Use config-based HTTP client in network check fallback path

When the workspace client is unavailable but config is resolved,
the network check was falling back to http.DefaultClient. This
ignores proxy and custom TLS settings from the SDK config, giving
misleading results in enterprise environments. Use
configuredNetworkHTTPClient(cfg) instead, which respects
HTTPTransport and InsecureSkipVerify from the config.

Author: simonfaltum

cmd/doctor/checks.go

@@ -236,8 +236,10 @@ func checkNetwork(cmd *cobra.Command, cfg *config.Config, resolveErr error, w *d
 		return checkNetworkWithHost(cmd, w.Config.Host, configuredNetworkHTTPClient(w.Config))
 	}
 
-	log.Warnf(cmd.Context(), "workspace client unavailable for network check, falling back to default HTTP client")
-	return checkNetworkWithHost(cmd, cfg.Host, http.DefaultClient)
+	// Workspace client unavailable, but we can still build an HTTP client
+	// from the resolved config to respect proxy and TLS settings.
+	log.Warnf(cmd.Context(), "workspace client unavailable for network check, using config-based HTTP client")
+	return checkNetworkWithHost(cmd, cfg.Host, configuredNetworkHTTPClient(cfg))
 }
 
 func checkNetworkWithHost(cmd *cobra.Command, host string, client *http.Client) CheckResult {

cmd/doctor/doctor_test.go

@@ -333,6 +333,33 @@ func TestCheckNetworkUsesWorkspaceClientTransport(t *testing.T) {
 	assert.Contains(t, result.Message, "reachable")
 }
 
+func TestCheckNetworkFallbackUsesConfigTransport(t *testing.T) {
+	called := false
+	cfg := &config.Config{
+		Host:  "https://example.com",
+		Token: "test-token",
+		HTTPTransport: roundTripFunc(func(r *http.Request) (*http.Response, error) {
+			called = true
+			assert.Equal(t, http.MethodHead, r.Method)
+			return &http.Response{
+				StatusCode: http.StatusOK,
+				Body:       http.NoBody,
+				Header:     make(http.Header),
+				Request:    r,
+			}, nil
+		}),
+	}
+
+	ctx := cmdio.MockDiscard(t.Context())
+	cmd := newTestCmd(ctx)
+
+	result := checkNetwork(cmd, cfg, nil, nil)
+	assert.True(t, called, "expected config's HTTPTransport to be used")
+	assert.Equal(t, "Network", result.Name)
+	assert.Equal(t, statusPass, result.Status)
+	assert.Contains(t, result.Message, "reachable")
+}
+
 func TestCheckNetworkConfigResolutionFailure(t *testing.T) {
 	clearConfigEnv(t)