@bitkyc08/opencodex 2.6.12 → 2.6.14-preview.20260701

package/src/doctor.ts

@@ -0,0 +1,173 @@
+/**
+ * `ocx doctor` - read-only environment diagnostics.
+ *
+ * Explains WHY ChatGPT quota may never populate (and thus why account
+ * auto-switch can appear stuck), especially on WSL2 where outbound fetch to
+ * chatgpt.com can be blocked by NAT/DNS/VPN/proxy differences. Observe-only:
+ * it never sets proxy env, relocates state dirs, mutates quota, or changes
+ * networking. See devlog/_plan/260630_wsl-account-autoswitch/30_*.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { getConfigDir, getConfigPath } from "./config";
+import { readCodexTokens } from "./codex-auth-collision";
+
+const WHAM_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
+const PROBE_TIMEOUT_MS = 8000;
+
+export type PathRow = { label: string; path: string; exists: boolean };
+
+export function resolveCodexHomeDir(): string {
+  const raw = process.env["CODEX_HOME"]?.trim();
+  return raw ? resolve(raw) : join(homedir(), ".codex");
+}
+
+export function collectPaths(): PathRow[] {
+  const codexHome = resolveCodexHomeDir();
+  const opencodexHome = getConfigDir();
+  return [
+    { label: "CODEX_HOME", path: codexHome, exists: existsSync(codexHome) },
+    { label: "CODEX_HOME/auth.json", path: join(codexHome, "auth.json"), exists: existsSync(join(codexHome, "auth.json")) },
+    { label: "OPENCODEX_HOME", path: opencodexHome, exists: existsSync(opencodexHome) },
+    { label: "OPENCODEX_HOME/config.json", path: getConfigPath(), exists: existsSync(getConfigPath()) },
+  ];
+}
+
+export type FsTypeInfo = { fstype: string; mount: string; isDrvfs: boolean; isMntDrive: boolean };
+
+/**
+ * Parse `/proc/mounts`-shaped content and return the longest mount-point prefix
+ * covering `path`. `mountsContent` is injectable for testing; in production the
+ * caller passes the real file (or null off-Linux -> "n/a").
+ */
+export function detectFsType(path: string, mountsContent: string | null): FsTypeInfo {
+  const isMntDrive = /^\/mnt\/[a-z]\//i.test(path) || /^\/mnt\/[a-z]$/i.test(path);
+  if (!mountsContent) {
+    return { fstype: "n/a", mount: "", isDrvfs: false, isMntDrive };
+  }
+  let best: { mount: string; fstype: string } | null = null;
+  for (const line of mountsContent.split("\n")) {
+    const parts = line.split(/\s+/);
+    if (parts.length < 3) continue;
+    const mount = parts[1]!;
+    const fstype = parts[2]!;
+    if (path === mount || path.startsWith(mount.endsWith("/") ? mount : `${mount}/`) || mount === "/") {
+      if (!best || mount.length > best.mount.length) best = { mount, fstype };
+    }
+  }
+  const fstype = best?.fstype ?? "unknown";
+  return {
+    fstype,
+    mount: best?.mount ?? "",
+    isDrvfs: fstype === "drvfs" || fstype === "9p",
+    isMntDrive,
+  };
+}
+
+function readMounts(): string | null {
+  try {
+    return process.platform === "linux" ? readFileSync("/proc/mounts", "utf-8") : null;
+  } catch {
+    return null;
+  }
+}
+
+const PROXY_KEYS = ["HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "NO_PROXY"] as const;
+
+export type ProxyEnvRow = { key: string; present: boolean };
+
+/** Report only presence/absence of proxy env vars - never the value (it may
+ * embed credentials). Checks both upper- and lower-case forms. */
+export function collectProxyEnv(): ProxyEnvRow[] {
+  return PROXY_KEYS.map(key => ({
+    key,
+    present: !!(process.env[key]?.trim() || process.env[key.toLowerCase()]?.trim()),
+  }));
+}
+
+export type WhamProbeResult = {
