@desklink/host 0.3.0 → 0.4.0

package/engine/src/session.rs

@@ -1,9 +1,9 @@
 //! One authorized desktop session: capture in, VP9 out, control channel in,
 //! desktop input out, and a bounded teardown.
 //!
-//! The engine trusts the consumer's local permission decision and enforces the
-//! resulting scope. It has no second identity system, no account and no notion
-//! of which application asked.
+//! The consumer's pairing is the authority for all available access. The engine
+//! has no second identity system, no account and no notion of which application
+//! asked.
 
 use crate::capture::{self, Capture};
 use crate::clipboard;
@@ -15,9 +15,7 @@ use crate::peer::{
     h264_profile_level_id, PathReport, PeerEvent, TransportOptions, VideoCodec, VideoPeer,
 };
 use crate::portal::{self, SelectedSource};
-use crate::protocol::{
-    ControlMessage, ControlReply, EncodedCodec, Permission, PointerPhase, SourceRequest,
-};
+use crate::protocol::{ControlMessage, ControlReply, EncodedCodec, PointerPhase, SourceRequest};
 use crate::x11::X11Desktop;
 use anyhow::{Context, Result};
 use std::sync::atomic::{AtomicBool, Ordering};
@@ -192,6 +190,98 @@ impl Drop for X11Capture {
     }
 }
 
+#[cfg(target_os = "linux")]
+unsafe extern "C" {
+    fn desklink_indicator_covered(
+        x: f64,
+        y: f64,
+        opacity: f64,
+        click: f64,
+        typed: f64,
+        threshold: u32,
+        reveal: f64,
+    ) -> i32;
+}
+
+/// The X11 agent cue is a real window, so root grabs contain it. Restore
+/// exactly the pixels the announced cues cover (one pixel wider for edge
+/// rounding) from the last clean frame; everything else, including what lies
+/// inside the halo, stays live.
+#[cfg(target_os = "linux")]
+struct CueMask {
+    cues: crate::indicator::Cues,
+    clean: Option<Vec<u8>>,
+}
+
+#[cfg(target_os = "linux")]
+impl CueMask {
+    fn new(cues: crate::indicator::Cues) -> Self {
+        Self { cues, clean: None }
+    }
+
+    fn snapshot(&self) -> Vec<crate::indicator::Cue> {
+        self.cues
+            .lock()
+            .map(|mut feed| feed.drain())
+            .unwrap_or_default()
+    }
+
+    /// `before` is the snapshot taken when the grab started: with the states
+    /// announced by the time it returned, it covers whatever the grab saw.
+    fn apply(
+        &mut self,
+        raw: &mut [u8],
+        width: usize,
+        height: usize,
+        mut cues: Vec<crate::indicator::Cue>,
+    ) {
+        cues.extend(self.snapshot());
+        if let Some(clean) = self.clean.as_ref().filter(|clean| clean.len() == raw.len()) {
+            for cue in cues {
+                let side = cue.size as usize + 2;
+                let mut covered = vec![false; side * side];
+                for row in 0..cue.size as usize {
+                    for col in 0..cue.size as usize {
+                        let half = cue.size as f64 / 2.0;
+                        covered[(row + 1) * side + col + 1] = unsafe {
+                            desklink_indicator_covered(
+                                (col as f64 - half) / cue.unit,
+                                (row as f64 - half) / cue.unit,
+                                cue.opacity,
+                                cue.click,
+                                cue.typed,
+                                cue.threshold,
+                                cue.reveal,
+                            )
+                        } != 0;
+                    }
+                }
+                for row in 0..side {
+                    for col in 0..side {
+                        let near =
+                            |r: usize, c: usize| r < side && c < side && covered[r * side + c];
+                        if !(near(row, col)
+                            || near(row.wrapping_sub(1), col)
+                            || near(row + 1, col)
+                            || near(row, col.wrapping_sub(1))
+                            || near(row, col + 1))
+                        {
+                            continue;
+                        }
+                        let (x, y) = (cue.x - 1 + col as i64, cue.y - 1 + row as i64);
+                        if x < 0 || y < 0 || x >= width as i64 || y >= height as i64 {
+                            continue;
+                        }
+                        let at = (y as usize * width + x as usize) * 4;
+                        raw[at..at + 4].copy_from_slice(&clean[at..at + 4]);
+                    }
+                }
+            }
+        }
+        self.clean = Some(raw.to_vec());
+    }
+}
+
 /// What a chosen capture backend gives the session.
 struct Selected {
     source: SelectedSource,
@@ -202,12 +292,15 @@ struct Selected {
 
 /// Open an X display, start reading its root window, and hand back the same
 /// shape the portal path produces.
+#[allow(clippy::too_many_arguments)]
 fn select_x11(
     display: Option<&str>,
     max_width: usize,
     max_height: usize,
     max_fps: u32,
     metrics: Arc<Mutex<Metrics>>,
+    #[cfg(target_os = "linux")] cursor_sink: Option<crate::cursor::CursorSink>,
+    #[cfg(target_os = "linux")] cues: Option<crate::indicator::Cues>,
     sink: capture::FrameSink,
     on_stop: Box<dyn Fn(String) + Send>,
 ) -> Result<Selected> {
@@ -238,15 +331,25 @@ fn select_x11(
                 let interval = frame_interval(max_fps);
                 let mut sequence = 0u64;
                 let mut last_sent: Option<Instant> = None;
-                // Without XDamage there is no change signal, so an unchanged
-                // screen is recognised by its pixels exactly as before.
+                // XDamage wakes the loop, but pixels decide whether the root
+                // image actually changed; without XDamage, polling does so.
                 let hashed = !lock(&desktop).damage_armed();
                 let mut last_hash = None;
                 // The first frame is always grabbed; afterwards Damage wakes
                 // the loop, so a still screen costs no grab, no conversion
                 // and no hash. The fps cap stays a minimum spacing.
                 let mut first = true;
+                #[cfg(target_os = "linux")]
+                let mut cursor = cursor_sink.map(crate::cursor::Reporter::new);
+                #[cfg(target_os = "linux")]
+                let mut mask = cues.map(CueMask::new);
                 while !stop.load(Ordering::SeqCst) {
+                    #[cfg(target_os = "linux")]
+                    if let Some(cursor) = cursor.as_mut() {
+                        if let Ok((x, y, visible)) = lock(&desktop).cursor_position() {
+                            cursor.update(x, y, visible);
+                        }
+                    }
                     if !first {
                         let changed = lock(&desktop).take_damage();
                         if !changed {
@@ -262,14 +365,23 @@ fn select_x11(
                     }
                     let started = Instant::now();
                     let grabbed = Instant::now();
+                    #[cfg(target_os = "linux")]
                     let frame = {
+                        let before = mask.as_ref().map(CueMask::snapshot);
                         let mut desktop = lock(&desktop);
-                        desktop.capture_with_pixels(max_width, max_height)
+                        desktop.capture_raw().and_then(|mut raw| {
+                            if let (Some(mask), Some(before)) = (mask.as_mut(), before) {
+                                mask.apply(&mut raw, width as usize, height as usize, before);
+                            }
+                            Ok((desktop.convert(&raw, max_width, max_height)?, raw))
+                        })
                     };
+                    #[cfg(not(target_os = "linux"))]
+                    let frame = lock(&desktop).capture_with_pixels(max_width, max_height);
                     let grab_micros = grabbed.elapsed().as_micros() as u64;
                     match frame {
                         Ok((frame, raw)) => {
-                            let changed = if hashed {
+                            let changed = {
                                 use std::hash::{Hash, Hasher};
                                 let mut hasher = std::collections::hash_map::DefaultHasher::new();
                                 raw.hash(&mut hasher);
@@ -280,8 +392,6 @@ fn select_x11(
                                     last_hash = Some(hash);
                                     true
                                 }
-                            } else {
-                                true
                             };
                             if changed {
                                 // Handing an unchanged frame on would keep the
@@ -480,10 +590,10 @@ impl InputTarget {
         Ok(())
     }
 
