        return;
+      }

-          LOG_INFO("PipeWire stream state: {} -> {}",
-                   pw_stream_state_as_string(old_state),
-                   pw_stream_state_as_string(state));
+      const PipeWireDynamicApi* pipewire = GetPipeWireApi();
+      LOG_INFO(
+          "PipeWire stream state: {} -> {}",
+          pipewire ? pipewire->stream_state_as_string(old_state) : "unknown",
+          pipewire ? pipewire->stream_state_as_string(state) : "unknown");
+    };
+    events.param_changed = [](void* userdata, uint32_t id,
+                              const struct spa_pod* param) {
+      auto* self = static_cast<ScreenCapturerWayland*>(userdata);
+      if (!self || id != SPA_PARAM_Format || !param) {
+        return;
+      }

-        };
-    events.param_changed =
-        [](void* userdata, uint32_t id, const struct spa_pod* param) {
-          auto* self = static_cast<ScreenCapturerWayland*>(userdata);
-          if (!self || id != SPA_PARAM_Format || !param) {
-            return;
-          }
+      spa_video_info_raw info{};
+      if (spa_format_video_raw_parse(param, &info) < 0) {
+        LOG_ERROR("Failed to parse PipeWire video format");
+        return;
+      }

-          spa_video_info_raw info{};
-          if (spa_format_video_raw_parse(param, &info) < 0) {
-            LOG_ERROR("Failed to parse PipeWire video format");
-            return;
-          }
+      self->spa_video_format_ = info.format;
+      self->frame_width_ = static_cast<int>(info.size.width);
+      self->frame_height_ = static_cast<int>(info.size.height);
+      self->frame_stride_ = static_cast<int>(info.size.width) * 4;

-          self->spa_video_format_ = info.format;
-          self->frame_width_ = static_cast<int>(info.size.width);
-          self->frame_height_ = static_cast<int>(info.size.height);
-          self->frame_stride_ = static_cast<int>(info.size.width) * 4;
-
-          bool supported_format =
-              (self->spa_video_format_ == SPA_VIDEO_FORMAT_BGRx) ||
-              (self->spa_video_format_ == SPA_VIDEO_FORMAT_BGRA);
+      bool supported_format =
+          (self->spa_video_format_ == SPA_VIDEO_FORMAT_BGRx) ||
+          (self->spa_video_format_ == SPA_VIDEO_FORMAT_BGRA);
 #ifdef SPA_VIDEO_FORMAT_RGBx
-          supported_format =
-              supported_format ||
-              (self->spa_video_format_ == SPA_VIDEO_FORMAT_RGBx);
+      supported_format = supported_format ||
+                         (self->spa_video_format_ == SPA_VIDEO_FORMAT_RGBx);
 #endif
 #ifdef SPA_VIDEO_FORMAT_RGBA
-          supported_format =
-              supported_format ||
-              (self->spa_video_format_ == SPA_VIDEO_FORMAT_RGBA);
+      supported_format = supported_format ||
+                         (self->spa_video_format_ == SPA_VIDEO_FORMAT_RGBA);
 #endif
-          if (!supported_format) {
-            LOG_ERROR("Unsupported PipeWire pixel format: {}",
-                      PipeWireFormatName(self->spa_video_format_));
-            self->running_ = false;
-            return;
-          }
+      if (!supported_format) {
+        LOG_ERROR("Unsupported PipeWire pixel format: {}",
+                  PipeWireFormatName(self->spa_video_format_));
+        self->running_ = false;
+        return;
+      }

-          const int bytes_per_pixel = BytesPerPixel(self->spa_video_format_);
-          if (bytes_per_pixel <= 0 || self->frame_width_ <= 0 ||
-              self->frame_height_ <= 0) {
-            LOG_ERROR("Invalid PipeWire frame layout: format={}, size={}x{}",
-                      PipeWireFormatName(self->spa_video_format_),
-                      self->frame_width_, self->frame_height_);
-            self->running_ = false;
-            return;
-          }
+      const int bytes_per_pixel = BytesPerPixel(self->spa_video_format_);
+      if (bytes_per_pixel <= 0 || self->frame_width_ <= 0 ||
+          self->frame_height_ <= 0) {
+        LOG_ERROR("Invalid PipeWire frame layout: format={}, size={}x{}",
+                  PipeWireFormatName(self->spa_video_format_),
+                  self->frame_width_, self->frame_height_);
+        self->running_ = false;
+        return;
+      }

-          self->frame_stride_ = self->frame_width_ * bytes_per_pixel;
+      self->frame_stride_ = self->frame_width_ * bytes_per_pixel;

-          uint8_t buffer[1024];
-          spa_pod_builder builder = SPA_POD_BUILDER_INIT(buffer, sizeof(buffer));
-          const spa_pod* params[2];
-          uint32_t param_count = 0;
+      uint8_t buffer[1024];
+      spa_pod_builder builder = SPA_POD_BUILDER_INIT(buffer, sizeof(buffer));
+      const spa_pod* params[2];
+      uint32_t param_count = 0;

-          params[param_count++] = reinterpret_cast<const spa_pod*>(
-              spa_pod_builder_add_object(
-                  &builder, SPA_TYPE_OBJECT_ParamBuffers, SPA_PARAM_Buffers,
-                  CROSSDESK_SPA_PARAM_BUFFERS_BUFFERS,
-                  SPA_POD_CHOICE_RANGE_Int(8, 4, 16),
-                  CROSSDESK_SPA_PARAM_BUFFERS_BLOCKS, SPA_POD_Int(1),
-                  CROSSDESK_SPA_PARAM_BUFFERS_SIZE,
-                  SPA_POD_CHOICE_RANGE_Int(self->frame_stride_ *
-                                               self->frame_height_,
-                                           self->frame_stride_ *
-                                               self->frame_height_,
-                                           self->frame_stride_ *
-                                               self->frame_height_),
-                  CROSSDESK_SPA_PARAM_BUFFERS_STRIDE,
-                  SPA_POD_CHOICE_RANGE_Int(self->frame_stride_,
-                                           self->frame_stride_,
-                                           self->frame_stride_)));
+      params[param_count++] =
+          reinterpret_cast<const spa_pod*>(spa_pod_builder_add_object(
+              &builder, SPA_TYPE_OBJECT_ParamBuffers, SPA_PARAM_Buffers,
+              CROSSDESK_SPA_PARAM_BUFFERS_BUFFERS,
+              SPA_POD_CHOICE_RANGE_Int(8, 4, 16),
+              CROSSDESK_SPA_PARAM_BUFFERS_BLOCKS, SPA_POD_Int(1),
+              CROSSDESK_SPA_PARAM_BUFFERS_SIZE,
+              SPA_POD_CHOICE_RANGE_Int(
+                  self->frame_stride_ * self->frame_height_,
+                  self->frame_stride_ * self->frame_height_,
+                  self->frame_stride_ * self->frame_height_),
+              CROSSDESK_SPA_PARAM_BUFFERS_STRIDE,
+              SPA_POD_CHOICE_RANGE_Int(self->frame_stride_, self->frame_stride_,
+                                       self->frame_stride_)));

-          params[param_count++] = reinterpret_cast<const spa_pod*>(
-              spa_pod_builder_add_object(
-                  &builder, SPA_TYPE_OBJECT_ParamMeta, SPA_PARAM_Meta,
-                  CROSSDESK_SPA_PARAM_META_TYPE, SPA_POD_Id(SPA_META_Header),
-                  CROSSDESK_SPA_PARAM_META_SIZE,
-                  SPA_POD_Int(sizeof(struct spa_meta_header))));
+      params[param_count++] =
+          reinterpret_cast<const spa_pod*>(spa_pod_builder_add_object(
+              &builder, SPA_TYPE_OBJECT_ParamMeta, SPA_PARAM_Meta,
+              CROSSDESK_SPA_PARAM_META_TYPE, SPA_POD_Id(SPA_META_Header),
+              CROSSDESK_SPA_PARAM_META_SIZE,
+              SPA_POD_Int(sizeof(struct spa_meta_header))));

-          if (self->pw_stream_) {
-            pw_stream_update_params(self->pw_stream_, params, param_count);
-          }
-          self->pipewire_format_ready_.store(true);
+      if (self->pw_stream_) {
+        const PipeWireDynamicApi* pipewire = GetPipeWireApi();
+        if (pipewire) {
+          pipewire->stream_update_params(self->pw_stream_, params, param_count);
+        }
+      }
+      self->pipewire_format_ready_.store(true);

-          const int pointer_width =
-              self->logical_width_ > 0 ? self->logical_width_ : self->frame_width_;
-          const int pointer_height = self->logical_height_ > 0
-                                         ? self->logical_height_
-                                         : self->frame_height_;
-          self->UpdateDisplayGeometry(pointer_width, pointer_height);
-          LOG_INFO(
-              "PipeWire video format: {}, {}x{} stride={} (pointer space {}x{})",
-                   PipeWireFormatName(self->spa_video_format_),
-                   self->frame_width_, self->frame_height_, self->frame_stride_,
-                   pointer_width, pointer_height);
-        };
+      int pointer_width =
+          self->logical_width_ > 0 ? self->logical_width_ : self->frame_width_;
+      int pointer_height = self->logical_height_ > 0 ? self->logical_height_
+                                                     : self->frame_height_;
+      double observed_scale_x = pointer_width > 0
+                                    ? static_cast<double>(self->frame_width_) /
+                                          static_cast<double>(pointer_width)
+                                    : 1.0;
+      double observed_scale_y = pointer_height > 0
+                                    ? static_cast<double>(self->frame_height_) /
+                                          static_cast<double>(pointer_height)
+                                    : 1.0;
+      double snapped_scale = 1.0;
+      bool derived_pointer_space = false;
+
+      if (!self->portal_has_logical_size_ && self->portal_stream_width_ > 0 &&
+          self->portal_stream_height_ > 0 && self->frame_width_ > 0 &&
+          self->frame_height_ > 0) {
+        const double raw_scale_x =
+            static_cast<double>(self->frame_width_) /
+            static_cast<double>(self->portal_stream_width_);
+        const double raw_scale_y =
+            static_cast<double>(self->frame_height_) /
+            static_cast<double>(self->portal_stream_height_);
+        const double average_scale = (raw_scale_x + raw_scale_y) * 0.5;
+        snapped_scale = SnapLikelyFractionalScale(average_scale);
+
+        const bool scales_are_consistent =
+            std::abs(raw_scale_x - raw_scale_y) <= 0.05;
+        const bool scale_was_snapped =
+            std::abs(snapped_scale - average_scale) <= 0.08;
+        if (scales_are_consistent && scale_was_snapped &&
+            snapped_scale > 1.05) {
+          pointer_width =
+              std::max(1, static_cast<int>(std::floor(
+                              static_cast<double>(self->portal_stream_width_) *
+                                  snapped_scale +
+                              1e-6)));
+          pointer_height =
+              std::max(1, static_cast<int>(std::floor(
+                              static_cast<double>(self->portal_stream_height_) *
+                                  snapped_scale +
+                              1e-6)));
+          observed_scale_x = pointer_width > 0
+                                 ? static_cast<double>(self->frame_width_) /
+                                       static_cast<double>(pointer_width)
+                                 : 1.0;
+          observed_scale_y = pointer_height > 0
+                                 ? static_cast<double>(self->frame_height_) /
+                                       static_cast<double>(pointer_height)
+                                 : 1.0;
+          derived_pointer_space = true;
+        }
+      }
+
+      self->UpdateDisplayGeometry(pointer_width, pointer_height);
+      if (derived_pointer_space) {
+        LOG_INFO(
+            "PipeWire video format: {}, {}x{} stride={} (pointer space {}x{}, "
+            "derived from portal stream {}x{} with compositor scale {:.4f}, "
+            "effective scale {:.4f}x{:.4f})",
+            PipeWireFormatName(self->spa_video_format_), self->frame_width_,
+            self->frame_height_, self->frame_stride_, pointer_width,
+            pointer_height, self->portal_stream_width_,
+            self->portal_stream_height_, snapped_scale, observed_scale_x,
+            observed_scale_y);
+      } else {
+        LOG_INFO(
+            "PipeWire video format: {}, {}x{} stride={} (pointer space {}x{}, "
+            "scale {:.4f}x{:.4f})",
+            PipeWireFormatName(self->spa_video_format_), self->frame_width_,
+            self->frame_height_, self->frame_stride_, pointer_width,
+            pointer_height, observed_scale_x, observed_scale_y);
+      }
+    };
    events.process = [](void* userdata) {
      auto* self = static_cast<ScreenCapturerWayland*>(userdata);
      if (self) {
@@ -382,7 +616,7 @@ bool ScreenCapturerWayland::SetupPipeWireStream(bool relaxed_connect,
    return events;
  }();

-  pw_stream_add_listener(pw_stream_, listener, &stream_events, this);
+  pipewire->stream_add_listener(pw_stream_, listener, &stream_events, this);
  pipewire_format_ready_.store(false);
  pipewire_stream_start_ms_.store(NowMs());
  pipewire_last_frame_ms_.store(0);
@@ -392,7 +626,8 @@ bool ScreenCapturerWayland::SetupPipeWireStream(bool relaxed_connect,
  const spa_pod* params[8];
  int param_count = 0;
  const spa_rectangle fixed_size{
-      static_cast<uint32_t>(logical_width_ > 0 ? logical_width_ : kFallbackWidth),
+      static_cast<uint32_t>(logical_width_ > 0 ? logical_width_
+                                               : kFallbackWidth),
      static_cast<uint32_t>(logical_height_ > 0 ? logical_height_
                                                : kFallbackHeight)};
  const spa_rectangle min_size{1u, 1u};
@@ -425,7 +660,7 @@ bool ScreenCapturerWayland::SetupPipeWireStream(bool relaxed_connect,

    if (param_count == 0) {
      LOG_ERROR("No valid PipeWire format params were built");
-      pw_thread_loop_unlock(pw_thread_loop_);
+      pipewire->thread_loop_unlock(pw_thread_loop_);
      CleanupPipeWire();
      return false;
    }
@@ -446,12 +681,12 @@ bool ScreenCapturerWayland::SetupPipeWireStream(bool relaxed_connect,
      PipeWireConnectModeName(mode), pipewire_node_id_, target_id,
      target_object_serial.empty() ? "none" : target_object_serial.c_str(),
      relaxed_connect, param_count, fixed_size.width, fixed_size.height);
-  const int ret = pw_stream_connect(
+  const int ret = pipewire->stream_connect(
      pw_stream_, PW_DIRECTION_INPUT, target_id,
      static_cast<pw_stream_flags>(PW_STREAM_FLAG_AUTOCONNECT |
                                   PW_STREAM_FLAG_MAP_BUFFERS),
      param_count > 0 ? params : nullptr, static_cast<uint32_t>(param_count));
-  pw_thread_loop_unlock(pw_thread_loop_);
+  pipewire->thread_loop_unlock(pw_thread_loop_);

  if (ret < 0) {
    LOG_ERROR("pw_stream_connect failed: {}", spa_strerror(ret));
@@ -463,16 +698,17 @@ bool ScreenCapturerWayland::SetupPipeWireStream(bool relaxed_connect,
 }

 void ScreenCapturerWayland::CleanupPipeWire() {
-  const bool need_lock = pw_thread_loop_ &&
-                         (pw_stream_ != nullptr || pw_core_ != nullptr ||
-                          pw_context_ != nullptr);
+  const PipeWireDynamicApi* pipewire = GetPipeWireApi();
+  const bool need_lock =
+      pipewire && pw_thread_loop_ &&
+      (pw_stream_ != nullptr || pw_core_ != nullptr || pw_context_ != nullptr);
  if (need_lock) {
-    pw_thread_loop_lock(pw_thread_loop_);
+    pipewire->thread_loop_lock(pw_thread_loop_);
  }

