@dotobokuri/fleet-console 1.14.0 → 1.15.0

package/AGENTS.md

@@ -84,7 +84,7 @@ The console is the operations variant of Fleet Wiki's **Maritime Codex** languag
   - `brass` means "지금 보고 있는 곳" — selected job brass dot indicator, active navigation, structural decoration, and non-live active/focus-adjacent emphasis.
   - `aurora` means "지금 살아있는 것" — streaming status, live dots, tenant beacons, stream caret, follow button, and `connection-chip--live`. Unlike Fleet Wiki, console does not reserve aurora only for document linkage because there is no document-link concept here.
   - `coral` means error/bad; `--warn` (amber, near `oklch(80% 0.13 85)`) means warning/connecting; neutral ink means idle.
-  - User accents recolor the Dock chip `::before` perimeter ring (the same edge band the underway/in-progress orbit rides) to a user-chosen hue, which may be any hue across the wheel (red/amber/green included). The accent is the static full-perimeter fill of that ring; the underway state overrides the same `::before` with the animated aurora/warn conic and wins while work is in progress (functional status outranks an identity tag). Accents never tint the chip fill, name, border, box-shadow ring, beacon, count, or close, and never animate on their own (an infinitely orbiting ring is reserved for the functional in-progress signal). Active brass lives on the border/fill/name, so an accented chip can be active and accented at once without collision.
+  - User accents recolor the Dock chip `::before` perimeter ring (the same edge band the underway/in-progress orbit rides) to a user-chosen hue, which may be any hue across the wheel (red/amber/green included). The accent is the static full-perimeter fill of that ring; the underway state overrides the same `::before` and wins while work is in progress (functional status outranks an identity tag), so an accented chip never exposes its accent while underway. The rotating aurora/warn conic rides only one surface at a time to avoid duplicated GPU cost: a minimized operation's dock chip `::before` carries the conic, while a visible operation's rotation is owned by its canvas panel and the dock chip `::before` stays transparent (accent suppressed, no ring). Accents never tint the chip fill, name, border, box-shadow ring, beacon, count, or close, and never animate on their own (an infinitely orbiting ring is reserved for the functional in-progress signal). Active brass lives on the border/fill/name, so an accented chip can be active and accented at once without collision.
 - **Typography**: `Fraunces Variable` is display type for the topbar brand, job titles, idle marks, and large headings. `Manrope Variable` is the default UI family. `JetBrains Mono Variable` is for stream output, job ids, timelines, and eyebrow labels with uppercase tracked styling. **Exception**: the Operations terminal (xterm) uses `Cascadia Code` — a terminal-tuned face for box-drawing/Powerline glyph alignment — rendered via the xterm WebGL addon with DOM fallback. This is the sole surface where the console mono identity deliberately diverges from JetBrains Mono; the terminal font lives in the `terminal.tsx` xterm options (xterm takes a JS font string, not a CSS token), so it is not a `theme.css` variable.
 - **Surface and atmosphere**: `body::before` owns the multi-radial cold teal + brass afterglow field, and `body::after` owns the `feTurbulence` grain overlay. Sidebar, selected-job stage, timeline dock, and job summary are glass cards using `backdrop-filter: blur(18px) saturate(140%)`, `--surface-glass`, `--surface-rim`, `--shadow-soft`, and `--radius-xl`/large-radius surfaces.
 - **Motion**: panes use one first-paint `codex-rise` reveal (720ms, `--ease-spring`, topbar/sidebar/stage staggered 40/120/200ms). Live dots use aurora pulse, the stream caret keeps its blink, and ambient infinite motion is forbidden. `prefers-reduced-motion` must continue to short-circuit animation. Exception: the Operations canvas background may render a user-toggleable ambient radar sweep that defaults on and persists per browser; it remains short-circuited by `prefers-reduced-motion`. Second exception: a running Operation panel renders a continuous perimeter "wake" ripple as a functional status signal (not ambient decoration) — it appears only while work is in progress (an active carrier job, or an in-progress Agent CLI turn), its color **follows the panel beacon** (aurora for an active job, amber `--warn` for a turn in progress), and it stays short-circuited by `prefers-reduced-motion`, degrading to a static tinted rim and glow. Like the live-dot pulse, this is allowed functional status motion, not forbidden ambient motion.

