# KIM Remote 0.3.9 - Windows

KIM Remote is a private, two-way Windows remote desktop app for computers on
the same Tailscale tailnet. It also remains compatible with the KIM Quest
Remote client.

Version 0.3.9 adds negotiated H.264 streaming at 30 FPS. The host prefers
NVIDIA NVENC, then AMD AMF, Intel Quick Sync, and finally x264 software
encoding. Older clients continue to receive the existing JPEG stream.

`ffmpeg.exe`, `LICENSE-FFmpeg.txt`, and `FFMPEG-NOTICE.txt` must remain beside
`KIMQuestRemoteHost.exe`. If the encoder sidecar is unavailable, the host
falls safely back to JPEG.

## Install

1. Confirm Tailscale is installed, logged in, and uses the same tailnet.
2. Open PowerShell with **Run as administrator** in this extracted folder.
3. Run the read-only audit:

   `powershell -ExecutionPolicy Bypass -File .\Audit-ReadOnly.ps1`

4. Verify the bundle hashes:

   `Get-Content .\CHECKSUMS-SHA256.txt`

   `Get-FileHash .\KIMQuestRemoteHost.exe -Algorithm SHA256`

5. Install and start:

   `powershell -ExecutionPolicy Bypass -File .\Install-Host.ps1 -StartNow -ShowNow`

6. Verify:

   `powershell -ExecutionPolicy Bypass -File .\Verify-Install.ps1`

At Windows sign-in, **KIM Remote Auto Patcher** runs first as a hidden,
elevated Scheduled Task. It accepts only an RSA-signed KIM manifest, then
verifies the ZIP size, SHA-256, internal checksums, and executable version
before replacing anything. The previous EXE is retained for rollback. If the
network or any verification fails, the installed version starts normally.
Closing the window hides it; it does not stop the host.

## Connect KIM Server and ROG Ally

Open **KIM Remote > Devices**. Robin-owned Windows computers are discovered
automatically. Click **Connect**; no pairing password is requested when both
PCs meet all of these checks:

- The connection comes from a real Tailscale address.
- Tailscale reports the peer OS as Windows and currently online.
- The peer and host have the same Tailscale owner `UserID`.
- The destination has the same stable Tailscale device identity first shown
  in the Devices list.

The host records accepted devices in
`%LOCALAPPDATA%\KIMQuestRemote\trusted-tailscale-peers.json` for local audit.
No shared password, certificate, or private key is embedded in this bundle or
download page. Each PC generates and keeps its own TLS identity.

Video, mouse, keyboard, and wheel input travel directly through Tailscale with
TLS. TCP 45830 is allowed only from `LocalSubnet` and `100.64.0.0/10`; do not
port-forward it.

## Multiple computers, monitors, and files

Click **Connect** on several computers to keep several independent sessions
open at the same time. Move or maximize each remote window on the local monitor
you want. Input is scoped to the window with focus; it is never broadcast to
the other sessions.

To send files to a remote Windows computer, drop local files onto that remote
desktop window or use **Send files**. To send files in the other direction,
open **This computer > Send file to connected** on the remote host. Transfers
use the authenticated TLS connection, are limited to 2 GiB each, and are
accepted only after the declared size and SHA-256 match. Received files are
saved in `Downloads\KIM Remote Incoming`; interrupted `.part` files are removed.

Dragging an icon visible inside the streamed desktop is not a filesystem drag:
the viewer receives pixels, not the remote file path. Use the remote host's
**Send file to connected** action for that direction.

## Quest and pairing fallback

Quest and manual/LAN profiles continue to use HMAC pairing. To change the
local pairing password:

`powershell -ExecutionPolicy Bypass -File .\Set-PairingPassword.ps1`

The script prompts securely and does not print or package the password. For
compatibility with the Meta Quest client, pairing authentication ignores case
and punctuation; use at least 10 letters or numbers.

## Huawei MatePad and Android tablets

Install `KIMRemote-Android-0.2.9.apk` and Tailscale on the tablet. Sign in to
Tailscale as the same Robin owner used by the Windows computers. In KIM Remote:

1. Add a computer name and its MagicDNS name or `100.x` Tailscale address.
2. Leave **Pairing key** blank.
3. Save and connect.

The host accepts passwordless Android sessions only when Tailscale verifies
that the source is an online Android node owned by the same Tailscale `UserID`.
Tap is left click, one-finger drag holds and drags, two-finger drag scrolls,
and the in-session toolbar opens the keyboard, controls help, or disconnect.

The same APK supports Samsung phones and Samsung DeX. In DeX it keeps system
window controls, can be resized or maximized, and accepts DeX mouse, wheel,
right/middle click, physical keyboard input, multi-window connections, file
picker, and file drag-and-drop. Each remote computer runs in its own Android
document window. Received files are stored under
`Downloads/KIM Remote Incoming`. Outside DeX, the Android client remains
immersive landscape for touch tablets and Meta Quest; Quest stays a single
fullscreen session to preserve VR controller focus.

## Rollback

Run as Administrator:

`powershell -ExecutionPolicy Bypass -File .\Rollback-Host.ps1`

If a previous EXE exists, it is restored and the 0.3.8 EXE is retained with a
timestamp for inspection. On a first install, startup and the firewall rule
are disabled. Rollback also disables the auto-patcher so it cannot immediately
reinstall the version being rolled back. Local identity, certificates, pairing
key, logs, and installed files are preserved.