-  if (pw_stream_) {
-    pw_stream_set_active(pw_stream_, false);
-    pw_stream_disconnect(pw_stream_);
+  if (pw_stream_ && pipewire) {
+    pipewire->stream_set_active(pw_stream_, false);
+    pipewire->stream_disconnect(pw_stream_);
  }

  if (stream_listener_) {
@@ -481,33 +717,34 @@ void ScreenCapturerWayland::CleanupPipeWire() {
    stream_listener_ = nullptr;
  }

-  if (pw_stream_) {
-    pw_stream_destroy(pw_stream_);
-    pw_stream_ = nullptr;
+  if (pw_stream_ && pipewire) {
+    pipewire->stream_destroy(pw_stream_);
  }
+  pw_stream_ = nullptr;

-  if (pw_core_) {
-    pw_core_disconnect(pw_core_);
-    pw_core_ = nullptr;
+  if (pw_core_ && pipewire) {
+    pipewire->core_disconnect(pw_core_);
  }
+  pw_core_ = nullptr;

-  if (pw_context_) {
-    pw_context_destroy(pw_context_);
-    pw_context_ = nullptr;
+  if (pw_context_ && pipewire) {
+    pipewire->context_destroy(pw_context_);
  }
+  pw_context_ = nullptr;

  if (need_lock) {
-    pw_thread_loop_unlock(pw_thread_loop_);
+    pipewire->thread_loop_unlock(pw_thread_loop_);
  }

-  if (pw_thread_loop_) {
+  if (pw_thread_loop_ && pipewire) {
    if (pipewire_thread_loop_started_) {
-      pw_thread_loop_stop(pw_thread_loop_);
+      pipewire->thread_loop_stop(pw_thread_loop_);
      pipewire_thread_loop_started_ = false;
    }
-    pw_thread_loop_destroy(pw_thread_loop_);
-    pw_thread_loop_ = nullptr;
+    pipewire->thread_loop_destroy(pw_thread_loop_);
  }
+  pw_thread_loop_ = nullptr;
+  pipewire_thread_loop_started_ = false;

  if (pipewire_fd_ >= 0) {
    close(pipewire_fd_);
@@ -518,23 +755,24 @@ void ScreenCapturerWayland::CleanupPipeWire() {
  pipewire_stream_start_ms_.store(0);
  pipewire_last_frame_ms_.store(0);

-  if (pipewire_initialized_) {
-    pw_deinit();
-    pipewire_initialized_ = false;
+  if (pipewire_initialized_ && pipewire) {
+    pipewire->deinit();
  }
+  pipewire_initialized_ = false;
 }

 void ScreenCapturerWayland::HandlePipeWireBuffer() {
-  if (!pw_stream_) {
+  const PipeWireDynamicApi* pipewire = GetPipeWireApi();
+  if (!pw_stream_ || !pipewire) {
    return;
  }

-  pw_buffer* buffer = pw_stream_dequeue_buffer(pw_stream_);
+  pw_buffer* buffer = pipewire->stream_dequeue_buffer(pw_stream_);
  if (!buffer) {
    return;
  }

-  auto requeue = [&]() { pw_stream_queue_buffer(pw_stream_, buffer); };
+  auto requeue = [&]() { pipewire->stream_queue_buffer(pw_stream_, buffer); };

  if (paused_) {
    requeue();
@@ -584,8 +822,8 @@ void ScreenCapturerWayland::HandlePipeWireBuffer() {
    uv_plane_.resize(uv_size);
  }

-  libyuv::ARGBToNV12(src, stride, y_plane_.data(), even_width,
-                     uv_plane_.data(), even_width, even_width, even_height);
+  libyuv::ARGBToNV12(src, stride, y_plane_.data(), even_width, uv_plane_.data(),
+                     even_width, even_width, even_height);

  std::vector<uint8_t> nv12;
  nv12.reserve(y_plane_.size() + uv_plane_.size());
@@ -1,15 +1,15 @@
 #include "screen_capturer_wayland.h"
-
 #include "screen_capturer_wayland_build.h"
 #include "wayland_portal_shared.h"

 #if CROSSDESK_WAYLAND_BUILD_ENABLED

+#include <unistd.h>
+
 #include <chrono>
 #include <cstring>
 #include <functional>
 #include <string>
-#include <unistd.h>

 #include "rd_log.h"

@@ -149,8 +149,8 @@ std::string BuildSessionHandleFromRequestPath(
    return "";
  }

-  const std::string sender = request_path.substr(sender_start,
-                                                 token_sep - sender_start);
+  const std::string sender =
+      request_path.substr(sender_start, token_sep - sender_start);
  if (sender.empty()) {
    return "";
  }
@@ -284,8 +284,7 @@ bool ExtractPortalResponse(DBusMessage* message, uint32_t* response_code,

 bool SendPortalRequestAndHandleResponse(
    DBusConnection* connection, const char* interface_name,
-    const char* method_name,
-    const char* action_name,
+    const char* method_name, const char* action_name,
    const std::function<bool(DBusMessage*)>& append_message_args,
    const std::atomic<bool>& running,
    const std::function<bool(uint32_t, DBusMessageIter*)>& handle_results,
@@ -295,9 +294,8 @@ bool SendPortalRequestAndHandleResponse(
    return false;
  }

-  DBusMessage* message =
-      dbus_message_new_method_call(kPortalBusName, kPortalObjectPath,
-                                   interface_name, method_name);
+  DBusMessage* message = dbus_message_new_method_call(
+      kPortalBusName, kPortalObjectPath, interface_name, method_name);
  if (!message) {
    LOG_ERROR("Failed to allocate {} message", method_name);
    return false;
@@ -311,8 +309,8 @@ bool SendPortalRequestAndHandleResponse(

  DBusError error;
  dbus_error_init(&error);
-  DBusMessage* reply =
-      dbus_connection_send_with_reply_and_block(connection, message, -1, &error);
+  DBusMessage* reply = dbus_connection_send_with_reply_and_block(
+      connection, message, -1, &error);
  dbus_message_unref(message);
  if (!reply) {
    LogDbusError(action_name ? action_name : method_name, &error);
@@ -365,8 +363,8 @@ bool ScreenCapturerWayland::CheckPortalAvailability() const {
    return false;
  }

-  const dbus_bool_t has_owner = dbus_bus_name_has_owner(
-      connection, kPortalBusName, &error);
+  const dbus_bool_t has_owner =
+      dbus_bus_name_has_owner(connection, kPortalBusName, &error);
  if (dbus_error_is_set(&error)) {
    LogDbusError("dbus_bus_name_has_owner", &error);
    dbus_error_free(&error);
@@ -415,7 +413,8 @@ bool ScreenCapturerWayland::CreatePortalSession() {
                                         &options);
        AppendDictEntryString(&options, "session_handle_token",
                              session_handle_token);
-        AppendDictEntryString(&options, "handle_token", MakeToken("crossdesk_req"));
+        AppendDictEntryString(&options, "handle_token",
+                              MakeToken("crossdesk_req"));
        dbus_message_iter_close_container(&iter, &options);
        return true;
      },
@@ -459,8 +458,8 @@ bool ScreenCapturerWayland::CreatePortalSession() {
  }

  if (session_handle_.empty()) {
-    const std::string fallback_handle = BuildSessionHandleFromRequestPath(
-        request_path, session_handle_token);
+    const std::string fallback_handle =
+        BuildSessionHandleFromRequestPath(request_path, session_handle_token);
    if (!fallback_handle.empty()) {
      LOG_WARN(
          "CreateSession response missing session_handle, using derived handle "
@@ -505,7 +504,8 @@ bool ScreenCapturerWayland::SelectPortalSource() {
        dbus_message_iter_close_container(&iter, &options);
        return true;
      },
-      running_, [](uint32_t response_code, DBusMessageIter*) {
+      running_,
+      [](uint32_t response_code, DBusMessageIter*) {
        if (response_code != 0) {
          LOG_ERROR("SelectSources was denied or malformed, response={}",
                    response_code);
@@ -538,7 +538,8 @@ bool ScreenCapturerWayland::SelectPortalDevices() {
        dbus_message_iter_close_container(&iter, &options);
        return true;
      },
-      running_, [](uint32_t response_code, DBusMessageIter*) {
+      running_,
+      [](uint32_t response_code, DBusMessageIter*) {
        if (response_code != 0) {
          LOG_ERROR("SelectDevices was denied or malformed, response={}",
                    response_code);
@@ -567,14 +568,16 @@ bool ScreenCapturerWayland::StartPortalSession() {
        dbus_message_iter_append_basic(&iter, DBUS_TYPE_STRING, &parent_window);
        dbus_message_iter_open_container(&iter, DBUS_TYPE_ARRAY, "{sv}",
                                         &options);
-        AppendDictEntryString(&options, "handle_token", MakeToken("crossdesk_req"));
+        AppendDictEntryString(&options, "handle_token",
+                              MakeToken("crossdesk_req"));
        dbus_message_iter_close_container(&iter, &options);
        return true;
      },
      running_,
      [&](uint32_t response_code, DBusMessageIter* results) {
        if (response_code != 0) {
-          LOG_ERROR("Start was denied or malformed, response={}", response_code);
+          LOG_ERROR("Start was denied or malformed, response={}",
+                    response_code);
          return false;
        }

@@ -602,16 +605,19 @@ bool ScreenCapturerWayland::StartPortalSession() {
                DBusMessageIter streams;
                dbus_message_iter_recurse(&variant, &streams);

-                if (dbus_message_iter_get_arg_type(&streams) == DBUS_TYPE_STRUCT) {
+                if (dbus_message_iter_get_arg_type(&streams) ==
+                    DBUS_TYPE_STRUCT) {
                  DBusMessageIter stream;
                  dbus_message_iter_recurse(&streams, &stream);

-                  if (dbus_message_iter_get_arg_type(&stream) == DBUS_TYPE_UINT32) {
+                  if (dbus_message_iter_get_arg_type(&stream) ==
+                      DBUS_TYPE_UINT32) {
                    dbus_message_iter_get_basic(&stream, &pipewire_node_id_);
                  }

                  if (dbus_message_iter_next(&stream) &&
-                      dbus_message_iter_get_arg_type(&stream) == DBUS_TYPE_ARRAY) {
+                      dbus_message_iter_get_arg_type(&stream) ==
+                          DBUS_TYPE_ARRAY) {
                    DBusMessageIter props;
                    int stream_width = 0;
                    int stream_height = 0;
@@ -637,7 +643,8 @@ bool ScreenCapturerWayland::StartPortalSession() {
                            DBusMessageIter size_iter;
                            int width = 0;
                            int height = 0;
-                            dbus_message_iter_recurse(&prop_variant, &size_iter);
+                            dbus_message_iter_recurse(&prop_variant,
+                                                      &size_iter);
                            if (ReadIntLike(&size_iter, &width) &&
                                dbus_message_iter_next(&size_iter) &&
                                ReadIntLike(&size_iter, &height)) {
@@ -665,6 +672,11 @@ bool ScreenCapturerWayland::StartPortalSession() {
                        stream_width, stream_height, logical_width,
                        logical_height, picked_width, picked_height);

+                    portal_stream_width_ = stream_width;
+                    portal_stream_height_ = stream_height;
+                    portal_has_logical_size_ =
+                        logical_width > 0 && logical_height > 0;
+
                    if (logical_width > 0 && logical_height > 0) {
                      logical_width_ = logical_width;
                      logical_height_ = logical_height;
@@ -682,8 +694,7 @@ bool ScreenCapturerWayland::StartPortalSession() {

          dbus_message_iter_next(&dict);
        }
-        pointer_granted_ =
-            (granted_devices & kRemoteDesktopDevicePointer) != 0;
+        pointer_granted_ = (granted_devices & kRemoteDesktopDevicePointer) != 0;
        return true;
      });
  if (!ok) {
@@ -699,8 +710,8 @@ bool ScreenCapturerWayland::StartPortalSession() {
    return false;
  }

-  shared_session_registered_ = PublishSharedWaylandPortalSession(
-      SharedWaylandPortalSessionInfo{
+  shared_session_registered_ =
+      PublishSharedWaylandPortalSession(SharedWaylandPortalSessionInfo{
          dbus_connection_, session_handle_, pipewire_node_id_, logical_width_,
          logical_height_, pointer_granted_});
  if (!shared_session_registered_) {
@@ -728,16 +739,14 @@ bool ScreenCapturerWayland::OpenPipeWireRemote() {
  DBusMessageIter options;
  const char* session_handle = session_handle_.c_str();
  dbus_message_iter_init_append(message, &iter);
-  dbus_message_iter_append_basic(&iter, DBUS_TYPE_OBJECT_PATH,
-                                 &session_handle);
+  dbus_message_iter_append_basic(&iter, DBUS_TYPE_OBJECT_PATH, &session_handle);
  dbus_message_iter_open_container(&iter, DBUS_TYPE_ARRAY, "{sv}", &options);
  dbus_message_iter_close_container(&iter, &options);

  DBusError error;
  dbus_error_init(&error);
-  DBusMessage* reply =
-      dbus_connection_send_with_reply_and_block(dbus_connection_, message, -1,
-                                                &error);
+  DBusMessage* reply = dbus_connection_send_with_reply_and_block(
+      dbus_connection_, message, -1, &error);
  dbus_message_unref(message);
  if (!reply) {
    LogDbusError("OpenPipeWireRemote", &error);
@@ -792,9 +801,8 @@ void ScreenCapturerWayland::ClosePortalSession() {
    ReleaseSharedWaylandPortalSession(&close_connection, &close_session_handle);
    shared_session_registered_ = false;
    if (close_connection) {
-      CloseWaylandPortalSessionAndConnection(close_connection,
-                                             close_session_handle,
-                                             "Session.Close");
+      CloseWaylandPortalSessionAndConnection(
+          close_connection, close_session_handle, "Session.Close");
    }
    dbus_connection_ = nullptr;
  } else if (dbus_connection_ && !session_handle_.empty()) {
@@ -805,9 +813,9 @@ void ScreenCapturerWayland::ClosePortalSession() {

  session_handle_.clear();
  pipewire_node_id_ = 0;
-  UpdateDisplayGeometry(logical_width_ > 0 ? logical_width_ : kFallbackWidth,
-                        logical_height_ > 0 ? logical_height_
-                                            : kFallbackHeight);
+  UpdateDisplayGeometry(
+      logical_width_ > 0 ? logical_width_ : kFallbackWidth,
+      logical_height_ > 0 ? logical_height_ : kFallbackHeight);
  pointer_granted_ = false;
 }

@@ -122,9 +122,8 @@ int ScreenCapturerX11::Init(const int fps, cb_desktop_data cb) {
  height_ = attr.height;

  if ((width_ & 1) != 0 || (height_ & 1) != 0) {
-    LOG_WARN(
-        "X11 root size {}x{} is not even, aligning down to {}x{} for NV12",
-        width_, height_, width_ & ~1, height_ & ~1);
+    LOG_WARN("X11 root size {}x{} is not even, aligning down to {}x{} for NV12",
+             width_, height_, width_ & ~1, height_ & ~1);
    width_ &= ~1;
    height_ &= ~1;
  }
@@ -183,8 +182,9 @@ int ScreenCapturerX11::Start(bool show_cursor) {
        OnFrame();
      }