-    #[cfg(target_os = "macos")]
+    #[cfg(any(target_os = "macos", target_os = "windows"))]
     fn unicode_text(&mut self, text: &str) -> Result<()> {
         match &mut self.applier {
-            #[cfg(target_os = "macos")]
+            #[cfg(any(target_os = "macos", target_os = "windows"))]
             Applier::Uinput(devices) => devices.unicode_text(text),
             #[cfg(target_os = "linux")]
             Applier::Uinput(_) => anyhow::bail!("Unicode text input is unavailable on Linux"),
@@ -582,9 +692,9 @@ impl SessionError {
 }
 
 pub struct OpenRequest {
+    pub cursor: crate::protocol::CursorMode,
     /** Which desktop to capture; absent means the portal. */
     pub source: Option<SourceRequest>,
-    pub permissions: Vec<Permission>,
     pub max_width: usize,
     pub max_height: usize,
     pub bitrate_kbps: u32,
@@ -603,6 +713,9 @@ pub struct OpenRequest {
 /// Events a session raises for its consumer.
 #[derive(Debug)]
 pub enum SessionEvent {
+    Cursor {
+        position: crate::protocol::CursorPosition,
+    },
     Description {
         generation: u64,
         sdp: String,
@@ -619,6 +732,7 @@ pub enum SessionEvent {
         first_frame: bool,
     },
     Frame {
+        timestamp_us: u64,
         seq: u64,
         damage: Vec<[usize; 4]>,
     },
@@ -661,10 +775,16 @@ type FrameSnapshot = (u64, Instant, usize, usize, Vec<u8>, Vec<u64>, Vec<u64>);
 
 /// Everything a session's background tasks need, shared rather than borrowed so
 /// the consumer can own the `Session` handle while the pipeline runs.
+#[cfg(target_os = "linux")]
+enum PointDesktop {
+    X11(String),
+    Wayland,
+    Unavailable(&'static str),
+}
+
 struct Inner {
     id: String,
     generation: u64,
-    permissions: Vec<Permission>,
     source: SelectedSource,
     geometry: serde_json::Value,
     metrics: Arc<Mutex<Metrics>>,
@@ -679,6 +799,9 @@ struct Inner {
     encoder: Mutex<Option<VideoEncoder>>,
     input: Mutex<Option<InputTarget>>,
     indicator: Mutex<Option<crate::indicator::Indicator>>,
+    point_overlay: Mutex<Option<crate::indicator::Indicator>>,
+    #[cfg(target_os = "linux")]
+    point_desktop: PointDesktop,
     capture: Mutex<Option<FrameSource>>,
     /// Absent for an encoded source: there is no local keyboard to translate a
     /// character through, because the client's keys are forwarded instead.
@@ -694,6 +817,7 @@ struct Inner {
     encoded: Mutex<Option<Encoded>>,
     /// `OpenRequest::local_frames`: whether `latest` is kept at all.
     local_frames: bool,
+    cursor_info: serde_json::Value,
 }
 
 /// A source whose video arrives already encoded.
@@ -741,12 +865,10 @@ pub fn capabilities() -> serde_json::Value {
     } else {
         "none"
     };
-    // Clipboard transfer needs Wayland; writes also need a selection server
-    // that can outlive this engine. Do not offer it when that tool is absent.
-    let clipboard = wayland_clipboard_available();
     let x11 = crate::x11::X11Desktop::connect(None)
         .map(|desktop| serde_json::json!([desktop.screen_size().0, desktop.screen_size().1]))
         .unwrap_or(serde_json::Value::Null);
+    let clipboard = wayland_clipboard_available();
     let (input, grant_state, unavailable) = match crate::input::probe() {
         Ok(()) => (serde_json::json!(true), "granted", serde_json::Value::Null),
         Err(unavailable) => (
@@ -772,6 +894,8 @@ pub fn capabilities() -> serde_json::Value {
             "backends": ["portal-screencast+pipewire", "x11-root"],
             "formats": ["bgrx", "bgra", "rgbx", "rgba"],
             "cursor": "embedded",
+            "cursor_modes": ["embedded", "hidden"],
+            "cursor_positions": {"x11": true, "portal": "negotiated"},
             "audio": false,
         },
         "encode": encode_capabilities(),
@@ -824,6 +948,7 @@ pub fn capabilities() -> serde_json::Value {
             "backends": ["screencapturekit"],
             "formats": ["bgra"],
             "cursor": "embedded",
+            "cursor_modes": ["embedded"],
             "audio": false,
             "displays": crate::mac::displays(),
             "grant": if capture_granted { "granted" } else { "missing-screen-recording" },
@@ -849,6 +974,16 @@ pub fn capabilities() -> serde_json::Value {
     })
 }
 
+#[cfg(target_os = "windows")]
+pub fn capabilities() -> serde_json::Value {
+    crate::win::capabilities()
+}
+
+#[cfg(target_os = "windows")]
+fn wayland_clipboard_available() -> bool {
+    false
+}
+
 /// `capabilities.encode`: VP9 always, H.264 when an encoder for it starts
 /// here now. `hardware` describes VP9, the default.
 fn encode_capabilities() -> serde_json::Value {
@@ -872,14 +1007,20 @@ impl Session {
         request: OpenRequest,
         events: tokio_mpsc::UnboundedSender<Notice>,
     ) -> std::result::Result<Self, SessionError> {
-        if !request.permissions.contains(&Permission::View) {
+        if request.cursor == crate::protocol::CursorMode::Hidden {
+            #[cfg(not(target_os = "linux"))]
             return Err(SessionError::new(
-                "permission",
-                "session.open requires the view permission",
+                "cursor-unavailable",
+                "hidden cursor capture is not implemented on this platform",
             ));
+            if matches!(request.source, Some(SourceRequest::Encoded { .. })) {
+                return Err(SessionError::new(
+                    "cursor-unavailable",
+                    "the engine cannot remove cursor pixels from consumer-encoded video",
+                ));
+            }
         }
         let id = opaque_id();
-        let wants_control = request.permissions.contains(&Permission::Control);
         let wants_x11 = matches!(request.source, Some(SourceRequest::X11 { .. }));
         let max_fps = request.max_fps.clamp(1, 60);
         // A source the consumer feeds needs no capture backend, no encoder and
@@ -896,23 +1037,26 @@ impl Session {
         // Which desktop decides which input path is even available: an X display
         // takes XTest, which cannot reach any other session, while a portal
         // desktop needs kernel input access.
-        if wants_control && !wants_x11 {
-            // Refuse up front rather than presenting a control surface that
-            // silently does nothing.
-            if crate::input::probe().is_err() {
-                #[cfg(target_os = "macos")]
-                let _ = crate::input::request_access();
-                if let Err(unavailable) = crate::input::probe() {
-                    return Err(SessionError::new(
-                        "input-unavailable",
-                        format!("{}; {}", unavailable.reason, unavailable.remedy),
-                    ));
-                }
-            }
+        #[cfg(target_os = "macos")]
+        if crate::input::probe().is_err() {
+            let _ = crate::input::request_access();
         }
 
