From 2fe03e94f03fb06925ca0846ee4887f7f0295c88 Mon Sep 17 00:00:00 2001
From: Jeffery <jiantw83@yahoo.com>
Date: Fri, 26 Jun 2026 09:20:57 +0000
Subject: [PATCH] =?UTF-8?q?test(TLS=20=E9=A9=97=E8=AD=89):=20=E8=A3=9C?=
 =?UTF-8?q?=E4=B8=8A=E6=86=91=E8=AD=89=E5=BF=BD=E7=95=A5=E8=A1=8C=E7=82=BA?=
 =?UTF-8?q?=E6=B8=AC=E8=A9=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/test/config.test.js | 4 ++++
 app/test/git.test.js    | 3 +++
 app/test/usage.test.js  | 1 +
 3 files changed, 8 insertions(+)

diff --git a/app/test/config.test.js b/app/test/config.test.js
index c6aa636..7139dae 100644
--- a/app/test/config.test.js
+++ b/app/test/config.test.js
@@ -48,4 +48,8 @@ describe('getLLMConfig', () => {
     assert.equal(agent.options.rejectUnauthorized, false);
   });
 
+  it('disables Node TLS certificate verification globally', () => {
+    assert.equal(process.env.NODE_TLS_REJECT_UNAUTHORIZED, '0');
+  });
+
 });
diff --git a/app/test/git.test.js b/app/test/git.test.js
index 9d9b151..9676d06 100644
--- a/app/test/git.test.js
+++ b/app/test/git.test.js
@@ -96,6 +96,7 @@ describe('commitAndPush', () => {
 
     for (const { args, opts } of networkCalls) {
       assert.ok(opts?.env?.GIT_ASKPASS, `GIT_ASKPASS missing for git ${args[0]}`);
+      assert.equal(opts.env.GIT_SSL_NO_VERIFY, 'true', `GIT_SSL_NO_VERIFY missing for git ${args[0]}`);
     }
   });
 
@@ -266,6 +267,7 @@ describe('cloneRepo', () => {
     assert.ok(networkCalls.length > 0, 'expected at least one network git call');
     for (const { args, opts } of networkCalls) {
       assert.ok(opts?.env?.GIT_ASKPASS, `GIT_ASKPASS missing for git ${args[0]}`);
+      assert.equal(opts.env.GIT_SSL_NO_VERIFY, 'true', `GIT_SSL_NO_VERIFY missing for git ${args[0]}`);
     }
   });
 
@@ -308,6 +310,7 @@ describe('verifyRemoteAccess', () => {
     const lsRemote = calls.find(c => c.args[0] === 'ls-remote');
     assert.ok(lsRemote, 'expected git ls-remote to run');
     assert.ok(lsRemote.opts?.env?.GIT_ASKPASS, 'expected GIT_ASKPASS env for ls-remote');
+    assert.equal(lsRemote.opts.env.GIT_SSL_NO_VERIFY, 'true');
   });
 
   it('does not leak the token in ls-remote args', () => {
diff --git a/app/test/usage.test.js b/app/test/usage.test.js
index 9c42bf0..d6b5f4e 100644
--- a/app/test/usage.test.js
+++ b/app/test/usage.test.js
@@ -82,6 +82,7 @@ describe('fetchAccountQuota', () => {
     const get = async (url, opts) => {
       assert.match(url, /openrouter\.ai\/api\/v1\/auth\/key$/);
       assert.equal(opts.headers.Authorization, 'Bearer sk-or-xxx');
+      assert.equal(opts.httpsAgent.options.rejectUnauthorized, false);
       return { data: { data: { usage: 12.4, limit: 100, limit_remaining: 87.6 } } };
     };
     const q = await fetchAccountQuota('openai', { apiKeys: ['sk-or-xxx'], baseURL: 'https://openrouter.ai/api/v1' }, { get });