-      const auto elapsed = std::chrono::duration_cast<std::chrono::milliseconds>(
-          clock::now() - frame_start);
+      const auto elapsed =
+          std::chrono::duration_cast<std::chrono::milliseconds>(clock::now() -
+                                                                frame_start);
      if (elapsed < frame_interval) {
        std::this_thread::sleep_for(frame_interval - elapsed);
      }
@@ -282,21 +282,17 @@ void ScreenCapturerX11::OnFrame() {
    }
  }

-  bool needs_copy = image->bytes_per_line != width_ * 4;
-  std::vector<uint8_t> argb_buf;
-  uint8_t* src_argb = nullptr;
-
-  if (needs_copy) {
-    argb_buf.resize(width_ * height_ * 4);
-    for (int y = 0; y < height_; ++y) {
-      memcpy(&argb_buf[y * width_ * 4], image->data + y * image->bytes_per_line,
-             width_ * 4);
-    }
-    src_argb = argb_buf.data();
-  } else {
-    src_argb = reinterpret_cast<uint8_t*>(image->data);
+  if (image->bits_per_pixel != 32 || image->bytes_per_line <= 0) {
+    LOG_WARN(
+        "Unsupported X11 image layout: bits_per_pixel={}, bytes_per_line={}",
+        image->bits_per_pixel, image->bytes_per_line);
+    XDestroyImage(image);
+    return;
  }

+  const uint8_t* src_argb = reinterpret_cast<const uint8_t*>(image->data);
+  const int src_stride_argb = image->bytes_per_line;
+
  const size_t y_size =
      static_cast<size_t>(width_) * static_cast<size_t>(height_);
  const size_t uv_size = y_size / 2;
@@ -307,8 +303,20 @@ void ScreenCapturerX11::OnFrame() {
    uv_plane_.resize(uv_size);
  }

-  libyuv::ARGBToNV12(src_argb, width_ * 4, y_plane_.data(), width_,
-                     uv_plane_.data(), width_, width_, height_);
+  const int convert_ret =
+      use_abgr_to_nv12_
+          ? libyuv::ABGRToNV12(src_argb, src_stride_argb, y_plane_.data(),
+                               width_, uv_plane_.data(), width_, width_,
+                               height_)
+          : libyuv::ARGBToNV12(src_argb, src_stride_argb, y_plane_.data(),
+                               width_, uv_plane_.data(), width_, width_,
+                               height_);
+  if (convert_ret != 0) {
+    LOG_WARN("X11 {} failed: {}",
+             use_abgr_to_nv12_ ? "ABGRToNV12" : "ARGBToNV12", convert_ret);
+    XDestroyImage(image);
+    return;
+  }

  std::vector<uint8_t> nv12;
  nv12.reserve(y_plane_.size() + uv_plane_.size());
@@ -416,16 +424,18 @@ bool ScreenCapturerX11::ProbeCapture() {
    x11_error = trap.SyncAndGetError();
  }

-  if (probe_image) {
-    XDestroyImage(probe_image);
-  }
-
  if (x11_error != 0 || !probe_image) {
    LOG_WARN("X11 probe XGetImage failed: x11_error={}, image={}", x11_error,
             probe_image ? "valid" : "null");
    return false;
  }

+  const bool red_in_low_byte = (probe_image->red_mask & 0x000000FFu) != 0;
+  const bool blue_in_low_byte = (probe_image->blue_mask & 0x000000FFu) != 0;
+  use_abgr_to_nv12_ = red_in_low_byte && !blue_in_low_byte;
+
+  XDestroyImage(probe_image);
+
  return true;
 }
 }  // namespace crossdesk
@@ -71,6 +71,7 @@ class ScreenCapturerX11 : public ScreenCapturer {
  cb_desktop_data callback_;
  std::vector<DisplayInfo> display_info_list_;
  int capture_error_count_ = 0;
+  bool use_abgr_to_nv12_ = false;

  std::vector<uint8_t> y_plane_;
  std::vector<uint8_t> uv_plane_;
@@ -244,6 +244,31 @@ bool ScreenCapturerDxgi::CreateDuplicationForMonitor(int monitor_index) {
  return true;
 }

+bool ScreenCapturerDxgi::RecreateDuplicationForCurrentMonitor() {
+  ReleaseDuplication();
+  int current_monitor = monitor_index_.load();
+  if (CreateDuplicationForMonitor(current_monitor)) {
+    return true;
+  }
+
+  EnumerateDisplays();
+  if (display_info_list_.empty()) {
+    LOG_ERROR("DXGI: no displays found while recreating duplication");
+    return false;
+  }
+  if (current_monitor < 0 ||
+      current_monitor >= static_cast<int>(display_info_list_.size())) {
+    current_monitor = 0;
+    monitor_index_ = 0;
+  }
+  if (CreateDuplicationForMonitor(current_monitor)) {
+    LOG_INFO("DXGI: recreated duplication for monitor {}",
+             monitor_index_.load());
+    return true;
+  }
+  return false;
+}
+
 void ScreenCapturerDxgi::ReleaseDuplication() {
  staging_.Reset();
  if (duplication_) {
@@ -254,6 +279,8 @@ void ScreenCapturerDxgi::ReleaseDuplication() {

 void ScreenCapturerDxgi::CaptureLoop() {
  const int timeout_ms = 33;
+  auto last_duplication_retry =
+      std::chrono::steady_clock::now() - std::chrono::milliseconds(1000);
  while (running_) {
    if (paused_) {
      std::this_thread::sleep_for(std::chrono::milliseconds(10));
@@ -261,6 +288,11 @@ void ScreenCapturerDxgi::CaptureLoop() {
    }

    if (!duplication_) {
+      const auto now = std::chrono::steady_clock::now();
+      if (now - last_duplication_retry >= std::chrono::milliseconds(500)) {
+        last_duplication_retry = now;
+        RecreateDuplicationForCurrentMonitor();
+      }
      std::this_thread::sleep_for(std::chrono::milliseconds(10));
      continue;
    }
@@ -274,9 +306,7 @@ void ScreenCapturerDxgi::CaptureLoop() {
    }
    if (FAILED(hr)) {
      LOG_ERROR("DXGI: AcquireNextFrame failed, hr={}", (int)hr);
-      // attempt to recreate duplication
-      ReleaseDuplication();
-      CreateDuplicationForMonitor(monitor_index_);
+      RecreateDuplicationForCurrentMonitor();
      continue;
    }

@@ -353,4 +383,4 @@ void ScreenCapturerDxgi::CaptureLoop() {
  }
 }

-}  // namespace crossdesk
+}  // namespace crossdesk
@@ -50,6 +50,7 @@ class ScreenCapturerDxgi : public ScreenCapturer {
  bool InitializeDxgi();
  void EnumerateDisplays();
  bool CreateDuplicationForMonitor(int monitor_index);
+  bool RecreateDuplicationForCurrentMonitor();
  void CaptureLoop();
  void ReleaseDuplication();

@@ -78,4 +79,4 @@ class ScreenCapturerDxgi : public ScreenCapturer {
 };
 }  // namespace crossdesk

-#endif
+#endif
@@ -100,8 +100,7 @@ bool ScreenCapturerWgc::IsWgcSupported() {
 }

 int ScreenCapturerWgc::Init(const int fps, cb_desktop_data cb) {
-  int error = 0;
-  if (inited_ == true) return error;
+  if (inited_ == true) return 0;

  // nv12_frame_ = new unsigned char[rect.right * rect.bottom * 3 / 2];
  // nv12_frame_scaled_ = new unsigned char[1280 * 720 * 3 / 2];
@@ -112,8 +111,18 @@ int ScreenCapturerWgc::Init(const int fps, cb_desktop_data cb) {

  if (!IsWgcSupported()) {
    LOG_ERROR("WGC not supported");
-    error = 2;
-    return error;
+    return 2;
+  }
+
+  return RebuildSessions(monitor_index_);
+}
+
+int ScreenCapturerWgc::RebuildSessions(int preferred_monitor_index) {
+  CleanUp();
+
+  if (!IsWgcSupported()) {
+    LOG_ERROR("WGC not supported");
+    return 2;
  }

  monitor_ = GetPrimaryMonitor();
@@ -125,6 +134,13 @@ int ScreenCapturerWgc::Init(const int fps, cb_desktop_data cb) {
    return -1;
  }

+  if (preferred_monitor_index < 0 ||
+      preferred_monitor_index >= static_cast<int>(display_info_list_.size())) {
+    preferred_monitor_index = 0;
+  }
+  monitor_index_ = preferred_monitor_index;
+
+  int error = 0;
  for (int i = 0; i < display_info_list_.size(); i++) {
    const auto& display = display_info_list_[i];
    LOG_INFO(
@@ -138,20 +154,28 @@ int ScreenCapturerWgc::Init(const int fps, cb_desktop_data cb) {
    sessions_.back().session_->RegisterObserver(this);
    error = sessions_.back().session_->Initialize((HMONITOR)display.handle);
    if (error != 0) {
+      LOG_ERROR("WGC: initialize session {} failed, ret={}", i, error);
+      CleanUp();
      return error;
    }
    sessions_[i].inited_ = true;
-    inited_ = true;
  }

  LOG_INFO("Default on monitor {}:{}", monitor_index_,
           display_info_list_[monitor_index_].name);

-  initial_monitor_index_ = monitor_index_;
+  if (initial_monitor_index_ < 0 ||
+      initial_monitor_index_ >= static_cast<int>(display_info_list_.size())) {
+    initial_monitor_index_ = monitor_index_;
+  }
+  inited_ = true;
  return 0;
 }

-int ScreenCapturerWgc::Destroy() { return 0; }
+int ScreenCapturerWgc::Destroy() {
+  CleanUp();
+  return 0;
+}

 int ScreenCapturerWgc::Start(bool show_cursor) {
  if (running_ == true) {
@@ -160,13 +184,37 @@ int ScreenCapturerWgc::Start(bool show_cursor) {
  }

  if (inited_ == false) {
-    LOG_ERROR("Screen capturer not inited");
-    return 4;
+    const int ret = RebuildSessions(monitor_index_);
+    if (ret != 0) {
+      LOG_ERROR("Screen capturer not inited");
+      return ret;
+    }
  }

+  int ret = StartSessions(show_cursor);
+  if (ret == 0) {
+    return 0;
+  }
+
+  LOG_WARN("WGC: start failed, rebuilding sessions");
+  ret = RebuildSessions(monitor_index_);
+  if (ret != 0) {
+    return ret;
+  }
+  return StartSessions(show_cursor);
+}
+
+int ScreenCapturerWgc::StartSessions(bool show_cursor) {
  bool any_started = false;
+  bool active_started = false;
  int last_error = 0;
-  for (int i = 0; i < sessions_.size(); i++) {
+  int active_monitor = monitor_index_;
+  if (active_monitor < 0 ||
+      active_monitor >= static_cast<int>(sessions_.size())) {
+    active_monitor = 0;
+    monitor_index_ = 0;
+  }
+  for (int i = 0; i < static_cast<int>(sessions_.size()); i++) {
    if (sessions_[i].inited_ == false) {
      LOG_ERROR("Session {} not inited", i);
      continue;
@@ -182,16 +230,27 @@ int ScreenCapturerWgc::Start(bool show_cursor) {
        continue;
      }

-      if (i != 0) {
+      if (i != active_monitor) {
        sessions_[i].session_->Pause();
        sessions_[i].paused_ = true;
+      } else {
+        sessions_[i].session_->Resume();
+        sessions_[i].paused_ = false;
      }
      sessions_[i].running_ = true;
      any_started = true;
+      if (i == active_monitor) {
+        active_started = true;
+      }
    }
-    running_ = running_ || any_started;
  }

+  running_ = active_started;
+  if (!active_started) {
+    LOG_ERROR("WGC: active session did not start successfully");
+    Stop();
+    return last_error != 0 ? last_error : -1;
+  }
  if (!any_started) {
    LOG_ERROR("WGC: no session started successfully");
    return last_error != 0 ? last_error : -1;
@@ -349,13 +408,16 @@ void ScreenCapturerWgc::OnFrame(const WgcSession::wgc_session_frame& frame,
 }

 void ScreenCapturerWgc::CleanUp() {
-  if (inited_) {
-    for (auto& session : sessions_) {
-      if (session.session_) {
-        session.session_->Stop();
-      }
+  running_ = false;
+  for (auto& session : sessions_) {
+    if (session.session_) {
+      session.session_->Stop();
    }
-    sessions_.clear();
  }
+  sessions_.clear();
+  display_info_list_.clear();
+  gs_display_list.clear();
+  monitor_ = nullptr;
+  inited_ = false;
 }
-}  // namespace crossdesk
+}  // namespace crossdesk
@@ -40,6 +40,8 @@ class ScreenCapturerWgc : public ScreenCapturer,

 protected:
  void CleanUp();
+  int RebuildSessions(int preferred_monitor_index);
+  int StartSessions(bool show_cursor);

 private:
  HMONITOR monitor_;
@@ -74,4 +76,4 @@ class ScreenCapturerWgc : public ScreenCapturer,
  std::mutex frame_mutex_;
 };
 }  // namespace crossdesk
-#endif
+#endif
@@ -7,8 +7,13 @@
 #ifndef _SCREEN_CAPTURER_WIN_H_
 #define _SCREEN_CAPTURER_WIN_H_

+#include <Windows.h>
+
+#include <atomic>
+#include <cstdint>
 #include <memory>
 #include <mutex>
+#include <thread>
 #include <unordered_map>
 #include <unordered_set>
 #include <vector>
@@ -48,9 +53,50 @@ class ScreenCapturerWin : public ScreenCapturer {
  std::mutex alias_mutex_;
  std::vector<DisplayInfo> canonical_displays_;
  std::unordered_set<std::string> canonical_labels_;
+  std::atomic<bool> running_{false};
+  std::atomic<bool> paused_{false};
+  std::atomic<bool> show_cursor_{true};
+  std::atomic<int> monitor_index_{0};
+  int initial_monitor_index_ = 0;
+  std::atomic<bool> secure_desktop_capture_active_{false};
+  std::atomic<bool> post_secure_desktop_waiting_for_frame_{false};
+  std::atomic<bool> post_secure_desktop_drop_logged_{false};
+  std::atomic<ULONGLONG> post_secure_desktop_started_tick_{0};
+  std::thread secure_capture_thread_;
+  HANDLE secure_frame_mapping_ = nullptr;
+  HANDLE secure_frame_ready_event_ = nullptr;
+  uint8_t* secure_frame_view_ = nullptr;
+  size_t secure_frame_view_size_ = 0;
+  DWORD secure_shared_session_id_ = 0xFFFFFFFF;
+  int secure_shared_left_ = 0;
+  int secure_shared_top_ = 0;
+  int secure_shared_width_ = 0;
+  int secure_shared_height_ = 0;
+  int secure_shared_fps_ = 0;
+  bool secure_shared_show_cursor_ = true;
+  std::string secure_shared_stage_;
+  bool secure_shared_capture_started_ = false;

  void BuildCanonicalFromImpl();
  void RebuildAliasesFromImpl();
+  void StopSecureCaptureThread();
+  bool RestartCaptureBackendAfterSecureDesktop();
+  void SecureDesktopCaptureLoop();
+  bool GetCurrentCaptureRegion(int* left, int* top, int* width, int* height,
+                               std::string* display_name);
+  bool StartSecureDesktopSharedCapture(DWORD session_id, int left, int top,
+                                       int width, int height,
+                                       const std::string& stage,
+                                       bool show_cursor, int fps,
+                                       std::string* error_out);
+  void StopSecureDesktopSharedCapture(DWORD session_id);
+  bool OpenSecureDesktopSharedFrame(DWORD session_id, size_t min_size,
+                                    std::string* error_out);
+  bool ReadSecureDesktopSharedFrame(DWORD wait_ms,
+                                    std::vector<uint8_t>* nv12_frame_out,
+                                    int* width_out, int* height_out,
+                                    std::string* error_out);
+  void CloseSecureDesktopSharedFrame();
 };
 }  // namespace crossdesk
-#endif
+#endif
@@ -2,23 +2,10 @@

