feat: add private relay for end-to-end-encrypted remote access (#2087)

Adds OpenChamber Relay — an opt-in way to reach an instance from a phone,
browser, or another desktop from anywhere, with no open inbound ports, no
tunnel, and no shared LAN. The instance dials outbound to a relay; all app
traffic (HTTP, the event stream, terminal, dictation) is multiplexed and
encrypted through a single connection per client, so the relay only ever
forwards opaque ciphertext.

Transport
- End-to-end-encrypted channel over WebCrypto (ECDH P-256 -> HKDF ->
  AES-256-GCM) with a capability-negotiated handshake and a small
  HTTP/SSE/WebSocket multiplexing protocol. A byte-compatible JS host mirror
  is cross-checked by tests.
- Host: outbound connection manager, per-client tunnel dispatcher to the local
  server over loopback, reuse of the existing instance identity key, and
  management routes. Disabled by default; explicit opt-in.
- Client: plugs into the existing runtime layer (runtime-fetch/-url/-switch/
  -auth, event pipeline, terminal, dictation) so features work over the relay
  unchanged; direct-URL and Electron realtime-proxy paths are untouched.

Pairing & UX
- Relay section in Settings -> Remote Instances (live status, QR/link pairing,
  revocation via the existing client-token list) and the mobile connect flow.
- Frame batching and idle-gated keepalive keep tunnel message volume low
  without affecting streaming smoothness.

Security
- The tunnel is transport only; the server authenticates every tunneled
  request exactly as for a direct remote client.
  fragments only. The relay stores no keys, tokens, or payloads.

Operability
- The endpoint can be pinned to a self-hosted rel
  paired clients inherit it from the offer automatically.
- Relay module DOCUMENTATION.md and a relay-trans
  invariants that future WebSocket/streaming changes must follow.

The relay transport is complete and tested; the UI for enabling and pairing
is gated behind openchamber_relay_gate and stays

packages/ui/src/lib/opencode/client.test.ts

@@ -126,6 +126,27 @@ describe('opencodeClient prompt retry behavior', () => {
     expect(error instanceof Error ? error.message : String(error)).toContain('Failed to fetch');
   });
 
+  test('does not fabricate an HTTP 500 when the SDK swallows a transport failure into result.error', async () => {
+    // The SDK catches thrown fetch errors and returns { error, response: undefined }.
+    // That is a transport failure, not a server 500 — it must surface as a
+    // descriptive transport error, never as "Failed to send message (500): {}".
+    promptAsyncResults.push({ error: new TypeError('relay tunnel reset: plaintext frame on established channel'), response: undefined });
+
+    let error: unknown = null;
+    try {
+      await sendPrompt('anthropic-transport');
+    } catch (caught) {
+      error = caught;
+    }
+
+    expect(promptAsyncCalls.length).toBe(1);
+    const message = error instanceof Error ? error.message : String(error);
+    expect(message).not.toContain('Failed to send message (500)');
+    expect(message).toContain('transport failure');
+    expect(message).toContain('relay tunnel reset');
+    expect((error as Error & { status?: number }).status).toBe(undefined);
+  });
+
   test('does not retry 503 prompt responses because proxy errors can be ambiguous too', async () => {
     promptAsyncResults.push({ response: new Response('starting', { status: 503 }) });
 

packages/ui/src/lib/opencode/client.ts

@@ -860,7 +860,14 @@ class OpencodeService {
       if (result.response instanceof Response) {
         response = result.response;
       } else if (result.error) {
-        const status = (result as SdkResult<unknown>).response?.status || 500;
+        const status = (result as SdkResult<unknown>).response?.status;
+        if (!status) {
+          // The SDK caught a thrown fetch error (network/tunnel transport
+          // failure) — there is no HTTP response to report. Never fabricate a
+          // status: surface it as a transport error so callers treat it like
+          // any other network failure instead of a server 500.
+          throw new Error(`Message send transport failure: ${formatSdkError(result.error)}`);
+        }
         response = new Response(JSON.stringify(result.error), { status });
       } else {
         response = new Response(JSON.stringify(result.data ?? true), { status: 200 });