[fix] fix Debian package dependencies for PipeWire and ALSA t64 transitions

scripts/linux/pkg_amd64.sh

@@ -8,6 +8,8 @@ APP_VERSION="$1"
 ARCHITECTURE="amd64"
 MAINTAINER="Junkun Di <junkun.di@hotmail.com>"
 DESCRIPTION="A simple cross-platform remote desktop client."
+ALSA_RUNTIME_DEP="libasound2 | libasound2t64"
+PIPEWIRE_RUNTIME_DEP="libpipewire-0.3-0 | libpipewire-0.3-0t64"
 
 # Remove 'v' prefix from version for Debian package (Debian version must start with digit)
 DEB_VERSION="${APP_VERSION#v}"
@@ -41,9 +43,9 @@ Maintainer: $MAINTAINER
 Description: $DESCRIPTION
 Depends: libc6 (>= 2.29), libstdc++6 (>= 9), libx11-6, libxcb1,
  libxcb-randr0, libxcb-xtest0, libxcb-xinerama0, libxcb-shape0,
- libxcb-xkb1, libxcb-xfixes0, libxv1, libxtst6, libasound2,
+ libxcb-xkb1, libxcb-xfixes0, libxv1, libxtst6, $ALSA_RUNTIME_DEP,
  libsndio7.0, libxcb-shm0, libpulse0, libdrm2, libdbus-1-3,
- libpipewire-0.3-0, xdg-desktop-portal,
+ $PIPEWIRE_RUNTIME_DEP, xdg-desktop-portal,
  xdg-desktop-portal-gtk | xdg-desktop-portal-kde | xdg-desktop-portal-wlr
 Recommends: nvidia-cuda-toolkit
 Priority: optional

scripts/linux/pkg_arm64.sh

@@ -8,6 +8,8 @@ APP_VERSION="$1"
 ARCHITECTURE="arm64"
 MAINTAINER="Junkun Di <junkun.di@hotmail.com>"
 DESCRIPTION="A simple cross-platform remote desktop client."
+ALSA_RUNTIME_DEP="libasound2 | libasound2t64"
+PIPEWIRE_RUNTIME_DEP="libpipewire-0.3-0 | libpipewire-0.3-0t64"
 
 # Remove 'v' prefix from version for Debian package (Debian version must start with digit)
 DEB_VERSION="${APP_VERSION#v}"
@@ -41,9 +43,9 @@ Maintainer: $MAINTAINER
 Description: $DESCRIPTION
 Depends: libc6 (>= 2.29), libstdc++6 (>= 9), libx11-6, libxcb1,
  libxcb-randr0, libxcb-xtest0, libxcb-xinerama0, libxcb-shape0,
- libxcb-xkb1, libxcb-xfixes0, libxv1, libxtst6, libasound2,
+ libxcb-xkb1, libxcb-xfixes0, libxv1, libxtst6, $ALSA_RUNTIME_DEP,
  libsndio7.0, libxcb-shm0, libpulse0, libdrm2, libdbus-1-3,
- libpipewire-0.3-0, xdg-desktop-portal,
+ $PIPEWIRE_RUNTIME_DEP, xdg-desktop-portal,
  xdg-desktop-portal-gtk | xdg-desktop-portal-kde | xdg-desktop-portal-wlr
 Priority: optional
 Section: utils

scripts/windows/nsis_script.nsi

@@ -8,6 +8,7 @@
 !define PRODUCT_WEB_SITE "https://www.crossdesk.cn/"
 !define APP_NAME "CrossDesk"
 !define UNINSTALL_REG_KEY "CrossDesk"
+!define PRODUCT_SERVICE_NAME "CrossDeskService"
 
 ; Installer icon path
 !define MUI_ICON "${__FILEDIR__}\..\..\icons\windows\crossdesk.ico"
@@ -68,14 +69,21 @@ cancelInstall:
     Abort
 
 installApp:
+    Call StopInstalledService
+
     SetOutPath "$INSTDIR"
     SetOverwrite ifnewer
 
     ; Main application executable path
     File /oname=CrossDesk.exe "..\..\build\windows\x64\release\crossdesk.exe"
+    ; Bundle service-side binaries required by the Windows service flow
+    File "..\..\build\windows\x64\release\crossdesk_service.exe"
+    File "..\..\build\windows\x64\release\crossdesk_session_helper.exe"
     ; Bundle runtime DLLs from the release output directory
     File "..\..\build\windows\x64\release\*.dll"
 
+    Call RegisterInstalledService
+
     ; Write uninstall information
     WriteUninstaller "$INSTDIR\uninstall.exe"
 
@@ -122,8 +130,12 @@ cancelUninstall:
     Abort
 
 uninstallApp:
+    Call un.UnregisterInstalledService
+
     ; Delete main executable and uninstaller
     Delete "$INSTDIR\CrossDesk.exe"
+    Delete "$INSTDIR\crossdesk_service.exe"
+    Delete "$INSTDIR\crossdesk_session_helper.exe"
     Delete "$INSTDIR\uninstall.exe"
 
     ; Recursively delete installation directory
@@ -148,3 +160,78 @@ SectionEnd
 Function LaunchApp
     Exec "$INSTDIR\CrossDesk.exe"
 FunctionEnd
+
+Function StopInstalledService
+    IfFileExists "$INSTDIR\CrossDesk.exe" 0 stop_with_sc
+    IfFileExists "$INSTDIR\crossdesk_service.exe" 0 stop_with_sc
+
+    DetailPrint "Stopping existing CrossDesk service"
+    ExecWait '"$INSTDIR\CrossDesk.exe" --service-stop' $0
+    ${If} $0 = 0
+        Return
+    ${EndIf}
+
+stop_with_sc:
+    DetailPrint "Stopping existing CrossDesk service via Service Control Manager"
+    ExecWait '"$SYSDIR\sc.exe" stop ${PRODUCT_SERVICE_NAME}' $0
+    ${If} $0 != 0
+    ${AndIf} $0 != 1060
+    ${AndIf} $0 != 1062
+        MessageBox MB_ICONSTOP|MB_OK "Failed to stop the existing CrossDesk service. The installation will be aborted."
+        Abort
+    ${EndIf}
+    Sleep 1500
+FunctionEnd
+
+Function RegisterInstalledService
+    IfFileExists "$INSTDIR\CrossDesk.exe" 0 missing_service_binary
+    IfFileExists "$INSTDIR\crossdesk_service.exe" 0 missing_service_binary
+    IfFileExists "$INSTDIR\crossdesk_session_helper.exe" 0 missing_service_binary
+
+    DetailPrint "Registering CrossDesk service"
+    ExecWait '"$INSTDIR\CrossDesk.exe" --service-install' $0
+    ${If} $0 != 0
+        MessageBox MB_ICONSTOP|MB_OK "Failed to register the CrossDesk service. The installation will be aborted."
+        Abort
+    ${EndIf}
+
+    DetailPrint "CrossDesk service registered for on-demand start"
+
+    Return
+
+missing_service_binary:
+    MessageBox MB_ICONSTOP|MB_OK "CrossDesk service files are missing from the installer package. The installation will be aborted."
+    Abort
+FunctionEnd
+
+Function un.UnregisterInstalledService
+    IfFileExists "$INSTDIR\CrossDesk.exe" 0 unregister_with_sc
+
+    DetailPrint "Stopping CrossDesk service"
+    ExecWait '"$INSTDIR\CrossDesk.exe" --service-stop' $0
+    ${If} $0 = 0
+        DetailPrint "Removing CrossDesk service"
+        ExecWait '"$INSTDIR\CrossDesk.exe" --service-uninstall' $0
+        ${If} $0 = 0
+            Return
+        ${EndIf}
+    ${EndIf}
+
+unregister_with_sc:
+    DetailPrint "Removing CrossDesk service via Service Control Manager"
+    ExecWait '"$SYSDIR\sc.exe" stop ${PRODUCT_SERVICE_NAME}' $0
+    ${If} $0 != 0
+    ${AndIf} $0 != 1060
+    ${AndIf} $0 != 1062
+        MessageBox MB_ICONSTOP|MB_OK "Failed to stop the CrossDesk service. Uninstall will be aborted."
+        Abort
+    ${EndIf}
+    Sleep 1500
+
+    ExecWait '"$SYSDIR\sc.exe" delete ${PRODUCT_SERVICE_NAME}' $0
+    ${If} $0 != 0
+    ${AndIf} $0 != 1060
+        MessageBox MB_ICONSTOP|MB_OK "Failed to remove the CrossDesk service. Uninstall will be aborted."
+        Abort
+    ${EndIf}
+FunctionEnd

src/app/main.cpp

@@ -7,15 +7,179 @@
 #endif
 
 #include <cstring>
+#include <filesystem>
+#include <iostream>
 #include <memory>
 #include <string>
 
+#ifdef _WIN32
+#include <cstdio>
+
+#include "service_host.h"
+#endif
+
 #include "config_center.h"
 #include "daemon.h"
 #include "path_manager.h"
 #include "render.h"
 
+#ifdef _WIN32
+namespace {
+
+void EnsureConsoleForCli() {
+  static bool console_ready = false;
+  if (console_ready) {
+    return;
+  }
+
+  if (!AttachConsole(ATTACH_PARENT_PROCESS)) {
+    DWORD error = GetLastError();
+    if (error != ERROR_ACCESS_DENIED) {
+      AllocConsole();
+    }
+  }
+
+  FILE* stream = nullptr;
+  freopen_s(&stream, "CONOUT$", "w", stdout);
+  freopen_s(&stream, "CONOUT$", "w", stderr);
+  freopen_s(&stream, "CONIN$", "r", stdin);
+  SetConsoleOutputCP(CP_UTF8);
+  console_ready = true;
+}
+
+void PrintServiceCliUsage() {
+  std::cout
+      << "CrossDesk service management commands\n"
+      << "  --service-install    Install the sibling crossdesk_service.exe\n"
+      << "  --service-uninstall  Remove the installed Windows service\n"
+      << "  --service-start      Start the Windows service\n"
+      << "  --service-stop       Stop the Windows service\n"
+      << "  --service-sas        Ask the service to send Secure Attention "
+         "Sequence\n"
+      << "  --service-ping       Ping the service over named pipe IPC\n"
+      << "  --service-status     Query service runtime status\n"
+      << "  --service-help       Show this help\n";
+}
+
+std::wstring GetCurrentExecutablePathW() {
+  wchar_t path[MAX_PATH] = {0};
+  DWORD length = GetModuleFileNameW(nullptr, path, MAX_PATH);
+  if (length == 0 || length >= MAX_PATH) {
+    return L"";
+  }
+  return std::wstring(path, length);
+}
+
+std::filesystem::path GetSiblingServiceExecutablePath() {
+  std::wstring current_executable = GetCurrentExecutablePathW();
+  if (current_executable.empty()) {
+    return {};
+  }
+
+  return std::filesystem::path(current_executable).parent_path() /
+         L"crossdesk_service.exe";
+}
+
+bool IsServiceCliCommand(const char* arg) {
+  if (arg == nullptr) {
+    return false;
+  }
+
+  return std::strcmp(arg, "--service-install") == 0 ||
+         std::strcmp(arg, "--service-uninstall") == 0 ||
+         std::strcmp(arg, "--service-start") == 0 ||
+         std::strcmp(arg, "--service-stop") == 0 ||
+         std::strcmp(arg, "--service-sas") == 0 ||
+         std::strcmp(arg, "--service-ping") == 0 ||
+         std::strcmp(arg, "--service-status") == 0 ||
+         std::strcmp(arg, "--service-help") == 0;
+}
+
+void TryStartManagedWindowsService() {
+  std::filesystem::path service_path = GetSiblingServiceExecutablePath();
+  if (service_path.empty() || !std::filesystem::exists(service_path)) {
+    return;
+  }
+
+  if (!crossdesk::IsCrossDeskServiceInstalled()) {
+    return;
+  }
+
+  crossdesk::StartCrossDeskService();
+}
+
+int HandleServiceCliCommand(const std::string& command) {
+  EnsureConsoleForCli();
+
+  if (command == "--service-help") {
+    PrintServiceCliUsage();
+    return 0;
+  }
+
+  if (command == "--service-install") {
+    std::filesystem::path service_path = GetSiblingServiceExecutablePath();
+    if (service_path.empty()) {
+      std::cerr << "Failed to locate crossdesk_service.exe" << std::endl;
+      return 1;
+    }
+    if (!std::filesystem::exists(service_path)) {
+      std::cerr << "Service binary not found: " << service_path.string()
+                << std::endl;
+      return 1;
+    }
+
+    bool success = crossdesk::InstallCrossDeskService(service_path.wstring());
+    std::cout << (success ? "install ok" : "install failed") << std::endl;
+    return success ? 0 : 1;
+  }
+
+  if (command == "--service-uninstall") {
+    bool success = crossdesk::UninstallCrossDeskService();
+    std::cout << (success ? "uninstall ok" : "uninstall failed") << std::endl;
+    return success ? 0 : 1;
+  }
+
+  if (command == "--service-start") {
+    bool success = crossdesk::StartCrossDeskService();
+    std::cout << (success ? "start ok" : "start failed") << std::endl;
+    return success ? 0 : 1;
+  }
+
+  if (command == "--service-stop") {
+    bool success = crossdesk::StopCrossDeskService();
+    std::cout << (success ? "stop ok" : "stop failed") << std::endl;
+    return success ? 0 : 1;
+  }
+
+  if (command == "--service-sas") {
+    std::cout << crossdesk::QueryCrossDeskService("sas") << std::endl;
+    return 0;
+  }
+
+  if (command == "--service-ping") {
+    std::cout << crossdesk::QueryCrossDeskService("ping") << std::endl;
+    return 0;
+  }
+
+  if (command == "--service-status") {
+    std::cout << crossdesk::QueryCrossDeskService("status") << std::endl;
+    return 0;
+  }
+
+  PrintServiceCliUsage();
+  return 1;
+}
+
+}  // namespace
+#endif
+
 int main(int argc, char* argv[]) {
+#ifdef _WIN32
+  if (argc > 1 && IsServiceCliCommand(argv[1])) {
+    return HandleServiceCliCommand(argv[1]);
+  }
+#endif
+
   // check if running as child process
   bool is_child = false;
   for (int i = 1; i < argc; i++) {
@@ -32,6 +196,10 @@ int main(int argc, char* argv[]) {
     return 0;
   }
 