 #include <Windows.Graphics.Capture.Interop.h>

-#include <atomic>
-#include <functional>
-#include <memory>
+#include <string>

 #include "rd_log.h"

-#define CHECK_INIT             \
-  if (!is_initialized_) {      \
-    LOG_ERROR("AE_NEED_INIT"); \
-    return 4;                  \
-  }
-
-#define CHECK_CLOSED                         \
-  if (cleaned_.load() == true) {             \
-    throw winrt::hresult_error(RO_E_CLOSED); \
-  }
-
 namespace crossdesk {

 extern "C" {
@@ -40,7 +27,7 @@ int WgcSessionImpl::Initialize(HWND hwnd) {

  target_.hwnd = hwnd;
  target_.is_window = true;
-  return Initialize();
+  return InitializeLocked();
 }

 int WgcSessionImpl::Initialize(HMONITOR hmonitor) {
@@ -48,7 +35,7 @@ int WgcSessionImpl::Initialize(HMONITOR hmonitor) {

  target_.hmonitor = hmonitor;
  target_.is_window = false;
-  return Initialize();
+  return InitializeLocked();
 }

 void WgcSessionImpl::RegisterObserver(wgc_session_observer* observer) {
@@ -59,68 +46,13 @@ void WgcSessionImpl::RegisterObserver(wgc_session_observer* observer) {
 int WgcSessionImpl::Start(bool show_cursor) {
  std::lock_guard locker(lock_);

-  if (is_running_) return 0;
-
-  int error = 1;
-
-  CHECK_INIT;
-  try {
-    last_show_cursor_ = show_cursor;
-    if (!capture_session_) {
-      auto current_size = capture_item_.Size();
-      capture_framepool_ =
-          winrt::Windows::Graphics::Capture::Direct3D11CaptureFramePool::
-              CreateFreeThreaded(d3d11_direct_device_,
-                                 winrt::Windows::Graphics::DirectX::
-                                     DirectXPixelFormat::B8G8R8A8UIntNormalized,
-                                 2, current_size);
-      capture_session_ = capture_framepool_.CreateCaptureSession(capture_item_);
-      capture_frame_size_ = current_size;
-      capture_framepool_trigger_ = capture_framepool_.FrameArrived(
-          winrt::auto_revoke, {this, &WgcSessionImpl::OnFrame});
-      capture_close_trigger_ = capture_item_.Closed(
-          winrt::auto_revoke, {this, &WgcSessionImpl::OnClosed});
-    }
-
-    if (!capture_framepool_) throw std::exception();
-
-    is_running_ = true;
-
-    // we do not need to crate a thread to enter a message loop coz we use
-    // CreateFreeThreaded instead of Create to create a capture frame pool,
-    // we need to test the performance later
-    // loop_ = std::thread(std::bind(&WgcSessionImpl::message_func, this));
-
-    capture_session_.IsCursorCaptureEnabled(show_cursor);
-    capture_session_.StartCapture();
-
-    error = 0;
-  } catch (winrt::hresult_error) {
-    LOG_ERROR("AE_WGC_CREATE_CAPTURER_FAILED");
-    return 86;
-  } catch (...) {
-    return 86;
-  }
-
-  return error;
+  return StartLocked(show_cursor);
 }

 int WgcSessionImpl::Stop() {
  std::lock_guard locker(lock_);

-  CHECK_INIT;
-
-  is_running_ = false;
-
-  // if (loop_.joinable()) loop_.join();
-
-  if (capture_framepool_trigger_) capture_framepool_trigger_.revoke();
-
-  if (capture_session_) {
-    capture_session_.Close();
-    capture_session_ = nullptr;
-  }
-
+  CleanUpLocked();
  return 0;
 }

@@ -129,7 +61,10 @@ int WgcSessionImpl::Pause() {

  is_paused_ = true;

-  CHECK_INIT;
+  if (!is_initialized_) {
+    LOG_ERROR("AE_NEED_INIT");
+    return 4;
+  }
  return 0;
 }

@@ -138,7 +73,10 @@ int WgcSessionImpl::Resume() {

  is_paused_ = false;

-  CHECK_INIT;
+  if (!is_initialized_) {
+    LOG_ERROR("AE_NEED_INIT");
+    return 4;
+  }
  return 0;
 }

@@ -175,10 +113,10 @@ auto WgcSessionImpl::CreateCaptureItemForWindow(HWND hwnd) {
      winrt::Windows::Graphics::Capture::GraphicsCaptureItem>();
  auto interop_factory = activation_factory.as<IGraphicsCaptureItemInterop>();
  winrt::Windows::Graphics::Capture::GraphicsCaptureItem item = {nullptr};
-  interop_factory->CreateForWindow(
+  winrt::check_hresult(interop_factory->CreateForWindow(
      hwnd,
      winrt::guid_of<ABI::Windows::Graphics::Capture::IGraphicsCaptureItem>(),
-      reinterpret_cast<void**>(winrt::put_abi(item)));
+      reinterpret_cast<void**>(winrt::put_abi(item))));
  return item;
 }

@@ -187,10 +125,10 @@ auto WgcSessionImpl::CreateCaptureItemForMonitor(HMONITOR hmonitor) {
      winrt::Windows::Graphics::Capture::GraphicsCaptureItem>();
  auto interop_factory = activation_factory.as<IGraphicsCaptureItemInterop>();
  winrt::Windows::Graphics::Capture::GraphicsCaptureItem item = {nullptr};
-  interop_factory->CreateForMonitor(
+  winrt::check_hresult(interop_factory->CreateForMonitor(
      hmonitor,
      winrt::guid_of<ABI::Windows::Graphics::Capture::IGraphicsCaptureItem>(),
-      reinterpret_cast<void**>(winrt::put_abi(item)));
+      reinterpret_cast<void**>(winrt::put_abi(item))));
  return item;
 }

@@ -218,6 +156,104 @@ HRESULT WgcSessionImpl::CreateMappedTexture(
                                    d3d11_texture_mapped_.put());
 }

+int WgcSessionImpl::StartCaptureLocked(bool show_cursor) {
+  if (!is_initialized_) {
+    LOG_ERROR("AE_NEED_INIT");
+    return 4;
+  }
+  if (!capture_item_) {
+    LOG_ERROR("WGC: capture item is null");
+    return 4;
+  }
+
+  try {
+    if (!capture_session_) {
+      auto current_size = capture_item_.Size();
+      capture_framepool_ =
+          winrt::Windows::Graphics::Capture::Direct3D11CaptureFramePool::
+              CreateFreeThreaded(d3d11_direct_device_,
+                                 winrt::Windows::Graphics::DirectX::
+                                     DirectXPixelFormat::B8G8R8A8UIntNormalized,
+                                 2, current_size);
+      capture_session_ = capture_framepool_.CreateCaptureSession(capture_item_);
+      capture_frame_size_ = current_size;
+      capture_framepool_trigger_ = capture_framepool_.FrameArrived(
+          winrt::auto_revoke, {this, &WgcSessionImpl::OnFrame});
+      capture_close_trigger_ = capture_item_.Closed(
+          winrt::auto_revoke, {this, &WgcSessionImpl::OnClosed});
+    }
+
+    if (!capture_framepool_ || !capture_session_) {
+      throw std::exception();
+    }
+
+    capture_session_.IsCursorCaptureEnabled(show_cursor);
+    capture_session_.StartCapture();
+    is_running_ = true;
+    return 0;
+  } catch (const winrt::hresult_error&) {
+    LOG_ERROR("AE_WGC_CREATE_CAPTURER_FAILED");
+    return 86;
+  } catch (...) {
+    LOG_ERROR("AE_WGC_CREATE_CAPTURER_FAILED");
+    return 86;
+  }
+}
+
+int WgcSessionImpl::StartLocked(bool show_cursor) {
+  if (is_running_) return 0;
+
+  last_show_cursor_ = show_cursor;
+  if (!is_initialized_) {
+    const int init_ret = InitializeLocked();
+    if (init_ret != 0) {
+      return init_ret;
+    }
+  }
+
+  int ret = StartCaptureLocked(show_cursor);
+  if (ret == 0) {
+    return 0;
+  }
+
+  LOG_WARN("WGC: start capture failed, rebuilding capture item");
+  CleanUpLocked();
+  ret = InitializeLocked();
+  if (ret != 0) {
+    return ret;
+  }
+  return StartCaptureLocked(show_cursor);
+}
+
+void WgcSessionImpl::StopLocked() {
+  is_running_ = false;
+
+  // if (loop_.joinable()) loop_.join();
+
+  if (capture_framepool_trigger_) capture_framepool_trigger_.revoke();
+  if (capture_close_trigger_) capture_close_trigger_.revoke();
+
+  if (capture_session_) {
+    try {
+      capture_session_.Close();
+    } catch (...) {
+      LOG_WARN("WGC: capture session close failed");
+    }
+    capture_session_ = nullptr;
+  }
+
+  if (capture_framepool_) {
+    try {
+      capture_framepool_.Close();
+    } catch (...) {
+      LOG_WARN("WGC: frame pool close failed");
+    }
+    capture_framepool_ = nullptr;
+  }
+
+  d3d11_texture_mapped_ = nullptr;
+}
+
 void WgcSessionImpl::OnFrame(
    winrt::Windows::Graphics::Capture::Direct3D11CaptureFramePool const& sender,
    [[maybe_unused]] winrt::Windows::Foundation::IInspectable const& args) {
@@ -225,7 +261,7 @@ void WgcSessionImpl::OnFrame(

  auto is_new_size = false;

-  {
+  try {
    auto frame = sender.TryGetNextFrame();
    auto frame_size = frame.ContentSize();

@@ -239,60 +275,63 @@ void WgcSessionImpl::OnFrame(
    }

    // copy to mapped texture
-    {
-      if (is_paused_) {
-        return;
-      }
-
-      auto frame_captured =
-          GetDXGIInterfaceFromObject<ID3D11Texture2D>(frame.Surface());
-
-      if (!d3d11_texture_mapped_ || is_new_size) {
-        HRESULT tex_hr = CreateMappedTexture(frame_captured);
-        if (FAILED(tex_hr)) {
-          OutputDebugStringW(
-              (L"CreateMappedTexture failed: " + std::to_wstring(tex_hr))
-                  .c_str());
-          return;
-        }
-      }
-
-      d3d11_device_context_->CopyResource(d3d11_texture_mapped_.get(),
-                                          frame_captured.get());
-
-      D3D11_MAPPED_SUBRESOURCE map_result;
-      HRESULT hr = d3d11_device_context_->Map(
-          d3d11_texture_mapped_.get(), 0, D3D11_MAP_READ,
-          0 /*coz we use CreateFreeThreaded, so we cant use flags
-               D3D11_MAP_FLAG_DO_NOT_WAIT*/
-          ,
-          &map_result);
-      if (FAILED(hr)) {
-        OutputDebugStringW(
-            (L"map resource failed: " + std::to_wstring(hr)).c_str());
-        return;
-      }
-
-      // copy data from map_result.pData
-      if (map_result.pData && observer_) {
-        observer_->OnFrame(
-            wgc_session_frame{static_cast<unsigned int>(frame_size.Width),
-                              static_cast<unsigned int>(frame_size.Height),
-                              map_result.RowPitch,
-                              const_cast<const unsigned char*>(
-                                  (unsigned char*)map_result.pData)},
-            id_);
-      }
-
-      d3d11_device_context_->Unmap(d3d11_texture_mapped_.get(), 0);
+    if (is_paused_) {
+      return;
    }
-  }

-  if (is_new_size) {
-    capture_framepool_.Recreate(d3d11_direct_device_,
-                                winrt::Windows::Graphics::DirectX::
-                                    DirectXPixelFormat::B8G8R8A8UIntNormalized,
-                                2, capture_frame_size_);
+    auto frame_captured =
+        GetDXGIInterfaceFromObject<ID3D11Texture2D>(frame.Surface());
+
+    if (!d3d11_texture_mapped_ || is_new_size) {
+      HRESULT tex_hr = CreateMappedTexture(frame_captured);
+      if (FAILED(tex_hr)) {
+        OutputDebugStringW(
+            (L"CreateMappedTexture failed: " + std::to_wstring(tex_hr))
+                .c_str());
+        return;
+      }
+    }
+
+    d3d11_device_context_->CopyResource(d3d11_texture_mapped_.get(),
+                                        frame_captured.get());
+
+    D3D11_MAPPED_SUBRESOURCE map_result;
+    HRESULT hr = d3d11_device_context_->Map(
+        d3d11_texture_mapped_.get(), 0, D3D11_MAP_READ,
+        0 /*coz we use CreateFreeThreaded, so we cant use flags
+             D3D11_MAP_FLAG_DO_NOT_WAIT*/
+        ,
+        &map_result);
+    if (FAILED(hr)) {
+      OutputDebugStringW(
+          (L"map resource failed: " + std::to_wstring(hr)).c_str());
+      return;
+    }
+
+    // copy data from map_result.pData
+    if (map_result.pData && observer_) {
+      observer_->OnFrame(
+          wgc_session_frame{static_cast<unsigned int>(frame_size.Width),
+                            static_cast<unsigned int>(frame_size.Height),
+                            map_result.RowPitch,
+                            const_cast<const unsigned char*>(
+                                (unsigned char*)map_result.pData)},
+          id_);
+    }
+
+    d3d11_device_context_->Unmap(d3d11_texture_mapped_.get(), 0);
+
+    if (is_new_size) {
+      capture_framepool_.Recreate(
+          d3d11_direct_device_,
+          winrt::Windows::Graphics::DirectX::
+              DirectXPixelFormat::B8G8R8A8UIntNormalized,
+          2, capture_frame_size_);
+    }
+  } catch (const winrt::hresult_error&) {
+    LOG_WARN("WGC: frame processing failed");
+  } catch (...) {
+    LOG_WARN("WGC: frame processing failed");
  }
 }

@@ -300,11 +339,13 @@ void WgcSessionImpl::OnClosed(
    winrt::Windows::Graphics::Capture::GraphicsCaptureItem const&,
    winrt::Windows::Foundation::IInspectable const&) {
  std::lock_guard locker(lock_);
+  const bool was_running = is_running_;
+  const bool was_paused = is_paused_;
  try {
-    CleanUp();
-    is_initialized_ = false;
-    if (Initialize() == 0) {
-      int ret = Start(last_show_cursor_);
+    CleanUpLocked();
+    is_paused_ = was_paused;
+    if (InitializeLocked() == 0) {
+      int ret = was_running ? StartCaptureLocked(last_show_cursor_) : 0;
      if (ret == 0) {
        OutputDebugStringW(L"WgcSessionImpl::OnClosed: auto recovered");
      } else {
@@ -319,9 +360,14 @@ void WgcSessionImpl::OnClosed(
  }
 }

