Fix TLS cert preflight classification false positive

src/commands/oauth-tls-preflight.test.ts

@@ -30,6 +30,24 @@ describe("runOpenAIOAuthTlsPreflight", () => {
       code: "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
     });
   });
+
+  it("keeps generic TLS transport failures in network classification", async () => {
+    const networkFetchImpl = vi.fn(async () => {
+      throw new TypeError("fetch failed", {
+        cause: new Error(
+          "Client network socket disconnected before secure TLS connection was established",
+        ),
+      });
+    });
+    const result = await runOpenAIOAuthTlsPreflight({
+      fetchImpl: networkFetchImpl,
+      timeoutMs: 20,
+    });
+    expect(result).toMatchObject({
+      ok: false,
+      kind: "network",
+    });
+  });
 });
 
 describe("formatOpenAIOAuthTlsPreflightFix", () => {

src/commands/oauth-tls-preflight.ts

@@ -16,7 +16,6 @@ const TLS_CERT_ERROR_PATTERNS = [
   /unable to verify the first certificate/i,
   /self[- ]signed certificate/i,
   /certificate has expired/i,
-  /tls/i,
 ];
 
 const OPENAI_AUTH_PROBE_URL =