Move Oktasso callback off port 3001

.env.example

@@ -8,8 +8,8 @@ OKTASSO_CLIENT_ID=
 
 # Generic OAuth/PKCE settings — the defaults below are fine for local dev.
 OKTASSO_SCOPES="profile email openid"
-OKTASSO_REDIRECT_URI=http://localhost:3001/auth
-OKTASSO_CALLBACK_PORT=3001
+OKTASSO_REDIRECT_URI=http://localhost:31337/auth
+OKTASSO_CALLBACK_PORT=31337
 # Token cache lifetime in ms (55 minutes).
 OKTASSO_REFRESH_AFTER_MS=3300000
 

apps/acp-attach-cli/SKILL.md

@@ -73,6 +73,6 @@ node <skill-dir>/scripts/tangent-acp-attach.mjs \
   `list_session_resources`, `read_session_resource`), so it can contribute files
   to the Tangent session and read what Prime or agents on other environments
   shared — no setup needed.
-- The Okta login opens a browser and listens on `localhost:3001`, so run the
+- The Okta login opens a browser and listens on `localhost:31337`, so run the
   client on the same machine as the browser you log in with.
 - CLI flag reference lives in [apps/acp-attach-cli/src/usage.ts](../../../apps/acp-attach-cli/src/usage.ts).

apps/local-agent-cli/README.md

@@ -12,7 +12,7 @@ extension — same remote-env host, no editor required.
 
 The client self-mints a short-lived, auto-refreshed remote-env token. On its
 first request it runs the Okta SSO login once (opening a browser and listening on
-`localhost:3001`), caches the cookie, and derives your identity from it. Pass
+`localhost:31337`), caches the cookie, and derives your identity from it. Pass
 `--email` only to mint as a specific identity instead.
 
 The deployment's Okta config must be present at runtime via `OKTASSO_*` and

packages/local-agent-host/src/oktasso.ts

@@ -51,8 +51,8 @@ function readConfig(): OktassoConfig {
     tokenExchangeUrl: requiredEnv("OKTASSO_TOKEN_EXCHANGE_URL"),
     clientId: requiredEnv("OKTASSO_CLIENT_ID"),
     scopes: env("OKTASSO_SCOPES", "profile email openid"),
-    redirectUri: env("OKTASSO_REDIRECT_URI", "http://localhost:3001/auth"),
-    callbackPort: Number(env("OKTASSO_CALLBACK_PORT", "3001")),
+    redirectUri: env("OKTASSO_REDIRECT_URI", "http://localhost:31337/auth"),
+    callbackPort: Number(env("OKTASSO_CALLBACK_PORT", "31337")),
     refreshAfterMs: Number(env("OKTASSO_REFRESH_AFTER_MS", "3300000")),
     cookieName: requiredEnv("AUTH_JWT_TOKEN_COOKIE_NAME"),
   };

scripts/oktassoAuth.ts

@@ -8,7 +8,7 @@
  * Flow:
  *   1. Generate PKCE verifier + challenge.
  *   2. Open the user's browser at Okta's `/authorize`.
- *   3. Run a one-shot HTTP server on http://localhost:3001/auth to catch the
+ *   3. Run a one-shot HTTP server on http://localhost:31337/auth to catch the
  *      redirect with the authorization code.
  *   4. Exchange the code for an Okta access token at `/token`.
  *   5. Exchange the access token for an Oktasso session token via the