-int WgcSessionImpl::Initialize() {
+int WgcSessionImpl::InitializeLocked() {
  if (is_initialized_) return 0;

+  d3d11_texture_mapped_ = nullptr;
+  d3d11_device_context_ = nullptr;
+  d3d11_direct_device_ = nullptr;
+  capture_frame_size_ = {};
+
  if (!(d3d11_direct_device_ = CreateD3D11Device())) {
    LOG_ERROR("AE_D3D_CREATE_DEVICE_FAILED");
    return 1;
@@ -332,6 +378,10 @@ int WgcSessionImpl::Initialize() {
      capture_item_ = CreateCaptureItemForWindow(target_.hwnd);
    else
      capture_item_ = CreateCaptureItemForMonitor(target_.hmonitor);
+    if (!capture_item_) {
+      LOG_ERROR("WGC: create capture item returned null");
+      return 86;
+    }

    // Set up
    auto d3d11_device =
@@ -353,21 +403,18 @@ int WgcSessionImpl::Initialize() {
 void WgcSessionImpl::CleanUp() {
  std::lock_guard locker(lock_);

-  auto expected = false;
-  if (cleaned_.compare_exchange_strong(expected, true)) {
-    capture_close_trigger_.revoke();
-    capture_framepool_trigger_.revoke();
+  CleanUpLocked();
+}

-    if (capture_framepool_) capture_framepool_.Close();
+void WgcSessionImpl::CleanUpLocked() {
+  StopLocked();

-    if (capture_session_) capture_session_.Close();
-
-    capture_framepool_ = nullptr;
-    capture_session_ = nullptr;
-    capture_item_ = nullptr;
-
-    is_initialized_ = false;
-  }
+  capture_item_ = nullptr;
+  d3d11_device_context_ = nullptr;
+  d3d11_direct_device_ = nullptr;
+  capture_frame_size_ = {};
+  is_initialized_ = false;
+  is_paused_ = false;
 }

 LRESULT CALLBACK WindowProc(HWND window, UINT message, WPARAM w_param,
@@ -68,8 +68,12 @@ class WgcSessionImpl : public WgcSession {
  void OnClosed(winrt::Windows::Graphics::Capture::GraphicsCaptureItem const&,
                winrt::Windows::Foundation::IInspectable const&);

-  int Initialize();
+  int InitializeLocked();
+  int StartLocked(bool show_cursor);
+  int StartCaptureLocked(bool show_cursor);
+  void StopLocked();
  void CleanUp();
+  void CleanUpLocked();

  // void message_func();

@@ -94,7 +98,6 @@ class WgcSessionImpl : public WgcSession {
  winrt::com_ptr<ID3D11DeviceContext> d3d11_device_context_{nullptr};
  winrt::com_ptr<ID3D11Texture2D> d3d11_texture_mapped_{nullptr};

