[Marc-André Moreau (mamoreau-devolutions)]

Adds NowClientHandle::session_lock and NowClientHandle::session_logoff, which send NOW_SESSION_LOCK_MSG and NOW_SESSION_LOGOFF_MSG. These let an RDP client lock or log off the interactive user session that hosts the NOW agent. RDP itself can only disconnect, so a client-initiated logoff has to go through NOW.

• Response: neither message has a response, so both methods complete once the request is written and flushed. A successful logoff ends the session that carries the channel, and the handle then returns WorkerClosed.
• Capability check: each request requires the matching negotiated session capability (NowCapabilities::supports_session_lock / supports_session_logoff).
  • The worker checks the capability when it writes the request, so a capset refresh from the peer is honored.
  • A request that isn't negotiated fails with NowClientError::UnsupportedCapability and writes nothing. This matches how the exec styles and the .NET client behave.
• Default config: the default NowClientConfig capset now advertises LOCK | LOGOFF. Callers that build their own client_capset must add these flags themselves.

Tests cover:

• the exact header-only frames on the wire;
• the default capset advertisement;
• a peer omitting a capability;
• a peer capset refresh withdrawing lock;
• negotiation requiring both sides;
• the handle closing after the channel ends.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Capability checks occur before queuing rather than transmission, allowing a request blocked by backpressure to be sent and report success after the peer withdraws the required capability.

1 open issue

• Recheck capability immediately before writing queued requests · New

What changed in this PR

Adds session lock and logoff requests to the Rust NOW client, allowing RDP clients to request these operating-system actions through the NOW agent.

Changes:

• Adds asynchronous handle methods that complete after the request is written and flushed.
• Advertises lock and logoff capabilities by default and adds negotiated capability checks.
• Documents the API and tests wire frames, capability negotiation, refresh handling, and channel closure.

File	Description
protocols/​rust/​now-client/​src/​config.rs	Advertises session capabilities by default and documents custom capsets.
protocols/​rust/​now-client/​src/​client.rs	Adds session request methods, worker handling, and transport tests.
protocols/​rust/​now-client/​src/​capabilities.rs	Adds session capability queries and negotiation tests.
protocols/​rust/​now-client/​README.md	Documents session requests, capability requirements, and completion semantics.

_{Review effort: Balanced}