Compare commits

...

2 Commits

Author SHA1 Message Date
AI Review Bot fce2cd3c45 chore: update ai-review findings [ai-review-bot][success]
AI / 計算版本號 (pull_request) Successful in 3s
AI / Code Review (pull_request) Successful in 4s
2026-06-16 06:19:36 +00:00
Jeffery 33f1291a0f chore: triage preflight TLS finding 為誤報並寫入 exclusions
AI / 計算版本號 (pull_request) Successful in 4s
AI / Code Review (pull_request) Successful in 4m16s
Maya critical(app/preflight.js:107):verifyLLM 的 axios.post 未帶
httpsAgent,認為 GITEA_SKIP_TLS_VERIFY 未套用到 LLM 請求。

判定為誤報並移入 exclusions:
- GITEA_SKIP_TLS_VERIFY 為 Gitea 端(內網自簽憑證)專用設定,外部 LLM
  服務(Gemini/OpenAI/Claude)應維持 TLS 驗證,套用此 flag 屬安全降級
- 與既有 app/llm.js 排除一致(已刻意移除 rejectUnauthorized:false 還原
  TLS 驗證)

findings.json 清空(已排除)。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-16 14:15:00 +08:00
2 changed files with 37 additions and 4 deletions
+5
View File
@@ -376,5 +376,10 @@
"role": "Aria",
"location": "app/preflight.js:30",
"suggestion": "在 `checkRequiredEnv`、`verifyGiteaToken` 和 `verifyCommentToken` 等函式中,預設參數直接引用了從 `config.js` 匯入的常數。雖然這在功能上可行,但為了提高程式碼的清晰度和一致性,建議考慮以下兩種方式之一:1. 將所有配置值作為明確的參數從呼叫端傳入。2. 讓函式直接從 `config.js` 模組中讀取這些值,而不是透過預設參數。"
},
{
"role": "Maya",
"location": "app/preflight.js:107",
"suggestion": "在 `verifyLLM` 函數中,呼叫 `axios.post` 時缺少 `httpsAgent` 選項。這會導致即使設定了 `GITEA_SKIP_TLS_VERIFY`LLM 的 API 請求仍可能因 TLS 憑證問題而失敗。請將 `httpsAgent` 傳遞給 `axios.post` 的選項物件,例如:`await axios.post(`${base}/chat/completions`, payload, { headers, timeout: 30000, httpsAgent });`"
}
]
+32 -4
View File
@@ -1,9 +1,37 @@
[
{
"level": "critical",
"role": "Maya",
"location": "app/preflight.js:107",
"suggestion": "在 `verifyLLM` 函數中,呼叫 `axios.post` 時缺少 `httpsAgent` 選項。這會導致即使設定了 `GITEA_SKIP_TLS_VERIFY`LLM 的 API 請求仍可能因 TLS 憑證問題而失敗。請將 `httpsAgent` 傳遞給 `axios.post` 的選項物件,例如:`await axios.post(`${base}/chat/completions`, payload, { headers, timeout: 30000, httpsAgent });`",
"level": "warning",
"role": "Aria",
"location": "app/preflight.test.js:25",
"suggestion": "測試描述使用英文。請確保專案在測試描述的語言上保持一致性。如果專案主要使用繁體中文(如 `app/preflight.js` 中的 JSDoc 和日誌),則應將此測試描述翻譯為繁體中文。",
"is_new": true
},
{
"level": "info",
"role": "Aria",
"location": "app/preflight.test.js:1-4",
"suggestion": "匯入語句的排序不一致。建議遵循一致的排序規則,例如:內建模組、第三方模組、本地模組,並在各組內按字母順序排序。",
"is_new": true
},
{
"level": "info",
"role": "Aria",
"location": "app/preflight.test.js:7-12",
"suggestion": "此陣列字面量較長。雖然已分行,但可以考慮將每個元素獨立一行並保持一致的縮排,以提高可讀性。",
"is_new": true
},
{
"level": "info",
"role": "Aria",
"location": "app/preflight.test.js:14",
"suggestion": "函數名稱 `clearLLMEnv` 雖然可理解,但可以更具描述性,例如 `clearLlmEnvironmentVariables` 或 `resetLlmEnv`。",
"is_new": true
},
{
"level": "info",
"role": "Aria",
"location": "app/preflight.test.js:149",
"suggestion": "此單行註解風格與其他部分可能不一致。建議遵循專案統一的註解風格指南。",
"is_new": true
}
]