@mahmoud_helmy/telecall 0.3.0-beta.2 → 0.3.0-beta.4

package/README.md

@@ -14,7 +14,7 @@ Run once on the PC:
 npx @mahmoud_helmy/telecall@beta
 ```
 
-The setup page opens in your browser. The phone app and Windows companion are included; Android Studio, .NET and APK_Bridge are not required.
+The setup page opens in your browser. This single package (about 4 MB) contains the phone APK, setup pages and the secure pairing service, all running on your Node.js. There are no npm dependencies, native helpers or post-install downloads. Android Studio, .NET and APK_Bridge are not required.
 
 1. Scan **Get the app** with your phone camera. Download **Telecall.apk**, open it, and allow your browser to install apps if Android asks.
 2. On the PC page, open **Pair phone**, select the phone's network, and click **Create pairing QR**.
@@ -47,9 +47,9 @@ Before updating, stop sharing, then run the global install command again. Downlo
 
 Pairing uses a certificate-pinned encrypted link, a 256-bit single-use credential and a five-minute QR expiry. Confirm pairing on the phone. The credential is shown only on the PC's local page. Camera images are neither sent nor saved. This beta pairs for one session; create a new QR after disconnecting.
 
-No Windows network-profile, firewall, administrator or router change is performed. Guest Wi-Fi isolation, VPNs or a firewall can still block device-to-device traffic. Telecall reports failures; it cannot override an organization's network policy. The PC page uses 8770 by default; the encrypted channel uses 8768 on your selected adapter and a loopback-only helper on 8769. Do not forward these ports to the internet.
+No Windows network-profile, firewall, administrator or router change is performed. Guest Wi-Fi isolation, VPNs or a firewall can still block device-to-device traffic. Telecall reports failures; it cannot override an organization's network policy. The PC page uses 8770 by default; the encrypted channel uses 8768 on your selected adapter only. Do not forward these ports to the internet.
 
-The APK is publicly downloadable on the selected local network while sharing runs. Pairing controls and the pairing QR are computer-only. Stop sharing when finished. Optional logs contain companion startup errors and local addresses, not pairing secrets or phone numbers; set `TELECALL_HOME` to choose their folder.
+The APK is publicly downloadable on the selected local network while sharing runs. Pairing controls and the pairing QR are computer-only. Stop sharing when finished. Optional logs contain startup errors and local addresses, not pairing secrets or phone numbers; set `TELECALL_HOME` to choose their folder.
 
 ## Report beta findings
 

package/THIRD-PARTY-NOTICES.md

@@ -1,9 +1,8 @@
 # Third-party notices
 
-The npm beta includes the independently signed Android beta and a self-contained .NET 10 Windows companion. Full .NET/ASP.NET Core licenses and third-party notices are included under `licenses/` in that package. Android dependencies include AndroidX Core/Activity/Compose/CameraX, Kotlin, OkHttp 4.12.0 and ZXing 3.5.3, under Apache License 2.0; the full license is included there as `APACHE-2.0.txt`. These components retain their upstream copyrights and licenses. The npm beta uses the tester's existing Node runtime rather than bundling Node.
-
-The Android Gradle baseline, wrapper, and connection/lifecycle architecture were adapted using the local APK Bridge project. Telecall is a separate application and does not share its tokens or app identity. APK Bridge's license is reproduced below. The Gradle wrapper is distributed by Gradle under Apache License 2.0; dependency artifacts retain their respective licenses. Windows self-contained runtime license files are retained in build output.
+The npm beta includes the independently signed Android beta and the Node.js setup and pairing code; it has no npm dependencies and no native Windows components. Android dependencies include AndroidX Core/Activity/Compose/CameraX, Kotlin, OkHttp 4.12.0 and ZXing 3.5.3, under Apache License 2.0; the full license is included there as `APACHE-2.0.txt`. These components retain their upstream copyrights and licenses. The npm beta uses the tester's existing Node runtime rather than bundling Node.
 
+The Android Gradle baseline, wrapper, and connection/lifecycle architecture were adapted using the local APK Bridge project. Telecall is a separate application and does not share its tokens or app identity. APK Bridge's license is reproduced below. The Gradle wrapper is distributed by Gradle under Apache License 2.0; dependency artifacts retain their respective licenses.
