[ci] fix NSIS uninstall function naming for service cleanup

README.md

@@ -262,3 +262,8 @@ sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keyc
 
 # 常见问题
 见 [常见问题](https://github.com/kunkundi/crossdesk/blob/self-hosted-server/docs/FAQ.md) 。
+
+# 致谢
+- 感谢 [HelloGitHub](https://hellogithub.com/) 的推荐与关注。
+- 感谢 [阮一峰的科技爱好者周刊](https://github.com/ruanyf/weekly) 的收录与推荐。
+- 感谢 [LinuxDo](https://linux.do) 社区的关注、交流与支持，为 CrossDesk 项目的完善提供了帮助。

README_EN.md

@@ -274,3 +274,8 @@ See [CrossDesk Web Client](https://github.com/kunkundi/crossdesk-web-client)。
 
 # FAQ
 See [FAQ](https://github.com/kunkundi/crosssesk/blob/self-hosted-server/docs/FAQ.md) .
+
+# Acknowledgements
+- Thanks to [HelloGitHub](https://hellogithub.com/) for the recommendation and exposure.
+- Thanks to [Ruanyf Weekly](https://github.com/ruanyf/weekly) for featuring CrossDesk.
+- Thanks to the [LinuxDo](https://linux.do) community for the attention, discussions, and support that helped improve CrossDesk.

scripts/windows/nsis_script.nsi

@@ -8,6 +8,7 @@
 !define PRODUCT_WEB_SITE "https://www.crossdesk.cn/"
 !define APP_NAME "CrossDesk"
 !define UNINSTALL_REG_KEY "CrossDesk"
+!define PRODUCT_SERVICE_NAME "CrossDeskService"
 
 ; Installer icon path
 !define MUI_ICON "${__FILEDIR__}\..\..\icons\windows\crossdesk.ico"
@@ -68,14 +69,21 @@ cancelInstall:
     Abort
 
 installApp:
+    Call StopInstalledService
+
     SetOutPath "$INSTDIR"
     SetOverwrite ifnewer
 
     ; Main application executable path
     File /oname=CrossDesk.exe "..\..\build\windows\x64\release\crossdesk.exe"
+    ; Bundle service-side binaries required by the Windows service flow
+    File "..\..\build\windows\x64\release\crossdesk_service.exe"
+    File "..\..\build\windows\x64\release\crossdesk_session_helper.exe"
     ; Bundle runtime DLLs from the release output directory
     File "..\..\build\windows\x64\release\*.dll"
 
+    Call RegisterInstalledService
+
     ; Write uninstall information
     WriteUninstaller "$INSTDIR\uninstall.exe"
 
@@ -122,8 +130,12 @@ cancelUninstall:
     Abort
 
 uninstallApp:
+    Call un.UnregisterInstalledService
+
     ; Delete main executable and uninstaller
     Delete "$INSTDIR\CrossDesk.exe"
+    Delete "$INSTDIR\crossdesk_service.exe"
+    Delete "$INSTDIR\crossdesk_session_helper.exe"
     Delete "$INSTDIR\uninstall.exe"
 
     ; Recursively delete installation directory
@@ -148,3 +160,85 @@ SectionEnd
 Function LaunchApp
     Exec "$INSTDIR\CrossDesk.exe"
 FunctionEnd
+
+Function StopInstalledService
+    IfFileExists "$INSTDIR\CrossDesk.exe" 0 stop_with_sc
+    IfFileExists "$INSTDIR\crossdesk_service.exe" 0 stop_with_sc
+
+    DetailPrint "Stopping existing CrossDesk service"
+    ExecWait '"$INSTDIR\CrossDesk.exe" --service-stop' $0
+    ${If} $0 = 0
+        Return
+    ${EndIf}
+
+stop_with_sc:
+    DetailPrint "Stopping existing CrossDesk service via Service Control Manager"
+    ExecWait '"$SYSDIR\sc.exe" stop ${PRODUCT_SERVICE_NAME}' $0
+    ${If} $0 != 0
+    ${AndIf} $0 != 1060
+    ${AndIf} $0 != 1062
+        MessageBox MB_ICONSTOP|MB_OK "Failed to stop the existing CrossDesk service. The installation will be aborted."
+        Abort
+    ${EndIf}
+    Sleep 1500
+FunctionEnd
+
+Function RegisterInstalledService
+    IfFileExists "$INSTDIR\CrossDesk.exe" 0 missing_service_binary
+    IfFileExists "$INSTDIR\crossdesk_service.exe" 0 missing_service_binary
+    IfFileExists "$INSTDIR\crossdesk_session_helper.exe" 0 missing_service_binary
+
+    DetailPrint "Registering CrossDesk service"
+    ExecWait '"$INSTDIR\CrossDesk.exe" --service-install' $0
+    ${If} $0 != 0
+        MessageBox MB_ICONSTOP|MB_OK "Failed to register the CrossDesk service. The installation will be aborted."
+        Abort
+    ${EndIf}
+
+    DetailPrint "Starting CrossDesk service"
+    ExecWait '"$INSTDIR\CrossDesk.exe" --service-start' $0
+    ${If} $0 != 0
+        ExecWait '"$INSTDIR\CrossDesk.exe" --service-uninstall' $1
+        ExecWait '"$SYSDIR\sc.exe" delete ${PRODUCT_SERVICE_NAME}' $1
+        MessageBox MB_ICONSTOP|MB_OK "The CrossDesk service was registered but could not be started. The installation will be aborted."
+        Abort
+    ${EndIf}
+
+    Return
+
+missing_service_binary:
+    MessageBox MB_ICONSTOP|MB_OK "CrossDesk service files are missing from the installer package. The installation will be aborted."
+    Abort
+FunctionEnd
+
+Function un.UnregisterInstalledService
+    IfFileExists "$INSTDIR\CrossDesk.exe" 0 unregister_with_sc
+
+    DetailPrint "Stopping CrossDesk service"
+    ExecWait '"$INSTDIR\CrossDesk.exe" --service-stop' $0
+    ${If} $0 = 0
+        DetailPrint "Removing CrossDesk service"
+        ExecWait '"$INSTDIR\CrossDesk.exe" --service-uninstall' $0
+        ${If} $0 = 0
+            Return
+        ${EndIf}
+    ${EndIf}
+
+unregister_with_sc:
+    DetailPrint "Removing CrossDesk service via Service Control Manager"
+    ExecWait '"$SYSDIR\sc.exe" stop ${PRODUCT_SERVICE_NAME}' $0
+    ${If} $0 != 0
+    ${AndIf} $0 != 1060
+    ${AndIf} $0 != 1062
+        MessageBox MB_ICONSTOP|MB_OK "Failed to stop the CrossDesk service. Uninstall will be aborted."
+        Abort
+    ${EndIf}
+    Sleep 1500
+
+    ExecWait '"$SYSDIR\sc.exe" delete ${PRODUCT_SERVICE_NAME}' $0
+    ${If} $0 != 0
+    ${AndIf} $0 != 1060
+        MessageBox MB_ICONSTOP|MB_OK "Failed to remove the CrossDesk service. Uninstall will be aborted."
+        Abort
+    ${EndIf}
+FunctionEnd

src/app/main.cpp

@@ -7,15 +7,165 @@
 #endif
 
 #include <cstring>
+#include <filesystem>
+#include <iostream>
 #include <memory>
 #include <string>
 
+#ifdef _WIN32
+#include <cstdio>
+#include "service_host.h"
+#endif
+
 #include "config_center.h"
 #include "daemon.h"
 #include "path_manager.h"
 #include "render.h"
 
+#ifdef _WIN32
+namespace {
+
+void EnsureConsoleForCli() {
+  static bool console_ready = false;
+  if (console_ready) {
+    return;
+  }
+
+  if (!AttachConsole(ATTACH_PARENT_PROCESS)) {
+    DWORD error = GetLastError();
+    if (error != ERROR_ACCESS_DENIED) {
+      AllocConsole();
+    }
+  }
+
+  FILE* stream = nullptr;
+  freopen_s(&stream, "CONOUT$", "w", stdout);
+  freopen_s(&stream, "CONOUT$", "w", stderr);
+  freopen_s(&stream, "CONIN$", "r", stdin);
+  SetConsoleOutputCP(CP_UTF8);
+  console_ready = true;
+}
+
+void PrintServiceCliUsage() {
+  std::cout
+      << "CrossDesk service management commands\n"
+      << "  --service-install    Install the sibling crossdesk_service.exe\n"
+      << "  --service-uninstall  Remove the installed Windows service\n"
+      << "  --service-start      Start the Windows service\n"
+      << "  --service-stop       Stop the Windows service\n"
+  << "  --service-sas        Ask the service to send Secure Attention Sequence\n"
+      << "  --service-ping       Ping the service over named pipe IPC\n"
+      << "  --service-status     Query service runtime status\n"
+      << "  --service-help       Show this help\n";
+}
+
+std::wstring GetCurrentExecutablePathW() {
+  wchar_t path[MAX_PATH] = {0};
+  DWORD length = GetModuleFileNameW(nullptr, path, MAX_PATH);
+  if (length == 0 || length >= MAX_PATH) {
+    return L"";
+  }
+  return std::wstring(path, length);
+}
+
+std::filesystem::path GetSiblingServiceExecutablePath() {
+  std::wstring current_executable = GetCurrentExecutablePathW();
+  if (current_executable.empty()) {
+    return {};
+  }
+
+  return std::filesystem::path(current_executable).parent_path() /
+         L"crossdesk_service.exe";
+}
+
+bool IsServiceCliCommand(const char* arg) {
+  if (arg == nullptr) {
+    return false;
+  }
+
+  return std::strcmp(arg, "--service-install") == 0 ||
+         std::strcmp(arg, "--service-uninstall") == 0 ||
+         std::strcmp(arg, "--service-start") == 0 ||
+         std::strcmp(arg, "--service-stop") == 0 ||
+      std::strcmp(arg, "--service-sas") == 0 ||
+         std::strcmp(arg, "--service-ping") == 0 ||
+         std::strcmp(arg, "--service-status") == 0 ||
+         std::strcmp(arg, "--service-help") == 0;
+}
+
+int HandleServiceCliCommand(const std::string& command) {
+  EnsureConsoleForCli();
+
+  if (command == "--service-help") {
+    PrintServiceCliUsage();
+    return 0;
+  }
+
+  if (command == "--service-install") {
+    std::filesystem::path service_path = GetSiblingServiceExecutablePath();
+    if (service_path.empty()) {
+      std::cerr << "Failed to locate crossdesk_service.exe" << std::endl;
+      return 1;
+    }
+    if (!std::filesystem::exists(service_path)) {
+      std::cerr << "Service binary not found: " << service_path.string()
+                << std::endl;
+      return 1;
+    }
+
+    bool success = crossdesk::InstallCrossDeskService(service_path.wstring());
+    std::cout << (success ? "install ok" : "install failed") << std::endl;
+    return success ? 0 : 1;
+  }
+
+  if (command == "--service-uninstall") {
+    bool success = crossdesk::UninstallCrossDeskService();
+    std::cout << (success ? "uninstall ok" : "uninstall failed")
+              << std::endl;
+    return success ? 0 : 1;
+  }
+
+  if (command == "--service-start") {
+    bool success = crossdesk::StartCrossDeskService();
+    std::cout << (success ? "start ok" : "start failed") << std::endl;
+    return success ? 0 : 1;
+  }
+
+  if (command == "--service-stop") {
+    bool success = crossdesk::StopCrossDeskService();
+    std::cout << (success ? "stop ok" : "stop failed") << std::endl;
+    return success ? 0 : 1;
+  }
+
+  if (command == "--service-sas") {
+    std::cout << crossdesk::QueryCrossDeskService("sas") << std::endl;
+    return 0;
+  }
+
+  if (command == "--service-ping") {
+    std::cout << crossdesk::QueryCrossDeskService("ping") << std::endl;
+    return 0;
+  }
+
+  if (command == "--service-status") {
+    std::cout << crossdesk::QueryCrossDeskService("status") << std::endl;
+    return 0;
+  }
+
+  PrintServiceCliUsage();
+  return 1;
+}
+
+}  // namespace
+#endif
+
 int main(int argc, char* argv[]) {
+#ifdef _WIN32
+  if (argc > 1 && IsServiceCliCommand(argv[1])) {
+    return HandleServiceCliCommand(argv[1]);
+  }
+#endif
+
   // check if running as child process
   bool is_child = false;
   for (int i = 1; i < argc; i++) {

src/device_controller/device_controller.h

@@ -7,6 +7,7 @@
 #ifndef _DEVICE_CONTROLLER_H_
 #define _DEVICE_CONTROLLER_H_
 
+#include <cstring>
 #include <stdio.h>
 
 #include <nlohmann/json.hpp>
@@ -23,6 +24,8 @@ typedef enum {
   audio_capture,
   host_infomation,
   display_id,
+  service_status,
+  service_command,
 } ControlType;
 typedef enum {
   move = 0,
@@ -36,6 +39,7 @@ typedef enum {
   wheel_horizontal
 } MouseFlag;
 typedef enum { key_down = 0, key_up } KeyFlag;
+typedef enum { send_sas = 0 } ServiceCommandFlag;
 typedef struct {
   float x;
   float y;
@@ -59,6 +63,15 @@ typedef struct {
   int* bottom;
 } HostInfo;
 
+typedef struct {
+  bool available;
+  char interactive_stage[32];
+} ServiceStatus;
+
+typedef struct {
+  ServiceCommandFlag flag;
+} ServiceCommand;
+
 struct RemoteAction {
   ControlType type;
   union {
@@ -67,6 +80,8 @@ struct RemoteAction {
     HostInfo i;
     bool a;
     int d;
+    ServiceStatus ss;
+    ServiceCommand c;
   };
 
   // parse
@@ -96,6 +111,14 @@ struct RemoteAction {
       case ControlType::display_id:
         j["display_id"] = a.d;
         break;
+      case ControlType::service_status:
+        j["service_status"] = {{"available", a.ss.available},
+                               {"interactive_stage",
+                                a.ss.interactive_stage}};
+        break;
+      case ControlType::service_command:
+        j["service_command"] = {{"flag", a.c.flag}};
+        break;
       case ControlType::host_infomation: {
         json displays = json::array();
         for (size_t idx = 0; idx < a.i.display_num; idx++) {
@@ -137,6 +160,21 @@ struct RemoteAction {
         case ControlType::display_id:
           out.d = j.at("display_id").get<int>();
           break;
+        case ControlType::service_status: {
+          const auto& service_status_json = j.at("service_status");
+          out.ss.available = service_status_json.value("available", false);
+          std::string interactive_stage =
+            service_status_json.value("interactive_stage", std::string());
+          std::strncpy(out.ss.interactive_stage, interactive_stage.c_str(),
+                 sizeof(out.ss.interactive_stage) - 1);
+          out.ss.interactive_stage[sizeof(out.ss.interactive_stage) - 1] =
+            '\0';
+          break;
+        }
+        case ControlType::service_command:
+          out.c.flag = static_cast<ServiceCommandFlag>(
+            j.at("service_command").at("flag").get<int>());
+          break;
         case ControlType::host_infomation: {
           std::string host_name =
               j.at("host_info").at("host_name").get<std::string>();

src/device_controller/keyboard_converter.h

@@ -98,6 +98,7 @@ std::map<int, int> vkCodeToCGKeyCode = {
     {0x67, 0x59},  // Numpad 7
     {0x68, 0x5B},  // Numpad 8
     {0x69, 0x5C},  // Numpad 9
+    {0x90, 0x47},  // Num Lock / Keypad Clear
     {0x6E, 0x41},  // Numpad .
     {0x6F, 0x4B},  // Numpad /
     {0x6A, 0x43},  // Numpad *
@@ -216,6 +217,7 @@ std::map<int, int> CGKeyCodeToVkCode = {
     {0x59, 0x67},  // Numpad 7
     {0x5B, 0x68},  // Numpad 8
     {0x5C, 0x69},  // Numpad 9
+    {0x47, 0x90},  // Num Lock / Keypad Clear
     {0x41, 0x6E},  // Numpad .
     {0x4B, 0x6F},  // Numpad /
     {0x43, 0x6A},  // Numpad *
@@ -336,6 +338,7 @@ std::map<int, int> vkCodeToX11KeySym = {
     {0x67, 0xFFB7},  // Numpad 7
     {0x68, 0xFFB8},  // Numpad 8
     {0x69, 0xFFB9},  // Numpad 9
+    {0x90, 0xFF7F},  // Num Lock
     {0x6E, 0xFFAE},  // Numpad .
     {0x6F, 0xFFAF},  // Numpad /
     {0x6A, 0xFFAA},  // Numpad *
@@ -464,6 +467,7 @@ std::map<int, int> x11KeySymToVkCode = {
     {0xFFB7, 0x67},  // Numpad 7
     {0xFFB8, 0x68},  // Numpad 8
     {0xFFB9, 0x69},  // Numpad 9
+    {0xFF7F, 0x90},  // Num Lock
     {0xFFAE, 0x6E},  // Numpad .
     {0xFFAF, 0x6F},  // Numpad /
     {0xFFAA, 0x6A},  // Numpad *
@@ -582,6 +586,7 @@ std::map<int, int> cgKeyCodeToX11KeySym = {
     {0x59, 0xFFB7},  // Numpad 7
     {0x5B, 0xFFB8},  // Numpad 8
     {0x5C, 0xFFB9},  // Numpad 9
+    {0x47, 0xFF7F},  // Num Lock / Keypad Clear
     {0x41, 0xFFAE},  // Numpad .
     {0x4B, 0xFFAF},  // Numpad /
     {0x43, 0xFFAA},  // Numpad *
@@ -708,6 +713,7 @@ std::map<int, int> x11KeySymToCgKeyCode = {
     {0xFFB7, 0x59},  // Numpad 7
     {0xFFB8, 0x5B},  // Numpad 8
     {0xFFB9, 0x5C},  // Numpad 9
+    {0xFF7F, 0x47},  // Num Lock / Keypad Clear
     {0xFFAE, 0x41},  // Numpad .
     {0xFFAF, 0x4B},  // Numpad /
     {0xFFAA, 0x43},  // Numpad *

src/device_controller/mouse/linux/mouse_controller.h

@@ -11,8 +11,8 @@
 #include <X11/Xutil.h>
 #include <unistd.h>
 
-#include <functional>
 #include <cstdint>
+#include <functional>
 #include <string>
 #include <vector>
 