+#ifdef _WIN32
+  TryStartManagedWindowsService();
+#endif
+
   bool enable_daemon = false;
   auto path_manager = std::make_unique<crossdesk::PathManager>("CrossDesk");
   if (path_manager) {

src/device_controller/device_controller.h

@@ -7,6 +7,7 @@
 #ifndef _DEVICE_CONTROLLER_H_
 #define _DEVICE_CONTROLLER_H_
 
+#include <cstring>
 #include <stdio.h>
 
 #include <nlohmann/json.hpp>
@@ -23,6 +24,8 @@ typedef enum {
   audio_capture,
   host_infomation,
   display_id,
+  service_status,
+  service_command,
 } ControlType;
 typedef enum {
   move = 0,
@@ -36,6 +39,7 @@ typedef enum {
   wheel_horizontal
 } MouseFlag;
 typedef enum { key_down = 0, key_up } KeyFlag;
+typedef enum { send_sas = 0 } ServiceCommandFlag;
 typedef struct {
   float x;
   float y;
@@ -59,6 +63,15 @@ typedef struct {
   int* bottom;
 } HostInfo;
 
+typedef struct {
+  bool available;
+  char interactive_stage[32];
+} ServiceStatus;
+
+typedef struct {
+  ServiceCommandFlag flag;
+} ServiceCommand;
+
 struct RemoteAction {
   ControlType type;
   union {
@@ -67,6 +80,8 @@ struct RemoteAction {
     HostInfo i;
     bool a;
     int d;
+    ServiceStatus ss;
+    ServiceCommand c;
   };
 
   // parse
@@ -96,6 +111,14 @@ struct RemoteAction {
       case ControlType::display_id:
         j["display_id"] = a.d;
         break;
+      case ControlType::service_status:
+        j["service_status"] = {{"available", a.ss.available},
+                               {"interactive_stage",
+                                a.ss.interactive_stage}};
+        break;
+      case ControlType::service_command:
+        j["service_command"] = {{"flag", a.c.flag}};
+        break;
       case ControlType::host_infomation: {
         json displays = json::array();
         for (size_t idx = 0; idx < a.i.display_num; idx++) {
@@ -137,6 +160,21 @@ struct RemoteAction {
         case ControlType::display_id:
           out.d = j.at("display_id").get<int>();
           break;
+        case ControlType::service_status: {
+          const auto& service_status_json = j.at("service_status");
+          out.ss.available = service_status_json.value("available", false);
+          std::string interactive_stage =
+            service_status_json.value("interactive_stage", std::string());
+          std::strncpy(out.ss.interactive_stage, interactive_stage.c_str(),
+                 sizeof(out.ss.interactive_stage) - 1);
+          out.ss.interactive_stage[sizeof(out.ss.interactive_stage) - 1] =
+            '\0';
+          break;
+        }
+        case ControlType::service_command:
+          out.c.flag = static_cast<ServiceCommandFlag>(
+            j.at("service_command").at("flag").get<int>());
+          break;
         case ControlType::host_infomation: {
           std::string host_name =
               j.at("host_info").at("host_name").get<std::string>();

src/device_controller/keyboard_converter.h

@@ -98,6 +98,7 @@ std::map<int, int> vkCodeToCGKeyCode = {
     {0x67, 0x59},  // Numpad 7
     {0x68, 0x5B},  // Numpad 8
     {0x69, 0x5C},  // Numpad 9
+    {0x90, 0x47},  // Num Lock / Keypad Clear
     {0x6E, 0x41},  // Numpad .
     {0x6F, 0x4B},  // Numpad /
     {0x6A, 0x43},  // Numpad *
@@ -216,6 +217,7 @@ std::map<int, int> CGKeyCodeToVkCode = {
     {0x59, 0x67},  // Numpad 7
     {0x5B, 0x68},  // Numpad 8
     {0x5C, 0x69},  // Numpad 9
+    {0x47, 0x90},  // Num Lock / Keypad Clear
     {0x41, 0x6E},  // Numpad .
     {0x4B, 0x6F},  // Numpad /
     {0x43, 0x6A},  // Numpad *
@@ -336,6 +338,7 @@ std::map<int, int> vkCodeToX11KeySym = {
     {0x67, 0xFFB7},  // Numpad 7
     {0x68, 0xFFB8},  // Numpad 8
     {0x69, 0xFFB9},  // Numpad 9
+    {0x90, 0xFF7F},  // Num Lock
     {0x6E, 0xFFAE},  // Numpad .
     {0x6F, 0xFFAF},  // Numpad /
     {0x6A, 0xFFAA},  // Numpad *
@@ -464,6 +467,7 @@ std::map<int, int> x11KeySymToVkCode = {
     {0xFFB7, 0x67},  // Numpad 7
     {0xFFB8, 0x68},  // Numpad 8
     {0xFFB9, 0x69},  // Numpad 9
+    {0xFF7F, 0x90},  // Num Lock
     {0xFFAE, 0x6E},  // Numpad .
     {0xFFAF, 0x6F},  // Numpad /
     {0xFFAA, 0x6A},  // Numpad *
@@ -582,6 +586,7 @@ std::map<int, int> cgKeyCodeToX11KeySym = {
     {0x59, 0xFFB7},  // Numpad 7
     {0x5B, 0xFFB8},  // Numpad 8
     {0x5C, 0xFFB9},  // Numpad 9
+    {0x47, 0xFF7F},  // Num Lock / Keypad Clear
     {0x41, 0xFFAE},  // Numpad .
     {0x4B, 0xFFAF},  // Numpad /
     {0x43, 0xFFAA},  // Numpad *
@@ -708,6 +713,7 @@ std::map<int, int> x11KeySymToCgKeyCode = {
     {0xFFB7, 0x59},  // Numpad 7
     {0xFFB8, 0x5B},  // Numpad 8
     {0xFFB9, 0x5C},  // Numpad 9
+    {0xFF7F, 0x47},  // Num Lock / Keypad Clear
     {0xFFAE, 0x41},  // Numpad .
     {0xFFAF, 0x4B},  // Numpad /
     {0xFFAA, 0x43},  // Numpad *

src/gui/assets/localization/localization_data.h

@@ -51,6 +51,22 @@ struct TranslationRow {
   X(release_mouse, u8"释放", "Release", u8"Освободить")                        \
   X(audio_capture, u8"声音", "Audio", u8"Звук")                                \
   X(mute, u8" 静音", " Mute", u8"Без звука")                                   \
+  X(send_sas, u8"发送SAS", "Send SAS", u8"Отправить SAS")                     \
+  X(remote_password_box_visible, u8"远端密码框已出现",                            \
+    "Remote password box visible", u8"Окно ввода пароля видно")                 \
+  X(remote_lock_screen_hint, u8"远端处于锁屏封面，可发送SAS",                     \
+    "Remote lock screen visible, send SAS",                                     \
+    u8"Видна блокировка, отправьте SAS")                                         \
+  X(remote_secure_desktop_active, u8"远端已进入安全桌面",                         \
+    "Remote secure desktop active",                                              \
+    u8"Активен защищенный рабочий стол")                                         \
+  X(remote_service_unavailable, u8"远端Windows服务不可用",                        \
+    "Remote Windows service unavailable",                                        \
+    u8"Служба Windows на удаленной стороне недоступна")                          \
+  X(remote_unlock_requires_secure_desktop,                                        \
+    u8"当前仍需要安全桌面专用采集/输入",                                         \
+    "Secure desktop capture/input is still required",                            \
+    u8"По-прежнему нужен отдельный захват/ввод для защищенного рабочего стола")   \
   X(settings, u8"设置", "Settings", u8"Настройки")                             \
   X(language, u8"语言:", "Language:", u8"Язык:")                               \
   X(video_quality, u8"视频质量:", "Video Quality:", u8"Качество видео:")       \

src/gui/render.cpp

@@ -28,6 +28,10 @@
 #include "screen_capturer_factory.h"
 #include "version_checker.h"
 
+#if _WIN32
+#include "interactive_state.h"
+#include "service_host.h"
+#endif
 
 #if defined(__APPLE__)
 #include "window_util_mac.h"
@@ -75,6 +79,67 @@ HICON LoadTrayIcon() {
 
   return LoadIconW(nullptr, IDI_APPLICATION);
 }
+
+struct WindowsServiceInteractiveStatus {
+  bool available = false;
+  unsigned int error_code = 0;
+  std::string interactive_stage;
+  std::string error;
+};
+
+constexpr uint32_t kWindowsServiceStatusIntervalMs = 1000;
+constexpr DWORD kWindowsServiceQueryTimeoutMs = 100;
+constexpr DWORD kWindowsServiceSasTimeoutMs = 500;
+
+RemoteAction BuildWindowsServiceStatusAction(
+    const WindowsServiceInteractiveStatus& status) {
+  RemoteAction action{};
+  action.type = ControlType::service_status;
+  action.ss.available = status.available;
+  std::strncpy(action.ss.interactive_stage, status.interactive_stage.c_str(),
+               sizeof(action.ss.interactive_stage) - 1);
+  action.ss.interactive_stage[sizeof(action.ss.interactive_stage) - 1] = '\0';
+  return action;
+}
+
+bool QueryWindowsServiceInteractiveStatus(
+    WindowsServiceInteractiveStatus* status) {
+  if (status == nullptr) {
+    return false;
+  }
+
+  *status = WindowsServiceInteractiveStatus{};
+  const std::string response =
+      QueryCrossDeskService("status", kWindowsServiceQueryTimeoutMs);
+  auto json = nlohmann::json::parse(response, nullptr, false);
+  if (json.is_discarded() || !json.is_object()) {
+    status->error = "invalid_service_status_json";
+    return false;
+  }
+
+  status->available = json.value("ok", false);
+  if (!status->available) {
+    status->error = json.value("error", std::string("service_unavailable"));
+    status->error_code = json.value("code", 0u);
+    return true;
+  }
+
+  status->interactive_stage = json.value("interactive_stage", std::string());
+
+  if (ShouldNormalizeUnlockToUserDesktop(
+          json.value("interactive_lock_screen_visible", false),
+          status->interactive_stage, json.value("session_locked", false),
+          json.value("interactive_logon_ui_visible", false),
+          json.value("interactive_secure_desktop_active",
+                     json.value("secure_desktop_active", false)),
+          json.value("credential_ui_visible", false),
+          json.value("password_box_visible", false),
+          json.value("unlock_ui_visible", false),
+          json.value("last_session_event", std::string()))) {
+    status->interactive_stage = "user-desktop";
+  }
+  return true;
+}
 #endif
 
