TLS connection failure to Perplexity API when WireGuard VPN is active

[ehrlichja]

Description:

aichat fails to connect to Perplexity's API (api.perplexity.ai) when a WireGuard VPN tunnel is active. The same endpoint works fine with curl (OpenSSL) and xh (rustls) through the same tunnel, so the issue appears specific to aichat's HTTP client configuration rather than a general TLS or network problem.

Error:

Error: Failed to call chat-completions api

Caused by:
    0: error sending request for url (https://api.perplexity.ai/chat/completions)
    1: client error (SendRequest)
    2: connection error
    3: peer closed connection without sending TLS close_notify: https://docs.rs/rustls/latest/rustls/manual/_03_howto/index.html#unexpected-eof

Steps to reproduce:

1. Connect to a WireGuard VPN
2. Run: aichat -m perplexity:sonar-pro "test query"
3. Observe TLS error

Workaround: Disconnecting from WireGuard allows the request to succeed.

Ruling out other causes:

• curl -v https://api.perplexity.ai/chat/completions — works through WireGuard (301, then 401 with auth)
• xh https://api.perplexity.ai/chat/completions — works through WireGuard (401, proper TLS handshake). xh also uses rustls.
• Lowering WireGuard MTU to 1280 did not help
• DNS resolves correctly through the tunnel

Environment:

• aichat 0.30.0-2 (Arch Linux pacman package)
• Arch Linux, kernel 6.18.13-arch1-1
• WireGuard (kernel module)
• rustc 1.93.1
• Framebuffer terminal