sync: update from private repo (f6b8c40)

src/bridge/server.ts

@@ -107,7 +107,7 @@ import { readGatewayConfig } from '../gateway/config.js';
 import { createAdminGatewayStatusRouter } from './admin-gateway-status-api.js';
 import { createServer as createHttpsServer } from 'https';
 import { X509Certificate } from 'crypto';
-import { mergeServerConfig } from '../server/config.js';
+import { mergeServerConfig, resolveListenPort } from '../server/config.js';
 import { resolveTlsOptions } from '../net/tls-options.js';
 import { createHttpRedirectServer } from '../net/http-redirect.js';
 
@@ -297,7 +297,9 @@ export function createCoreServer(opts: CoreServerOptions): {
   // tls.enabled and the cookie secure flag.
   const serverCfg = mergeServerConfig(loadConfig().server, {
     freshInstall: false,
-    httpsPort: opts.listenPort ?? Number(process.env['PORT'] ?? 9876),
+    // startCoreServer threads the resolved port in via listenPort; the fallback
+    // (for callers that bypass it) applies the same PORT-env > config precedence.
+    httpsPort: opts.listenPort ?? resolveListenPort(process.env['PORT'], loadConfig().server?.port),
   });
 
   if (authActive) {
@@ -1152,9 +1154,7 @@ export function createCoreServer(opts: CoreServerOptions): {
     // (startCoreServer always sets it) over the PORT env-var guess so
     // the status endpoint matches what the bridge actually bound.
     // env-var fallback is kept for callers that bypass startCoreServer.
-    const envPortRaw = Number(process.env['PORT']);
-    const envPort = Number.isFinite(envPortRaw) && envPortRaw > 0 ? envPortRaw : 9876;
-    const actualPort = opts.listenPort ?? envPort;
+    const actualPort = opts.listenPort ?? resolveListenPort(process.env['PORT'], loadConfig().server?.port);
     const statusRouter = createAdminGatewayStatusRouter({
       mount: gatewayMount,
       configManager: opts.configManager ?? null,
@@ -1267,7 +1267,9 @@ function deriveCallbackBaseUrl(authConfig: AuthConfig | undefined): string {
       }
     }
   }
-  const port = Number(process.env.PORT ?? 9876);
+  // Same precedence as the listener (PORT env > server.port > default) so the
+  // derived OAuth callback origin matches the port the bridge actually binds.
+  const port = resolveListenPort(process.env.PORT, loadConfig().server?.port);
   return `http://localhost:${port}`;
 }