Add OpenAI OAuth TLS preflight and doctor prerequisite check by alexfilatov · Pull Request #32051 · openclaw/openclaw

alexfilatov · 2026-03-02T18:49:37Z

Summary

Add an OpenAI OAuth TLS preflight to detect local certificate-chain problems early and provide actionable remediation, instead of surfacing only TypeError: fetch failed.

Changes

Add runOpenAIOAuthTlsPreflight() and remediation formatter in src/commands/oauth-tls-preflight.ts.
Run TLS preflight before loginOpenAICodex() in src/commands/openai-codex-oauth.ts.
Add doctor check via noteOpenAIOAuthTlsPrerequisites() in src/commands/doctor.ts.
Keep doctor fast-path tests deterministic by mocking preflight in src/commands/doctor.fast-path-mocks.ts.

User-visible behavior

During OpenAI Codex OAuth, TLS trust failures now produce actionable guidance, including:
- brew postinstall ca-certificates
- brew postinstall openssl@3
- expected cert bundle location when Homebrew prefix is detectable.
openclaw doctor now reports an OAuth TLS prerequisites warning when TLS trust is broken for OpenAI auth calls.

Why

On some Homebrew Node/OpenSSL setups, missing or broken cert bundle links cause OAuth failures like:

OpenAI OAuth failed
TypeError: fetch failed
UNABLE_TO_GET_ISSUER_CERT_LOCALLY

This change turns that failure mode into an explicit prerequisite check with concrete fixes.

Tests

Ran:

corepack pnpm vitest run \
  src/commands/openai-codex-oauth.test.ts \
  src/commands/oauth-tls-preflight.test.ts \
  src/commands/oauth-tls-preflight.doctor.test.ts

All passed.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0c71cd7db8

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-03-02T18:53:36Z

src/commands/oauth-tls-preflight.ts

+  /unable to verify the first certificate/i,
+  /self[- ]signed certificate/i,
+  /certificate has expired/i,
+  /tls/i,


Remove generic TLS regex from cert-failure detection

The TLS_CERT_ERROR_PATTERNS entry /tls/i will classify many non-certificate failures as tls-cert (for example, Node fetch errors like ECONNRESET that say "secure TLS connection was established"). That classification is consumed by loginOpenAICodexOAuth, which hard-fails early for tls-cert and shows Homebrew certificate remediation, so transient/proxy transport failures get misreported as cert-chain issues and abort OAuth before a real login attempt. Please keep cert detection limited to certificate-specific codes/messages so generic TLS transport errors stay in the network path.

Useful? React with 👍 / 👎.

Removed the generic /tls/i pattern from TLS_CERT_ERROR_PATTERNS, so only certificate-specific codes/messages map to tls-cert. Added a regression test asserting "secure TLS connection was established" transport failures stay classified as network.

greptile-apps · 2026-03-02T18:56:00Z

Greptile Summary

This PR adds a TLS preflight check for OpenAI OAuth flows to detect certificate chain issues early. The implementation is well-structured with comprehensive test coverage:

New oauth-tls-preflight.ts module provides runOpenAIOAuthTlsPreflight() for connectivity checks and formatOpenAIOAuthTlsPreflightFix() for remediation guidance
Integrates into openai-codex-oauth.ts to fail fast with actionable errors before starting the OAuth flow
Adds noteOpenAIOAuthTlsPrerequisites() to the openclaw doctor command for proactive health checks
Includes proper test mocking in doctor.fast-path-mocks.ts to keep fast-path tests deterministic

The error handling correctly distinguishes TLS certificate errors from general network issues, and the remediation messages provide specific Homebrew commands (brew postinstall ca-certificates, brew postinstall openssl@3) with cert bundle path validation.

No issues found - the implementation follows existing patterns, has robust error handling, and provides a clear user experience improvement.

Confidence Score: 5/5

This PR is safe to merge with no identified risks.
Score reflects clean implementation, comprehensive test coverage, proper error handling, and clear user benefit. The code follows existing patterns, uses dependency injection for testability, and integrates cleanly into the OAuth and doctor flows. No logical errors, security issues, or edge cases were identified during review.
No files require special attention

_{Last reviewed commit: 0c71cd7}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 943aba1bbe

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-03-02T20:03:59Z

src/commands/doctor.ts

  await noteMacLaunchctlGatewayEnvOverrides(cfg);

  await noteSecurityWarnings(cfg);
+  await noteOpenAIOAuthTlsPrerequisites();


Gate OAuth TLS preflight in doctor to avoid global 4s probe

This new call runs on every doctor execution, even when the user is not using OpenAI OAuth, and it triggers an outbound probe to auth.openai.com; combined with runOpenAIOAuthTlsPreflight({ timeoutMs: 4000 }), blocked/offline environments can now pay an extra ~4s on every run with no actionable output (network errors are intentionally suppressed). Please make this check conditional (for example, only when OpenAI OAuth is configured or in an explicit deep/probe mode) so doctor doesn't add a universal external dependency and latency penalty.

