[Bug]: EACCES on port 9899 due to Windows WinNAT excluded port range

[LittleNightmare]

App Variant

Tauri

Operating System & Version

Windows 11 Pro 25H2

Issue Summary

CodeNomad fails to start on Windows with CLI exited early: exit code: 1 when port 9899 falls inside a WinNAT excluded port range, causing listen EACCES instead of binding successfully. The issue is intermittent because the excluded range varies across boots.

Steps to Reproduce

1. On Windows with Hyper-V / WSL / Docker enabled (WinNAT active)
2. Install CodeNomad 0.18.0 Tauri build
3. Launch from desktop shortcut
4. Observe: app fails with CLI exited early: exit code: 1

To confirm: run netsh int ipv4 show excludedportrange protocol=tcp. If the range 9893-9992 appears, both default ports (9898, 9899) are blocked. Setting CLI_HTTPS_PORT=9891 CLI_HTTP_PORT=9892 (outside the range) makes CodeNomad start normally.

Expected Behavior

CodeNomad starts successfully regardless of WinNAT's excluded port range, or at minimum surfaces an actionable error telling the user which port is reserved and how to fix it.

Logs & Screenshots

[INFO] [app] Starting CodeNomad CLI server options={"httpsPort":9898,"httpPort":9899,...} [ERROR] [app] CLI server crashed err=Error: listen EACCES: permission denied 127.0.0.1:9899 at Server.setupListenHandle [as _listen2] (node:net:1918:21) [tauri-cli] cli process exited before ready: Some("CLI exited early: exit code: 1")

Additional Context

Root cause: CodeNomad's default HTTP port (9899) and HTTPS port (9898) can fall within WinNAT's dynamically reserved excluded port range on Windows. Unlike EADDRINUSE, Windows returns EACCES on listen() for excluded ports — the port is system-reserved, not in use.

Workaround: Set user environment variables CLI_HTTPS_PORT=9891 and CLI_HTTP_PORT=9892.

Suggested fixes:

• Move default ports outside typical WinNAT excluded ranges (e.g. below 9000)
• Allow port configuration in config.yaml for the Tauri desktop app
• Detect EACCES on listen() and surface an actionable message (e.g. "Port 9899 is reserved by Windows. Try setting CLI_HTTP_PORT or check netsh int ipv4 show excludedportrange")

[pascalandr]

Hi @LittleNightmare,

I checked the code and tested the ports on Windows.

I can confirm a CodeNomad bug: automatic mode tries 9898/9899 first, but retries an ephemeral port only for EADDRINUSE. An EACCES therefore stops startup instead of trying another port.

I cannot confirm the stated WinNAT root cause :

• 9893-9992 is not a standard Windows excluded range.
• Microsoft documents the default dynamic TCP range as 49152-65535.
• On any Windows machine Ihave access, 9898/9899 are not excluded and CodeNomad is currently bound to both.
• EACCES does not by itself prove WinNAT involvement; exclusive access by a service or kernel driver can produce the same error.

Please attach the raw output from the affected boot:

netsh int ipv4 show excludedportrange protocol=tcp
netsh int ipv4 show dynamicport tcp
netstat -ano | findstr ":9898 :9899"

Please also provide the full CLI/Tauri log and the excluded-port output after a reboot. Without those results, the confirmed issue is an unhandled Windows EACCES; the specific WinNAT attribution and claim that the range changes between boots remain unverified.

Anyway I think the robust fix is to retry an ephemeral port on EACCES in automatic mode, not move the defaults to another arbitrary fixed range.