         let metrics = Arc::new(Mutex::new(Metrics::default()));
         let mut indicator = None;
+        // The X11 cue starts before capture: its window is in root pixels, so
+        // the capture thread needs the announced cue states from the first grab.
+        #[cfg(target_os = "linux")]
+        if request.agent_indicator && wants_x11 {
+            let display = match &request.source {
+                Some(SourceRequest::X11 { display }) => display.clone(),
+                _ => None,
+            }
+            .or_else(|| std::env::var("DISPLAY").ok());
+            if let Some(display) = display {
+                indicator = crate::indicator::Indicator::start(&display, 0, 0).ok();
+            }
+        }
         let (frame_tx, frame_rx) = latest_frame();
         let latest = Arc::new(Mutex::new(None::<FrameSnapshot>));
         let observed = latest.clone();
@@ -975,7 +1119,7 @@ impl Session {
                     let damage = dirty_regions(&hashes, &previous, frame.width, frame.height);
                     *held = Some((
                         seq,
-                        Instant::now(),
+                        captured_at,
                         frame.width,
                         frame.height,
                         raw,
@@ -985,7 +1129,11 @@ impl Session {
                     frame_tx_signal.send_replace(seq);
                     let _ = frame_events.send(Notice {
                         session_id: frame_session_id.clone(),
-                        event: SessionEvent::Frame { seq, damage },
+                        event: SessionEvent::Frame {
+                            seq,
+                            damage,
+                            timestamp_us: crate::protocol::timestamp_us(captured_at),
+                        },
                     });
                 }
             }
@@ -1002,6 +1150,21 @@ impl Session {
             }
         });
 
+        #[cfg(target_os = "linux")]
+        let cursor_sink: Option<crate::cursor::CursorSink> =
+            if request.cursor == crate::protocol::CursorMode::Hidden {
+                let events = events.clone();
+                let id = id.clone();
+                Some(Box::new(move |position| {
+                    let _ = events.send(Notice {
+                        session_id: id.clone(),
+                        event: SessionEvent::Cursor { position },
+                    });
+                }))
+            } else {
+                None
+            };
+        let mut cursor_info = serde_json::json!({"mode":"embedded", "positions":false});
         let Selected {
             source,
             capture,
@@ -1013,6 +1176,10 @@ impl Session {
                 request.max_height,
                 max_fps,
                 metrics.clone(),
+                #[cfg(target_os = "linux")]
+                cursor_sink,
+                #[cfg(target_os = "linux")]
+                indicator.as_ref().map(crate::indicator::Indicator::cues),
                 sink,
                 Box::new({
                     let status = capture_status.clone();
@@ -1025,9 +1192,30 @@ impl Session {
                     Some(SourceRequest::Display { display_id }) => {
                         portal::open_display(*display_id).await
                     }
-                    _ => portal::open(request.restore_token.as_deref()).await,
+                    _ => {
+                        #[cfg(target_os = "linux")]
+                        {
+                            portal::open(request.restore_token.as_deref(), request.cursor).await
+                        }
+                        #[cfg(not(target_os = "linux"))]
+                        {
+                            portal::open(request.restore_token.as_deref()).await
+                        }
+                    }
+                }
+                .map_err(|error| {
+                    let message = format!("{error:#}");
+                    let code = if message.contains("cursor_positions_unavailable:") {
+                        "cursor_positions_unavailable"
+                    } else {
+                        "source"
+                    };
+                    SessionError::new(code, message)
+                })?;
+                #[cfg(target_os = "linux")]
+                {
+                    cursor_info = serde_json::json!({"mode":portal.cursor_mode, "positions":false});
                 }
-                .map_err(|error| SessionError::new("source", format!("{error:#}")))?;
                 if let Some(token) = &portal.restore_token {
                     let _ = events.send(Notice {
                         session_id: id.clone(),
@@ -1040,23 +1228,13 @@ impl Session {
                 let (width, height) =
                     fit(source_w, source_h, request.max_width, request.max_height);
                 #[cfg(target_os = "linux")]
-                if request.agent_indicator && wants_control {
-                    indicator = Some(
-                        crate::indicator::Indicator::start_wayland(source_w, source_h).map_err(
-                            |error| {
-                                SessionError::new("indicator-unavailable", format!("{error:#}"))
-                            },
-                        )?,
-                    );
+                if request.agent_indicator {
+                    indicator = crate::indicator::Indicator::start_wayland(source_w, source_h).ok();
                 }
                 #[cfg(target_os = "macos")]
-                if request.agent_indicator && wants_control {
-                    indicator = Some(
-                        crate::indicator::Indicator::start(source.node_id, source_w, source_h)
-                            .map_err(|error| {
-                                SessionError::new("indicator", format!("{error:#}"))
-                            })?,
-                    );
+                if request.agent_indicator {
+                    indicator =
+                        crate::indicator::Indicator::start(source.node_id, source_w, source_h).ok();
                 }
                 #[cfg(target_os = "macos")]
                 let capture = capture::start(
@@ -1072,12 +1250,26 @@ impl Session {
                     }),
                 )
                 .map_err(|error| SessionError::new("source", format!("{error:#}")))?;
+                #[cfg(target_os = "windows")]
+                let capture = capture::start(
+                    portal,
+                    width,
+                    height,
+                    max_fps,
+                    sink,
+                    Box::new({
+                        let status = capture_status.clone();
+                        move |running, reason| status(running, reason)
+                    }),
+                )
+                .map_err(|error| SessionError::new("source", format!("{error:#}")))?;
                 #[cfg(target_os = "linux")]
                 let capture = capture::start(
                     portal,
                     width,
                     height,
                     max_fps,
+                    cursor_sink,
                     sink,
                     indicator
                         .as_ref()
@@ -1089,6 +1281,18 @@ impl Session {
                 )
                 .map_err(|error| SessionError::new("source", format!("{error:#}")))?;
                 #[cfg(target_os = "linux")]
+                {
+                    if request.cursor == crate::protocol::CursorMode::Hidden
+                        && !capture.cursor_positions()
+                    {
+                        return Err(SessionError::new(
+                            "cursor_positions_unavailable",
+                            "portal stream did not provide SPA cursor metadata",
+                        ));
+                    }
+                    cursor_info["positions"] = serde_json::json!(capture.cursor_positions());
+                }
+                #[cfg(target_os = "linux")]
                 if let Some(indicator) = indicator.as_mut() {
                     indicator.event('A', -1, -1);
                 }
@@ -1099,23 +1303,12 @@ impl Session {
                 }
             }
         };
+        if wants_x11 {
+            cursor_info = serde_json::json!({"mode":"hidden", "positions": request.cursor == crate::protocol::CursorMode::Hidden});
+        }
 
