[irby]

do not merge.

adds in http trace logs to help understand occasional transient networking issues caused when interacting with a proxy.

[Copilot]

🟡 Changes recommended

Tracing changes health-check timeout and validation behavior, misses constructor-time failures, and can misclassify failure stages.

6 open issues

• Preserve the default health-check client timeout · New
• Install tracing before constructor-time authentication · New
• Retain authentication response JSON validation · New
• Prevent losing dial attempts from overriding successful requests · New
• Report failed request writes instead of treating them as sent · New
• Distinguish proxy CONNECT failure from pre-dial failure · New

What changed in this PR

Adds opt-in HTTP tracing to the Command client to help diagnose intermittent proxy-related networking failures. The PR is marked “do not merge.”

Changes:

• Adds structured connection, timing, and error logs controlled by COMMAND_ISSUER_HTTP_TRACE.
• Integrates tracing into client setup and adds health-check, SDK-request, and EOF tests.
• Expands end-to-end environment-file ignore rules.

File	Description
internal/​command/​httptrace.go	Adds the tracing wrapper and request diagnostics.
internal/​command/​httptrace_test.go	Tests tracing output, failures, and enablement.
internal/​command/​command.go	Enables tracing during signer setup.
e2e/​.gitignore	Ignores all *.env files.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Parallel connection attempts can produce mismatched addresses and timings, undermining the diagnostic logs.

3 open issues

• Distinguish proxy CONNECT failure from pre-dial failure
• Report failed request writes instead of treating them as sent
• Install tracing before constructor-time authentication

1 previously missed issue

In code that hasn't changed since last review

Correlate parallel dial attempts with results

internal/​command/​httptrace.go:190

Parallel dial attempts overwrite the same connectStart and connectAddr, while ConnectDone records a successful completion without correlating its address. For example, if IPv6 starts first, IPv4 starts later, and IPv6 wins, tcpConnect is measured from the IPv4 start and connectAddr incorrectly names the IPv4 endpoint. Track start times by network/address and select the matching successful attempt, or log each attempt separately, so the diagnostic reports consistent addresses and timings.

3 resolved since last review

• Preserve the default health-check client timeout
• Prevent losing dial attempts from overriding successful requests
• Retain authentication response JSON validation

_{Review effort: Balanced}