[FEATURE]: WireGuard mesh pairing for remote devices (beyond localhost) #59393

Feature hasn't been suggested before.

• I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

Summary

Extend OpenCode v2 pairing beyond localhost-only tunnels with a WireGuard mesh. opencode pair should print a QR code in the terminal; scanning it from a phone, tablet, or another machine joins that device to the mesh so sessions work across networks.

Problem

Pairing/tunnels currently only work on the same machine (localhost). That blocks:

• Phone as a remote control / monitor for a dev session
• Laptop ↔ desktop across different networks
• Collaboration when devices are not on the same LAN

Proposed solution

Add a WireGuard mesh under the existing session/sync protocol. Upper layers keep talking over a private mesh IP instead of localhost.

Flow

1. opencode pair generates a host WireGuard identity (keypair + peer config: endpoint, pubkey, allowed IPs, PSK).
2. Encode it as a pairing URI (e.g. wg://… or a compact signed payload).
3. Render a QR code in the terminal (ASCII/Unicode) plus a pasteable join command.
4. The other device scans / imports:
   • Mobile: deep-link into WireGuard (or an OpenCode companion) and connect
   • Desktop/CLI: opencode join <uri> or import into wg-quick / userspace WG
   • Browser: v1 fallback (relay / WebRTC data channel) if native WG isn’t available
5. Peer gets a mesh IP (e.g. 10.88.0.2). OpenCode session/sync runs over the tunnel.

Example UX

$ opencode pair
Generating mesh identity...
Scan this QR with your device:

█▀▀▀▀▀█ ▀▄█▀▄ █▀▀▀▀▀█
█ ███ █ ▀█ ▄▀ █ ███ █
█ ▀▀▀ █ █▄▀ ▀ █ ▀▀▀ █
▀▀▀▀▀▀▀ █▄▀ █ ▀▀▀▀▀▀▀

Or: opencode join wg://eyJwdWJrZXkiOi...
Waiting for peer... (expires in 5:00)
✔ Device "iPhone-14" joined (10.88.0.2)

Requirements

• Terminal QR (no image file)
• Ephemeral keys per pairing; optional persist for a trusted-device list
• Single-use QR, short TTL (e.g. 5 min)
• NAT traversal: STUN + lightweight relay (DERP-style) when holepunching fails
• Device list + revoke (opencode devices list / revoke <id>)
• Signed pairing payload; don’t log private keys
• Fallback when kernel WG isn’t available (userspace WG, or documented relay path)

Clients

Open questions

1. Own relay vs. existing DERP-like service for NAT?
2. Official WireGuard app deep-link vs. a first-party mobile app for v1?
3. Does “browser pairing” need to be a full mesh peer, or just a secure tunnel to the host?
4. Does joining the mesh imply trust, or is there a second auth step after connect?