-  std::atomic<bool> cleaned_ = false;
  winrt::Windows::Graphics::Capture::Direct3D11CaptureFramePool
      capture_framepool_{nullptr};
  winrt::Windows::Graphics::Capture::Direct3D11CaptureFramePool::
@@ -0,0 +1,42 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-04-21
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _INTERACTIVE_STATE_H_
+#define _INTERACTIVE_STATE_H_
+
+#include <string>
+
+namespace crossdesk {
+
+inline bool IsSecureDesktopInteractionRequired(
+    const std::string& interactive_stage) {
+  return interactive_stage == "lock-screen" ||
+         interactive_stage == "credential-ui" ||
+         interactive_stage == "secure-desktop";
+}
+
+inline bool ShouldNormalizeUnlockToUserDesktop(
+    bool interactive_lock_screen_visible, const std::string& interactive_stage,
+    bool session_locked, bool interactive_logon_ui_visible,
+    bool interactive_secure_desktop_active, bool credential_ui_visible,
+    bool password_box_visible, bool unlock_ui_visible,
+    const std::string& last_session_event) {
+  if (!interactive_lock_screen_visible && interactive_stage != "lock-screen") {
+    return false;
+  }
+
+  if (session_locked || interactive_logon_ui_visible ||
+      interactive_secure_desktop_active || credential_ui_visible ||
+      password_box_visible || unlock_ui_visible) {
+    return false;
+  }
+
+  return last_session_event != "session-lock";
+}
+
+}  // namespace crossdesk
+
+#endif
@@ -0,0 +1,87 @@
+#include <Windows.h>
+
+#include <iostream>
+#include <string>
+
+#include "service_host.h"
+
+namespace {
+
+std::wstring GetExecutablePath() {
+  wchar_t path[MAX_PATH] = {0};
+  DWORD length = GetModuleFileNameW(nullptr, path, MAX_PATH);
+  if (length == 0 || length >= MAX_PATH) {
+    return L"";
+  }
+  return std::wstring(path, length);
+}
+
+void PrintUsage() {
+  std::cout
+      << "CrossDesk Windows service skeleton\n"
+      << "  --service    Run under the Windows Service Control Manager\n"
+      << "  --console    Run the service loop in console mode\n"
+      << "  --install    Install the service for the current executable\n"
+      << "  --uninstall  Remove the installed service\n"
+      << "  --start      Start the installed service\n"
+      << "  --stop       Stop the installed service\n"
+      << "  --sas        Ask the service to send Secure Attention Sequence\n"
+      << "  --ping       Ping the running service over named pipe IPC\n"
+      << "  --status     Query runtime status over named pipe IPC\n";
+}
+
+}  // namespace
+
+int main(int argc, char* argv[]) {
+  crossdesk::CrossDeskServiceHost host;
+
+  if (argc <= 1) {
+    PrintUsage();
+    return 0;
+  }
+
+  std::string command = argv[1];
+  if (command == "--service") {
+    return host.RunAsService();
+  }
+  if (command == "--console") {
+    return host.RunInConsole();
+  }
+  if (command == "--install") {
+    std::wstring executable_path = GetExecutablePath();
+    bool success = !executable_path.empty() &&
+                   crossdesk::InstallCrossDeskService(executable_path);
+    std::cout << (success ? "install ok" : "install failed") << std::endl;
+    return success ? 0 : 1;
+  }
+  if (command == "--uninstall") {
+    bool success = crossdesk::UninstallCrossDeskService();
+    std::cout << (success ? "uninstall ok" : "uninstall failed") << std::endl;
+    return success ? 0 : 1;
+  }
+  if (command == "--start") {
+    bool success = crossdesk::StartCrossDeskService();
+    std::cout << (success ? "start ok" : "start failed") << std::endl;
+    return success ? 0 : 1;
+  }
+  if (command == "--stop") {
+    bool success = crossdesk::StopCrossDeskService();
+    std::cout << (success ? "stop ok" : "stop failed") << std::endl;
+    return success ? 0 : 1;
+  }
+  if (command == "--sas") {
+    std::cout << crossdesk::QueryCrossDeskService("sas") << std::endl;
+    return 0;
+  }
+  if (command == "--ping") {
+    std::cout << crossdesk::QueryCrossDeskService("ping") << std::endl;
+    return 0;
+  }
+  if (command == "--status") {
+    std::cout << crossdesk::QueryCrossDeskService("status") << std::endl;
+    return 0;
+  }
+
+  PrintUsage();
+  return 1;
+}
@@ -0,0 +1,161 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-04-21
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _SERVICE_HOST_H_
+#define _SERVICE_HOST_H_
+
+#include <Windows.h>
+
+#include <cstdint>
+#include <mutex>
+#include <string>
+#include <thread>
+
+namespace crossdesk {
+
+inline constexpr wchar_t kCrossDeskServiceName[] = L"CrossDeskService";
+inline constexpr wchar_t kCrossDeskServiceDisplayName[] = L"CrossDesk Service";
+inline constexpr wchar_t kCrossDeskServicePipeName[] =
+    L"\\\\.\\pipe\\CrossDeskService";
+
+class CrossDeskServiceHost {
+ public:
+  CrossDeskServiceHost();
+  ~CrossDeskServiceHost();
+
+  int RunAsService();
+  int RunInConsole();
+
+ private:
+  int RunServiceLoop(bool as_service);
+  int InitializeRuntime();
+  void ShutdownRuntime();
+  void RequestStop();
+  void ClientProcessMonitorLoop();
+  void ReportServiceStatus(DWORD current_state, DWORD win32_exit_code,
+                           DWORD wait_hint);
+  void IpcServerLoop();
+  void RefreshSessionState();
+  void EnsureSessionHelper();
+  void ReapSessionHelper();
+  void StopSessionHelper();
+  bool LaunchSessionHelper(DWORD session_id);
+  void ReapSecureInputHelper();
+  void StopSecureInputHelper();
+  bool LaunchSecureInputHelper(DWORD session_id,
+                               const std::string& interactive_stage);
+  std::wstring GetSessionHelperPath() const;
+  std::wstring GetSessionHelperStopEventName(DWORD session_id) const;
+  std::wstring GetSecureInputHelperPath() const;
+  std::wstring GetSecureInputHelperStopEventName(DWORD session_id) const;
+  void ResetSessionHelperReportedStateLocked(const char* error,
+                                             DWORD error_code);
+  bool GetEffectiveSessionLockedLocked() const;
+  bool IsHelperReportingLockScreenLocked() const;
+  bool HasSecureInputUiLocked() const;
+  void UpdateSasSecureDesktopGraceLocked(const std::string& observed_stage);
+  bool IsSasSecureDesktopGraceActiveLocked() const;
+  bool ShouldKeepSecureInputHelperLocked(DWORD target_session_id) const;
+  std::string ResolveInteractiveStageLocked() const;
+  void RefreshSessionHelperReportedState();
+  void RecordSessionEvent(DWORD event_type, DWORD session_id);
+  std::string HandleIpcCommand(const std::string& command);
+  std::string BuildStatusResponse();
+  std::string SendSecureAttentionSequence();
+  std::string SendSecureDesktopKeyboardInput(int key_code, bool is_down,
+                                             uint32_t scan_code = 0,
+                                             bool extended = false);
+  std::string SendSecureDesktopMouseInput(int x, int y, int wheel, int flag);
+
+  static void WINAPI ServiceMain(DWORD argc, LPWSTR* argv);
+  static BOOL WINAPI ConsoleControlHandler(DWORD control_type);
+  static DWORD WINAPI ServiceControlHandler(DWORD control, DWORD event_type,
+                                            LPVOID event_data, LPVOID context);
+
+ private:
+  SERVICE_STATUS_HANDLE status_handle_ = nullptr;
+  SERVICE_STATUS service_status_{};
+  HANDLE stop_event_ = nullptr;
+  std::thread ipc_thread_;
+  std::thread client_process_monitor_thread_;
+  std::mutex state_mutex_;
+  DWORD active_session_id_ = 0xFFFFFFFF;
+  DWORD process_session_id_ = 0xFFFFFFFF;
+  DWORD input_desktop_error_code_ = 0;
+  DWORD session_helper_process_id_ = 0;
+  DWORD session_helper_session_id_ = 0xFFFFFFFF;
+  DWORD session_helper_exit_code_ = 0;
+  DWORD session_helper_last_error_code_ = 0;
+  DWORD session_helper_status_error_code_ = 0;
+  DWORD session_helper_report_session_id_ = 0xFFFFFFFF;
+  DWORD session_helper_report_process_id_ = 0;
+  DWORD session_helper_report_input_desktop_error_code_ = 0;
+  DWORD secure_input_helper_process_id_ = 0;
+  DWORD secure_input_helper_session_id_ = 0xFFFFFFFF;
+  DWORD secure_input_helper_exit_code_ = 0;
+  DWORD secure_input_helper_last_error_code_ = 0;
+  DWORD last_session_event_type_ = 0;
+  DWORD last_session_event_session_id_ = 0xFFFFFFFF;
+  ULONGLONG started_at_tick_ = 0;
+  ULONGLONG last_sas_tick_ = 0;
+  ULONGLONG session_helper_started_at_tick_ = 0;
+  ULONGLONG session_helper_report_state_age_ms_ = 0;
+  ULONGLONG session_helper_report_uptime_ms_ = 0;
+  ULONGLONG secure_input_helper_started_at_tick_ = 0;
+  ULONGLONG sas_secure_desktop_until_tick_ = 0;
+  bool session_locked_ = false;
+  bool logon_ui_visible_ = false;
+  bool prelogin_ = false;
+  bool secure_desktop_active_ = false;
+  bool input_desktop_available_ = false;
+  bool session_helper_running_ = false;
+  bool session_helper_status_ok_ = false;
+  bool session_helper_report_session_locked_ = false;
+  bool session_helper_report_input_desktop_available_ = false;
+  bool session_helper_report_lock_app_visible_ = false;
+  bool session_helper_report_logon_ui_visible_ = false;
+  bool session_helper_report_secure_desktop_active_ = false;
+  bool session_helper_report_credential_ui_visible_ = false;
+  bool session_helper_report_unlock_ui_visible_ = false;
+  bool secure_input_helper_running_ = false;
+  bool console_mode_ = false;
+  bool sas_secure_desktop_seen_ = false;
+  DWORD last_sas_error_code_ = 0;
+  bool last_sas_success_ = false;
+  HANDLE session_helper_process_handle_ = nullptr;
+  HANDLE session_helper_stop_event_ = nullptr;
+  HANDLE secure_input_helper_process_handle_ = nullptr;
+  HANDLE secure_input_helper_stop_event_ = nullptr;
+  std::string input_desktop_name_;
+  std::string last_sas_error_;
+  std::string session_helper_last_error_;
+  std::string session_helper_status_error_;
+  std::string session_helper_report_input_desktop_;
+  std::string session_helper_report_interactive_stage_;
+  std::string secure_input_helper_last_error_;
+  std::string secure_input_helper_interactive_stage_;
+
+  static CrossDeskServiceHost* instance_;
+};
+
+bool IsCrossDeskServiceInstalled();
+bool InstallCrossDeskService(const std::wstring& binary_path);
+bool UninstallCrossDeskService();
+bool StartCrossDeskService();
+bool StopCrossDeskService(DWORD timeout_ms = 5000);
+std::string QueryCrossDeskService(const std::string& command,
+                                  DWORD timeout_ms = 1000);
+std::string SendCrossDeskSecureDesktopKeyInput(int key_code, bool is_down,
+                                               uint32_t scan_code = 0,
+                                               bool extended = false,
+                                               DWORD timeout_ms = 1000);
+std::string SendCrossDeskSecureDesktopMouseInput(int x, int y, int wheel,
+                                                 int flag,
+                                                 DWORD timeout_ms = 1000);
+
+}  // namespace crossdesk
+
+#endif
@@ -0,0 +1,87 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-04-21
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _SESSION_HELPER_SHARED_H_
+#define _SESSION_HELPER_SHARED_H_
+
+#include <Windows.h>
+
+#include <cstdint>
+#include <string>
+
+namespace crossdesk {
+
+inline constexpr wchar_t kCrossDeskSessionHelperPipePrefix[] =
+    L"\\\\.\\pipe\\CrossDeskSessionHelper-";
+inline constexpr wchar_t kCrossDeskSecureInputHelperPipePrefix[] =
+    L"\\\\.\\pipe\\CrossDeskSecureInputHelper-";
+inline constexpr char kCrossDeskSessionHelperStatusCommand[] = "status";
+inline constexpr char kCrossDeskSecureInputKeyboardCommandPrefix[] =
+    "keyboard:";
+inline constexpr char kCrossDeskSecureInputMouseCommandPrefix[] = "mouse:";
+inline constexpr char kCrossDeskSecureInputCaptureCommandPrefix[] = "capture:";
+inline constexpr char kCrossDeskSecureInputCaptureStartCommandPrefix[] =
+    "capture-start:";
+inline constexpr char kCrossDeskSecureInputCaptureStopCommand[] =
+    "capture-stop";
+inline constexpr DWORD kCrossDeskSecureInputPipeBufferBytes = 16 * 1024 * 1024;
+inline constexpr wchar_t kCrossDeskSecureDesktopFrameMappingPrefix[] =
+    L"Global\\CrossDeskSecureDesktopFrame-";
+inline constexpr wchar_t kCrossDeskSecureDesktopFrameReadyEventPrefix[] =
+    L"Global\\CrossDeskSecureDesktopFrameReady-";
+inline constexpr uint32_t kCrossDeskSecureDesktopFrameMagic = 0x50444358;
+inline constexpr uint32_t kCrossDeskSecureDesktopFrameVersion = 1;
+
+#pragma pack(push, 1)
+struct CrossDeskSecureDesktopFrameHeader {
+  uint32_t magic;
+  uint32_t version;
+  int32_t left;
+  int32_t top;
+  uint32_t width;
+  uint32_t height;
+  uint32_t payload_size;
+};
+
+struct CrossDeskSecureDesktopSharedFrameHeader {
+  uint32_t magic;
+  uint32_t version;
+  volatile uint32_t writing;
+  uint32_t sequence;
+  int32_t left;
+  int32_t top;
+  uint32_t width;
+  uint32_t height;
+  uint32_t payload_size;
+  uint32_t buffer_size;
+};
+#pragma pack(pop)
+
+inline std::wstring GetCrossDeskSessionHelperPipeName(DWORD session_id) {
+  return std::wstring(kCrossDeskSessionHelperPipePrefix) +
+         std::to_wstring(session_id);
+}
+
+inline std::wstring GetCrossDeskSecureInputHelperPipeName(DWORD session_id) {
+  return std::wstring(kCrossDeskSecureInputHelperPipePrefix) +
+         std::to_wstring(session_id);
+}
+
+inline std::wstring GetCrossDeskSecureDesktopFrameMappingName(
+    DWORD session_id) {
+  return std::wstring(kCrossDeskSecureDesktopFrameMappingPrefix) +
+         std::to_wstring(session_id);
+}
+
+inline std::wstring GetCrossDeskSecureDesktopFrameReadyEventName(
+    DWORD session_id) {
+  return std::wstring(kCrossDeskSecureDesktopFrameReadyEventPrefix) +
+         std::to_wstring(session_id);
+}
+
+}  // namespace crossdesk
+
+#endif
@@ -0,0 +1,183 @@
+#include <filesystem>
+#include <fstream>
+#include <iostream>
+#include <sstream>
+#include <string>
+
+namespace {
+
+std::filesystem::path FindRepoRoot() {
+  std::filesystem::path current = std::filesystem::current_path();
+  while (!current.empty()) {
+    if (std::filesystem::exists(current / "xmake.lua") &&
+        std::filesystem::exists(current / "src/gui/toolbars/control_bar.cpp")) {
+      return current;
+    }
+    current = current.parent_path();
+  }
+  return {};
+}
+
+std::string ReadFile(const std::filesystem::path& path) {
+  std::ifstream file(path, std::ios::binary);
+  if (!file) {
+    return {};
+  }
+
+  std::ostringstream stream;
+  stream << file.rdbuf();
+  return stream.str();
+}
+
+bool ExpectContains(const char* name, const std::string& value,
+                    const std::string& expected) {
+  if (value.find(expected) != std::string::npos) {
+    return true;
+  }
+
+  std::cerr << name << " missing expected text: " << expected << "\n";
+  return false;
+}
+
+bool ExpectNotContains(const char* name, const std::string& value,
+                       const std::string& unexpected) {
+  if (value.find(unexpected) == std::string::npos) {
+    return true;
+  }
+
+  std::cerr << name << " contains unexpected text: " << unexpected << "\n";
+  return false;
+}
+
+bool ExpectContainsAtLeast(const char* name, const std::string& value,
+                           const std::string& expected, size_t min_count) {
+  size_t count = 0;
+  size_t pos = 0;
+  while ((pos = value.find(expected, pos)) != std::string::npos) {
+    ++count;
+    pos += expected.size();
+  }
+
+  if (count >= min_count) {
+    return true;
+  }
+
+  std::cerr << name << " expected at least " << min_count
+            << " occurrences of: " << expected << ", found " << count
+            << "\n";
+  return false;
+}
+
+bool ExpectResetBeforeDisplayPopup(const std::string& value) {
+  const std::string reset = "props->display_selectable_hovered_ = false;";
+  const std::string popup = "ImGui::BeginPopup(\"display\")";
+  const size_t reset_pos = value.find(reset);
+  const size_t popup_pos = value.find(popup);
+
+  if (reset_pos != std::string::npos && popup_pos != std::string::npos &&
+      reset_pos < popup_pos) {
+    return true;
+  }
+
+  std::cerr << "control_bar.cpp must clear display_selectable_hovered_ before "
+               "checking the display popup\n";
+  return false;
+}
+
+bool ExpectResetBeforeShortcutPopup(const std::string& value) {
+  const std::string reset = "props->shortcut_selectable_hovered_ = false;";
+  const std::string popup = "ImGui::BeginPopup(\"shortcut\")";
+  const size_t reset_pos = value.find(reset);
+  const size_t popup_pos = value.find(popup);
+
+  if (reset_pos != std::string::npos && popup_pos != std::string::npos &&
+      reset_pos < popup_pos) {
+    return true;
+  }
+
+  std::cerr << "control_bar.cpp must clear shortcut_selectable_hovered_ before "
+               "checking the shortcut popup\n";
+  return false;
+}
+
+}  // namespace
+
+int main() {
+  const std::filesystem::path repo_root = FindRepoRoot();
+  if (repo_root.empty()) {
+    std::cerr << "failed to locate repository root\n";
+    return 1;
+  }
+
+  const std::string control_bar =
+      ReadFile(repo_root / "src/gui/toolbars/control_bar.cpp");
+
+  bool ok = true;
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "props->display_selectable_hovered_ = false;");
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "ImGui::IsWindowHovered("
+                       "ImGuiHoveredFlags_RootAndChildWindows)");
+  ok &= ExpectResetBeforeDisplayPopup(control_bar);
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "props->shortcut_selectable_hovered_ =");
+  ok &= ExpectResetBeforeShortcutPopup(control_bar);
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "void ShowControlBarTooltip(const std::string& text)");
+  ok &= ExpectContainsAtLeast("control_bar.cpp", control_bar,
+                              "ShowControlBarTooltip(", 10);
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "localization::select_display"
+                       "[localization_language_index_]");
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "localization::send_shortcut"
+                       "[localization_language_index_]");
+  ok &= ExpectNotContains("control_bar.cpp", control_bar,
+                          "ShowControlBarTooltip("
+                          "props->mouse_control_button_label_)");
+  ok &= ExpectNotContains("control_bar.cpp", control_bar,
+                          "ShowControlBarTooltip("
+                          "props->audio_capture_button_label_)");
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "localization::select_file"
+                       "[localization_language_index_]");
+  ok &= ExpectNotContains("control_bar.cpp", control_bar,
+                          "ShowControlBarTooltip("
+                          "props->net_traffic_stats_button_label_)");
+  ok &= ExpectNotContains("control_bar.cpp", control_bar,
+                          "ShowControlBarTooltip("
+                          "props->fullscreen_button_label_)");
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "localization::release_mouse"
+                       "[localization_language_index_]");
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "localization::control_mouse"
+                       "[localization_language_index_]");
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "localization::audio_capture"
+                       "[localization_language_index_]");
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "localization::mute[localization_language_index_]");
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "localization::hide_net_traffic_stats"
+                       "[localization_language_index_]");
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "localization::show_net_traffic_stats"
+                       "[localization_language_index_]");
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "localization::exit_fullscreen"
+                       "[localization_language_index_]");
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "localization::fullscreen"
+                       "[localization_language_index_]");
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "localization::disconnect"
+                       "[localization_language_index_]");
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "localization::expand_control_bar"
+                       "[localization_language_index_]");
+  ok &= ExpectContains("control_bar.cpp", control_bar,
+                       "localization::collapse_control_bar"
+                       "[localization_language_index_]");
+  return ok ? 0 : 1;
+}
@@ -0,0 +1,60 @@
+#include "macos_keyboard_modifier_state.h"
+
+#include <cstdint>
+#include <iostream>
+
+namespace {
+
+bool ExpectEqual(const char* name, uint32_t actual, uint32_t expected) {
+  if (actual == expected) {
+    return true;
+  }
+
+  std::cerr << name << " mismatch\n"
+            << "  expected: " << expected << "\n"
+            << "  actual:   " << actual << "\n";
+  return false;
+}
+
+}  // namespace
+
+int main() {
+  crossdesk::MacKeyboardModifierState state;
+
+  bool ok = true;
+  ok &= ExpectEqual("initial flags", state.flags(), 0);
+  ok &= ExpectEqual("left shift down", state.Update(0xA0, true),
+                    crossdesk::kMacInjectedModifierShift);
+  ok &= ExpectEqual("shifted semicolon keeps shift",
+                    state.Update(0xBA, true),
+                    crossdesk::kMacInjectedModifierShift);
+  ok &= ExpectEqual("semicolon up keeps shift", state.Update(0xBA, false),
+                    crossdesk::kMacInjectedModifierShift);
+  ok &= ExpectEqual("right shift down while left held",
+                    state.Update(0xA1, true),
+                    crossdesk::kMacInjectedModifierShift);
+  ok &= ExpectEqual("left shift up while right held", state.Update(0xA0, false),
+                    crossdesk::kMacInjectedModifierShift);
+  ok &= ExpectEqual("right shift up clears shift", state.Update(0xA1, false),
+                    0);
+
+  ok &= ExpectEqual("left control down", state.Update(0xA2, true),
+                    crossdesk::kMacInjectedModifierControl);
+  ok &= ExpectEqual("right alt adds option", state.Update(0xA5, true),
+                    crossdesk::kMacInjectedModifierControl |
+                        crossdesk::kMacInjectedModifierOption);
+  ok &= ExpectEqual("left command adds command", state.Update(0x5B, true),
+                    crossdesk::kMacInjectedModifierControl |
+                        crossdesk::kMacInjectedModifierOption |
+                        crossdesk::kMacInjectedModifierCommand);
+  ok &= ExpectEqual("left control up leaves option command",
+                    state.Update(0xA2, false),
+                    crossdesk::kMacInjectedModifierOption |
+                        crossdesk::kMacInjectedModifierCommand);
+  ok &= ExpectEqual("right alt up leaves command", state.Update(0xA5, false),
+                    crossdesk::kMacInjectedModifierCommand);
+  ok &= ExpectEqual("left command up clears all", state.Update(0x5B, false),
+                    0);
+
+  return ok ? 0 : 1;
+}
@@ -0,0 +1,78 @@
+#include "path_manager.h"
+
+#include <cstdint>
+#include <filesystem>
+#include <iostream>
+#include <string>
+
+#ifdef _WIN32
+#include <windows.h>
+#elif defined(__APPLE__)
+#include <mach-o/dyld.h>
+#include <limits.h>
+#else
+#include <limits.h>
+#include <unistd.h>
+#endif
+
+namespace {
+
+std::filesystem::path GetExecutableDirectory() {
+#ifdef _WIN32
+  wchar_t buffer[MAX_PATH] = {};
+  DWORD length = GetModuleFileNameW(nullptr, buffer, MAX_PATH);
+  if (length == 0 || length == MAX_PATH) {
+    return {};
+  }
+  return std::filesystem::path(buffer).parent_path();
+#elif defined(__APPLE__)
+  char buffer[PATH_MAX] = {};
