feat(mobile): support public secure tunnel pairing endpoints

[LosEcher]

Summary

Allow Orca Mobile pairing to use a user-managed secure WebSocket origin such as wss://orca.example.com for Cloudflare Tunnel and similar public TLS-terminated routes.

• Accept origin-only ws:// and wss:// endpoints alongside existing IP, hostname, and host:port forms.
• Preserve the exact secure endpoint through pairing offers, direct Mobile RPC connections, and saved host records.
• Keep unchanged implicit wss://host endpoints unchanged during host editing; use the scheme default (443) when the hostname changes.
• Keep device-token authorization, pinned-key E2EE, Relay metadata, and provider ownership unchanged.
• Add operator documentation for the Cloudflare HTTP/WebSocket route and verification flow.

Screenshots

Three physical-device/UI screenshots are attached in the PR conversation (not committed to the repository, per project policy):

1. Mobile pairing log reaching WebSocket open and Received e2ee_ready over the public wss:// endpoint.
2. Desktop pairing screen showing the secure custom endpoint.
3. Desktop confirmation showing the phone paired.

Testing

• pnpm lint
• pnpm typecheck
• pnpm test — 30,696 passed, 46 skipped
• pnpm build — root build passed in the recorded local evidence; not rerun after the final rebase. build:unpack reached an uncached Electron download and was stopped when it did not complete at a practical rate.
• Added regression tests for endpoint parsing, pairing-offer preservation, direct WebSocket construction, and implicit secure-port editing.
• Mobile full test suite — 1,771 passed, 2 skipped.

AI Review Report

The review checked:

• Cross-platform behavior for macOS, Linux, and Windows: endpoint parsing uses platform-neutral URL/path handling; no shortcut, shell, or platform-specific Electron behavior changed.
• Local, SSH, and remote-runtime compatibility: the tunnel remains user-managed direct connectivity; Orca does not spawn, supervise, or require cloudflared and does not assume a local-only origin.
• Supported agents, integrations, and Git providers: no agent, Relay, provider, or Git-provider contracts changed.
• Performance and UI quality: parsing is input-scoped, connection setup is unchanged, copy and labels are updated across the supported locale catalogs, and the custom endpoint flow remains within the existing picker.
• The review found and fixed a cross-flow bug where editing a saved wss://host could rewrite its implicit port as 6768.

Security Audit

• The new parser rejects credentials, unsupported schemes, paths, queries, fragments, invalid ports, and coercive numeric hosts.
• Pairing URLs contain no Cloudflare API token, Access service token, or browser credential. Existing device-token, public-key pinning, and E2EE checks remain required.
• The public endpoint is an operator-owned boundary; Orca does not invoke Cloudflare APIs or persist connector credentials.
• Existing runtime limits and unauthenticated WebSocket timeout remain in force; no new unauthenticated command or IPC path was added.

Notes

• Manual validation succeeded on 2026-07-16 with a physical Android device over cellular through the Cloudflare Tunnel; the supplied screenshots are the evidence.
• iOS coverage, connector-restart recovery, and private WARP routing remain unverified.
• X handle: @LosEcher

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 9f2278c8-2056-47bd-8b8f-fbeb95615944

📥 Commits

Reviewing files that changed from the base of the PR and between 39d6a69 and 4e08f78.

📒 Files selected for processing (1)

• src/renderer/src/i18n/locales/zh.json

🚧 Files skipped from review as they are similar to previous changes (1)

• src/renderer/src/i18n/locales/zh.json

---

📝 Walkthrough

Walkthrough

Adds shared validation for bare Mobile addresses and ws:///wss:// endpoint origins. Updates pairing UI copy and custom endpoint input across supported locales. Preserves secure tunnel endpoints through pairing offers, direct WebSocket connections, saved hosts, and host editing. Adds unit and integration coverage, plus documentation for Cloudflare Tunnel configuration, verification, troubleshooting, and physical-device testing.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main change: adding support for secure public tunnel pairing endpoints.
Description check	✅ Passed	The description follows the required template and includes summary, screenshots, testing, review, security, and notes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 5cd2df0c-8e68-4bfb-9bc3-6b142a1927a9

📥 Commits

Reviewing files that changed from the base of the PR and between cf02cc4 and 39d6a69.

📒 Files selected for processing (19)

• docs/reference/2026-07-16-mobile-public-tunnel-pairing-design.md
• docs/reference/mobile-public-tunnel.md
• mobile/README.md
• mobile/app/h/[hostId]/edit.tsx
• mobile/src/transport/host-endpoint-edit.test.ts
• mobile/src/transport/host-endpoint-edit.ts
• mobile/src/transport/pre-profile-pairing-coordinator.test.ts
• mobile/src/transport/rpc-client.test.ts
• src/main/runtime/runtime-rpc.test.ts
• src/renderer/src/components/mobile/NetworkInterfacePicker.tsx
• src/renderer/src/components/settings/MobilePairingSetupSection.test.tsx
• src/renderer/src/components/settings/MobilePairingSetupSection.tsx
• src/renderer/src/i18n/locales/en.json
• src/renderer/src/i18n/locales/es.json
• src/renderer/src/i18n/locales/ja.json
• src/renderer/src/i18n/locales/ko.json
• src/renderer/src/i18n/locales/zh.json
• src/shared/network/mobile-pairing-endpoint.test.ts
• src/shared/network/mobile-pairing-endpoint.ts

[LosEcher]