Module lan_ports 

The fixed port range srv’s listeners live in, so a firewall rule can name them (docs/specs/SPEC_LAN_FIREWALL_SETUP_2026_10_01.md §4.1).

srv used to let the OS choose its web and ws ports on every start. A firewall rule that must survive updates, new portable builds and reinstalls cannot name a port that changes, and a program rule cannot either: the sidecar’s filename embeds its version, so a per-exe rule stops matching on every update and re-registering it needs another elevation. A port range does neither.

The loopback and LAN listeners share a port (see lan_listeners.rs), so choosing the startup ports from the range is enough: every LAN listener added later lands in the range too, and mDNS advertises the real port.

Several instances on one host (channels, portable builds, task dev) each take the next free ports. If fewer than two are free srv does not fail: it falls back to OS-chosen ports exactly as before, and StartupListeners::in_range is false so the LAN indicator can say the rule does not cover this instance.

Structs

StartupListeners

The two startup listeners, plus where they came from.

Constants

LAN_PORT_RANGE

TCP ports srv’s web and ws listeners are taken from.

Functions

bind_startup_listeners

Bind the web and ws listeners on loopback, from LAN_PORT_RANGE when two ports are free there, else OS-chosen. Panics only if even an OS-chosen loopback bind fails, as the code this replaces did.

bind_startup_listeners_from 🔒

bind_startup_listeners over an explicit candidate list. Separate so the tests can drive it with ports they control instead of racing real instances for the production range.

first_two_free 🔒

The first two loopback ports among candidates that bind, in order. Not necessarily adjacent: an instance that started earlier may hold one in the middle. None when fewer than two are free; nothing is left bound then.