Your workstation.
Your approved PBXs.

The right prerequisites.
No bundled VPN driver.

• Windows 10 or 11, x64. Integrated WireGuard installation requires native Intel/AMD x64, not x64 emulation on ARM64.
• Official WireGuard for Windows. Reuse a verified installation or explicitly approve the application's installer flow.
• Windows system OpenSSH Client for managed SSH. GUI-only pairing does not need it.
• A prepared FreePBX 17 / Debian 12 test PBX. Install the module and root broker, provide HTTPS for approval and make its WireGuard UDP endpoint reachable.

The Release build uses native C++17 Win32/MFC and static runtime linking. No .NET runtime or separate MFC/Visual C++ runtime is expected; Windows system components remain necessary.

Extract. Keep the helper.
Choose your tools.

Obtain the TELIPHONES-Windows-x64 artefact from an existing successful Windows Actions run. Extract the ZIP and keep TELIPHONES.exe and TELIPHONES-SSH.exe together. The helper is required for managed SSH.

The bundle includes licences and build-info.json with source/run provenance and executable hashes. Builds are unsigned; check their trusted origin rather than disabling SmartScreen or other protections.

1. Applications

   Select a preferred browser and SSH terminal. Save & Next saves the selection; Skip retains the defaults.

2. Secure connectivity

   Reuse verified WireGuard or choose Install WireGuard. TELIPHONES verifies a reviewed official MSI's pinned hash and Authenticode publisher, invokes Windows Installer through UAC and rechecks the installation.

3. Get started

   Choose Add my PBX or finish and explore. Not Now never downloads software; return to Settings > Connectivity later. Connections require verified WireGuard.

Add a PBX.
With someone saying yes.

1. Generate the request

   Choose Add my PBX..., enter a workstation name, then select Web access or Web + SSH access. Web-only requests do not create an SSH identity or require Windows OpenSSH. Copy feedback is shown briefly in the dialog instead of opening a success popup.

2. Approve in FreePBX

   A full administrator opens Connectivity > TELIPHONES > Windows workstations over HTTPS. They paste the request, set the reachable WireGuard endpoint and lifetime, and explicitly approve an existing account if granting managed SSH. The server rejects SSH approval for a web-only request.

3. Import the response

   Paste the response into the waiting Windows dialog and save the connection. TELIPHONES validates its binding to the pending request and reports whether SSH was authorised. Managed pairings supply the approved account, ports and pinned host/CA keys.

You can save multiple PBXs. Only one tunnel is active at a time; each PBX needs its own approval. Pairing data is operationally sensitive even though private keys are not in the exchanged strings.

Connect, then open FreePBX.

Select a profile and Connect. Approve the Windows tunnel setup when requested. The PBX grants a separate authenticated management-session lease; a WireGuard handshake alone does not count as an admitted session. The default capacity is one workstation. Once Connection Health reports the management endpoint reachable, select Open FreePBX and sign in with normal FreePBX credentials.

Updated Windows 0.8.0 builds retain and launch the approved HTTP/HTTPS URL, scheme and port, for example https://<PBX tunnel address>:8443/admin/. Standard 80/443 installations remain supported. Web redirects, listening addresses and TLS certificates remain a PBX configuration matter; do not bypass certificate checks to resolve a mismatch.

Unlocked pairings use the shared public WireGuard listener and may roam between public IPs. An administrator may instead approve a Locked pairing with a dedicated listener restricted to approved sources. Windows shows the actual PBX policy, current verified public source, DNS resolution failures, and session occupancy. Lock to Current IP uses the source observed by the PBX. Allowed List changes and unlocks are sent as requests and remain pending until an administrator approves them.

When an administrator changes listener mode, the existing WireGuard identity receives a bound configuration migration over its authenticated tunnel. The old path allows only session control until the updated tunnel acknowledges. If automatic migration is interrupted, reconnect the saved profile; do not delete the identity. Native Windows and live-PBX migration still require verification.

Custom-port import, launch and health checks require a build containing the current changes. Check build provenance as well as the unreleased 0.8.0 version. Re-pair saved profiles after changing the management URL on the PBX.

A built-in console.
Experimental, pending native validation.

With SSH explicitly approved and the PBX reachable, choose Open SSH. The unreleased Windows source opens the built-in console on the existing managed certificate, pinned host/CA identities and owned SSH process. A web-only workstation can choose Request SSH after pairing; FreePBX must explicitly approve the request and select an existing Linux account. There is no implicit root selection, password or unverified-host fallback. Rejection preserves web access.

The source now includes a libvterm-based VT screen, interactive keyboard input, ANSI colours and cursor control, scrollback, clipboard actions, reconnect/disconnect controls, and a ConPTY-backed OpenSSH path with terminal resize propagation. Portable emulator tests pass. Native MFC/ConPTY integration, full-screen applications, and real SSH behavior remain unverified until tested on Windows.

Try the clearly simulated website demonstrations. Their terminal never opens SSH or executes commands. Read the evidence boundary.

Measurements, not reassurance by colour.

Connection Health now probes the saved management endpoint's TCP port: an explicit port such as 8080/8443, or HTTP 80 / HTTPS 443 when omitted. It no longer substitutes unrelated 443/80 probes for My PBXs. This measures a TCP connection, not HTTP contents, redirects or TLS certificate validity.

Graphs show recent jitter, application probe failures, byte-counter rates and handshake freshness. Three durations are distinct: Connected for, Authorisation remaining and continuously healthy time.

• Choose latency/jitter, upload/download or failure/interruption graphs.
• Pop out a compact monitor without stopping sampling when it closes.
• Unknown measurements remain unknown; TCP failures are not network packet-loss measurements.
• Management-endpoint degradation disables new SSH launches, but does not by itself close existing terminals.

Portable tests cover endpoint selection; native Windows execution of the updated custom-port path remains outstanding.

A timeline on each side

View Session Log shows local client observations and offers a text export. Logs are bounded, rotated and kept under the current user's local application data. The FreePBX module exposes a separately filtered PBX record to full administrators.

Review and sanitise exports before sharing them. Do not send private keys, credentials, complete pairing strings, grants or customer-identifying metadata.

Close the connection.
Or withdraw the permission.

Disconnect closes owned managed SSH processes and stops/removes the local tunnel. Normal application exit requests disconnection too. The pairing remains authorised, so reconnecting does not need a new approval while it is still valid.

Remove deletes the local profile and secrets. It does not revoke server-side authority or guarantee physical storage erasure. For a retired or lost workstation, revoke its pairing in FreePBX first.

Temporary approval retains its original expiry. Persistent approval lasts until revoked. No server-pushed revocation channel exists, so the Windows connection display is not a substitute for verifying PBX-side access removal.

Familiar tools.
Considered presentation.

Choose the Windows default browser or a detected Chrome, Edge, Firefox, Brave or Vivaldi installation. Settings can locate supported executables if detection misses them; a missing selection produces an explicit recovery choice, not a silent substitution.

System, Light and Dark appearance modes preview across TELIPHONES windows. Save persists the choice; Cancel restores it. Windows high-contrast settings take priority. Switching themes does not restart the tunnel or change authorisation.

The interface adapts its content to smaller and higher-DPI work areas, keeping connection actions available. Full real display-scale and multi-monitor validation remains part of the manual test programme.