 #if defined(__linux__) && !defined(__APPLE__)
@@ -729,9 +794,21 @@ int Render::StopMouseController() {
 }
 
 int Render::StartKeyboardCapturer() {
+  keyboard_capturer_uses_sdl_events_ = false;
+
+#if defined(__linux__) && !defined(__APPLE__)
+  if (IsWaylandSession()) {
+    keyboard_capturer_uses_sdl_events_ = true;
+    LOG_INFO("Start keyboard capturer with SDL Wayland backend");
+    return 0;
+  }
+#endif
+
   if (!keyboard_capturer_) {
-    LOG_INFO("keyboard capturer is nullptr");
+    keyboard_capturer_uses_sdl_events_ = true;
-    return -1;
+    LOG_WARN(
+        "keyboard capturer is nullptr, falling back to SDL keyboard events");
+    return 0;
   }
 
   int keyboard_capturer_init_ret = keyboard_capturer_->Hook(
@@ -743,15 +820,24 @@ int Render::StartKeyboardCapturer() {
       },
       this);
   if (0 != keyboard_capturer_init_ret) {
-    LOG_ERROR("Start keyboard capturer failed");
+    keyboard_capturer_uses_sdl_events_ = true;
+    LOG_WARN(
+        "Start keyboard capturer failed, falling back to SDL keyboard "
+        "events");
   } else {
-    LOG_INFO("Start keyboard capturer");
+    LOG_INFO("Start keyboard capturer with native hook");
   }
 
-  return keyboard_capturer_init_ret;
+  return 0;
 }
 
 int Render::StopKeyboardCapturer() {
+  if (keyboard_capturer_uses_sdl_events_) {
+    keyboard_capturer_uses_sdl_events_ = false;
+    LOG_INFO("Stop keyboard capturer with SDL keyboard backend");
+    return 0;
+  }
+
   if (keyboard_capturer_) {
     keyboard_capturer_->Unhook();
     LOG_INFO("Stop keyboard capturer");
@@ -1746,6 +1832,7 @@ void Render::MainLoop() {
     HandlePendingPresenceProbe();
     HandleStreamWindow();
     HandleServerWindow();
+    HandleWindowsServiceIntegration();
 
     DrawMainWindow();
     if (stream_window_inited_) {
@@ -1772,6 +1859,141 @@ void Render::UpdateLabels() {
   }
 }
 
+void Render::ResetRemoteServiceStatus(SubStreamWindowProperties& props) {
+  props.remote_service_status_received_ = false;
+  props.remote_service_available_ = false;
+  props.remote_interactive_stage_.clear();
+}
+
+void Render::ApplyRemoteServiceStatus(SubStreamWindowProperties& props,
+                                      const ServiceStatus& status) {
+  props.remote_service_status_received_ = true;
+  props.remote_service_available_ = status.available;
+  props.remote_interactive_stage_ = status.interactive_stage;
+}
+
+Render::RemoteUnlockState Render::GetRemoteUnlockState(
+    const SubStreamWindowProperties& props) const {
+  if (!props.remote_service_status_received_) {
+    return RemoteUnlockState::none;
+  }
+  if (!props.remote_service_available_) {
+    return RemoteUnlockState::service_unavailable;
+  }
+  if (props.remote_interactive_stage_ == "credential-ui") {
+    return RemoteUnlockState::credential_ui;
+  }
+  if (props.remote_interactive_stage_ == "lock-screen") {
+    return RemoteUnlockState::lock_screen;
+  }
+  if (props.remote_interactive_stage_ == "secure-desktop") {
+    return RemoteUnlockState::secure_desktop;
+  }
+  return RemoteUnlockState::none;
+}
+
+void Render::HandleWindowsServiceIntegration() {
+#if _WIN32
+  static bool last_logged_service_available = true;
+  static unsigned int last_logged_service_error_code = 0;
+  static std::string last_logged_service_error;
+
+  if (!is_server_mode_ || peer_ == nullptr) {
+    ResetLocalWindowsServiceState(true);
+    return;
+  }
+
+  const bool has_connected_remote =
+      std::any_of(connection_status_.begin(), connection_status_.end(),
+                  [](const auto& entry) {
+                    return entry.second == ConnectionStatus::Connected;
+                  });
+  if (!has_connected_remote) {
+    ResetLocalWindowsServiceState(false);
+    return;
+  }
+
+  bool force_broadcast = false;
+  if (pending_windows_service_sas_.exchange(false, std::memory_order_relaxed)) {
+    const std::string response =
+        QueryCrossDeskService("sas", kWindowsServiceSasTimeoutMs);
+    auto json = nlohmann::json::parse(response, nullptr, false);
+    if (json.is_discarded() || !json.value("ok", false)) {
+      LOG_WARN("Remote SAS request failed: {}", response);
+    } else {
+      LOG_INFO("Remote SAS request forwarded to local Windows service");
+    }
+    last_windows_service_status_tick_ = 0;
+    force_broadcast = true;
+  }
+
+  const uint32_t now = static_cast<uint32_t>(SDL_GetTicks());
+  if (!force_broadcast && last_windows_service_status_tick_ != 0 &&
+      now - last_windows_service_status_tick_ <
+          kWindowsServiceStatusIntervalMs) {
+    return;
+  }
+  last_windows_service_status_tick_ = now;
+
+  WindowsServiceInteractiveStatus status;
+  const bool status_ok = QueryWindowsServiceInteractiveStatus(&status);
+  local_service_status_received_ = status_ok;
+  local_service_available_ = status.available;
+  local_interactive_stage_ = status.available ? status.interactive_stage : "";
+
+  if (status_ok) {
+    const bool availability_changed =
+        status.available != last_logged_service_available;
+    const bool error_changed =
+        !status.available &&
+        (status.error != last_logged_service_error ||
+         status.error_code != last_logged_service_error_code);
+    if (availability_changed || error_changed) {
+      if (status.available) {
+        LOG_INFO(
+            "Local Windows service available for secure desktop integration");
+      } else {
+        LOG_WARN(
+            "Local Windows service unavailable, secure desktop integration "
+            "disabled: error={}, code={}",
+            status.error, status.error_code);
+      }
+      last_logged_service_available = status.available;
+      last_logged_service_error = status.error;
+      last_logged_service_error_code = status.error_code;
+    }
+  } else if (last_logged_service_available ||
+             last_logged_service_error != "invalid_service_status_json") {
+    LOG_WARN(
+        "Local Windows service status query failed, secure desktop integration "
+        "disabled");
+    last_logged_service_available = false;
+    last_logged_service_error = "invalid_service_status_json";
+    last_logged_service_error_code = 0;
+  }
+
+  RemoteAction remote_action = BuildWindowsServiceStatusAction(status);
+  std::string msg = remote_action.to_json();
+  int ret = SendReliableDataFrame(peer_, msg.data(), msg.size(),
+                                  control_data_label_.c_str());
+  if (ret != 0) {
+    LOG_WARN("Broadcast Windows service status failed, ret={}", ret);
+  }
+#endif
+}
+
+#if _WIN32
+void Render::ResetLocalWindowsServiceState(bool clear_pending_sas) {
+  last_windows_service_status_tick_ = 0;
+  if (clear_pending_sas) {
+    pending_windows_service_sas_.store(false, std::memory_order_relaxed);
+  }
+  local_service_status_received_ = false;
+  local_service_available_ = false;
+  local_interactive_stage_.clear();
+}
+#endif
+
 void Render::HandleRecentConnections() {
   if (reload_recent_connections_ && main_renderer_) {
     uint32_t now_time = SDL_GetTicks();
@@ -2470,7 +2692,7 @@ void Render::ProcessSdlEvent(const SDL_Event& event) {
     case SDL_EVENT_WINDOW_FOCUS_LOST:
       if (stream_window_ &&
           SDL_GetWindowID(stream_window_) == event.window.windowID) {
-        ForceReleasePressedModifiers();
+        ForceReleasePressedKeys();
         focus_on_stream_window_ = false;
       } else if (main_window_ &&
                  SDL_GetWindowID(main_window_) == event.window.windowID) {
@@ -2502,6 +2724,15 @@ void Render::ProcessSdlEvent(const SDL_Event& event) {
       break;
     }
 
+    case SDL_EVENT_KEY_DOWN:
+    case SDL_EVENT_KEY_UP:
+      if (keyboard_capturer_is_started_ && keyboard_capturer_uses_sdl_events_ &&
+          focus_on_stream_window_ && stream_window_ &&
+          SDL_GetWindowID(stream_window_) == event.key.windowID) {
+        ProcessKeyboardEvent(event);
+      }
+      break;
+
     default:
       if (event.type == STREAM_REFRESH_EVENT) {
         auto* props = static_cast<SubStreamWindowProperties*>(event.user.data1);

src/gui/render.h

@@ -44,6 +44,14 @@
 namespace crossdesk {
 class Render {
  public:
+  enum class RemoteUnlockState {
+    none,
+    service_unavailable,
+    lock_screen,
+    credential_ui,
+    secure_desktop,
+  };
+
   struct FileTransferState {
     std::atomic<bool> file_sending_ = false;
     std::atomic<uint64_t> file_sent_bytes_ = 0;
@@ -159,6 +167,9 @@ class Render {
     std::string mouse_control_button_label_ = "Mouse Control";
     std::string audio_capture_button_label_ = "Audio Capture";
     std::string remote_host_name_ = "";
+    bool remote_service_status_received_ = false;
+    bool remote_service_available_ = false;
+    std::string remote_interactive_stage_ = "";
     std::vector<DisplayInfo> display_info_list_;
     SDL_Texture* stream_texture_ = nullptr;
     uint8_t* argb_buffer_ = nullptr;
@@ -271,6 +282,11 @@ class Render {
       std::shared_ptr<SubStreamWindowProperties>& props);
   void DrawReceivingScreenText(
       std::shared_ptr<SubStreamWindowProperties>& props);
+  void ResetRemoteServiceStatus(SubStreamWindowProperties& props);
+  void ApplyRemoteServiceStatus(SubStreamWindowProperties& props,
+                                const ServiceStatus& status);
+  RemoteUnlockState GetRemoteUnlockState(
+      const SubStreamWindowProperties& props) const;
 #ifdef __APPLE__
   int RequestPermissionWindow();
   bool CheckScreenRecordingPermission();
@@ -324,8 +340,9 @@ class Render {
  private:
   int SendKeyCommand(int key_code, bool is_down);
   static bool IsModifierVkKey(int key_code);
-  void UpdatePressedModifierState(int key_code, bool is_down);
+  void TrackPressedKeyState(int key_code, bool is_down);
-  void ForceReleasePressedModifiers();
+  void ForceReleasePressedKeys();
+  int ProcessKeyboardEvent(const SDL_Event& event);
   int ProcessMouseEvent(const SDL_Event& event);
 
   static void SdlCaptureAudioIn(void* userdata, Uint8* stream, int len);
@@ -359,6 +376,10 @@ class Render {
 
   int AudioDeviceInit();
   int AudioDeviceDestroy();
+  void HandleWindowsServiceIntegration();
+#if _WIN32
+  void ResetLocalWindowsServiceState(bool clear_pending_sas);
+#endif
 
  private:
   struct CDCache {
@@ -455,6 +476,7 @@ class Render {
   bool start_keyboard_capturer_ = false;
   bool show_cursor_ = false;
   bool keyboard_capturer_is_started_ = false;
+  bool keyboard_capturer_uses_sdl_events_ = false;
   bool foucs_on_main_window_ = false;
   bool focus_on_stream_window_ = false;
   bool main_window_minimized_ = false;
@@ -510,11 +532,19 @@ class Render {
   std::string controlled_remote_id_ = "";
   std::string focused_remote_id_ = "";
   std::string remote_client_id_ = "";
-  std::unordered_set<int> pressed_modifier_keys_;
+  std::unordered_set<int> pressed_keyboard_keys_;
-  std::mutex pressed_modifier_keys_mutex_;
+  std::mutex pressed_keyboard_keys_mutex_;
   SDL_Event last_mouse_event;
   SDL_AudioStream* output_stream_;
   uint32_t STREAM_REFRESH_EVENT = 0;
+#if _WIN32
+  std::atomic<bool> pending_windows_service_sas_{false};
+  bool local_service_status_received_ = false;
+  bool local_service_available_ = false;
+  std::string local_interactive_stage_;
+  uint32_t last_local_secure_input_block_log_tick_ = 0;
+  uint32_t last_windows_service_status_tick_ = 0;
+#endif
 
