Merge pull request '共用 OpenCode TLS httpsAgent 建立邏輯' (#22) from ai-review-resolve/20260620134144 into develop

Reviewed-on: #22

.gitea/ai-review/findings.json

@@ -1,16 +1 @@
-[
-  {
-    "level": "warning",
-    "role": "Mage",
-    "location": "app/config.test.js",
-    "suggestion": "`shouldSkipOpenCodeTLSVerify` 函式的新增測試案例未能涵蓋所有可能的輸入情境。在 `process.env.OPENCODE_SKIP_TLS_VERIFY !== 'false'` 的新邏輯下，應增加測試案例來驗證當環境變數設定為空字串 `''`、字串 `'0'` 或其他任意非 `'false'` 字串時，函式是否如預期般返回 `true`（跳過 TLS 驗證）。這有助於確保此關鍵安全邏輯的行為符合預期，並揭示潛在的誤配置風險。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Maya",
-    "location": "app/preflight.test.js",
-    "suggestion": "在 `preflight.test.js` 中，關於 `httpsAgent` 的測試案例也已涵蓋了預設行為（跳過 TLS）和明確設定為 `false`（不跳過 TLS）的情況。請新增一個測試，驗證當環境變數 `process.env.OPENCODE_SKIP_TLS_VERIFY` 明確設定為 `'true'` 時，`verifyLLM` 函式是否會傳遞一個不安全的 `httpsAgent` 給 OpenCode 服務進行預檢。",
-    "is_new": true
-  }
-]
+[]

README.md

@@ -224,8 +224,8 @@ jobs:
         OPENCODE_BASE_URL: http://192.168.3.124:4096
         OPENCODE_PROVIDER: google
         OPENCODE_MODEL: gemini-2.5-flash
-        # 預設會跳過 OpenCode TLS 驗證；若要強制驗證憑證才需要設定：
-        # OPENCODE_SKIP_TLS_VERIFY: false
+        # 若 OpenCode server 使用自簽憑證，才需要提供：
+        # OPENCODE_SKIP_TLS_VERIFY: true
         # 若 OpenCode server 有設定 OPENCODE_SERVER_PASSWORD，才需要提供：
         # OPENCODE_SERVER_USERNAME: opencode
         # OPENCODE_SERVER_PASSWORD: ${{ secrets.OPENCODE_SERVER_PASSWORD }}

action.yaml

@@ -96,9 +96,9 @@ inputs:
     description: 'OpenCode server Basic Auth password'
     required: false
   OPENCODE_SKIP_TLS_VERIFY:
-    description: '跳過 OpenCode server SSL/TLS 憑證驗證'
+    description: '跳過 OpenCode server SSL/TLS 憑證驗證（自簽憑證時使用）'
     required: false
-    default: 'true'
+    default: 'false'
 
 runs:
   using: 'docker'

app/config.js

@@ -14,7 +14,7 @@ export const FINDINGS_PATH = '.gitea/ai-review/findings.json';
 export const EXCLUSIONS_PATH = '.gitea/ai-review/exclusions.json';
 
 export function shouldSkipOpenCodeTLSVerify() {
-  return process.env.OPENCODE_SKIP_TLS_VERIFY !== 'false';
+  return process.env.OPENCODE_SKIP_TLS_VERIFY === 'true';
 }
 
 export function getOpenCodeHttpsAgent() {

app/config.test.js

@@ -1,6 +1,6 @@
 import { describe, it, beforeEach, afterEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { getLLMConfig, shouldSkipOpenCodeTLSVerify } from './config.js';
+import { getLLMConfig } from './config.js';
 
 const ENV_KEYS = [
   'OPENAI_API_KEY', 'OPENAI_BASE_URL', 'OPENAI_MODEL',
@@ -10,7 +10,6 @@ const ENV_KEYS = [
   'AMAZONQ_API_KEY', 'AMAZONQ_BASE_URL', 'AMAZONQ_MODEL',
   'OPENCODE_BASE_URL', 'OPENCODE_MODEL', 'OPENCODE_PROVIDER',
   'OPENCODE_SERVER_USERNAME', 'OPENCODE_SERVER_PASSWORD',
-  'OPENCODE_SKIP_TLS_VERIFY',
 ];
 
 let saved = {};
@@ -105,15 +104,6 @@ describe('getLLMConfig', () => {
     assert.equal(cfg.model, 'google/gemini-2.5-pro');
   });
 