package/dist/cli-bin.mjs

@@ -21650,6 +21650,8 @@ var GLOBAL_OPTIONS_FILE_NAME = "settings.json";
 var LOCK_DIR_NAME = "settings.json.lock";
 var LOCK_OWNER_FILE_NAME = "owner";
 var TEMP_FILE_PREFIX = `.tmp-${GLOBAL_OPTIONS_FILE_NAME}-`;
+var MIN_CONSOLE_STATIC_PORT = 1024;
+var MAX_CONSOLE_STATIC_PORT = 65535;
 function createGlobalOptionsStore(deps = {}) {
   const dataDir = deps.dataDir ?? getFleetDataDir();
   const optionsPath = path92.join(dataDir, GLOBAL_OPTIONS_FILE_NAME);
@@ -21687,15 +21689,20 @@ function sanitizeGlobalOptionsData(value) {
   const data = {
     version: GLOBAL_OPTIONS_VERSION,
     ...typeof value.replaceSystemPrompt === "boolean" ? { replaceSystemPrompt: value.replaceSystemPrompt } : {},
-    ...typeof value.enableMetaphor === "boolean" ? { enableMetaphor: value.enableMetaphor } : {}
+    ...typeof value.enableMetaphor === "boolean" ? { enableMetaphor: value.enableMetaphor } : {},
+    ...value.consolePortMode === "dynamic" || value.consolePortMode === "static" ? { consolePortMode: value.consolePortMode } : {},
+    ...isValidConsoleStaticPort(value.consoleStaticPort) ? { consoleStaticPort: value.consoleStaticPort } : {}
   };
-  const allowedKeys = /* @__PURE__ */ new Set(["version", "replaceSystemPrompt", "enableMetaphor"]);
-  const changed = Object.keys(value).some((key) => !allowedKeys.has(key)) || "replaceSystemPrompt" in value && typeof value.replaceSystemPrompt !== "boolean" || "enableMetaphor" in value && typeof value.enableMetaphor !== "boolean";
+  const allowedKeys = /* @__PURE__ */ new Set(["version", "replaceSystemPrompt", "enableMetaphor", "consolePortMode", "consoleStaticPort"]);
+  const changed = Object.keys(value).some((key) => !allowedKeys.has(key)) || "replaceSystemPrompt" in value && typeof value.replaceSystemPrompt !== "boolean" || "enableMetaphor" in value && typeof value.enableMetaphor !== "boolean" || "consolePortMode" in value && value.consolePortMode !== "dynamic" && value.consolePortMode !== "static" || "consoleStaticPort" in value && !isValidConsoleStaticPort(value.consoleStaticPort);
   return { data, changed };
 }
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function isValidConsoleStaticPort(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= MIN_CONSOLE_STATIC_PORT && value <= MAX_CONSOLE_STATIC_PORT;
+}
 function createGlobalOptionsService(deps = {}) {
   const store2 = deps.store ?? createGlobalOptionsStore({ dataDir: deps.dataDir });
   return {
@@ -40736,6 +40743,8 @@ function requireCarrierConfig(registry3, carrierId) {
 }
 
 // src/global-settings-routes.ts
+var MIN_CONSOLE_STATIC_PORT2 = 1024;
+var MAX_CONSOLE_STATIC_PORT2 = 65535;
 var GLOBAL_SETTINGS_API_CATALOG = [
   {
     method: "GET",
@@ -40799,10 +40808,20 @@ async function mutateGlobalSettings(req, res, deps) {
     deps.writeJson(res, 400, { error: "invalid_enable_metaphor" });
     return;
   }
+  if (body.consolePortMode !== void 0 && body.consolePortMode !== "dynamic" && body.consolePortMode !== "static") {
+    deps.writeJson(res, 400, { error: "invalid_console_port_mode" });
+    return;
+  }
+  if (body.consoleStaticPort !== void 0 && body.consoleStaticPort !== null && !isValidConsoleStaticPort2(body.consoleStaticPort)) {
+    deps.writeJson(res, 400, { error: "invalid_console_static_port" });
+    return;
+  }
   const updated = deps.globalOptionsService.update((current) => ({
     ...current,
     ...typeof body.replaceSystemPrompt === "boolean" ? { replaceSystemPrompt: body.replaceSystemPrompt } : {},
-    ...typeof body.enableMetaphor === "boolean" ? { enableMetaphor: body.enableMetaphor } : {}
+    ...typeof body.enableMetaphor === "boolean" ? { enableMetaphor: body.enableMetaphor } : {},
+    ...body.consolePortMode === "dynamic" || body.consolePortMode === "static" ? { consolePortMode: body.consolePortMode } : {},
+    ...isValidConsoleStaticPort2(body.consoleStaticPort) ? { consoleStaticPort: body.consoleStaticPort } : {}
   }));
   const response = { state: toGlobalSettingsState(updated) };
   deps.writeJson(res, 200, response);
