codex-proxy follow-up from PR #431: single-source the agy-proxy, clef-proxy and antigravity-ls-proxy ports too #435

Finding

PR #431 single-sources the codex-proxy port (18744) and explicitly leaves the same pattern in the sibling proxies as a follow-up — its body and commit message both say: "Follow-up (not in this change): agy-proxy (18743) and clef-proxy have the same two-copies pattern." No issue was ever filed for it (issue searches for agy-proxy, CODEX_PROXY_PORT, "proxy port" and "codex-proxy" return no tracking issue). This issue files that promised follow-up, and adds a third instance the PR didn't mention.

Evidence (all on current main, verified 2026-10-20)

• agy-proxy (18743) — three copies, identical to the codex case PR codex-proxy: single-source the port via CODEX_PROXY_PORT #431 fixed:
  • .opencode/opencode.jsonc:1850: "baseURL": "http://127.0.0.1:18743/v1" (antigravity-agy provider)
  • home/common/default.nix:483: "AGY_PROXY_PORT=18743" in the agy-proxy systemd user service
  • bin/agy-proxy.mjs:7: fallback process.env.AGY_PROXY_PORT || '18743'
• antigravity-ls-proxy (18745) — same three copies, not mentioned in PR codex-proxy: single-source the port via CODEX_PROXY_PORT #431:
  • .opencode/opencode.jsonc:1932: "baseURL": "http://127.0.0.1:18745/v1" (antigravity-ls provider)
  • home/common/default.nix:529: "ANTIGRAVITY_LS_PROXY_PORT=18745" in the service
  • bin/antigravity-ls-proxy.mjs:7: fallback process.env.ANTIGRAVITY_LS_PROXY_PORT || '18745'
• clef-proxy (18742) — two copies (no opencode.jsonc consumer; its models go through the Cloudflare gateway, so the copies are the service env and the script fallback):
  • home/common/default.nix:460: "CLEF_PROXY_PORT=18742"
  • bin/clef-proxy.mjs:7: fallback process.env.CLEF_PROXY_PORT || '18742'

For comparison, the pattern PR #431 removed for codex was: home/common/default.nix:506 "CODEX_PROXY_PORT=18744" + .opencode/opencode.jsonc:2668 hardcoded baseURL.

Why it matters

These are the same silent-drift failure PR #431 fixed for codex: change or collide one copy and the provider dies with an error that looks like a network/auth problem. Leaving them untracked guarantees the pattern is rediscovered per-proxy, one incident at a time.

Acceptance criteria

• Each proxy's port is defined once (in the home/common/default.nix let block, alongside codexProxyPort) and flows to its systemd service environment, the shell session variables, and — for agy and antigravity-ls — the opencode.jsonc baseURL, following the PR codex-proxy: single-source the port via CODEX_PROXY_PORT #431 pattern.
• Any {env:...} baseURL introduced by this work handles the variable-unset case consistently with however the CODEX_PROXY_PORT unset case is resolved (the scripts' built-in fallbacks and the client config must not be able to disagree).
• A grep for the literal ports 18742/18743/18745 in .opencode/opencode.jsonc and the service Environment lists in home/common/default.nix returns no remaining hardcoded copies (script fallbacks may keep the literal as the documented default).