test(server): bind management-auth fixtures on kernel-assigned ports

[lidge-jun]

Summary

• Allocate the two management-auth test listeners with the kernel at their real bind, preserving the original public wildcard and management loopback hosts and every real HTTP handler.
• The old fixtures probed 127.0.0.1, closed the probe, then bound the public server to 0.0.0.0. CI exposed EADDRINUSE in the two live Tailscale/pairing tests; an available loopback number was not a reservation for that wildcard bind.
• Keep all identity, origin, credential, health, consent and single-use pairing assertions. Restore the bind spy synchronously and join cleanup on failure. Production server/auth/port policy is unchanged.
• Stack foundation for fix(responses): accept complete external task inputs without weakening tool guards #3743 verification: land this fixture-only layer first, then the task-input layer.

Verification

• Failure evidence: https://github.com/lidge-jun/opencodex/actions/runs/34011124632 — macOS 2/2 failed only the two live management-auth binds; corrected task-input cases and Linux checks passed.
• Independent xai/grok-4.6 review passed for the fixture change, preserved host/handler boundaries and cleanup.
• Exact-head hosted CI passed at dc3f760: https://github.com/lidge-jun/opencodex/actions/runs/34012437884 — Linux4/4, macOS2/2 and gates. Both previously failing real HTTP management-auth tests passed on macOS2.
• Owner authorized bottom-up admin integration; this records that decision rather than a second-maintainer approval.
• git diff --check passed; no local tests/typecheck/build were run. No retries, skips or authentication relaxation were added.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

• Tests
  • Improved reliability of management authentication test coverage on macOS.
  • Tests now validate separate, active public and management listeners using dynamically assigned ports.
  • Existing authentication checks and cleanup behavior remain covered.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: b35d3285-bd08-47b3-910d-1c4b62de6378

📥 Commits

Reviewing files that changed from the base of the PR and between 25c8d2b and dc3f760.

📒 Files selected for processing (2)

• devlog/_plan/260906_release_244_followups/022_management_auth_port_fixture.md
• tests/server/server-management-auth.test.ts

---

📝 Walkthrough

Walkthrough

The change adds a synchronous ephemeral-listener helper for management-auth tests. Two management-ingress tests now use captured listener ports instead of probe-then-close port allocation.

Changes

Management Auth Fixture

Layer / File(s)	Summary
Ephemeral listener fixture devlog/_plan/260906_release_244_followups/022_management_auth_port_fixture.md:1-27, tests/server/server-management-auth.test.ts:118-148	The plan defines the fixture repair. The test helper wraps Bun.serve, binds both listeners to ephemeral ports, preserves ingress configuration, validates distinct listeners, restores the spy, and stops listeners if setup fails.
Management-ingress test integration tests/server/server-management-auth.test.ts:1011-1019, tests/server/server-management-auth.test.ts:1195-1201	The Tailscale and pairing-exchange tests use startEphemeralHubServer and obtain the management port from the live listener instead of reserving ports manually.

Estimated code review effort: 2 (Simple) | ~10 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/release-244-auth-port-fixtures-07c0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-06T05:01:00.496782Z	dc3f760	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.