fix(tls): preserve dynamic peer certificates

[proggeramlug]

When a TLSSocket flowed through a callback, dynamic getPeerCertificate() dispatch was intercepted by perry-ext-net's reduced HTTPS facade. Direct tls.connect() sockets never populate that facade's optional CN field, so both the original and rotated server certificates appeared as {} even though the negotiated DER bytes were recorded correctly.

The extension now leaves getPeerCertificate() to the primary stdlib handle dispatcher, which builds Node's legacy certificate object from the recorded DER. This preserves the first connection's certificate while a server rotates its secure context and exposes the new certificate to later connections.

Refs #9202.

Validation:

• exact tls/context/server-context-rotation.ts output matches Node 26.5.1
• complete TLS node-suite: 100/100 passed
• full perry-ext-net: 33 passed
• cargo check -p perry-stdlib passed during path isolation
• ./scripts/run_lint_gates.sh: all 64 gates passed, 2 CI-only skipped

Summary by CodeRabbit

• Bug Fixes
  • Fixed TLSSocket.getPeerCertificate() so it returns the complete negotiated certificate.
  • Certificate inspection now preserves peer identity when a server’s secure context is rotated.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 856b40c0-2f27-4876-8a8e-ff578504b7f8

📥 Commits

Reviewing files that changed from the base of the PR and between 504e180 and c0bb08a.

📒 Files selected for processing (2)

• changelog.d/9911-tls-peer-certificate-dispatch.md
• crates/perry-ext-net/src/dispatch.rs

Included review availability: Your plan provides up to 8 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The native net extension stops handling TLSSocket.getPeerCertificate(). Calls now use the primary stdlib dispatcher, which returns the complete negotiated certificate. A changelog entry documents the dispatch fix and peer identity preservation during secure-context rotation.

Changes

TLS peer certificate dispatch

Layer / File(s)	Summary
Delegate certificate inspection crates/perry-ext-net/src/dispatch.rs, changelog.d/9911-tls-peer-certificate-dispatch.md	The extension no longer claims or handles getPeerCertificate. The method falls through to the primary stdlib dispatcher, and the changelog records the behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to c0bb0

TLS peer-certificate inspection now returns the complete negotiated certificate through the standard TLS path, including across secure-context rotation. The current change is ready to merge.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the TLS dispatch fix, its impact, related issue, and validation results. It omits the template headings and checklist, but it contains the required substantive informa…
Title check	✅ Passed	The title concisely and accurately identifies the TLS fix that preserves dynamic peer certificates.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[proggeramlug]

Landed on main via merge train #9922. Validated as a tree: 64/64 lint gates, and perry-runtime/codegen/hir/stdlib all green (5,962 tests, 0 failures). Thanks!