fix(api): widen dual-stack fallback process-wide

Move the IPv6-to-IPv4 fallback timeout from per-request https agents to a
single process-wide setting.

The per-request agents only covered four axios calls, so `detectRegion` in
src/utils/urls.ts still failed first, along with the oauth, provisioning
and MCP profile calls. Setting the Node default covers every client in the
process, including posthog-node, the agent SDK and MCP.

Replaces the two mock-based tests, which asserted the config object was
passed rather than that the timeout changed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: 2 people

bin.ts

@@ -2,6 +2,8 @@
 import { satisfies } from 'semver';
 import { ErrorCodes } from './src/lib/errors/codes.js';
 import { emitWizardError } from './src/lib/errors/emit.js';
+// Only pulls in node:net, so safe to hoist above the version guard.
+import { configureDualStackFallback } from './src/lib/net-tuning.js';
 
 // Keep in sync with `engines.node` in package.json. npx does not enforce
 // engines, so this preflight is the only thing standing between an old Node
@@ -35,6 +37,9 @@ if (!satisfies(process.version, NODE_VERSION_RANGE)) {
   process.exit(1);
 }
 
+// Must run before any network client opens a connection.
+configureDualStackFallback();
+
 // Test mock server — only loaded when NODE_ENV is 'test'.
 // In production builds, tsdown replaces process.env.NODE_ENV with 'production',
 // making this block dead code.

src/lib/__tests__/api-transport.test.ts

@@ -0,0 +1,26 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import {
+  DUAL_STACK_ATTEMPT_TIMEOUT_MS,
+  configureDualStackFallback,
+  dualStackNet,
+} from '../net-tuning';
+
+describe('configureDualStackFallback', () => {
+  const original = dualStackNet.getDefaultAutoSelectFamilyAttemptTimeout();
+
+  afterEach(() => {
+    dualStackNet.setDefaultAutoSelectFamilyAttemptTimeout(original);
+  });
+
+  it('raises the attempt timeout above the 250ms Node default', () => {
+    configureDualStackFallback();
+
+    expect(dualStackNet.getDefaultAutoSelectFamilyAttemptTimeout()).toBe(
+      DUAL_STACK_ATTEMPT_TIMEOUT_MS,
+    );
+  });
+
+  it('leaves enough headroom for a slow IPv4 connect', () => {
+    expect(DUAL_STACK_ATTEMPT_TIMEOUT_MS).toBeGreaterThanOrEqual(1_000);
+  });
+});

src/lib/__tests__/net-tuning.test.ts

@@ -1,15 +1,8 @@
-import { Agent } from 'node:https';
 import axios, { AxiosError } from 'axios';
 import { z } from 'zod';
 import { analytics } from '@utils/analytics';
 import { WIZARD_USER_AGENT } from './constants';
 
-// Node defaults to 250ms between IPv6 and IPv4 connection attempts, which is
-// too short for some regional PostHog API connections after OAuth completes.
-export const posthogApiHttpsAgent = new Agent({
-  autoSelectFamilyAttemptTimeout: 2_000,
-});
-
 /**
  * User payload from `/api/users/@me/`. Schema typed for the fields the
  * wizard actually reads + passthrough on everything else so the full
@@ -155,7 +148,6 @@ export async function fetchUserData(
         Authorization: `Bearer ${accessToken}`,
         'User-Agent': WIZARD_USER_AGENT,
       },
-      httpsAgent: posthogApiHttpsAgent,
     });
 
     return ApiUserSchema.parse(response.data);
@@ -195,7 +187,6 @@ export async function fetchRecentActivity(
           Authorization: `Bearer ${accessToken}`,
           'User-Agent': WIZARD_USER_AGENT,
         },
-        httpsAgent: posthogApiHttpsAgent,
         // Short timeout — best-effort probe, not a critical path.
         timeout: 4000,
       },
@@ -224,7 +215,6 @@ export async function fetchProjectData(
         Authorization: `Bearer ${accessToken}`,
         'User-Agent': WIZARD_USER_AGENT,
       },
-      httpsAgent: posthogApiHttpsAgent,
     });
 
     return ApiProjectSchema.parse(response.data);
@@ -263,7 +253,6 @@ export async function fetchSlackConnected(
         Authorization: `Bearer ${accessToken}`,
         'User-Agent': WIZARD_USER_AGENT,
       },
-      httpsAgent: posthogApiHttpsAgent,
       signal,
     },
   );

src/lib/api.ts

@@ -0,0 +1,19 @@
+import net from 'node:net';
+
+/** Node's 250ms default kills a slow IPv4 connect when IPv6 is unroutable. */
+export const DUAL_STACK_ATTEMPT_TIMEOUT_MS = 2_000;
+
+// @types/node is pinned to v18; these are Node 20+ APIs.
+type DualStackNet = {
+  setDefaultAutoSelectFamilyAttemptTimeout(ms: number): void;
+  getDefaultAutoSelectFamilyAttemptTimeout(): number;
+};
+
+export const dualStackNet = net as unknown as DualStackNet;
+
+/** Process-wide, so axios, fetch, posthog-node, the agent SDK and MCP all get it. */
+export function configureDualStackFallback(): void {
+  dualStackNet.setDefaultAutoSelectFamilyAttemptTimeout(
+    DUAL_STACK_ATTEMPT_TIMEOUT_MS,
+  );
+}

src/lib/net-tuning.ts

@@ -1,6 +1,6 @@
 import axios from 'axios';
 import { analytics } from '@utils/analytics';
-import { handleApiError, posthogApiHttpsAgent } from '@lib/api';
+import { handleApiError } from '@lib/api';
 import { WIZARD_USER_AGENT } from '@lib/constants';
 import { HealthIssueListResponseSchema, type HealthIssue } from './types';
 
@@ -17,7 +17,6 @@ export async function fetchHealthIssues(
         Authorization: `Bearer ${accessToken}`,
         'User-Agent': WIZARD_USER_AGENT,
       },
-      httpsAgent: posthogApiHttpsAgent,
     });
     return HealthIssueListResponseSchema.parse(response.data).results;
   } catch (error) {