Merge pull request 'feat(OpenCode TLS): 預設跳過 TLS 驗證' (#25) from develop into master

Reviewed-on: #25

.gitea/ai-review/findings.json

@@ -1 +1,16 @@
-[]
+[
+  {
+    "level": "warning",
+    "role": "Mage",
+    "location": "app/config.test.js",
+    "suggestion": "`shouldSkipOpenCodeTLSVerify` 函式的新增測試案例未能涵蓋所有可能的輸入情境。在 `process.env.OPENCODE_SKIP_TLS_VERIFY !== 'false'` 的新邏輯下，應增加測試案例來驗證當環境變數設定為空字串 `''`、字串 `'0'` 或其他任意非 `'false'` 字串時，函式是否如預期般返回 `true`（跳過 TLS 驗證）。這有助於確保此關鍵安全邏輯的行為符合預期，並揭示潛在的誤配置風險。",
+    "is_new": true
+  },
+  {
+    "level": "warning",
+    "role": "Maya",
+    "location": "app/preflight.test.js",
+    "suggestion": "在 `preflight.test.js` 中，關於 `httpsAgent` 的測試案例也已涵蓋了預設行為（跳過 TLS）和明確設定為 `false`（不跳過 TLS）的情況。請新增一個測試，驗證當環境變數 `process.env.OPENCODE_SKIP_TLS_VERIFY` 明確設定為 `'true'` 時，`verifyLLM` 函式是否會傳遞一個不安全的 `httpsAgent` 給 OpenCode 服務進行預檢。",
+    "is_new": true
+  }
+]

README.md

@@ -224,8 +224,8 @@ jobs:
         OPENCODE_BASE_URL: http://192.168.3.124:4096
         OPENCODE_PROVIDER: google
         OPENCODE_MODEL: gemini-2.5-flash
-        # 若 OpenCode server 使用自簽憑證，才需要提供：
-        # OPENCODE_SKIP_TLS_VERIFY: true
+        # 預設會跳過 OpenCode TLS 驗證；若要強制驗證憑證才需要設定：
+        # OPENCODE_SKIP_TLS_VERIFY: false
         # 若 OpenCode server 有設定 OPENCODE_SERVER_PASSWORD，才需要提供：
         # OPENCODE_SERVER_USERNAME: opencode
         # OPENCODE_SERVER_PASSWORD: ${{ secrets.OPENCODE_SERVER_PASSWORD }}

action.yaml

@@ -96,9 +96,9 @@ inputs:
     description: 'OpenCode server Basic Auth password'
     required: false
   OPENCODE_SKIP_TLS_VERIFY:
-    description: '跳過 OpenCode server SSL/TLS 憑證驗證（自簽憑證時使用）'
+    description: '跳過 OpenCode server SSL/TLS 憑證驗證'
     required: false
-    default: 'false'
+    default: 'true'
 
 runs:
   using: 'docker'

app/config.js

@@ -1,3 +1,5 @@
+import https from 'https';
+
 export const GITEA_TOKEN = process.env.GITEA_TOKEN || '';
 export const GITEA_COMMENT_TOKEN = process.env.GITEA_COMMENT_TOKEN || '';
 export const GITEA_SERVER_URL = process.env.GITEA_SERVER_URL || 'https://gitea.com';
@@ -12,7 +14,11 @@ export const FINDINGS_PATH = '.gitea/ai-review/findings.json';
 export const EXCLUSIONS_PATH = '.gitea/ai-review/exclusions.json';
 
 export function shouldSkipOpenCodeTLSVerify() {
-  return process.env.OPENCODE_SKIP_TLS_VERIFY === 'true';
+  return process.env.OPENCODE_SKIP_TLS_VERIFY !== 'false';
+}
+
+export function getOpenCodeHttpsAgent() {
+  return shouldSkipOpenCodeTLSVerify() ? new https.Agent({ rejectUnauthorized: false }) : undefined;
 }
 
 /** 將逗號分隔的 API key 字串拆成陣列 */

app/config.test.js

@@ -1,6 +1,6 @@
 import { describe, it, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { getLLMConfig } from './config.js';
+import { getLLMConfig, shouldSkipOpenCodeTLSVerify } from './config.js';
 
 const ENV_KEYS = [
   'OPENAI_API_KEY', 'OPENAI_BASE_URL', 'OPENAI_MODEL',
@@ -10,6 +10,7 @@ const ENV_KEYS = [
   'AMAZONQ_API_KEY', 'AMAZONQ_BASE_URL', 'AMAZONQ_MODEL',
   'OPENCODE_BASE_URL', 'OPENCODE_MODEL', 'OPENCODE_PROVIDER',
   'OPENCODE_SERVER_USERNAME', 'OPENCODE_SERVER_PASSWORD',
+  'OPENCODE_SKIP_TLS_VERIFY',
 ];
 
 let saved = {};
@@ -104,6 +105,15 @@ describe('getLLMConfig', () => {
     assert.equal(cfg.model, 'google/gemini-2.5-pro');
   });
 