@@ -40810,13 +40829,18 @@ async function mutateGlobalSettings(req, res, deps) {
 function toGlobalSettingsState(data) {
   return {
     replaceSystemPrompt: data.replaceSystemPrompt ?? false,
-    enableMetaphor: data.enableMetaphor ?? false
+    enableMetaphor: data.enableMetaphor ?? false,
+    consolePortMode: data.consolePortMode ?? "dynamic",
+    consoleStaticPort: data.consoleStaticPort ?? null
   };
 }
 function isJsonRequest2(req) {
   const contentType = req.headers["content-type"];
   return typeof contentType === "string" && contentType.toLowerCase().split(";")[0]?.trim() === "application/json";
 }
+function isValidConsoleStaticPort2(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= MIN_CONSOLE_STATIC_PORT2 && value <= MAX_CONSOLE_STATIC_PORT2;
+}
 
 // src/model-auth-routes.ts
 var MODEL_AUTH_PROVIDERS = [
@@ -44608,6 +44632,8 @@ function createConsoleUpdateCheckService(deps = {}) {
 // src/server.ts
 var DEFAULT_HOST2 = "127.0.0.1";
 var DEFAULT_PORT2 = 0;
+var MIN_CONSOLE_STATIC_PORT3 = 1024;
+var MAX_CONSOLE_STATIC_PORT3 = 65535;
 var SHELL_TERMINAL_SESSION_ID = "shell";
 var THEATER_SHELL_SESSION_PREFIX2 = "shell:";
 var SERVER_TIMEOUT_MS = 30 * 60 * 1e3;
@@ -44778,7 +44804,7 @@ var SERVER_API_CATALOG = [
 ];
 function createConsoleServer(deps = {}) {
   const host = deps.host ?? DEFAULT_HOST2;
-  const port = deps.port ?? DEFAULT_PORT2;
+  const injectedPort = deps.port ?? DEFAULT_PORT2;
   const release = deps.release ?? readFleetConsoleRelease();
   const version2 = deps.version ?? release.version;
   const channel = release.channel;
@@ -44818,7 +44844,7 @@ function createConsoleServer(deps = {}) {
     cwd: deps.codexCwd ?? process.cwd(),
     host,
     version: version2,
-    getPort: () => lockHandle?.payload.port ?? port,
+    getPort: () => lockHandle?.payload.port ?? portState.effectivePort,
     getAdminToken: () => lockHandle?.payload.token ?? null
   });
   const pendingRuntimeSessions = /* @__PURE__ */ new Map();
@@ -44866,7 +44892,7 @@ function createConsoleServer(deps = {}) {
   });
   const terminalUpgrade = createTerminalUpgradeHandler({
     expectedHost: host,
-    getExpectedPort: () => lockHandle?.payload.port ?? port,
+    getExpectedPort: () => lockHandle?.payload.port ?? portState.effectivePort,
     tickets: terminalTickets,
     sessions: terminalSessions,
     validateHost
@@ -44876,6 +44902,12 @@ function createConsoleServer(deps = {}) {
   let lockHandle = null;
   let activeLockFile = null;
   let activeEndpoint = null;
+  let portState = {
+    requestedPort: null,
+    effectivePort: injectedPort,
+    portMode: "dynamic",
+    portHonored: true
+  };
   let agentRuntimeStopped = false;
   let consoleResourcesDisposed = false;
   let updateApplyInFlight = false;
@@ -44909,7 +44941,7 @@ function createConsoleServer(deps = {}) {
       runAsyncBooleanHandler(codex.handle(req, res), res, () => tryServeStaticConsole(req, res, pathname));
       return;
     }
-    if (!validateHost(req, lockHandle?.payload.port ?? port)) {
+    if (!validateHost(req, lockHandle?.payload.port ?? portState.effectivePort)) {
       writeJson(res, 403, { error: "host_mismatch" });
       return;
     }
@@ -45036,7 +45068,11 @@ function createConsoleServer(deps = {}) {
       endpoint: payload.endpoint,
       startedAt: payload.startedAt,
       version: payload.version,
-      workspaceCount: observability.workspaceCount()
+      workspaceCount: observability.workspaceCount(),
+      portMode: portState.portMode,
+      requestedPort: portState.requestedPort,
+      effectivePort: portState.effectivePort,
+      portHonored: portState.portHonored
     };
     writeJson(res, 200, body);
   }
@@ -45439,7 +45475,11 @@ function createConsoleServer(deps = {}) {
       version: version2,
       channel,
       ...updateCheck.getStatus(),
-      port: lockHandle?.payload.port ?? port,
+      port: lockHandle?.payload.port ?? portState.effectivePort,
+      portMode: portState.portMode,
+      requestedPort: portState.requestedPort,
+      effectivePort: portState.effectivePort,