 ## APK Bridge — MIT License
 
 The local installation page follows APK Bridge's QR-to-download pattern. Its offline QR generator vendors the qrcode 1.5.4 core and SVG renderer (Copyright 2012 Ryan Day) and dijkstrajs (Copyright 2008 Wyatt Baldwin), both MIT licensed. Full license texts are in `install/vendor/qrcode/LICENSE` and `install/vendor/qrcode/DIJKSTRA-LICENSE`. The only QR library modification changes the dijkstrajs import to its vendored relative path. The portable install bundle includes the existing local Node.js runtime; its complete license notices are preserved in `runtime/LICENSE`.

package/app/app.json

@@ -1,9 +1,8 @@
 {
-  "version": "0.3.0-beta.2-api36",
-  "packageName": "com.telecall.diagnostics.beta",
-  "companionVersion": "0.3.0-beta.2",
-  "size": 3548980,
-  "sha256": "87ca4b3ca6b8469a97fda017eaff2630d33dec811d01c66f2940e8b5fee27c8f",
-  "minimumAndroid": 10,
-  "channel": "signed-beta"
+    "version":  "0.3.0-beta.4-api36",
+    "packageName":  "com.telecall.diagnostics.beta",
+    "size":  3548980,
+    "sha256":  "4508b98680fba77f8e06052d4209c481b64fa899a488869a3b150224d9b92d4b",
+    "minimumAndroid":  10,
+    "channel":  "signed-beta"
 }

package/app/cert.mjs

@@ -0,0 +1,54 @@
+import {X509Certificate, createHash, generateKeyPairSync, randomBytes, sign} from 'node:crypto';
+import {isIPv4} from 'node:net';
+
+// Node can verify certificates but not issue them. This builds the one shape Telecall
+// needs: an ephemeral self-signed P-256 leaf whose SHA-256 the phone pins from the QR.
+const length = n => n < 0x80 ? Buffer.from([n]) : n < 0x100 ? Buffer.from([0x81, n]) : Buffer.from([0x82, n >> 8, n & 0xff]);
+const tlv = (tag, ...parts) => { const body = Buffer.concat(parts); return Buffer.concat([Buffer.from([tag]), length(body.length), body]); };
+const seq = (...parts) => tlv(0x30, ...parts);
+const oid = dotted => {
+  const [a, b, ...rest] = dotted.split('.').map(Number);
+  const bytes = [40 * a + b];
+  for (const value of rest) {
+    const group = [value & 0x7f];
+    for (let v = value >>> 7; v; v >>>= 7) group.unshift((v & 0x7f) | 0x80);
+    bytes.push(...group);
+  }
+  return tlv(0x06, Buffer.from(bytes));
+};
+const utcTime = date => tlv(0x17, Buffer.from(date.toISOString().replace(/[-:T]/g, '').slice(2, 14) + 'Z'));
+const extension = (id, critical, value) => seq(oid(id), ...(critical ? [tlv(0x01, Buffer.from([0xff]))] : []), tlv(0x04, value));
+const pem = (label, der) => `-----BEGIN ${label}-----\n${der.toString('base64').match(/.{1,64}/g).join('\n')}\n-----END ${label}-----\n`;
+
+export function createCertificate(ip, now = new Date()) {
+  if (!isIPv4(ip)) throw new Error('Certificate address must be IPv4');
+  const {privateKey, publicKey} = generateKeyPairSync('ec', {namedCurve: 'P-256'});
+  const serial = randomBytes(16);
+  serial[0] = (serial[0] & 0x7f) | 0x40; // positive and minimally encoded
+  const algorithm = seq(oid('1.2.840.10045.4.3.2')); // ecdsa-with-SHA256, no parameters
+  const name = seq(tlv(0x31, seq(oid('2.5.4.3'), tlv(0x0c, Buffer.from('Telecall')))));
+  const tbs = seq(
+    tlv(0xa0, tlv(0x02, Buffer.from([2]))), // v3
+    tlv(0x02, serial),
+    algorithm,
+    name,
+    seq(utcTime(new Date(now.getTime() - 60_000)), utcTime(new Date(now.getTime() + 8 * 3600_000))),
+    name,
+    publicKey.export({type: 'spki', format: 'der'}),
+    tlv(0xa3, seq(
+      extension('2.5.29.19', true, seq()), // basicConstraints: not a CA
+      extension('2.5.29.37', true, seq(oid('1.3.6.1.5.5.7.3.1'))), // serverAuth only
+      extension('2.5.29.17', false, seq(tlv(0x87, Buffer.from(ip.split('.').map(Number)))))
+    ))
+  );
+  const signature = sign('sha256', tbs, {key: privateKey, dsaEncoding: 'der'});
+  const der = seq(tbs, algorithm, tlv(0x03, Buffer.from([0]), signature));
+  const parsed = new X509Certificate(der);
