Integrate ScreenSteer with Windows and .NET

Reference three projects from the source archive (or the NuGet package for the core): ScreenSteer.Client (protocol, validator, registry, agent, reconnect policy), ScreenSteer.Client.LiveKit (room transport with token-refreshing reconnect, window capture, full-screen capture), and ScreenSteer.Client.Wpf (the XAML permission model).

The core client has no dependencies beyond the base class library and also targets netstandard2.1 for Unity and MAUI.

StartAsync creates the session and the data channel only — no pixels are captured yet. When an agent joins, the transport raises AgentJoined with the agent's display name (agents must set one in the console before they can join).

Show one approval popup naming that person, for example "Allow Dana to securely connect and help with this app?". Keep it to three facts in plain words: who is asking, that the session is limited to this app, and that it can be stopped at any time. A wall of security detail at the moment of decision makes people hesitate rather than feel safe, so keep the mechanics for your help page. Only after approval do you call BeginSharingAsync, so the first frame to leave the machine is already consented and already masked. Say in that popup that the agent can press the controls you approved for remote assistance, because it is the only time you ask.

Then call SetControlPreauthorized(true). That tells the console the control question is already answered, so it completes the control request itself and control simply switches on: no agent-side button that would prompt nobody, and no second popup for your user. If the user later pauses control, the pre-authorization is withdrawn with it, so the next request raises your own "allow help again" popup instead of resuming behind their back.

WindowCapturePublisher captures a single window's client area via PrintWindow: overlapping windows, other apps, and the rest of the desktop are never in the frame, even while your window is occluded. Minimized windows publish a solid dark paused frame, and resizes republish the track at the new aspect automatically.

All coordinates — action rectangles and redaction masks — are normalized against the window client area, so they survive moves, resizes, and DPI changes.

WpfAssistSurface keeps the interaction map and redaction masks in sync with the live window, so you write no per-control code and no coordinate math. Coverage defaults to AllControls — every visible control is operable except what you exclude; switch to MarkedOnly to invert the default so nothing is operable until you mark it.

Both exclusion attributes inherit down the visual tree, so one attribute protects an entire screen such as billing or admin.

RegisteredControls (default): every operable control is registered with its rectangle. Most auditable, but the interaction map is a single 15 KiB data packet, so at most about 70 controls fit at once — CoverageTruncated fires if a screen exceeds it.

LiveHitTest ("global touch"): clicks resolve against the live visual tree at execution time, so there is no per-button cap. Text inputs stay individually registered so the console knows to prompt for values, and every protection still applies at click time — Deny and Redact (checked on the exact pixels clicked, so a marked area can never leak through to a parent control), password boxes, and stale-click rejection: any geometry change bumps the layout revision so clicks minted against an outdated frame fail closed.

An agent can fire the shortcuts you publish, and nothing else. List them in WpfAssistOptions.Shortcuts (empty by default, so a session has no keyboard until you add one) and the console shows a button per chord. There is no free-text field anywhere in the flow, which is what keeps a remote keyboard from reaching a password box.

Delivery tries your KeyBinding command first, through CanExecute, and falls back to real routed key events on the focused element, so Escape reaches a Cancel button and Ctrl+R reaches a KeyDown handler. Keys are refused while focus sits in a password box or a marked subtree, and every key needs active control consent.

If your app decides what a shortcut means in code, give the shortcut a Run delegate instead of relying on key delivery. Handlers that read Keyboard.Modifiers, and raw WM_KEYDOWN hooks, both read the physical keyboard, which no in-process key event can set, so a sent Ctrl+R would silently do nothing. A Run delegate calls your method on the UI thread; route it through the same guarded dispatch your key handler uses so suspension and sensitive-flow guards still apply.

A Border, Grid, or Image that acts as a button is operable when its click runs through a command: put a MouseBinding with MouseAction="LeftClick" and Command="{Binding ...}" in the element's InputBindings, and the SDK invokes that command (through CanExecute) exactly as a real click would. Its caption is read from the first TextBlock inside it, so the console shows the words the user sees and DenyLabelFragments matches them.

An element that is clickable only through a code-behind MouseLeftButtonDown handler stays out of reach: WPF exposes nothing to invoke, and the SDK never synthesizes input. Bind a command instead, or use a real Button with your own template.

LiveKit join tokens expire after 15 minutes, so construct LiveKitRoomTransport with LiveKitReconnectOptions whose token provider calls RefreshDeviceTokenAsync. Terminal drops then rejoin automatically with backoff and republish the capture; surface Reconnecting/Reconnected in your banner.

The per-session bearer never expires and live sessions are never expired server-side for being long.

Keep three controls visible for the whole session: Stop control (view only) via RevokeControlAsync — fails closed locally even if the network is down; Return control via ReturnControlAsync — re-grants the most recent controller without a new agent request; and Stop session via StopAsync, which always works.

The source archive's samples/ScreenSteer.Sample.Wpf implements the full flow: named approval, control bar, laser overlay, reconnect banner, and both Deny and Redact markings.