refactor(settings): remove Orbit hosted mode and deployment flag

Author: Dimillian

docs/mobile-ios-cloudflare-blueprint.md

@@ -33,7 +33,7 @@ This document is the canonical implementation plan for shipping CodexMonitor on
 - Remote provider settings baseline is implemented:
   - `remoteBackendProvider`: `"tcp" | "orbit"`
   - `remoteBackendHost`, `remoteBackendToken`
-  - `orbitDeploymentMode`, `orbitWsUrl`, `orbitAuthUrl`
+  - `orbitWsUrl`, `orbitAuthUrl`
   - `orbitRunnerName`, `orbitAutoStartRunner`
   - `orbitUseAccess`, `orbitAccessClientId`, `orbitAccessClientSecretRef`
 - Orbit remote operations are implemented in app and daemon wiring via shared core:
@@ -45,7 +45,7 @@ This document is the canonical implementation plan for shipping CodexMonitor on
   - `orbit_runner_stop`
   - `orbit_runner_status`
 - Settings UI now includes Orbit provider setup/actions in `SettingsView`:
-  - deployment mode, URLs, runner name, access fields, connect/sign-in/sign-out, runner start/stop/status
+  - URLs, runner name, access fields, connect/sign-in/sign-out, runner start/stop/status
   - inline device-code polling flow wired to `orbit_sign_in_poll`
 - Remote notification forwarding currently handles only:
   - `app-server-event`
@@ -73,7 +73,7 @@ This document is the canonical implementation plan for shipping CodexMonitor on
 3. Orbit Cloud Services
 - Auth service (passkey + JWT/session).
 - Orbit relay (Worker + Durable Object routing + event persistence endpoint).
-- Optional hosted deployment path or self-host deployment path.
+- User-owned self-host deployment path only.
 
 ## Canonical Protocol Choice
 
@@ -92,19 +92,9 @@ This document is the canonical implementation plan for shipping CodexMonitor on
 7. Orbit relays results and notifications back to subscribed iOS clients.
 8. On reconnect, iOS reloads state from thread resume + stored events endpoint.
 
-## Orbit Deployment Modes
+## Orbit Deployment Model
 
-## Mode A (Recommended): Hosted Orbit
-
-Best setup UX for most users.
-
-- User does not deploy Cloudflare services manually.
-- User authenticates in app, pairs device, and connects.
-- CodexMonitor stores only required client credentials/tokens in secure storage.
-
-## Mode B: Self-Hosted Orbit
-
-Advanced setup for users who want full control.
+## Self-Hosted Orbit Only
 
 - User deploys Orbit/Auth workers and D1 with Wrangler.
 - User provides Orbit/Auth endpoints in Settings.
@@ -147,7 +137,6 @@ Implemented baseline fields:
 - `remoteBackendProvider`: `"tcp" | "orbit"`
 - `remoteBackendHost`
 - `remoteBackendToken`
-- `orbitDeploymentMode`
 - `orbitWsUrl`
 - `orbitAuthUrl`
 - `orbitRunnerName`
@@ -158,7 +147,7 @@ Implemented baseline fields:
 
 Planned next (not yet implemented in settings model):
 
-- deployment/auth/pairing metadata required for full hosted/self-host Orbit UX
+- deployment/auth/pairing metadata required for full self-host Orbit UX
 - secure-storage integration for secret material lifecycle (set/reset/rotation)
 
 Keep secrets out of plain `settings.json` where possible.
@@ -260,11 +249,10 @@ Update `src/features/settings/components/SettingsView.tsx` to add an Orbit secti
 Required controls:
 
 - Provider selector (`TCP daemon` / `Orbit`)
-- Deployment mode selector (`Hosted` / `Self-Hosted`)
-- Orbit WS URL input (self-host only)
-- Orbit Auth URL input (self-host only)
+- Orbit WS URL input
+- Orbit Auth URL input
 - Runner name input
-- Access auth toggle + client id input + secret set/reset (self-host optional)
+- Access auth toggle + client id input + secret set/reset (optional)
 - `Connect test` button
 - `Sign In` / `Sign Out` actions
 - `Start Runner` / `Stop Runner` buttons
@@ -276,7 +264,7 @@ Required controls:
 Current implementation status:
 
 - Implemented now:
-  - Provider selector, deployment mode selector
+  - Provider selector
   - Orbit WS/Auth URL inputs
   - Runner name input
   - Access toggle + client id/secret ref fields
@@ -290,7 +278,6 @@ Current implementation status:
 
 UX behavior:
 