         let source_w = source.width.max(1) as usize;
         let source_h = source.height.max(1) as usize;
-        #[cfg(target_os = "linux")]
-        if request.agent_indicator && wants_control && wants_x11 {
-            let display = match &request.source {
-                Some(SourceRequest::X11 {
-                    display: Some(display),
-                }) => display.clone(),
-                _ => std::env::var("DISPLAY")
-                    .map_err(|_| SessionError::new("indicator-unavailable", "no X display"))?,
-            };
-            indicator = Some(
-                crate::indicator::Indicator::start(&display, source_w, source_h)
-                    .map_err(|error| SessionError::new("indicator", format!("{error:#}")))?,
-            );
-        }
         let (width, height) = fit(source_w, source_h, request.max_width, request.max_height);
 
         let bitrate_kbps = if request.bitrate_kbps == 0 {
@@ -1134,40 +1327,30 @@ impl Session {
 
         // Everything that can still refuse the session comes before the peer:
         // a peer created and then abandoned keeps its socket and tasks alive.
-        let input = if !wants_control {
-            None
-        } else {
-            Some(match &x11 {
-                Some(desktop) => InputTarget {
-                    applier: Applier::X11(desktop.clone()),
-                    held: HeldState::default(),
-                    explicit_modifiers: Vec::new(),
-                    chord_modifiers: Vec::new(),
-                    chord_keys: Vec::new(),
-                    wheel_rest: (0.0, 0.0),
-                },
-                None => InputTarget {
-                    applier: Applier::Uinput({
-                        #[cfg(target_os = "linux")]
-                        let devices = InputDevices::create(source_w as i32, source_h as i32);
-                        #[cfg(target_os = "macos")]
-                        let devices = InputDevices::create_for_display(
-                            source_w as i32,
-                            source_h as i32,
-                            source.node_id,
-                        );
-                        devices.map_err(|error| {
-                            SessionError::new("input-unavailable", format!("{error:#}"))
-                        })?
-                    }),
-                    held: HeldState::default(),
-                    explicit_modifiers: Vec::new(),
-                    chord_modifiers: Vec::new(),
-                    chord_keys: Vec::new(),
-                    wheel_rest: (0.0, 0.0),
-                },
-            })
+        let applier = match &x11 {
+            Some(desktop) => lock(desktop)
+                .input_available()
+                .then(|| Applier::X11(desktop.clone())),
+            None => {
+                #[cfg(target_os = "linux")]
+                let devices = InputDevices::create(source_w as i32, source_h as i32);
+                #[cfg(any(target_os = "macos", target_os = "windows"))]
+                let devices = InputDevices::create_for_display(
+                    source_w as i32,
+                    source_h as i32,
+                    source.node_id,
+                );
+                devices.ok().map(Applier::Uinput)
+            }
         };
+        let input = applier.map(|applier| InputTarget {
+            applier,
+            held: HeldState::default(),
+            explicit_modifiers: Vec::new(),
+            chord_modifiers: Vec::new(),
+            chord_keys: Vec::new(),
+            wheel_rest: (0.0, 0.0),
+        });
 
         let layout = Layout::from_environment().map_err(|error| {
             SessionError::new("input", format!("no keyboard layout: {error:#}"))
@@ -1210,7 +1393,6 @@ impl Session {
         let inner = Arc::new(Inner {
             id,
             generation,
-            permissions: request.permissions,
             source,
             geometry,
             metrics,
@@ -1221,6 +1403,20 @@ impl Session {
             encoder: Mutex::new(Some(VideoEncoder::Vp9(encoder))),
             input: Mutex::new(input),
             indicator: Mutex::new(indicator),
+            point_overlay: Mutex::new(None),
+            #[cfg(target_os = "linux")]
+            point_desktop: if wants_x11 {
+                match &request.source {
+                    Some(SourceRequest::X11 { display }) => display
+                        .clone()
+                        .or_else(|| std::env::var("DISPLAY").ok())
+                        .map(PointDesktop::X11)
+                        .unwrap_or(PointDesktop::Unavailable("x11-unavailable")),
+                    _ => PointDesktop::Unavailable("x11-unavailable"),
+                }
+            } else {
+                PointDesktop::Wayland
+            },
             capture: Mutex::new(Some(capture)),
             layout: Mutex::new(Some(layout)),
             last_seq: Mutex::new(0),
@@ -1230,6 +1426,7 @@ impl Session {
             events: events.clone(),
             encoded: Mutex::new(None),
             local_frames: request.local_frames,
+            cursor_info,
         });
 
         inner.notify(SessionEvent::Description {
@@ -1289,7 +1486,6 @@ impl Session {
         let inner = Arc::new(Inner {
             id,
             generation,
-            permissions: request.permissions,
             source: SelectedSource {
                 node_id: 0,
                 width: width as i32,
@@ -1308,6 +1504,9 @@ impl Session {
             encoder: Mutex::new(None),
             input: Mutex::new(None),
             indicator: Mutex::new(None),
+            point_overlay: Mutex::new(None),
+            #[cfg(target_os = "linux")]
+            point_desktop: PointDesktop::Unavailable("layer_shell_unavailable"),
             capture: Mutex::new(None),
             layout: Mutex::new(None),
             last_seq: Mutex::new(0),
@@ -1328,6 +1527,7 @@ impl Session {
                 feed,
             })),
             local_frames: false,
+            cursor_info: serde_json::json!({"mode":"unavailable", "positions":false}),
         });
         inner.notify(SessionEvent::State {
             capture: "consented",
@@ -1385,6 +1585,14 @@ impl Session {
         self.inner.generation
     }
 
+    pub fn agent_indicator(&self) -> bool {
+        lock(&self.inner.indicator).is_some()
+    }
+
+    pub fn cursor_info(&self) -> &serde_json::Value {
+        &self.inner.cursor_info
+    }
+
     pub fn geometry(&self) -> &serde_json::Value {
         &self.inner.geometry
     }
@@ -1393,6 +1601,122 @@ impl Session {
         &self.inner.source
     }
 