@@ -47,9 +47,9 @@ class MouseController : public DeviceController {
   bool NotifyWaylandPointerMotionAbsolute(uint32_t stream, double x, double y);
   bool NotifyWaylandPointerButton(int button, uint32_t state);
   bool NotifyWaylandPointerAxisDiscrete(uint32_t axis, int32_t steps);
-  bool SendWaylandPortalVoidCall(const char* method_name,
+  bool SendWaylandPortalVoidCall(
-                                 const std::function<void(DBusMessageIter*)>&
+      const char* method_name,
-                                     append_args);
+      const std::function<void(DBusMessageIter*)>& append_args);
 
   enum class WaylandAbsoluteMode { kUnknown, kPixels, kNormalized, kDisabled };
 
@@ -72,6 +72,8 @@ class MouseController : public DeviceController {
   WaylandAbsoluteMode wayland_absolute_mode_ = WaylandAbsoluteMode::kUnknown;
   bool wayland_absolute_disabled_logged_ = false;
   uint32_t wayland_absolute_stream_id_ = 0;
+  int wayland_portal_space_width_ = 0;
+  int wayland_portal_space_height_ = 0;
   bool using_shared_wayland_session_ = false;
 };
 }  // namespace crossdesk

src/device_controller/mouse/linux/mouse_controller_wayland.cpp

@@ -1,5 +1,3 @@
-#include "mouse_controller.h"
-
 #include <algorithm>
 #include <chrono>
 #include <cmath>
@@ -7,6 +5,8 @@
 #include <cstring>
 #include <thread>
 
+#include "mouse_controller.h"
+
 #if defined(CROSSDESK_HAS_WAYLAND_CAPTURER) && CROSSDESK_HAS_WAYLAND_CAPTURER
 #include <dbus/dbus.h>
 #endif
@@ -22,7 +22,8 @@ void MouseController::OnWaylandDisplayInfoListUpdated() {
       display_info_list_.empty()
           ? 0
           : reinterpret_cast<uintptr_t>(display_info_list_[0].handle);
-  const int width0 = display_info_list_.empty() ? 0 : display_info_list_[0].width;
+  const int width0 =
+      display_info_list_.empty() ? 0 : display_info_list_[0].width;
   const int height0 =
       display_info_list_.empty() ? 0 : display_info_list_[0].height;
   const bool should_log = !logged_wayland_display_info_ ||
@@ -43,8 +44,7 @@ void MouseController::OnWaylandDisplayInfoListUpdated() {
     const auto& display = display_info_list_[i];
     LOG_INFO(
         "Wayland mouse display info [{}]: name={}, rect=({},{})->({},{}) "
-        "size={}x{}, stream={}"
+        "size={}x{}, stream={}",
-        ,
         i, display.name, display.left, display.top, display.right,
         display.bottom, display.width, display.height,
         reinterpret_cast<uintptr_t>(display.handle));
@@ -88,6 +88,13 @@ std::string MakeToken(const char* prefix) {
 }
 
 void LogDbusError(const char* action, DBusError* error) {
+  if (action && error && dbus_error_is_set(error) &&
+      strcmp(action, "NotifyPointerMotionAbsolute") == 0 && error->name &&
+      strcmp(error->name, "org.freedesktop.DBus.Error.Failed") == 0 &&
+      error->message && strcmp(error->message, "Invalid position") == 0) {
+    return;
+  }
+
   if (error && dbus_error_is_set(error)) {
     LOG_ERROR("{} failed: {} ({})", action,
               error->message ? error->message : "unknown",
@@ -190,6 +197,27 @@ bool ReadUint32Like(DBusMessageIter* iter, uint32_t* value) {
   return false;
 }
 
+bool ReadIntLike(DBusMessageIter* iter, int* value) {
+  if (!iter || !value) {
+    return false;
+  }
+
+  if (dbus_message_iter_get_arg_type(iter) == DBUS_TYPE_INT32) {
+    int32_t temp = 0;
+    dbus_message_iter_get_basic(iter, &temp);
+    *value = static_cast<int>(temp);
+    return true;
+  }
+
+  uint32_t temp = 0;
+  if (ReadUint32Like(iter, &temp)) {
+    *value = static_cast<int>(temp);
+    return true;
+  }
+
+  return false;
+}
+
 bool ReadFirstStreamId(DBusMessageIter* variant, uint32_t* stream_id) {
   if (!variant || !stream_id) {
     return false;
@@ -215,6 +243,85 @@ bool ReadFirstStreamId(DBusMessageIter* variant, uint32_t* stream_id) {
   return false;
 }
 
+bool ReadFirstStreamGeometry(DBusMessageIter* variant, int* width,
+                             int* height) {
+  if (!variant || !width || !height) {
+    return false;
+  }
+  if (dbus_message_iter_get_arg_type(variant) != DBUS_TYPE_ARRAY) {
+    return false;
+  }
+
+  int parsed_width = 0;
+  int parsed_height = 0;
+  DBusMessageIter streams;
+  dbus_message_iter_recurse(variant, &streams);
+  while (dbus_message_iter_get_arg_type(&streams) != DBUS_TYPE_INVALID) {
+    if (dbus_message_iter_get_arg_type(&streams) == DBUS_TYPE_STRUCT) {
+      DBusMessageIter stream;
+      dbus_message_iter_recurse(&streams, &stream);
+
+      if (dbus_message_iter_get_arg_type(&stream) == DBUS_TYPE_UINT32) {
+        dbus_message_iter_next(&stream);
+      }
+
+      if (dbus_message_iter_get_arg_type(&stream) == DBUS_TYPE_ARRAY) {
+        int stream_width = 0;
+        int stream_height = 0;
+        int logical_width = 0;
+        int logical_height = 0;
+        DBusMessageIter props;
+        dbus_message_iter_recurse(&stream, &props);
+        while (dbus_message_iter_get_arg_type(&props) != DBUS_TYPE_INVALID) {
+          if (dbus_message_iter_get_arg_type(&props) == DBUS_TYPE_DICT_ENTRY) {
+            DBusMessageIter prop_entry;
+            dbus_message_iter_recurse(&props, &prop_entry);
+
+            const char* prop_key = nullptr;
+            dbus_message_iter_get_basic(&prop_entry, &prop_key);
+            if (prop_key && dbus_message_iter_next(&prop_entry) &&
+                dbus_message_iter_get_arg_type(&prop_entry) ==
+                    DBUS_TYPE_VARIANT) {
+              DBusMessageIter prop_variant;
+              dbus_message_iter_recurse(&prop_entry, &prop_variant);
+              if (dbus_message_iter_get_arg_type(&prop_variant) ==
+                  DBUS_TYPE_STRUCT) {
+                DBusMessageIter size_iter;
+                int candidate_width = 0;
+                int candidate_height = 0;
+                dbus_message_iter_recurse(&prop_variant, &size_iter);
+                if (ReadIntLike(&size_iter, &candidate_width) &&
+                    dbus_message_iter_next(&size_iter) &&
+                    ReadIntLike(&size_iter, &candidate_height)) {
+                  if (strcmp(prop_key, "logical_size") == 0) {
+                    logical_width = candidate_width;
+                    logical_height = candidate_height;
+                  } else if (strcmp(prop_key, "size") == 0) {
+                    stream_width = candidate_width;
+                    stream_height = candidate_height;
+                  }
+                }
+              }
+            }
+          }
+          dbus_message_iter_next(&props);
+        }
+
+        parsed_width = logical_width > 0 ? logical_width : stream_width;
+        parsed_height = logical_height > 0 ? logical_height : stream_height;
+        if (parsed_width > 0 && parsed_height > 0) {
+          *width = parsed_width;
+          *height = parsed_height;
+          return true;
+        }
+      }
+    }
+    dbus_message_iter_next(&streams);
+  }
+
+  return false;
+}
+
 std::string BuildSessionHandleFromRequestPath(
     const std::string& request_path, const std::string& session_handle_token) {
   if (request_path.rfind(kPortalRequestPathPrefix, 0) != 0 ||
@@ -361,8 +468,7 @@ bool ExtractPortalResponse(DBusMessage* message, uint32_t* response_code,
 
 bool SendPortalRequestAndHandleResponse(
     DBusConnection* connection, const char* interface_name,
-    const char* method_name,
+    const char* method_name, const char* action_name,
-    const char* action_name,
     const std::function<bool(DBusMessage*)>& append_message_args,
     const std::function<bool(uint32_t, DBusMessageIter*)>& handle_results,
     std::string* request_path_out = nullptr) {
@@ -386,8 +492,8 @@ bool SendPortalRequestAndHandleResponse(
 
   DBusError error;
   dbus_error_init(&error);
-  DBusMessage* reply =
+  DBusMessage* reply = dbus_connection_send_with_reply_and_block(
-      dbus_connection_send_with_reply_and_block(connection, message, -1, &error);
+      connection, message, -1, &error);
   dbus_message_unref(message);
   if (!reply) {
     LogDbusError(action_name ? action_name : method_name, &error);
@@ -438,6 +544,8 @@ bool MouseController::InitWaylandPortal() {
         dbus_connection_ = shared_session.connection;
         wayland_session_handle_ = shared_session.session_handle;
         wayland_absolute_stream_id_ = shared_session.stream_id;
+        wayland_portal_space_width_ = shared_session.width;
+        wayland_portal_space_height_ = shared_session.height;
         last_display_index_ = -1;
         last_norm_x_ = -1.0;
         last_norm_y_ = -1.0;
@@ -448,9 +556,11 @@ bool MouseController::InitWaylandPortal() {
         wayland_absolute_mode_ = WaylandAbsoluteMode::kUnknown;
         wayland_absolute_disabled_logged_ = false;
         using_shared_wayland_session_ = true;
-        LOG_INFO("Mouse controller attached to shared Wayland portal session, "
+        LOG_INFO(
-                 "stream_id={}",
+            "Mouse controller attached to shared Wayland portal session, "
-                 wayland_absolute_stream_id_);
+            "stream_id={}, portal_space={}x{}",
+            wayland_absolute_stream_id_, wayland_portal_space_width_,
+            wayland_portal_space_height_);
         return true;
       };
 
@@ -469,16 +579,18 @@ bool MouseController::InitWaylandPortal() {
 
     if (!waiting_logged) {
       waiting_logged = true;
-      LOG_INFO("Waiting for shared Wayland portal session from screen "
+      LOG_INFO(
-               "capturer before creating a standalone mouse session");
+          "Waiting for shared Wayland portal session from screen "
+          "capturer before creating a standalone mouse session");
     }
 
     std::this_thread::sleep_for(std::chrono::milliseconds(100));
   }
 
   if (waiting_logged) {
-    LOG_WARN("Shared Wayland portal session did not appear in time; falling "
+    LOG_WARN(
-             "back to standalone mouse portal session");
+        "Shared Wayland portal session did not appear in time; falling "
+        "back to standalone mouse portal session");
   }
 
   if (AcquireSharedWaylandPortalSession(true, &shared_session)) {
@@ -677,6 +789,8 @@ bool MouseController::InitWaylandPortal() {
 
         uint32_t granted_devices = 0;
         uint32_t absolute_stream_id = 0;
+        int absolute_space_width = 0;
+        int absolute_space_height = 0;
         DBusMessageIter dict;
         dbus_message_iter_recurse(results, &dict);
         while (dbus_message_iter_get_arg_type(&dict) != DBUS_TYPE_INVALID) {
@@ -694,6 +808,8 @@ bool MouseController::InitWaylandPortal() {
                 ReadUint32Like(&variant, &granted_devices);
               } else if (strcmp(key, "streams") == 0) {
                 ReadFirstStreamId(&variant, &absolute_stream_id);
+                ReadFirstStreamGeometry(&variant, &absolute_space_width,
+                                        &absolute_space_height);
               }
             }
           }
@@ -703,19 +819,24 @@ bool MouseController::InitWaylandPortal() {
         pointer_granted = (granted_devices & kRemoteDesktopDevicePointer) != 0;
         if (!pointer_granted) {
           LOG_ERROR(
-              "RemoteDesktop.Start granted devices mask={}, pointer not allowed",
+              "RemoteDesktop.Start granted devices mask={}, pointer not "
+              "allowed",
               granted_devices);
           return false;
         }
         if (absolute_stream_id == 0) {
-          LOG_ERROR("RemoteDesktop.Start did not return a screencast stream id");
+          LOG_ERROR(
+              "RemoteDesktop.Start did not return a screencast stream id");
           return false;
         }
         wayland_absolute_stream_id_ = absolute_stream_id;
+        wayland_portal_space_width_ = absolute_space_width;
+        wayland_portal_space_height_ = absolute_space_height;
         wayland_absolute_mode_ = WaylandAbsoluteMode::kUnknown;
         wayland_absolute_disabled_logged_ = false;
-        LOG_INFO("Wayland mouse absolute stream id={}",
+        LOG_INFO("Wayland mouse absolute stream id={}, portal_space={}x{}",
-                 wayland_absolute_stream_id_);
+                 wayland_absolute_stream_id_, wayland_portal_space_width_,
+                 wayland_portal_space_height_);
         return true;
       });
 
@@ -782,6 +903,8 @@ void MouseController::CleanupWaylandPortal() {
   wayland_absolute_mode_ = WaylandAbsoluteMode::kUnknown;
   wayland_absolute_disabled_logged_ = false;
   wayland_absolute_stream_id_ = 0;
+  wayland_portal_space_width_ = 0;
+  wayland_portal_space_height_ = 0;
   using_shared_wayland_session_ = false;
 }
 
@@ -835,49 +958,80 @@ int MouseController::SendWaylandMouseCommand(RemoteAction remote_action,
       }
 
       const uint32_t stream = wayland_absolute_stream_id_;
-      const double abs_x = norm_x * std::max(width - 1, 1);
+      const int portal_width =
-      const double abs_y = norm_y * std::max(height - 1, 1);
+          wayland_portal_space_width_ > 0 ? wayland_portal_space_width_ : width;
+      const int portal_height = wayland_portal_space_height_ > 0
+                                    ? wayland_portal_space_height_
+                                    : height;
+      const double abs_x = norm_x * static_cast<double>(width);
+      const double abs_y = norm_y * static_cast<double>(height);
+      const double max_x = std::nextafter(static_cast<double>(width), 0.0);
+      const double max_y = std::nextafter(static_cast<double>(height), 0.0);
+      const double send_x = std::clamp(abs_x, 0.0, std::max(max_x, 0.0));
+      const double send_y = std::clamp(abs_y, 0.0, std::max(max_y, 0.0));
+      const bool can_use_relative = last_display_index_ == display_index &&
+                                    last_norm_x_ >= 0.0 && last_norm_y_ >= 0.0;
+      const double rel_dx =
+          (norm_x - last_norm_x_) * static_cast<double>(portal_width);
+      const double rel_dy =
+          (norm_y - last_norm_y_) * static_cast<double>(portal_height);
 
-      auto accept_absolute = [&]() {
+      auto accept_motion = [&]() {
         last_display_index_ = display_index;
         last_norm_x_ = norm_x;
         last_norm_y_ = norm_y;
+        wayland_absolute_disabled_logged_ = false;
         return 0;
       };
 
+      auto try_relative_fallback = [&]() -> bool {
+        if (!can_use_relative) {
+          return false;
+        }
+        if (std::abs(rel_dx) < 1e-6 && std::abs(rel_dy) < 1e-6) {
+          return false;
+        }
+        if (NotifyWaylandPointerMotion(rel_dx, rel_dy)) {
+          return true;
+        }
+        return false;
+      };
+
+      if (wayland_absolute_mode_ == WaylandAbsoluteMode::kDisabled) {
+        if (try_relative_fallback()) {
+          return accept_motion();
+        }
+        if (!wayland_absolute_disabled_logged_) {
+          wayland_absolute_disabled_logged_ = true;
+          LOG_ERROR("NotifyPointerMotionAbsolute rejected by portal backend");
+        }
+        return -3;
+      }
+
       if (wayland_absolute_mode_ == WaylandAbsoluteMode::kPixels) {
-        if (NotifyWaylandPointerMotionAbsolute(stream, abs_x, abs_y)) {
+        if (NotifyWaylandPointerMotionAbsolute(stream, send_x, send_y)) {
-          return accept_absolute();
+          return accept_motion();
         }
-        wayland_absolute_mode_ = WaylandAbsoluteMode::kDisabled;
+        if (try_relative_fallback()) {
-      } else if (wayland_absolute_mode_ == WaylandAbsoluteMode::kNormalized) {
+          return accept_motion();
-        if (NotifyWaylandPointerMotionAbsolute(stream, norm_x, norm_y)) {
-          return accept_absolute();
         }
-        wayland_absolute_mode_ = WaylandAbsoluteMode::kDisabled;
+      } else if (wayland_absolute_mode_ == WaylandAbsoluteMode::kUnknown) {
-      } else {
+        if (NotifyWaylandPointerMotionAbsolute(stream, send_x, send_y)) {
-        if (NotifyWaylandPointerMotionAbsolute(stream, abs_x, abs_y)) {
           wayland_absolute_mode_ = WaylandAbsoluteMode::kPixels;
-          LOG_INFO("Wayland absolute pointer mode selected: pixel coordinates");
-          return accept_absolute();
-        }
-
-        if (NotifyWaylandPointerMotionAbsolute(stream, norm_x, norm_y)) {
-          wayland_absolute_mode_ = WaylandAbsoluteMode::kNormalized;
           LOG_INFO(
-              "Wayland absolute pointer mode selected: normalized "
+              "Wayland absolute pointer mode selected: pixel coordinates "
-              "coordinates");
+              "(pointer space {}x{})",
-          return accept_absolute();
+              width, height);
+          return accept_motion();
+        }
+        if (try_relative_fallback()) {
+          return accept_motion();
         }
-
-        wayland_absolute_mode_ = WaylandAbsoluteMode::kDisabled;
       }
 
       if (!wayland_absolute_disabled_logged_) {
         wayland_absolute_disabled_logged_ = true;
-        LOG_ERROR(
+        LOG_ERROR("NotifyPointerMotionAbsolute rejected by portal backend");
-            "NotifyPointerMotionAbsolute rejected by portal backend in both "
-            "pixel and normalized modes");
       }
       return -3;
     }
@@ -1030,9 +1184,9 @@ bool MouseController::SendWaylandPortalVoidCall(
     return false;
   }
 