+      portHonored: portState.portHonored,
       wikiServerStatus: resolveWikiServerStatus(theaterId)
     };
     writeJson(res, 200, payload);
@@ -45562,11 +45602,11 @@ function createConsoleServer(deps = {}) {
   }
   function isTerminalAuthorized(req) {
     if (!lockHandle) return false;
-    return isAllowedTerminalOrigin(req, lockHandle.payload.port ?? port);
+    return isAllowedTerminalOrigin(req, lockHandle.payload.port ?? portState.effectivePort);
   }
   function isExactConsoleOrigin(req) {
     if (!lockHandle) return false;
-    return req.headers.origin === `http://127.0.0.1:${lockHandle.payload.port ?? port}`;
+    return req.headers.origin === `http://127.0.0.1:${lockHandle.payload.port ?? portState.effectivePort}`;
   }
   function listVisibleWorkspaces(requestedTenantId) {
     if (requestedTenantId) {
@@ -45740,36 +45780,19 @@ function createConsoleServer(deps = {}) {
   }
   const returnedServer = {
     host,
-    port,
+    port: injectedPort,
     async start(lockPaths) {
       if (server && lockHandle) return lockHandle.payload.endpoint;
       try {
         await rehydrateDurableState();
-        await new Promise((resolve, reject) => {
-          const srv = createHttpServer(handleRequest, terminalUpgrade);
-          srv.once("error", reject);
-          srv.listen(port, host, async () => {
-            srv.off("error", reject);
-            const address = srv.address();
-            const actualPort = typeof address === "object" && address ? address.port : port;
-            const endpoint = `http://${host}:${actualPort}/`;
-            try {
-              const localLoopbackServer = await maybeStartLoopbackServer(host, actualPort, handleRequest, terminalUpgrade);
-              server = srv;
-              loopbackServer = localLoopbackServer;
-              lockHandle = lock.writeLock({ dir: lockPaths.dir, lockFile: lockPaths.lockFile, pid: process.pid, port: actualPort, endpoint, version: version2 });
-              activeLockFile = lockPaths.lockFile;
-              activeEndpoint = endpoint;
-              resolve();
-            } catch (err) {
-              await closeHttpServer(srv);
-              await closeHttpServer(loopbackServer);
-              server = null;
-              loopbackServer = null;
-              reject(err);
-            }
-          });
-        });
+        const listenPlan = resolveConsolePortListenPlan();
+        const result = await listenConsolePort(listenPlan);
+        server = result.srv;
+        loopbackServer = result.localLoopbackServer;
+        portState = result.portState;
+        lockHandle = lock.writeLock({ dir: lockPaths.dir, lockFile: lockPaths.lockFile, pid: process.pid, port: result.actualPort, endpoint: result.endpoint, version: version2 });
+        activeLockFile = lockPaths.lockFile;
+        activeEndpoint = result.endpoint;
       } catch (error51) {
         await cleanupAfterFailedStart();
         throw error51;
@@ -45782,6 +45805,78 @@ function createConsoleServer(deps = {}) {
       await stopServer();
     }
   };
+  function resolveConsolePortListenPlan() {
+    if (deps.port !== void 0) {
+      return {
+        port: injectedPort,
+        requestedPort: null,
+        portMode: "dynamic",
+        allowFallback: false
+      };
+    }
+    const options = infraServices.globalOptionsService.load();
+    if (options.consolePortMode === "static" && isValidConsoleStaticPort3(options.consoleStaticPort)) {
+      return {
+        port: options.consoleStaticPort,
+        requestedPort: options.consoleStaticPort,
+        portMode: "static",
+        allowFallback: true
+      };
+    }
+    return {
+      port: DEFAULT_PORT2,
+      requestedPort: null,
+      portMode: "dynamic",
+      allowFallback: false
+    };
+  }
+  async function listenConsolePort(plan) {
+    try {
+      return await listenOnce(plan.port, {
+        requestedPort: plan.requestedPort,
+        portMode: plan.portMode,
+        portHonored: true
+      });
+    } catch (error51) {
