Enum PortSpecification 

pub enum PortSpecification {
    One {
        port: u16,
    },
    Range {
        range: PortRange,
    },
    All {
        all_ports: AllPorts,
    },
}

PortSpecification, the model’s tagged union: one port, a range, or all of them.

A union rather than the single-field struct this was, and the change is a defect fix rather than completeness for its own sake. Session::connect_headers(port) and connect_subprotocols(port) exist to reach another port on the same VM, and they were built over a token the control plane had minted with allowedPorts: [{port: 9000}] — so they returned a correct-looking port header behind a credential that did not authorize it. Measured 2026-08-15 on one VM with a listener on 8080, varying only the mint:

allowedPorts	GET :8080 through the endpoint
[{port: 9000}]	403 Access to port denied
[{port: 9000}, {port: 8080}]	200, the guest answered
[{allPorts: {}}]	200
[{range: {startPort: 8000, endPort: 9100}}]	200

One variable, four outcomes, so the token’s scope is the whole of it. On the WebSocket path the same rejection is close code 1006 with no reason, which is why this was invisible to a client-side test: the strings were right and the credential behind them was not.

#[serde(untagged)] because the wire form is the member name as the key — {"port": 9000}, {"range": {..}}, {"allPorts": {}} — not a discriminator field, and serde’s default enum representation would emit {"Port": 9000}. Each variant names its own key through rename.

Variants

One

Exactly one port. What a session built for the agent port asks for.

Fields

port: u16

Range

An inclusive range. Both members are required by the model.

Fields

range: PortRange

All

Every port on the VM.

Deliberately not what this client mints by default. A token good for every port is one whose leak is worth more, and the ports a caller actually needs are knowable: the agent port plus whatever it asked for. Present because the model has it and a caller building a general proxy needs it, reached only through an explicit scope.

Fields

all_ports: AllPorts

Implementations

impl PortSpecification

pub fn port(port: u16) -> PortSpecification

One port.

pub fn range(start: u16, end: u16) -> PortSpecification

An inclusive range of ports.

pub fn all() -> PortSpecification

Every port. See PortSpecification::All for why this is not a default.

Trait Implementations

impl Clone for PortSpecification

fn clone(&self) -> PortSpecification

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for PortSpecification

impl Debug for PortSpecification

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Serialize for PortSpecification

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.