fix: auto-prepend http:// to bare remote server URLs

PolyPilot.Tests/ConnectionSettingsTests.cs

@@ -208,6 +208,62 @@ public void CliSourceMode_Enum_HasExpectedValues()
         Assert.Equal(1, (int)CliSourceMode.System);
     }
 
+    [Theory]
+    [InlineData(null, null)]
+    [InlineData("", "")]
+    [InlineData("  ", "  ")]
+    public void NormalizeRemoteUrl_NullOrEmpty_ReturnsAsIs(string? input, string? expected)
+    {
+        Assert.Equal(expected, ConnectionSettings.NormalizeRemoteUrl(input));
+    }
+
+    [Theory]
+    [InlineData("http://192.168.1.5:4322", "http://192.168.1.5:4322")]
+    [InlineData("https://my-tunnel.devtunnels.ms", "https://my-tunnel.devtunnels.ms")]
+    [InlineData("ws://localhost:4322", "ws://localhost:4322")]
+    [InlineData("wss://tunnel.example.com", "wss://tunnel.example.com")]
+    [InlineData("HTTP://MYHOST:5000", "HTTP://MYHOST:5000")]
+    public void NormalizeRemoteUrl_WithScheme_PassesThrough(string input, string expected)
+    {
+        Assert.Equal(expected, ConnectionSettings.NormalizeRemoteUrl(input));
+    }
+
+    [Theory]
+    [InlineData("192.168.1.5:4322", "http://192.168.1.5:4322")]
+    [InlineData("localhost:4322", "http://localhost:4322")]
+    [InlineData("10.0.0.1", "http://10.0.0.1")]
+    [InlineData("myserver.local:8080", "http://myserver.local:8080")]
+    public void NormalizeRemoteUrl_BareAddress_PrependsHttp(string input, string expected)
+    {
+        Assert.Equal(expected, ConnectionSettings.NormalizeRemoteUrl(input));
+    }
+
+    [Theory]
+    [InlineData("xxx.devtunnels.ms", "https://xxx.devtunnels.ms")]
+    [InlineData("abc123.ngrok.io", "https://abc123.ngrok.io")]
+    [InlineData("tunnel.ngrok-free.app", "https://tunnel.ngrok-free.app")]
+    [InlineData("my.cloudflare.com", "https://my.cloudflare.com")]
+    public void NormalizeRemoteUrl_KnownTlsHost_PrependsHttps(string input, string expected)
+    {
+        Assert.Equal(expected, ConnectionSettings.NormalizeRemoteUrl(input));
+    }
+
+    [Theory]
+    [InlineData("http://192.168.1.5:4322/", "http://192.168.1.5:4322")]
+    [InlineData("  192.168.1.5:4322  ", "http://192.168.1.5:4322")]
+    [InlineData("https://tunnel.devtunnels.ms/", "https://tunnel.devtunnels.ms")]
+    public void NormalizeRemoteUrl_TrimsWhitespaceAndSlash(string input, string expected)
+    {
+        Assert.Equal(expected, ConnectionSettings.NormalizeRemoteUrl(input));
+    }
+
+    [Fact]
+    public void NormalizeRemoteUrl_DoesNotDoubleScheme()
+    {
+        var result = ConnectionSettings.NormalizeRemoteUrl("http://http://example.com");
+        Assert.Equal("http://http://example.com", result);
+    }
+
     private void Dispose()
     {
         try { Directory.Delete(_testDir, true); } catch { }

PolyPilot/Components/Pages/Dashboard.razor

@@ -591,7 +591,7 @@
         {
             var connSettings = ConnectionSettings.Load();
             connSettings.Mode = ConnectionMode.Remote;
-            connSettings.RemoteUrl = mobileRemoteUrl;
+            connSettings.RemoteUrl = ConnectionSettings.NormalizeRemoteUrl(mobileRemoteUrl) ?? mobileRemoteUrl;
             connSettings.RemoteToken = mobileRemoteToken;
             connSettings.Save();
             await CopilotService.ReconnectAsync(connSettings);

PolyPilot/Components/Pages/Settings.razor

@@ -1087,6 +1087,10 @@
             return;
         }
 
+        // Normalize URL before saving (adds http:// if no scheme)
+        if (settings.Mode == ConnectionMode.Remote)
+            settings.RemoteUrl = ConnectionSettings.NormalizeRemoteUrl(settings.RemoteUrl);
+
         settings.Save();
         ShowStatus("Settings saved. Reconnecting...", "", 0);
 

PolyPilot/Models/ConnectionSettings.cs

@@ -60,6 +60,35 @@ public class ConnectionSettings
     public List<string> DisabledPlugins { get; set; } = new();
     public bool EnableSessionNotifications { get; set; } = false;
 
+    /// <summary>
+    /// Normalizes a remote URL by ensuring it has an http(s):// scheme.
+    /// Plain IPs/hostnames get http://, devtunnels/known TLS hosts get https://.
+    /// Already-schemed URLs pass through unchanged. Returns null for null/empty input.
+    /// </summary>
+    public static string? NormalizeRemoteUrl(string? url)
+    {
+        if (string.IsNullOrWhiteSpace(url))
+            return url;
+
+        var trimmed = url.Trim().TrimEnd('/');
+
+        // Already has a recognized scheme — return as-is
+        if (trimmed.StartsWith("http://", StringComparison.OrdinalIgnoreCase)
+            || trimmed.StartsWith("https://", StringComparison.OrdinalIgnoreCase)
+            || trimmed.StartsWith("ws://", StringComparison.OrdinalIgnoreCase)
+            || trimmed.StartsWith("wss://", StringComparison.OrdinalIgnoreCase))
+            return trimmed;
+
+        // Heuristic: devtunnels and well-known cloud hosts use TLS
+        if (trimmed.Contains(".devtunnels.ms", StringComparison.OrdinalIgnoreCase)
+            || trimmed.Contains(".ngrok", StringComparison.OrdinalIgnoreCase)
+            || trimmed.Contains(".cloudflare", StringComparison.OrdinalIgnoreCase))
+            return "https://" + trimmed;
+
+        // Everything else (bare IP, localhost, LAN hostname) → http
+        return "http://" + trimmed;
+    }
+
     [JsonIgnore]
     public string CliUrl => Mode == ConnectionMode.Remote && !string.IsNullOrEmpty(RemoteUrl)
         ? RemoteUrl

PolyPilot/Services/CopilotService.Bridge.cs

@@ -12,16 +12,15 @@ public partial class CopilotService
     /// </summary>
     private async Task InitializeRemoteAsync(ConnectionSettings settings, CancellationToken ct)
     {
-        var wsUrl = settings.RemoteUrl!.TrimEnd('/');
+        var normalized = ConnectionSettings.NormalizeRemoteUrl(settings.RemoteUrl) ?? settings.RemoteUrl!;
+        var wsUrl = normalized.TrimEnd('/');
         if (wsUrl.StartsWith("https://", StringComparison.OrdinalIgnoreCase))
             wsUrl = "wss://" + wsUrl[8..];
         else if (wsUrl.StartsWith("http://", StringComparison.OrdinalIgnoreCase))
             wsUrl = "ws://" + wsUrl[7..];
         else if (wsUrl.StartsWith("wss://", StringComparison.OrdinalIgnoreCase)
               || wsUrl.StartsWith("ws://", StringComparison.OrdinalIgnoreCase))
             { /* already a WebSocket URL */ }
-        else
-            wsUrl = "wss://" + wsUrl;
 
         Debug($"Remote mode: connecting to {wsUrl}");