-- Hide manual endpoint fields in hosted mode.
 - Disable invalid combinations.
 - Show clear actionable errors (auth failed, runner offline, endpoint invalid, token expired).
 - Persist non-secret fields immediately.
@@ -299,7 +286,7 @@ UX behavior:
 ## iOS client UX
 
 - First launch setup:
-  - `Sign In` (hosted) or endpoint-aware sign-in (self-host)
+  - endpoint-aware sign-in (self-host)
   - `Scan QR` / `Enter pair code`
   - Recent sessions
 - Runtime status:
@@ -312,35 +299,13 @@ UX behavior:
 
 ## User Setup Flows
 
-## Hosted Orbit (default)
-
-Desktop setup:
-
-1. Open CodexMonitor Settings.
-2. Set `Backend Mode = Remote`, `Provider = Orbit`, `Mode = Hosted`.
-3. Click `Sign In` and complete auth.
-4. Click `Start Runner`.
-5. Click `Show QR` (or `Copy Pair Code`).
-
-Mobile setup:
-
-1. Launch iOS app.
-2. Sign in.
-3. Scan QR (or enter pair code).
-4. App stores credentials in Keychain and auto-connects.
-
-User-provided information:
-
-- No manual URL/session entry required.
-- Only account login + pair action.
-
 ## Self-Hosted Orbit
 
 Desktop setup:
 
 1. Deploy Orbit/Auth services to Cloudflare.
 2. Open CodexMonitor Settings.
-3. Set `Backend Mode = Remote`, `Provider = Orbit`, `Mode = Self-Hosted`.
+3. Set `Backend Mode = Remote`, `Provider = Orbit`.
 4. Enter `Orbit WS URL` and `Orbit Auth URL`.
 5. Configure optional Access credentials.
 6. Sign in and start runner.
@@ -511,7 +476,7 @@ cargo test
 ## Implementation Milestones
 
 1. Milestone A: iOS compile baseline + mobile-safe stubs.
-2. Milestone B: Orbit integration baseline (hosted + self-host config paths).
+2. Milestone B: Orbit integration baseline (self-host config path).
 3. Milestone C: `remote_backend` transport refactor + Orbit WS transport + runner Orbit mode.
 4. Milestone D: daemon parity closure for mobile scope (excluding terminal/dictation).
 5. Milestone E: Settings UX/service manager + pairing UX.
@@ -521,7 +486,7 @@ cargo test
 
 - iOS app can fully control a macOS runner via Orbit bridge.
 - Remote feature parity with desktop local mode for supported workflows.
-- macOS users can configure Orbit from Settings without terminal steps in hosted mode.
+- macOS users can configure Orbit from Settings using self-hosted Orbit endpoints.
 - Runner can be started/stopped/auto-started from app.
 - Reconnect/resync is robust and observable.
 - Build/install flow is documented and reproducible.

memory/decisions.md

@@ -260,3 +260,10 @@ Type: decision
 Event: Split `SettingsView` into section-focused components plus a dedicated sidebar nav while keeping orchestration/state in the container.
 Action: Added `SettingsNav`, extracted section components under `src/features/settings/components/sections/*`, introduced shared settings types in `settingsTypes.ts`, and rewired `SettingsView.tsx` to modal shell + section routing.
 Rule: For large settings surfaces, keep `SettingsView` as layout/orchestration and move section UI into dedicated components with typed props.
+
+## 2026-02-07 20:23
+Context: Orbit product scope canonicalization
+Type: decision
+Event: Product direction is now self-hosted Orbit only; app should not present hosted Orbit mode or imply CodexMonitor-hosted relay/auth services.
+Action: Removed `orbitDeploymentMode` from frontend/backend settings models and defaults, removed deployment mode selector from Settings UI, and updated mobile Orbit blueprint/setup language to self-host-only.
+Rule: Keep Orbit setup/docs/UI self-host-only unless user explicitly requests reintroducing hosted mode.

memory/todo.md

@@ -1,7 +1,7 @@
 # TODO
 
 ## Open
-- [ ] 2026-02-07: Implement Orbit-only mobile remote foundation: Orbit transport in `remote_backend`, runner Orbit mode, hosted/self-host settings + pairing UX, and iOS keychain-backed auth storage.
+- [ ] 2026-02-07: Implement Orbit-only mobile remote foundation: Orbit transport in `remote_backend`, runner Orbit mode, self-host settings + pairing UX, and iOS keychain-backed auth storage.
 - [ ] 2026-02-07: Harden Orbit WS transport with explicit reconnect/backoff + replay/resync handling for mobile reconnect flows.
 - [ ] 2026-02-07: Complete Orbit production readiness gaps after baseline wiring: secure secret storage (Keychain/keyring), LaunchAgent/background runner management, pairing QR/code UX, and app-side Orbit reconnect/resync handling.
 

