* fix(runtime): keep the listener on loopback for a "This computer only" pairing link
The runtime pairing URL handler called ensureNetworkExposure() for every
offer, including one whose advertised address is loopback. Settings ->
"Share this Orca server" offers a "This computer only" radio that pairs
against 127.0.0.1 precisely so nothing is reachable off-host, yet choosing
it rebound the WebSocket listener from 127.0.0.1 to 0.0.0.0 — and the widen
never narrows back, so the runtime stayed exposed to the whole LAN for the
rest of the process after the user picked the option that exists to avoid
exactly that.
Gate the widen on the advertised address: only a non-loopback endpoint (LAN,
Tailscale, custom host) needs a listener reachable off this machine, so those
paths keep widening exactly as STA-2370 intended. A loopback link is already
served by the loopback listener, so it now mints without touching the bind.
Classification reuses the shared pairing-address classifier, which also covers
localhost, ::1 and 127.0.0.0/8 typed into the custom-address field.
Tests: a real OrcaRuntimeRpcServer driven through the IPC handler asserts the
bind host stays 127.0.0.1 after a local link and flips to 0.0.0.0 after a
LAN one, plus handler-level cases for 127.0.0.1 / localhost / ::1.
* fix(runtime): gate the pairing widen on the user's declared reach, not the address shape
Review of #12405 found two ways the loopback fix misbehaved.
1. The guarantee died at the next launch. resolveInitialWebSocketBindHost()
binds 0.0.0.0 whenever any device has lastSeenAt > 0, and MobileSocketWiring
stamps that for EVERY authenticated socket — including the local browser
opening a "This computer only" link. So the runtime was still published on
every interface, one restart later. Grants now carry the reach they were
minted for (DeviceEntry.pairingReach, persisted); a this-computer grant no
longer counts as proof that an off-host client may reconnect. Registries
written before the field default to network reach, so an already-paired
phone still finds a wide listener after upgrading. A pending grant that is
re-advertised for the network widens (never narrows) so its link survives.
2. The widen was gated on the shape of the typed address, which the renderer
never sent the intent for. A Custom `127.0.0.1:8443` — the documented SSH
tunnel / reverse proxy field — skipped the widen and produced a dead link,
while `localhost:8443`, `[::1]:6768` and `ws://127.0.0.1:6768` widened, so
the same loopback intent was handled three different ways. The renderer now
sends the declared reach ('this-computer' | 'network') and main gates on it;
the address is only used as a mismatch guard (a this-computer reach carrying
an off-host address still widens rather than minting an unreachable link),
resolved through resolveAdvertisedPairingHostname so every accepted address
form classifies identically.
Also corrected the ensureNetworkExposure invariant comment: the widen is no
longer confined to the first pairing action, so it can now tear down live
loopback sockets — they reconnect on the reused pinned port.
Tests: reach-form matrix + tunnel/undeclared/mismatch cases in mobile.test.ts,
real-server relaunch bind for both reaches, legacy registry compatibility, the
pending-grant reach upgrade, a live-client port-stability guard, hostname
resolver coverage, and the renderer reach plumbing. Reverting only the source
fails 18 of them.
---------
Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>