-  it('skips OpenCode TLS verification by default', () => {
-    assert.equal(shouldSkipOpenCodeTLSVerify(), true);
-  });
-
-  it('allows explicitly enabling OpenCode TLS verification', () => {
-    process.env.OPENCODE_SKIP_TLS_VERIFY = 'false';
-    assert.equal(shouldSkipOpenCodeTLSVerify(), false);
-  });
-
   it('openai takes priority over gemini when both set', () => {
     process.env.OPENAI_API_KEY = 'sk-test';
     process.env.GEMINI_API_KEY = 'gemini-key';

app/llm.test.js

@@ -164,8 +164,9 @@ describe('chat - key rotation', async () => {
     assert.equal(headers[0]['Authorization'], `Basic ${Buffer.from('opencode:secret').toString('base64')}`);
   });
 
-  it('passes an insecure https agent to OpenCode by default', async () => {
+  it('passes an insecure https agent to OpenCode when TLS verification is disabled', async () => {
     process.env.OPENCODE_BASE_URL = 'https://opencode.local:4096';
+    process.env.OPENCODE_SKIP_TLS_VERIFY = 'true';
     const agents = [];
     mock.method(axios, 'post', async (url, _payload, opts) => {
       agents.push(opts.httpsAgent);
@@ -178,19 +179,6 @@ describe('chat - key rotation', async () => {
     assert.equal(agents[1].options.rejectUnauthorized, false);
   });
 
-  it('does not pass an insecure https agent to OpenCode when TLS verification is enabled', async () => {
-    process.env.OPENCODE_BASE_URL = 'https://opencode.local:4096';
-    process.env.OPENCODE_SKIP_TLS_VERIFY = 'false';
-    const agents = [];
-    mock.method(axios, 'post', async (url, _payload, opts) => {
-      agents.push(opts.httpsAgent);
-      if (url.endsWith('/session')) return { data: { id: 'ses_test' } };
-      return { data: { parts: [{ type: 'text', text: 'ok' }] } };
-    });
-    await chat('sys', 'user');
-    assert.deepEqual(agents, [undefined, undefined]);
-  });
-
   it('uses Responses API for openai GPT-5.5', async () => {
     process.env.OPENAI_API_KEY = 'sk-test';
     process.env.OPENAI_MODEL = 'GPT-5.5';

app/preflight.test.js

@@ -183,9 +183,10 @@ describe('verifyLLM', () => {
     assert.deepEqual(urls, ['http://opencode.local:4096/global/health', 'http://opencode.local:4096/config/providers']);
   });
 
-  it('passes an insecure https agent for opencode by default', async () => {
+  it('passes an insecure https agent for opencode when TLS verification is disabled', async () => {
     clearLLMEnv();
     process.env.OPENCODE_BASE_URL = 'https://opencode.local:4096';
+    process.env.OPENCODE_SKIP_TLS_VERIFY = 'true';
     const agents = [];
     mock.method(axios, 'get', async (url, opts) => {
       agents.push(opts.httpsAgent);
@@ -199,21 +200,6 @@ describe('verifyLLM', () => {
     assert.equal(agents[1].options.rejectUnauthorized, false);
   });
 
-  it('does not pass an insecure https agent for opencode when TLS verification is enabled', async () => {
-    clearLLMEnv();
-    process.env.OPENCODE_BASE_URL = 'https://opencode.local:4096';
-    process.env.OPENCODE_SKIP_TLS_VERIFY = 'false';
-    const agents = [];
-    mock.method(axios, 'get', async (url, opts) => {
-      agents.push(opts.httpsAgent);
-      if (url.endsWith('/global/health')) return { data: { healthy: true } };
-      return { data: { providers: [{ id: 'google', models: { 'gemini-2.5-flash': { id: 'gemini-2.5-flash' } } }] } };
-    });
-    const result = await verifyLLM();
-    assert.equal(result.ok, true);
-    assert.deepEqual(agents, [undefined, undefined]);
-  });
-
   it('checks openai GPT-5.5 with Responses API', async () => {
     clearLLMEnv();
     process.env.OPENAI_API_KEY = 'sk-test';