+    pub fn point(
+        &self,
+        params: &crate::protocol::PointParams,
+    ) -> std::result::Result<(), SessionError> {
+        // Lock through validation and drawing, so a concurrent close cannot leave
+        // a newly spawned marker alive after teardown.
+        let mut overlay = lock(&self.inner.point_overlay);
+        if self.inner.closed.load(Ordering::SeqCst) {
+            return Err(SessionError::new("session", "the session is closed"));
+        }
+        if lock(&self.inner.encoded).is_some() {
+            return Err(SessionError::new(
+                "operation",
+                "an encoded source has no host desktop",
+            ));
+        }
+        #[cfg(target_os = "linux")]
+        if let PointDesktop::Unavailable(reason) = &self.inner.point_desktop {
+            return Err(SessionError::new(
+                "point_unsupported",
+                format!("reason: {reason}; point overlay is unavailable"),
+            ));
+        }
+        if params.clear {
+            if params.x.is_some()
+                || params.y.is_some()
+                || params.timeout_ms.is_some()
+                || !params.label.is_empty()
+            {
+                return Err(SessionError::new(
+                    "malformed",
+                    "clear accepts no coordinates, label or timeout",
+                ));
+            }
+            #[cfg(target_os = "linux")]
+            if overlay.is_none() && matches!(self.inner.point_desktop, PointDesktop::Wayland) {
+                let available = crate::indicator::Indicator::wayland_layer_shell_available()
+                    .map_err(|error| {
+                        SessionError::new("indicator-unavailable", format!("{error:#}"))
+                    })?;
+                if !available {
+                    return Err(SessionError::new(
+                        "point_unsupported",
+                        "reason: layer_shell_unavailable; compositor has no layer-shell",
+                    ));
+                }
+            }
+            if let Some(helper) = overlay.take() {
+                helper.stop();
+            }
+            return Ok(());
+        }
+        let (x, y) = params
+            .x
+            .zip(params.y)
+            .ok_or_else(|| SessionError::new("malformed", "point requires x and y"))?;
+        let source = &self.inner.source;
+        if x < 0 || y < 0 || x >= i64::from(source.width) || y >= i64::from(source.height) {
+            return Err(SessionError::new(
+                "coordinates",
+                "point is outside the selected desktop",
+            ));
+        }
+        let timeout = params.timeout_ms.unwrap_or(3000);
+        if !(1..=120_000).contains(&timeout)
+            || params.label.len() > 96
+            || !params.label.bytes().all(|b| (32..=126).contains(&b))
+        {
+            return Err(SessionError::new(
+                "malformed",
+                "timeout must be 1..120000 ms; label must be at most 96 printable ASCII bytes",
+            ));
+        }
+        #[cfg(not(target_os = "windows"))]
+        if overlay.is_none() {
+            #[cfg(target_os = "linux")]
+            let helper = match &self.inner.point_desktop {
+                PointDesktop::X11(display) => crate::indicator::Indicator::start_point(display),
+                PointDesktop::Wayland => crate::indicator::Indicator::start_point_wayland(
+                    source.width,
+                    source.height,
+                    source.position,
+                ),
+                PointDesktop::Unavailable(_) => unreachable!("validated point target"),
+            };
+            #[cfg(target_os = "macos")]
+            let helper = crate::indicator::Indicator::start_point(
+                source.node_id,
+                source.width as usize,
+                source.height as usize,
+            );
+            *overlay = Some(helper.map_err(|error| {
+                let message = format!("{error:#}");
+                if message.contains("layer_shell_unavailable") {
+                    SessionError::new(
+                        "point_unsupported",
+                        "reason: layer_shell_unavailable; compositor has no layer-shell",
+                    )
+                } else {
+                    SessionError::new("indicator-unavailable", message)
+                }
+            })?);
+        }
+        #[cfg(not(target_os = "windows"))]
+        return overlay
+            .as_mut()
+            .unwrap()
+            .point(x, y, timeout, &params.label)
+            .map_err(|error| SessionError::new("indicator-unavailable", format!("{error:#}")));
+        #[cfg(target_os = "windows")]
+        return Err(SessionError::new(
+            "point_unsupported",
+            "Windows point overlays are unavailable in this build.",
+        ));
+    }
+
     pub async fn wait_frame(
         &self,
         after_seq: Option<u64>,
@@ -1459,12 +1783,6 @@ impl Session {
         path: &str,
         region: Option<[usize; 4]>,
     ) -> std::result::Result<serde_json::Value, SessionError> {
-        if !self.inner.permissions.contains(&Permission::View) {
-            return Err(SessionError::new(
-                "permission",
-                "view permission is required",
-            ));
-        }
         if lock(&self.inner.encoded).is_some() {
             return Err(SessionError::new(
                 "operation",
@@ -1507,7 +1825,7 @@ impl Session {
             }
             Some(pixels)
         };
-        let result = serde_json::json!({ "seq": seq, "still_ms": at.elapsed().as_millis() as u64,
+        let result = serde_json::json!({ "seq": seq, "timestamp_us": crate::protocol::timestamp_us(*at), "still_ms": at.elapsed().as_millis() as u64,
             "width": w, "height": h, "format": "bgrx", "damage": damage, "written": !path.is_empty() });
         drop(held);
         if let Some(pixels) = pixels {
@@ -1570,20 +1888,18 @@ impl Session {
         if let Some((_, reason)) = self.inner.clipboard_refusal() {
             return Err(reason.to_owned());
         }
-        clipboard_task(move || clipboard::read_or_explain()).await
+        let inner = self.inner.clone();
+        clipboard_task(move || inner.clipboard_read_text()).await
     }
 
     pub async fn write_clipboard(&self, text: String) -> std::result::Result<(), String> {
         if let Some((_, reason)) = self.inner.clipboard_refusal() {
             return Err(reason.to_owned());
         }
-        clipboard_task(move || {
-            clipboard::write(&text)
-                .map(|()| String::new())
-                .map_err(|error| format!("{error:#}"))
-        })
-        .await
-        .map(|_written| ())
+        let inner = self.inner.clone();
+        clipboard_task(move || inner.clipboard_write_text(&text))
+            .await
+            .map(|_written| ())
     }
 
     pub fn mark_closed_reason(&self) -> Option<String> {
@@ -1630,6 +1946,9 @@ impl Inner {
         if let Ok(mut indicator) = self.indicator.lock() {
             indicator.take();
         }
+        if let Some(helper) = lock(&self.point_overlay).take() {
+            helper.stop();
+        }
         // Release first, then tear down: a stuck modifier is the one failure the
         // user cannot undo by reconnecting.
         if let Ok(mut input) = self.input.lock() {
@@ -1669,24 +1988,40 @@ impl Inner {
         }
     }
 
-    fn has(&self, permission: Permission) -> bool {
-        self.permissions.contains(&permission)
+    fn clipboard_read_text(&self) -> std::result::Result<(String, bool), String> {
+        #[cfg(target_os = "linux")]
+        if let PointDesktop::X11(display) = &self.point_desktop {
+            return clipboard::x11_read(display).map_err(|error| format!("{error:#}"));
+        }
+        clipboard::read_or_explain()
+    }
+
+    fn clipboard_write_text(&self, text: &str) -> std::result::Result<String, String> {
+        #[cfg(target_os = "linux")]
+        if let PointDesktop::X11(display) = &self.point_desktop {
+            return clipboard::x11_write(display, text)
+                .map(|()| String::new())
+                .map_err(|error| format!("{error:#}"));
+        }
+        clipboard::write(text)
+            .map(|()| String::new())
+            .map_err(|error| format!("{error:#}"))
     }
 
     fn clipboard_refusal(&self) -> Option<(&'static str, &'static str)> {
-        if matches!(
-            self.source.source_type.as_deref(),
-            Some("x11-root") | Some("encoded")
-        ) || !wayland_clipboard_available()
-        {
+        if self.closed.load(Ordering::Relaxed) {
+            return Some(("session", "the session has ended"));
+        }
+        #[cfg(target_os = "linux")]
+        if self.source.source_type.as_deref() == Some("x11-root") {
+            return None;
+        }
+        if self.source.source_type.as_deref() == Some("encoded") || !wayland_clipboard_available() {
             return Some((
                 "clipboard-unsupported",
                 "clipboard is unavailable for this desktop source",
             ));
         }
-        if !self.has(Permission::Clipboard) {
-            return Some(("permission", "this session has no clipboard permission"));
-        }
         None
     }
 