+      if (!plan.allowFallback || plan.requestedPort === null) throw error51;
+      return listenOnce(DEFAULT_PORT2, {
+        requestedPort: plan.requestedPort,
+        portMode: "static",
+        portHonored: false
+      });
+    }
+  }
+  function listenOnce(portToBind, statePatch) {
+    return new Promise((resolve, reject) => {
+      const srv = createHttpServer(handleRequest, terminalUpgrade);
+      const onError = (error51) => {
+        reject(error51);
+      };
+      srv.once("error", onError);
+      srv.listen(portToBind, host, async () => {
+        srv.off("error", onError);
+        const address = srv.address();
+        const actualPort = typeof address === "object" && address ? address.port : portToBind;
+        const endpoint = `http://${host}:${actualPort}/`;
+        try {
+          const localLoopbackServer = await maybeStartLoopbackServer(host, actualPort, handleRequest, terminalUpgrade);
+          resolve({
+            srv,
+            localLoopbackServer,
+            actualPort,
+            endpoint,
+            portState: {
+              ...statePatch,
+              effectivePort: actualPort
+            }
+          });
+        } catch (err) {
+          await closeHttpServer(srv);
+          reject(err);
+        }
+      });
+    });
+  }
   return returnedServer;
 }
 function resolveCarrierEventOrigin(event, jobOriginById) {
@@ -45934,6 +46029,9 @@ function validateHost(req, expectedPort) {
   if (!hostHeader) return false;
   return hostHeader === `127.0.0.1:${expectedPort}`;
 }
+function isValidConsoleStaticPort3(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= MIN_CONSOLE_STATIC_PORT3 && value <= MAX_CONSOLE_STATIC_PORT3;
+}
 function isAllowedTerminalOrigin(req, expectedPort) {
   const origin = req.headers.origin;
   if (origin === void 0) return true;

package/dist/cli.d.ts

@@ -12,6 +12,10 @@ interface ConsoleHealth {
     readonly pid: number;
     readonly host: string;
     readonly port: number;
+    readonly portMode: "dynamic" | "static";
+    readonly requestedPort: number | null;
+    readonly effectivePort: number;
+    readonly portHonored: boolean;
     readonly endpoint: string;
     readonly startedAt: number;
     readonly version: string;

package/dist/cli.mjs

@@ -21650,6 +21650,8 @@ var GLOBAL_OPTIONS_FILE_NAME = "settings.json";
 var LOCK_DIR_NAME = "settings.json.lock";
 var LOCK_OWNER_FILE_NAME = "owner";
 var TEMP_FILE_PREFIX = `.tmp-${GLOBAL_OPTIONS_FILE_NAME}-`;
+var MIN_CONSOLE_STATIC_PORT = 1024;
+var MAX_CONSOLE_STATIC_PORT = 65535;
 function createGlobalOptionsStore(deps = {}) {
   const dataDir = deps.dataDir ?? getFleetDataDir();
   const optionsPath = path92.join(dataDir, GLOBAL_OPTIONS_FILE_NAME);
@@ -21687,15 +21689,20 @@ function sanitizeGlobalOptionsData(value) {
   const data = {
     version: GLOBAL_OPTIONS_VERSION,
     ...typeof value.replaceSystemPrompt === "boolean" ? { replaceSystemPrompt: value.replaceSystemPrompt } : {},
-    ...typeof value.enableMetaphor === "boolean" ? { enableMetaphor: value.enableMetaphor } : {}
+    ...typeof value.enableMetaphor === "boolean" ? { enableMetaphor: value.enableMetaphor } : {},
+    ...value.consolePortMode === "dynamic" || value.consolePortMode === "static" ? { consolePortMode: value.consolePortMode } : {},
+    ...isValidConsoleStaticPort(value.consoleStaticPort) ? { consoleStaticPort: value.consoleStaticPort } : {}
   };
-  const allowedKeys = /* @__PURE__ */ new Set(["version", "replaceSystemPrompt", "enableMetaphor"]);
-  const changed = Object.keys(value).some((key) => !allowedKeys.has(key)) || "replaceSystemPrompt" in value && typeof value.replaceSystemPrompt !== "boolean" || "enableMetaphor" in value && typeof value.enableMetaphor !== "boolean";
+  const allowedKeys = /* @__PURE__ */ new Set(["version", "replaceSystemPrompt", "enableMetaphor", "consolePortMode", "consoleStaticPort"]);