Useful? React with 👍 / 👎.

…filatov

…filatov)

grp06 · 2026-03-02T21:25:11Z

Landed via temp rebase onto main.

Gate: pnpm check
Land commit: a4927ed
Merge commit: a4927ed
Cleanup: removed PR_DRAFT_OAUTH_TLS_PREFLIGHT.md from the PR branch before merge.

Thanks @alexfilatov!

@stakeswky

* main: (154 commits) fix: harden exec allowlist regex literal handling (openclaw#32162) (thanks @stakeswky) fix(exec): escape regex literals in allowlist path matching fix: OpenAI OAuth TLS preflight gating (openclaw#32051) (thanks @alexfilatov) Auth: gate OpenAI OAuth TLS preflight in doctor Fix TLS cert preflight classification false positive Add OpenAI OAuth TLS preflight and doctor prerequisite check fix(gateway): hot-reload channelHealthCheckMinutes without full restart refactor: harden plugin install flow and main DM route pinning fix: propagate whatsapp inbound fromMe context (openclaw#32167) (thanks @scoootscooob) fix(whatsapp): propagate fromMe through inbound message pipeline refactor: harden msteams lifecycle and attachment flows fix(config): move sensitive-schema hint warnings to debug test(perf): reduce heavy fixture and guardrail overhead perf(core): speed up routing, pairing, slack, and security scans refactor: unify queueing and normalize telegram slack flows fix: harden bundled plugin install fallback semantics (openclaw#32096) (thanks @scoootscooob) fix(plugins): prefer bundled plugin ids over bare npm specs fix: distinguish warning message for non-OpenClaw vs missing npm package fix(plugins): fall back to bundled plugin when npm spec resolves to non-OpenClaw package (openclaw#32019) fix: harden msteams revoked-context fallback delivery (openclaw#27224) (thanks @openperf) ...

…filatov

…filatov)

…filatov

…filatov)

…filatov

…filatov)

openclaw-barnacle bot added commands Command implementations size: M labels Mar 2, 2026

chatgpt-codex-connector bot reviewed Mar 2, 2026

View reviewed changes

alexfilatov and others added 4 commits March 2, 2026 13:20

Add OpenAI OAuth TLS preflight and doctor prerequisite check

4b96aeb

Fix TLS cert preflight classification false positive

ef90a98

Auth: gate OpenAI OAuth TLS preflight in doctor

aee1d02

fix: OpenAI OAuth TLS preflight gating (openclaw#32051) (thanks @alex…

27e55c7

…filatov)

grp06 force-pushed the fix/oauth-tls-preflight branch from 943aba1 to 27e55c7 Compare March 2, 2026 21:24

grp06 merged commit a4927ed into openclaw:main Mar 2, 2026
9 checks passed

dawi369 pushed a commit to dawi369/davis that referenced this pull request Mar 3, 2026

fix: OpenAI OAuth TLS preflight gating (openclaw#32051) (thanks @alex…

2888d3b

…filatov)

OWALabuy pushed a commit to kcinzgg/openclaw that referenced this pull request Mar 4, 2026

fix: OpenAI OAuth TLS preflight gating (openclaw#32051) (thanks @alex…

47df493

…filatov)

zooqueen pushed a commit to hanzoai/bot that referenced this pull request Mar 6, 2026

fix: OpenAI OAuth TLS preflight gating (openclaw#32051) (thanks @alex…

efec54b

…filatov)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add OpenAI OAuth TLS preflight and doctor prerequisite check#32051

Add OpenAI OAuth TLS preflight and doctor prerequisite check#32051
grp06 merged 4 commits intoopenclaw:mainfrom
alexfilatov:fix/oauth-tls-preflight

alexfilatov commented Mar 2, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Mar 2, 2026

Uh oh!

alexfilatov Mar 2, 2026

Uh oh!

greptile-apps bot commented Mar 2, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Mar 2, 2026

Uh oh!

Uh oh!

grp06 commented Mar 2, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

alexfilatov commented Mar 2, 2026

Summary

Changes

User-visible behavior

Why

Tests

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

alexfilatov Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot commented Mar 2, 2026

Greptile Summary

Confidence Score: 5/5

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

grp06 commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

grp06 commented Mar 2, 2026 •

edited

Loading