fix(cli) preserve custom transport in TLS config and reuse it for streaming

1 file · +15 -5

M internal/adapters/in/cli/remote/client.go +15 -5


@@ -92,10 +92,17 @@ func (c *Client) applyTLSConfig() {
92	92		fmt.Fprintf(os.Stderr, "WARNING: TLS certificate verification disabled for %s\n", c.baseURL)
93	93
94	94		var transport *http.Transport
95		-	if existing, ok := c.httpClient.Transport.(*http.Transport); ok {
96		-	transport = existing.Clone()
97		-	} else {
	95	+	switch t := c.httpClient.Transport.(type) {
	96	+	case *http.Transport:
	97	+	transport = t.Clone()
	98	+	case nil:
98	99		transport = http.DefaultTransport.(*http.Transport).Clone()
	100	+	default:
	101	+	// Cannot apply InsecureSkipVerify to a non-*http.Transport.
	102	+	// Log a warning and leave the transport intact rather than
	103	+	// silently replacing it (which would drop caller-provided behavior).
	104	+	fmt.Fprintf(os.Stderr, "WARNING: --insecure requires *http.Transport, got %T; TLS override not applied\n", t)
	105	+	return
99	106		}
100	107
101	108		if transport.TLSClientConfig == nil {

@@ -741,8 +748,11 @@ func (c *Client) streamLogs(ctx context.Context, path string) (<-chan string, er
741	748		req.Header.Set("Authorization", "Bearer "+c.token)
742	749		}
743	750
744		-	// Use a client without timeout for streaming
745		-	streamClient := &http.Client{}
	751	+	// Use the same transport as the main client (honoring TLS config and
	752	+	// custom transports) but without a timeout so streaming doesn't get cut off.
	753	+	streamClient := &http.Client{
	754	+	Transport: c.httpClient.Transport,
	755	+	}
746	756		resp, err := streamClient.Do(req)
747	757		if err != nil {
748	758		return nil, fmt.Errorf("failed to connect: %w", err)

 	fmt.Fprintf(os.Stderr, "WARNING: TLS certificate verification disabled for %s\n", c.baseURL)
 	var transport *http.Transport
-	if existing, ok := c.httpClient.Transport.(*http.Transport); ok {
+	switch t := c.httpClient.Transport.(type) {
-		transport = existing.Clone()
+	case *http.Transport:
-	} else {
+		transport = t.Clone()
+	case nil:
 		transport = http.DefaultTransport.(*http.Transport).Clone()
+	default:
+		// Cannot apply InsecureSkipVerify to a non-*http.Transport.
+		// Log a warning and leave the transport intact rather than
+		// silently replacing it (which would drop caller-provided behavior).
+		fmt.Fprintf(os.Stderr, "WARNING: --insecure requires *http.Transport, got %T; TLS override not applied\n", t)
+		return
 	}
 	if transport.TLSClientConfig == nil {
 		req.Header.Set("Authorization", "Bearer "+c.token)
 	}
-	// Use a client without timeout for streaming
+	// Use the same transport as the main client (honoring TLS config and
-	streamClient := &http.Client{}
+	// custom transports) but without a timeout so streaming doesn't get cut off.
+	streamClient := &http.Client{
+		Transport: c.httpClient.Transport,
+	}
 	resp, err := streamClient.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("failed to connect: %w", err)