+  if (!parsed.verify(publicKey) || !parsed.checkPrivateKey(privateKey) || parsed.checkIP(ip) !== ip) throw new Error('Generated certificate failed its self-check');
+  return {
+    key: privateKey.export({type: 'pkcs8', format: 'pem'}),
+    cert: pem('CERTIFICATE', der),
+    der,
+    fingerprint: createHash('sha256').update(der).digest('hex').toUpperCase()
+  };
+}

package/app/page.js

@@ -53,10 +53,7 @@ if (document.body.classList.contains('pairing')) {
       document.querySelector('#pair-countdown').textContent = `Expires in ${Math.floor(remaining/60)}:${String(remaining%60).padStart(2,'0')} · Keep this QR private`;
     } else {image.removeAttribute('src'); expires = null;}
     error.textContent = state.state !== 'blocked' ? '' : ({
-      PrivateProfileRequired:'Windows marks this network Public. If you trust it, select Private in Windows network settings, then try again.',
-      CannotVerifyPrivateProfile:'Windows could not confirm a Private profile for this adapter. Choose your trusted Private Wi-Fi network above.',
-      MissingPairingHost:'The secure companion is missing. Extract the complete updated Telecall installer folder.',
-      CouldNotStartSecureListener:'The secure listener could not start. Check that another Telecall session is not using port 8768.'
+      CouldNotStartSecureListener:'The secure listener could not start on this network. Choose a connected Wi-Fi or hotspot address above, then try again.'
       ,LanPortBusy:'Port 8768 is already in use. Stop the other Telecall session, then create a fresh QR.'
     }[state.code] || 'Check the companion and your Windows network settings, then create a fresh QR.');
   }

package/app/pairing.mjs

@@ -1,116 +1,35 @@
-import {spawn} from 'node:child_process';
-import {existsSync} from 'node:fs';
-import {join, resolve} from 'node:path';
-import net from 'node:net';
-import {createRequire} from 'node:module';
-
-export function resolvePairingHost(root) {
-  const portable = join(root,'pairing','Telecall.PairingHost.exe');
-  if (existsSync(portable)) return portable;
-  try {return createRequire(import.meta.url).resolve('@mahmoud_helmy/telecall-windows-x64/host');}
-  catch {return null;}
-}
+import {SecureSession} from './secure-host.mjs';
 
+// One computer-only pairing at a time. The secure session runs in this Node process and
+// listens only on the selected adapter; no helper process, relay or network-profile change.
 export class PairingController {
-  #child = null;
+  #session = null;
+  #closing = Promise.resolve();
   #state = {state:'idle'};
-  #payload = null;
-  #timer = null;
   #generation = 0;
-  #proxy = null;
-  #sockets = new Set();
-  constructor(root) { this.root = root; }
+  constructor(root, {port = 8768} = {}) { this.root = root; this.port = port; }
   status() { return {...this.#state}; }
-  payload() { return this.#state.state === 'waiting' && Date.now() < this.#state.expiresAt ? this.#payload : null; }
+  payload() { return this.#state.state === 'waiting' && Date.now() < this.#state.expiresAt ? this.#session?.payload ?? null : null; }
   async start(address) {
     if (['connected','starting'].includes(this.#state.state)) throw new Error('Finish or disconnect the current session before creating another QR.');
-    const previous = this.#child;
     this.stop();
     const generation = this.#generation;
     this.#state = {state:'starting'};
-    if (previous && previous.exitCode === null) await new Promise(ok => {
-      const timer = setTimeout(ok,2000); timer.unref();
-      previous.once('exit', () => {clearTimeout(timer); ok();});
-    });
+    await this.#closing;
     if (generation !== this.#generation) return;
-    // Only the selected adapter is exposed. This is a raw TLS passthrough: Node
-    // cannot read cellular status or modify the certificate-pinned session.