+  ok: boolean;
+  status: number | null;
+  durationMs: number;
+  classification: "ok" | "timeout" | "connect_error" | string;
+  authenticated: boolean;
+};
+
+/**
+ * Replicate the runtime WHAM fetch shape (same URL, 8s timeout, main-token
+ * headers when present) so the probe fails exactly where the real path fails.
+ * `fetchImpl` is injectable for testing.
+ */
+export async function probeWham(fetchImpl: typeof fetch = fetch): Promise<WhamProbeResult> {
+  const tokens = readCodexTokens();
+  const headers: Record<string, string> = {};
+  if (tokens) {
+    headers.Authorization = `Bearer ${tokens.access_token}`;
+    headers["ChatGPT-Account-Id"] = tokens.account_id;
+  }
+  const start = performance.now();
+  try {
+    const resp = await fetchImpl(WHAM_USAGE_URL, { headers, signal: AbortSignal.timeout(PROBE_TIMEOUT_MS) });
+    const durationMs = Math.round(performance.now() - start);
+    return {
+      ok: resp.ok,
+      status: resp.status,
+      durationMs,
+      classification: resp.ok ? "ok" : `http_${resp.status}`,
+      authenticated: !!tokens,
+    };
+  } catch (err) {
+    const durationMs = Math.round(performance.now() - start);
+    const name = err instanceof Error ? err.name : String(err);
+    const classification = name === "TimeoutError" || name === "AbortError"
+      ? "timeout"
+      : "connect_error";
+    return { ok: false, status: null, durationMs, classification, authenticated: !!tokens };
+  }
+}
+
+export async function runDoctor(): Promise<void> {
+  console.log("opencodex doctor\n");
+
+  const paths = collectPaths();
+  const mounts = readMounts();
+  console.log("Paths");
+  for (const row of paths) {
+    const fs = detectFsType(row.path, mounts);
+    const flags = [fs.fstype !== "n/a" ? `fs=${fs.fstype}` : null, fs.isDrvfs || fs.isMntDrive ? "WSL /mnt drive" : null]
+      .filter(Boolean).join(", ");
+    console.log(`  ${row.exists ? "ok " : "-- "} ${row.label}: ${row.path}${flags ? `  (${flags})` : ""}`);
+  }
+
+  console.log("\nProxy env (presence only)");
+  for (const row of collectProxyEnv()) {
+    console.log(`  ${row.present ? "set    " : "unset  "} ${row.key}`);
+  }
+
+  console.log("\nWHAM reachability");
+  const probe = await probeWham();
+  const detail = probe.status !== null ? `status=${probe.status}` : `error=${probe.classification}`;
+  console.log(`  ${probe.ok ? "ok " : "-- "} ${WHAM_USAGE_URL}`);
+  console.log(`       ${detail}, ${probe.durationMs}ms, ${probe.authenticated ? "authenticated" : "unauthenticated"}`);
+
+  // Hints, not fixes.
+  const hints: string[] = [];
+  const anyDrvfs = paths.some(p => detectFsType(p.path, mounts).isDrvfs || detectFsType(p.path, mounts).isMntDrive);
+  const noProxy = collectProxyEnv().every(p => !p.present);
+  if (anyDrvfs) {
+    hints.push("State dir is on a Windows-mounted (/mnt) drive. Prefer the Linux home (~) under WSL for token/lock reliability.");
+  }
+  if (!probe.ok) {
+    if (probe.classification === "timeout" || probe.classification === "connect_error") {
+      hints.push("WHAM probe could not reach chatgpt.com. On WSL2 this is often NAT/DNS/VPN. Quota cannot prime, so auto-switch stays on unknown scores.");
+      if (noProxy) {
+        hints.push("No *_PROXY env is set in this WSL process. If Windows uses a proxy/VPN, set HTTP(S)_PROXY here or enable WSL autoProxy so Bun fetch can reach the network.");
+      }
+    }
+  }
+  if (hints.length > 0) {
+    console.log("\nHints");
+    for (const h of hints) console.log(`  - ${h}`);
+  }
+}