-  DBusMessage* message = dbus_message_new_method_call(
+  DBusMessage* message =
-      kPortalBusName, kPortalObjectPath, kPortalRemoteDesktopInterface,
+      dbus_message_new_method_call(kPortalBusName, kPortalObjectPath,
-      method_name);
+                                   kPortalRemoteDesktopInterface, method_name);
   if (!message) {
     LOG_ERROR("Failed to allocate {} message", method_name);
     return false;

src/gui/assets/localization/localization_data.h

@@ -51,6 +51,22 @@ struct TranslationRow {
   X(release_mouse, u8"释放", "Release", u8"Освободить")                        \
   X(audio_capture, u8"声音", "Audio", u8"Звук")                                \
   X(mute, u8" 静音", " Mute", u8"Без звука")                                   \
+  X(send_sas, u8"发送SAS", "Send SAS", u8"Отправить SAS")                     \
+  X(remote_password_box_visible, u8"远端密码框已出现",                            \
+    "Remote password box visible", u8"Окно ввода пароля видно")                 \
+  X(remote_lock_screen_hint, u8"远端处于锁屏封面，可发送SAS",                     \
+    "Remote lock screen visible, send SAS",                                     \
+    u8"Видна блокировка, отправьте SAS")                                         \
+  X(remote_secure_desktop_active, u8"远端已进入安全桌面",                         \
+    "Remote secure desktop active",                                              \
+    u8"Активен защищенный рабочий стол")                                         \
+  X(remote_service_unavailable, u8"远端Windows服务不可用",                        \
+    "Remote Windows service unavailable",                                        \
+    u8"Служба Windows на удаленной стороне недоступна")                          \
+  X(remote_unlock_requires_secure_desktop,                                        \
+    u8"当前仍需要安全桌面专用采集/输入",                                         \
+    "Secure desktop capture/input is still required",                            \
+    u8"По-прежнему нужен отдельный захват/ввод для защищенного рабочего стола")   \
   X(settings, u8"设置", "Settings", u8"Настройки")                             \
   X(language, u8"语言:", "Language:", u8"Язык:")                               \
   X(video_quality, u8"视频质量:", "Video Quality:", u8"Качество видео:")       \

src/gui/render.cpp

@@ -28,6 +28,10 @@
 #include "screen_capturer_factory.h"
 #include "version_checker.h"
 
+#if _WIN32
+#include "interactive_state.h"
+#include "service_host.h"
+#endif
 
 #if defined(__APPLE__)
 #include "window_util_mac.h"
@@ -75,6 +79,67 @@ HICON LoadTrayIcon() {
 
   return LoadIconW(nullptr, IDI_APPLICATION);
 }
+
+struct WindowsServiceInteractiveStatus {
+  bool available = false;
+  unsigned int error_code = 0;
+  std::string interactive_stage;
+  std::string error;
+};
+
+constexpr uint32_t kWindowsServiceStatusIntervalMs = 1000;
+constexpr DWORD kWindowsServiceQueryTimeoutMs = 100;
+constexpr DWORD kWindowsServiceSasTimeoutMs = 500;
+
+RemoteAction BuildWindowsServiceStatusAction(
+    const WindowsServiceInteractiveStatus& status) {
+  RemoteAction action{};
+  action.type = ControlType::service_status;
+  action.ss.available = status.available;
+  std::strncpy(action.ss.interactive_stage, status.interactive_stage.c_str(),
+               sizeof(action.ss.interactive_stage) - 1);
+  action.ss.interactive_stage[sizeof(action.ss.interactive_stage) - 1] = '\0';
+  return action;
+}
+
+bool QueryWindowsServiceInteractiveStatus(
+    WindowsServiceInteractiveStatus* status) {
+  if (status == nullptr) {
+    return false;
+  }
+
+  *status = WindowsServiceInteractiveStatus{};
+  const std::string response =
+      QueryCrossDeskService("status", kWindowsServiceQueryTimeoutMs);
+  auto json = nlohmann::json::parse(response, nullptr, false);
+  if (json.is_discarded() || !json.is_object()) {
+    status->error = "invalid_service_status_json";
+    return false;
+  }
+
+  status->available = json.value("ok", false);
+  if (!status->available) {
+    status->error = json.value("error", std::string("service_unavailable"));
+    status->error_code = json.value("code", 0u);
+    return true;
+  }
+
+  status->interactive_stage = json.value("interactive_stage", std::string());
+
+  if (ShouldNormalizeUnlockToUserDesktop(
+          json.value("interactive_lock_screen_visible", false),
+          status->interactive_stage, json.value("session_locked", false),
+          json.value("interactive_logon_ui_visible", false),
+          json.value("interactive_secure_desktop_active",
+                     json.value("secure_desktop_active", false)),
+          json.value("credential_ui_visible", false),
+          json.value("password_box_visible", false),
+          json.value("unlock_ui_visible", false),
+          json.value("last_session_event", std::string()))) {
+    status->interactive_stage = "user-desktop";
+  }
+  return true;
+}
 #endif
 
 #if defined(__linux__) && !defined(__APPLE__)
@@ -729,9 +794,21 @@ int Render::StopMouseController() {
 }
 
 int Render::StartKeyboardCapturer() {
+  keyboard_capturer_uses_sdl_events_ = false;
+
+#if defined(__linux__) && !defined(__APPLE__)
+  if (IsWaylandSession()) {
+    keyboard_capturer_uses_sdl_events_ = true;
+    LOG_INFO("Start keyboard capturer with SDL Wayland backend");
+    return 0;
+  }
+#endif
+
   if (!keyboard_capturer_) {
-    LOG_INFO("keyboard capturer is nullptr");
+    keyboard_capturer_uses_sdl_events_ = true;
-    return -1;
+    LOG_WARN(
+        "keyboard capturer is nullptr, falling back to SDL keyboard events");
+    return 0;
   }
 
   int keyboard_capturer_init_ret = keyboard_capturer_->Hook(
@@ -743,15 +820,24 @@ int Render::StartKeyboardCapturer() {
       },
       this);
   if (0 != keyboard_capturer_init_ret) {
-    LOG_ERROR("Start keyboard capturer failed");
+    keyboard_capturer_uses_sdl_events_ = true;
+    LOG_WARN(
+        "Start keyboard capturer failed, falling back to SDL keyboard "
+        "events");
   } else {
-    LOG_INFO("Start keyboard capturer");
+    LOG_INFO("Start keyboard capturer with native hook");
   }
 
-  return keyboard_capturer_init_ret;
+  return 0;
 }
 
 int Render::StopKeyboardCapturer() {
+  if (keyboard_capturer_uses_sdl_events_) {
+    keyboard_capturer_uses_sdl_events_ = false;
+    LOG_INFO("Stop keyboard capturer with SDL keyboard backend");
+    return 0;
+  }
+
   if (keyboard_capturer_) {
     keyboard_capturer_->Unhook();
     LOG_INFO("Stop keyboard capturer");
@@ -1746,6 +1832,7 @@ void Render::MainLoop() {
     HandlePendingPresenceProbe();
     HandleStreamWindow();
     HandleServerWindow();
+    HandleWindowsServiceIntegration();
 
     DrawMainWindow();
     if (stream_window_inited_) {
@@ -1772,6 +1859,141 @@ void Render::UpdateLabels() {
   }
 }
 
+void Render::ResetRemoteServiceStatus(SubStreamWindowProperties& props) {
+  props.remote_service_status_received_ = false;
+  props.remote_service_available_ = false;
+  props.remote_interactive_stage_.clear();
+}
+
+void Render::ApplyRemoteServiceStatus(SubStreamWindowProperties& props,
+                                      const ServiceStatus& status) {
+  props.remote_service_status_received_ = true;
+  props.remote_service_available_ = status.available;
+  props.remote_interactive_stage_ = status.interactive_stage;
+}
+
+Render::RemoteUnlockState Render::GetRemoteUnlockState(
+    const SubStreamWindowProperties& props) const {
+  if (!props.remote_service_status_received_) {
+    return RemoteUnlockState::none;
+  }
+  if (!props.remote_service_available_) {
+    return RemoteUnlockState::service_unavailable;
+  }
+  if (props.remote_interactive_stage_ == "credential-ui") {
+    return RemoteUnlockState::credential_ui;
+  }
+  if (props.remote_interactive_stage_ == "lock-screen") {
+    return RemoteUnlockState::lock_screen;
+  }
+  if (props.remote_interactive_stage_ == "secure-desktop") {
+    return RemoteUnlockState::secure_desktop;
+  }
+  return RemoteUnlockState::none;
+}
+
+void Render::HandleWindowsServiceIntegration() {
+#if _WIN32
+  static bool last_logged_service_available = true;
+  static unsigned int last_logged_service_error_code = 0;
+  static std::string last_logged_service_error;
+
+  if (!is_server_mode_ || peer_ == nullptr) {
+    ResetLocalWindowsServiceState(true);
+    return;
+  }
+
+  const bool has_connected_remote =
+      std::any_of(connection_status_.begin(), connection_status_.end(),
+                  [](const auto& entry) {
+                    return entry.second == ConnectionStatus::Connected;
+                  });
+  if (!has_connected_remote) {
+    ResetLocalWindowsServiceState(false);
+    return;
+  }
+
+  bool force_broadcast = false;
+  if (pending_windows_service_sas_.exchange(false, std::memory_order_relaxed)) {
+    const std::string response =
+        QueryCrossDeskService("sas", kWindowsServiceSasTimeoutMs);
+    auto json = nlohmann::json::parse(response, nullptr, false);
+    if (json.is_discarded() || !json.value("ok", false)) {
+      LOG_WARN("Remote SAS request failed: {}", response);
+    } else {
+      LOG_INFO("Remote SAS request forwarded to local Windows service");
+    }
+    last_windows_service_status_tick_ = 0;
+    force_broadcast = true;
+  }
+
+  const uint32_t now = static_cast<uint32_t>(SDL_GetTicks());
+  if (!force_broadcast && last_windows_service_status_tick_ != 0 &&
+      now - last_windows_service_status_tick_ <
+          kWindowsServiceStatusIntervalMs) {
+    return;
+  }
+  last_windows_service_status_tick_ = now;
+
+  WindowsServiceInteractiveStatus status;
+  const bool status_ok = QueryWindowsServiceInteractiveStatus(&status);
+  local_service_status_received_ = status_ok;
+  local_service_available_ = status.available;
+  local_interactive_stage_ = status.available ? status.interactive_stage : "";
+
+  if (status_ok) {
+    const bool availability_changed =
+        status.available != last_logged_service_available;
+    const bool error_changed =
+        !status.available &&
+        (status.error != last_logged_service_error ||
+         status.error_code != last_logged_service_error_code);
+    if (availability_changed || error_changed) {
+      if (status.available) {
+        LOG_INFO(
+            "Local Windows service available for secure desktop integration");
+      } else {
+        LOG_WARN(
+            "Local Windows service unavailable, secure desktop integration "
+            "disabled: error={}, code={}",
+            status.error, status.error_code);
+      }
+      last_logged_service_available = status.available;
+      last_logged_service_error = status.error;
+      last_logged_service_error_code = status.error_code;
+    }
+  } else if (last_logged_service_available ||
+             last_logged_service_error != "invalid_service_status_json") {
+    LOG_WARN(
+        "Local Windows service status query failed, secure desktop integration "
+        "disabled");
+    last_logged_service_available = false;
+    last_logged_service_error = "invalid_service_status_json";
+    last_logged_service_error_code = 0;
+  }
+
+  RemoteAction remote_action = BuildWindowsServiceStatusAction(status);
+  std::string msg = remote_action.to_json();
+  int ret = SendReliableDataFrame(peer_, msg.data(), msg.size(),
+                                  control_data_label_.c_str());
+  if (ret != 0) {
+    LOG_WARN("Broadcast Windows service status failed, ret={}", ret);
+  }
+#endif
+}
+
+#if _WIN32
+void Render::ResetLocalWindowsServiceState(bool clear_pending_sas) {
+  last_windows_service_status_tick_ = 0;
+  if (clear_pending_sas) {
+    pending_windows_service_sas_.store(false, std::memory_order_relaxed);
+  }
+  local_service_status_received_ = false;
+  local_service_available_ = false;
+  local_interactive_stage_.clear();
+}
+#endif
+
 void Render::HandleRecentConnections() {
   if (reload_recent_connections_ && main_renderer_) {
     uint32_t now_time = SDL_GetTicks();
@@ -2470,7 +2692,7 @@ void Render::ProcessSdlEvent(const SDL_Event& event) {
     case SDL_EVENT_WINDOW_FOCUS_LOST:
       if (stream_window_ &&
           SDL_GetWindowID(stream_window_) == event.window.windowID) {
-        ForceReleasePressedModifiers();
+        ForceReleasePressedKeys();
         focus_on_stream_window_ = false;
       } else if (main_window_ &&
                  SDL_GetWindowID(main_window_) == event.window.windowID) {
@@ -2502,6 +2724,15 @@ void Render::ProcessSdlEvent(const SDL_Event& event) {
       break;
     }
 
+    case SDL_EVENT_KEY_DOWN:
+    case SDL_EVENT_KEY_UP:
+      if (keyboard_capturer_is_started_ && keyboard_capturer_uses_sdl_events_ &&
+          focus_on_stream_window_ && stream_window_ &&
+          SDL_GetWindowID(stream_window_) == event.key.windowID) {
+        ProcessKeyboardEvent(event);
+      }
+      break;
+
     default:
       if (event.type == STREAM_REFRESH_EVENT) {
         auto* props = static_cast<SubStreamWindowProperties*>(event.user.data1);

src/gui/render.h

@@ -44,6 +44,14 @@
 namespace crossdesk {
 class Render {
  public:
+  enum class RemoteUnlockState {
+    none,
+    service_unavailable,
+    lock_screen,
+    credential_ui,
+    secure_desktop,
+  };
+
   struct FileTransferState {
     std::atomic<bool> file_sending_ = false;
     std::atomic<uint64_t> file_sent_bytes_ = 0;
@@ -159,6 +167,9 @@ class Render {
     std::string mouse_control_button_label_ = "Mouse Control";
     std::string audio_capture_button_label_ = "Audio Capture";
     std::string remote_host_name_ = "";
+    bool remote_service_status_received_ = false;
+    bool remote_service_available_ = false;
+    std::string remote_interactive_stage_ = "";
     std::vector<DisplayInfo> display_info_list_;
     SDL_Texture* stream_texture_ = nullptr;
     uint8_t* argb_buffer_ = nullptr;
@@ -271,6 +282,11 @@ class Render {
       std::shared_ptr<SubStreamWindowProperties>& props);
   void DrawReceivingScreenText(
       std::shared_ptr<SubStreamWindowProperties>& props);
+  void ResetRemoteServiceStatus(SubStreamWindowProperties& props);
+  void ApplyRemoteServiceStatus(SubStreamWindowProperties& props,
+                                const ServiceStatus& status);
+  RemoteUnlockState GetRemoteUnlockState(
+      const SubStreamWindowProperties& props) const;
 #ifdef __APPLE__
   int RequestPermissionWindow();
   bool CheckScreenRecordingPermission();
@@ -324,8 +340,9 @@ class Render {
  private:
   int SendKeyCommand(int key_code, bool is_down);
   static bool IsModifierVkKey(int key_code);
-  void UpdatePressedModifierState(int key_code, bool is_down);
+  void TrackPressedKeyState(int key_code, bool is_down);
-  void ForceReleasePressedModifiers();
+  void ForceReleasePressedKeys();
+  int ProcessKeyboardEvent(const SDL_Event& event);
   int ProcessMouseEvent(const SDL_Event& event);
 
   static void SdlCaptureAudioIn(void* userdata, Uint8* stream, int len);
@@ -359,6 +376,10 @@ class Render {
 
   int AudioDeviceInit();
   int AudioDeviceDestroy();
+  void HandleWindowsServiceIntegration();
+#if _WIN32
+  void ResetLocalWindowsServiceState(bool clear_pending_sas);
+#endif
 
  private:
   struct CDCache {
@@ -455,6 +476,7 @@ class Render {
   bool start_keyboard_capturer_ = false;
   bool show_cursor_ = false;
   bool keyboard_capturer_is_started_ = false;
+  bool keyboard_capturer_uses_sdl_events_ = false;
   bool foucs_on_main_window_ = false;
   bool focus_on_stream_window_ = false;
   bool main_window_minimized_ = false;
@@ -510,11 +532,19 @@ class Render {
   std::string controlled_remote_id_ = "";
   std::string focused_remote_id_ = "";
   std::string remote_client_id_ = "";
-  std::unordered_set<int> pressed_modifier_keys_;
+  std::unordered_set<int> pressed_keyboard_keys_;
-  std::mutex pressed_modifier_keys_mutex_;
+  std::mutex pressed_keyboard_keys_mutex_;
   SDL_Event last_mouse_event;
   SDL_AudioStream* output_stream_;
   uint32_t STREAM_REFRESH_EVENT = 0;
+#if _WIN32
+  std::atomic<bool> pending_windows_service_sas_{false};
+  bool local_service_status_received_ = false;
+  bool local_service_available_ = false;
+  std::string local_interactive_stage_;
+  uint32_t last_local_secure_input_block_log_tick_ = 0;
+  uint32_t last_windows_service_status_tick_ = 0;
+#endif
 
   // stream window render
   SDL_Window* stream_window_ = nullptr;

src/gui/render_callback.cpp

@@ -17,11 +17,234 @@
 #include "platform.h"
 #include "rd_log.h"
 #include "render.h"
+#if _WIN32
+#include "interactive_state.h"
+#include "service_host.h"
+#endif
 