-    const proxy = net.createServer(client => {
-      if (!['waiting','connected'].includes(this.#state.state) || this.#sockets.size >= 8) {client.destroy(); return;}
-      const upstream = net.connect({host:'127.0.0.1',port:8769});
-      this.#sockets.add(client); this.#sockets.add(upstream);
-      for (const socket of [client,upstream]) {
-        socket.setTimeout(45000, () => socket.destroy());
-        socket.on('error', () => {client.destroy(); upstream.destroy();});
-        socket.on('close', () => {this.#sockets.delete(socket); client.destroy(); upstream.destroy();});
-      }
-      client.pipe(upstream).pipe(client);
-    });
-    this.#proxy = proxy;
-    const listening = await new Promise(ok => {
-      proxy.once('error', () => ok(false));
-      proxy.listen(8768,address, () => ok(true));
+    const session = new SecureSession({address, port:this.port});
+    this.#session = session;
+    session.on('state', ({state, code}) => {
+      if (this.#session !== session) return;
+      this.#state = {state, code, expiresAt: state === 'blocked' ? undefined : session.expiresAt};
     });
-    if (!listening) {this.stop(); this.#state = {state:'blocked',code:'LanPortBusy'}; return;}
-    if (generation !== this.#generation) {proxy.close(); return;}
-    const portable = resolvePairingHost(this.root);
-    const project = resolve(this.root,'..','..','..');
-    const dotnet = join(project,'.tooling','dotnet','dotnet.exe');
-    const dll = join(project,'windows','Telecall.PairingHost','bin','Debug','net10.0','win-x64','Telecall.PairingHost.dll');
-    let executable, args;
-    if (portable) { executable = portable; args = ['--qr-pairing',address]; }
-    else if (existsSync(dotnet) && existsSync(dll)) { executable = dotnet; args = [dll,'--qr-pairing',address]; }
-    else { this.stop(); this.#state = {state:'blocked',code:'MissingPairingHost'}; return; }
-    let child;
-    try {child = spawn(executable,args,{cwd:this.root,windowsHide:true,stdio:['ignore','pipe','pipe']});}
-    catch {this.stop(); this.#state = {state:'blocked',code:'CouldNotStartSecureListener'}; return;}
-    this.#child = child;
-    let buffer = '';
-    child.stdout.setEncoding('utf8');
-    child.stdout.on('data', chunk => {
-      if (this.#child !== child) return;
-      buffer += chunk;
-      if (buffer.length > 16384) { this.stop(); this.#state = {state:'blocked',code:'InvalidHostResponse'}; return; }
-      let end;
-      while ((end = buffer.indexOf('\n')) >= 0) {
-        const line = buffer.slice(0,end).trim(); buffer = buffer.slice(end+1);
-        if (!line.startsWith('TELECALL_PAIRING:')) continue;
-        try {
-          const event = JSON.parse(line.slice('TELECALL_PAIRING:'.length));
-          if (!['waiting','connected','disconnected','expired','blocked'].includes(event.state)) continue;
-          clearTimeout(this.#timer);
-          this.#state = {state:event.state, code:event.code, expiresAt:event.expiresAt ?? this.#state.expiresAt};
-          this.#payload = event.state === 'waiting' ? event.payload : null;
-          if (['blocked','expired','disconnected'].includes(event.state)) this.#closeProxy();
-        } catch { this.stop(); this.#state = {state:'blocked',code:'InvalidHostResponse'}; }
-      }
-    });
-    // Consume errors without ever writing a child's output or a pairing credential to logs.
-    child.stderr.resume();
-    child.on('error', () => {
-      if (this.#child === child) {clearTimeout(this.#timer); this.#closeProxy(); this.#payload = null; this.#state = {state:'blocked',code:'CouldNotStartSecureListener'};}
-    });
-    child.on('exit', () => {
-      if (this.#child !== child) return;
-      this.#child = null; clearTimeout(this.#timer); this.#payload = null;
-      this.#closeProxy();
-      if (!['blocked','expired','disconnected'].includes(this.#state.state)) this.#state = {state:'disconnected'};
-    });
-    this.#timer = setTimeout(() => {if (this.#child === child && this.#state.state === 'starting') {this.stop(); this.#state = {state:'blocked',code:'PairingHostTimeout'};}},15000);
-    this.#timer.unref();
+    await session.listen();
+    if (generation !== this.#generation) await session.close();
   }
   stop() {
     this.#generation++;
-    clearTimeout(this.#timer);
-    const child = this.#child; this.#child = null;
-    child?.kill();
-    this.#closeProxy();
-    this.#payload = null;
+    const session = this.#session; this.#session = null;
+    if (session) this.#closing = session.close();
     this.#state = {state:'idle'};
   }
-  #closeProxy() {
-    this.#proxy?.close(); this.#proxy = null;
-    for (const socket of this.#sockets) socket.destroy();
-    this.#sockets.clear();
-  }
 }

package/app/secure-host.mjs

@@ -0,0 +1,169 @@
+import https from 'node:https';
+import {EventEmitter} from 'node:events';
+import {randomBytes, randomUUID, timingSafeEqual} from 'node:crypto';
+import {hostname, networkInterfaces} from 'node:os';
+import {createCertificate} from './cert.mjs';
+import {acceptWebSocket, isWebSocketRequest} from './ws.mjs';
+
+// Ephemeral pairing session, not production trust: the full certificate fingerprint and
+// a 256-bit one-use secret travel only in the computer-only QR. Nothing is persisted.