package/src/oauth/anthropic.ts

@@ -13,7 +13,7 @@ const SCOPES = "org:create_api_key user:profile user:inference";
 // ── OAuth-request requirements applied by the anthropic adapter when authMode==="oauth" ──
 export const ANTHROPIC_OAUTH_BETA = "claude-code-20250219,oauth-2025-04-20";
 export const CLAUDE_CODE_SYSTEM_INSTRUCTION = "You are a Claude agent, built on Anthropic's Claude Agent SDK.";
-const CLAUDE_TOOL_PREFIX = "proxy_";
+const CLAUDE_TOOL_PREFIX = "custom_";
 const ANTHROPIC_BUILTIN_TOOLS = new Set(["web_search", "code_execution", "text_editor", "computer"]);
 
 /** OAuth tokens reject arbitrary tool names; prefix custom tools (Anthropic builtins are exempt). */
@@ -22,7 +22,7 @@ export function applyClaudeToolPrefix(name: string): string {
   return CLAUDE_TOOL_PREFIX + name;
 }
 
-/** Strip the proxy_ prefix from a returned tool_use name so the caller (Codex) sees the original. */
+/** Strip the custom_ prefix from a returned tool_use name so the caller (Codex) sees the original. */
 export function stripClaudeToolPrefix(name: string): string {
   return name.startsWith(CLAUDE_TOOL_PREFIX) ? name.slice(CLAUDE_TOOL_PREFIX.length) : name;
 }

package/src/oauth/google-antigravity.ts

@@ -12,6 +12,7 @@
 import { OAuthCallbackFlow, type OAuthCallbackFlowOptions } from "./callback-server";
 import { generatePKCE } from "./pkce";
 import type { OAuthController, OAuthCredentials } from "./types";
+import { antigravityUserAgent, ANTIGRAVITY_GOOG_API_CLIENT_UA } from "../adapters/client-fingerprint";
 
 const CLIENT_ID = process.env.GOOGLE_ANTIGRAVITY_CLIENT_ID
   || "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com";
@@ -94,7 +95,7 @@ function extractProjectId(data: Record<string, unknown> | undefined): string | u
 async function loadCodeAssistProject(accessToken: string, signal?: AbortSignal): Promise<string | undefined> {
   const response = await fetch(`${PROD_API}/${API_VERSION}:loadCodeAssist`, {
     method: "POST",
-    headers: { Authorization: `Bearer ${accessToken}`, Accept: "*/*", "Content-Type": "application/json" },
+    headers: { Authorization: `Bearer ${accessToken}`, Accept: "*/*", "Content-Type": "application/json", "User-Agent": antigravityUserAgent() },
     body: JSON.stringify({ metadata: { ideType: "ANTIGRAVITY" } }),
     signal: requestSignal(signal),
   });
@@ -107,8 +108,8 @@ async function onboardProject(accessToken: string, signal?: AbortSignal): Promis
     if (signal?.aborted) throw signal.reason ?? new Error("Antigravity onboarding aborted");
     const response = await fetch(`${DAILY_API}/${API_VERSION}:onboardUser`, {
       method: "POST",
-      headers: { Authorization: `Bearer ${accessToken}`, Accept: "*/*", "Content-Type": "application/json" },
-      body: JSON.stringify({ tier_id: "free-tier", metadata: { ide_type: "ANTIGRAVITY", ide_name: "antigravity" } }),
+      headers: { Authorization: `Bearer ${accessToken}`, Accept: "*/*", "Content-Type": "application/json", "User-Agent": antigravityUserAgent(), "x-goog-api-client": ANTIGRAVITY_GOOG_API_CLIENT_UA },
+      body: JSON.stringify({ tier_id: "free-tier", metadata: { ide_type: "ANTIGRAVITY", ide_name: "antigravity", ide_version: antigravityUserAgent() } }),
       signal: requestSignal(signal),
     });
     if (!response.ok) {

package/src/oauth/kimi.ts

@@ -12,7 +12,7 @@ const DEVICE_ID_FILENAME = "kimi-device-id";
 const DEFAULT_POLL_INTERVAL_MS = 5000;
 const DEFAULT_DEVICE_FLOW_TTL_MS = 15 * 60 * 1000;
 const OAUTH_EXPIRY_SKEW_MS = 5 * 60 * 1000;
-const KIMI_CLI_VERSION = "1.0.0";
+const KIMI_CLI_VERSION = "0.14.0";
 
