---
name: "OAuth callback URL ignores --port CLI flag"
---

# Bug 449: OAuth callback URL ignores --port CLI flag

## Description

OAuthState is initialized with `resolve_port()` (reads STORKIT_PORT env var, defaults to 3001) instead of the actual port the server is listening on. When the server is started with `--port 4000`, the OAuth callback URL is still generated as `http://localhost:3001/callback`, so the Anthropic redirect lands on the wrong server and the state parameter lookup fails with "Unknown or expired state parameter".

## How to Reproduce

Start huskies with `--port 4000` (without setting STORKIT_PORT env var). Click the OAuth login button in the web UI. Authenticate with Anthropic. The callback redirect goes to localhost:3001 instead of localhost:4000.

## Actual Result

Callback hits port 3001 (or wrong port). If a different huskies is running there, it returns "Invalid State". If nothing is running there, the page fails to load.

## Expected Result

Callback URL should use the actual server port (from --port CLI flag), so the redirect returns to the correct server instance.

## Acceptance Criteria

- [ ] build_routes receives the actual listening port and passes it to OAuthState::new
- [ ] OAuth callback URL matches the port the server is actually listening on
- [ ] Works with --port flag, STORKIT_PORT env var, and default port