   // stream window render
   SDL_Window* stream_window_ = nullptr;

src/gui/render_callback.cpp

@@ -17,11 +17,234 @@
 #include "platform.h"
 #include "rd_log.h"
 #include "render.h"
+#if _WIN32
+#include "interactive_state.h"
+#include "service_host.h"
+#endif
 
 #define NV12_BUFFER_SIZE 1280 * 720 * 3 / 2
 
 namespace crossdesk {
 
+namespace {
+
+int TranslateSdlKeypadScancodeToVk(SDL_Scancode scancode) {
+  switch (scancode) {
+    case SDL_SCANCODE_NUMLOCKCLEAR:
+      return 0x90;
+    case SDL_SCANCODE_KP_ENTER:
+      return 0x0D;
+    case SDL_SCANCODE_KP_0:
+      return 0x60;
+    case SDL_SCANCODE_KP_1:
+      return 0x61;
+    case SDL_SCANCODE_KP_2:
+      return 0x62;
+    case SDL_SCANCODE_KP_3:
+      return 0x63;
+    case SDL_SCANCODE_KP_4:
+      return 0x64;
+    case SDL_SCANCODE_KP_5:
+      return 0x65;
+    case SDL_SCANCODE_KP_6:
+      return 0x66;
+    case SDL_SCANCODE_KP_7:
+      return 0x67;
+    case SDL_SCANCODE_KP_8:
+      return 0x68;
+    case SDL_SCANCODE_KP_9:
+      return 0x69;
+    case SDL_SCANCODE_KP_PERIOD:
+    case SDL_SCANCODE_KP_COMMA:
+      return 0x6E;
+    case SDL_SCANCODE_KP_DIVIDE:
+      return 0x6F;
+    case SDL_SCANCODE_KP_MULTIPLY:
+      return 0x6A;
+    case SDL_SCANCODE_KP_MINUS:
+      return 0x6D;
+    case SDL_SCANCODE_KP_PLUS:
+      return 0x6B;
+    case SDL_SCANCODE_KP_EQUALS:
+      return 0xBB;
+    default:
+      return -1;
+  }
+}
+
+int TranslateSdlKeyboardEventToVk(const SDL_KeyboardEvent& event) {
+  const int keypad_key_code = TranslateSdlKeypadScancodeToVk(event.scancode);
+  if (keypad_key_code >= 0) {
+    return keypad_key_code;
+  }
+
+  const int key = static_cast<int>(event.key);
+  if (key >= 'a' && key <= 'z') {
+    return key - 'a' + 0x41;
+  }
+  if (key >= 'A' && key <= 'Z') {
+    return key;
+  }
+  if (key >= '0' && key <= '9') {
+    return key;
+  }
+
+  switch (key) {
+    case ';':
+      return 0xBA;
+    case '\'':
+      return 0xDE;
+    case '`':
+      return 0xC0;
+    case ',':
+      return 0xBC;
+    case '.':
+      return 0xBE;
+    case '/':
+      return 0xBF;
+    case '\\':
+      return 0xDC;
+    case '[':
+      return 0xDB;
+    case ']':
+      return 0xDD;
+    case '-':
+      return 0xBD;
+    case '=':
+      return 0xBB;
+    default:
+      break;
+  }
+
+  switch (event.scancode) {
+    case SDL_SCANCODE_ESCAPE:
+      return 0x1B;
+    case SDL_SCANCODE_RETURN:
+      return 0x0D;
+    case SDL_SCANCODE_SPACE:
+      return 0x20;
+    case SDL_SCANCODE_BACKSPACE:
+      return 0x08;
+    case SDL_SCANCODE_TAB:
+      return 0x09;
+    case SDL_SCANCODE_PRINTSCREEN:
+      return 0x2C;
+    case SDL_SCANCODE_SCROLLLOCK:
+      return 0x91;
+    case SDL_SCANCODE_PAUSE:
+      return 0x13;
+    case SDL_SCANCODE_INSERT:
+      return 0x2D;
+    case SDL_SCANCODE_DELETE:
+      return 0x2E;
+    case SDL_SCANCODE_HOME:
+      return 0x24;
+    case SDL_SCANCODE_END:
+      return 0x23;
+    case SDL_SCANCODE_PAGEUP:
+      return 0x21;
+    case SDL_SCANCODE_PAGEDOWN:
+      return 0x22;
+    case SDL_SCANCODE_LEFT:
+      return 0x25;
+    case SDL_SCANCODE_RIGHT:
+      return 0x27;
+    case SDL_SCANCODE_UP:
+      return 0x26;
+    case SDL_SCANCODE_DOWN:
+      return 0x28;
+    case SDL_SCANCODE_F1:
+      return 0x70;
+    case SDL_SCANCODE_F2:
+      return 0x71;
+    case SDL_SCANCODE_F3:
+      return 0x72;
+    case SDL_SCANCODE_F4:
+      return 0x73;
+    case SDL_SCANCODE_F5:
+      return 0x74;
+    case SDL_SCANCODE_F6:
+      return 0x75;
+    case SDL_SCANCODE_F7:
+      return 0x76;
+    case SDL_SCANCODE_F8:
+      return 0x77;
+    case SDL_SCANCODE_F9:
+      return 0x78;
+    case SDL_SCANCODE_F10:
+      return 0x79;
+    case SDL_SCANCODE_F11:
+      return 0x7A;
+    case SDL_SCANCODE_F12:
+      return 0x7B;
+    case SDL_SCANCODE_CAPSLOCK:
+      return 0x14;
+    case SDL_SCANCODE_LSHIFT:
+      return 0xA0;
+    case SDL_SCANCODE_RSHIFT:
+      return 0xA1;
+    case SDL_SCANCODE_LCTRL:
+      return 0xA2;
+    case SDL_SCANCODE_RCTRL:
+      return 0xA3;
+    case SDL_SCANCODE_LALT:
+      return 0xA4;
+    case SDL_SCANCODE_RALT:
+      return 0xA5;
+    case SDL_SCANCODE_LGUI:
+      return 0x5B;
+    case SDL_SCANCODE_RGUI:
+      return 0x5C;
+    default:
+      return -1;
+  }
+}
+
+#if _WIN32
+constexpr uint32_t kSecureDesktopInputLogIntervalMs = 2000;
+
+bool BuildAbsoluteMousePosition(const std::vector<DisplayInfo>& displays,
+                                int display_index, float normalized_x,
+                                float normalized_y, int* absolute_x_out,
+                                int* absolute_y_out) {
+  if (absolute_x_out == nullptr || absolute_y_out == nullptr ||
+      display_index < 0 || display_index >= static_cast<int>(displays.size())) {
+    return false;
+  }
+
+  const DisplayInfo& display = displays[display_index];
+  if (display.width <= 0 || display.height <= 0) {
+    return false;
+  }
+
+  const float clamped_x = std::clamp(normalized_x, 0.0f, 1.0f);
+  const float clamped_y = std::clamp(normalized_y, 0.0f, 1.0f);
+  *absolute_x_out = static_cast<int>(clamped_x * display.width) + display.left;
+  *absolute_y_out = static_cast<int>(clamped_y * display.height) + display.top;
+  return true;
+}
+
+void LogSecureDesktopInputBlocked(uint32_t* last_tick, const char* side,
+                                  const char* stage) {
+  if (last_tick == nullptr) {
+    return;
+  }
+
+  const uint32_t now = static_cast<uint32_t>(SDL_GetTicks());
+  if (*last_tick != 0 && now - *last_tick < kSecureDesktopInputLogIntervalMs) {
+    return;
+  }
+
+  *last_tick = now;
+  LOG_WARN(
+      "{} secure-desktop input blocked, stage={}, normal SendInput path "
+      "cannot drive the Windows password UI",
+      side != nullptr ? side : "unknown", stage != nullptr ? stage : "");
+}
+#endif
+
+}  // namespace
+
 void Render::OnSignalMessageCb(const char* message, size_t size,
                                void* user_data) {
   Render* render = (Render*)user_data;
@@ -100,29 +323,29 @@ bool Render::IsModifierVkKey(int key_code) {
   }
 }
 
-void Render::UpdatePressedModifierState(int key_code, bool is_down) {
+void Render::TrackPressedKeyState(int key_code, bool is_down) {
-  if (!IsModifierVkKey(key_code)) {
+  if (!IsWaylandSession() && !IsModifierVkKey(key_code)) {
     return;
   }
 
-  std::lock_guard<std::mutex> lock(pressed_modifier_keys_mutex_);
+  std::lock_guard<std::mutex> lock(pressed_keyboard_keys_mutex_);
   if (is_down) {
-    pressed_modifier_keys_.insert(key_code);
+    pressed_keyboard_keys_.insert(key_code);
   } else {
-    pressed_modifier_keys_.erase(key_code);
+    pressed_keyboard_keys_.erase(key_code);
   }
 }
 
-void Render::ForceReleasePressedModifiers() {
+void Render::ForceReleasePressedKeys() {
   std::vector<int> pressed_keys;
   {
-    std::lock_guard<std::mutex> lock(pressed_modifier_keys_mutex_);
+    std::lock_guard<std::mutex> lock(pressed_keyboard_keys_mutex_);
-    if (pressed_modifier_keys_.empty()) {
+    if (pressed_keyboard_keys_.empty()) {
       return;
     }
-    pressed_keys.assign(pressed_modifier_keys_.begin(),
+    pressed_keys.assign(pressed_keyboard_keys_.begin(),
-                        pressed_modifier_keys_.end());
+                        pressed_keyboard_keys_.end());
-    pressed_modifier_keys_.clear();
+    pressed_keyboard_keys_.clear();
   }
 
   for (int key_code : pressed_keys) {
@@ -158,11 +381,28 @@ int Render::SendKeyCommand(int key_code, bool is_down) {
     }
   }
 
-  UpdatePressedModifierState(key_code, is_down);
+  TrackPressedKeyState(key_code, is_down);
 
   return 0;
 }
 
+int Render::ProcessKeyboardEvent(const SDL_Event& event) {
+  if (event.type != SDL_EVENT_KEY_DOWN && event.type != SDL_EVENT_KEY_UP) {
+    return -1;
+  }
+
+  if (event.type == SDL_EVENT_KEY_DOWN && event.key.repeat) {
+    return 0;
+  }
+
+  const int key_code = TranslateSdlKeyboardEventToVk(event.key);
+  if (key_code < 0) {
+    return 0;
+  }
+
+  return SendKeyCommand(key_code, event.type == SDL_EVENT_KEY_DOWN);
+}
+
 int Render::ProcessMouseEvent(const SDL_Event& event) {
   controlled_remote_id_ = "";
   RemoteAction remote_action;
@@ -240,7 +480,8 @@ int Render::ProcessMouseEvent(const SDL_Event& event) {
     }
 
     if (is_pointer_position_event && cursor_x >= render_rect.x &&
-        cursor_x <= render_rect.x + render_rect.w && cursor_y >= render_rect.y &&
+        cursor_x <= render_rect.x + render_rect.w &&
+        cursor_y >= render_rect.y &&
         cursor_y <= render_rect.y + render_rect.h) {
       controlled_remote_id_ = it.first;
       last_mouse_event.motion.x = cursor_x;
@@ -709,16 +950,31 @@ void Render::OnReceiveDataBufferCb(const char* data, size_t size,
   }
 
   std::string json_str(data, size);
-  RemoteAction remote_action;
+  RemoteAction remote_action{};
-
+  if (!remote_action.from_json(json_str)) {
-  try {
+    LOG_ERROR("Failed to parse RemoteAction JSON payload");
-    remote_action.from_json(json_str);
-  } catch (const std::exception& e) {
-    LOG_ERROR("Failed to parse RemoteAction JSON: {}", e.what());
     return;
   }
 