 interface DeviceAuthorizationResponse {
   user_code?: string;
@@ -70,7 +70,7 @@ function getDeviceId(): string {
 function getKimiCommonHeaders(): Record<string, string> {
   return {
     "User-Agent": `KimiCLI/${KIMI_CLI_VERSION}`,
-    "X-Msh-Platform": "kimi_cli",
+    "X-Msh-Platform": "kimi_code_cli",
     "X-Msh-Version": KIMI_CLI_VERSION,
     "X-Msh-Device-Name": os.hostname(),
     "X-Msh-Device-Model": getDeviceModel(),

package/src/server/adapter-resolve.ts

@@ -0,0 +1,43 @@
+import { createAnthropicAdapter } from "../adapters/anthropic";
+import { createAzureAdapter } from "../adapters/azure";
+import { createGoogleAdapter } from "../adapters/google";
+import { createKiroAdapter } from "../adapters/kiro";
+import { createOpenAIChatAdapter } from "../adapters/openai-chat";
+import { createResponsesPassthroughAdapter } from "../adapters/openai-responses";
+import type { OcxProviderConfig } from "../types";
+
+/** Providers whose listed model ids must be driven over the Anthropic wire even if the provider's
+ *  configured adapter is something else (the upstream only speaks Anthropic for these models). */
+const ANTHROPIC_WIRE_MODELS: Record<string, Set<string>> = {
+  "opencode-go": new Set(["minimax-m2.5", "minimax-m2.7", "minimax-m3", "qwen3.5-plus", "qwen3.6-plus", "qwen3.7-max", "qwen3.7-plus"]),
+};
+
+/** Return a provider config whose adapter is forced to "anthropic" when the model id is wire-pinned. */
+export function resolveWireProtocolOverride(providerName: string, modelId: string, providerConfig: OcxProviderConfig): OcxProviderConfig {
+  const overrideSet = ANTHROPIC_WIRE_MODELS[providerName];
+  if (overrideSet?.has(modelId) && providerConfig.adapter !== "anthropic") {
+    return { ...providerConfig, adapter: "anthropic" };
+  }
+  return providerConfig;
+}
+
+/** Build the provider adapter for a resolved provider config. */
+export function resolveAdapter(providerConfig: OcxProviderConfig) {
+  switch (providerConfig.adapter) {
+    case "openai-chat":
+      return createOpenAIChatAdapter(providerConfig);
+    case "anthropic":
+      return createAnthropicAdapter(providerConfig);
+    case "openai-responses":
+      return createResponsesPassthroughAdapter(providerConfig);
+    case "google":
+      return createGoogleAdapter(providerConfig);
+    case "kiro":
+      return createKiroAdapter(providerConfig);
+    case "azure":
+    case "azure-openai":
+      return createAzureAdapter(providerConfig);
+    default:
+      throw new Error(`Unknown adapter: ${providerConfig.adapter}`);
+  }
+}

package/src/server/gui-static.ts

@@ -0,0 +1,98 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { extname, isAbsolute, join, relative, resolve } from "node:path";
+
+/** opencodex version, read from the packaged package.json (same source as the server bootstrap). */
+const VERSION = (() => {
+  try {
+    return JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8")).version as string;
+  } catch {
+    return "0.0.0";
+  }
+})();
+
+const MIME_TYPES: Record<string, string> = {
+  ".html": "text/html", ".js": "application/javascript", ".css": "text/css",
+  ".json": "application/json", ".svg": "image/svg+xml", ".png": "image/png",
+  ".ico": "image/x-icon",
+};
+
+function findGuiDist(): string | null {
+  const candidates = [
+    join(import.meta.dir, "..", "..", "gui", "dist"),
+    join(import.meta.dir, "..", "..", "..", "gui", "dist"),
+  ];
+  for (const c of candidates) {
+    if (existsSync(join(c, "index.html"))) return c;
+  }
+  return null;
+}
+
+export function resolveGuiFilePath(guiDist: string, pathname: string): string | null {
+  let decodedPath: string;
+  try {
+    decodedPath = decodeURIComponent(pathname);
+  } catch {
+    return null;
+  }
+  if (decodedPath.includes("\0")) return null;
+
+  const relativePath = decodedPath === "/" || decodedPath === ""
+    ? "index.html"
+    : decodedPath.replace(/\\/g, "/").replace(/^\/+/, "");
+  const root = resolve(guiDist);
+  const filePath = resolve(root, relativePath);
+  const rel = relative(root, filePath);
+  if (rel === "" || rel.startsWith("..") || isAbsolute(rel)) return null;
+  return filePath;
+}
+
+function isFile(path: string): boolean {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+
+export function serveGuiFile(pathname: string): Response | null {
+  const guiDist = findGuiDist();
+  if (!guiDist) return null;
+  const filePath = resolveGuiFilePath(guiDist, pathname);
+  if (!filePath) return null;
+
+  if (!isFile(filePath)) {
+    if (!extname(pathname)) {
+      const indexPath = join(guiDist, "index.html");
+      if (isFile(indexPath)) {
+        return new Response(Bun.file(indexPath), {
+          headers: { "Content-Type": "text/html" },
+        });
+      }
+    }
+    return null;
+  }
+
+  const ext = extname(filePath);
+  const contentType = MIME_TYPES[ext] || "application/octet-stream";
+  return new Response(Bun.file(filePath), {
+    headers: { "Content-Type": contentType },
+  });
+}
+
+export function rootFallbackPayload() {
+  return {
+    status: "ok",
+    service: "opencodex",
+    version: VERSION,
+    dashboard: {
+      available: false,
+      reason: "GUI build not found. Run `bun run build:gui` from the opencodex repo, or use `ocx gui` from a packaged install.",
+    },
+    endpoints: {
+      health: "/healthz",
+      models: "/v1/models",
+      responses: "/v1/responses",
+      management: "/api/*",
+    },
+  };
+}

