fix(server): do not HTTP-probe unknown local listeners

[iamshadmantaqi]

What Changed

PortDiscovery still HTTP-probes listeners so Preview can hide MySQL and Redis. It no longer GETs every local TCP socket.

A discovered listener is probed only when it is a curated dev port, a registered T3 terminal PID, or a configured Preview URL.

Why

#6021 added HTML probes to classify servers. The classification is correct, but the probe itself writes HTTP onto unrelated binary listeners. #8407 reproduces that against thinkorswim's JxBrowser RPC socket: lsof finds a random high port, T3 sends GET / over HTTP then HTTPS, and the other app crashes during login.

Configured Preview URLs and ordinary Vite/webpack ports still get probed.

Closes #8407

Blast Radius

Preview port discovery on macOS and Linux lsof, and the Windows listener scan. Non-HTTP services on curated ports are still probed, then excluded, same as today. Random system listeners are left untouched.

Verification

Failing-then-passing regression in apps/server/src/preview/PortScanner.test.ts.

• Before the fix, a listener on port 63261 was returned after an HTTP GET.
• After the fix, that file is 21/21 passing. The same listener is probed when its PID is registered as a T3 terminal.
• vp lint on the two changed files: 0 errors.
• vp run --filter t3 typecheck: no errors in the changed file.

No UI chrome changed, so no screenshots.

Checklist

• This PR is small and focused
• I explained what changed and why
• No UI change (screenshots not applicable)
• No motion change (video not applicable)

---

Note

Medium Risk
Changes preview port-scan behavior on macOS/Linux and Windows fallback paths; misclassification could hide a dev server on a non-curated port, but configured URLs and terminal PIDs still get probed.

Overview
Preview port discovery no longer sends HTTP(S) GET probes to every TCP listener lsof finds on macOS/Linux. Discovered sockets are probed only when they sit on a curated dev port (e.g. Vite/webpack) or belong to a registered T3 terminal PID; configured Preview URLs are still probed as before.

This avoids writing HTTP onto unrelated binary/RPC listeners (e.g. random high ports from other apps) while keeping normal dev-server and terminal-owned port discovery. Tests cover a high port with no probe until registerTerminalProcesses maps the PID.

^{Reviewed by Cursor Bugbot for commit abaad2b. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Skip HTTP probing for unknown local listeners in PortDiscovery.scan

Discovered listeners are now only HTTP-probed when on a curated dev port, owned by a registered T3 terminal, or named in a configured Preview URL. Adds isEligibleDiscoveredWebProbe in PortScanner.ts to gate probe URL construction and avoid sending HTTP to binary RPC listeners.

• Tests in PortScanner.test.ts verify the no-probe path for foreign listeners and the probe path for terminal-owned high-numbered ports
• Behavioral Change: non-eligible discovered listeners are no longer probed and will not appear in PortDiscovery.scan() results

^{Macroscope summarized abaad2b.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f401c3b0-e0fc-40bb-84f1-9e2ba0181dd2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved at abaad2b

Macroscope's review found this PR approvable — This is a small, self-contained server bug fix that prevents HTTP traffic from being sent to unrelated local binary listeners while preserving configured previews, common development ports, and T3 terminal-owned listeners. Regression tests cover both the no-probe and preserved-probe paths.

^{You can add or adjust custom eligibility rules. Learn more.}

[Mnigos]

Checked this locally: merges cleanly onto current main and the eligibility gate does what it says. One thing worth knowing before it closes #8407 outright: the ~10s TLS stall in the Steam trace is undici keeping an in-flight connect alive after the fetch is aborted (see my note on #8407), so a binary service on a curated port or from a T3 terminal still gets probed and still blocks for 10s. Might be cleaner to say this PR narrows the blast radius and leave #8407 open for the socket cleanup.

[t3-code]

thanks for contributing this fix! your change has been carried over into #9832, so we are closing this pr in favor of that one. #9832 is still open and has not merged yet.

if anything from this pr is missing there, please open a new pr with the remaining changes.

closed at the request of @Bil0000.