src-tauri/src/settings/mod.rs

@@ -41,8 +41,13 @@ pub(crate) async fn get_codex_config_path() -> Result<String, String> {
 fn should_reset_remote_backend(previous: &AppSettings, updated: &AppSettings) -> bool {
     let backend_mode_changed = !matches!(
         (&previous.backend_mode, &updated.backend_mode),
-        (crate::types::BackendMode::Local, crate::types::BackendMode::Local)
-            | (crate::types::BackendMode::Remote, crate::types::BackendMode::Remote)
+        (
+            crate::types::BackendMode::Local,
+            crate::types::BackendMode::Local
+        ) | (
+            crate::types::BackendMode::Remote,
+            crate::types::BackendMode::Remote
+        )
     );
     backend_mode_changed
         || previous.remote_backend_provider != updated.remote_backend_provider

src-tauri/src/types.rs

@@ -400,8 +400,6 @@ pub(crate) struct AppSettings {
     pub(crate) remote_backend_host: String,
     #[serde(default, rename = "remoteBackendToken")]
     pub(crate) remote_backend_token: Option<String>,
-    #[serde(default, rename = "orbitDeploymentMode")]
-    pub(crate) orbit_deployment_mode: OrbitDeploymentMode,
     #[serde(default, rename = "orbitWsUrl")]
     pub(crate) orbit_ws_url: Option<String>,
     #[serde(default, rename = "orbitAuthUrl")]
@@ -654,19 +652,6 @@ impl Default for RemoteBackendProvider {
     }
 }
 
-#[derive(Debug, Serialize, Deserialize, Clone, PartialEq, Eq)]
-#[serde(rename_all = "snake_case")]
-pub(crate) enum OrbitDeploymentMode {
-    Hosted,
-    SelfHosted,
-}
-
-impl Default for OrbitDeploymentMode {
-    fn default() -> Self {
-        OrbitDeploymentMode::Hosted
-    }
-}
-
 fn default_access_mode() -> String {
     "current".to_string()
 }
@@ -1072,7 +1057,6 @@ impl Default for AppSettings {
             remote_backend_provider: RemoteBackendProvider::Tcp,
             remote_backend_host: default_remote_backend_host(),
             remote_backend_token: None,
-            orbit_deployment_mode: OrbitDeploymentMode::Hosted,
             orbit_ws_url: None,
             orbit_auth_url: None,
             orbit_runner_name: None,
@@ -1142,8 +1126,8 @@ impl Default for AppSettings {
 #[cfg(test)]
 mod tests {
     use super::{
-        AppSettings, BackendMode, OrbitDeploymentMode, RemoteBackendProvider, WorkspaceEntry,
-        WorkspaceGroup, WorkspaceKind, WorkspaceSettings,
+        AppSettings, BackendMode, RemoteBackendProvider, WorkspaceEntry, WorkspaceGroup,
+        WorkspaceKind, WorkspaceSettings,
     };
 
     #[test]
@@ -1157,10 +1141,6 @@ mod tests {
         ));
         assert_eq!(settings.remote_backend_host, "127.0.0.1:4732");
         assert!(settings.remote_backend_token.is_none());
-        assert!(matches!(
-            settings.orbit_deployment_mode,
-            OrbitDeploymentMode::Hosted
-        ));
         assert!(settings.orbit_ws_url.is_none());
         assert!(settings.orbit_auth_url.is_none());
         assert!(settings.orbit_runner_name.is_none());

src/features/settings/components/SettingsView.test.tsx

@@ -25,7 +25,6 @@ const baseSettings: AppSettings = {
   remoteBackendProvider: "tcp",
   remoteBackendHost: "127.0.0.1:4732",
   remoteBackendToken: null,
-  orbitDeploymentMode: "hosted",
   orbitWsUrl: null,
   orbitAuthUrl: null,
   orbitRunnerName: null,
@@ -679,7 +678,6 @@ describe("SettingsView Codex overrides", () => {
     );
 
     await waitFor(() => {
-      expect(screen.getByLabelText("Orbit deployment mode")).toBeTruthy();
       expect(screen.getByLabelText("Orbit websocket URL")).toBeTruthy();
       expect(screen.getByLabelText("Orbit auth URL")).toBeTruthy();
       expect(screen.getByLabelText("Orbit runner name")).toBeTruthy();

src/features/settings/components/SettingsView.tsx

@@ -831,18 +831,6 @@ export function SettingsView({
     });
   };
 