package/src/server.ts

@@ -1,12 +1,5 @@
-import { existsSync, readFileSync, statSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { timingSafeEqual } from "node:crypto";
-import { extname, isAbsolute, join, relative, resolve } from "node:path";
-import { createAnthropicAdapter } from "./adapters/anthropic";
-import { createAzureAdapter } from "./adapters/azure";
-import { createGoogleAdapter } from "./adapters/google";
-import { createKiroAdapter } from "./adapters/kiro";
-import { createOpenAIChatAdapter } from "./adapters/openai-chat";
-import { createResponsesPassthroughAdapter } from "./adapters/openai-responses";
 import { bridgeToResponsesSSE, buildResponseJSON, formatErrorResponse, type ResponsesTerminalStatus } from "./bridge";
 import { markActivity } from "./sidecar-tracker";
 import {
@@ -87,6 +80,10 @@ import {
   type CodexUpstreamOutcome,
 } from "./codex-routing";
 import { registerCodexWebSocket, unregisterCodexWebSocket, updateCodexWebSocketAuthContext } from "./codex-websocket-registry";
+import { resolveGuiFilePath, rootFallbackPayload, serveGuiFile } from "./server/gui-static";
+export { resolveGuiFilePath, rootFallbackPayload } from "./server/gui-static";
+import { resolveAdapter, resolveWireProtocolOverride } from "./server/adapter-resolve";
+export { resolveAdapter } from "./server/adapter-resolve";
 
 // ---------------------------------------------------------------------------
 // Active turn tracking + graceful shutdown drain
@@ -188,124 +185,10 @@ const VERSION = (() => {
   }
 })();
 
-const MIME_TYPES: Record<string, string> = {
-  ".html": "text/html", ".js": "application/javascript", ".css": "text/css",
-  ".json": "application/json", ".svg": "image/svg+xml", ".png": "image/png",
-  ".ico": "image/x-icon",
-};
+// GUI static serving extracted to ./server/gui-static. Re-exported below to keep the
+// "../src/server" import surface stable for tests/callers.
 