   std::string remote_id(user_id, user_id_size);
+  if (remote_action.type == ControlType::service_status) {
+    auto props_it = render->client_properties_.find(remote_id);
+    if (props_it != render->client_properties_.end()) {
+      render->ApplyRemoteServiceStatus(*props_it->second, remote_action.ss);
+    }
+    return;
+  }
+
+  if (remote_action.type == ControlType::service_command) {
+#if _WIN32
+    if (remote_action.c.flag == ServiceCommandFlag::send_sas) {
+      render->pending_windows_service_sas_.store(true,
+                                                 std::memory_order_relaxed);
+    }
+#endif
+    return;
+  }
+
   // std::shared_lock lock(render->client_properties_mutex_);
   if (remote_action.type == ControlType::host_infomation) {
     if (render->client_properties_.find(remote_id) !=
@@ -748,6 +1004,60 @@ void Render::OnReceiveDataBufferCb(const char* data, size_t size,
     }
   } else {
     // remote
+#if _WIN32
+    if (render->local_service_status_received_ &&
+        render->local_service_available_ &&
+        IsSecureDesktopInteractionRequired(render->local_interactive_stage_)) {
+      if (remote_action.type == ControlType::mouse) {
+        int absolute_x = 0;
+        int absolute_y = 0;
+        if (!BuildAbsoluteMousePosition(render->display_info_list_,
+                                        render->selected_display_,
+                                        remote_action.m.x, remote_action.m.y,
+                                        &absolute_x, &absolute_y)) {
+          LOG_WARN(
+              "Secure desktop mouse injection skipped, invalid display "
+              "mapping: display_index={}, x={}, y={}",
+              render->selected_display_, remote_action.m.x, remote_action.m.y);
+          return;
+        }
+
+        const std::string response = SendCrossDeskSecureDesktopMouseInput(
+            absolute_x, absolute_y, remote_action.m.s,
+            static_cast<int>(remote_action.m.flag), 1000);
+        auto json = nlohmann::json::parse(response, nullptr, false);
+        if (json.is_discarded() || !json.value("ok", false)) {
+          LogSecureDesktopInputBlocked(
+              &render->last_local_secure_input_block_log_tick_, "local",
+              render->local_interactive_stage_.c_str());
+          LOG_WARN(
+              "Secure desktop mouse injection failed, x={}, y={}, wheel={}, "
+              "flag={}, response={}",
+              absolute_x, absolute_y, remote_action.m.s,
+              static_cast<int>(remote_action.m.flag), response);
+        }
+        return;
+      }
+
+      if (remote_action.type == ControlType::keyboard) {
+        const int key_code = static_cast<int>(remote_action.k.key_value);
+        const bool is_down = remote_action.k.flag == KeyFlag::key_down;
+        const std::string response =
+            SendCrossDeskSecureDesktopKeyInput(key_code, is_down, 1000);
+        auto json = nlohmann::json::parse(response, nullptr, false);
+        if (json.is_discarded() || !json.value("ok", false)) {
+          LogSecureDesktopInputBlocked(
+              &render->last_local_secure_input_block_log_tick_, "local",
+              render->local_interactive_stage_.c_str());
+          LOG_WARN(
+              "Secure desktop keyboard injection failed, key_code={}, "
+              "is_down={}, response={}",
+              key_code, is_down, response);
+        }
+        return;
+      }
+    }
+#endif
     if (remote_action.type == ControlType::mouse && render->mouse_controller_) {
       render->mouse_controller_->SendMouseCommand(remote_action,
                                                   render->selected_display_);
@@ -841,6 +1151,7 @@ void Render::OnConnectionStatusCb(ConnectionStatus status, const char* user_id,
 
     switch (status) {
       case ConnectionStatus::Connected: {
+        render->ResetRemoteServiceStatus(*props);
         {
           RemoteAction remote_action;
           remote_action.i.display_num = render->display_info_list_.size();
@@ -904,6 +1215,7 @@ void Render::OnConnectionStatusCb(ConnectionStatus status, const char* user_id,
       case ConnectionStatus::Closed: {
         props->connection_established_ = false;
         props->enable_mouse_control_ = false;
+        render->ResetRemoteServiceStatus(*props);
 
         {
           std::lock_guard<std::mutex> lock(props->video_frame_mutex_);
@@ -954,6 +1266,9 @@ void Render::OnConnectionStatusCb(ConnectionStatus status, const char* user_id,
 
     switch (status) {
       case ConnectionStatus::Connected: {
+#if _WIN32
+        render->last_windows_service_status_tick_ = 0;
+#endif
         {
           RemoteAction remote_action;
           remote_action.i.display_num = render->display_info_list_.size();
@@ -1028,8 +1343,9 @@ void Render::OnConnectionStatusCb(ConnectionStatus status, const char* user_id,
             // Keep Wayland capture session warm to avoid black screen on
             // subsequent reconnects.
             render->start_screen_capturer_ = true;
-            LOG_INFO("Keeping Wayland screen capturer running after "
+            LOG_INFO(
-                     "disconnect to preserve reconnect stability");
+                "Keeping Wayland screen capturer running after "
+                "disconnect to preserve reconnect stability");
           } else {
             render->start_screen_capturer_ = false;
           }

src/gui/windows/control_window.cpp

@@ -257,4 +257,3 @@ int Render::ControlWindow(std::shared_ptr<SubStreamWindowProperties>& props) {
   return 0;
 }
 }  // namespace crossdesk
-

src/screen_capturer/linux/screen_capturer_x11.cpp

@@ -122,9 +122,8 @@ int ScreenCapturerX11::Init(const int fps, cb_desktop_data cb) {
   height_ = attr.height;
 
   if ((width_ & 1) != 0 || (height_ & 1) != 0) {
-    LOG_WARN(
+    LOG_WARN("X11 root size {}x{} is not even, aligning down to {}x{} for NV12",
-        "X11 root size {}x{} is not even, aligning down to {}x{} for NV12",
+             width_, height_, width_ & ~1, height_ & ~1);
-        width_, height_, width_ & ~1, height_ & ~1);
     width_ &= ~1;
     height_ &= ~1;
   }
@@ -183,8 +182,9 @@ int ScreenCapturerX11::Start(bool show_cursor) {
         OnFrame();
       }
 
-      const auto elapsed = std::chrono::duration_cast<std::chrono::milliseconds>(
+      const auto elapsed =
-          clock::now() - frame_start);
+          std::chrono::duration_cast<std::chrono::milliseconds>(clock::now() -
+                                                                frame_start);
       if (elapsed < frame_interval) {
         std::this_thread::sleep_for(frame_interval - elapsed);
       }
@@ -282,21 +282,17 @@ void ScreenCapturerX11::OnFrame() {
     }
   }
 
-  bool needs_copy = image->bytes_per_line != width_ * 4;
+  if (image->bits_per_pixel != 32 || image->bytes_per_line <= 0) {
-  std::vector<uint8_t> argb_buf;
+    LOG_WARN(
-  uint8_t* src_argb = nullptr;
+        "Unsupported X11 image layout: bits_per_pixel={}, bytes_per_line={}",
-
+        image->bits_per_pixel, image->bytes_per_line);
-  if (needs_copy) {
+    XDestroyImage(image);
-    argb_buf.resize(width_ * height_ * 4);
+    return;
-    for (int y = 0; y < height_; ++y) {
-      memcpy(&argb_buf[y * width_ * 4], image->data + y * image->bytes_per_line,
-             width_ * 4);
-    }
-    src_argb = argb_buf.data();
-  } else {
-    src_argb = reinterpret_cast<uint8_t*>(image->data);
   }
 
+  const uint8_t* src_argb = reinterpret_cast<const uint8_t*>(image->data);
+  const int src_stride_argb = image->bytes_per_line;
+
   const size_t y_size =
       static_cast<size_t>(width_) * static_cast<size_t>(height_);
   const size_t uv_size = y_size / 2;
@@ -307,8 +303,20 @@ void ScreenCapturerX11::OnFrame() {
     uv_plane_.resize(uv_size);
   }
 
-  libyuv::ARGBToNV12(src_argb, width_ * 4, y_plane_.data(), width_,
+  const int convert_ret =
-                     uv_plane_.data(), width_, width_, height_);
+      use_abgr_to_nv12_
+          ? libyuv::ABGRToNV12(src_argb, src_stride_argb, y_plane_.data(),
+                               width_, uv_plane_.data(), width_, width_,
+                               height_)
+          : libyuv::ARGBToNV12(src_argb, src_stride_argb, y_plane_.data(),
+                               width_, uv_plane_.data(), width_, width_,
+                               height_);
+  if (convert_ret != 0) {
+    LOG_WARN("X11 {} failed: {}",
+             use_abgr_to_nv12_ ? "ABGRToNV12" : "ARGBToNV12", convert_ret);
+    XDestroyImage(image);
+    return;
+  }
 
   std::vector<uint8_t> nv12;
   nv12.reserve(y_plane_.size() + uv_plane_.size());
@@ -416,16 +424,18 @@ bool ScreenCapturerX11::ProbeCapture() {
     x11_error = trap.SyncAndGetError();
   }
 
-  if (probe_image) {
-    XDestroyImage(probe_image);
-  }
-
   if (x11_error != 0 || !probe_image) {
     LOG_WARN("X11 probe XGetImage failed: x11_error={}, image={}", x11_error,
              probe_image ? "valid" : "null");
     return false;
   }
 
+  const bool red_in_low_byte = (probe_image->red_mask & 0x000000FFu) != 0;
+  const bool blue_in_low_byte = (probe_image->blue_mask & 0x000000FFu) != 0;
+  use_abgr_to_nv12_ = red_in_low_byte && !blue_in_low_byte;
+
+  XDestroyImage(probe_image);
+
   return true;
 }
 }  // namespace crossdesk

src/screen_capturer/linux/screen_capturer_x11.h

@@ -71,6 +71,7 @@ class ScreenCapturerX11 : public ScreenCapturer {
   cb_desktop_data callback_;
   std::vector<DisplayInfo> display_info_list_;
   int capture_error_count_ = 0;
+  bool use_abgr_to_nv12_ = false;
 
   std::vector<uint8_t> y_plane_;
   std::vector<uint8_t> uv_plane_;

src/screen_capturer/windows/screen_capturer_win.cpp

@@ -2,22 +2,49 @@
 
 #include <Windows.h>
 
+#include <chrono>
 #include <cmath>
+#include <cstring>
 #include <filesystem>
 #include <memory>
+#include <nlohmann/json.hpp>
+#include <sstream>
 #include <string>
+#include <thread>
 #include <utility>
 #include <vector>
 
+#include "interactive_state.h"
 #include "rd_log.h"
 #include "screen_capturer_dxgi.h"
 #include "screen_capturer_gdi.h"
+#include "service_host.h"
+#include "session_helper_shared.h"
 #include "wgc_plugin_api.h"
 
 namespace crossdesk {
 
 namespace {
 
+using Json = nlohmann::json;
+
+constexpr DWORD kSecureDesktopStatusIntervalMs = 250;
+constexpr DWORD kSecureDesktopStatusPipeTimeoutMs = 150;
+constexpr DWORD kSecureDesktopHelperPipeTimeoutMs = 120;
+constexpr DWORD kSecureDesktopTransientErrorGraceMs = 1500;
+constexpr DWORD kSecureDesktopTransientErrorLogIntervalMs = 5000;
+constexpr int kSecureDesktopCaptureMinIntervalMs = 100;
+
+struct SecureDesktopServiceStatus {
+  bool service_available = false;
+  bool capture_active = false;
+  bool helper_running = false;
+  DWORD active_session_id = 0xFFFFFFFF;
+  DWORD error_code = 0;
+  std::string interactive_stage;
+  std::string error;
+};
+
 class WgcPluginCapturer final : public ScreenCapturer {
  public:
   using CreateFn = ScreenCapturer* (*)();
@@ -101,6 +128,213 @@ class WgcPluginCapturer final : public ScreenCapturer {
   DestroyFn destroy_fn_ = nullptr;
 };
 