+  uint32_t size = sizeof(buffer);
+  if (_NSGetExecutablePath(buffer, &size) != 0) {
+    return {};
+  }
+  return std::filesystem::weakly_canonical(buffer).parent_path();
+#else
+  char buffer[PATH_MAX] = {};
+  ssize_t length = readlink("/proc/self/exe", buffer, sizeof(buffer) - 1);
+  if (length <= 0) {
+    return {};
+  }
+  buffer[length] = '\0';
+  return std::filesystem::path(buffer).parent_path();
+#endif
+}
+
+bool ExpectEqual(const char* name,
+                 const std::filesystem::path& actual,
+                 const std::filesystem::path& expected) {
+  if (actual.lexically_normal() == expected.lexically_normal()) {
+    return true;
+  }
+
+  std::cerr << name << " mismatch\n"
+            << "  expected: " << expected.string() << "\n"
+            << "  actual:   " << actual.string() << "\n";
+  return false;
+}
+
+}  // namespace
+
+int main() {
+  const std::filesystem::path exe_dir = GetExecutableDirectory();
+  if (exe_dir.empty()) {
+    std::cerr << "failed to resolve executable directory\n";
+    return 1;
+  }
+
+  crossdesk::PathManager path_manager("CrossDesk");
+  const std::filesystem::path expected_data = exe_dir / "data";
+  const std::filesystem::path expected_logs = exe_dir / "logs";
+
+  bool ok = true;
+  ok &= ExpectEqual("config path", path_manager.GetConfigPath(), expected_data);
+  ok &= ExpectEqual("cache path", path_manager.GetCachePath(), expected_data);
+  ok &= ExpectEqual("log path", path_manager.GetLogPath(), expected_logs);
+
+  return ok ? 0 : 1;
+}
@@ -0,0 +1,117 @@
+#include <filesystem>
+#include <fstream>
+#include <iostream>
+#include <sstream>
+#include <string>
+
+#ifdef _WIN32
+#include <windows.h>
+#endif
+
+namespace {
+
+std::string ReadFile(const std::filesystem::path& path) {
+  std::ifstream file(path, std::ios::binary);
+  if (!file) {
+    return {};
+  }
+
+  std::ostringstream stream;
+  stream << file.rdbuf();
+  return stream.str();
+}
+
+std::filesystem::path FindRepoRoot() {
+  std::filesystem::path current = std::filesystem::current_path();
+  while (!current.empty()) {
+    if (std::filesystem::exists(current / "xmake.lua") &&
+        std::filesystem::exists(current / "scripts/windows/crossdesk.rc")) {
+      return current;
+    }
+    current = current.parent_path();
+  }
+  return {};
+}
+
+bool ExpectContains(const char* name, const std::string& value,
+                    const std::string& expected) {
+  if (value.find(expected) != std::string::npos) {
+    return true;
+  }
+
+  std::cerr << name << " missing expected text: " << expected << "\n";
+  return false;
+}
+
+bool ExpectNotContains(const char* name, const std::string& value,
+                       const std::string& unexpected) {
+  if (value.find(unexpected) == std::string::npos) {
+    return true;
+  }
+
+  std::cerr << name << " contains unexpected text: " << unexpected << "\n";
+  return false;
+}
+
+#ifdef _WIN32
+bool ExpectActivationContext(const std::filesystem::path& manifest_path) {
+  ACTCTXW context = {};
+  context.cbSize = sizeof(context);
+  std::wstring source = manifest_path.wstring();
+  context.lpSource = source.c_str();
+
+  HANDLE activation_context = CreateActCtxW(&context);
+  if (activation_context == INVALID_HANDLE_VALUE) {
+    std::cerr << "CreateActCtxW failed for " << manifest_path.string()
+              << ", error=" << GetLastError() << "\n";
+    return false;
+  }
+
+  ReleaseActCtx(activation_context);
+  return true;
+}
+#endif
+
+}  // namespace
+
+int main() {
+  const std::filesystem::path repo_root = FindRepoRoot();
+  if (repo_root.empty()) {
+    std::cerr << "failed to locate repository root\n";
+    return 1;
+  }
+
+  const std::string rc = ReadFile(repo_root / "scripts/windows/crossdesk.rc");
+  const std::string manifest =
+      ReadFile(repo_root / "scripts/windows/crossdesk.manifest");
+  const std::string debug_manifest =
+      ReadFile(repo_root / "scripts/windows/crossdesk_debug.manifest");
+
+  bool ok = true;
+  ok &= ExpectContains("crossdesk.rc", rc, "crossdesk.manifest");
+  ok &= ExpectContains("crossdesk.rc", rc, "crossdesk_debug.manifest");
+  ok &= ExpectContains("crossdesk.rc", rc, "CROSSDESK_DEBUG");
+  ok &= ExpectContains("crossdesk.rc", rc, "RT_MANIFEST");
+  ok &= ExpectContains("crossdesk.manifest", manifest,
+                       "level=\"requireAdministrator\"");
+  ok &= ExpectContains("crossdesk.manifest", manifest,
+                       "http://schemas.microsoft.com/SMI/2005/WindowsSettings");
+  ok &= ExpectContains("crossdesk.manifest", manifest,
+                       "http://schemas.microsoft.com/SMI/2016/WindowsSettings");
+  ok &= ExpectNotContains("crossdesk.manifest", manifest,
+                          "processorArchitecture=\"*\"");
+  ok &= ExpectContains("crossdesk_debug.manifest", debug_manifest,
+                       "level=\"asInvoker\"");
+  ok &= ExpectContains("crossdesk_debug.manifest", debug_manifest,
+                       "http://schemas.microsoft.com/SMI/2005/WindowsSettings");
+  ok &= ExpectContains("crossdesk_debug.manifest", debug_manifest,
+                       "http://schemas.microsoft.com/SMI/2016/WindowsSettings");
+  ok &= ExpectNotContains("crossdesk_debug.manifest", debug_manifest,
+                          "processorArchitecture=\"*\"");
+#ifdef _WIN32
+  ok &= ExpectActivationContext(repo_root / "scripts/windows/crossdesk.manifest");
+  ok &= ExpectActivationContext(
+      repo_root / "scripts/windows/crossdesk_debug.manifest");
+#endif
+  return ok ? 0 : 1;
+}
@@ -0,0 +1,63 @@
+#include <filesystem>
+#include <fstream>
+#include <iostream>
+#include <sstream>
+#include <string>
+
+namespace {
+
+std::filesystem::path FindRepoRoot() {
+  std::filesystem::path current = std::filesystem::current_path();
+  while (!current.empty()) {
+    if (std::filesystem::exists(current / "xmake.lua") &&
+        std::filesystem::exists(
+            current / "src/device_controller/mouse/windows/mouse_controller.cpp")) {
+      return current;
+    }
+    current = current.parent_path();
+  }
+  return {};
+}
+
+std::string ReadFile(const std::filesystem::path& path) {
+  std::ifstream file(path, std::ios::binary);
+  if (!file) {
+    return {};
+  }
+
+  std::ostringstream stream;
+  stream << file.rdbuf();
+  return stream.str();
+}
+
+bool ExpectContains(const char* name, const std::string& value,
+                    const std::string& expected) {
+  if (value.find(expected) != std::string::npos) {
+    return true;
+  }
+
+  std::cerr << name << " missing expected text: " << expected << "\n";
+  return false;
+}
+
+}  // namespace
+
+int main() {
+  const std::filesystem::path repo_root = FindRepoRoot();
+  if (repo_root.empty()) {
+    std::cerr << "failed to locate repository root\n";
+    return 1;
+  }
+
+  const std::string mouse_controller = ReadFile(
+      repo_root / "src/device_controller/mouse/windows/mouse_controller.cpp");
+
+  bool ok = true;
+  ok &= ExpectContains("mouse_controller.cpp", mouse_controller,
+                       "INPUT ip = {0};");
+  ok &= ExpectContains("mouse_controller.cpp", mouse_controller,
+                       "SetCursorPos failed");
+  ok &= ExpectContains("mouse_controller.cpp", mouse_controller,
+                       "SendInput failed for mouse");
+  return ok ? 0 : 1;
+}
@@ -0,0 +1,149 @@
+#include <filesystem>
+#include <fstream>
+#include <iostream>
+#include <sstream>
+#include <string>
+
+#include "interactive_state.h"
+
+namespace {
+
+std::filesystem::path FindRepoRoot() {
+  std::filesystem::path current = std::filesystem::current_path();
+  while (!current.empty()) {
+    if (std::filesystem::exists(current / "xmake.lua") &&
+        std::filesystem::exists(
+            current / "src/service/windows/service_host.cpp")) {
+      return current;
+    }
+    current = current.parent_path();
+  }
+  return {};
+}
+
+std::string ReadFile(const std::filesystem::path& path) {
+  std::ifstream file(path, std::ios::binary);
+  if (!file) {
+    return {};
+  }
+
+  std::ostringstream stream;
+  stream << file.rdbuf();
+  return stream.str();
+}
+
+bool ExpectContains(const char* name, const std::string& value,
+                    const std::string& expected) {
+  if (value.find(expected) != std::string::npos) {
+    return true;
+  }
+
+  std::cerr << name << " missing expected text: " << expected << "\n";
+  return false;
+}
+
+bool ExpectNotContains(const char* name, const std::string& value,
+                       const std::string& unexpected) {
+  if (value.find(unexpected) == std::string::npos) {
+    return true;
+  }
+
+  std::cerr << name << " contains unexpected text: " << unexpected << "\n";
+  return false;
+}
+
+bool ExpectTrue(const char* name, bool value) {
+  if (value) {
+    return true;
+  }
+
+  std::cerr << name << " expected true\n";
+  return false;
+}
+
+}  // namespace
+
+int main() {
+  const std::filesystem::path repo_root = FindRepoRoot();
+  if (repo_root.empty()) {
+    std::cerr << "failed to locate repository root\n";
+    return 1;
+  }
+
+  const std::string control_bar =
+      ReadFile(repo_root / "src/gui/toolbars/control_bar.cpp");
+  const std::string render = ReadFile(repo_root / "src/gui/render.cpp");
+  const std::string render_h = ReadFile(repo_root / "src/gui/render.h");
+  const std::string service_host =
+      ReadFile(repo_root / "src/service/windows/service_host.cpp");
+  const std::string service_host_h =
+      ReadFile(repo_root / "src/service/windows/service_host.h");
+  const std::string session_helper =
+      ReadFile(repo_root / "src/service/windows/session_helper_main.cpp");
+
+  bool ok = true;
+  ok &= ExpectTrue("secure desktop input routing",
+                   crossdesk::IsSecureDesktopInteractionRequired(
+                       "secure-desktop"));
+  ok &= ExpectNotContains("control_bar.cpp", control_bar,
+                          "CanSendSecureAttentionSequence("
+                          "props->remote_interactive_stage_)");
+  ok &= ExpectNotContains("control_bar.cpp", control_bar,
+                          "ImGui::BeginDisabled();\n"
+                          "      }\n"
+                          "      if (ImGui::Selectable(sas_label.c_str()))");
+  ok &= ExpectNotContains("render.cpp", render, "sas_requires_lock_screen");
+  ok &= ExpectContains("render.h", render_h,
+                       "optimistic_windows_secure_desktop_until_tick_");
+  ok &= ExpectContains("render.cpp", render,
+                       "kWindowsServiceSasSecureDesktopGraceMs");
+  ok &= ExpectContains("render.cpp", render,
+                       "status->sas_secure_desktop_grace_active");
+  ok &= ExpectContains("render.cpp", render,
+                       "json.value(\"sas_secure_desktop_grace_active\", false)");
+  ok &= ExpectContains("render.cpp", render,
+                       "status.sas_secure_desktop_grace_active");
+  ok &= ExpectContains("render.cpp", render,
+                       "local_interactive_stage_ = \"secure-desktop\"");
+  ok &= ExpectContains("service_host.h", service_host_h,
+                       "sas_secure_desktop_until_tick_");
+  ok &= ExpectContains("service_host.h", service_host_h,
+                       "sas_secure_desktop_seen_");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "kSasSecureDesktopGraceMs");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "IsSasSecureDesktopGraceActiveLocked()");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "UpdateSasSecureDesktopGraceLocked("
+                       "session_helper_report_interactive_stage_)");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "sas_secure_desktop_seen_ = true");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "sas_secure_desktop_until_tick_ = 0");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "sas_secure_desktop_until_tick_ =");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "now + kSasSecureDesktopGraceMs");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "\\\"sas_secure_desktop_grace_active\\\"");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "raw_interactive_stage = ResolveInteractiveStageLocked()");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "kSessionHelperStatePollMs = 1000");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "EVENT_SYSTEM_DESKTOPSWITCH");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "SetWinEventHook(");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "MsgWaitForMultipleObjects");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "WaitForSessionHelperStateChange(stop_event, "
+                       "desktop_switch_event)");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "inaccessible_secure_input_desktop");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "desktop_info.error_code == ERROR_ACCESS_DENIED");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "secure_desktop_active = input_desktop_is_winlogon ||");
+  return ok ? 0 : 1;
+}
@@ -0,0 +1,225 @@
+#include <filesystem>
+#include <fstream>
+#include <iostream>
+#include <sstream>
+#include <string>
+
+namespace {
+
+std::filesystem::path FindRepoRoot() {
+  std::filesystem::path current = std::filesystem::current_path();
+  while (!current.empty()) {
+    if (std::filesystem::exists(current / "xmake.lua") &&
+        std::filesystem::exists(current / "src/service/windows/service_host.cpp")) {
+      return current;
+    }
+    current = current.parent_path();
+  }
+  return {};
+}
+
+std::string ReadFile(const std::filesystem::path& path) {
+  std::ifstream file(path, std::ios::binary);
+  if (!file) {
+    return {};
+  }
+
+  std::ostringstream stream;
+  stream << file.rdbuf();
+  return stream.str();
+}
+
+bool ExpectContains(const char* name, const std::string& value,
+                    const std::string& expected) {
+  if (value.find(expected) != std::string::npos) {
+    return true;
+  }
+
+  std::cerr << name << " missing expected text: " << expected << "\n";
+  return false;
+}
+
+bool ExpectNotContains(const char* name, const std::string& value,
+                       const std::string& unexpected) {
+  if (value.find(unexpected) == std::string::npos) {
+    return true;
+  }
+
+  std::cerr << name << " contains unexpected text: " << unexpected << "\n";
+  return false;
+}
+
+}  // namespace
+
+int main() {
+  const std::filesystem::path repo_root = FindRepoRoot();
+  if (repo_root.empty()) {
+    std::cerr << "failed to locate repository root\n";
+    return 1;
+  }
+
+  const std::string service_host =
+      ReadFile(repo_root / "src/service/windows/service_host.cpp");
+  const std::string service_host_h =
+      ReadFile(repo_root / "src/service/windows/service_host.h");
+  const std::string session_helper =
+      ReadFile(repo_root / "src/service/windows/session_helper_main.cpp");
+  const std::string targets =
+      ReadFile(repo_root / "xmake/targets.lua");
+  const std::string interactive_state =
+      ReadFile(repo_root / "src/service/windows/interactive_state.h");
+  const std::string render_callback =
+      ReadFile(repo_root / "src/gui/render_callback.cpp");
+  const std::string render = ReadFile(repo_root / "src/gui/render.cpp");
+  const std::string screen_capturer_h =
+      ReadFile(repo_root / "src/screen_capturer/windows/screen_capturer_win.h");
+  const std::string screen_capturer_cpp =
+      ReadFile(repo_root / "src/screen_capturer/windows/screen_capturer_win.cpp");
+
+  bool ok = true;
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "ParseSecureDesktopMouseIpcCommand");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "BuildSecureInputHelperMouseCommand");
+  ok &= ExpectContains("targets.lua", targets,
+                       "target(\"crossdesk_session_helper\")");
+  ok &= ExpectContains("targets.lua", targets,
+                       "add_files(\"scripts/windows/crossdesk.rc\")");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "EnablePerMonitorDpiAwareness");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "SetProcessDpiAwarenessContext(\n"
+                       "      DPI_AWARENESS_CONTEXT_PER_MONITOR_AWARE_V2)");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "EnablePerMonitorDpiAwareness();\n\n"
+                       "  InitializeHelperLogger();");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "const ULONGLONG deadline_tick = GetTickCount64() + timeout_ms");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "while (GetTickCount64() <= deadline_tick)");
+  ok &= ExpectNotContains("service_host.cpp", service_host,
+                          "constexpr int kPipeConnectRetryCount = 3");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "BuildSecureInputHelperKeyboardCommand(");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "const std::string& interactive_stage");
+  ok &= ExpectContains("service_host.h", service_host_h,
+                       "bool LaunchSecureInputHelper(DWORD session_id,\n"
+                       "                               const std::string& interactive_stage)");
+  ok &= ExpectContains("service_host.h", service_host_h,
+                       "std::string secure_input_helper_interactive_stage_");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "SecureInputHelperDesktopForStage");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "return L\"winsta0\\\\Winlogon\"");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "return L\"winsta0\\\\default\"");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "secure_input_helper_interactive_stage_ == interactive_stage");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "secure_input_helper_interactive_stage_ = interactive_stage");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "secure_input_helper_interactive_stage_.clear()");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "LaunchSecureInputHelper(target_session_id, interactive_stage)");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "\\\"secure_input_helper_stage\\\":\\\"");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "session_helper_report_interactive_stage_");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "return SendSecureDesktopMouseInput");
+  ok &= ExpectContains("render.cpp", render,
+                       "constexpr DWORD kWindowsServiceQueryTimeoutMs = 500");
+  ok &= ExpectContains("screen_capturer_win.cpp", screen_capturer_cpp,
+                       "constexpr DWORD kSecureDesktopStatusPipeTimeoutMs = 500");
+  ok &= ExpectContains("render.cpp", render,
+                       "IsTransientWindowsServiceStatusError(status.error)");
+  ok &= ExpectContains("screen_capturer_win.cpp", screen_capturer_cpp,
+                       "IsTransientWindowsServiceStatusError(status.error)");
+  ok &= ExpectContains("render.cpp", render,
+                       "Local Windows service temporarily unavailable");
+  ok &= ExpectContains("screen_capturer_win.cpp", screen_capturer_cpp,
+                       "Windows capturer secure desktop service temporarily unavailable");
+  ok &= ExpectContains("screen_capturer_win.cpp", screen_capturer_cpp,
+                       "Windows capturer secure desktop transient frame query failed");
+  ok &= ExpectContains("screen_capturer_win.cpp", screen_capturer_cpp,
+                       "if (transient_error) {\n"
+                       "          LOG_INFO(");
+  ok &= ExpectContains("render_callback.cpp", render_callback,
+                       "IsTransientSecureDesktopInputFailure");
+  ok &= ExpectContains("render_callback.cpp", render_callback,
+                       "Secure desktop keyboard injection transient failure");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "MOUSEEVENTF_MOVE | MOUSEEVENTF_ABSOLUTE");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "MOUSEEVENTF_VIRTUALDESK");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "std::vector<INPUT> inputs");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "SendInput(static_cast<UINT>(inputs.size())");
+  ok &= ExpectNotContains("session_helper_main.cpp", session_helper,
+                          "SetCursorPos(request.x, request.y)");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "NormalizeAbsoluteMouseCoordinate");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "EnsureThreadInteractiveDesktop");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "OpenInputDesktop");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "DesktopNameForInteractiveStage");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "interactive_stage == \"credential-ui\"");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "return L\"Winlogon\"");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "interactive_stage == \"lock-screen\"");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "return L\"Default\"");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "EnsureThreadInteractiveDesktopForStage");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "switch_interactive_desktop_failed");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "Json BuildInputFailureJson");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "json[\"target_desktop\"]");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "json[\"current_desktop\"]");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "json[\"stage\"]");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "ParseSecureInputKeyboardCommand(command, &key_code, &is_down, &scan_code,\n"
+                       "                                      &extended, &interactive_stage)");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "InjectKeyboardInput(key_code, is_down, scan_code, extended,\n"
+                       "                            interactive_stage)");
+  ok &= ExpectContains("session_helper_main.cpp", session_helper,
+                       "InjectMouseInput(mouse_request)");
+  ok &= ExpectNotContains("session_helper_main.cpp", session_helper,
+                          "EnsureThreadDesktop(L\"Winlogon\", &secure_desktop)");
+  ok &= ExpectContains("service_host.cpp", service_host,
+                       "winsta0\\\\default");
+  ok &= ExpectNotContains("service_host.cpp", service_host,
+                          "startup_info.lpDesktop = const_cast<LPWSTR>(L\"winsta0\\\\Winlogon\")");
+  ok &= ExpectContains("interactive_state.h", interactive_state,
+                       "interactive_stage == \"lock-screen\"");
+  ok &= ExpectContains("render_callback.cpp", render_callback,
+                       "RemoteAction remote_action{};");
+  ok &= ExpectContains("render.cpp", render,
+                       "previous_secure_desktop_interaction");
+  ok &= ExpectNotContains(
+      "render_callback.cpp", render_callback,
+      "render->local_service_available_ &&\n"
+      "        IsSecureDesktopInteractionRequired(render->local_interactive_stage_)");
+  ok &= ExpectContains("screen_capturer_win.h", screen_capturer_h,
+                       "std::string secure_shared_stage_;");
+  ok &= ExpectContains("screen_capturer_win.cpp", screen_capturer_cpp,
+                       "const std::string& stage");
+  ok &= ExpectContains("screen_capturer_win.cpp", screen_capturer_cpp,
+                       "secure_shared_stage_ == stage");
+  ok &= ExpectContains("screen_capturer_win.cpp", screen_capturer_cpp,
+                       "secure_shared_stage_ = stage");
+  ok &= ExpectContains("screen_capturer_win.cpp", screen_capturer_cpp,
+                       "secure_shared_stage_.clear()");
+  return ok ? 0 : 1;
+}
@@ -23,6 +23,12 @@ function setup_options_and_dependencies()
        set_description("Enable DRM capture on Linux (assumes dependencies are installed)")
    option_end()

