Hi @bmx,
Port 4560 is for incoming OSC events. These just come in and get registered as OSC messages that don’t do anything unless you specifically write code that will get triggered when new events come in.
If port 4560 were to run arbitrary code coming in on an open port, that would be a huge security risk (it would essentially allow anyone who can send network messages to your machine to run arbitrary code on your machine).
Sonic Pi therefore runs a separate OSC server for the server API which includes /run-code but only listens on the local loopback network so remote machines cannot send to it. Also, for additional security this port is now randomised on boot. In the future things are likely to get even more constrained, but I will also be working on making it easy to boot a GUI-less server that allows you to set the port on boot, which should make working with external editors like VS Code much easier 