From c31d043419fbb0961a3c93201a8d9ca8ff6a2903 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 13 Jul 2026 23:52:50 +0000
Subject: [PATCH 1/3] [log] Add debug logging to TLS helper functions in
 proxy/tls.go

Add logTLS debug logging calls to randomSerial and writePEM helper
functions, and to the TLS directory creation step in
GenerateSelfSignedTLS. These provide visibility into:
- TLS directory creation path
- Random serial number generation values
- PEM file write operations (path, type, size)
- PEM file write completion

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 internal/proxy/tls.go | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/internal/proxy/tls.go b/internal/proxy/tls.go
index 3c846b40..c722e9c6 100644
--- a/internal/proxy/tls.go
+++ b/internal/proxy/tls.go
@@ -70,8 +70,8 @@ func GenerateSelfSignedTLS(dir string) (*TLSConfig, error) {
 	if err := os.MkdirAll(dir, 0755); err != nil {
 		return nil, fmt.Errorf("failed to create TLS directory %s: %w", dir, err)
 	}
+	logTLS.Printf("TLS directory ensured: %s", dir)
 
-	// --- Generate CA ---
 	caKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	if err != nil {
 		return nil, fmt.Errorf("failed to generate CA key: %w", err)
@@ -190,14 +190,20 @@ func randomSerial() (*big.Int, error) {
 	if serial.Sign() == 0 {
 		serial = new(big.Int).Add(serial, big.NewInt(1))
 	}
+	logTLS.Printf("generated random serial number: %s", serial.String())
 	return serial, nil
 }
 
 func writePEM(path, blockType string, derBytes []byte, perm os.FileMode) error {
+	logTLS.Printf("writing PEM file: path=%s, type=%s, size=%d bytes", path, blockType, len(derBytes))
 	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, perm)
 	if err != nil {
 		return err
 	}
 	defer f.Close()
-	return pem.Encode(f, &pem.Block{Type: blockType, Bytes: derBytes})
+	if err := pem.Encode(f, &pem.Block{Type: blockType, Bytes: derBytes}); err != nil {
+		return err
+	}
+	logTLS.Printf("PEM file written successfully: path=%s", path)
+	return nil
 }

From b7cc3adfb0f8102a7a6b8e4773fa8355ceaa985a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 14 Jul 2026 17:42:49 +0000
Subject: [PATCH 2/3] fix: address review feedback in proxy/tls.go

- Pass *big.Int directly to Printf instead of calling .String() eagerly
- Close file explicitly in writePEM, handle close error, and only log
  success after confirmed close
---
 internal/proxy/tls.go | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/internal/proxy/tls.go b/internal/proxy/tls.go
index c722e9c6..4be8c928 100644
--- a/internal/proxy/tls.go
+++ b/internal/proxy/tls.go
@@ -190,7 +190,7 @@ func randomSerial() (*big.Int, error) {
 	if serial.Sign() == 0 {
 		serial = new(big.Int).Add(serial, big.NewInt(1))
 	}
-	logTLS.Printf("generated random serial number: %s", serial.String())
+	logTLS.Printf("generated random serial number: %s", serial)
 	return serial, nil
 }
 
@@ -200,8 +200,11 @@ func writePEM(path, blockType string, derBytes []byte, perm os.FileMode) error {
 	if err != nil {
 		return err
 	}
-	defer f.Close()
 	if err := pem.Encode(f, &pem.Block{Type: blockType, Bytes: derBytes}); err != nil {
+		_ = f.Close()
+		return err
+	}
+	if err := f.Close(); err != nil {
 		return err
 	}
 	logTLS.Printf("PEM file written successfully: path=%s", path)

From d1231795faef9681b1623134a915e43ed1171880 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 14 Jul 2026 17:43:25 +0000
Subject: [PATCH 3/3] fix: log close error in writePEM error path

Log the file close error when pem.Encode fails, rather than silently
discarding it.
---
 internal/proxy/tls.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/internal/proxy/tls.go b/internal/proxy/tls.go
index 4be8c928..2a90d7ac 100644
--- a/internal/proxy/tls.go
+++ b/internal/proxy/tls.go
@@ -201,7 +201,9 @@ func writePEM(path, blockType string, derBytes []byte, perm os.FileMode) error {
 		return err
 	}
 	if err := pem.Encode(f, &pem.Block{Type: blockType, Bytes: derBytes}); err != nil {
-		_ = f.Close()
+		if closeErr := f.Close(); closeErr != nil {
+			logTLS.Printf("failed to close file after encoding error: %v", closeErr)
+		}
 		return err
 	}
 	if err := f.Close(); err != nil {