+export const PAIRING_LIFETIME = 5 * 60_000;
+const CALL_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+export function isPrivateIPv4(ip = '') {
+  const p = ip.split('.').map(Number);
+  if (p.length !== 4 || p.some(n => !Number.isInteger(n) || n < 0 || n > 255)) return false;
+  return p[0] === 10 || p[0] === 192 && p[1] === 168 || p[0] === 172 && p[1] >= 16 && p[1] <= 31;
+}
+const adapterIsUp = (ip, interfaces = networkInterfaces()) =>
+  Object.values(interfaces).flat().some(i => i && i.family === 'IPv4' && !i.internal && i.address === ip);
+const compact = hex => Buffer.from(hex, 'hex').toString('base64url');
+
+// Same rules as the earlier .NET PairingChallenge: single claim, expiry, five-failure lockout.
+export class PairingChallenge {
+  #expected; #expiresAt; #claimed = false; #failures = 0;
+  constructor(secret, expiresAt) { this.#expected = Buffer.from('Bearer ' + secret, 'ascii'); this.#expiresAt = expiresAt; }
+  tryClaim(authorization, now, isWebSocket) {
+    if (this.#claimed || now >= this.#expiresAt || this.#failures >= 5) return false;
+    const supplied = Buffer.from(authorization ?? '', 'utf8');
+    if (!isWebSocket || supplied.length !== this.#expected.length || !timingSafeEqual(supplied, this.#expected)) { this.#failures++; return false; }
+    this.#claimed = true;
+    return true;
+  }
+}
+
+export class SecureSession extends EventEmitter {
+  state = 'idle';
+  code = undefined;
+  revision = -1;
+  calls = [];
+  sessionId = randomUUID().replaceAll('-', '');
+  #secret = randomBytes(32).toString('hex').toUpperCase();
+  #server = null; #socket = null; #sockets = new Set(); #timer = null; #closed = null;
+  constructor({address, port = 8768, debugTunnel = false, lifetime = PAIRING_LIFETIME, now = Date.now()}) {
+    super();
+    this.address = debugTunnel ? '127.0.0.1' : address;
+    this.port = port;
+    this.debugTunnel = debugTunnel;
+    this.expiresAt = now + lifetime;
+    this.challenge = new PairingChallenge(this.#secret, this.expiresAt);
+  }
+  get payload() {
+    if (this.state !== 'waiting') return null;
+    const name = hostname().split('.')[0] || 'Computer';
+    return `telecall://pair?v=1&h=${this.address}&p=${compact(this.fingerprint)}&s=${compact(this.#secret)}` +
+      `&e=${Math.floor(this.expiresAt / 1000)}&n=${encodeURIComponent(name)}`;
+  }
+  get pairingJson() {
+    return JSON.stringify({url: `wss://${this.address}:${this.port}/probe`, fingerprint: this.fingerprint, secret: this.#secret, debugTunnel: this.debugTunnel});
+  }
+  #setState(state, code) {
+    if (this.state === state) return;
+    this.state = state; this.code = code;
+    this.emit('state', {state, code});
+  }
+  // Resolves once the session is waiting or blocked; never rejects.
+  async listen() {
+    try {
+      if (!this.debugTunnel && (!isPrivateIPv4(this.address) || !adapterIsUp(this.address))) throw new Error('Not a connected local adapter');
+      const certificate = createCertificate(this.address);
+      this.fingerprint = certificate.fingerprint;
+      this.certificate = certificate.cert;
+      const server = https.createServer({key: certificate.key, cert: certificate.cert, minVersion: 'TLSv1.2'}, (req, res) => {
+        // Plain HTTPS to the endpoint is a failed pairing attempt, as before.
