feat(desktop): support remote-only startup

Allow Desktop to skip its in-process OpenChamber server with OPENCHAMBER_SKIP_LOCAL_SERVER=1 while continuing to load the packaged UI shell.

Carry local runtime availability through the boot contract so unavailable or unconfigured remotes enter a remote-only chooser instead of offering broken local recovery actions. The chooser can select saved instances, add a server by URL, or redeem an OpenChamber pairing link over direct or E2EE relay transports.

Keep additional windows, Mini Chat, background startup, and unreachable-host recovery functional without a local origin. Render boot and recovery surfaces with the active theme background rather than exposing the native vibrancy backing.

Document the environment variable and cover serverless boot routing plus malformed pairing imports with focused tests.

packages/ui/src/lib/desktopHosts.ts

@@ -1,5 +1,6 @@
 import { hasDesktopInvoke, invokeDesktop } from '@/lib/desktop';
 import { createRelayTunnelClient } from '@/lib/relay/tunnel-client';
+import { parsePairingConnectionPayload, type PairingEndpointCandidate } from '@/lib/connectionPayload';
 
 type DesktopInvoke = (cmd: string, args?: Record<string, unknown>) => Promise<unknown>;
 
@@ -79,6 +80,122 @@ export type DesktopHostsConfigInput = {
   localClientToken?: string | null;
 };
 
+const desktopPlatformName = (): string | undefined => {
+  if (typeof navigator === 'undefined') return undefined;
+  const ua = navigator.userAgent;
+  if (/Macintosh|Mac OS X/i.test(ua)) return 'macos';
+  if (/Windows/i.test(ua)) return 'windows';
+  if (/Linux/i.test(ua)) return 'linux';
+  return undefined;
+};
+
+export const importDesktopHostPairing = async (
+  link: string,
+  hosts: DesktopHost[],
+): Promise<{ hosts: DesktopHost[]; hostId: string }> => {
+  const payload = parsePairingConnectionPayload(link);
+  if (!payload) throw new Error('invalid-connect-link');
+
+  const installId = await desktopInstallIdGet().catch(() => '');
+  const redeemInit: RequestInit = {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify({
+      pairingId: payload.pairingId,
+      secret: payload.secret,
+      clientLabel: payload.label || 'OpenChamber Desktop',
+      clientKind: 'desktop',
+      deviceName: 'OpenChamber Desktop',
+      devicePlatform: desktopPlatformName(),
+      ...(installId ? { dedupeKey: `desktop:${installId}` } : {}),
+    }),
+  };
+  const readToken = async (response: Response): Promise<string | null> => {
+    if (!response.ok) return null;
+    const body = (await response.json().catch(() => null)) as { clientToken?: unknown } | null;
+    const token = typeof body?.clientToken === 'string' ? body.clientToken.trim() : '';
+    return token || null;
+  };
+
+  let redeemed: { directUrl?: string; relay?: DesktopHostRelay; token: string } | null = null;
+  const candidates = [...payload.candidates].sort(
+    (a, b) => (a.type === 'relay' ? 1 : 0) - (b.type === 'relay' ? 1 : 0),
+  );
+  for (const candidate of candidates) {
+    if (candidate.type === 'relay') {
+      const tunnel = createRelayTunnelClient({
+        relayUrl: candidate.relayUrl,
+        serverId: candidate.serverId,
+        hostEncPubJwk: candidate.hostEncPubJwk,
+        ...(candidate.grant ? { grant: candidate.grant } : {}),
+      });
+      try {
+        const token = await readToken(await tunnel.fetch('/api/client-auth/pairing/redeem', redeemInit));
+        if (token) {
+          redeemed = {
+            relay: { relayUrl: candidate.relayUrl, serverId: candidate.serverId, hostEncPubJwk: candidate.hostEncPubJwk },
+            token,
+          };
+          break;
+        }
+      } catch {
+        // Try the next advertised transport.
+      } finally {
+        tunnel.close();
+      }
+      continue;
+    }
+    const directUrl = normalizeHostUrl(candidate.url);
+    if (!directUrl) continue;
+    try {
+      const token = await readToken(await fetch(`${directUrl}/api/client-auth/pairing/redeem`, redeemInit));
+      if (token) {
+        redeemed = { directUrl, token };
+        break;
+      }
+    } catch {
+      // Try the next advertised transport.
+    }
+  }
+  if (!redeemed) throw new Error('pairing-redeem-failed');
+
+  const relayCandidate = payload.candidates.find(
+    (candidate): candidate is Extract<PairingEndpointCandidate, { type: 'relay' }> => candidate.type === 'relay',
+  );
+  const relay = redeemed.relay || (relayCandidate
+    ? { relayUrl: relayCandidate.relayUrl, serverId: relayCandidate.serverId, hostEncPubJwk: relayCandidate.hostEncPubJwk }
+    : undefined);
+  const firstDirectUrl = payload.candidates
+    .filter((candidate): candidate is Extract<PairingEndpointCandidate, { type: 'lan' | 'tunnel' }> => candidate.type !== 'relay')
+    .map((candidate) => normalizeHostUrl(candidate.url))
+    .find((value): value is string => Boolean(value));
+  const directUrl = redeemed.directUrl || firstDirectUrl;
+  const url = directUrl || (relay ? relayHostDisplayUrl(relay.serverId) : null);
+  if (!url) throw new Error('pairing-missing-transport');
+
+  const existing = hosts.find((host) => (
+    relay ? host.relay?.serverId === relay.serverId : (!host.relay && normalizeHostUrl(host.apiUrl || host.url) === url)
+  ));
+  const hostId = existing?.id || (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function'
+    ? crypto.randomUUID()
+    : `host-${Date.now()}-${Math.random().toString(16).slice(2)}`);
+  const nextHost: DesktopHost = {
+    ...(existing || {}),
+    id: hostId,
+    label: payload.label || existing?.label || redactSensitiveUrl(url),
+    url,
+    apiUrl: directUrl,
+    clientToken: redeemed.token,
+    ...(relay ? { relay } : {}),
+  };
+  return {
+    hostId,
+    hosts: existing
+      ? hosts.map((host) => host.id === hostId ? nextHost : host)
+      : [nextHost, ...hosts],
+  };
+};
+
 export type HostProbeResult = {
   status: 'ok' | 'auth' | 'update-recommended' | 'incompatible' | 'wrong-service' | 'unreachable';
   latencyMs: number;