[Copilot]

topaz access wellknown always used http.DefaultClient, so it ignored TOPAZ_PLAINTEXT and TOPAZ_INSECURE. In default local TLS setups, that made the generated well-known URL unreachable unless the gateway certificate was already trusted.

• Request transport

  • Route well-known requests over http when plaintext mode is enabled.
  • Use an HTTP client that honors insecure TLS mode for this command.

• Transport preservation

  • Clone the effective default client/transport instead of replacing it wholesale.
  • Preserve existing client settings and cloned TLS config; only override InsecureSkipVerify when TOPAZ_INSECURE is set.

• Focused coverage

  • Add tests for:
    • HTTPS → HTTP URL rewrite in plaintext mode
    • insecure TLS access against a self-signed test server
    • plaintext access against an HTTP test server

if req.URL, err = wellKnownURL(req.URL, info.Directory.Plaintext); err != nil {
	return fmt.Errorf("building request URL: %w", err)
}

resp, err := wellKnownClient(info.Directory.Insecure).Do(req)

[coveralls]

Coverage Report for CI Build 36326674635

Coverage remained the same at 6.27%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	10175
Covered Lines:	638
Line Coverage:	6.27%
Coverage Strength:	0.06 hits per line

---

💛 - Coveralls