Windows 11: OAuth login fails with WSAEACCES 10013 when localhost port 1455 is TCP-excluded

What version of Codex CLI is running?

0.149.0-alpha.4.1

What subscription do you have?

ChatGPT Plus

Which model were you using?

gpt5.6 luna

What platform is your computer?

Windows 11 x64

What terminal emulator and version are you using (if applicable)?

VS Code 1.134.0 with Windows PowerShell 5.1

Codex doctor report

Not available. No authentication tokens or credential files are attached.

What issue are you seeing?

On Windows 11, ChatGPT login from the Codex VS Code extension fails before the browser OAuth flow starts.

The bundled Codex binary fails while binding the local OAuth callback server:

TcpListener::bind("127.0.0.1:1455")
WSAEACCES
os error 10013
There is no process listening on port 1455 or 1457. However, Windows reports the following TCP exclusion range for both IPv4 and IPv6:
1447–1546
Both Codex OAuth ports, 1455 and 1457, fall inside this range.
The error prevents the local login server from starting, so the browser OAuth flow is never opened.

## 重現步驟

```markdown
1. Install the Codex VS Code extension version `26.818.41705` on Windows 11.
2. Start the Codex VS Code extension while logged out.
3. Select "Sign in with ChatGPT".
4. Observe that the browser OAuth flow does not start.
5. Check the local ports:

   ```powershell
   netstat -ano | findstr ":1455"
   netstat -ano | findstr ":1457"
   No listener is reported.
6. Check Windows TCP exclusions:
netsh interface ipv4 show excludedportrange protocol=tcp
netsh interface ipv6 show excludedportrange protocol=tcp
7. Observe that both IPv4 and IPv6 contain:
1447–1546
8. The Codex log reports:
failed to start login server
os error 10013

### What steps can reproduce the bug?

1. Use Windows 11 with the Codex VS Code extension `26.818.41705` and bundled Codex `0.149.0-alpha.4.1`.
2. Ensure the machine has a Windows TCP excluded range containing `1447–1546`.
3. Confirm that ports 1455 and 1457 have no active listeners:

   ```powershell
   netstat -ano | findstr ":1455"
   netstat -ano | findstr ":1457"
4. Confirm the excluded ranges:
netsh interface ipv4 show excludedportrange protocol=tcp
netsh interface ipv6 show excludedportrange protocol=tcp
5. In VS Code, sign out of Codex or use a fresh unauthenticated Codex installation.
6. Select Sign in with ChatGPT.
7. Observe that the browser OAuth flow does not start and the login fails with:
failed to start login server
WSAEACCES
os error 10013
8. Independently reproduce the bind failure without starting OAuth:
try {
  $x=[System.Net.Sockets.TcpListener]::new(
    [System.Net.IPAddress]::Loopback,1455
  )
  $x.Start()
  "BIND_1455=PASS"
  $x.Stop()
} catch {
  "BIND_1455=FAIL: $($_.Exception.Message)"
}
Expected result:
BIND_1455=FAIL

### What is the expected behavior?

```markdown
Codex should either:

- start the OAuth callback server successfully;
- use a configurable callback port;
- use a dynamically allocated localhost port when supported by the OAuth redirect allow-list;
- fall back when the bind fails with `WSAEACCES` / `PermissionDenied`; or
- provide a device-code login flow that does not require a localhost callback server.

The login failure should also provide an actionable diagnostic explaining that the callback port is reserved by Windows networking.

### Additional information

Codex source contains:

Related to #18250, but this is not the same failure mode.

In this report, the local bind fails specifically with Windows
WSAEACCES / os error 10013 because TCP ports 1455 and 1457 are inside
the Windows excluded range 1447–1546.

Controlled verification showed that stopping only WinNAT made the bind
succeed and allowed VS Code login to complete. HNS, Hyper-V, WSL, and
Docker were not stopped.

```rust
const DEFAULT_PORT: u16 = 1455;
const FALLBACK_PORT: u16 = 1457;
The internal ServerOptions type contains a configurable port field, but the CLI and VS Code extension do not expose a login/callback port setting or environment variable.
Controlled verification:
- With WinNAT running, a standalone bind test on 127.0.0.1:1455 failed with WSAEACCES.
- After stopping only the WinNAT service, the same bind test passed.
- HNS, Hyper-V VMMS, vmcompute, WSLService, and Docker were not stopped.
- The VS Code ChatGPT login then succeeded.
- WinNAT was subsequently restarted successfully.
- After restoration, all services were running and the bind test still passed.
- No excluded-port range, registry, firewall, adapter, or OAuth credential was modified.
- OpenCode/OpenCodex did not own port 1455 or 1457.
This appears to be a Windows networking compatibility issue involving the fixed Codex OAuth callback ports and runtime TCP reservations, possibly involving WinNAT.