+std::string BuildSecureCaptureCommand(int left, int top, int width, int height,
+                                      bool show_cursor) {
+  std::ostringstream stream;
+  stream << kCrossDeskSecureInputCaptureCommandPrefix << left << ":" << top
+         << ":" << width << ":" << height << ":" << (show_cursor ? 1 : 0);
+  return stream.str();
+}
+
+std::string ExtractPipeTextResponse(const std::vector<uint8_t>& response) {
+  if (response.empty() || response.front() != '{') {
+    return "<non-text-response>";
+  }
+  return std::string(response.begin(), response.end());
+}
+
+bool IsTransientSecureDesktopFrameError(const std::string& error_message) {
+  return error_message.rfind("pipe_unavailable:", 0) == 0 ||
+         error_message.find("\"error\":\"bitblt_failed\"") != std::string::npos;
+}
+
+bool ReadPipeMessage(HANDLE pipe, std::vector<uint8_t>* response_out,
+                     DWORD* error_code_out = nullptr) {
+  if (response_out == nullptr) {
+    return false;
+  }
+
+  response_out->clear();
+  if (error_code_out != nullptr) {
+    *error_code_out = 0;
+  }
+
+  std::vector<uint8_t> chunk(64 * 1024);
+  while (true) {
+    DWORD bytes_read = 0;
+    if (ReadFile(pipe, chunk.data(), static_cast<DWORD>(chunk.size()),
+                 &bytes_read, nullptr)) {
+      response_out->insert(response_out->end(), chunk.begin(),
+                           chunk.begin() + bytes_read);
+      return true;
+    }
+
+    const DWORD error = GetLastError();
+    response_out->insert(response_out->end(), chunk.begin(),
+                         chunk.begin() + bytes_read);
+    if (error == ERROR_MORE_DATA) {
+      continue;
+    }
+
+    if (error_code_out != nullptr) {
+      *error_code_out = error;
+    }
+    return false;
+  }
+}
+
+bool ParseSecureDesktopFrameResponse(const std::vector<uint8_t>& response,
+                                     std::vector<uint8_t>* nv12_frame_out,
+                                     int* width_out, int* height_out,
+                                     std::string* error_out) {
+  if (nv12_frame_out == nullptr || width_out == nullptr ||
+      height_out == nullptr) {
+    return false;
+  }
+
+  if (response.size() < sizeof(CrossDeskSecureDesktopFrameHeader)) {
+    if (error_out != nullptr) {
+      *error_out = ExtractPipeTextResponse(response);
+    }
+    return false;
+  }
+
+  CrossDeskSecureDesktopFrameHeader header{};
+  std::memcpy(&header, response.data(), sizeof(header));
+  if (header.magic != kCrossDeskSecureDesktopFrameMagic ||
+      header.version != kCrossDeskSecureDesktopFrameVersion) {
+    if (error_out != nullptr) {
+      *error_out = ExtractPipeTextResponse(response);
+    }
+    return false;
+  }
+
+  const size_t expected_size = sizeof(header) + header.payload_size;
+  if (expected_size != response.size()) {
+    if (error_out != nullptr) {
+      *error_out = "<invalid-frame-size>";
+    }
+    return false;
+  }
+
+  *width_out = static_cast<int>(header.width);
+  *height_out = static_cast<int>(header.height);
+  nv12_frame_out->assign(response.begin() + sizeof(header), response.end());
+  return true;
+}
+
+bool QuerySecureDesktopServiceStatus(SecureDesktopServiceStatus* status) {
+  if (status == nullptr) {
+    return false;
+  }
+
+  *status = {};
+  const std::string response =
+      QueryCrossDeskService("status", kSecureDesktopStatusPipeTimeoutMs);
+  Json json = Json::parse(response, nullptr, false);
+  if (json.is_discarded() || !json.is_object()) {
+    status->error = "invalid_service_status_json";
+    return false;
+  }
+
+  status->service_available = json.value("ok", false);
+  if (!status->service_available) {
+    status->error = json.value("error", std::string("service_unavailable"));
+    status->error_code = json.value("code", 0u);
+    return true;
+  }
+
+  if (ShouldNormalizeUnlockToUserDesktop(
+          json.value("interactive_lock_screen_visible", false),
+          json.value("interactive_stage", std::string()),
+          json.value("session_locked", false),
+          json.value("interactive_logon_ui_visible", false),
+          json.value("interactive_secure_desktop_active",
+                     json.value("secure_desktop_active", false)),
+          json.value("credential_ui_visible", false),
+          json.value("password_box_visible", false),
+          json.value("unlock_ui_visible", false),
+          json.value("last_session_event", std::string()))) {
+    status->active_session_id = json.value("active_session_id", 0xFFFFFFFFu);
+    status->interactive_stage = "user-desktop";
+    status->capture_active = false;
+    return true;
+  }
+
+  status->active_session_id = json.value("active_session_id", 0xFFFFFFFFu);
+  status->helper_running = json.value("secure_input_helper_running", false);
+  status->interactive_stage = json.value("interactive_stage", std::string());
+  const bool secure_desktop_active =
+      json.value("interactive_secure_desktop_active",
+                 json.value("secure_desktop_active", false));
+  status->capture_active =
+      status->active_session_id != 0xFFFFFFFF &&
+      (secure_desktop_active ||
+       IsSecureDesktopInteractionRequired(status->interactive_stage));
+  return true;
+}
+
+bool QuerySecureDesktopHelperFrame(DWORD session_id, int left, int top,
+                                   int width, int height, bool show_cursor,
+                                   std::vector<uint8_t>* nv12_frame_out,
+                                   int* captured_width_out,
+                                   int* captured_height_out,
+                                   std::string* error_out) {
+  if (nv12_frame_out == nullptr || captured_width_out == nullptr ||
+      captured_height_out == nullptr) {
+    return false;
+  }
+
+  const std::wstring pipe_name =
+      GetCrossDeskSecureInputHelperPipeName(session_id);
+  if (!WaitNamedPipeW(pipe_name.c_str(), kSecureDesktopHelperPipeTimeoutMs)) {
+    if (error_out != nullptr) {
+      *error_out = "pipe_unavailable:" + std::to_string(GetLastError());
+    }
+    return false;
+  }
+
+  HANDLE pipe = CreateFileW(pipe_name.c_str(), GENERIC_READ | GENERIC_WRITE, 0,
+                            nullptr, OPEN_EXISTING, 0, nullptr);
+  if (pipe == INVALID_HANDLE_VALUE) {
+    if (error_out != nullptr) {
+      *error_out = "pipe_connect_failed:" + std::to_string(GetLastError());
+    }
+    return false;
+  }
+
+  DWORD pipe_mode = PIPE_READMODE_MESSAGE;
+  SetNamedPipeHandleState(pipe, &pipe_mode, nullptr, nullptr);
+
+  const std::string command =
+      BuildSecureCaptureCommand(left, top, width, height, show_cursor);
+  DWORD bytes_written = 0;
+  if (!WriteFile(pipe, command.data(), static_cast<DWORD>(command.size()),
+                 &bytes_written, nullptr)) {
+    const DWORD error = GetLastError();
+    CloseHandle(pipe);
+    if (error_out != nullptr) {
+      *error_out = "pipe_write_failed:" + std::to_string(error);
+    }
+    return false;
+  }
+
+  std::vector<uint8_t> response;
+  DWORD read_error = 0;
+  const bool read_ok = ReadPipeMessage(pipe, &response, &read_error);
+  CloseHandle(pipe);
+  if (!read_ok) {
+    if (error_out != nullptr) {
+      *error_out = "pipe_read_failed:" + std::to_string(read_error);
+    }
+    return false;
+  }
+
+  return ParseSecureDesktopFrameResponse(response, nv12_frame_out,
+                                         captured_width_out,
+                                         captured_height_out, error_out);
+}
+
 }  // namespace
 
 ScreenCapturerWin::ScreenCapturerWin() {}
@@ -111,6 +345,10 @@ int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
   cb_orig_ = cb;
   cb_ = [this](unsigned char* data, int size, int w, int h,
                const char* display_name) {
+    if (secure_desktop_capture_active_.load(std::memory_order_relaxed)) {
+      return;
+    }
+
     std::string mapped_name;
     {
       std::lock_guard<std::mutex> lock(alias_mutex_);
@@ -137,6 +375,8 @@ int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
   if (ret == 0) {
     LOG_INFO("Windows capturer: using WGC plugin");
     BuildCanonicalFromImpl();
+    monitor_index_.store(0, std::memory_order_relaxed);
+    initial_monitor_index_ = 0;
     return 0;
   }
 
@@ -150,6 +390,8 @@ int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
   if (ret == 0) {
     LOG_INFO("Windows capturer: using DXGI Desktop Duplication");
     BuildCanonicalFromImpl();
+    monitor_index_.store(0, std::memory_order_relaxed);
+    initial_monitor_index_ = 0;
     return 0;
   }
 
@@ -162,6 +404,8 @@ int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
   if (ret == 0) {
     LOG_INFO("Windows capturer: using GDI BitBlt");
     BuildCanonicalFromImpl();
+    monitor_index_.store(0, std::memory_order_relaxed);
+    initial_monitor_index_ = 0;
     return 0;
   }
 
@@ -171,6 +415,8 @@ int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
 }
 
 int ScreenCapturerWin::Destroy() {
+  Stop();
+  paused_.store(false, std::memory_order_relaxed);
   if (impl_) {
     impl_->Destroy();
     impl_.reset();
@@ -187,67 +433,100 @@ int ScreenCapturerWin::Destroy() {
 
 int ScreenCapturerWin::Start(bool show_cursor) {
   if (!impl_) return -1;
+  if (running_.load(std::memory_order_relaxed)) {
+    return 0;
+  }
+
+  show_cursor_.store(show_cursor, std::memory_order_relaxed);
+  paused_.store(false, std::memory_order_relaxed);
+
   int ret = impl_->Start(show_cursor);
-  if (ret == 0) return 0;
+  if (ret != 0) {
+    LOG_WARN("Windows capturer: Start failed (ret={}), trying fallback", ret);
 
-  LOG_WARN("Windows capturer: Start failed (ret={}), trying fallback", ret);
+    auto try_init_start = [&](std::unique_ptr<ScreenCapturer> cand) -> bool {
+      int r = cand->Init(fps_, cb_);
+      if (r != 0) return false;
+      int s = cand->Start(show_cursor);
+      if (s == 0) {
+        impl_ = std::move(cand);
+        impl_is_wgc_plugin_ = false;
+        RebuildAliasesFromImpl();
+        return true;
+      }
+      return false;
+    };
 
-  auto try_init_start = [&](std::unique_ptr<ScreenCapturer> cand) -> bool {
+    bool fallback_started = false;
-    int r = cand->Init(fps_, cb_);
+    if (impl_is_wgc_plugin_) {
-    if (r != 0) return false;
+      if (try_init_start(std::make_unique<ScreenCapturerDxgi>())) {
-    int s = cand->Start(show_cursor);
+        LOG_INFO("Windows capturer: fallback to DXGI");
-    if (s == 0) {
+        fallback_started = true;
-      impl_ = std::move(cand);
+      } else if (try_init_start(std::make_unique<ScreenCapturerGdi>())) {
-      impl_is_wgc_plugin_ = false;
+        LOG_INFO("Windows capturer: fallback to GDI");
-      RebuildAliasesFromImpl();
+        fallback_started = true;
-      return true;
+      }
+    } else if (dynamic_cast<ScreenCapturerDxgi*>(impl_.get())) {
+      if (try_init_start(std::make_unique<ScreenCapturerGdi>())) {
+        LOG_INFO("Windows capturer: fallback to GDI");
+        fallback_started = true;
+      }
     }
-    return false;
-  };
 
-  if (impl_is_wgc_plugin_) {
+    if (!fallback_started) {
-    if (try_init_start(std::make_unique<ScreenCapturerDxgi>())) {
+      LOG_ERROR("Windows capturer: all fallbacks failed to start");
-      LOG_INFO("Windows capturer: fallback to DXGI");
+      return ret;
-      return 0;
-    }
-    if (try_init_start(std::make_unique<ScreenCapturerGdi>())) {
-      LOG_INFO("Windows capturer: fallback to GDI");
-      return 0;
-    }
-  } else if (dynamic_cast<ScreenCapturerDxgi*>(impl_.get())) {
-    if (try_init_start(std::make_unique<ScreenCapturerGdi>())) {
-      LOG_INFO("Windows capturer: fallback to GDI");
-      return 0;
     }
   }
 
