fix(server): probe only owned preview listeners

[maria-rcks]

automatic browser discovery used to send http requests to unrelated listeners, which could close binary-protocol servers. discovery now probes only listeners owned by t3 terminals, and skips a port if any listener at that port is unowned. explicitly configured loopback urls keep their paths and query strings.

verified the baseline scanner with pid-scoped real listener metadata: the binary listener received GET / and exited 23. the candidate terminal → websocket → browser card path discovered a real vite server on 8311 and opened its pairing page, while the unrelated binary listener received zero bytes and stayed alive. closing the owned terminal stopped its 8311 listener and removed its automatic card. native windows, desktop shell, mobile and relay/tunnel paths remain unverified.

24 existing scanner tests, targeted lint, formatting and server typecheck passed on blacksmith.

implemented with gpt-6.1-sol in codex.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This changes the default preview-discovery behavior by removing common-port fallback probing and gating automatic HTTP/TLS probes on T3 terminal ownership. The production path spans multiple platform-specific listener-discovery fallbacks, so the behavioral change requires human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 91bd5e97-37a3-438f-98dc-942d4c61146a

---

📥 Commits

Reviewing files that changed from the base of the PR and between 83591ea and 61c2e62.

---

📒 Files selected for processing (2)

• apps/server/src/preview/PortScanner.test.ts
• apps/server/src/preview/PortScanner.ts

---

💤 Files with no reviewable changes (2)

• apps/server/src/preview/PortScanner.ts
• apps/server/src/preview/PortScanner.test.ts

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.

---

---

📝 Walkthrough

Walkthrough

PortScanner now limits automatic HTTP and HTTPS probes to listeners owned by registered terminal processes. Configured URLs remain eligible when listener discovery fails. Common-port probing was removed, and tests now use explicit URLs and registered process ownership.

Changes

Port scanning

Layer / File(s)	Summary
Listener ownership and probe eligibility apps/server/src/preview/PortScanner.ts, apps/server/src/preview/PortScanner.test.ts	Duplicate listener records clear terminal ownership when any record is unowned. Automatic HTTP and HTTPS probes skip listeners without terminal ownership. Tests register terminal processes and cover owned, unowned, and mixed-ownership listeners.
Configured URL scans and discovery fallback apps/server/src/preview/PortScanner.ts, apps/server/src/preview/PortScanner.test.ts	Common-port probing was removed. When listener discovery fails or returns no listeners, scans use configured URLs. Integration tests use real loopback listeners and explicit URLs.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

---

Merge Risk

Merge Risk: ⚪ Minimal · up to 61c2e

No actionable merge-blocking issue was found. Native Windows and relay paths remain unverified, but there is no evidence of a failure in those paths.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 83591

Automatic discovery becomes less intrusive by avoiding unrelated local services. Remaining uncertainty concerns concurrent terminal shutdown, incomplete listener visibility, and environments that have not been validated.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The affected sink is HTTP(S) probing of local endpoints. Automatic eligibility uses registrations from all known terminals; explicitly configured loopback targets remain eligible independently of terminal ownership.

Security Findings and Attack Paths

• inferred — Stale PID registrations or incomplete listener visibility can weaken the ownership guarantee and permit requests to an unrelated local listener. These are residual limitations, not established PR-introduced attack paths: terminal inspection ordering and partial /proc acceptance predate the PR, and the base automatically probed discovered listeners without ownership authorization.

Trust Boundaries and Controls

• observed — The new gate rejects unknown ownership and observed mixed ownership before automatic probing. Listener commands no longer request truncated output, and output-limit errors enter recovery rather than authorizing probes from a truncated command result. This does not establish complete visibility: /proc discovery still accepts one readable TCP table when the other cannot be read.

Hardening Proposals

• proposed — As follow-up hardening, bind registrations to a live terminal generation, reject late inspection results after cleanup, revalidate ownership before dispatch and publication, and distinguish incomplete listener inventories from complete discovery.

---

---

---

Pre-merge checks | 3 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check		The description explains the problem, implementation, verification evidence, screenshots, test results, and unverified platforms. It does not provide the required Scope and approval information or exp…	Add a link to the triaged issue or maintainer approval discussion with the approval comment. If this fix qualifies as an obvious bug exemption, state that reason explicitly and explain why no prior approval was required.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: restricting preview probing to owned listeners.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

Full details: Description check

Explanation

The description explains the problem, implementation, verification evidence, screenshots, test results, and unverified platforms. It does not provide the required Scope and approval information or explain why the focused fix qualifies for an exemption.

---

---

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

---

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}