 #define NV12_BUFFER_SIZE 1280 * 720 * 3 / 2
 
 namespace crossdesk {
 
+namespace {
+
+int TranslateSdlKeypadScancodeToVk(SDL_Scancode scancode) {
+  switch (scancode) {
+    case SDL_SCANCODE_NUMLOCKCLEAR:
+      return 0x90;
+    case SDL_SCANCODE_KP_ENTER:
+      return 0x0D;
+    case SDL_SCANCODE_KP_0:
+      return 0x60;
+    case SDL_SCANCODE_KP_1:
+      return 0x61;
+    case SDL_SCANCODE_KP_2:
+      return 0x62;
+    case SDL_SCANCODE_KP_3:
+      return 0x63;
+    case SDL_SCANCODE_KP_4:
+      return 0x64;
+    case SDL_SCANCODE_KP_5:
+      return 0x65;
+    case SDL_SCANCODE_KP_6:
+      return 0x66;
+    case SDL_SCANCODE_KP_7:
+      return 0x67;
+    case SDL_SCANCODE_KP_8:
+      return 0x68;
+    case SDL_SCANCODE_KP_9:
+      return 0x69;
+    case SDL_SCANCODE_KP_PERIOD:
+    case SDL_SCANCODE_KP_COMMA:
+      return 0x6E;
+    case SDL_SCANCODE_KP_DIVIDE:
+      return 0x6F;
+    case SDL_SCANCODE_KP_MULTIPLY:
+      return 0x6A;
+    case SDL_SCANCODE_KP_MINUS:
+      return 0x6D;
+    case SDL_SCANCODE_KP_PLUS:
+      return 0x6B;
+    case SDL_SCANCODE_KP_EQUALS:
+      return 0xBB;
+    default:
+      return -1;
+  }
+}
+
+int TranslateSdlKeyboardEventToVk(const SDL_KeyboardEvent& event) {
+  const int keypad_key_code = TranslateSdlKeypadScancodeToVk(event.scancode);
+  if (keypad_key_code >= 0) {
+    return keypad_key_code;
+  }
+
+  const int key = static_cast<int>(event.key);
+  if (key >= 'a' && key <= 'z') {
+    return key - 'a' + 0x41;
+  }
+  if (key >= 'A' && key <= 'Z') {
+    return key;
+  }
+  if (key >= '0' && key <= '9') {
+    return key;
+  }
+
+  switch (key) {
+    case ';':
+      return 0xBA;
+    case '\'':
+      return 0xDE;
+    case '`':
+      return 0xC0;
+    case ',':
+      return 0xBC;
+    case '.':
+      return 0xBE;
+    case '/':
+      return 0xBF;
+    case '\\':
+      return 0xDC;
+    case '[':
+      return 0xDB;
+    case ']':
+      return 0xDD;
+    case '-':
+      return 0xBD;
+    case '=':
+      return 0xBB;
+    default:
+      break;
+  }
+
+  switch (event.scancode) {
+    case SDL_SCANCODE_ESCAPE:
+      return 0x1B;
+    case SDL_SCANCODE_RETURN:
+      return 0x0D;
+    case SDL_SCANCODE_SPACE:
+      return 0x20;
+    case SDL_SCANCODE_BACKSPACE:
+      return 0x08;
+    case SDL_SCANCODE_TAB:
+      return 0x09;
+    case SDL_SCANCODE_PRINTSCREEN:
+      return 0x2C;
+    case SDL_SCANCODE_SCROLLLOCK:
+      return 0x91;
+    case SDL_SCANCODE_PAUSE:
+      return 0x13;
+    case SDL_SCANCODE_INSERT:
+      return 0x2D;
+    case SDL_SCANCODE_DELETE:
+      return 0x2E;
+    case SDL_SCANCODE_HOME:
+      return 0x24;
+    case SDL_SCANCODE_END:
+      return 0x23;
+    case SDL_SCANCODE_PAGEUP:
+      return 0x21;
+    case SDL_SCANCODE_PAGEDOWN:
+      return 0x22;
+    case SDL_SCANCODE_LEFT:
+      return 0x25;
+    case SDL_SCANCODE_RIGHT:
+      return 0x27;
+    case SDL_SCANCODE_UP:
+      return 0x26;
+    case SDL_SCANCODE_DOWN:
+      return 0x28;
+    case SDL_SCANCODE_F1:
+      return 0x70;
+    case SDL_SCANCODE_F2:
+      return 0x71;
+    case SDL_SCANCODE_F3:
+      return 0x72;
+    case SDL_SCANCODE_F4:
+      return 0x73;
+    case SDL_SCANCODE_F5:
+      return 0x74;
+    case SDL_SCANCODE_F6:
+      return 0x75;
+    case SDL_SCANCODE_F7:
+      return 0x76;
+    case SDL_SCANCODE_F8:
+      return 0x77;
+    case SDL_SCANCODE_F9:
+      return 0x78;
+    case SDL_SCANCODE_F10:
+      return 0x79;
+    case SDL_SCANCODE_F11:
+      return 0x7A;
+    case SDL_SCANCODE_F12:
+      return 0x7B;
+    case SDL_SCANCODE_CAPSLOCK:
+      return 0x14;
+    case SDL_SCANCODE_LSHIFT:
+      return 0xA0;
+    case SDL_SCANCODE_RSHIFT:
+      return 0xA1;
+    case SDL_SCANCODE_LCTRL:
+      return 0xA2;
+    case SDL_SCANCODE_RCTRL:
+      return 0xA3;
+    case SDL_SCANCODE_LALT:
+      return 0xA4;
+    case SDL_SCANCODE_RALT:
+      return 0xA5;
+    case SDL_SCANCODE_LGUI:
+      return 0x5B;
+    case SDL_SCANCODE_RGUI:
+      return 0x5C;
+    default:
+      return -1;
+  }
+}
+
+#if _WIN32
+constexpr uint32_t kSecureDesktopInputLogIntervalMs = 2000;
+
+bool BuildAbsoluteMousePosition(const std::vector<DisplayInfo>& displays,
+                                int display_index, float normalized_x,
+                                float normalized_y, int* absolute_x_out,
+                                int* absolute_y_out) {
+  if (absolute_x_out == nullptr || absolute_y_out == nullptr ||
+      display_index < 0 || display_index >= static_cast<int>(displays.size())) {
+    return false;
+  }
+
+  const DisplayInfo& display = displays[display_index];
+  if (display.width <= 0 || display.height <= 0) {
+    return false;
+  }
+
+  const float clamped_x = std::clamp(normalized_x, 0.0f, 1.0f);
+  const float clamped_y = std::clamp(normalized_y, 0.0f, 1.0f);
+  *absolute_x_out = static_cast<int>(clamped_x * display.width) + display.left;
+  *absolute_y_out = static_cast<int>(clamped_y * display.height) + display.top;
+  return true;
+}
+
+void LogSecureDesktopInputBlocked(uint32_t* last_tick, const char* side,
+                                  const char* stage) {
+  if (last_tick == nullptr) {
+    return;
+  }
+
+  const uint32_t now = static_cast<uint32_t>(SDL_GetTicks());
+  if (*last_tick != 0 && now - *last_tick < kSecureDesktopInputLogIntervalMs) {
+    return;
+  }
+
+  *last_tick = now;
+  LOG_WARN(
+      "{} secure-desktop input blocked, stage={}, normal SendInput path "
+      "cannot drive the Windows password UI",
+      side != nullptr ? side : "unknown", stage != nullptr ? stage : "");
+}
+#endif
+
+}  // namespace
+
 void Render::OnSignalMessageCb(const char* message, size_t size,
                                void* user_data) {
   Render* render = (Render*)user_data;
@@ -100,29 +323,29 @@ bool Render::IsModifierVkKey(int key_code) {
   }
 }
 
-void Render::UpdatePressedModifierState(int key_code, bool is_down) {
+void Render::TrackPressedKeyState(int key_code, bool is_down) {
-  if (!IsModifierVkKey(key_code)) {
+  if (!IsWaylandSession() && !IsModifierVkKey(key_code)) {
     return;
   }
 
-  std::lock_guard<std::mutex> lock(pressed_modifier_keys_mutex_);
+  std::lock_guard<std::mutex> lock(pressed_keyboard_keys_mutex_);
   if (is_down) {
-    pressed_modifier_keys_.insert(key_code);
+    pressed_keyboard_keys_.insert(key_code);
   } else {
-    pressed_modifier_keys_.erase(key_code);
+    pressed_keyboard_keys_.erase(key_code);
   }
 }
 
-void Render::ForceReleasePressedModifiers() {
+void Render::ForceReleasePressedKeys() {
   std::vector<int> pressed_keys;
   {
-    std::lock_guard<std::mutex> lock(pressed_modifier_keys_mutex_);
+    std::lock_guard<std::mutex> lock(pressed_keyboard_keys_mutex_);
-    if (pressed_modifier_keys_.empty()) {
+    if (pressed_keyboard_keys_.empty()) {
       return;
     }
-    pressed_keys.assign(pressed_modifier_keys_.begin(),
+    pressed_keys.assign(pressed_keyboard_keys_.begin(),
-                        pressed_modifier_keys_.end());
+                        pressed_keyboard_keys_.end());
-    pressed_modifier_keys_.clear();
+    pressed_keyboard_keys_.clear();
   }
 
   for (int key_code : pressed_keys) {
@@ -158,11 +381,28 @@ int Render::SendKeyCommand(int key_code, bool is_down) {
     }
   }
 
-  UpdatePressedModifierState(key_code, is_down);
+  TrackPressedKeyState(key_code, is_down);
 
   return 0;
 }
 
+int Render::ProcessKeyboardEvent(const SDL_Event& event) {
+  if (event.type != SDL_EVENT_KEY_DOWN && event.type != SDL_EVENT_KEY_UP) {
+    return -1;
+  }
+
+  if (event.type == SDL_EVENT_KEY_DOWN && event.key.repeat) {
+    return 0;
+  }
+
+  const int key_code = TranslateSdlKeyboardEventToVk(event.key);
+  if (key_code < 0) {
+    return 0;
+  }
+
+  return SendKeyCommand(key_code, event.type == SDL_EVENT_KEY_DOWN);
+}
+
 int Render::ProcessMouseEvent(const SDL_Event& event) {
   controlled_remote_id_ = "";
   RemoteAction remote_action;
@@ -240,7 +480,8 @@ int Render::ProcessMouseEvent(const SDL_Event& event) {
     }
 
     if (is_pointer_position_event && cursor_x >= render_rect.x &&
-        cursor_x <= render_rect.x + render_rect.w && cursor_y >= render_rect.y &&
+        cursor_x <= render_rect.x + render_rect.w &&
+        cursor_y >= render_rect.y &&
         cursor_y <= render_rect.y + render_rect.h) {
       controlled_remote_id_ = it.first;
       last_mouse_event.motion.x = cursor_x;
@@ -709,16 +950,31 @@ void Render::OnReceiveDataBufferCb(const char* data, size_t size,
   }
 
   std::string json_str(data, size);
-  RemoteAction remote_action;
+  RemoteAction remote_action{};
-
+  if (!remote_action.from_json(json_str)) {
-  try {
+    LOG_ERROR("Failed to parse RemoteAction JSON payload");
-    remote_action.from_json(json_str);
-  } catch (const std::exception& e) {
-    LOG_ERROR("Failed to parse RemoteAction JSON: {}", e.what());
     return;
   }
 
   std::string remote_id(user_id, user_id_size);
+  if (remote_action.type == ControlType::service_status) {
+    auto props_it = render->client_properties_.find(remote_id);
+    if (props_it != render->client_properties_.end()) {
+      render->ApplyRemoteServiceStatus(*props_it->second, remote_action.ss);
+    }
+    return;
+  }
+
+  if (remote_action.type == ControlType::service_command) {
+#if _WIN32
+    if (remote_action.c.flag == ServiceCommandFlag::send_sas) {
+      render->pending_windows_service_sas_.store(true,
+                                                 std::memory_order_relaxed);
+    }
+#endif
+    return;
+  }
+
   // std::shared_lock lock(render->client_properties_mutex_);
   if (remote_action.type == ControlType::host_infomation) {
     if (render->client_properties_.find(remote_id) !=
@@ -748,6 +1004,60 @@ void Render::OnReceiveDataBufferCb(const char* data, size_t size,
     }
   } else {
     // remote
+#if _WIN32
+    if (render->local_service_status_received_ &&
+        render->local_service_available_ &&
+        IsSecureDesktopInteractionRequired(render->local_interactive_stage_)) {
+      if (remote_action.type == ControlType::mouse) {
+        int absolute_x = 0;
+        int absolute_y = 0;
+        if (!BuildAbsoluteMousePosition(render->display_info_list_,
+                                        render->selected_display_,
+                                        remote_action.m.x, remote_action.m.y,
+                                        &absolute_x, &absolute_y)) {
+          LOG_WARN(
+              "Secure desktop mouse injection skipped, invalid display "
+              "mapping: display_index={}, x={}, y={}",
+              render->selected_display_, remote_action.m.x, remote_action.m.y);
+          return;
+        }
+
+        const std::string response = SendCrossDeskSecureDesktopMouseInput(
+            absolute_x, absolute_y, remote_action.m.s,
+            static_cast<int>(remote_action.m.flag), 1000);
+        auto json = nlohmann::json::parse(response, nullptr, false);
+        if (json.is_discarded() || !json.value("ok", false)) {
+          LogSecureDesktopInputBlocked(
+              &render->last_local_secure_input_block_log_tick_, "local",
+              render->local_interactive_stage_.c_str());
+          LOG_WARN(
+              "Secure desktop mouse injection failed, x={}, y={}, wheel={}, "
+              "flag={}, response={}",
+              absolute_x, absolute_y, remote_action.m.s,
+              static_cast<int>(remote_action.m.flag), response);
+        }
+        return;
+      }
+
+      if (remote_action.type == ControlType::keyboard) {
+        const int key_code = static_cast<int>(remote_action.k.key_value);
+        const bool is_down = remote_action.k.flag == KeyFlag::key_down;
+        const std::string response =
+            SendCrossDeskSecureDesktopKeyInput(key_code, is_down, 1000);
+        auto json = nlohmann::json::parse(response, nullptr, false);
+        if (json.is_discarded() || !json.value("ok", false)) {
+          LogSecureDesktopInputBlocked(
+              &render->last_local_secure_input_block_log_tick_, "local",
+              render->local_interactive_stage_.c_str());
+          LOG_WARN(
+              "Secure desktop keyboard injection failed, key_code={}, "
+              "is_down={}, response={}",
+              key_code, is_down, response);
+        }
+        return;
+      }
+    }
+#endif
     if (remote_action.type == ControlType::mouse && render->mouse_controller_) {
       render->mouse_controller_->SendMouseCommand(remote_action,
                                                   render->selected_display_);
@@ -841,6 +1151,7 @@ void Render::OnConnectionStatusCb(ConnectionStatus status, const char* user_id,
 
     switch (status) {
       case ConnectionStatus::Connected: {
+        render->ResetRemoteServiceStatus(*props);
         {
           RemoteAction remote_action;
           remote_action.i.display_num = render->display_info_list_.size();
@@ -904,6 +1215,7 @@ void Render::OnConnectionStatusCb(ConnectionStatus status, const char* user_id,
       case ConnectionStatus::Closed: {
         props->connection_established_ = false;
         props->enable_mouse_control_ = false;
+        render->ResetRemoteServiceStatus(*props);
 
         {
           std::lock_guard<std::mutex> lock(props->video_frame_mutex_);
@@ -954,6 +1266,9 @@ void Render::OnConnectionStatusCb(ConnectionStatus status, const char* user_id,
 
     switch (status) {
       case ConnectionStatus::Connected: {
+#if _WIN32
+        render->last_windows_service_status_tick_ = 0;
+#endif
         {
           RemoteAction remote_action;
           remote_action.i.display_num = render->display_info_list_.size();
@@ -1028,8 +1343,9 @@ void Render::OnConnectionStatusCb(ConnectionStatus status, const char* user_id,
             // Keep Wayland capture session warm to avoid black screen on
             // subsequent reconnects.
             render->start_screen_capturer_ = true;
-            LOG_INFO("Keeping Wayland screen capturer running after "
+            LOG_INFO(
-                     "disconnect to preserve reconnect stability");
+                "Keeping Wayland screen capturer running after "
+                "disconnect to preserve reconnect stability");
           } else {
             render->start_screen_capturer_ = false;
           }

src/gui/windows/control_window.cpp

@@ -257,4 +257,3 @@ int Render::ControlWindow(std::shared_ptr<SubStreamWindowProperties>& props) {
   return 0;
 }
 }  // namespace crossdesk
-

src/screen_capturer/linux/screen_capturer_linux.cpp

@@ -177,8 +177,8 @@ int ScreenCapturerLinux::Start(bool show_cursor) {
     backend_name = "Wayland";
   }
 
-  LOG_WARN("Linux screen capturer backend {} start failed: {}",
+  LOG_WARN("Linux screen capturer backend {} start failed: {}", backend_name,
-           backend_name, ret);
+           ret);
 
   if (backend_ == BackendType::kX11 && kDrmBuildEnabled &&
       TryFallbackToDrm(show_cursor)) {
@@ -484,7 +484,8 @@ void ScreenCapturerLinux::UpdateAliasesFromBackend(ScreenCapturer* backend) {
   }
 }
 
-std::string ScreenCapturerLinux::MapDisplayName(const char* display_name) const {
+std::string ScreenCapturerLinux::MapDisplayName(
+    const char* display_name) const {
   std::string input_name = display_name ? display_name : "";
   if (input_name.empty()) {
     return input_name;

src/screen_capturer/linux/screen_capturer_wayland.cpp

@@ -3,13 +3,13 @@
 #include "screen_capturer_wayland_build.h"
 
 #if !CROSSDESK_WAYLAND_BUILD_ENABLED
-#error "Wayland capturer requires USE_WAYLAND=true and Wayland development headers"
+#error \
+    "Wayland capturer requires USE_WAYLAND=true and Wayland development headers"
 #endif
 
+#include <chrono>
 #include <cstdlib>
 #include <cstring>
-
-#include <chrono>
 #include <thread>
 
 #include "platform.h"
@@ -69,6 +69,9 @@ int ScreenCapturerWayland::Init(const int fps, cb_desktop_data cb) {
   frame_width_ = kFallbackWidth;
   frame_height_ = kFallbackHeight;
   frame_stride_ = kFallbackWidth * 4;
+  portal_has_logical_size_ = false;
+  portal_stream_width_ = 0;
+  portal_stream_height_ = 0;
   logical_width_ = kFallbackWidth;
   logical_height_ = kFallbackHeight;
   y_plane_.resize(kFallbackWidth * kFallbackHeight);
@@ -94,9 +97,9 @@ int ScreenCapturerWayland::Start(bool show_cursor) {
   show_cursor_ = show_cursor;
   paused_ = false;
   pipewire_node_id_ = 0;
-  UpdateDisplayGeometry(logical_width_ > 0 ? logical_width_ : kFallbackWidth,
+  UpdateDisplayGeometry(
-                        logical_height_ > 0 ? logical_height_
+      logical_width_ > 0 ? logical_width_ : kFallbackWidth,
-                                            : kFallbackHeight);
+      logical_height_ > 0 ? logical_height_ : kFallbackHeight);
   pipewire_format_ready_.store(false);
   pipewire_stream_start_ms_.store(0);
   pipewire_last_frame_ms_.store(0);
@@ -111,9 +114,9 @@ int ScreenCapturerWayland::Stop() {
     thread_.join();
   }
   pipewire_node_id_ = 0;
-  UpdateDisplayGeometry(logical_width_ > 0 ? logical_width_ : kFallbackWidth,
+  UpdateDisplayGeometry(
-                        logical_height_ > 0 ? logical_height_
+      logical_width_ > 0 ? logical_width_ : kFallbackWidth,
-                                            : kFallbackHeight);
+      logical_height_ > 0 ? logical_height_ : kFallbackHeight);
   return 0;
 }
 
