fix(core,tooling): keep the harness's own ports out of the Agent's environment and off the dev server (#100)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: J.Li <jl2388@cam.ac.uk>

packages/web/vite.config.ts

@@ -1,9 +1,11 @@
 /**
  * Vite config: React SPA + Tailwind CSS 4.
  *
- * Dev server listens on 7365; `/api` is proxied to the local Web server (defaults to 127.0.0.1:7364,
- * overridable via PENGUIN_API_PROXY). SSE (text/event-stream) passes through http-proxy transparently, no
- * special config needed.
+ * Dev server listens on 7365; `/api` is proxied to the **development** backend (127.0.0.1:7368 --
+ * `pnpm dev:server`, deliberately not the installed server's 7364, which is routinely running at the
+ * same time). Honors PORT so overriding the backend port moves the proxy with it, and
+ * PENGUIN_API_PROXY overrides the whole target. SSE (text/event-stream) passes through http-proxy
+ * transparently, no special config needed.
  * The vitest config is kept separate in vitest.config.ts (its embedded vite 5 types conflict with this
  * package's vite 7 plugin types, hence the separate file to avoid the clash).
  */
@@ -11,15 +13,32 @@ import react from "@vitejs/plugin-react";
 import tailwindcss from "@tailwindcss/vite";
 import { defineConfig } from "vite";
 
+/**
+ * Resolves the `/api` proxy target: PENGUIN_API_PROXY replaces it outright, otherwise the
+ * development backend on PORT — the same variable `pnpm dev:server` binds — defaulting to 7368.
+ *
+ * Empty counts as unset, as everywhere else PORT is read in this repo (server/src/config.ts,
+ * cli/src/commands/serve.ts, scripts/run-with-env.mjs). Here `??` would be actively harmful: an
+ * exported-but-empty `PORT=` yields `http://127.0.0.1:` — port 80 — and every /api call would be
+ * answered by whatever happens to listen there, silently and without an error, which is the exact
+ * wrong-backend failure this default exists to prevent.
+ *
+ * Takes the environment as an argument so the resolution can be unit-tested (a vite config's
+ * `server.proxy` cannot be exercised without starting a dev server).
+ */
+export function apiProxyTarget(env: Record<string, string | undefined> = process.env): string {
+  return env.PENGUIN_API_PROXY || `http://127.0.0.1:${env.PORT || "7368"}`;
+}
+
 export default defineConfig({
   plugins: [react(), tailwindcss()],
   server: {
-    // Fixed PenguinHarness dev port (stands alone — only the main server default is
-    // shared, as DEFAULT_SERVER_PORT in core; vite configs cannot import core TS).
+    // Fixed PenguinHarness dev port (stands alone — vite configs cannot import core TS,
+    // so the numbers are literals here; the allocation table lives in core's internal/ports.ts).
     port: 7365,
     proxy: {
       "/api": {
-        target: process.env.PENGUIN_API_PROXY ?? "http://127.0.0.1:7364",
+        target: apiProxyTarget(),
         changeOrigin: false,
       },
     },