+        if (new URL(req.url, 'https://x').pathname === '/probe') this.challenge.tryClaim(req.headers.authorization, Date.now(), false);
+        res.writeHead(new URL(req.url, 'https://x').pathname === '/probe' ? 403 : 404, {connection: 'close', 'content-length': 0}).end();
+      });
+      this.#server = server;
+      server.maxConnections = 8;
+      server.headersTimeout = 15000;
+      server.requestTimeout = 15000;
+      server.on('connection', socket => {
+        this.#sockets.add(socket);
+        socket.setTimeout(45000, () => socket.destroy());
+        socket.on('error', () => socket.destroy());
+        socket.on('close', () => this.#sockets.delete(socket));
+      });
+      server.on('tlsClientError', (_, socket) => socket.destroy());
+      server.on('upgrade', (req, socket, head) => this.#upgrade(req, socket, head));
+      this.#closed = new Promise(ok => server.once('close', ok));
+      await new Promise((ok, fail) => { server.once('error', fail); server.listen(this.port, this.address, ok); });
+      server.on('error', () => {});
+      this.port = server.address().port;
+      this.#timer = setTimeout(() => { if (this.state === 'waiting') { this.#setState('expired'); this.close(); } }, Math.max(0, this.expiresAt - Date.now()));
+      this.#timer.unref();
+      this.#setState('waiting');
+    } catch (error) {
+      this.close();
+      this.#setState('blocked', error?.code === 'EADDRINUSE' ? 'LanPortBusy' : 'CouldNotStartSecureListener');
+    }
+  }
+  #upgrade(req, socket, head) {
+    socket.on('error', () => socket.destroy());
+    if (new URL(req.url, 'https://x').pathname !== '/probe') return reject(socket, 404);
+    if (!this.challenge.tryClaim(req.headers.authorization, Date.now(), isWebSocketRequest(req))) return reject(socket, 403);
+    const ws = acceptWebSocket(req, socket, head);
+    this.#socket = ws;
+    clearTimeout(this.#timer); // expiry limits claiming, not an established session
+    this.#setState('connected');
+    ws.on('message', text => {
+      try { this.#handle(JSON.parse(text)); }
+      catch { ws.close(1008); }
+    });
+    ws.on('close', () => {
+      this.#socket = null; this.calls = []; this.revision = -1;
+      if (this.state === 'connected') this.#setState('disconnected');
+      this.close();
+    });
+    this.#send({type: 'hello', version: 1, sessionId: this.sessionId});
+  }
+  #handle(message) {
+    if (message?.version !== 1 || message.sessionId !== this.sessionId) throw new Error('Session mismatch');
+    if (message.type === 'snapshot') {
+      if (!Number.isSafeInteger(message.revision) || !Array.isArray(message.calls)) throw new Error('Invalid snapshot');
+      if (message.revision < this.revision) return;
+      const calls = message.calls.map(call => {
+        if (typeof call?.callId !== 'string' || !CALL_ID.test(call.callId) || typeof call.cellular !== 'boolean' || !Number.isInteger(call.state)) throw new Error('Invalid call');
+        return {callId: call.callId, state: call.state, cellular: call.cellular};
+      });
+      this.calls = calls; this.revision = message.revision;
+      this.emit('snapshot', {revision: this.revision, calls});
+    } else if (message.type === 'result') {
+      if (typeof message.commandId !== 'string' || typeof message.code !== 'string') throw new Error('Invalid result');
+      this.emit('result', {commandId: message.commandId, code: message.code});
+    } else throw new Error('Unexpected message');
+  }
+  #send(message) {
+    if (!this.#socket?.send(JSON.stringify(message))) throw new Error('No paired phone');
+  }
+  refresh() { this.#send({type: 'refresh', version: 1, sessionId: this.sessionId}); }
+  // Loopback test harness only: resolves with the phone's next result for this commandId.
+  sendTestCommand({commandId, callId, revision, action}, timeout = 15000) {
+    if (!this.debugTunnel) return Promise.reject(new Error('Test commands require the loopback tunnel'));
+    return new Promise((ok, fail) => {
+      const done = (fn, value) => { clearTimeout(timer); this.off('result', listener); fn(value); };
+      const listener = result => { if (result.commandId === commandId) done(ok, result.code); };
+      const timer = setTimeout(() => done(fail, new Error('No result')), timeout);
+      this.on('result', listener);
+      try { this.#send({type: 'command', version: 1, sessionId: this.sessionId, commandId, callId, revision, action}); }
+      catch (error) { done(fail, error); }
+    });
+  }
+  // Ends the session and frees the port; resolves when the listener has closed.