-  const handleChangeOrbitDeploymentMode = async (
-    deploymentMode: AppSettings["orbitDeploymentMode"],
-  ) => {
-    if (deploymentMode === appSettings.orbitDeploymentMode) {
-      return;
-    }
-    await onUpdateAppSettings({
-      ...appSettings,
-      orbitDeploymentMode: deploymentMode,
-    });
-  };
-
   const handleCommitOrbitWsUrl = async () => {
     const nextValue = normalizeOverrideValue(orbitWsUrlDraft);
     setOrbitWsUrlDraft(nextValue ?? "");
@@ -1644,7 +1632,6 @@ export function SettingsView({
               onCommitRemoteHost={handleCommitRemoteHost}
               onCommitRemoteToken={handleCommitRemoteToken}
               onChangeRemoteProvider={handleChangeRemoteProvider}
-              onChangeOrbitDeploymentMode={handleChangeOrbitDeploymentMode}
               onCommitOrbitWsUrl={handleCommitOrbitWsUrl}
               onCommitOrbitAuthUrl={handleCommitOrbitAuthUrl}
               onCommitOrbitRunnerName={handleCommitOrbitRunnerName}

src/features/settings/components/sections/SettingsCodexSection.tsx

@@ -63,9 +63,6 @@ type SettingsCodexSectionProps = {
   onCommitRemoteHost: () => Promise<void>;
   onCommitRemoteToken: () => Promise<void>;
   onChangeRemoteProvider: (provider: AppSettings["remoteBackendProvider"]) => Promise<void>;
-  onChangeOrbitDeploymentMode: (
-    deploymentMode: AppSettings["orbitDeploymentMode"],
-  ) => Promise<void>;
   onCommitOrbitWsUrl: () => Promise<void>;
   onCommitOrbitAuthUrl: () => Promise<void>;
   onCommitOrbitRunnerName: () => Promise<void>;
@@ -150,7 +147,6 @@ export function SettingsCodexSection({
   onCommitRemoteHost,
   onCommitRemoteToken,
   onChangeRemoteProvider,
-  onChangeOrbitDeploymentMode,
   onCommitOrbitWsUrl,
   onCommitOrbitAuthUrl,
   onCommitOrbitRunnerName,
@@ -366,7 +362,7 @@ export function SettingsCodexSection({
               <option value="orbit">Orbit</option>
             </select>
             <div className="settings-help">
-              Use TCP for host:port daemon access, or Orbit for managed/authenticated remote
+              Use TCP for host:port daemon access, or Orbit for self-hosted Cloudflare relay
               sessions.
             </div>
           </div>
@@ -417,26 +413,6 @@ export function SettingsCodexSection({
 
           {appSettings.remoteBackendProvider === "orbit" && (
             <>
-              <div className="settings-field">
-                <label className="settings-field-label" htmlFor="orbit-deployment-mode">
-                  Orbit deployment mode
-                </label>
-                <select
-                  id="orbit-deployment-mode"
-                  className="settings-select"
-                  value={appSettings.orbitDeploymentMode}
-                  onChange={(event) => {
-                    void onChangeOrbitDeploymentMode(
-                      event.target.value as AppSettings["orbitDeploymentMode"],
-                    );
-                  }}
-                  aria-label="Orbit deployment mode"
-                >
-                  <option value="hosted">Hosted</option>
-                  <option value="self_hosted">Self-hosted</option>
-                </select>
-              </div>
-
               <div className="settings-field">
                 <label className="settings-field-label" htmlFor="orbit-ws-url">
                   Orbit websocket URL

src/features/settings/hooks/useAppSettings.ts

@@ -29,7 +29,6 @@ function buildDefaultSettings(): AppSettings {
     remoteBackendProvider: "tcp",
     remoteBackendHost: "127.0.0.1:4732",
     remoteBackendToken: null,
-    orbitDeploymentMode: "hosted",
     orbitWsUrl: null,
     orbitAuthUrl: null,
     orbitRunnerName: null,

src/types.ts

@@ -116,7 +116,6 @@ export type ReviewTarget =
 export type AccessMode = "read-only" | "current" | "full-access";
 export type BackendMode = "local" | "remote";
 export type RemoteBackendProvider = "tcp" | "orbit";
-export type OrbitDeploymentMode = "hosted" | "self_hosted";
 export type ThemePreference = "system" | "light" | "dark" | "dim";
 export type PersonalityPreference = "friendly" | "pragmatic";
 
@@ -150,7 +149,6 @@ export type AppSettings = {
   remoteBackendProvider: RemoteBackendProvider;
   remoteBackendHost: string;
   remoteBackendToken: string | null;
-  orbitDeploymentMode: OrbitDeploymentMode;
   orbitWsUrl: string | null;
   orbitAuthUrl: string | null;
   orbitRunnerName: string | null;