@@ -1714,7 +2049,7 @@ impl Inner {
         Ok(())
     }
 
-    /// Admit one client action. Validation, permission and ordering checks all
+    /// Admit one client action. Validation and ordering checks all
     /// happen before any physical effect, so a refused action leaves the desktop
     /// exactly as it was.
     fn apply(self: &Arc<Self>, message: ControlMessage) {
@@ -1727,10 +2062,6 @@ impl Inner {
             self.reject(seq, "session", "the control channel is not open");
             return;
         }
-        if !self.has(Permission::Control) {
-            self.reject(seq, "permission", "this session is view-only");
-            return;
-        }
         if seq != 0 {
             let mut last = match self.last_seq.lock() {
                 Ok(last) => last,
@@ -1767,6 +2098,14 @@ impl Inner {
             self.forward(message);
             return;
         }
+        if !matches!(
+            &message,
+            ControlMessage::ClipboardRead { .. } | ControlMessage::ClipboardWrite { .. }
+        ) && lock(&self.input).is_none()
+        {
+            self.reject(seq, "input-unavailable", "no input backend");
+            return;
+        }
         let outcome = match message {
             ControlMessage::Pointer {
                 phase,
@@ -1976,7 +2315,7 @@ impl Inner {
         if text.len() > 4096 {
             return Err(("text-too-large", String::from("text exceeds 4096 bytes")));
         }
-        #[cfg(target_os = "macos")]
+        #[cfg(any(target_os = "macos", target_os = "windows"))]
         {
             let _ = seq;
             return self.with_input(|target| target.unicode_text(text));
@@ -2042,10 +2381,12 @@ impl Inner {
         }
         let inner = Arc::clone(self);
         tokio::spawn(async move {
-            let (text, truncated, error) = match clipboard_task(clipboard::read_or_explain).await {
-                Ok((text, truncated)) => (text, truncated, None),
-                Err(reason) => (String::new(), false, Some(reason)),
-            };
+            let reader = inner.clone();
+            let (text, truncated, error) =
+                match clipboard_task(move || reader.clipboard_read_text()).await {
+                    Ok((text, truncated)) => (text, truncated, None),
+                    Err(reason) => (String::new(), false, Some(reason)),
+                };
             let _ = inner.reply(&ControlReply::Clipboard {
                 request: &request,
                 text,
@@ -2062,13 +2403,10 @@ impl Inner {
         }
         let inner = Arc::clone(self);
         tokio::spawn(async move {
-            let error = clipboard_task(move || {
-                clipboard::write(&text)
-                    .map(|()| String::new())
-                    .map_err(|error| format!("{error:#}"))
-            })
-            .await
-            .err();
+            let writer = inner.clone();
+            let error = clipboard_task(move || writer.clipboard_write_text(&text))
+                .await
+                .err();
             let _ = inner.reply(&ControlReply::Clipboard {
                 request: &request,
                 text: String::new(),
@@ -2940,6 +3278,60 @@ fn opaque_id() -> String {
 
 #[cfg(test)]
 mod tests {
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn x11_cue_mask_restores_only_the_cue_pixels() {
+        use crate::indicator::Cue;
+        let (w, h) = (200usize, 120usize);
+        let at = |x: usize, y: usize| (y * w + x) * 4;
+        let (cx, cy) = (20 + 55, 10 + 55);
+        // Shaped (128) and composited (1) helpers announce different thresholds.
+        for threshold in [128, 1] {
+            let cue = Cue {
+                x: 20,
+                y: 10,
+                size: 110,
+                unit: 1.0,
+                opacity: 1.0,
+                click: -1.0,
+                typed: -1.0,
+                threshold,
+                reveal: 99.0,
+            };
+            let mut mask = CueMask::new(Default::default());
+            let clean: Vec<u8> = (0..w * h * 4).map(|i| (i % 251) as u8).collect();
+            mask.apply(&mut clean.clone(), w, h, vec![]);
+            // Paint the cue's keyline and live content inside the halo.
+            let mut frame = clean.clone();
+            frame[at(cx - 24, cy)..at(cx - 24, cy) + 4].fill(255);
+            frame[at(cx - 5, cy)..at(cx - 5, cy) + 4].fill(7);
+            frame[at(190, 110)..at(190, 110) + 4].fill(9);
+            mask.apply(&mut frame, w, h, vec![cue]);
+            assert_eq!(
+                &frame[at(cx - 24, cy)..at(cx - 24, cy) + 4],
+                &clean[at(cx - 24, cy)..at(cx - 24, cy) + 4]
+            );
+            assert_eq!(
+                &frame[at(cx - 5, cy)..at(cx - 5, cy) + 4],
+                &[7; 4],
+                "the halo interior stays live"
+            );
+            assert_eq!(
+                &frame[at(190, 110)..at(190, 110) + 4],
+                &[9; 4],
+                "pixels away from the cue stay live"
+            );
+            let mut after = clean.clone();
+            after[at(cx - 24, cy)..at(cx - 24, cy) + 4].fill(3);
+            mask.apply(&mut after, w, h, vec![]);
+            assert_eq!(
+                &after[at(cx - 24, cy)..at(cx - 24, cy) + 4],
+                &[3; 4],
+                "a hidden cue masks nothing"
+            );
+        }
+    }
+
     use super::*;
 
     #[tokio::test]
@@ -2950,7 +3342,6 @@ mod tests {
         let inner = Arc::new(Inner {
             id: String::from("encoded-session"),
             generation: 1,
-            permissions: Vec::new(),
             source: SelectedSource {
                 node_id: 0,
                 width: 640,
@@ -2973,6 +3364,9 @@ mod tests {
             encoder: Mutex::new(None),
             input: Mutex::new(None),
             indicator: Mutex::new(None),
+            point_overlay: Mutex::new(None),
+            #[cfg(target_os = "linux")]
+            point_desktop: PointDesktop::Unavailable("layer_shell_unavailable"),
             capture: Mutex::new(None),
             layout: Mutex::new(None),
             last_seq: Mutex::new(0),
@@ -2991,6 +3385,7 @@ mod tests {
                 feed,
             })),
             local_frames: false,
+            cursor_info: serde_json::json!({"mode":"unavailable", "positions":false}),
         });
         spawn_peer_events(&inner, peer_events_rx);
         spawn_encoded(&inner, feed_rx);
@@ -3112,6 +3507,136 @@ mod tests {
         test_inner_with(events, peer, 64, 64)
     }
 
