CLI download fails silently behind corporate proxy with custom CA certificate (Windows)

[chirag127]

Environment

• OS: Windows 11 Enterprise (corporate network)
• VS Code: 1.104.x
• WakaTime extension: latest
• Network: corporate HTTPS proxy (HTTPS_PROXY=http://proxy.corp:8080) with a custom internal CA certificate installed in the Windows certificate store (but NOT in the system's NODE_EXTRA_CA_CERTS or OpenSSL bundle)

Problem

On first install (or after a CLI update), the extension downloads wakatime-cli via a Node.js HTTPS request. On corporate machines that:

1. Intercept TLS with a corporate CA (not in Mozilla/Node default bundle), OR
2. Require authenticated proxy (Proxy-Authorization header)

the download fails. The failure mode is silent: the extension shows "WakaTime: Downloading WakaTime CLI..." in the status bar, then stops — no error notification, no Output channel message with the actual TLS or proxy error.

Steps to Reproduce

1. Install WakaTime extension on a corporate Windows 11 machine behind an intercepting proxy.
2. On activation, observe status bar shows "Downloading WakaTime CLI..." indefinitely.
3. Check %USERPROFILE%\.wakatime\wakatime-cli.log — ECONNREFUSED or unable to get local issuer certificate.

Expected

• Extension should read http.proxy and http.proxyStrictSSL from VS Code settings and pass them (+ NODE_EXTRA_CA_CERTS if set) to the CLI download request.
• On failure: surface actionable error in Notification + Output panel with the raw TLS/proxy error and a pointer to manual CLI install instructions.

Workaround

Manually download wakatime-cli from GitHub Releases to %USERPROFILE%\.wakatime\ and set wakatime.cliPath — but this is not documented in the extension README.

Related

• Error when download cli #415 (proxy setting ignored for SSH remote) — similar root cause: system proxy not propagated to extension download code