@@ -182,9 +185,9 @@ void ScreenCapturerWayland::Run() {
 
       const bool format_timeout =
           stream_start > 0 && !format_ready && (now - stream_start) > 1200;
-      const bool first_frame_timeout =
+      const bool first_frame_timeout = stream_start > 0 && format_ready &&
-          stream_start > 0 && format_ready && last_frame == 0 &&
+                                       last_frame == 0 &&
-          (now - stream_start) > 4000;
+                                       (now - stream_start) > 4000;
       const bool frame_stall = last_frame > 0 && (now - last_frame) > 5000;
 
       if (format_timeout || first_frame_timeout || frame_stall) {
@@ -200,10 +203,10 @@ void ScreenCapturerWayland::Run() {
         }
 
         ++recovery_index;
-        const char* reason = format_timeout
+        const char* reason =
-                                 ? "format-timeout"
+            format_timeout
-                                 : (first_frame_timeout ? "first-frame-timeout"
+                ? "format-timeout"
-                                                        : "frame-stall");
+                : (first_frame_timeout ? "first-frame-timeout" : "frame-stall");
         const auto& config = kRecoveryConfigs[recovery_index];
         LOG_WARN(
             "Wayland capture stalled ({}) - retrying PipeWire only, "

src/screen_capturer/linux/screen_capturer_wayland.h

@@ -94,10 +94,13 @@ class ScreenCapturerWayland : public ScreenCapturer {
   bool pipewire_thread_loop_started_ = false;
   bool pointer_granted_ = false;
   bool shared_session_registered_ = false;
+  bool portal_has_logical_size_ = false;
   uint32_t spa_video_format_ = 0;
   int frame_width_ = 0;
   int frame_height_ = 0;
   int frame_stride_ = 0;
+  int portal_stream_width_ = 0;
+  int portal_stream_height_ = 0;
   int logical_width_ = 0;
   int logical_height_ = 0;
 

src/screen_capturer/linux/screen_capturer_wayland_pipewire.cpp

@@ -1,14 +1,16 @@
 #include "screen_capturer_wayland.h"
-
 #include "screen_capturer_wayland_build.h"
 
 #if CROSSDESK_WAYLAND_BUILD_ENABLED
 
-#include <chrono>
-#include <cstdint>
-#include <thread>
 #include <unistd.h>
 
+#include <algorithm>
+#include <chrono>
+#include <cmath>
+#include <cstdint>
+#include <limits>
+#include <thread>
 #include <vector>
 
 #include "libyuv.h"
@@ -57,6 +59,22 @@ int64_t NowMs() {
       .count();
 }
 
+double SnapLikelyFractionalScale(double observed_scale) {
+  static constexpr double kCandidates[] = {
+      1.0, 1.25, 1.3333333333, 1.5, 1.6666666667, 1.75, 2.0, 2.25, 2.5, 3.0};
+  double best = observed_scale;
+  double best_error = std::numeric_limits<double>::max();
+  for (double candidate : kCandidates) {
+    const double error = std::abs(candidate - observed_scale);
+    if (error < best_error) {
+      best = candidate;
+      best_error = error;
+    }
+  }
+
+  return best_error <= 0.08 ? best : observed_scale;
+}
+
 struct PipeWireTargetLookupState {
   pw_thread_loop* loop = nullptr;
   uint32_t target_node_id = 0;
@@ -87,30 +105,30 @@ std::string LookupPipeWireTargetObjectSerial(pw_core* core,
 
   pw_registry_events registry_events{};
   registry_events.version = PW_VERSION_REGISTRY_EVENTS;
-  registry_events.global =
+  registry_events.global = [](void* userdata, uint32_t id, uint32_t permissions,
-      [](void* userdata, uint32_t id, uint32_t permissions, const char* type,
+                              const char* type, uint32_t version,
-         uint32_t version, const spa_dict* props) {
+                              const spa_dict* props) {
-        (void)permissions;
+    (void)permissions;
-        (void)version;
+    (void)version;
-        auto* state = static_cast<PipeWireTargetLookupState*>(userdata);
+    auto* state = static_cast<PipeWireTargetLookupState*>(userdata);
-        if (!state || !props || id != state->target_node_id || !type) {
+    if (!state || !props || id != state->target_node_id || !type) {
-          return;
+      return;
-        }
+    }
-        if (strcmp(type, PW_TYPE_INTERFACE_Node) != 0) {
+    if (strcmp(type, PW_TYPE_INTERFACE_Node) != 0) {
-          return;
+      return;
-        }
+    }
 
-        const char* object_serial = spa_dict_lookup(props, PW_KEY_OBJECT_SERIAL);
+    const char* object_serial = spa_dict_lookup(props, PW_KEY_OBJECT_SERIAL);
-        if (!object_serial || object_serial[0] == '\0') {
+    if (!object_serial || object_serial[0] == '\0') {
-          object_serial = spa_dict_lookup(props, "object.serial");
+      object_serial = spa_dict_lookup(props, "object.serial");
-        }
+    }
-        if (!object_serial || object_serial[0] == '\0') {
+    if (!object_serial || object_serial[0] == '\0') {
-          return;
+      return;
-        }
+    }
 
-        state->object_serial = object_serial;
+    state->object_serial = object_serial;
-        state->found = true;
+    state->found = true;
-      };
+  };
 
   pw_core_events core_events{};
   core_events.version = PW_VERSION_CORE_EVENTS;
@@ -226,23 +244,23 @@ bool ScreenCapturerWayland::SetupPipeWireStream(bool relaxed_connect,
 
   std::string target_object_serial;
   if (mode == PipeWireConnectMode::kTargetObject) {
-    target_object_serial =
+    target_object_serial = LookupPipeWireTargetObjectSerial(
-        LookupPipeWireTargetObjectSerial(pw_core_, pw_thread_loop_,
+        pw_core_, pw_thread_loop_, pipewire_node_id_);
-                                         pipewire_node_id_);
     if (!target_object_serial.empty()) {
       pw_properties_set(stream_props, PW_KEY_TARGET_OBJECT,
                         target_object_serial.c_str());
       LOG_INFO("PipeWire target object serial for node {} is {}",
                pipewire_node_id_, target_object_serial);
     } else {
-      LOG_WARN("PipeWire target object serial lookup failed for node {}, "
+      LOG_WARN(
-               "falling back to direct target id in target-object mode",
+          "PipeWire target object serial lookup failed for node {}, "
-               pipewire_node_id_);
+          "falling back to direct target id in target-object mode",
+          pipewire_node_id_);
     }
   }
 
-  pw_stream_ = pw_stream_new(pw_core_, "CrossDesk Wayland Capture",
+  pw_stream_ =
-                             stream_props);
+      pw_stream_new(pw_core_, "CrossDesk Wayland Capture", stream_props);
   if (!pw_stream_) {
     LOG_ERROR("Failed to create PipeWire stream");
     pw_thread_loop_unlock(pw_thread_loop_);
@@ -256,123 +274,180 @@ bool ScreenCapturerWayland::SetupPipeWireStream(bool relaxed_connect,
   static const pw_stream_events stream_events = [] {
     pw_stream_events events{};
     events.version = PW_VERSION_STREAM_EVENTS;
-    events.state_changed =
+    events.state_changed = [](void* userdata, enum pw_stream_state old_state,
-        [](void* userdata, enum pw_stream_state old_state,
+                              enum pw_stream_state state,
-           enum pw_stream_state state, const char* error_message) {
+                              const char* error_message) {
-          auto* self = static_cast<ScreenCapturerWayland*>(userdata);
+      auto* self = static_cast<ScreenCapturerWayland*>(userdata);
-          if (!self) {
+      if (!self) {
-            return;
+        return;
-          }
+      }
 
-          if (state == PW_STREAM_STATE_ERROR) {
+      if (state == PW_STREAM_STATE_ERROR) {
-            LOG_ERROR("PipeWire stream error: {}",
+        LOG_ERROR("PipeWire stream error: {}",
-                      error_message ? error_message : "unknown");
+                  error_message ? error_message : "unknown");
-            self->running_ = false;
+        self->running_ = false;
-            return;
+        return;
-          }
+      }
 
-          LOG_INFO("PipeWire stream state: {} -> {}",
+      LOG_INFO("PipeWire stream state: {} -> {}",
-                   pw_stream_state_as_string(old_state),
+               pw_stream_state_as_string(old_state),
-                   pw_stream_state_as_string(state));
+               pw_stream_state_as_string(state));
+    };
+    events.param_changed = [](void* userdata, uint32_t id,
+                              const struct spa_pod* param) {
+      auto* self = static_cast<ScreenCapturerWayland*>(userdata);
+      if (!self || id != SPA_PARAM_Format || !param) {
+        return;
+      }
 
-        };
+      spa_video_info_raw info{};
-    events.param_changed =
+      if (spa_format_video_raw_parse(param, &info) < 0) {
-        [](void* userdata, uint32_t id, const struct spa_pod* param) {
+        LOG_ERROR("Failed to parse PipeWire video format");
-          auto* self = static_cast<ScreenCapturerWayland*>(userdata);
+        return;
-          if (!self || id != SPA_PARAM_Format || !param) {
+      }
-            return;
-          }
 
-          spa_video_info_raw info{};
+      self->spa_video_format_ = info.format;
-          if (spa_format_video_raw_parse(param, &info) < 0) {
+      self->frame_width_ = static_cast<int>(info.size.width);
-            LOG_ERROR("Failed to parse PipeWire video format");
+      self->frame_height_ = static_cast<int>(info.size.height);
-            return;
+      self->frame_stride_ = static_cast<int>(info.size.width) * 4;
-          }
 
-          self->spa_video_format_ = info.format;
+      bool supported_format =
-          self->frame_width_ = static_cast<int>(info.size.width);
+          (self->spa_video_format_ == SPA_VIDEO_FORMAT_BGRx) ||
-          self->frame_height_ = static_cast<int>(info.size.height);
+          (self->spa_video_format_ == SPA_VIDEO_FORMAT_BGRA);
-          self->frame_stride_ = static_cast<int>(info.size.width) * 4;
-
-          bool supported_format =
-              (self->spa_video_format_ == SPA_VIDEO_FORMAT_BGRx) ||
-              (self->spa_video_format_ == SPA_VIDEO_FORMAT_BGRA);
 #ifdef SPA_VIDEO_FORMAT_RGBx
-          supported_format =
+      supported_format = supported_format ||
-              supported_format ||
+                         (self->spa_video_format_ == SPA_VIDEO_FORMAT_RGBx);
-              (self->spa_video_format_ == SPA_VIDEO_FORMAT_RGBx);
 #endif
 #ifdef SPA_VIDEO_FORMAT_RGBA
-          supported_format =
+      supported_format = supported_format ||
-              supported_format ||
+                         (self->spa_video_format_ == SPA_VIDEO_FORMAT_RGBA);
-              (self->spa_video_format_ == SPA_VIDEO_FORMAT_RGBA);
 #endif
-          if (!supported_format) {
+      if (!supported_format) {
-            LOG_ERROR("Unsupported PipeWire pixel format: {}",
+        LOG_ERROR("Unsupported PipeWire pixel format: {}",
-                      PipeWireFormatName(self->spa_video_format_));
+                  PipeWireFormatName(self->spa_video_format_));
-            self->running_ = false;
+        self->running_ = false;
-            return;
+        return;
-          }
+      }
 
-          const int bytes_per_pixel = BytesPerPixel(self->spa_video_format_);
+      const int bytes_per_pixel = BytesPerPixel(self->spa_video_format_);
-          if (bytes_per_pixel <= 0 || self->frame_width_ <= 0 ||
+      if (bytes_per_pixel <= 0 || self->frame_width_ <= 0 ||
-              self->frame_height_ <= 0) {
+          self->frame_height_ <= 0) {
-            LOG_ERROR("Invalid PipeWire frame layout: format={}, size={}x{}",
+        LOG_ERROR("Invalid PipeWire frame layout: format={}, size={}x{}",
-                      PipeWireFormatName(self->spa_video_format_),
+                  PipeWireFormatName(self->spa_video_format_),
-                      self->frame_width_, self->frame_height_);
+                  self->frame_width_, self->frame_height_);
-            self->running_ = false;
+        self->running_ = false;
-            return;
+        return;
-          }
+      }
 
-          self->frame_stride_ = self->frame_width_ * bytes_per_pixel;
+      self->frame_stride_ = self->frame_width_ * bytes_per_pixel;
 
-          uint8_t buffer[1024];
+      uint8_t buffer[1024];
-          spa_pod_builder builder = SPA_POD_BUILDER_INIT(buffer, sizeof(buffer));
+      spa_pod_builder builder = SPA_POD_BUILDER_INIT(buffer, sizeof(buffer));
-          const spa_pod* params[2];
+      const spa_pod* params[2];
-          uint32_t param_count = 0;
+      uint32_t param_count = 0;
 
-          params[param_count++] = reinterpret_cast<const spa_pod*>(
+      params[param_count++] =
-              spa_pod_builder_add_object(
+          reinterpret_cast<const spa_pod*>(spa_pod_builder_add_object(
-                  &builder, SPA_TYPE_OBJECT_ParamBuffers, SPA_PARAM_Buffers,
+              &builder, SPA_TYPE_OBJECT_ParamBuffers, SPA_PARAM_Buffers,
-                  CROSSDESK_SPA_PARAM_BUFFERS_BUFFERS,
+              CROSSDESK_SPA_PARAM_BUFFERS_BUFFERS,
-                  SPA_POD_CHOICE_RANGE_Int(8, 4, 16),
+              SPA_POD_CHOICE_RANGE_Int(8, 4, 16),
-                  CROSSDESK_SPA_PARAM_BUFFERS_BLOCKS, SPA_POD_Int(1),
+              CROSSDESK_SPA_PARAM_BUFFERS_BLOCKS, SPA_POD_Int(1),
-                  CROSSDESK_SPA_PARAM_BUFFERS_SIZE,
+              CROSSDESK_SPA_PARAM_BUFFERS_SIZE,
-                  SPA_POD_CHOICE_RANGE_Int(self->frame_stride_ *
+              SPA_POD_CHOICE_RANGE_Int(
-                                               self->frame_height_,
+                  self->frame_stride_ * self->frame_height_,
-                                           self->frame_stride_ *
+                  self->frame_stride_ * self->frame_height_,
-                                               self->frame_height_,
+                  self->frame_stride_ * self->frame_height_),
-                                           self->frame_stride_ *
+              CROSSDESK_SPA_PARAM_BUFFERS_STRIDE,
-                                               self->frame_height_),
+              SPA_POD_CHOICE_RANGE_Int(self->frame_stride_, self->frame_stride_,
-                  CROSSDESK_SPA_PARAM_BUFFERS_STRIDE,
+                                       self->frame_stride_)));
-                  SPA_POD_CHOICE_RANGE_Int(self->frame_stride_,
-                                           self->frame_stride_,
-                                           self->frame_stride_)));
 
-          params[param_count++] = reinterpret_cast<const spa_pod*>(
+      params[param_count++] =
-              spa_pod_builder_add_object(
+          reinterpret_cast<const spa_pod*>(spa_pod_builder_add_object(
-                  &builder, SPA_TYPE_OBJECT_ParamMeta, SPA_PARAM_Meta,
+              &builder, SPA_TYPE_OBJECT_ParamMeta, SPA_PARAM_Meta,
-                  CROSSDESK_SPA_PARAM_META_TYPE, SPA_POD_Id(SPA_META_Header),
+              CROSSDESK_SPA_PARAM_META_TYPE, SPA_POD_Id(SPA_META_Header),
-                  CROSSDESK_SPA_PARAM_META_SIZE,
+              CROSSDESK_SPA_PARAM_META_SIZE,
-                  SPA_POD_Int(sizeof(struct spa_meta_header))));
+              SPA_POD_Int(sizeof(struct spa_meta_header))));
 
-          if (self->pw_stream_) {
+      if (self->pw_stream_) {
-            pw_stream_update_params(self->pw_stream_, params, param_count);
+        pw_stream_update_params(self->pw_stream_, params, param_count);
-          }
+      }
-          self->pipewire_format_ready_.store(true);
+      self->pipewire_format_ready_.store(true);
 