+  const changed = Object.keys(value).some((key) => !allowedKeys.has(key)) || "replaceSystemPrompt" in value && typeof value.replaceSystemPrompt !== "boolean" || "enableMetaphor" in value && typeof value.enableMetaphor !== "boolean" || "consolePortMode" in value && value.consolePortMode !== "dynamic" && value.consolePortMode !== "static" || "consoleStaticPort" in value && !isValidConsoleStaticPort(value.consoleStaticPort);
   return { data, changed };
 }
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function isValidConsoleStaticPort(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= MIN_CONSOLE_STATIC_PORT && value <= MAX_CONSOLE_STATIC_PORT;
+}
 function createGlobalOptionsService(deps = {}) {
   const store2 = deps.store ?? createGlobalOptionsStore({ dataDir: deps.dataDir });
   return {
@@ -40736,6 +40743,8 @@ function requireCarrierConfig(registry3, carrierId) {
 }
 
 // src/global-settings-routes.ts
+var MIN_CONSOLE_STATIC_PORT2 = 1024;
+var MAX_CONSOLE_STATIC_PORT2 = 65535;
 var GLOBAL_SETTINGS_API_CATALOG = [
   {
     method: "GET",
@@ -40799,10 +40808,20 @@ async function mutateGlobalSettings(req, res, deps) {
     deps.writeJson(res, 400, { error: "invalid_enable_metaphor" });
     return;
   }
+  if (body.consolePortMode !== void 0 && body.consolePortMode !== "dynamic" && body.consolePortMode !== "static") {
+    deps.writeJson(res, 400, { error: "invalid_console_port_mode" });
+    return;
+  }
+  if (body.consoleStaticPort !== void 0 && body.consoleStaticPort !== null && !isValidConsoleStaticPort2(body.consoleStaticPort)) {
+    deps.writeJson(res, 400, { error: "invalid_console_static_port" });
+    return;
+  }
   const updated = deps.globalOptionsService.update((current) => ({
     ...current,
     ...typeof body.replaceSystemPrompt === "boolean" ? { replaceSystemPrompt: body.replaceSystemPrompt } : {},
-    ...typeof body.enableMetaphor === "boolean" ? { enableMetaphor: body.enableMetaphor } : {}
+    ...typeof body.enableMetaphor === "boolean" ? { enableMetaphor: body.enableMetaphor } : {},
+    ...body.consolePortMode === "dynamic" || body.consolePortMode === "static" ? { consolePortMode: body.consolePortMode } : {},
+    ...isValidConsoleStaticPort2(body.consoleStaticPort) ? { consoleStaticPort: body.consoleStaticPort } : {}
   }));
   const response = { state: toGlobalSettingsState(updated) };
   deps.writeJson(res, 200, response);
@@ -40810,13 +40829,18 @@ async function mutateGlobalSettings(req, res, deps) {
 function toGlobalSettingsState(data) {
   return {
     replaceSystemPrompt: data.replaceSystemPrompt ?? false,
-    enableMetaphor: data.enableMetaphor ?? false
+    enableMetaphor: data.enableMetaphor ?? false,
+    consolePortMode: data.consolePortMode ?? "dynamic",
+    consoleStaticPort: data.consoleStaticPort ?? null
   };
 }
 function isJsonRequest2(req) {
   const contentType = req.headers["content-type"];
   return typeof contentType === "string" && contentType.toLowerCase().split(";")[0]?.trim() === "application/json";
 }
+function isValidConsoleStaticPort2(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= MIN_CONSOLE_STATIC_PORT2 && value <= MAX_CONSOLE_STATIC_PORT2;
+}
 
 // src/model-auth-routes.ts
 var MODEL_AUTH_PROVIDERS = [
@@ -44608,6 +44632,8 @@ function createConsoleUpdateCheckService(deps = {}) {
 // src/server.ts
 var DEFAULT_HOST2 = "127.0.0.1";
 var DEFAULT_PORT2 = 0;
+var MIN_CONSOLE_STATIC_PORT3 = 1024;
+var MAX_CONSOLE_STATIC_PORT3 = 65535;
 var SHELL_TERMINAL_SESSION_ID = "shell";
 var THEATER_SHELL_SESSION_PREFIX2 = "shell:";
 var SERVER_TIMEOUT_MS = 30 * 60 * 1e3;
@@ -44778,7 +44804,7 @@ var SERVER_API_CATALOG = [
 ];
 function createConsoleServer(deps = {}) {
   const host = deps.host ?? DEFAULT_HOST2;
-  const port = deps.port ?? DEFAULT_PORT2;
+  const injectedPort = deps.port ?? DEFAULT_PORT2;
   const release = deps.release ?? readFleetConsoleRelease();
   const version2 = deps.version ?? release.version;
   const channel = release.channel;
@@ -44818,7 +44844,7 @@ function createConsoleServer(deps = {}) {
     cwd: deps.codexCwd ?? process.cwd(),
     host,
     version: version2,
-    getPort: () => lockHandle?.payload.port ?? port,
+    getPort: () => lockHandle?.payload.port ?? portState.effectivePort,
