Initial commit: hello-agent — headless RustDesk-protocol-compatible Windows agent

A single-binary, Flutter-free remote-support agent that speaks the stock
RustDesk wire protocol. Designed for one-line MDM deployment against a
self-hosted rustdesk-server: a supporter using the unmodified rustdesk.exe
client connects, the controlled-side user gets a native Win32 approval
prompt, click Yes / No.

CLI surface

    hello-agent.exe --install                # register + start service
    hello-agent.exe --uninstall              # stop, delete, clean up
    hello-agent.exe --config <BLOB>          # admin-UI deploy string
    hello-agent.exe --install --config <BLOB>   # MDM one-liner

--config accepts both forms emitted by the rustdesk-server admin UI: the
reversed-base64 deploy string and the host=,key=,api=,relay= filename
form. Decoded via the upstream custom_server module, persisted via
hbb_common::config::Config::set_option.

Architecture

    --service runs as a Session 0 LocalSystem service. It polls
    WTSGetActiveConsoleSessionId and (re)spawns hello-agent.exe --server
    into the active console session via librustdesk::platform::run_as_user,
    handling the Session 0 → user-session token impersonation.

    --server is the worker. It boots three concurrent components:
      1. cm_popup: an IPC listener on the rustdesk `_cm` named pipe
      2. librustdesk::start_server(true, false): the upstream protocol
         stack — rendezvous mediator, NAT punch, IPC server, screen
         capture, login validation, hbbs_http heartbeat / sysinfo sync
      3. (implicit) ApproveMode::Click is pinned in config, so every
         incoming connection routes through cm_popup

The popup mechanism reuses an existing upstream contract without any
patches to the protocol code: when a peer connects with no password,
Connection::start in the upstream code calls try_start_cm_ipc, which
ipc::connect-s the `_cm` pipe before falling back to spawning a Flutter
CM child. Since cm_popup is up first, step 1 succeeds; we read the
Data::Login{authorized:false} frame, show MessageBoxTimeoutW (Yes/No,
60s, top-most, system-modal), and reply Data::Authorize or Data::Close.

Source tree

    src/main.rs             CLI dispatcher + run_server() composition
    src/cli.rs              hand-rolled argv parser + unit tests
    src/service.rs          windows-service install/uninstall/dispatcher
    src/config_import.rs    --config blob decoding + persistence
    src/cm_popup.rs         _cm IPC listener + Win32 approval dialog

Vendoring

The upstream RustDesk crate is vendored under vendor/rustdesk/ — full
workspace including libs/{hbb_common, scrap, enigo, clipboard,
virtual_display, remote_printer}. This makes the build self-contained
(no submodules, no sibling-repo checkout in CI) and gives us freedom to
fork in a different direction later. Excluded from the vendor: .git,
target/, flutter/, appimage/, flatpak/, fastlane/, docs/, examples/,
ci/, build.py, Dockerfile, upstream README/CLAUDE/AGENTS/GEMINI.

One local divergence vs. upstream: vendor/rustdesk/src/lib.rs flips
`mod custom_server` → `pub mod custom_server` so config_import.rs can
call get_custom_server_from_string without going through the
ui_interface shim. Documented in README.md → "Re-syncing the vendored
copy".

CI

.gitea/workflows/build-windows.yml builds on a self-hosted Windows
runner with Rust 1.75, LLVM 15.0.6 (libclang for bindgen via libvpx-sys),
and a vcpkg cache. The vendored vcpkg.json drives x64-windows-static
deps. The workflow stages the resulting hello-agent.exe into
SignOutput\, reports authenticode signing status (warns on unsigned),
and uploads as artifact. ~15 min full build, faster on incremental.

Out of scope for this commit: Linux/macOS builds, code signing, MSI
packaging, coexistence with stock rustdesk on the same box (currently
shares the RustDesk APP_NAME and config dir).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

vendor/rustdesk/build.rs

@@ -0,0 +1,94 @@
+#[cfg(windows)]
+fn build_windows() {
+    let file = "src/platform/windows.cc";
+    let file2 = "src/platform/windows_delete_test_cert.cc";
+    cc::Build::new().file(file).file(file2).compile("windows");
+    println!("cargo:rustc-link-lib=WtsApi32");
+    println!("cargo:rerun-if-changed={}", file);
+    println!("cargo:rerun-if-changed={}", file2);
+}
+
+#[cfg(target_os = "macos")]
+fn build_mac() {
+    let file = "src/platform/macos.mm";
+    let mut b = cc::Build::new();
+    if let Ok(os_version::OsVersion::MacOS(v)) = os_version::detect() {
+        let v = v.version;
+        if v.contains("10.14") {
+            b.flag("-DNO_InputMonitoringAuthStatus=1");
+        }
+    }
+    b.flag("-std=c++17").file(file).compile("macos");
+    println!("cargo:rerun-if-changed={}", file);
+}
+
+#[cfg(all(windows, feature = "inline"))]
+fn build_manifest() {
+    use std::io::Write;
+    if std::env::var("PROFILE").unwrap() == "release" {
+        let mut res = winres::WindowsResource::new();
+        res.set_icon("res/icon.ico")
+            .set_language(winapi::um::winnt::MAKELANGID(
+                winapi::um::winnt::LANG_ENGLISH,
+                winapi::um::winnt::SUBLANG_ENGLISH_US,
+            ))
+            .set_manifest_file("res/manifest.xml");
+        match res.compile() {
+            Err(e) => {
+                write!(std::io::stderr(), "{}", e).unwrap();
+                std::process::exit(1);
+            }
+            Ok(_) => {}
+        }
+    }
+}
+
+fn install_android_deps() {
+    let target_os = std::env::var("CARGO_CFG_TARGET_OS").unwrap();
+    if target_os != "android" {
+        return;
+    }
+    let mut target_arch = std::env::var("CARGO_CFG_TARGET_ARCH").unwrap();
+    if target_arch == "x86_64" {
+        target_arch = "x64".to_owned();
+    } else if target_arch == "x86" {
+        target_arch = "x86".to_owned();
+    } else if target_arch == "aarch64" {
+        target_arch = "arm64".to_owned();
+    } else {
+        target_arch = "arm".to_owned();
+    }
+    let target = format!("{}-android", target_arch);
+    let vcpkg_root = std::env::var("VCPKG_ROOT").unwrap();
+    let mut path: std::path::PathBuf = vcpkg_root.into();
+    if let Ok(vcpkg_root) = std::env::var("VCPKG_INSTALLED_ROOT") {
+        path = vcpkg_root.into();
+    } else {
+        path.push("installed");
+    }
+    path.push(target);
+    println!(
+        "cargo:rustc-link-search={}",
+        path.join("lib").to_str().unwrap()
+    );
+    println!("cargo:rustc-link-lib=ndk_compat");
+    println!("cargo:rustc-link-lib=oboe");
+    println!("cargo:rustc-link-lib=c++");
+    println!("cargo:rustc-link-lib=OpenSLES");
+}
+
+fn main() {
+    hbb_common::gen_version();
+    install_android_deps();
+    #[cfg(all(windows, feature = "inline"))]
+    build_manifest();
+    #[cfg(windows)]
+    build_windows();
+    let target_os = std::env::var("CARGO_CFG_TARGET_OS").unwrap();
+    if target_os == "macos" {
+        #[cfg(target_os = "macos")]
+        build_mac();
+        println!("cargo:rustc-link-lib=framework=ApplicationServices");
+    }
+    println!("cargo:rerun-if-changed=build.rs");
+}