+  close() {
+    clearTimeout(this.#timer);
+    this.#socket?.close(1000);
+    for (const socket of this.#sockets) socket.destroy();
+    this.#sockets.clear();
+    const listening = this.#server?.listening;
+    if (listening) this.#server.close();
+    const closed = listening ? this.#closed : Promise.resolve();
+    this.#server = null;
+    return Promise.race([closed, new Promise(ok => setTimeout(ok, 2000).unref())]);
+  }
+}
+
+function reject(socket, status) {
+  socket.end(`HTTP/1.1 ${status} ${status === 403 ? 'Forbidden' : 'Not Found'}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+  setTimeout(() => socket.destroy(), 1000).unref();
+}

package/app/ws.mjs

@@ -0,0 +1,100 @@
+import {EventEmitter} from 'node:events';
+import {createHash} from 'node:crypto';
+
+// Minimal RFC 6455 server side for the phone's single text channel. Strict by design:
+// masked client frames, text only, no extensions, bounded per-message size.
+const GUID = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';
+
+export function isWebSocketRequest(req) {
+  return req.method === 'GET' && /^websocket$/i.test(req.headers.upgrade ?? '') &&
+    /(^|,)\s*upgrade\s*(,|$)/i.test(req.headers.connection ?? '') &&
+    req.headers['sec-websocket-version'] === '13' &&
+    /^[A-Za-z0-9+/]{21}[AQgw]==$/.test(req.headers['sec-websocket-key'] ?? '');
+}
+
+export function acceptWebSocket(req, socket, head, options) {
+  const accept = createHash('sha1').update(req.headers['sec-websocket-key'] + GUID).digest('base64');
+  socket.write(`HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Accept: ${accept}\r\n\r\n`);
+  return new WebSocketConnection(socket, head, options);
+}
+
+export class WebSocketConnection extends EventEmitter {
+  #socket; #max; #buffer = Buffer.alloc(0); #parts = []; #partSize = 0; #inMessage = false;
+  #closing = false; #closed = false;
+  #decoder = new TextDecoder('utf-8', {fatal: true});
+  constructor(socket, head = Buffer.alloc(0), {maxMessage = 16384} = {}) {
+    super();
+    this.#socket = socket; this.#max = maxMessage;
+    socket.on('data', chunk => this.#receive(chunk));
+    socket.on('error', () => socket.destroy());
+    socket.on('close', () => { if (!this.#closed) { this.#closed = true; this.#closing = true; this.emit('close'); } });
+    if (head.length) queueMicrotask(() => this.#receive(head));
+  }
+  get open() { return !this.#closing; }
+  send(text) {
+    const payload = Buffer.from(text, 'utf8');
+    if (this.#closing || payload.length > this.#max) return false;
+    this.#write(0x1, payload);
+    return true;
+  }
+  close(code = 1000) {
+    if (this.#closing) return;
+    this.#closing = true;
+    const body = Buffer.alloc(2); body.writeUInt16BE(code);
+    this.#write(0x8, body);
+    this.#socket.end();
+    setTimeout(() => this.#socket.destroy(), 1000).unref();
+  }
+  #write(opcode, payload) {
+    const n = payload.length;
+    const header = n < 126 ? Buffer.from([0x80 | opcode, n]) : Buffer.from([0x80 | opcode, 126, n >> 8, n & 0xff]);
+    if (!this.#socket.destroyed) this.#socket.write(Buffer.concat([header, payload]));
+  }
+  #receive(chunk) {
+    if (this.#closing) return;
+    // At most one maximal frame plus its header is ever buffered.