-  LOG_ERROR("Windows capturer: all fallbacks failed to start");
+  running_.store(true, std::memory_order_relaxed);
-  return ret;
+  secure_desktop_capture_active_.store(false, std::memory_order_relaxed);
+  if (!secure_capture_thread_.joinable()) {
+    secure_capture_thread_ =
+        std::thread([this]() { SecureDesktopCaptureLoop(); });
+  }
+  return 0;
 }
 
 int ScreenCapturerWin::Stop() {
-  if (!impl_) return 0;
+  running_.store(false, std::memory_order_relaxed);
-  return impl_->Stop();
+  secure_desktop_capture_active_.store(false, std::memory_order_relaxed);
+  int ret = 0;
+  if (impl_) {
+    ret = impl_->Stop();
+  }
+  StopSecureCaptureThread();
+  return ret;
 }
 
 int ScreenCapturerWin::Pause(int monitor_index) {
+  paused_.store(true, std::memory_order_relaxed);
   if (!impl_) return -1;
   return impl_->Pause(monitor_index);
 }
 
 int ScreenCapturerWin::Resume(int monitor_index) {
+  paused_.store(false, std::memory_order_relaxed);
   if (!impl_) return -1;
   return impl_->Resume(monitor_index);
 }
 
 int ScreenCapturerWin::SwitchTo(int monitor_index) {
   if (!impl_) return -1;
-  return impl_->SwitchTo(monitor_index);
+  const int ret = impl_->SwitchTo(monitor_index);
+  if (ret == 0) {
+    monitor_index_.store(monitor_index, std::memory_order_relaxed);
+  }
+  return ret;
 }
 
 int ScreenCapturerWin::ResetToInitialMonitor() {
   if (!impl_) return -1;
-  return impl_->ResetToInitialMonitor();
+  const int ret = impl_->ResetToInitialMonitor();
+  if (ret == 0) {
+    monitor_index_.store(initial_monitor_index_, std::memory_order_relaxed);
+  }
+  return ret;
 }
 
 std::vector<DisplayInfo> ScreenCapturerWin::GetDisplayInfoList() {
@@ -297,4 +576,173 @@ void ScreenCapturerWin::RebuildAliasesFromImpl() {
   }
 }
 
+void ScreenCapturerWin::StopSecureCaptureThread() {
+  if (secure_capture_thread_.joinable()) {
+    secure_capture_thread_.join();
+  }
+}
+
+bool ScreenCapturerWin::GetCurrentCaptureRegion(int* left, int* top, int* width,
+                                                int* height,
+                                                std::string* display_name) {
+  if (left == nullptr || top == nullptr || width == nullptr ||
+      height == nullptr || display_name == nullptr) {
+    return false;
+  }
+
+  std::lock_guard<std::mutex> lock(alias_mutex_);
+  if (canonical_displays_.empty()) {
+    return false;
+  }
+
+  int current_monitor = monitor_index_.load(std::memory_order_relaxed);
+  if (current_monitor < 0 ||
+      current_monitor >= static_cast<int>(canonical_displays_.size())) {
+    current_monitor = 0;
+  }
+
+  const auto& display = canonical_displays_[current_monitor];
+  const int capture_width = display.width & ~1;
+  const int capture_height = display.height & ~1;
+  if (capture_width <= 0 || capture_height <= 0) {
+    return false;
+  }
+
+  *left = display.left;
+  *top = display.top;
+  *width = capture_width;
+  *height = capture_height;
+  *display_name = display.name;
+  return true;
+}
+
+void ScreenCapturerWin::SecureDesktopCaptureLoop() {
+  const int frame_interval_ms =
+      fps_ > 0 ? (std::max)(kSecureDesktopCaptureMinIntervalMs, 1000 / fps_)
+               : kSecureDesktopCaptureMinIntervalMs;
+  ULONGLONG last_status_tick = 0;
+  ULONGLONG last_error_tick = 0;
+  bool last_capture_active = false;
+  bool last_service_available = true;
+  std::string last_stage;
+  std::string last_service_error;
+  ULONGLONG capture_stage_started_tick = 0;
+  SecureDesktopServiceStatus status;
+  std::vector<uint8_t> secure_frame;
+
+  while (running_.load(std::memory_order_relaxed)) {
+    if (paused_.load(std::memory_order_relaxed)) {
+      std::this_thread::sleep_for(std::chrono::milliseconds(10));
+      continue;
+    }
+
+    const ULONGLONG now = GetTickCount64();
+    if (last_status_tick == 0 ||
+        now - last_status_tick >= kSecureDesktopStatusIntervalMs) {
+      SecureDesktopServiceStatus latest_status;
+      const bool status_ok = QuerySecureDesktopServiceStatus(&latest_status);
+      status = latest_status;
+      if (status_ok) {
+        const bool service_changed =
+            status.service_available != last_service_available;
+        const bool service_error_changed =
+            !status.service_available && status.error != last_service_error;
+        if (service_changed || service_error_changed) {
+          if (status.service_available) {
+            LOG_INFO(
+                "Windows capturer secure desktop service available, polling "
+                "session_id={}",
+                status.active_session_id);
+          } else {
+            LOG_WARN(
+                "Windows capturer secure desktop service unavailable: "
+                "error={}, code={}",
+                status.error, status.error_code);
+          }
+          last_service_available = status.service_available;
+          last_service_error = status.error;
+        }
+      } else if (last_service_available ||
+                 last_service_error != "invalid_service_status_json") {
+        LOG_WARN("Windows capturer secure desktop service status query failed");
+        last_service_available = false;
+        last_service_error = "invalid_service_status_json";
+      }
+
+      secure_desktop_capture_active_.store(status.capture_active,
+                                           std::memory_order_relaxed);
+      if (status.capture_active != last_capture_active ||
+          status.interactive_stage != last_stage) {
+        capture_stage_started_tick = now;
+        LOG_INFO(
+            "Windows capturer secure desktop state: active={}, stage='{}', "
+            "session_id={}",
+            status.capture_active, status.interactive_stage,
+            status.active_session_id);
+        last_capture_active = status.capture_active;
+        last_stage = status.interactive_stage;
+      }
+      last_status_tick = now;
+    }
+
+    if (!status.capture_active || status.active_session_id == 0xFFFFFFFF) {
+      std::this_thread::sleep_for(
+          std::chrono::milliseconds(status.service_available ? 50 : 200));
+      continue;
+    }
+
+    if (!status.helper_running) {
+      std::this_thread::sleep_for(std::chrono::milliseconds(30));
+      continue;
+    }
+
+    int left = 0;
+    int top = 0;
+    int width = 0;
+    int height = 0;
+    std::string display_name;
+    if (!GetCurrentCaptureRegion(&left, &top, &width, &height, &display_name)) {
+      std::this_thread::sleep_for(std::chrono::milliseconds(100));
+      continue;
+    }
+
+    int captured_width = 0;
+    int captured_height = 0;
+    std::string error_message;
+    if (QuerySecureDesktopHelperFrame(
+            status.active_session_id, left, top, width, height,
+            show_cursor_.load(std::memory_order_relaxed), &secure_frame,
+            &captured_width, &captured_height, &error_message)) {
+      if (cb_orig_ && !secure_frame.empty()) {
+        cb_orig_(secure_frame.data(), static_cast<int>(secure_frame.size()),
+                 captured_width, captured_height, display_name.c_str());
+      }
+    } else {
+      const bool transient_error =
+          IsTransientSecureDesktopFrameError(error_message);
+      const bool in_grace_period = capture_stage_started_tick != 0 &&
+                                   now - capture_stage_started_tick <
+                                       kSecureDesktopTransientErrorGraceMs;
+      const DWORD log_interval =
+          transient_error ? kSecureDesktopTransientErrorLogIntervalMs : 1000;
+      if (transient_error && in_grace_period) {
+        std::this_thread::sleep_for(
+            std::chrono::milliseconds(frame_interval_ms));
+        continue;
+      }
+      if (now - last_error_tick >= log_interval) {
+        LOG_WARN(
+            "Windows capturer secure desktop frame query failed, stage='{}', "
+            "session_id={}, error={}",
+            status.interactive_stage, status.active_session_id, error_message);
+        last_error_tick = now;
+      }
+    }
+
+    std::this_thread::sleep_for(std::chrono::milliseconds(frame_interval_ms));
+  }
+
+  secure_desktop_capture_active_.store(false, std::memory_order_relaxed);
+}
+
 }  // namespace crossdesk

src/screen_capturer/windows/screen_capturer_win.h

@@ -7,8 +7,12 @@
 #ifndef _SCREEN_CAPTURER_WIN_H_
 #define _SCREEN_CAPTURER_WIN_H_
 
+#include <Windows.h>
+
+#include <atomic>
 #include <memory>
 #include <mutex>
+#include <thread>
 #include <unordered_map>
 #include <unordered_set>
 #include <vector>
@@ -48,9 +52,20 @@ class ScreenCapturerWin : public ScreenCapturer {
   std::mutex alias_mutex_;
   std::vector<DisplayInfo> canonical_displays_;
   std::unordered_set<std::string> canonical_labels_;
+  std::atomic<bool> running_{false};
+  std::atomic<bool> paused_{false};
+  std::atomic<bool> show_cursor_{true};
+  std::atomic<int> monitor_index_{0};
+  int initial_monitor_index_ = 0;
+  std::atomic<bool> secure_desktop_capture_active_{false};
+  std::thread secure_capture_thread_;
 
   void BuildCanonicalFromImpl();
   void RebuildAliasesFromImpl();
+  void StopSecureCaptureThread();
+  void SecureDesktopCaptureLoop();
+  bool GetCurrentCaptureRegion(int* left, int* top, int* width, int* height,
+                               std::string* display_name);
 };
 }  // namespace crossdesk
 #endif

src/service/windows/interactive_state.h

@@ -0,0 +1,41 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-04-21
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _INTERACTIVE_STATE_H_
+#define _INTERACTIVE_STATE_H_
+
+#include <string>
+
+namespace crossdesk {
+
+inline bool IsSecureDesktopInteractionRequired(
+    const std::string& interactive_stage) {
+  return interactive_stage == "credential-ui" ||
+         interactive_stage == "secure-desktop";
+}
+
+inline bool ShouldNormalizeUnlockToUserDesktop(
+    bool interactive_lock_screen_visible, const std::string& interactive_stage,
+    bool session_locked, bool interactive_logon_ui_visible,
+    bool interactive_secure_desktop_active, bool credential_ui_visible,
+    bool password_box_visible, bool unlock_ui_visible,
+    const std::string& last_session_event) {
+  if (!interactive_lock_screen_visible && interactive_stage != "lock-screen") {
+    return false;
+  }
+
+  if (session_locked || interactive_logon_ui_visible ||
+      interactive_secure_desktop_active || credential_ui_visible ||
+      password_box_visible || unlock_ui_visible) {
+    return false;
+  }
+
+  return last_session_event != "session-lock";
+}
+
+}  // namespace crossdesk
+
+#endif

src/service/windows/main.cpp

@@ -0,0 +1,87 @@
+#include <Windows.h>
+
+#include <iostream>
+#include <string>
+
+#include "service_host.h"
+
+namespace {
+
+std::wstring GetExecutablePath() {
+  wchar_t path[MAX_PATH] = {0};
+  DWORD length = GetModuleFileNameW(nullptr, path, MAX_PATH);
+  if (length == 0 || length >= MAX_PATH) {
+    return L"";
+  }
+  return std::wstring(path, length);
+}
+
+void PrintUsage() {
+  std::cout
+      << "CrossDesk Windows service skeleton\n"
+      << "  --service    Run under the Windows Service Control Manager\n"
+      << "  --console    Run the service loop in console mode\n"
+      << "  --install    Install the service for the current executable\n"
+      << "  --uninstall  Remove the installed service\n"
+      << "  --start      Start the installed service\n"
+      << "  --stop       Stop the installed service\n"
+      << "  --sas        Ask the service to send Secure Attention Sequence\n"
+      << "  --ping       Ping the running service over named pipe IPC\n"
+      << "  --status     Query runtime status over named pipe IPC\n";
+}
+
+}  // namespace
+
+int main(int argc, char* argv[]) {
+  crossdesk::CrossDeskServiceHost host;
+
+  if (argc <= 1) {
+    PrintUsage();
+    return 0;
+  }
+
+  std::string command = argv[1];
+  if (command == "--service") {
+    return host.RunAsService();
+  }
+  if (command == "--console") {
+    return host.RunInConsole();
+  }
+  if (command == "--install") {
+    std::wstring executable_path = GetExecutablePath();
+    bool success = !executable_path.empty() &&
+                   crossdesk::InstallCrossDeskService(executable_path);
+    std::cout << (success ? "install ok" : "install failed") << std::endl;
+    return success ? 0 : 1;
+  }
+  if (command == "--uninstall") {
+    bool success = crossdesk::UninstallCrossDeskService();
+    std::cout << (success ? "uninstall ok" : "uninstall failed") << std::endl;
+    return success ? 0 : 1;
+  }
+  if (command == "--start") {
+    bool success = crossdesk::StartCrossDeskService();
+    std::cout << (success ? "start ok" : "start failed") << std::endl;
+    return success ? 0 : 1;
+  }
+  if (command == "--stop") {
+    bool success = crossdesk::StopCrossDeskService();
+    std::cout << (success ? "stop ok" : "stop failed") << std::endl;
+    return success ? 0 : 1;
+  }
+  if (command == "--sas") {
+    std::cout << crossdesk::QueryCrossDeskService("sas") << std::endl;
+    return 0;
+  }
+  if (command == "--ping") {
+    std::cout << crossdesk::QueryCrossDeskService("ping") << std::endl;
+    return 0;
+  }
+  if (command == "--status") {
+    std::cout << crossdesk::QueryCrossDeskService("status") << std::endl;
+    return 0;
+  }
+
+  PrintUsage();
+  return 1;
+}

