RemEx 2.5.0 — Your colours, everywhere

RemEx 2.5.0 — Your colours, everywhere

The PC app stopped storing your theme as a name and started building it from a colour, which is how the phone has always done it. Alongside that: a security audit that closed six findings, transfers that tell you how long they will take, and the first CI that has ever built this repository.

This release covers everything since 2.4.0: 1,129 commits across 1,030 files.

---

🎨 Personalize — the headline

The four PC themes are gone as a concept. CyberNOC, Monolith, SolarFlare and BaseDarkGlass each carried their own 53 hand-written colour values. RemEx stored your theme as a name and looked colours up under it, which is why upgrading could quietly change how your app looked. The PC now derives its whole palette the way the phone does: a seed colour, a style, light or dark, and a contrast level. All four old themes survive as presets under shorter names (Neon, Slate, Ember and Glass) and still look the way they did.

Palette Studio. Pick the colour the whole app is built from on a wheel and watch it repaint as you drag. A "From this PC" row adopts your Windows accent colour or pulls the strongest colours out of your wallpaper. The seven palette styles are a row of live previews instead of a dropdown of seven words, and light/dark became a three-way picker with System.

Match my phone. Your phone tells the PC its theme after it connects and whenever you change it: seed, style, light or dark, contrast, and whether it is running on wallpaper colour. Personalize offers a one-tap "Match my phone" once it knows one.

On Android, dynamic colour is a toggle now. The theme had always accepted the parameter and nothing ever passed it, so Material You wallpaper theming was permanently on and the RemEx amber palette was unreachable on modern devices. Two palette styles that were implemented but missing from the picker, Neutral and Monochrome, are now selectable.

The PC shell moved onto real Material components underneath all this: a proper app bar instead of an invisible spacer, a Material side sheet for settings, a real list for the navigation drawer, Material snackbars for toasts, and Avalonia 11.3 to 12.1.

🔒 Security

A numbered audit closed six findings:

• An unauthenticated /debug/logs endpoint served up to 3,000 buffered log lines to any network-reachable caller, and those lines retained the live 6-digit pairing PIN and paired client IDs in cleartext. Removed.
• The screen-capture and file channels were gated on a presence check, not authentication. Live screen capture with input injection into the elevated desktop, and bulk filesystem read/write, both accepted a client ID that is unguessable but not secret. They now require cryptographic proof-of-possession.
• LaunchApp would run any path a paired client sent it, including \\attacker\share\evil.exe, as the always-elevated host. It now enforces an allowlist and rejects network paths.
• A read-only shared root could be re-pinned as writable by browsing into a subfolder and adding it back.
• TLS certificate pinning fell open when no pin was supplied, dropping to a trust manager that accepts any certificate.
• The root endpoint handed anonymous callers a full remote-desktop diagnostic report.

Separately: the Remote Desktop channel now actually enforces certificate pinning, rather than computing the answer and returning true regardless. A class of local-process impersonation is closed, where another program on your PC could take over a phone's file transfer, borrow its file permissions, or cancel a transfer by knowing its reference number. Accepting one file no longer lets the PC send a different one. And ending a process now checks it is the same instance you confirmed, not just something with the same name.

📁 Files and transfers

• Speed and time remaining, on both platforms and in every language. The PC was throwing byte counts away at the boundary and passing only a percentage, and neither speed nor ETA can be derived from a fraction.
• Whole-folder transfer. Previously you opened the folder, selected everything, and repeated for every subfolder; an empty folder had no way through at all.
• Name collisions ask instead of failing. Replace / Keep both / Skip, with "apply to all remaining".
• Permission prompts appear on the device that asked. A phone requesting full access used to raise a dialog on the PC monitor, possibly in another room, where it waited in front of nobody until it timed out.
• Fixed: every file transfer failing with "The binary file channel is not connected" on a phone that was plainly connected.
• A file arriving on the phone now says so and offers to open or share it. Until now the only outcome ever reported was a failure.

🖥️ Remote control

• A disconnecting phone can no longer leave keys held down on your PC. A chord is six independent messages and nothing guarantees the client sends the closing half.
• Send your phone's clipboard to the PC, and take a screenshot from the phone. The PC has been able to take one on request for two releases, with nothing on the phone asking for it.
• Media and volume control, including on Linux, where the host had been silently dropping the media key range.
• Wake-on-LAN stopped asking you to find and type your PC's MAC address, which was the one setup step a non-technical user cannot do.
• On Linux, several things were broken at once and are now fixed: every leftward or upward mouse movement did nothing on the ydotool backend, clicking did nothing at all, and on 95 locales a monitor placed above or left of the origin stopped screen capture from starting.

🔗 Connection and pairing

• "Is my phone attached?" is now a different question from "is the app talking to itself?" Every status light bound to the UI's own local connection, so a PC with zero phones paired showed a green "Connected".
• Settings lists the phones paired with this PC, showing name, first paired, last connected and whether it is connected right now. You can rename or unpair from there.
• The phone lists paired PCs and you connect by tapping one, instead of remembering only whatever address you typed last.
• A readiness check on Home covering administrator rights, the certificate, whether RemEx is accepting connections, the firewall, and start-at-sign-in. It stays collapsed to one line when everything is fine.
• Forgetting a PC on Android cleared the pin but not the reconnect secret, so re-pairing could fail on the very next connect.
• Certificate fingerprints you can actually compare, on the PC's About page and in the phone's cert-changed prompt.

📊 Dashboard and tray

The tray flyout is somewhere you can do things from, rather than showing two buttons that both only opened the main window. Sensor alerts show a bell on the card that has one set. Three navigation badges that had nothing behind them now count active transfers, unread warnings, and paired devices online.

♿ Accessibility and languages

The Android app honours the system "Remove animations" setting, including on the splash screens, and re-themes live when you toggle it. Escape closes every dialog, which previously meant reaching for the mouse after typing a six-digit PIN. The remote-desktop surface can be driven by TalkBack. All nine language files are now checked by CI against four separate failure modes, and 233 orphaned PC keys plus 50 dead Android strings were removed after being adjudicated one at a time rather than swept.

🐛 Also fixed

373 fixes in total. Among them: the PC could forget your personalization seconds after launch and write defaults over your real settings; a typo in the custom accent box could leave the app unreadable and stick permanently; importing a savefile got quietly undone by the Personalize sheet; seven desktop failures wrote to a debug channel that does not exist outside a debugger, so they never reached the diagnostics export a support case is built from; and file lists sorted file10 before file9.

---

📦 Downloads

Platform	File
Windows	RemEx-v2.5.0-Setup.exe
Android	RemEx-V2.5.0-release.apk (sideload)
Linux (x64)	remex-agent-v2.5.0-linux-x64.tar.gz

The Google Play build is distributed separately through the Play Store.

Full detail: docs/RELEASE-NOTES-2.5.0.md, and the complete 770-entry record in docs/CHANGELOG.md.