rayfin login fails in WSL2 + Dev Container environment when Global Secure Access is enabled

[ymasaoka]

Problem statement

When using Rayfin CLI inside a WSL2-based Dev Container on Windows, rayfin login fails if Microsoft Global Secure Access (GSA) is enabled on the host machine.

The issue is reproducible in a WSL2 + Dev Container development environment. Disabling GSA immediately restores normal behavior and rayfin login succeeds.

This appears to be related to networking differences between the Windows host and the Linux container environment. GSA traffic interception works on the Windows host through its TUN driver, but the Linux container does not appear to have access to the same network path required for the authentication flow.

Proposed solution

Investigate whether Rayfin CLI can:

• Detect when it is running inside WSL2 or a Dev Container.
• Provide a clearer error message when the authentication flow cannot be completed because of Global Secure Access networking.
• Document known limitations and workarounds for WSL2 + Dev Container environments when GSA is enabled.
• Provide an alternative authentication flow that does not depend on host-only networking behavior, if applicable.

Alternatives considered

• Disabling Global Secure Access on the Windows host. This workaround allows rayfin login to succeed, but it is not practical in enterprise environments where GSA is mandated.
• Running Rayfin CLI directly from the Windows host instead of the Dev Container.

Additional context

Environment:

• Windows 11
• WSL2
• VS Code Dev Container
• Microsoft Global Secure Access enabled

Observed behavior:

• rayfin login fails when GSA is enabled.
• rayfin login succeeds immediately after GSA is disabled.

Possible root cause:
GSA uses a Windows-based TUN driver for traffic redirection. Since the driver operates on the Windows host network stack, Linux containers running inside WSL2 may not have access to the same network path or authentication redirection mechanism required by rayfin login.