-function findGuiDist(): string | null {
-  const candidates = [
-    join(import.meta.dir, "..", "gui", "dist"),
-    join(import.meta.dir, "..", "..", "gui", "dist"),
-  ];
-  for (const c of candidates) {
-    if (existsSync(join(c, "index.html"))) return c;
-  }
-  return null;
-}
-
-export function resolveGuiFilePath(guiDist: string, pathname: string): string | null {
-  let decodedPath: string;
-  try {
-    decodedPath = decodeURIComponent(pathname);
-  } catch {
-    return null;
-  }
-  if (decodedPath.includes("\0")) return null;
-
-  const relativePath = decodedPath === "/" || decodedPath === ""
-    ? "index.html"
-    : decodedPath.replace(/\\/g, "/").replace(/^\/+/, "");
-  const root = resolve(guiDist);
-  const filePath = resolve(root, relativePath);
-  const rel = relative(root, filePath);
-  if (rel === "" || rel.startsWith("..") || isAbsolute(rel)) return null;
-  return filePath;
-}
-
-function isFile(path: string): boolean {
-  try {
-    return statSync(path).isFile();
-  } catch {
-    return false;
-  }
-}
-
-function serveGuiFile(pathname: string): Response | null {
-  const guiDist = findGuiDist();
-  if (!guiDist) return null;
-  const filePath = resolveGuiFilePath(guiDist, pathname);
-  if (!filePath) return null;
-
-  if (!isFile(filePath)) {
-    if (!extname(pathname)) {
-      const indexPath = join(guiDist, "index.html");
-      if (isFile(indexPath)) {
-        return new Response(Bun.file(indexPath), {
-          headers: { "Content-Type": "text/html" },
-        });
-      }
-    }
-    return null;
-  }
-
-  const ext = extname(filePath);
-  const contentType = MIME_TYPES[ext] || "application/octet-stream";
-  return new Response(Bun.file(filePath), {
-    headers: { "Content-Type": contentType },
-  });
-}
-
-export function rootFallbackPayload() {
-  return {
-    status: "ok",
-    service: "opencodex",
-    version: VERSION,
-    dashboard: {
-      available: false,
-      reason: "GUI build not found. Run `bun run build:gui` from the opencodex repo, or use `ocx gui` from a packaged install.",
-    },
-    endpoints: {
-      health: "/healthz",
-      models: "/v1/models",
-      responses: "/v1/responses",
-      management: "/api/*",
-    },
-  };
-}
-
-const ANTHROPIC_WIRE_MODELS: Record<string, Set<string>> = {
-  "opencode-go": new Set(["minimax-m2.5", "minimax-m2.7", "minimax-m3", "qwen3.5-plus", "qwen3.6-plus", "qwen3.7-max", "qwen3.7-plus"]),
-};
-
-function resolveWireProtocolOverride(providerName: string, modelId: string, providerConfig: OcxProviderConfig): OcxProviderConfig {
-  const overrideSet = ANTHROPIC_WIRE_MODELS[providerName];
-  if (overrideSet?.has(modelId) && providerConfig.adapter !== "anthropic") {
-    return { ...providerConfig, adapter: "anthropic" };
-  }
-  return providerConfig;
-}
-
-export function resolveAdapter(providerConfig: OcxProviderConfig) {
-  switch (providerConfig.adapter) {
-    case "openai-chat":
-      return createOpenAIChatAdapter(providerConfig);
-    case "anthropic":
-      return createAnthropicAdapter(providerConfig);
-    case "openai-responses":
-      return createResponsesPassthroughAdapter(providerConfig);
-    case "google":
-      return createGoogleAdapter(providerConfig);
-    case "kiro":
-      return createKiroAdapter(providerConfig);
-    case "azure":
-    case "azure-openai":
-      return createAzureAdapter(providerConfig);
-    default:
-      throw new Error(`Unknown adapter: ${providerConfig.adapter}`);
-  }
-}
+// Adapter resolution + wire-protocol override extracted to ./server/adapter-resolve.
 
 function sidecarOutcomeRecorder(config: OcxConfig, authCtx: CodexAuthContext): ((outcome: CodexUpstreamOutcome) => void) | undefined {
   return authCtx.kind === "pool" || authCtx.kind === "main-pool"
@@ -2310,5 +2193,13 @@ export function startServer(port?: number) {
   console.log(`   GET  /api/*        → management API`);
   console.log(`   GET  /             → GUI dashboard`);
 
+  // Prime pool-account quota in the background so the rotation engine has real
+  // usage scores from the first routing decision, even when the dashboard is
+  // never opened (the common CLI/WSL case). Fire-and-forget: never blocks the
+  // listener, and a blocked network silently no-ops (see Phase 30 diagnostics).
+  import("./codex-auth-api")
+    .then(({ primeCodexPoolQuotas }) => primeCodexPoolQuotas(config, "startup"))
+    .catch(() => {});
+
   return server;
 }