+    if (this.#buffer.length + chunk.length > this.#max + 14) return this.close(1009);
+    this.#buffer = Buffer.concat([this.#buffer, chunk]);
+    while (!this.#closing && this.#frame());
+  }
+  #frame() {
+    const b = this.#buffer;
+    if (b.length < 2) return false;
+    const fin = (b[0] & 0x80) !== 0, opcode = b[0] & 0x0f;
+    if (b[0] & 0x70 || !(b[1] & 0x80)) { this.close(1002); return false; }
+    let size = b[1] & 0x7f, offset = 2;
+    if (size === 126) { if (b.length < 4) return false; size = b.readUInt16BE(2); offset = 4; }
+    else if (size === 127) {
+      if (b.length < 10) return false;
+      const big = b.readBigUInt64BE(2);
+      if (big > BigInt(this.#max)) { this.close(1009); return false; }
+      size = Number(big); offset = 10;
+    }
+    if (opcode >= 0x8) {
+      if (!fin || size > 125 || opcode > 0xa) { this.close(1002); return false; }
+    } else if (opcode === 0x2) { this.close(1003); return false; }
+    else if (opcode > 0x2 || (opcode === 0x0) !== this.#inMessage) { this.close(1002); return false; }
+    else if (this.#partSize + size > this.#max) { this.close(1009); return false; }
+    if (b.length < offset + 4 + size) return false;
+    const mask = b.subarray(offset, offset + 4);
+    const payload = Buffer.from(b.subarray(offset + 4, offset + 4 + size));
+    for (let i = 0; i < payload.length; i++) payload[i] ^= mask[i & 3];
+    this.#buffer = b.subarray(offset + 4 + size);
+    if (opcode === 0x9) this.#write(0xa, payload);
+    else if (opcode === 0x8) {
+      const code = payload.length >= 2 ? payload.readUInt16BE(0) : 1000;
+      const valid = payload.length !== 1 && (code >= 1000 && code <= 1014 && ![1004, 1005, 1006].includes(code) || code >= 3000 && code <= 4999);
+      this.close(valid ? code : 1002);
+    } else if (opcode <= 0x1) {
+      this.#parts.push(payload); this.#partSize += size; this.#inMessage = !fin;
+      if (fin) {
+        const data = Buffer.concat(this.#parts);
+        this.#parts = []; this.#partSize = 0;
+        let text;
+        try { text = this.#decoder.decode(data); } catch { this.close(1007); return false; }
+        this.emit('message', text);
+      }
+    }
+    return true;
+  }
+}

package/bin/telecall.mjs

@@ -6,7 +6,6 @@ import {dirname,join} from 'node:path';
 import {fileURLToPath} from 'node:url';
 import {homedir} from 'node:os';
 import {createHash} from 'node:crypto';
-import {resolvePairingHost} from '../app/pairing.mjs';
 
 const root = dirname(dirname(fileURLToPath(import.meta.url)));
 const app = join(root,'app');
@@ -45,9 +44,7 @@ async function verify() {
   const metadata = JSON.parse(await readFile(join(app,'app.json'),'utf8'));
   const apk = await readFile(join(app,'Telecall.apk'));
   if (createHash('sha256').update(apk).digest('hex') !== metadata.sha256 || apk.length !== metadata.size) throw Error('The bundled Android APK failed its integrity check. Reinstall this beta.');
-  const host = resolvePairingHost(app);
-  if (!host) throw Error('The Windows companion dependency is missing. Reinstall this beta.');
-  await stat(host);
+  for (const file of ['server.mjs','pairing.mjs','secure-host.mjs','cert.mjs','ws.mjs']) await stat(join(app,file));
   return metadata;
 }
 async function run() {
@@ -55,7 +52,7 @@ try {
   if (process.platform !== 'win32' || process.arch !== 'x64') throw Error('This beta supports Windows 11 x64. The phone needs Android 10 or later.');
   if (command === 'doctor') {
     const metadata = await verify();
-    console.log(`Telecall ${pkg.version}\nAPK verified: ${metadata.version}\nWindows companion included; no .NET installation needed.\nNo network profile or firewall settings are changed.\nBoth devices need a reachable local network. Desktop call audio is unverified.`);
+    console.log(`Telecall ${pkg.version}\nAPK verified: ${metadata.version}\nPairing runs in Node; nothing else to install.\nNo network profile or firewall settings are changed.\nBoth devices need a reachable local network. Desktop call audio is unverified.`);
     return;
   }
   const existing = await health();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mahmoud_helmy/telecall",
-  "version": "0.3.0-beta.2",
+  "version": "0.3.0-beta.4",
   "description": "Telecall beta: install the Android app and pair it with Windows using local QR codes.",
   "license": "UNLICENSED",
   "author": "Mahmoud Helmy",
@@ -10,7 +10,6 @@
   "os": ["win32"],
   "cpu": ["x64"],
   "engines": {"node": ">=22"},
-  "dependencies": {"@mahmoud_helmy/telecall-windows-x64": "0.3.0-beta.2"},
   "keywords": ["android", "windows", "local-network", "qr", "beta"],
   "publishConfig": {"access": "public", "tag": "beta"}
 }

package/licenses/ASPNETCORE-LICENSE.txt

@@ -1,23 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) .NET Foundation and Contributors
-
-All rights reserved.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.