-          const int pointer_width =
+      int pointer_width =
-              self->logical_width_ > 0 ? self->logical_width_ : self->frame_width_;
+          self->logical_width_ > 0 ? self->logical_width_ : self->frame_width_;
-          const int pointer_height = self->logical_height_ > 0
+      int pointer_height = self->logical_height_ > 0 ? self->logical_height_
-                                         ? self->logical_height_
+                                                     : self->frame_height_;
-                                         : self->frame_height_;
+      double observed_scale_x = pointer_width > 0
-          self->UpdateDisplayGeometry(pointer_width, pointer_height);
+                                    ? static_cast<double>(self->frame_width_) /
-          LOG_INFO(
+                                          static_cast<double>(pointer_width)
-              "PipeWire video format: {}, {}x{} stride={} (pointer space {}x{})",
+                                    : 1.0;
-                   PipeWireFormatName(self->spa_video_format_),
+      double observed_scale_y = pointer_height > 0
-                   self->frame_width_, self->frame_height_, self->frame_stride_,
+                                    ? static_cast<double>(self->frame_height_) /
-                   pointer_width, pointer_height);
+                                          static_cast<double>(pointer_height)
-        };
+                                    : 1.0;
+      double snapped_scale = 1.0;
+      bool derived_pointer_space = false;
+
+      if (!self->portal_has_logical_size_ && self->portal_stream_width_ > 0 &&
+          self->portal_stream_height_ > 0 && self->frame_width_ > 0 &&
+          self->frame_height_ > 0) {
+        const double raw_scale_x =
+            static_cast<double>(self->frame_width_) /
+            static_cast<double>(self->portal_stream_width_);
+        const double raw_scale_y =
+            static_cast<double>(self->frame_height_) /
+            static_cast<double>(self->portal_stream_height_);
+        const double average_scale = (raw_scale_x + raw_scale_y) * 0.5;
+        snapped_scale = SnapLikelyFractionalScale(average_scale);
+
+        const bool scales_are_consistent =
+            std::abs(raw_scale_x - raw_scale_y) <= 0.05;
+        const bool scale_was_snapped =
+            std::abs(snapped_scale - average_scale) <= 0.08;
+        if (scales_are_consistent && scale_was_snapped &&
+            snapped_scale > 1.05) {
+          pointer_width =
+              std::max(1, static_cast<int>(std::floor(
+                              static_cast<double>(self->portal_stream_width_) *
+                                  snapped_scale +
+                              1e-6)));
+          pointer_height =
+              std::max(1, static_cast<int>(std::floor(
+                              static_cast<double>(self->portal_stream_height_) *
+                                  snapped_scale +
+                              1e-6)));
+          observed_scale_x = pointer_width > 0
+                                 ? static_cast<double>(self->frame_width_) /
+                                       static_cast<double>(pointer_width)
+                                 : 1.0;
+          observed_scale_y = pointer_height > 0
+                                 ? static_cast<double>(self->frame_height_) /
+                                       static_cast<double>(pointer_height)
+                                 : 1.0;
+          derived_pointer_space = true;
+        }
+      }
+
+      self->UpdateDisplayGeometry(pointer_width, pointer_height);
+      if (derived_pointer_space) {
+        LOG_INFO(
+            "PipeWire video format: {}, {}x{} stride={} (pointer space {}x{}, "
+            "derived from portal stream {}x{} with compositor scale {:.4f}, "
+            "effective scale {:.4f}x{:.4f})",
+            PipeWireFormatName(self->spa_video_format_), self->frame_width_,
+            self->frame_height_, self->frame_stride_, pointer_width,
+            pointer_height, self->portal_stream_width_,
+            self->portal_stream_height_, snapped_scale, observed_scale_x,
+            observed_scale_y);
+      } else {
+        LOG_INFO(
+            "PipeWire video format: {}, {}x{} stride={} (pointer space {}x{}, "
+            "scale {:.4f}x{:.4f})",
+            PipeWireFormatName(self->spa_video_format_), self->frame_width_,
+            self->frame_height_, self->frame_stride_, pointer_width,
+            pointer_height, observed_scale_x, observed_scale_y);
+      }
+    };
     events.process = [](void* userdata) {
       auto* self = static_cast<ScreenCapturerWayland*>(userdata);
       if (self) {
@@ -392,7 +467,8 @@ bool ScreenCapturerWayland::SetupPipeWireStream(bool relaxed_connect,
   const spa_pod* params[8];
   int param_count = 0;
   const spa_rectangle fixed_size{
-      static_cast<uint32_t>(logical_width_ > 0 ? logical_width_ : kFallbackWidth),
+      static_cast<uint32_t>(logical_width_ > 0 ? logical_width_
+                                               : kFallbackWidth),
       static_cast<uint32_t>(logical_height_ > 0 ? logical_height_
                                                 : kFallbackHeight)};
   const spa_rectangle min_size{1u, 1u};
@@ -463,9 +539,9 @@ bool ScreenCapturerWayland::SetupPipeWireStream(bool relaxed_connect,
 }
 
 void ScreenCapturerWayland::CleanupPipeWire() {
-  const bool need_lock = pw_thread_loop_ &&
+  const bool need_lock =
-                         (pw_stream_ != nullptr || pw_core_ != nullptr ||
+      pw_thread_loop_ &&
-                          pw_context_ != nullptr);
+      (pw_stream_ != nullptr || pw_core_ != nullptr || pw_context_ != nullptr);
   if (need_lock) {
     pw_thread_loop_lock(pw_thread_loop_);
   }
@@ -584,8 +660,8 @@ void ScreenCapturerWayland::HandlePipeWireBuffer() {
     uv_plane_.resize(uv_size);
   }
 
-  libyuv::ARGBToNV12(src, stride, y_plane_.data(), even_width,
+  libyuv::ARGBToNV12(src, stride, y_plane_.data(), even_width, uv_plane_.data(),
-                     uv_plane_.data(), even_width, even_width, even_height);
+                     even_width, even_width, even_height);
 
   std::vector<uint8_t> nv12;
   nv12.reserve(y_plane_.size() + uv_plane_.size());

src/screen_capturer/linux/screen_capturer_wayland_portal.cpp

@@ -1,15 +1,15 @@
 #include "screen_capturer_wayland.h"
-
 #include "screen_capturer_wayland_build.h"
 #include "wayland_portal_shared.h"
 
 #if CROSSDESK_WAYLAND_BUILD_ENABLED
 
+#include <unistd.h>
+
 #include <chrono>
 #include <cstring>
 #include <functional>
 #include <string>
-#include <unistd.h>
 
 #include "rd_log.h"
 
@@ -149,8 +149,8 @@ std::string BuildSessionHandleFromRequestPath(
     return "";
   }
 
-  const std::string sender = request_path.substr(sender_start,
+  const std::string sender =
-                                                 token_sep - sender_start);
+      request_path.substr(sender_start, token_sep - sender_start);
   if (sender.empty()) {
     return "";
   }
@@ -284,8 +284,7 @@ bool ExtractPortalResponse(DBusMessage* message, uint32_t* response_code,
 
 bool SendPortalRequestAndHandleResponse(
     DBusConnection* connection, const char* interface_name,
-    const char* method_name,
+    const char* method_name, const char* action_name,
-    const char* action_name,
     const std::function<bool(DBusMessage*)>& append_message_args,
     const std::atomic<bool>& running,
     const std::function<bool(uint32_t, DBusMessageIter*)>& handle_results,
@@ -295,9 +294,8 @@ bool SendPortalRequestAndHandleResponse(
     return false;
   }
 
-  DBusMessage* message =
+  DBusMessage* message = dbus_message_new_method_call(
-      dbus_message_new_method_call(kPortalBusName, kPortalObjectPath,
+      kPortalBusName, kPortalObjectPath, interface_name, method_name);
-                                   interface_name, method_name);
   if (!message) {
     LOG_ERROR("Failed to allocate {} message", method_name);
     return false;
@@ -311,8 +309,8 @@ bool SendPortalRequestAndHandleResponse(
 
   DBusError error;
   dbus_error_init(&error);
-  DBusMessage* reply =
+  DBusMessage* reply = dbus_connection_send_with_reply_and_block(
-      dbus_connection_send_with_reply_and_block(connection, message, -1, &error);
+      connection, message, -1, &error);
   dbus_message_unref(message);
   if (!reply) {
     LogDbusError(action_name ? action_name : method_name, &error);
@@ -365,8 +363,8 @@ bool ScreenCapturerWayland::CheckPortalAvailability() const {
     return false;
   }
 
-  const dbus_bool_t has_owner = dbus_bus_name_has_owner(
+  const dbus_bool_t has_owner =
-      connection, kPortalBusName, &error);
+      dbus_bus_name_has_owner(connection, kPortalBusName, &error);
   if (dbus_error_is_set(&error)) {
     LogDbusError("dbus_bus_name_has_owner", &error);
     dbus_error_free(&error);
@@ -415,7 +413,8 @@ bool ScreenCapturerWayland::CreatePortalSession() {
                                          &options);
         AppendDictEntryString(&options, "session_handle_token",
                               session_handle_token);
-        AppendDictEntryString(&options, "handle_token", MakeToken("crossdesk_req"));
+        AppendDictEntryString(&options, "handle_token",
+                              MakeToken("crossdesk_req"));
         dbus_message_iter_close_container(&iter, &options);
         return true;
       },
@@ -459,8 +458,8 @@ bool ScreenCapturerWayland::CreatePortalSession() {
   }
 
   if (session_handle_.empty()) {
-    const std::string fallback_handle = BuildSessionHandleFromRequestPath(
+    const std::string fallback_handle =
-        request_path, session_handle_token);
+        BuildSessionHandleFromRequestPath(request_path, session_handle_token);
     if (!fallback_handle.empty()) {
       LOG_WARN(
           "CreateSession response missing session_handle, using derived handle "
@@ -505,7 +504,8 @@ bool ScreenCapturerWayland::SelectPortalSource() {
         dbus_message_iter_close_container(&iter, &options);
         return true;
       },
-      running_, [](uint32_t response_code, DBusMessageIter*) {
+      running_,
+      [](uint32_t response_code, DBusMessageIter*) {
         if (response_code != 0) {
           LOG_ERROR("SelectSources was denied or malformed, response={}",
                     response_code);
@@ -538,7 +538,8 @@ bool ScreenCapturerWayland::SelectPortalDevices() {
         dbus_message_iter_close_container(&iter, &options);
         return true;
       },
-      running_, [](uint32_t response_code, DBusMessageIter*) {
+      running_,
+      [](uint32_t response_code, DBusMessageIter*) {
         if (response_code != 0) {
           LOG_ERROR("SelectDevices was denied or malformed, response={}",
                     response_code);
@@ -567,14 +568,16 @@ bool ScreenCapturerWayland::StartPortalSession() {
         dbus_message_iter_append_basic(&iter, DBUS_TYPE_STRING, &parent_window);
         dbus_message_iter_open_container(&iter, DBUS_TYPE_ARRAY, "{sv}",
                                          &options);
-        AppendDictEntryString(&options, "handle_token", MakeToken("crossdesk_req"));
+        AppendDictEntryString(&options, "handle_token",
+                              MakeToken("crossdesk_req"));
         dbus_message_iter_close_container(&iter, &options);
         return true;
       },
       running_,
       [&](uint32_t response_code, DBusMessageIter* results) {
         if (response_code != 0) {
-          LOG_ERROR("Start was denied or malformed, response={}", response_code);
+          LOG_ERROR("Start was denied or malformed, response={}",
+                    response_code);
           return false;
         }
 
@@ -602,16 +605,19 @@ bool ScreenCapturerWayland::StartPortalSession() {
                 DBusMessageIter streams;
                 dbus_message_iter_recurse(&variant, &streams);
 
-                if (dbus_message_iter_get_arg_type(&streams) == DBUS_TYPE_STRUCT) {
+                if (dbus_message_iter_get_arg_type(&streams) ==
+                    DBUS_TYPE_STRUCT) {
                   DBusMessageIter stream;
                   dbus_message_iter_recurse(&streams, &stream);
 
-                  if (dbus_message_iter_get_arg_type(&stream) == DBUS_TYPE_UINT32) {
+                  if (dbus_message_iter_get_arg_type(&stream) ==
+                      DBUS_TYPE_UINT32) {
                     dbus_message_iter_get_basic(&stream, &pipewire_node_id_);
                   }
 
                   if (dbus_message_iter_next(&stream) &&
-                      dbus_message_iter_get_arg_type(&stream) == DBUS_TYPE_ARRAY) {
+                      dbus_message_iter_get_arg_type(&stream) ==
+                          DBUS_TYPE_ARRAY) {
                     DBusMessageIter props;
                     int stream_width = 0;
                     int stream_height = 0;
@@ -637,7 +643,8 @@ bool ScreenCapturerWayland::StartPortalSession() {
                             DBusMessageIter size_iter;
                             int width = 0;
                             int height = 0;
-                            dbus_message_iter_recurse(&prop_variant, &size_iter);
+                            dbus_message_iter_recurse(&prop_variant,
+                                                      &size_iter);
                             if (ReadIntLike(&size_iter, &width) &&
                                 dbus_message_iter_next(&size_iter) &&
                                 ReadIntLike(&size_iter, &height)) {
@@ -665,6 +672,11 @@ bool ScreenCapturerWayland::StartPortalSession() {
                         stream_width, stream_height, logical_width,
                         logical_height, picked_width, picked_height);
 
+                    portal_stream_width_ = stream_width;
+                    portal_stream_height_ = stream_height;
+                    portal_has_logical_size_ =
+                        logical_width > 0 && logical_height > 0;
+
                     if (logical_width > 0 && logical_height > 0) {
                       logical_width_ = logical_width;
                       logical_height_ = logical_height;
@@ -682,8 +694,7 @@ bool ScreenCapturerWayland::StartPortalSession() {
 
           dbus_message_iter_next(&dict);
         }
-        pointer_granted_ =
+        pointer_granted_ = (granted_devices & kRemoteDesktopDevicePointer) != 0;
-            (granted_devices & kRemoteDesktopDevicePointer) != 0;
         return true;
       });
   if (!ok) {
@@ -699,8 +710,8 @@ bool ScreenCapturerWayland::StartPortalSession() {
     return false;
   }
 
-  shared_session_registered_ = PublishSharedWaylandPortalSession(
+  shared_session_registered_ =
-      SharedWaylandPortalSessionInfo{
+      PublishSharedWaylandPortalSession(SharedWaylandPortalSessionInfo{
           dbus_connection_, session_handle_, pipewire_node_id_, logical_width_,
           logical_height_, pointer_granted_});
   if (!shared_session_registered_) {
@@ -728,16 +739,14 @@ bool ScreenCapturerWayland::OpenPipeWireRemote() {
   DBusMessageIter options;
   const char* session_handle = session_handle_.c_str();
   dbus_message_iter_init_append(message, &iter);
-  dbus_message_iter_append_basic(&iter, DBUS_TYPE_OBJECT_PATH,
+  dbus_message_iter_append_basic(&iter, DBUS_TYPE_OBJECT_PATH, &session_handle);
-                                 &session_handle);
   dbus_message_iter_open_container(&iter, DBUS_TYPE_ARRAY, "{sv}", &options);
   dbus_message_iter_close_container(&iter, &options);
 
   DBusError error;
   dbus_error_init(&error);
-  DBusMessage* reply =
+  DBusMessage* reply = dbus_connection_send_with_reply_and_block(
-      dbus_connection_send_with_reply_and_block(dbus_connection_, message, -1,
+      dbus_connection_, message, -1, &error);
-                                                &error);
   dbus_message_unref(message);
   if (!reply) {
     LogDbusError("OpenPipeWireRemote", &error);
@@ -792,9 +801,8 @@ void ScreenCapturerWayland::ClosePortalSession() {
     ReleaseSharedWaylandPortalSession(&close_connection, &close_session_handle);
     shared_session_registered_ = false;
     if (close_connection) {
-      CloseWaylandPortalSessionAndConnection(close_connection,
+      CloseWaylandPortalSessionAndConnection(
-                                             close_session_handle,
+          close_connection, close_session_handle, "Session.Close");
-                                             "Session.Close");
     }
     dbus_connection_ = nullptr;
   } else if (dbus_connection_ && !session_handle_.empty()) {
@@ -805,9 +813,9 @@ void ScreenCapturerWayland::ClosePortalSession() {
 
   session_handle_.clear();
   pipewire_node_id_ = 0;
-  UpdateDisplayGeometry(logical_width_ > 0 ? logical_width_ : kFallbackWidth,
+  UpdateDisplayGeometry(
-                        logical_height_ > 0 ? logical_height_
+      logical_width_ > 0 ? logical_width_ : kFallbackWidth,
-                                            : kFallbackHeight);
+      logical_height_ > 0 ? logical_height_ : kFallbackHeight);
   pointer_granted_ = false;
 }
 

src/screen_capturer/windows/screen_capturer_win.cpp

@@ -2,22 +2,49 @@
 
 #include <Windows.h>
 
+#include <chrono>
 #include <cmath>
+#include <cstring>
 #include <filesystem>
 #include <memory>
+#include <nlohmann/json.hpp>
+#include <sstream>
 #include <string>
+#include <thread>
 #include <utility>
 #include <vector>
 
+#include "interactive_state.h"
 #include "rd_log.h"
 #include "screen_capturer_dxgi.h"
 #include "screen_capturer_gdi.h"
+#include "service_host.h"
+#include "session_helper_shared.h"
 #include "wgc_plugin_api.h"
 
 namespace crossdesk {
 
 namespace {
 
+using Json = nlohmann::json;
+
+constexpr DWORD kSecureDesktopStatusIntervalMs = 250;
+constexpr DWORD kSecureDesktopStatusPipeTimeoutMs = 150;
+constexpr DWORD kSecureDesktopHelperPipeTimeoutMs = 120;
+constexpr DWORD kSecureDesktopTransientErrorGraceMs = 1500;
+constexpr DWORD kSecureDesktopTransientErrorLogIntervalMs = 5000;
+constexpr int kSecureDesktopCaptureMinIntervalMs = 100;
+
+struct SecureDesktopServiceStatus {
+  bool service_available = false;
+  bool capture_active = false;
+  bool helper_running = false;
+  DWORD active_session_id = 0xFFFFFFFF;
+  DWORD error_code = 0;
+  std::string interactive_stage;
+  std::string error;
+};
+
 class WgcPluginCapturer final : public ScreenCapturer {
  public:
   using CreateFn = ScreenCapturer* (*)();
@@ -101,6 +128,213 @@ class WgcPluginCapturer final : public ScreenCapturer {
   DestroyFn destroy_fn_ = nullptr;
 };
 