src/service/windows/service_host.h

@@ -0,0 +1,148 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-04-21
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _SERVICE_HOST_H_
+#define _SERVICE_HOST_H_
+
+#include <Windows.h>
+
+#include <mutex>
+#include <string>
+#include <thread>
+
+namespace crossdesk {
+
+inline constexpr wchar_t kCrossDeskServiceName[] = L"CrossDeskService";
+inline constexpr wchar_t kCrossDeskServiceDisplayName[] = L"CrossDesk Service";
+inline constexpr wchar_t kCrossDeskServicePipeName[] =
+    L"\\\\.\\pipe\\CrossDeskService";
+
+class CrossDeskServiceHost {
+ public:
+  CrossDeskServiceHost();
+  ~CrossDeskServiceHost();
+
+  int RunAsService();
+  int RunInConsole();
+
+ private:
+  int RunServiceLoop(bool as_service);
+  int InitializeRuntime();
+  void ShutdownRuntime();
+  void RequestStop();
+  void ClientProcessMonitorLoop();
+  void ReportServiceStatus(DWORD current_state, DWORD win32_exit_code,
+                           DWORD wait_hint);
+  void IpcServerLoop();
+  void RefreshSessionState();
+  void EnsureSessionHelper();
+  void ReapSessionHelper();
+  void StopSessionHelper();
+  bool LaunchSessionHelper(DWORD session_id);
+  void ReapSecureInputHelper();
+  void StopSecureInputHelper();
+  bool LaunchSecureInputHelper(DWORD session_id);
+  std::wstring GetSessionHelperPath() const;
+  std::wstring GetSessionHelperStopEventName(DWORD session_id) const;
+  std::wstring GetSecureInputHelperPath() const;
+  std::wstring GetSecureInputHelperStopEventName(DWORD session_id) const;
+  void ResetSessionHelperReportedStateLocked(const char* error,
+                                             DWORD error_code);
+  bool GetEffectiveSessionLockedLocked() const;
+  bool IsHelperReportingLockScreenLocked() const;
+  bool HasSecureInputUiLocked() const;
+  bool ShouldKeepSecureInputHelperLocked(DWORD target_session_id) const;
+  void RefreshSessionHelperReportedState();
+  void RecordSessionEvent(DWORD event_type, DWORD session_id);
+  std::string HandleIpcCommand(const std::string& command);
+  std::string BuildStatusResponse();
+  std::string SendSecureAttentionSequence();
+  std::string SendSecureDesktopKeyboardInput(int key_code, bool is_down);
+
+  static void WINAPI ServiceMain(DWORD argc, LPWSTR* argv);
+  static BOOL WINAPI ConsoleControlHandler(DWORD control_type);
+  static DWORD WINAPI ServiceControlHandler(DWORD control, DWORD event_type,
+                                            LPVOID event_data, LPVOID context);
+
+ private:
+  SERVICE_STATUS_HANDLE status_handle_ = nullptr;
+  SERVICE_STATUS service_status_{};
+  HANDLE stop_event_ = nullptr;
+  std::thread ipc_thread_;
+  std::thread client_process_monitor_thread_;
+  std::mutex state_mutex_;
+  DWORD active_session_id_ = 0xFFFFFFFF;
+  DWORD process_session_id_ = 0xFFFFFFFF;
+  DWORD input_desktop_error_code_ = 0;
+  DWORD session_helper_process_id_ = 0;
+  DWORD session_helper_session_id_ = 0xFFFFFFFF;
+  DWORD session_helper_exit_code_ = 0;
+  DWORD session_helper_last_error_code_ = 0;
+  DWORD session_helper_status_error_code_ = 0;
+  DWORD session_helper_report_session_id_ = 0xFFFFFFFF;
+  DWORD session_helper_report_process_id_ = 0;
+  DWORD session_helper_report_input_desktop_error_code_ = 0;
+  DWORD secure_input_helper_process_id_ = 0;
+  DWORD secure_input_helper_session_id_ = 0xFFFFFFFF;
+  DWORD secure_input_helper_exit_code_ = 0;
+  DWORD secure_input_helper_last_error_code_ = 0;
+  DWORD last_session_event_type_ = 0;
+  DWORD last_session_event_session_id_ = 0xFFFFFFFF;
+  ULONGLONG started_at_tick_ = 0;
+  ULONGLONG last_sas_tick_ = 0;
+  ULONGLONG session_helper_started_at_tick_ = 0;
+  ULONGLONG session_helper_report_state_age_ms_ = 0;
+  ULONGLONG session_helper_report_uptime_ms_ = 0;
+  ULONGLONG secure_input_helper_started_at_tick_ = 0;
+  bool session_locked_ = false;
+  bool logon_ui_visible_ = false;
+  bool prelogin_ = false;
+  bool secure_desktop_active_ = false;
+  bool input_desktop_available_ = false;
+  bool session_helper_running_ = false;
+  bool session_helper_status_ok_ = false;
+  bool session_helper_report_session_locked_ = false;
+  bool session_helper_report_input_desktop_available_ = false;
+  bool session_helper_report_lock_app_visible_ = false;
+  bool session_helper_report_logon_ui_visible_ = false;
+  bool session_helper_report_secure_desktop_active_ = false;
+  bool session_helper_report_credential_ui_visible_ = false;
+  bool session_helper_report_unlock_ui_visible_ = false;
+  bool secure_input_helper_running_ = false;
+  bool console_mode_ = false;
+  DWORD last_sas_error_code_ = 0;
+  bool last_sas_success_ = false;
+  HANDLE session_helper_process_handle_ = nullptr;
+  HANDLE session_helper_stop_event_ = nullptr;
+  HANDLE secure_input_helper_process_handle_ = nullptr;
+  HANDLE secure_input_helper_stop_event_ = nullptr;
+  std::string input_desktop_name_;
+  std::string last_sas_error_;
+  std::string session_helper_last_error_;
+  std::string session_helper_status_error_;
+  std::string session_helper_report_input_desktop_;
+  std::string session_helper_report_interactive_stage_;
+  std::string secure_input_helper_last_error_;
+
+  static CrossDeskServiceHost* instance_;
+};
+
+bool IsCrossDeskServiceInstalled();
+bool InstallCrossDeskService(const std::wstring& binary_path);
+bool UninstallCrossDeskService();
+bool StartCrossDeskService();
+bool StopCrossDeskService(DWORD timeout_ms = 5000);
+std::string QueryCrossDeskService(const std::string& command,
+                                  DWORD timeout_ms = 1000);
+std::string SendCrossDeskSecureDesktopKeyInput(int key_code, bool is_down,
+                                               DWORD timeout_ms = 1000);
+std::string SendCrossDeskSecureDesktopMouseInput(int x, int y, int wheel,
+                                                 int flag,
+                                                 DWORD timeout_ms = 1000);
+
+}  // namespace crossdesk
+
+#endif

src/service/windows/session_helper_shared.h

@@ -0,0 +1,54 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-04-21
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _SESSION_HELPER_SHARED_H_
+#define _SESSION_HELPER_SHARED_H_
+
+#include <Windows.h>
+
+#include <cstdint>
+#include <string>
+
+namespace crossdesk {
+
+inline constexpr wchar_t kCrossDeskSessionHelperPipePrefix[] =
+    L"\\\\.\\pipe\\CrossDeskSessionHelper-";
+inline constexpr wchar_t kCrossDeskSecureInputHelperPipePrefix[] =
+    L"\\\\.\\pipe\\CrossDeskSecureInputHelper-";
+inline constexpr char kCrossDeskSessionHelperStatusCommand[] = "status";
+inline constexpr char kCrossDeskSecureInputKeyboardCommandPrefix[] =
+    "keyboard:";
+inline constexpr char kCrossDeskSecureInputMouseCommandPrefix[] = "mouse:";
+inline constexpr char kCrossDeskSecureInputCaptureCommandPrefix[] = "capture:";
+inline constexpr DWORD kCrossDeskSecureInputPipeBufferBytes = 16 * 1024 * 1024;
+inline constexpr uint32_t kCrossDeskSecureDesktopFrameMagic = 0x50444358;
+inline constexpr uint32_t kCrossDeskSecureDesktopFrameVersion = 1;
+
+#pragma pack(push, 1)
+struct CrossDeskSecureDesktopFrameHeader {
+  uint32_t magic;
+  uint32_t version;
+  int32_t left;
+  int32_t top;
+  uint32_t width;
+  uint32_t height;
+  uint32_t payload_size;
+};
+#pragma pack(pop)
+
+inline std::wstring GetCrossDeskSessionHelperPipeName(DWORD session_id) {
+  return std::wstring(kCrossDeskSessionHelperPipePrefix) +
+         std::to_wstring(session_id);
+}
+
+inline std::wstring GetCrossDeskSecureInputHelperPipeName(DWORD session_id) {
+  return std::wstring(kCrossDeskSecureInputHelperPipePrefix) +
+         std::to_wstring(session_id);
+}
+
+}  // namespace crossdesk
+
+#endif

xmake/targets.lua

@@ -34,7 +34,8 @@ function setup_targets()
             add_files("src/screen_capturer/windows/screen_capturer_dxgi.cpp",
                 "src/screen_capturer/windows/screen_capturer_gdi.cpp",
                 "src/screen_capturer/windows/screen_capturer_win.cpp")
-            add_includedirs("src/screen_capturer/windows", {public = true})
+            add_includedirs("src/screen_capturer/windows", "src/service/windows",
+                {public = true})
         elseif is_os("macosx") then
             add_files("src/screen_capturer/macosx/*.cpp",
                 "src/screen_capturer/macosx/*.mm")
@@ -146,7 +147,8 @@ function setup_targets()
             "src/gui/windows", {public = true})
         if is_os("windows") then
             add_files("src/gui/tray/*.cpp")
-            add_includedirs("src/gui/tray", {public = true})
+            add_includedirs("src/gui/tray", "src/service/windows",
+                {public = true})
         elseif is_os("macosx") then
             add_files("src/gui/windows/*.mm")
         end
@@ -163,6 +165,22 @@ function setup_targets()
                 "src/screen_capturer/windows/wgc_plugin_entry.cpp")
             add_includedirs("src/common", "src/screen_capturer",
                 "src/screen_capturer/windows")
+
+        target("crossdesk_service")
+            set_kind("binary")
+            add_deps("rd_log", "path_manager")
+            add_links("Advapi32", "Wtsapi32", "Ole32", "Userenv")
+            add_files("src/service/windows/main.cpp",
+                "src/service/windows/service_host.cpp")
+            add_includedirs("src/service/windows", {public = true})
+
+        target("crossdesk_session_helper")
+            set_kind("binary")
+            add_packages("libyuv")
+            add_deps("rd_log", "path_manager")
+            add_links("Advapi32", "User32", "Wtsapi32", "Gdi32")
+            add_files("src/service/windows/session_helper_main.cpp")
+            add_includedirs("src/service/windows", {public = true})
     end
 
     target("crossdesk")
@@ -171,7 +189,10 @@ function setup_targets()
         add_files("src/app/*.cpp")
         add_includedirs("src/app", {public = true})
         if is_os("windows") then
-            add_deps("wgc_plugin")
+            add_files("src/service/windows/service_host.cpp")
+            add_includedirs("src/service/windows", {public = true})
+            add_links("Advapi32", "Wtsapi32", "Ole32", "Userenv")
+            add_deps("wgc_plugin", "crossdesk_service", "crossdesk_session_helper")
             add_files("scripts/windows/crossdesk.rc")
         end
 end