From dc8a56c85702baa476812077abbefc620e218bf5 Mon Sep 17 00:00:00 2001
From: Alex Filatov <alex@alexfilatov.com>
Date: Mon, 2 Mar 2026 19:57:39 +0000
Subject: [PATCH] Fix TLS cert preflight classification false positive

---
 src/commands/oauth-tls-preflight.test.ts | 18 ++++++++++++++++++
 src/commands/oauth-tls-preflight.ts      |  1 -
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/src/commands/oauth-tls-preflight.test.ts b/src/commands/oauth-tls-preflight.test.ts
index 892800e3e4e..acd36635a6e 100644
--- a/src/commands/oauth-tls-preflight.test.ts
+++ b/src/commands/oauth-tls-preflight.test.ts
@@ -30,6 +30,24 @@ describe("runOpenAIOAuthTlsPreflight", () => {
       code: "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
     });
   });
+
+  it("keeps generic TLS transport failures in network classification", async () => {
+    const networkFetchImpl = vi.fn(async () => {
+      throw new TypeError("fetch failed", {
+        cause: new Error(
+          "Client network socket disconnected before secure TLS connection was established",
+        ),
+      });
+    });
+    const result = await runOpenAIOAuthTlsPreflight({
+      fetchImpl: networkFetchImpl,
+      timeoutMs: 20,
+    });
+    expect(result).toMatchObject({
+      ok: false,
+      kind: "network",
+    });
+  });
 });
 
 describe("formatOpenAIOAuthTlsPreflightFix", () => {
diff --git a/src/commands/oauth-tls-preflight.ts b/src/commands/oauth-tls-preflight.ts
index 7ef234f5a46..43297801a4e 100644
--- a/src/commands/oauth-tls-preflight.ts
+++ b/src/commands/oauth-tls-preflight.ts
@@ -16,7 +16,6 @@ const TLS_CERT_ERROR_PATTERNS = [
   /unable to verify the first certificate/i,
   /self[- ]signed certificate/i,
   /certificate has expired/i,
-  /tls/i,
 ];
 
 const OPENAI_AUTH_PROBE_URL =