+std::string BuildSecureCaptureCommand(int left, int top, int width, int height,
+                                      bool show_cursor) {
+  std::ostringstream stream;
+  stream << kCrossDeskSecureInputCaptureCommandPrefix << left << ":" << top
+         << ":" << width << ":" << height << ":" << (show_cursor ? 1 : 0);
+  return stream.str();
+}
+
+std::string ExtractPipeTextResponse(const std::vector<uint8_t>& response) {
+  if (response.empty() || response.front() != '{') {
+    return "<non-text-response>";
+  }
+  return std::string(response.begin(), response.end());
+}
+
+bool IsTransientSecureDesktopFrameError(const std::string& error_message) {
+  return error_message.rfind("pipe_unavailable:", 0) == 0 ||
+         error_message.find("\"error\":\"bitblt_failed\"") != std::string::npos;
+}
+
+bool ReadPipeMessage(HANDLE pipe, std::vector<uint8_t>* response_out,
+                     DWORD* error_code_out = nullptr) {
+  if (response_out == nullptr) {
+    return false;
+  }
+
+  response_out->clear();
+  if (error_code_out != nullptr) {
+    *error_code_out = 0;
+  }
+
+  std::vector<uint8_t> chunk(64 * 1024);
+  while (true) {
+    DWORD bytes_read = 0;
+    if (ReadFile(pipe, chunk.data(), static_cast<DWORD>(chunk.size()),
+                 &bytes_read, nullptr)) {
+      response_out->insert(response_out->end(), chunk.begin(),
+                           chunk.begin() + bytes_read);
+      return true;
+    }
+
+    const DWORD error = GetLastError();
+    response_out->insert(response_out->end(), chunk.begin(),
+                         chunk.begin() + bytes_read);
+    if (error == ERROR_MORE_DATA) {
+      continue;
+    }
+
+    if (error_code_out != nullptr) {
+      *error_code_out = error;
+    }
+    return false;
+  }
+}
+
+bool ParseSecureDesktopFrameResponse(const std::vector<uint8_t>& response,
+                                     std::vector<uint8_t>* nv12_frame_out,
+                                     int* width_out, int* height_out,
+                                     std::string* error_out) {
+  if (nv12_frame_out == nullptr || width_out == nullptr ||
+      height_out == nullptr) {
+    return false;
+  }
+
+  if (response.size() < sizeof(CrossDeskSecureDesktopFrameHeader)) {
+    if (error_out != nullptr) {
+      *error_out = ExtractPipeTextResponse(response);
+    }
+    return false;
+  }
+
+  CrossDeskSecureDesktopFrameHeader header{};
+  std::memcpy(&header, response.data(), sizeof(header));
+  if (header.magic != kCrossDeskSecureDesktopFrameMagic ||
+      header.version != kCrossDeskSecureDesktopFrameVersion) {
+    if (error_out != nullptr) {
+      *error_out = ExtractPipeTextResponse(response);
+    }
+    return false;
+  }
+
+  const size_t expected_size = sizeof(header) + header.payload_size;
+  if (expected_size != response.size()) {
+    if (error_out != nullptr) {
+      *error_out = "<invalid-frame-size>";
+    }
+    return false;
+  }
+
+  *width_out = static_cast<int>(header.width);
+  *height_out = static_cast<int>(header.height);
+  nv12_frame_out->assign(response.begin() + sizeof(header), response.end());
+  return true;
+}
+
+bool QuerySecureDesktopServiceStatus(SecureDesktopServiceStatus* status) {
+  if (status == nullptr) {
+    return false;
+  }
+
+  *status = {};
+  const std::string response =
+      QueryCrossDeskService("status", kSecureDesktopStatusPipeTimeoutMs);
+  Json json = Json::parse(response, nullptr, false);
+  if (json.is_discarded() || !json.is_object()) {
+    status->error = "invalid_service_status_json";
+    return false;
+  }
+
+  status->service_available = json.value("ok", false);
+  if (!status->service_available) {
+    status->error = json.value("error", std::string("service_unavailable"));
+    status->error_code = json.value("code", 0u);
+    return true;
+  }
+
+  if (ShouldNormalizeUnlockToUserDesktop(
+          json.value("interactive_lock_screen_visible", false),
+          json.value("interactive_stage", std::string()),
+          json.value("session_locked", false),
+          json.value("interactive_logon_ui_visible", false),
+          json.value("interactive_secure_desktop_active",
+                     json.value("secure_desktop_active", false)),
+          json.value("credential_ui_visible", false),
+          json.value("password_box_visible", false),
+          json.value("unlock_ui_visible", false),
+          json.value("last_session_event", std::string()))) {
+    status->active_session_id = json.value("active_session_id", 0xFFFFFFFFu);
+    status->interactive_stage = "user-desktop";
+    status->capture_active = false;
+    return true;
+  }
+
+  status->active_session_id = json.value("active_session_id", 0xFFFFFFFFu);
+  status->helper_running = json.value("secure_input_helper_running", false);
+  status->interactive_stage = json.value("interactive_stage", std::string());
+  const bool secure_desktop_active =
+      json.value("interactive_secure_desktop_active",
+                 json.value("secure_desktop_active", false));
+  status->capture_active =
+      status->active_session_id != 0xFFFFFFFF &&
+      (secure_desktop_active ||
+       IsSecureDesktopInteractionRequired(status->interactive_stage));
+  return true;
+}
+
+bool QuerySecureDesktopHelperFrame(DWORD session_id, int left, int top,
+                                   int width, int height, bool show_cursor,
+                                   std::vector<uint8_t>* nv12_frame_out,
+                                   int* captured_width_out,
+                                   int* captured_height_out,
+                                   std::string* error_out) {
+  if (nv12_frame_out == nullptr || captured_width_out == nullptr ||
+      captured_height_out == nullptr) {
+    return false;
+  }
+
+  const std::wstring pipe_name =
+      GetCrossDeskSecureInputHelperPipeName(session_id);
+  if (!WaitNamedPipeW(pipe_name.c_str(), kSecureDesktopHelperPipeTimeoutMs)) {
+    if (error_out != nullptr) {
+      *error_out = "pipe_unavailable:" + std::to_string(GetLastError());
+    }
+    return false;
+  }
+
+  HANDLE pipe = CreateFileW(pipe_name.c_str(), GENERIC_READ | GENERIC_WRITE, 0,
+                            nullptr, OPEN_EXISTING, 0, nullptr);
+  if (pipe == INVALID_HANDLE_VALUE) {
+    if (error_out != nullptr) {
+      *error_out = "pipe_connect_failed:" + std::to_string(GetLastError());
+    }
+    return false;
+  }
+
+  DWORD pipe_mode = PIPE_READMODE_MESSAGE;
+  SetNamedPipeHandleState(pipe, &pipe_mode, nullptr, nullptr);
+
+  const std::string command =
+      BuildSecureCaptureCommand(left, top, width, height, show_cursor);
+  DWORD bytes_written = 0;
+  if (!WriteFile(pipe, command.data(), static_cast<DWORD>(command.size()),
+                 &bytes_written, nullptr)) {
+    const DWORD error = GetLastError();
+    CloseHandle(pipe);
+    if (error_out != nullptr) {
+      *error_out = "pipe_write_failed:" + std::to_string(error);
+    }
+    return false;
+  }
+
+  std::vector<uint8_t> response;
+  DWORD read_error = 0;
+  const bool read_ok = ReadPipeMessage(pipe, &response, &read_error);
+  CloseHandle(pipe);
+  if (!read_ok) {
+    if (error_out != nullptr) {
+      *error_out = "pipe_read_failed:" + std::to_string(read_error);
+    }
+    return false;
+  }
+
+  return ParseSecureDesktopFrameResponse(response, nv12_frame_out,
+                                         captured_width_out,
+                                         captured_height_out, error_out);
+}
+
 }  // namespace
 
 ScreenCapturerWin::ScreenCapturerWin() {}
@@ -111,6 +345,10 @@ int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
   cb_orig_ = cb;
   cb_ = [this](unsigned char* data, int size, int w, int h,
                const char* display_name) {
+    if (secure_desktop_capture_active_.load(std::memory_order_relaxed)) {
+      return;
+    }
+
     std::string mapped_name;
     {
       std::lock_guard<std::mutex> lock(alias_mutex_);
@@ -137,6 +375,8 @@ int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
   if (ret == 0) {
     LOG_INFO("Windows capturer: using WGC plugin");
     BuildCanonicalFromImpl();
+    monitor_index_.store(0, std::memory_order_relaxed);
+    initial_monitor_index_ = 0;
     return 0;
   }
 
@@ -150,6 +390,8 @@ int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
   if (ret == 0) {
     LOG_INFO("Windows capturer: using DXGI Desktop Duplication");
     BuildCanonicalFromImpl();
+    monitor_index_.store(0, std::memory_order_relaxed);
+    initial_monitor_index_ = 0;
     return 0;
   }
 
@@ -162,6 +404,8 @@ int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
   if (ret == 0) {
     LOG_INFO("Windows capturer: using GDI BitBlt");
     BuildCanonicalFromImpl();
+    monitor_index_.store(0, std::memory_order_relaxed);
+    initial_monitor_index_ = 0;
     return 0;
   }
 
@@ -171,6 +415,8 @@ int ScreenCapturerWin::Init(const int fps, cb_desktop_data cb) {
 }
 
 int ScreenCapturerWin::Destroy() {
+  Stop();
+  paused_.store(false, std::memory_order_relaxed);
   if (impl_) {
     impl_->Destroy();
     impl_.reset();
@@ -187,67 +433,100 @@ int ScreenCapturerWin::Destroy() {
 
 int ScreenCapturerWin::Start(bool show_cursor) {
   if (!impl_) return -1;
+  if (running_.load(std::memory_order_relaxed)) {
+    return 0;
+  }
+
+  show_cursor_.store(show_cursor, std::memory_order_relaxed);
+  paused_.store(false, std::memory_order_relaxed);
+
   int ret = impl_->Start(show_cursor);
-  if (ret == 0) return 0;
+  if (ret != 0) {
+    LOG_WARN("Windows capturer: Start failed (ret={}), trying fallback", ret);
 
-  LOG_WARN("Windows capturer: Start failed (ret={}), trying fallback", ret);
+    auto try_init_start = [&](std::unique_ptr<ScreenCapturer> cand) -> bool {
+      int r = cand->Init(fps_, cb_);
+      if (r != 0) return false;
+      int s = cand->Start(show_cursor);
+      if (s == 0) {
+        impl_ = std::move(cand);
+        impl_is_wgc_plugin_ = false;
+        RebuildAliasesFromImpl();
+        return true;
+      }
+      return false;
+    };
 
-  auto try_init_start = [&](std::unique_ptr<ScreenCapturer> cand) -> bool {
+    bool fallback_started = false;
-    int r = cand->Init(fps_, cb_);
+    if (impl_is_wgc_plugin_) {
-    if (r != 0) return false;
+      if (try_init_start(std::make_unique<ScreenCapturerDxgi>())) {
-    int s = cand->Start(show_cursor);
+        LOG_INFO("Windows capturer: fallback to DXGI");
-    if (s == 0) {
+        fallback_started = true;
-      impl_ = std::move(cand);
+      } else if (try_init_start(std::make_unique<ScreenCapturerGdi>())) {
-      impl_is_wgc_plugin_ = false;
+        LOG_INFO("Windows capturer: fallback to GDI");
-      RebuildAliasesFromImpl();
+        fallback_started = true;
-      return true;
+      }
+    } else if (dynamic_cast<ScreenCapturerDxgi*>(impl_.get())) {
+      if (try_init_start(std::make_unique<ScreenCapturerGdi>())) {
+        LOG_INFO("Windows capturer: fallback to GDI");
+        fallback_started = true;
+      }
     }
-    return false;
-  };
 
-  if (impl_is_wgc_plugin_) {
+    if (!fallback_started) {
-    if (try_init_start(std::make_unique<ScreenCapturerDxgi>())) {
+      LOG_ERROR("Windows capturer: all fallbacks failed to start");
-      LOG_INFO("Windows capturer: fallback to DXGI");
+      return ret;
-      return 0;
-    }
-    if (try_init_start(std::make_unique<ScreenCapturerGdi>())) {
-      LOG_INFO("Windows capturer: fallback to GDI");
-      return 0;
-    }
-  } else if (dynamic_cast<ScreenCapturerDxgi*>(impl_.get())) {
-    if (try_init_start(std::make_unique<ScreenCapturerGdi>())) {
-      LOG_INFO("Windows capturer: fallback to GDI");
-      return 0;
     }
   }
 
-  LOG_ERROR("Windows capturer: all fallbacks failed to start");
+  running_.store(true, std::memory_order_relaxed);
-  return ret;
+  secure_desktop_capture_active_.store(false, std::memory_order_relaxed);
+  if (!secure_capture_thread_.joinable()) {
+    secure_capture_thread_ =
+        std::thread([this]() { SecureDesktopCaptureLoop(); });
+  }
+  return 0;
 }
 
 int ScreenCapturerWin::Stop() {
-  if (!impl_) return 0;
+  running_.store(false, std::memory_order_relaxed);
-  return impl_->Stop();
+  secure_desktop_capture_active_.store(false, std::memory_order_relaxed);
+  int ret = 0;
+  if (impl_) {
+    ret = impl_->Stop();
+  }
+  StopSecureCaptureThread();
+  return ret;
 }
 
 int ScreenCapturerWin::Pause(int monitor_index) {
+  paused_.store(true, std::memory_order_relaxed);
   if (!impl_) return -1;
   return impl_->Pause(monitor_index);
 }
 
 int ScreenCapturerWin::Resume(int monitor_index) {
+  paused_.store(false, std::memory_order_relaxed);
   if (!impl_) return -1;
   return impl_->Resume(monitor_index);
 }
 
 int ScreenCapturerWin::SwitchTo(int monitor_index) {
   if (!impl_) return -1;
-  return impl_->SwitchTo(monitor_index);
+  const int ret = impl_->SwitchTo(monitor_index);
+  if (ret == 0) {
+    monitor_index_.store(monitor_index, std::memory_order_relaxed);
+  }
+  return ret;
 }
 
 int ScreenCapturerWin::ResetToInitialMonitor() {
   if (!impl_) return -1;
-  return impl_->ResetToInitialMonitor();
+  const int ret = impl_->ResetToInitialMonitor();
+  if (ret == 0) {
+    monitor_index_.store(initial_monitor_index_, std::memory_order_relaxed);
+  }
+  return ret;
 }
 
 std::vector<DisplayInfo> ScreenCapturerWin::GetDisplayInfoList() {
@@ -297,4 +576,173 @@ void ScreenCapturerWin::RebuildAliasesFromImpl() {
   }
 }
 
+void ScreenCapturerWin::StopSecureCaptureThread() {
+  if (secure_capture_thread_.joinable()) {
+    secure_capture_thread_.join();
+  }
+}
+
+bool ScreenCapturerWin::GetCurrentCaptureRegion(int* left, int* top, int* width,
+                                                int* height,
+                                                std::string* display_name) {
+  if (left == nullptr || top == nullptr || width == nullptr ||
+      height == nullptr || display_name == nullptr) {
+    return false;
+  }
+
+  std::lock_guard<std::mutex> lock(alias_mutex_);
+  if (canonical_displays_.empty()) {
+    return false;
+  }
+
+  int current_monitor = monitor_index_.load(std::memory_order_relaxed);
+  if (current_monitor < 0 ||
+      current_monitor >= static_cast<int>(canonical_displays_.size())) {
+    current_monitor = 0;
+  }
+
+  const auto& display = canonical_displays_[current_monitor];
+  const int capture_width = display.width & ~1;
+  const int capture_height = display.height & ~1;
+  if (capture_width <= 0 || capture_height <= 0) {
+    return false;
+  }
+
+  *left = display.left;
+  *top = display.top;
+  *width = capture_width;
+  *height = capture_height;
+  *display_name = display.name;
+  return true;
+}
+
+void ScreenCapturerWin::SecureDesktopCaptureLoop() {
+  const int frame_interval_ms =
+      fps_ > 0 ? (std::max)(kSecureDesktopCaptureMinIntervalMs, 1000 / fps_)
+               : kSecureDesktopCaptureMinIntervalMs;
+  ULONGLONG last_status_tick = 0;
+  ULONGLONG last_error_tick = 0;
+  bool last_capture_active = false;
+  bool last_service_available = true;
+  std::string last_stage;
+  std::string last_service_error;
+  ULONGLONG capture_stage_started_tick = 0;
+  SecureDesktopServiceStatus status;
+  std::vector<uint8_t> secure_frame;
+
+  while (running_.load(std::memory_order_relaxed)) {
+    if (paused_.load(std::memory_order_relaxed)) {
+      std::this_thread::sleep_for(std::chrono::milliseconds(10));
+      continue;
+    }
+
+    const ULONGLONG now = GetTickCount64();
+    if (last_status_tick == 0 ||
+        now - last_status_tick >= kSecureDesktopStatusIntervalMs) {
+      SecureDesktopServiceStatus latest_status;
+      const bool status_ok = QuerySecureDesktopServiceStatus(&latest_status);
+      status = latest_status;
+      if (status_ok) {
+        const bool service_changed =
+            status.service_available != last_service_available;
+        const bool service_error_changed =
+            !status.service_available && status.error != last_service_error;
+        if (service_changed || service_error_changed) {
+          if (status.service_available) {
+            LOG_INFO(
+                "Windows capturer secure desktop service available, polling "
+                "session_id={}",
+                status.active_session_id);
+          } else {
+            LOG_WARN(
+                "Windows capturer secure desktop service unavailable: "
+                "error={}, code={}",
+                status.error, status.error_code);
+          }
+          last_service_available = status.service_available;
+          last_service_error = status.error;
+        }
+      } else if (last_service_available ||
+                 last_service_error != "invalid_service_status_json") {
+        LOG_WARN("Windows capturer secure desktop service status query failed");
+        last_service_available = false;
+        last_service_error = "invalid_service_status_json";
+      }
+
+      secure_desktop_capture_active_.store(status.capture_active,
+                                           std::memory_order_relaxed);
+      if (status.capture_active != last_capture_active ||
+          status.interactive_stage != last_stage) {
+        capture_stage_started_tick = now;
+        LOG_INFO(
+            "Windows capturer secure desktop state: active={}, stage='{}', "
+            "session_id={}",
+            status.capture_active, status.interactive_stage,
+            status.active_session_id);
+        last_capture_active = status.capture_active;
+        last_stage = status.interactive_stage;
+      }
+      last_status_tick = now;
+    }
+
+    if (!status.capture_active || status.active_session_id == 0xFFFFFFFF) {
+      std::this_thread::sleep_for(
+          std::chrono::milliseconds(status.service_available ? 50 : 200));
+      continue;
+    }
+
+    if (!status.helper_running) {
+      std::this_thread::sleep_for(std::chrono::milliseconds(30));
+      continue;
+    }
+
+    int left = 0;
+    int top = 0;
+    int width = 0;
+    int height = 0;
+    std::string display_name;
+    if (!GetCurrentCaptureRegion(&left, &top, &width, &height, &display_name)) {
+      std::this_thread::sleep_for(std::chrono::milliseconds(100));
+      continue;
+    }
+
+    int captured_width = 0;
+    int captured_height = 0;
+    std::string error_message;
+    if (QuerySecureDesktopHelperFrame(
+            status.active_session_id, left, top, width, height,
+            show_cursor_.load(std::memory_order_relaxed), &secure_frame,
+            &captured_width, &captured_height, &error_message)) {
+      if (cb_orig_ && !secure_frame.empty()) {
+        cb_orig_(secure_frame.data(), static_cast<int>(secure_frame.size()),
+                 captured_width, captured_height, display_name.c_str());
+      }
+    } else {
+      const bool transient_error =
+          IsTransientSecureDesktopFrameError(error_message);
+      const bool in_grace_period = capture_stage_started_tick != 0 &&
+                                   now - capture_stage_started_tick <
+                                       kSecureDesktopTransientErrorGraceMs;
+      const DWORD log_interval =
+          transient_error ? kSecureDesktopTransientErrorLogIntervalMs : 1000;
+      if (transient_error && in_grace_period) {
+        std::this_thread::sleep_for(
+            std::chrono::milliseconds(frame_interval_ms));
+        continue;
+      }
+      if (now - last_error_tick >= log_interval) {
+        LOG_WARN(
+            "Windows capturer secure desktop frame query failed, stage='{}', "
+            "session_id={}, error={}",
+            status.interactive_stage, status.active_session_id, error_message);
+        last_error_tick = now;
+      }
+    }
+
+    std::this_thread::sleep_for(std::chrono::milliseconds(frame_interval_ms));
+  }
+
+  secure_desktop_capture_active_.store(false, std::memory_order_relaxed);
+}
+
 }  // namespace crossdesk

src/screen_capturer/windows/screen_capturer_win.h

@@ -7,8 +7,12 @@
 #ifndef _SCREEN_CAPTURER_WIN_H_
 #define _SCREEN_CAPTURER_WIN_H_
 