     getAdminToken: () => lockHandle?.payload.token ?? null
   });
   const pendingRuntimeSessions = /* @__PURE__ */ new Map();
@@ -44866,7 +44892,7 @@ function createConsoleServer(deps = {}) {
   });
   const terminalUpgrade = createTerminalUpgradeHandler({
     expectedHost: host,
-    getExpectedPort: () => lockHandle?.payload.port ?? port,
+    getExpectedPort: () => lockHandle?.payload.port ?? portState.effectivePort,
     tickets: terminalTickets,
     sessions: terminalSessions,
     validateHost
@@ -44876,6 +44902,12 @@ function createConsoleServer(deps = {}) {
   let lockHandle = null;
   let activeLockFile = null;
   let activeEndpoint = null;
+  let portState = {
+    requestedPort: null,
+    effectivePort: injectedPort,
+    portMode: "dynamic",
+    portHonored: true
+  };
   let agentRuntimeStopped = false;
   let consoleResourcesDisposed = false;
   let updateApplyInFlight = false;
@@ -44909,7 +44941,7 @@ function createConsoleServer(deps = {}) {
       runAsyncBooleanHandler(codex.handle(req, res), res, () => tryServeStaticConsole(req, res, pathname));
       return;
     }
-    if (!validateHost(req, lockHandle?.payload.port ?? port)) {
+    if (!validateHost(req, lockHandle?.payload.port ?? portState.effectivePort)) {
       writeJson(res, 403, { error: "host_mismatch" });
       return;
     }
@@ -45036,7 +45068,11 @@ function createConsoleServer(deps = {}) {
       endpoint: payload.endpoint,
       startedAt: payload.startedAt,
       version: payload.version,
-      workspaceCount: observability.workspaceCount()
+      workspaceCount: observability.workspaceCount(),
+      portMode: portState.portMode,
+      requestedPort: portState.requestedPort,
+      effectivePort: portState.effectivePort,
+      portHonored: portState.portHonored
     };
     writeJson(res, 200, body);
   }
@@ -45439,7 +45475,11 @@ function createConsoleServer(deps = {}) {
       version: version2,
       channel,
       ...updateCheck.getStatus(),
-      port: lockHandle?.payload.port ?? port,
+      port: lockHandle?.payload.port ?? portState.effectivePort,
+      portMode: portState.portMode,
+      requestedPort: portState.requestedPort,
+      effectivePort: portState.effectivePort,
+      portHonored: portState.portHonored,
       wikiServerStatus: resolveWikiServerStatus(theaterId)
     };
     writeJson(res, 200, payload);
@@ -45562,11 +45602,11 @@ function createConsoleServer(deps = {}) {
   }
   function isTerminalAuthorized(req) {
     if (!lockHandle) return false;
-    return isAllowedTerminalOrigin(req, lockHandle.payload.port ?? port);
+    return isAllowedTerminalOrigin(req, lockHandle.payload.port ?? portState.effectivePort);
   }
   function isExactConsoleOrigin(req) {
     if (!lockHandle) return false;
-    return req.headers.origin === `http://127.0.0.1:${lockHandle.payload.port ?? port}`;
+    return req.headers.origin === `http://127.0.0.1:${lockHandle.payload.port ?? portState.effectivePort}`;
   }
   function listVisibleWorkspaces(requestedTenantId) {
     if (requestedTenantId) {
@@ -45740,36 +45780,19 @@ function createConsoleServer(deps = {}) {
   }
   const returnedServer = {
     host,
-    port,
+    port: injectedPort,
     async start(lockPaths) {
       if (server && lockHandle) return lockHandle.payload.endpoint;
       try {
         await rehydrateDurableState();
-        await new Promise((resolve, reject) => {
-          const srv = createHttpServer(handleRequest, terminalUpgrade);
-          srv.once("error", reject);
-          srv.listen(port, host, async () => {
-            srv.off("error", reject);
-            const address = srv.address();
-            const actualPort = typeof address === "object" && address ? address.port : port;
-            const endpoint = `http://${host}:${actualPort}/`;
-            try {
-              const localLoopbackServer = await maybeStartLoopbackServer(host, actualPort, handleRequest, terminalUpgrade);
-              server = srv;
-              loopbackServer = localLoopbackServer;
