Add OpenAI OAuth TLS preflight and doctor prerequisite check

src/commands/openai-codex-oauth.test.ts

@@ -5,6 +5,8 @@ import type { WizardPrompter } from "../wizard/prompts.js";
 const mocks = vi.hoisted(() => ({
   loginOpenAICodex: vi.fn(),
   createVpsAwareOAuthHandlers: vi.fn(),
+  runOpenAIOAuthTlsPreflight: vi.fn(),
+  formatOpenAIOAuthTlsPreflightFix: vi.fn(),
 }));
 
 vi.mock("@mariozechner/pi-ai", () => ({
@@ -15,6 +17,11 @@ vi.mock("./oauth-flow.js", () => ({
   createVpsAwareOAuthHandlers: mocks.createVpsAwareOAuthHandlers,
 }));
 
+vi.mock("./oauth-tls-preflight.js", () => ({
+  runOpenAIOAuthTlsPreflight: mocks.runOpenAIOAuthTlsPreflight,
+  formatOpenAIOAuthTlsPreflightFix: mocks.formatOpenAIOAuthTlsPreflightFix,
+}));
+
 import { loginOpenAICodexOAuth } from "./openai-codex-oauth.js";
 
 function createPrompter() {
@@ -39,6 +46,8 @@ function createRuntime(): RuntimeEnv {
 describe("loginOpenAICodexOAuth", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    mocks.runOpenAIOAuthTlsPreflight.mockResolvedValue({ ok: true });
+    mocks.formatOpenAIOAuthTlsPreflightFix.mockReturnValue("tls fix");
   });
 
   it("returns credentials on successful oauth login", async () => {
@@ -95,4 +104,33 @@ describe("loginOpenAICodexOAuth", () => {
       "OAuth help",
     );
   });
+
+  it("fails early with actionable message when TLS preflight fails", async () => {
+    mocks.runOpenAIOAuthTlsPreflight.mockResolvedValue({
+      ok: false,
+      kind: "tls-cert",
+      code: "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+      message: "unable to get local issuer certificate",
+    });
+    mocks.formatOpenAIOAuthTlsPreflightFix.mockReturnValue("Run brew postinstall openssl@3");
+
+    const { prompter } = createPrompter();
+    const runtime = createRuntime();
+
+    await expect(
+      loginOpenAICodexOAuth({
+        prompter,
+        runtime,
+        isRemote: false,
+        openUrl: async () => {},
+      }),
+    ).rejects.toThrow("unable to get local issuer certificate");
+
+    expect(mocks.loginOpenAICodex).not.toHaveBeenCalled();
+    expect(runtime.error).toHaveBeenCalledWith("Run brew postinstall openssl@3");
+    expect(prompter.note).toHaveBeenCalledWith(
+      "Run brew postinstall openssl@3",
+      "OAuth prerequisites",
+    );
+  });
 });