+  it('skips OpenCode TLS verification by default', () => {
+    assert.equal(shouldSkipOpenCodeTLSVerify(), true);
+  });
+
+  it('allows explicitly enabling OpenCode TLS verification', () => {
+    process.env.OPENCODE_SKIP_TLS_VERIFY = 'false';
+    assert.equal(shouldSkipOpenCodeTLSVerify(), false);
+  });
+
   it('openai takes priority over gemini when both set', () => {
     process.env.OPENAI_API_KEY = 'sk-test';
     process.env.GEMINI_API_KEY = 'gemini-key';

app/llm.js

@@ -1,6 +1,5 @@
 import axios from 'axios';
-import https from 'https';
-import { getLLMConfig, shouldSkipOpenCodeTLSVerify } from './config.js';
+import { getLLMConfig, getOpenCodeHttpsAgent } from './config.js';
 import { line, error } from './log.js';
 
 function isOpenAIGpt55(provider, model) {
@@ -50,7 +49,7 @@ function applyOpenCodeAuth(headers) {
 function opencodeAxiosOptions(headers) {
   return {
     headers,
-    httpsAgent: shouldSkipOpenCodeTLSVerify() ? new https.Agent({ rejectUnauthorized: false }) : undefined,
+    httpsAgent: getOpenCodeHttpsAgent(),
   };
 }
 

app/llm.test.js

@@ -164,9 +164,8 @@ describe('chat - key rotation', async () => {
     assert.equal(headers[0]['Authorization'], `Basic ${Buffer.from('opencode:secret').toString('base64')}`);
   });
 
-  it('passes an insecure https agent to OpenCode when TLS verification is disabled', async () => {
+  it('passes an insecure https agent to OpenCode by default', async () => {
     process.env.OPENCODE_BASE_URL = 'https://opencode.local:4096';
-    process.env.OPENCODE_SKIP_TLS_VERIFY = 'true';
     const agents = [];
     mock.method(axios, 'post', async (url, _payload, opts) => {
       agents.push(opts.httpsAgent);
@@ -179,6 +178,19 @@ describe('chat - key rotation', async () => {
     assert.equal(agents[1].options.rejectUnauthorized, false);
   });
 
+  it('does not pass an insecure https agent to OpenCode when TLS verification is enabled', async () => {
+    process.env.OPENCODE_BASE_URL = 'https://opencode.local:4096';
+    process.env.OPENCODE_SKIP_TLS_VERIFY = 'false';
+    const agents = [];
+    mock.method(axios, 'post', async (url, _payload, opts) => {
+      agents.push(opts.httpsAgent);
+      if (url.endsWith('/session')) return { data: { id: 'ses_test' } };
+      return { data: { parts: [{ type: 'text', text: 'ok' }] } };
+    });
+    await chat('sys', 'user');
+    assert.deepEqual(agents, [undefined, undefined]);
+  });
+
   it('uses Responses API for openai GPT-5.5', async () => {
     process.env.OPENAI_API_KEY = 'sk-test';
     process.env.OPENAI_MODEL = 'GPT-5.5';

app/preflight.js

@@ -7,8 +7,8 @@ import {
   GITEA_REPOSITORY,
   GITEA_SKIP_TLS_VERIFY,
   PR_NUMBER,
+  getOpenCodeHttpsAgent,
   getLLMConfig,
-  shouldSkipOpenCodeTLSVerify,
 } from './config.js';
 import { verifyRemoteAccess } from './git.js';
 import { step, line, ok, error } from './log.js';
@@ -30,7 +30,7 @@ const applyOpenCodeAuth = (headers) => {
 const opencodeAxiosOptions = (headers) => ({
   headers,
   timeout: 30000,
-  httpsAgent: shouldSkipOpenCodeTLSVerify() ? new https.Agent({ rejectUnauthorized: false }) : undefined,
+  httpsAgent: getOpenCodeHttpsAgent(),
 });
 
 function giteaErr(e) {

app/preflight.test.js

@@ -183,10 +183,9 @@ describe('verifyLLM', () => {
     assert.deepEqual(urls, ['http://opencode.local:4096/global/health', 'http://opencode.local:4096/config/providers']);
   });
 
-  it('passes an insecure https agent for opencode when TLS verification is disabled', async () => {
+  it('passes an insecure https agent for opencode by default', async () => {
     clearLLMEnv();
     process.env.OPENCODE_BASE_URL = 'https://opencode.local:4096';
-    process.env.OPENCODE_SKIP_TLS_VERIFY = 'true';
     const agents = [];
     mock.method(axios, 'get', async (url, opts) => {
       agents.push(opts.httpsAgent);
@@ -200,6 +199,21 @@ describe('verifyLLM', () => {
     assert.equal(agents[1].options.rejectUnauthorized, false);
   });
 
+  it('does not pass an insecure https agent for opencode when TLS verification is enabled', async () => {
+    clearLLMEnv();
+    process.env.OPENCODE_BASE_URL = 'https://opencode.local:4096';
+    process.env.OPENCODE_SKIP_TLS_VERIFY = 'false';
+    const agents = [];
+    mock.method(axios, 'get', async (url, opts) => {
+      agents.push(opts.httpsAgent);
+      if (url.endsWith('/global/health')) return { data: { healthy: true } };
+      return { data: { providers: [{ id: 'google', models: { 'gemini-2.5-flash': { id: 'gemini-2.5-flash' } } }] } };
+    });
+    const result = await verifyLLM();
+    assert.equal(result.ok, true);
+    assert.deepEqual(agents, [undefined, undefined]);
+  });
+
   it('checks openai GPT-5.5 with Responses API', async () => {
     clearLLMEnv();
     process.env.OPENAI_API_KEY = 'sk-test';