fix(ocap-kernel): allow plain ws:// connections for relay dialing

[sirtimid]

Summary

• Import @libp2p/websockets/filters and use the all filter for the WebSocket transport
• The default libp2p WebSocket filter only permits wss:// (TLS) connections, which blocks relays on private networks or behind a reverse proxy that expose plain ws:// endpoints

Test plan

• Relay dialing over ws:// multiaddrs succeeds (previously rejected)
• wss:// relay connections continue to work

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes libp2p transport configuration to permit non-TLS ws:// connections, which can affect connectivity/security expectations when dialing relays. Scope is small but impacts network transport behavior across environments.

Overview
Updates the libp2p WebSocket transport configuration in connection-factory.ts to use @libp2p/websockets/filters.all, allowing relay dialing over plain ws:// multiaddrs in addition to wss://.

This removes the previous implicit restriction to secure WebSockets, improving compatibility with private-network/reverse-proxy relays that only expose ws:// endpoints.

^{Written by Cursor Bugbot for commit 73f8293. This will update automatically on new commits. Configure here.}

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	76.02% 🟰 ±0%	6567 / 8638
🔵	Statements	75.91% 🟰 ±0%	6672 / 8789
🔵	Functions	73.83% 🟰 ±0%	1642 / 2224
🔵	Branches	75.43% 🟰 ±0%	2426 / 3216

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
packages/ocap-kernel/src/remotes/platform/connection-factory.ts	97.27% 🟰 ±0%	90% 🟰 ±0%	96.29% 🟰 ±0%	97.22% 🟰 ±0%	262, 407, 441

Generated in workflow #3819 for commit 73f8293 by the Vitest Coverage Report Action

[rekmarks]

Approving, but we shouldn't be able to use ws:// outside of the use cases mentioned in the PR description. We can keep webSockets({ filter: wsFilters.all }) so the transport handles
ws://, but replace denyDialMultiaddr: async () => false with a function that:

• Allows any wss:// (secure)
• Allows ws:// to RFC 1918 / loopback addresses
• Allows ws:// to any hostname in a configurable allowedWsHosts list
• Denies everything else