.gitea/ai-review/findings.json

@@ -1,16 +1 @@
-[
-  {
-    "level": "warning",
-    "role": "Maya",
-    "location": "app/config.test.js:119",
-    "suggestion": "函式 `shouldSkipOpenCodeTLSVerify` 的邏輯是只要環境變數 `OPENCODE_SKIP_TLS_VERIFY` 的值不是 `'false'` 就回傳 `true`。目前的測試案例涵蓋了 `''`, `'0'`, `'true'`, `'yes'`。為了更全面地驗證此寬鬆的判斷邏輯，請考慮新增測試案例，例如 `'1'`、`'on'` 或其他任意非 `'false'` 的字串，以確保其行為符合預期。",
-    "is_new": true
-  },
-  {
-    "level": "warning",
-    "role": "Maya",
-    "location": "app/preflight.test.js:199",
-    "suggestion": "函式 `verifyLLM` 在 `OPENCODE_SKIP_TLS_VERIFY` 為 `true` 時會傳遞不安全的 HTTPS Agent。`config.test.js` 中的 `shouldSkipOpenCodeTLSVerify` 測試顯示，`''`、`'0'`、`'yes'` 也會導致跳過 TLS 驗證。請在 `preflight.test.js` 中新增測試案例，驗證當 `OPENCODE_SKIP_TLS_VERIFY` 設定為這些值時，`httpsAgent` 是否也能正確地設定 `rejectUnauthorized: false`。",
-    "is_new": true
-  }
-]
+[]

app/config.test.js

@@ -115,7 +115,7 @@ describe('getLLMConfig', () => {
   });
 
   it('skips OpenCode TLS verification for empty string and non-false values', () => {
-    for (const value of ['', '0', 'true', 'yes']) {
+    for (const value of ['', '0', 'true', 'yes', '1', 'on', 'custom']) {
       process.env.OPENCODE_SKIP_TLS_VERIFY = value;
       assert.equal(shouldSkipOpenCodeTLSVerify(), true);
     }

app/preflight.test.js

@@ -199,21 +199,24 @@ describe('verifyLLM', () => {
     assert.equal(agents[1].options.rejectUnauthorized, false);
   });
 
-  it('passes an insecure https agent for opencode when TLS skip is explicitly true', async () => {
-    clearLLMEnv();
-    process.env.OPENCODE_BASE_URL = 'https://opencode.local:4096';
-    process.env.OPENCODE_SKIP_TLS_VERIFY = 'true';
-    const agents = [];
-    mock.method(axios, 'get', async (url, opts) => {
-      agents.push(opts.httpsAgent);
-      if (url.endsWith('/global/health')) return { data: { healthy: true } };
-      return { data: { providers: [{ id: 'google', models: { 'gemini-2.5-flash': { id: 'gemini-2.5-flash' } } }] } };
-    });
-    const result = await verifyLLM();
-    assert.equal(result.ok, true);
-    assert.equal(agents.length, 2);
-    assert.equal(agents[0].options.rejectUnauthorized, false);
-    assert.equal(agents[1].options.rejectUnauthorized, false);
+  it('passes an insecure https agent for opencode when TLS skip is any non-false value', async () => {
+    for (const value of ['true', '', '0', 'yes', '1', 'on']) {
+      clearLLMEnv();
+      mock.restoreAll();
+      process.env.OPENCODE_BASE_URL = 'https://opencode.local:4096';
+      process.env.OPENCODE_SKIP_TLS_VERIFY = value;
+      const agents = [];
+      mock.method(axios, 'get', async (url, opts) => {
+        agents.push(opts.httpsAgent);
+        if (url.endsWith('/global/health')) return { data: { healthy: true } };
+        return { data: { providers: [{ id: 'google', models: { 'gemini-2.5-flash': { id: 'gemini-2.5-flash' } } }] } };
+      });
+      const result = await verifyLLM();
+      assert.equal(result.ok, true);
+      assert.equal(agents.length, 2);
+      assert.equal(agents[0].options.rejectUnauthorized, false);
+      assert.equal(agents[1].options.rejectUnauthorized, false);
+    }
   });
 
   it('does not pass an insecure https agent for opencode when TLS verification is enabled', async () => {