+#include <Windows.h>
+
+#include <atomic>
 #include <memory>
 #include <mutex>
+#include <thread>
 #include <unordered_map>
 #include <unordered_set>
 #include <vector>
@@ -48,9 +52,20 @@ class ScreenCapturerWin : public ScreenCapturer {
   std::mutex alias_mutex_;
   std::vector<DisplayInfo> canonical_displays_;
   std::unordered_set<std::string> canonical_labels_;
+  std::atomic<bool> running_{false};
+  std::atomic<bool> paused_{false};
+  std::atomic<bool> show_cursor_{true};
+  std::atomic<int> monitor_index_{0};
+  int initial_monitor_index_ = 0;
+  std::atomic<bool> secure_desktop_capture_active_{false};
+  std::thread secure_capture_thread_;
 
   void BuildCanonicalFromImpl();
   void RebuildAliasesFromImpl();
+  void StopSecureCaptureThread();
+  void SecureDesktopCaptureLoop();
+  bool GetCurrentCaptureRegion(int* left, int* top, int* width, int* height,
+                               std::string* display_name);
 };
 }  // namespace crossdesk
 #endif

src/service/windows/interactive_state.h

@@ -0,0 +1,41 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-04-21
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _INTERACTIVE_STATE_H_
+#define _INTERACTIVE_STATE_H_
+
+#include <string>
+
+namespace crossdesk {
+
+inline bool IsSecureDesktopInteractionRequired(
+    const std::string& interactive_stage) {
+  return interactive_stage == "credential-ui" ||
+         interactive_stage == "secure-desktop";
+}
+
+inline bool ShouldNormalizeUnlockToUserDesktop(
+    bool interactive_lock_screen_visible, const std::string& interactive_stage,
+    bool session_locked, bool interactive_logon_ui_visible,
+    bool interactive_secure_desktop_active, bool credential_ui_visible,
+    bool password_box_visible, bool unlock_ui_visible,
+    const std::string& last_session_event) {
+  if (!interactive_lock_screen_visible && interactive_stage != "lock-screen") {
+    return false;
+  }
+
+  if (session_locked || interactive_logon_ui_visible ||
+      interactive_secure_desktop_active || credential_ui_visible ||
+      password_box_visible || unlock_ui_visible) {
+    return false;
+  }
+
+  return last_session_event != "session-lock";
+}
+
+}  // namespace crossdesk
+
+#endif

src/service/windows/main.cpp

@@ -0,0 +1,87 @@
+#include <Windows.h>
+
+#include <iostream>
+#include <string>
+
+#include "service_host.h"
+
+namespace {
+
+std::wstring GetExecutablePath() {
+  wchar_t path[MAX_PATH] = {0};
+  DWORD length = GetModuleFileNameW(nullptr, path, MAX_PATH);
+  if (length == 0 || length >= MAX_PATH) {
+    return L"";
+  }
+  return std::wstring(path, length);
+}
+
+void PrintUsage() {
+  std::cout
+      << "CrossDesk Windows service skeleton\n"
+      << "  --service    Run under the Windows Service Control Manager\n"
+      << "  --console    Run the service loop in console mode\n"
+      << "  --install    Install the service for the current executable\n"
+      << "  --uninstall  Remove the installed service\n"
+      << "  --start      Start the installed service\n"
+      << "  --stop       Stop the installed service\n"
+      << "  --sas        Ask the service to send Secure Attention Sequence\n"
+      << "  --ping       Ping the running service over named pipe IPC\n"
+      << "  --status     Query runtime status over named pipe IPC\n";
+}
+
+}  // namespace
+
+int main(int argc, char* argv[]) {
+  crossdesk::CrossDeskServiceHost host;
+
+  if (argc <= 1) {
+    PrintUsage();
+    return 0;
+  }
+
+  std::string command = argv[1];
+  if (command == "--service") {
+    return host.RunAsService();
+  }
+  if (command == "--console") {
+    return host.RunInConsole();
+  }
+  if (command == "--install") {
+    std::wstring executable_path = GetExecutablePath();
+    bool success = !executable_path.empty() &&
+                   crossdesk::InstallCrossDeskService(executable_path);
+    std::cout << (success ? "install ok" : "install failed") << std::endl;
+    return success ? 0 : 1;
+  }
+  if (command == "--uninstall") {
+    bool success = crossdesk::UninstallCrossDeskService();
+    std::cout << (success ? "uninstall ok" : "uninstall failed") << std::endl;
+    return success ? 0 : 1;
+  }
+  if (command == "--start") {
+    bool success = crossdesk::StartCrossDeskService();
+    std::cout << (success ? "start ok" : "start failed") << std::endl;
+    return success ? 0 : 1;
+  }
+  if (command == "--stop") {
+    bool success = crossdesk::StopCrossDeskService();
+    std::cout << (success ? "stop ok" : "stop failed") << std::endl;
+    return success ? 0 : 1;
+  }
+  if (command == "--sas") {
+    std::cout << crossdesk::QueryCrossDeskService("sas") << std::endl;
+    return 0;
+  }
+  if (command == "--ping") {
+    std::cout << crossdesk::QueryCrossDeskService("ping") << std::endl;
+    return 0;
+  }
+  if (command == "--status") {
+    std::cout << crossdesk::QueryCrossDeskService("status") << std::endl;
+    return 0;
+  }
+
+  PrintUsage();
+  return 1;
+}

src/service/windows/service_host.h

@@ -0,0 +1,145 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-04-21
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _SERVICE_HOST_H_
+#define _SERVICE_HOST_H_
+
+#include <Windows.h>
+
+#include <mutex>
+#include <string>
+#include <thread>
+
+namespace crossdesk {
+
+inline constexpr wchar_t kCrossDeskServiceName[] = L"CrossDeskService";
+inline constexpr wchar_t kCrossDeskServiceDisplayName[] = L"CrossDesk Service";
+inline constexpr wchar_t kCrossDeskServicePipeName[] =
+    L"\\\\.\\pipe\\CrossDeskService";
+
+class CrossDeskServiceHost {
+ public:
+  CrossDeskServiceHost();
+  ~CrossDeskServiceHost();
+
+  int RunAsService();
+  int RunInConsole();
+
+ private:
+  int RunServiceLoop(bool as_service);
+  int InitializeRuntime();
+  void ShutdownRuntime();
+  void RequestStop();
+  void ReportServiceStatus(DWORD current_state, DWORD win32_exit_code,
+                           DWORD wait_hint);
+  void IpcServerLoop();
+  void RefreshSessionState();
+  void EnsureSessionHelper();
+  void ReapSessionHelper();
+  void StopSessionHelper();
+  bool LaunchSessionHelper(DWORD session_id);
+  void ReapSecureInputHelper();
+  void StopSecureInputHelper();
+  bool LaunchSecureInputHelper(DWORD session_id);
+  std::wstring GetSessionHelperPath() const;
+  std::wstring GetSessionHelperStopEventName(DWORD session_id) const;
+  std::wstring GetSecureInputHelperPath() const;
+  std::wstring GetSecureInputHelperStopEventName(DWORD session_id) const;
+  void ResetSessionHelperReportedStateLocked(const char* error,
+                                             DWORD error_code);
+  bool GetEffectiveSessionLockedLocked() const;
+  bool IsHelperReportingLockScreenLocked() const;
+  bool HasSecureInputUiLocked() const;
+  bool ShouldKeepSecureInputHelperLocked(DWORD target_session_id) const;
+  void RefreshSessionHelperReportedState();
+  void RecordSessionEvent(DWORD event_type, DWORD session_id);
+  std::string HandleIpcCommand(const std::string& command);
+  std::string BuildStatusResponse();
+  std::string SendSecureAttentionSequence();
+  std::string SendSecureDesktopKeyboardInput(int key_code, bool is_down);
+
+  static void WINAPI ServiceMain(DWORD argc, LPWSTR* argv);
+  static BOOL WINAPI ConsoleControlHandler(DWORD control_type);
+  static DWORD WINAPI ServiceControlHandler(DWORD control, DWORD event_type,
+                                            LPVOID event_data, LPVOID context);
+
+ private:
+  SERVICE_STATUS_HANDLE status_handle_ = nullptr;
+  SERVICE_STATUS service_status_{};
+  HANDLE stop_event_ = nullptr;
+  std::thread ipc_thread_;
+  std::mutex state_mutex_;
+  DWORD active_session_id_ = 0xFFFFFFFF;
+  DWORD process_session_id_ = 0xFFFFFFFF;
+  DWORD input_desktop_error_code_ = 0;
+  DWORD session_helper_process_id_ = 0;
+  DWORD session_helper_session_id_ = 0xFFFFFFFF;
+  DWORD session_helper_exit_code_ = 0;
+  DWORD session_helper_last_error_code_ = 0;
+  DWORD session_helper_status_error_code_ = 0;
+  DWORD session_helper_report_session_id_ = 0xFFFFFFFF;
+  DWORD session_helper_report_process_id_ = 0;
+  DWORD session_helper_report_input_desktop_error_code_ = 0;
+  DWORD secure_input_helper_process_id_ = 0;
+  DWORD secure_input_helper_session_id_ = 0xFFFFFFFF;
+  DWORD secure_input_helper_exit_code_ = 0;
+  DWORD secure_input_helper_last_error_code_ = 0;
+  DWORD last_session_event_type_ = 0;
+  DWORD last_session_event_session_id_ = 0xFFFFFFFF;
+  ULONGLONG started_at_tick_ = 0;
+  ULONGLONG last_sas_tick_ = 0;
+  ULONGLONG session_helper_started_at_tick_ = 0;
+  ULONGLONG session_helper_report_state_age_ms_ = 0;
+  ULONGLONG session_helper_report_uptime_ms_ = 0;
+  ULONGLONG secure_input_helper_started_at_tick_ = 0;
+  bool session_locked_ = false;
+  bool logon_ui_visible_ = false;
+  bool prelogin_ = false;
+  bool secure_desktop_active_ = false;
+  bool input_desktop_available_ = false;
+  bool session_helper_running_ = false;
+  bool session_helper_status_ok_ = false;
+  bool session_helper_report_session_locked_ = false;
+  bool session_helper_report_input_desktop_available_ = false;
+  bool session_helper_report_lock_app_visible_ = false;
+  bool session_helper_report_logon_ui_visible_ = false;
+  bool session_helper_report_secure_desktop_active_ = false;
+  bool session_helper_report_credential_ui_visible_ = false;
+  bool session_helper_report_unlock_ui_visible_ = false;
+  bool secure_input_helper_running_ = false;
+  bool console_mode_ = false;
+  DWORD last_sas_error_code_ = 0;
+  bool last_sas_success_ = false;
+  HANDLE session_helper_process_handle_ = nullptr;
+  HANDLE session_helper_stop_event_ = nullptr;
+  HANDLE secure_input_helper_process_handle_ = nullptr;
+  HANDLE secure_input_helper_stop_event_ = nullptr;
+  std::string input_desktop_name_;
+  std::string last_sas_error_;
+  std::string session_helper_last_error_;
+  std::string session_helper_status_error_;
+  std::string session_helper_report_input_desktop_;
+  std::string session_helper_report_interactive_stage_;
+  std::string secure_input_helper_last_error_;
+
+  static CrossDeskServiceHost* instance_;
+};
+
+bool InstallCrossDeskService(const std::wstring& binary_path);
+bool UninstallCrossDeskService();
+bool StartCrossDeskService();
+bool StopCrossDeskService(DWORD timeout_ms = 5000);
+std::string QueryCrossDeskService(const std::string& command,
+                                  DWORD timeout_ms = 1000);
+std::string SendCrossDeskSecureDesktopKeyInput(int key_code, bool is_down,
+                                               DWORD timeout_ms = 1000);
+std::string SendCrossDeskSecureDesktopMouseInput(int x, int y, int wheel,
+                                                 int flag,
+                                                 DWORD timeout_ms = 1000);
+
+}  // namespace crossdesk
+
+#endif

src/service/windows/session_helper_shared.h

@@ -0,0 +1,54 @@
+/*
+ * @Author: DI JUNKUN
+ * @Date: 2026-04-21
+ * Copyright (c) 2026 by DI JUNKUN, All Rights Reserved.
+ */
+
+#ifndef _SESSION_HELPER_SHARED_H_
+#define _SESSION_HELPER_SHARED_H_
+
+#include <Windows.h>
+
+#include <cstdint>
+#include <string>
+
+namespace crossdesk {
+
+inline constexpr wchar_t kCrossDeskSessionHelperPipePrefix[] =
+    L"\\\\.\\pipe\\CrossDeskSessionHelper-";
+inline constexpr wchar_t kCrossDeskSecureInputHelperPipePrefix[] =
+    L"\\\\.\\pipe\\CrossDeskSecureInputHelper-";
+inline constexpr char kCrossDeskSessionHelperStatusCommand[] = "status";
+inline constexpr char kCrossDeskSecureInputKeyboardCommandPrefix[] =
+    "keyboard:";
+inline constexpr char kCrossDeskSecureInputMouseCommandPrefix[] = "mouse:";
+inline constexpr char kCrossDeskSecureInputCaptureCommandPrefix[] = "capture:";
+inline constexpr DWORD kCrossDeskSecureInputPipeBufferBytes = 16 * 1024 * 1024;
+inline constexpr uint32_t kCrossDeskSecureDesktopFrameMagic = 0x50444358;
+inline constexpr uint32_t kCrossDeskSecureDesktopFrameVersion = 1;
+
+#pragma pack(push, 1)
+struct CrossDeskSecureDesktopFrameHeader {
+  uint32_t magic;
+  uint32_t version;
+  int32_t left;
+  int32_t top;
+  uint32_t width;
+  uint32_t height;
+  uint32_t payload_size;
+};
+#pragma pack(pop)
+
+inline std::wstring GetCrossDeskSessionHelperPipeName(DWORD session_id) {
+  return std::wstring(kCrossDeskSessionHelperPipePrefix) +
+         std::to_wstring(session_id);
+}
+
+inline std::wstring GetCrossDeskSecureInputHelperPipeName(DWORD session_id) {
+  return std::wstring(kCrossDeskSecureInputHelperPipePrefix) +
+         std::to_wstring(session_id);
+}
+
+}  // namespace crossdesk
+
+#endif

xmake/targets.lua

@@ -34,7 +34,8 @@ function setup_targets()
             add_files("src/screen_capturer/windows/screen_capturer_dxgi.cpp",
                 "src/screen_capturer/windows/screen_capturer_gdi.cpp",
                 "src/screen_capturer/windows/screen_capturer_win.cpp")
-            add_includedirs("src/screen_capturer/windows", {public = true})
+            add_includedirs("src/screen_capturer/windows", "src/service/windows",
+                {public = true})
         elseif is_os("macosx") then
             add_files("src/screen_capturer/macosx/*.cpp",
                 "src/screen_capturer/macosx/*.mm")
@@ -146,7 +147,8 @@ function setup_targets()
             "src/gui/windows", {public = true})
         if is_os("windows") then
             add_files("src/gui/tray/*.cpp")
-            add_includedirs("src/gui/tray", {public = true})
+            add_includedirs("src/gui/tray", "src/service/windows",
+                {public = true})
         elseif is_os("macosx") then
             add_files("src/gui/windows/*.mm")
         end
@@ -163,6 +165,22 @@ function setup_targets()
                 "src/screen_capturer/windows/wgc_plugin_entry.cpp")
             add_includedirs("src/common", "src/screen_capturer",
                 "src/screen_capturer/windows")
+
+        target("crossdesk_service")
+            set_kind("binary")
+            add_deps("rd_log", "path_manager")
+            add_links("Advapi32", "Wtsapi32", "Ole32", "Userenv")
+            add_files("src/service/windows/main.cpp",
+                "src/service/windows/service_host.cpp")
+            add_includedirs("src/service/windows", {public = true})
+
+        target("crossdesk_session_helper")
+            set_kind("binary")
+            add_packages("libyuv")
+            add_deps("rd_log", "path_manager")
+            add_links("Advapi32", "User32", "Wtsapi32", "Gdi32")
+            add_files("src/service/windows/session_helper_main.cpp")
+            add_includedirs("src/service/windows", {public = true})
     end
 
     target("crossdesk")
@@ -171,7 +189,10 @@ function setup_targets()
         add_files("src/app/*.cpp")
         add_includedirs("src/app", {public = true})
         if is_os("windows") then
-            add_deps("wgc_plugin")
+            add_files("src/service/windows/service_host.cpp")
+            add_includedirs("src/service/windows", {public = true})
+            add_links("Advapi32", "Wtsapi32", "Ole32", "Userenv")
+            add_deps("wgc_plugin", "crossdesk_service", "crossdesk_session_helper")
             add_files("scripts/windows/crossdesk.rc")
         end
 end