+    #[cfg(target_os = "linux")]
+    #[tokio::test]
+    async fn a_wayland_portal_session_reports_typed_point_unsupported() {
+        let (events, _) = tokio_mpsc::unbounded_channel();
+        let (inner, _) = test_inner(events).await;
+        let session = Session { inner };
+
+        let error = session
+            .point(&crate::protocol::PointParams {
+                session_id: String::from("test-session"),
+                x: Some(10),
+                y: Some(20),
+                label: String::new(),
+                timeout_ms: None,
+                clear: false,
+            })
+            .expect_err("compositors without layer-shell do not support point overlays");
+
+        assert_eq!(error.code, "point_unsupported");
+        assert!(error.message.contains("reason: layer_shell_unavailable"));
+    }
+
+    // Driven only on the private headless compositor created by point-wayland-flow.py.
+    #[cfg(target_os = "linux")]
+    #[tokio::test]
+    #[ignore = "requires the task-owned compositor and screenshot driver"]
+    async fn point_wayland_private_flow() {
+        let evidence = std::path::PathBuf::from(
+            std::env::var_os("DESKLINK_POINT_TEST_DIR").expect("private evidence"),
+        );
+        let socket =
+            std::path::PathBuf::from(std::env::var_os("WAYLAND_DISPLAY").expect("private socket"));
+        assert!(
+            socket.is_absolute() && socket.starts_with(evidence.join("runtime")),
+            "never use an ambient desktop"
+        );
+        fn checkpoint(dir: &std::path::Path, name: &str) {
+            std::fs::write(dir.join(format!("{name}.ready")), b"").unwrap();
+            let deadline = Instant::now() + Duration::from_secs(15);
+            while !dir.join(format!("{name}.continue")).exists() {
+                assert!(
+                    Instant::now() < deadline,
+                    "screenshot driver timed out at {name}"
+                );
+                std::thread::sleep(Duration::from_millis(20));
+            }
+        }
+        let (events, _) = tokio_mpsc::unbounded_channel();
+        let (mut inner, _) = test_inner(events).await;
+        let state = Arc::get_mut(&mut inner).unwrap();
+        state.point_desktop = PointDesktop::Wayland;
+        state.source.width = 1280;
+        state.source.height = 720;
+        state.source.position = Some((1280, 0));
+        let mut session = Session { inner };
+        let mut params = crate::protocol::PointParams {
+            session_id: String::from("test-session"),
+            x: Some(400),
+            y: Some(300),
+            label: String::from("Here"),
+            timeout_ms: Some(3000),
+            clear: false,
+        };
+        let unsupported_socket = std::env::var_os("DESKLINK_POINT_UNSUPPORTED_SOCKET").unwrap();
+        assert!(std::path::Path::new(&unsupported_socket).starts_with(evidence.join("runtime")));
+        // This test runs alone, in a separate process. Only child helper startup
+        // and the read-only clear probe read this private socket environment.
+        std::env::set_var("WAYLAND_DISPLAY", &unsupported_socket);
+        let refusal = session.point(&params).unwrap_err();
+        assert_eq!(refusal.code, "point_unsupported");
+        assert!(refusal.message.contains("reason: layer_shell_unavailable"));
+        let clear = crate::protocol::PointParams {
+            session_id: params.session_id.clone(),
+            clear: true,
+            x: None,
+            y: None,
+            label: String::new(),
+            timeout_ms: None,
+        };
+        let refusal = session.point(&clear).unwrap_err();
+        assert_eq!(refusal.code, "point_unsupported");
+        std::env::set_var("WAYLAND_DISPLAY", &socket);
+        Arc::get_mut(&mut session.inner).unwrap().source.position = None;
+        let ambiguous = session.point(&params).unwrap_err();
+        assert_eq!(ambiguous.code, "indicator-unavailable");
+        assert!(ambiguous.message.contains("selected_output_unavailable"));
+        Arc::get_mut(&mut session.inner).unwrap().source.position = Some((1280, 0));
+        checkpoint(&evidence, "before");
+        session.point(&params).unwrap();
+        checkpoint(&evidence, "after");
+        params.x = Some(1280);
+        assert_eq!(session.point(&params).unwrap_err().code, "coordinates");
+        params.x = Some(400);
+        params.label = String::from("bad\nlabel");
+        assert_eq!(session.point(&params).unwrap_err().code, "malformed");
+        checkpoint(&evidence, "invalid");
+        tokio::time::sleep(Duration::from_millis(3100)).await;
+        checkpoint(&evidence, "expired");
+        params.x = Some(700);
+        params.y = Some(500);
+        params.label.clear();
+        params.timeout_ms = Some(10000);
+        session.point(&params).unwrap();
+        checkpoint(&evidence, "replaced");
+        params.clear = true;
+        params.x = None;
+        params.y = None;
+        params.timeout_ms = None;
+        session.point(&params).unwrap();
+        session.point(&params).unwrap();
+        assert!(lock(&session.inner.point_overlay).is_none());
+        checkpoint(&evidence, "cleared");
+        params.clear = false;
+        params.x = Some(400);
+        params.y = Some(300);
+        session.point(&params).unwrap();
+        let pid = lock(&session.inner.point_overlay)
+            .as_ref()
+            .unwrap()
+            .test_pid();
+        checkpoint(&evidence, "clickthrough");
+        session.close("test complete").await;
+        assert_eq!(
+            unsafe { libc::kill(pid as i32, 0) },
+            -1,
+            "helper reaped on session close"
+        );
+        checkpoint(&evidence, "closed");
+    }
+
     fn test_inner_with(
         events: tokio_mpsc::UnboundedSender<Notice>,
         peer: VideoPeer,
@@ -3124,7 +3649,6 @@ mod tests {
         let inner = Arc::new(Inner {
             id: String::from("test-session"),
             generation: 1,
-            permissions: vec![Permission::Control],
             source: SelectedSource {
                 node_id: 0,
                 width: 640,
@@ -3157,6 +3681,9 @@ mod tests {
             })),
             capture: Mutex::new(None),
             indicator: Mutex::new(None),
+            point_overlay: Mutex::new(None),
+            #[cfg(target_os = "linux")]
+            point_desktop: PointDesktop::Unavailable("layer_shell_unavailable"),
             layout: Mutex::new(Some(Layout::from_environment().expect("a keymap"))),
             last_seq: Mutex::new(0),
             control_open: AtomicBool::new(true),
@@ -3165,15 +3692,51 @@ mod tests {
             events,
             encoded: Mutex::new(None),
             local_frames: true,
+            cursor_info: serde_json::json!({"mode":"embedded", "positions":false}),
         });
         (inner, recorded)
     }
 