-              lockHandle = lock.writeLock({ dir: lockPaths.dir, lockFile: lockPaths.lockFile, pid: process.pid, port: actualPort, endpoint, version: version2 });
-              activeLockFile = lockPaths.lockFile;
-              activeEndpoint = endpoint;
-              resolve();
-            } catch (err) {
-              await closeHttpServer(srv);
-              await closeHttpServer(loopbackServer);
-              server = null;
-              loopbackServer = null;
-              reject(err);
-            }
-          });
-        });
+        const listenPlan = resolveConsolePortListenPlan();
+        const result = await listenConsolePort(listenPlan);
+        server = result.srv;
+        loopbackServer = result.localLoopbackServer;
+        portState = result.portState;
+        lockHandle = lock.writeLock({ dir: lockPaths.dir, lockFile: lockPaths.lockFile, pid: process.pid, port: result.actualPort, endpoint: result.endpoint, version: version2 });
+        activeLockFile = lockPaths.lockFile;
+        activeEndpoint = result.endpoint;
       } catch (error51) {
         await cleanupAfterFailedStart();
         throw error51;
@@ -45782,6 +45805,78 @@ function createConsoleServer(deps = {}) {
       await stopServer();
     }
   };
+  function resolveConsolePortListenPlan() {
+    if (deps.port !== void 0) {
+      return {
+        port: injectedPort,
+        requestedPort: null,
+        portMode: "dynamic",
+        allowFallback: false
+      };
+    }
+    const options = infraServices.globalOptionsService.load();
+    if (options.consolePortMode === "static" && isValidConsoleStaticPort3(options.consoleStaticPort)) {
+      return {
+        port: options.consoleStaticPort,
+        requestedPort: options.consoleStaticPort,
+        portMode: "static",
+        allowFallback: true
+      };
+    }
+    return {
+      port: DEFAULT_PORT2,
+      requestedPort: null,
+      portMode: "dynamic",
+      allowFallback: false
+    };
+  }
+  async function listenConsolePort(plan) {
+    try {
+      return await listenOnce(plan.port, {
+        requestedPort: plan.requestedPort,
+        portMode: plan.portMode,
+        portHonored: true
+      });
+    } catch (error51) {
+      if (!plan.allowFallback || plan.requestedPort === null) throw error51;
+      return listenOnce(DEFAULT_PORT2, {
+        requestedPort: plan.requestedPort,
+        portMode: "static",
+        portHonored: false
+      });
+    }
+  }
+  function listenOnce(portToBind, statePatch) {
+    return new Promise((resolve, reject) => {
+      const srv = createHttpServer(handleRequest, terminalUpgrade);
+      const onError = (error51) => {
+        reject(error51);
+      };
+      srv.once("error", onError);
+      srv.listen(portToBind, host, async () => {
+        srv.off("error", onError);
+        const address = srv.address();
+        const actualPort = typeof address === "object" && address ? address.port : portToBind;
+        const endpoint = `http://${host}:${actualPort}/`;
+        try {
+          const localLoopbackServer = await maybeStartLoopbackServer(host, actualPort, handleRequest, terminalUpgrade);
+          resolve({
+            srv,
+            localLoopbackServer,
+            actualPort,
+            endpoint,
+            portState: {
+              ...statePatch,
+              effectivePort: actualPort
+            }
+          });
+        } catch (err) {
+          await closeHttpServer(srv);
+          reject(err);
+        }
+      });
+    });
+  }
   return returnedServer;
 }
 function resolveCarrierEventOrigin(event, jobOriginById) {
@@ -45934,6 +46029,9 @@ function validateHost(req, expectedPort) {
   if (!hostHeader) return false;
   return hostHeader === `127.0.0.1:${expectedPort}`;
 }
+function isValidConsoleStaticPort3(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= MIN_CONSOLE_STATIC_PORT3 && value <= MAX_CONSOLE_STATIC_PORT3;
+}
 function isAllowedTerminalOrigin(req, expectedPort) {
   const origin = req.headers.origin;
   if (origin === void 0) return true;