[Bug]: Preview port discovery still sends HTTP/TLS to non-web apps launched from T3 terminals, and there's no way to turn it off (crashes Black Ops III, trips Maya's commandPort) #18377

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

On stable v0.0.45 (Windows), which doesn't include #16687:

1. Open T3 Code with the legacy sidebar enabled (legacySidebarEnabled: true) and a few threads visible. Nothing needs to be open in Preview.
2. Start any app that listens on a local TCP port and doesn't validate what it receives. Mine were:
   • Call of Duty: Black Ops III (Steam, launched through the BO3 mod tools with +set developer 2 +devmap <map>)
   • Autodesk Maya with a commandPort open
3. Within ~3 s, PortDiscovery.pollTick runs Get-NetTCPConnection -State Listen, finds the listener and sends GET / to it (see server.trace.ndjson: PortDiscovery.scanSnapshot → PortDiscovery.probeWebUrl).
4. Black Ops III hard-crashes during map load, every time, for every map. Maya shows its commandPort warning/error popup every time it gets probed.

On main / nightly with #16687, the same thing still happens if the app is started from a T3 terminal. That terminal process tree counts as "owned", so its listeners still get both http:// and https:// probes (makeWebProbeGroups in apps/server/src/preview/PortScanner.ts). Launching Maya, mayapy, Blender, Houdini, Unreal, a game build or a mod-tools launcher from the integrated terminal is a normal thing to do in a creative or game-dev workflow, and none of those are web servers.

Expected behavior

• T3 Code shouldn't write HTTP or TLS bytes to a socket unless it has good reason to believe the socket is a web server, or the user has opted in.
• There should be a setting to turn automatic local-server discovery off entirely, or limit it to explicitly configured preview URLs. Anyone who doesn't use Preview shouldn't pay for it in crashes, popups or a PowerShell spawn every 3 seconds.

Actual behavior

• Stable v0.0.45: every listening TCP port on the machine gets an unsolicited GET / (plus TLS on newer builds) every few seconds while thread rows are visible in the sidebar (useThreadDiscoveredPorts → subscribeDiscoveredLocalServers → PortDiscovery.retain).
• main / nightly: the same probes, limited to listeners owned by T3 terminals, which still includes any non-web app started from a terminal.
• There's no setting to disable discovery. The legacy sidebar keeps it retained for as long as the window is open.
• On Windows, the Get-NetTCPConnection PowerShell enumeration still spawns every 3 s even when no listener is eligible for probing (cost covered in [Bug]: Windows port discovery re-spawns a doomed PowerShell/WMI probe every 3 s (the port-scanner half of #4182, not fixed by #2679) #5900).

Plenty of desktop software opens a loopback port for IPC, scripting or debugging and then trusts whatever arrives: DCC tools (Maya commandPort, Houdini hrpyc, Blender add-ons), game engines and game dev builds, plugin hosts. A stray GET / HTTP/1.1 is enough to crash them or interrupt the user with security dialogs. That makes this especially painful for creatives and game developers using T3 Code next to those tools. It took me a while to work out that my editor's sidebar was what kept crashing my game.

Impact

Major degradation or frequent failure

Version or commit

T3 Code (Alpha) v0.0.45 (stable, desktop). Also verified by reading main @ 318201c (#16687) that terminal-owned listeners are still probed.

Environment

Windows 11 IoT Enterprise 10.0.26200, T3 Code desktop v0.0.45, legacy sidebar enabled, local backend. Black Ops III Steam build CL 13892626. Autodesk Maya.

Logs or stack traces

# Black Ops III crash (minidump from crash_reports/, same result on every launch)
Exception: 0xC0000005 ACCESS_VIOLATION reading 0x8
RIP:  BlackOps3.exe+0x29EBDFD
RDX:  0x74736F680A0D312E   # bytes ".1\r\nhost": the tail of "GET / HTTP/1.1\r\nhost: ..." (undici's lowercase Host header)
Modules: only BlackOps3.exe, Steam and Windows DLLs (no mods or injectors loaded)
Console log ends right after the server starts loading the map; a normal load continues with logging `Unknown command "bbstart"`, but the game crashes due to this issue before it can reach there.

# T3 Code server.trace.ndjson on the same machine, same day
"PortDiscovery.probeWebUrl"   16500 spans
"PortDiscovery.scanSnapshot"   1023 spans
"PortDiscovery.pollTick"       1019 spans

Screenshots, recordings, or supporting files

No response

Workaround

There's no setting to turn off port probing, so I patched resources/server.asar (Electron asar integrity validation is off in this build, and I really didn't want the hassle of maintaining a fork). I made two same-length edits in apps/server/dist/bin.mjs: the Get-NetTCPConnection … command string became exit 0, so no listeners are ever enumerated, and state.retainCount > 0 ? pollTick() became < 0. After restarting T3 Code, Black Ops III loads normally and Maya no longer shows the popup. Obviously this "fix" gets wiped on every update, but Opus 5.5 decided to just do it for me in like 10 seconds lmao, so here we are.

Suggested fix (any of these would help)

1. Ship fix(server): probe only owned preview listeners #16687 to stable soon. It already fixes listeners that aren't owned by T3.
2. Add a setting, e.g. "Detect local dev servers: Automatic / Configured URLs only / Off". "Off" should also stop the 3 s listener enumeration.
3. Don't probe a terminal-owned listener just because it's owned. Gate it on the owning process being a known dev-server runtime (node, bun, deno, python, ruby, php, java, dotnet, go binaries started by a dev script…) or on the user opting in for that terminal. At minimum, offer an ignore list by process name or port.
4. Don't retain discovery from the sidebar unless the user actually uses the dev-server indicator or Preview.