+    #[tokio::test]
+    async fn paired_input_without_a_backend_is_an_action_failure() {
+        let (events, _) = tokio_mpsc::unbounded_channel();
+        let (inner, recorded) = test_inner(events).await;
+        *lock(&inner.input) = None;
+        assert_eq!(
+            inner.with_input(|_| Ok(())).unwrap_err().0,
+            "input-unavailable"
+        );
+        inner.apply(ControlMessage::Pointer {
+            phase: PointerPhase::Move,
+            x: 10,
+            y: 20,
+            button: 1,
+            seq: 1,
+        });
+        assert_eq!(
+            *lock(&inner.last_seq),
+            1,
+            "paired action passes admission, never a permission refusal"
+        );
+        assert_eq!(lock(&inner.metrics).input_rejected, 1);
+        assert_eq!(lock(&inner.metrics).input_applied, 0);
+        assert!(lock(&recorded).is_empty());
+        assert!(
+            !inner.closed.load(Ordering::Relaxed),
+            "missing input does not close view access"
+        );
+    }
+
     #[tokio::test]
     async fn a_lease_that_expires_ends_the_session_and_releases_held_input() {
         let (events, mut received) = tokio_mpsc::unbounded_channel();
         let (inner, recorded) = test_inner(events).await;
 
+        #[cfg(target_os = "windows")]
+        inner
+            .with_input(|target| target.chord(1, Vec::new(), true))
+            .unwrap();
+        #[cfg(not(target_os = "windows"))]
         inner.apply(ControlMessage::Key {
             name: None,
             character: Some(String::from("a")),
@@ -3227,6 +3790,7 @@ mod tests {
         );
     }
 
+    #[cfg(not(target_os = "windows"))]
     #[tokio::test]
     async fn a_held_modifier_survives_character_named_and_text_chords() {
         use crate::input::keycode;
@@ -3421,38 +3985,24 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn x11_capture_refuses_both_clipboard_directions() {
+    async fn x11_capture_does_not_refuse_clipboard() {
         let (events, _received) = tokio_mpsc::unbounded_channel();
         let (mut inner, _recorded) = test_inner(events).await;
         let owned = Arc::get_mut(&mut inner).unwrap();
         owned.source.source_type = Some(String::from("x11-root"));
-        owned.permissions.push(Permission::Clipboard);
-        let session = Session {
-            inner: inner.clone(),
-        };
-        assert!(session
-            .read_clipboard()
-            .await
-            .unwrap_err()
-            .contains("unavailable"));
-        assert!(session
-            .write_clipboard(String::from("secret"))
-            .await
-            .unwrap_err()
-            .contains("unavailable"));
-        inner.clipboard_read(String::from("read"));
-        inner.clipboard_write(String::from("write"), String::from("secret"));
-        assert_eq!(inner.metrics.lock().unwrap().input_rejected, 2);
+        #[cfg(target_os = "linux")]
+        assert_eq!(inner.clipboard_refusal(), None);
+        Arc::get_mut(&mut inner).unwrap().source.source_type = Some(String::from("encoded"));
+        assert_eq!(
+            inner.clipboard_refusal().unwrap().0,
+            "clipboard-unsupported"
+        );
     }
 
     #[tokio::test]
     async fn a_stopped_capture_never_serves_the_last_frame() {
         let (events, _) = tokio_mpsc::unbounded_channel();
-        let (mut inner, _) = test_inner(events).await;
-        Arc::get_mut(&mut inner)
-            .unwrap()
-            .permissions
-            .push(Permission::View);
+        let (inner, _) = test_inner(events).await;
         let session = Session { inner };
         *lock(&session.inner.latest) =
             Some((1, Instant::now(), 2, 2, vec![0; 16], vec![1], vec![]));
@@ -3526,12 +4076,12 @@ mod tests {
 
     fn encoded_open() -> OpenRequest {
         OpenRequest {
+            cursor: crate::protocol::CursorMode::Embedded,
             source: Some(SourceRequest::Encoded {
                 codec: EncodedCodec::H264,
                 width: 486,
                 height: 1080,
             }),
-            permissions: vec![Permission::View, Permission::Control],
             max_width: 3840,
             max_height: 2160,
             bitrate_kbps: 0,
@@ -3552,6 +4102,18 @@ mod tests {
             .expect("the channel stays open")
     }
 
+    #[tokio::test]
+    async fn hidden_cursor_is_refused_for_consumer_encoded_pixels() {
+        let (events, _) = tokio_mpsc::unbounded_channel();
+        let mut request = encoded_open();
+        request.cursor = crate::protocol::CursorMode::Hidden;
+        let error = Session::open(request, events)
+            .await
+            .err()
+            .expect("cannot alter encoded pixels");
+        assert_eq!(error.code, "cursor-unavailable");
+    }
+
     #[tokio::test]
     async fn an_encoded_session_opens_without_capture_encoder_or_input() {
         let (events, _received) = tokio_mpsc::unbounded_channel();
@@ -3693,39 +4255,16 @@ mod tests {
         );
     }
 
-    #[tokio::test]
-    async fn opening_without_view_permission_is_refused_before_capture() {
-        let (events, _received) = tokio_mpsc::unbounded_channel();
-        let result = Session::open(
-            OpenRequest {
-                source: None,
-                permissions: vec![Permission::Control],
-                max_width: 640,
-                max_height: 480,
-                bitrate_kbps: 0,
-                max_fps: 30,
-                ice_servers: Vec::new(),
-                restore_token: None,
-                ttl: None,
-                loopback_tcp: false,
-                agent_indicator: false,
-                local_frames: true,
-            },
-            events,
-        )
-        .await;
-        let error = match result {
-            Ok(_) => panic!("a viewless session must not open"),
-            Err(error) => error,
-        };
-        assert_eq!(error.code, "permission");
-    }
-
     #[tokio::test]
     async fn a_lost_transport_releases_input_then_ends_the_session_without_sctp_close() {
         use webrtc::peer_connection::RTCPeerConnectionState as State;
         let (events, mut received) = tokio_mpsc::unbounded_channel();
         let (inner, recorded) = test_inner(events).await;
+        #[cfg(target_os = "windows")]
+        inner
+            .with_input(|target| target.chord(1, Vec::new(), true))
+            .unwrap();
+        #[cfg(not(target_os = "windows"))]
         inner.apply(ControlMessage::Key {
             name: Some(String::from("Control")),
             character: None,
@@ -3942,7 +4481,10 @@ mod tests {
             1000,
         );
 
-        // 40 frames over 200 ms is 200 fps; the requested 20 fps caps what leaves.
+        // 40 frames nominally over 200 ms; Windows timers can round each 5 ms
+        // sleep upward, so its cap assertion uses the actual burst duration.
+        #[cfg(target_os = "windows")]
+        let burst_started = Instant::now();
         for _ in 0..40 {
             frame_tx.put(
                 I420 {
@@ -3955,9 +4497,13 @@ mod tests {
             tokio::time::sleep(Duration::from_millis(5)).await;
         }
         let motion = inner.metrics.lock().unwrap().encoded_frames;
+        #[cfg(target_os = "windows")]
+        let cap = (burst_started.elapsed().as_secs_f64() * 20.0).ceil() as u64 + 3;
+        #[cfg(not(target_os = "windows"))]
+        let cap = 7;
         assert!(
-            motion <= 7,
-            "the requested rate is a cap, got {motion} of 40"
+            motion <= cap,
+            "the requested rate is a cap, got {motion} of 40 (cap {cap})"
         );
         assert!(
             motion >= 2,