+    option("CROSSDESK_PORTABLE")
+        set_default(false)
+        set_showmenu(true)
+        set_description("Build CrossDesk as a portable package that stores data beside the executable")
+    option_end()
+
    add_rules("mode.release", "mode.debug")
    set_languages("c++17")
    set_encodings("utf-8")
@@ -35,6 +41,7 @@ function setup_options_and_dependencies()
    add_defines("USE_CUDA=" .. (is_config("USE_CUDA", true) and "1" or "0"))
    add_defines("USE_WAYLAND=" .. (is_config("USE_WAYLAND", true) and "1" or "0"))
    add_defines("USE_DRM=" .. (is_config("USE_DRM", true) and "1" or "0"))
+    add_defines("CROSSDESK_PORTABLE=" .. (is_config("CROSSDESK_PORTABLE", true) and "1" or "0"))

    if is_mode("debug") then
        add_defines("CROSSDESK_DEBUG")
@@ -47,4 +54,4 @@ function setup_options_and_dependencies()
    add_requires("nlohmann_json 3.11.3")
    add_requires("cpp-httplib v0.26.0", {configs = {ssl = true}})
    add_requires("tinyfiledialogs 3.15.1")
-end
+end
@@ -49,7 +49,7 @@ function setup_platform_settings()
        end

        if is_config("USE_WAYLAND", true) then
-            add_links("dbus-1", "pipewire-0.3")
+            add_links("dbus-1")
            add_defines("CROSSDESK_HAS_WAYLAND_CAPTURER=1")
            add_existing_include_dirs({
                "/usr/include/dbus-1.0",
@@ -25,6 +25,46 @@ function setup_targets()
        add_files("src/path_manager/*.cpp")
        add_includedirs("src/path_manager", {public = true})

+    target("path_manager_portable_test")
+        set_kind("binary")
+        set_default(false)
+        add_defines("CROSSDESK_PORTABLE=1")
+        add_includedirs("src/path_manager")
+        add_files("tests/path_manager_portable_test.cpp",
+            "src/path_manager/path_manager.cpp")
+
+    target("macos_keyboard_modifier_state_test")
+        set_kind("binary")
+        set_default(false)
+        add_includedirs("src/device_controller")
+        add_files("tests/macos_keyboard_modifier_state_test.cpp")
+
+    target("windows_manifest_resource_test")
+        set_kind("binary")
+        set_default(false)
+        add_files("tests/windows_manifest_resource_test.cpp")
+
+    target("windows_service_mouse_ipc_test")
+        set_kind("binary")
+        set_default(false)
+        add_files("tests/windows_service_mouse_ipc_test.cpp")
+
+    target("windows_mouse_controller_safety_test")
+        set_kind("binary")
+        set_default(false)
+        add_files("tests/windows_mouse_controller_safety_test.cpp")
+
+    target("windows_sas_guard_test")
+        set_kind("binary")
+        set_default(false)
+        add_includedirs("src/service/windows")
+        add_files("tests/windows_sas_guard_test.cpp")
+
+    target("display_popup_hover_state_test")
+        set_kind("binary")
+        set_default(false)
+        add_files("tests/display_popup_hover_state_test.cpp")
+
    target("screen_capturer")
        set_kind("object")
        add_deps("rd_log", "common")
@@ -34,7 +74,8 @@ function setup_targets()
            add_files("src/screen_capturer/windows/screen_capturer_dxgi.cpp",
                "src/screen_capturer/windows/screen_capturer_gdi.cpp",
                "src/screen_capturer/windows/screen_capturer_win.cpp")
-            add_includedirs("src/screen_capturer/windows", {public = true})
+            add_includedirs("src/screen_capturer/windows", "src/service/windows",
+                {public = true})
        elseif is_os("macosx") then
            add_files("src/screen_capturer/macosx/*.cpp",
                "src/screen_capturer/macosx/*.mm")
@@ -146,7 +187,8 @@ function setup_targets()
            "src/gui/windows", {public = true})
        if is_os("windows") then
            add_files("src/gui/tray/*.cpp")
-            add_includedirs("src/gui/tray", {public = true})
+            add_includedirs("src/gui/tray", "src/service/windows",
+                {public = true})
        elseif is_os("macosx") then
            add_files("src/gui/windows/*.mm")
        end
@@ -157,12 +199,32 @@ function setup_targets()
            add_packages("libyuv")
            add_deps("rd_log", "path_manager")
            add_defines("CROSSDESK_WGC_PLUGIN_BUILD=1")
+            -- Keep the project on C++17 while C++/WinRT still falls back to
+            -- MSVC's deprecated experimental coroutine header.
+            add_defines("_SILENCE_EXPERIMENTAL_COROUTINE_DEPRECATION_WARNINGS")
            add_links("windowsapp")
            add_files("src/screen_capturer/windows/screen_capturer_wgc.cpp",
                "src/screen_capturer/windows/wgc_session_impl.cpp",
                "src/screen_capturer/windows/wgc_plugin_entry.cpp")
            add_includedirs("src/common", "src/screen_capturer",
                "src/screen_capturer/windows")
+
+        target("crossdesk_service")
+            set_kind("binary")
+            add_deps("rd_log", "path_manager")
+            add_links("Advapi32", "Wtsapi32", "Ole32", "Userenv")
+            add_files("src/service/windows/main.cpp",
+                "src/service/windows/service_host.cpp")
+            add_includedirs("src/service/windows", {public = true})
+
+        target("crossdesk_session_helper")
+            set_kind("binary")
+            add_packages("libyuv")
+            add_deps("rd_log", "path_manager")
+            add_links("Advapi32", "User32", "Wtsapi32", "Gdi32")
+            add_files("src/service/windows/session_helper_main.cpp")
+            add_files("scripts/windows/crossdesk.rc")
+            add_includedirs("src/service/windows", {public = true})
    end

    target("crossdesk")
@@ -171,7 +233,10 @@ function setup_targets()
        add_files("src/app/*.cpp")
        add_includedirs("src/app", {public = true})
        if is_os("windows") then
-            add_deps("wgc_plugin")
+            add_files("src/service/windows/service_host.cpp")
+            add_includedirs("src/service/windows", {public = true})
+            add_links("Advapi32", "Wtsapi32", "Ole32", "Userenv")
+            add_deps("wgc_plugin", "crossdesk_service", "crossdesk_session_helper")
            add_files("scripts/windows/crossdesk.rc")
        end
-end
+end
Author	SHA1	Message	Date
dijunkun	8f3959e6c6	[fix] reset stale macOS permissions during install	2026-05-28 01:34:02 +08:00
dijunkun	5ff6b601c7	[fix] improve macOS permission request flow	2026-05-28 01:33:50 +08:00
kunkundi	4895ac9c23	[fix] bundle Windows Service binaries in Windows portable package	2026-05-27 19:37:06 +08:00
kunkundi	f121aa47f7	[feat] add portable Windows Service install prompt with one-click setup	2026-05-27 19:32:58 +08:00
dijunkun	00a8d59284	[chore] update README	2026-05-27 17:22:51 +08:00
dijunkun	a30489e05b	[feat] update MiniRTC: report relay traversal when either ICE candidate is relayed	2026-05-27 16:37:08 +08:00
dijunkun	dfbeb3ed20	[fix] request stream keyframes when capture resumes	2026-05-27 16:05:42 +08:00
dijunkun	2eed1c974e	[fix] recover Windows capture backends after secure desktop exit	2026-05-27 16:05:00 +08:00
dijunkun	63a79a90ac	[fix] refine Windows credential UI state detection	2026-05-27 16:04:38 +08:00
dijunkun	a61e74d97b	[feat] add video keyframe request APIs	2026-05-27 15:58:32 +08:00
kunkundi	54438a4aa1	[feat] refine control bar display index label sizing and alignment	2026-05-27 10:24:53 +08:00
dijunkun	7682ad63e4	[feat] add localized tooltips for control bar buttons	2026-05-27 00:37:34 +08:00
dijunkun	06c53fdc9c	[fix] handle SAS secure desktop transitions and restore desktop capture promptly, refs #77	2026-05-26 04:38:07 +08:00
dijunkun	665f4e684c	[feat] improve Windows secure desktop capture and input handling, refs #77	2026-05-26 03:26:37 +08:00
dijunkun	52b894fe0e	[feat] improve secure desktop capture by streaming latest frames through shared memory	2026-05-26 01:28:12 +08:00
kunkundi	82c0cbbad4	[fix] fix C++17 WGC build with newer MSVC coroutine deprecation	2026-05-25 17:37:26 +08:00
dijunkun	ce004af379	[feat] add a control bar shortcut menu for sending Ctrl+Alt+Del and remote lock commands	2026-05-25 15:57:31 +08:00
dijunkun	15bd9e9fdc	[fix] enable repeated SPS/PPS on NVENC keyframes, fixes #78	2026-05-25 02:16:19 +08:00
dijunkun	37aabeaf72	[fix] reset display popup hover state after monitor switching to restore mouse control, fixes #83	2026-05-25 01:28:17 +08:00
dijunkun	473737ac9b	[fix] fix Windows input forwarding and allow debug builds to run without admin, fixes #82	2026-05-25 00:40:38 +08:00
dijunkun	1e29ec708f	[fix] fix macOS remote keyboard modifier injection, fixes #81	2026-05-21 00:23:50 +08:00
dijunkun	515d517a99	[feat] add portable build storage mode, refs #80	2026-05-21 00:13:27 +08:00
dijunkun	a3aedcb624	[fix] fix incorrect new version notification display issue	2026-05-07 15:45:21 +08:00
dijunkun	98b7c6c966	[fix] preserve Linux keypad navigation semantics and Windows scan-code metadata for remote keyboard input	2026-05-07 14:50:00 +08:00
dijunkun	b1d956af2c	[fix] fix left/right modifier key injection while preserving scan code metadata	2026-05-06 17:52:31 +08:00
dijunkun	b7a031bb7f	[fix] make PipeWire and portal dependencies optional	2026-04-28 17:08:34 +08:00
dijunkun	15cce07b6e	Merge branch 'desktop-unlock-win' into file-transfer	2026-04-28 15:53:18 +08:00
dijunkun	1d5d6f5121	[fix] fix Debian package dependencies for PipeWire and ALSA t64 transitions	2026-04-28 11:14:25 +08:00
dijunkun	5f541f5c8b	[feat] make CrossDesk service start and stop with the app	2026-04-28 10:25:16 +08:00
dijunkun	71bce08549	[fix] select the correct X11 pixel format conversion to prevent green-tinted screen capture on ubuntu	2026-04-27 17:57:11 +08:00
dijunkun	37b9badb2a	[ci] fix NSIS uninstall function naming for service cleanup	2026-04-22 00:16:58 +08:00
dijunkun	4089e80fe8	[feat] register and remove CrossDeskService in the Windows installer	2026-04-21 23:23:11 +08:00
dijunkun	2be6e727ce	[fix] use SDL keyboard capture on Wayland only	2026-04-21 17:37:19 +08:00
dijunkun	d3b886c3f6	[fix] fix blocking issue on controlled-side during shutdown	2026-04-21 16:52:59 +08:00
dijunkun	97e48bfe71	[fix] fix Wayland keyboard capture by using SDL key events	2026-04-21 14:47:10 +08:00
dijunkun	a8769dee06	Merge branch 'file-transfer' of https://github.com/kunkundi/crossdesk into file-transfer	2026-04-21 09:28:22 +08:00
dijunkun	ffa94986d5	[feat] add Windows secure desktop remote unlock support for locked sessions, refs #77	2026-04-21 04:10:08 +08:00
dijunkun	e4dfb61509	[fix] fix wayland cursor mapping	2026-04-20 18:09:13 +08:00
dijunkun	d42b6e3261	[feat] update MiniRTC	2026-04-20 18:02:56 +08:00
dijunkun	855b15025c	[fix] fix file transfer window interactions issue	2026-04-14 14:25:16 +08:00
dijunkun	3701b2c0d9	[chore] add acknowledgements	2026-04-14 11:03:06 +08:00