ELI5

Pasting an HTTPS tunnel URL into server sharing disables link creation today. Editing a paired phone from a LAN address to a secure tunnel also keeps the LAN port. This fixes both so the existing custom-address flow can use a user-managed Cloudflare Tunnel.

What Changed

The sharing validator accepts HTTPS through the existing URL normalizer. A full WSS address without an explicit port uses 443 in mobile editing; explicit ports and saved proxy paths/queries remain intact. Setup docs explain the actual local listener port, stable versus temporary tunnels, and browser versus mobile pairing scope.

Why

Fix the remaining address failures in the existing transport without adding another parser, provider UI, dependency, or wire format.

Linked Issue

Partial implementation of #14039 and #12535. This does not add the dedicated Cloudflare option or resolve every discovery request, so neither issue is marked fixed.

Related work: #14040 by Pierre-Mike and #8999 by LosEcher; complete URL/proxy support already shipped in #9912 and #11383. This small patch was implemented on current main and does not replace or close those contributors' PRs. Mobile Access credentials from #25077 are a separate follow-up.

Visual Proof

Real mobile-web Edit host route, captured in headless Chromium through Playwright CDP with a synthetic paired host. Same input before and after; no real credentials. This is browser evidence, not a native-device claim.

Before: inherits LAN port	After: uses secure default

Testing

• Manually exercised the changes locally with a disposable runtime and real Cloudflare Quick Tunnel: pairing, repository/worktree RPC, terminal output and host CLI passed on a nondefault local origin port. That smoke was performed before this conflict-free rebase; address implementation is unchanged.
• Regression tests observed failing before the fix, then passing.
• On this head: 81 focused shared/runtime/form/generator tests passed; complete mobile suite 11,034 passed, 6 skipped on the repository-pinned Node 24.21.0.
• Root typechecks and changed-code quality gate passed; desktop/web/mobile-web and Orcad builds passed during implementation. Browser before/after checks have no uncaught page errors.
• A current rebuilt disposable server plus the production mobile client (with a Node WebSocket adapter) also passed pinned-identity E2EE/status RPC, named connector restart/redial, runtime restart with the same pairing, and rejection of a revoked Orca pairing through a real named Cloudflare Tunnel. The provided hostname still admits unauthenticated WebSockets, so Cloudflare Access enforcement is explicitly unverified.
• Native iOS/Android and Windows/Linux execution remain unverified. The Electron validation skill was unavailable, so no rendered Electron check is claimed. The exact-head PR workflow and other fork workflows report action_required with zero jobs; maintainer approval is needed before CI can run.

AI Disclosure

Implemented with Codex (GPT-6) assistance. No human maintainer approval is claimed.

Review

Checked connected validators, generation and mobile save/reconnect callers. HTTPS is validated before normalization; HTTP, credentials, fragments and invalid hosts/ports stay rejected. Pairing grants, identity checks, E2EE, listener exposure, old-peer compatibility and bare-address editing are retained. No new process/platform path or provider/agent integration is introduced; SSH/headless hosts retain the same advertised-address contract. Work is bounded input normalization, with no background service. Browser layout is unchanged; the mobile hint describes the port behavior.

Author

X/Twitter handle: not provided.

Agent skill upstream boundary

• Not applicable; no upstream skill-installer source or resources copied.

Notes

Draft while remaining validation and contributor coordination are completed. The authenticated tunnel follow-up stays separate. No merge requested and no required check bypassed.

Checklist

• Small, focused change; behavior, mechanism and alternatives explained
• Safe before/after evidence attached
• Self-reviewed correctness, security and performance
• Cross-platform, SSH/remote and compatibility impact considered
• Full required CI and remaining native/restart/revocation validation complete