From 68ce92b0e5db53610d50aa2fa70a2682853440bf Mon Sep 17 00:00:00 2001
From: Jeffery <jiantw83@yahoo.com>
Date: Mon, 29 Jun 2026 10:49:22 +0000
Subject: [PATCH] =?UTF-8?q?fix(TLS=20=E9=A9=97=E8=AD=89):=20=E7=A7=BB?=
 =?UTF-8?q?=E9=99=A4=20git=20=E8=88=87=20OpenRouter=20=E7=9A=84=E4=B8=8D?=
 =?UTF-8?q?=E5=AE=89=E5=85=A8=E6=86=91=E8=AD=89=E7=95=A5=E9=81=8E=E8=A8=AD?=
 =?UTF-8?q?=E5=AE=9A?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/git.js             | 1 -
 app/test/git.test.js   | 6 +++---
 app/test/usage.test.js | 2 +-
 app/usage.js           | 2 --
 4 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/app/git.js b/app/git.js
index ea8146e..d099ade 100644
--- a/app/git.js
+++ b/app/git.js
@@ -64,7 +64,6 @@ function withAskpass(workspace, fn, token = GITEA_TOKEN) {
   const credEnv = {
     ...process.env,
     GIT_ASKPASS: askpassScript,
-    GIT_SSL_NO_VERIFY: 'true',
     GIT_USERNAME: 'x-token',
     GIT_TOKEN: token,
   };
diff --git a/app/test/git.test.js b/app/test/git.test.js
index 9676d06..bb37685 100644
--- a/app/test/git.test.js
+++ b/app/test/git.test.js
@@ -96,7 +96,7 @@ describe('commitAndPush', () => {
 
     for (const { args, opts } of networkCalls) {
       assert.ok(opts?.env?.GIT_ASKPASS, `GIT_ASKPASS missing for git ${args[0]}`);
-      assert.equal(opts.env.GIT_SSL_NO_VERIFY, 'true', `GIT_SSL_NO_VERIFY missing for git ${args[0]}`);
+      assert.equal(opts.env.GIT_SSL_NO_VERIFY, undefined, `GIT_SSL_NO_VERIFY must not be forced for git ${args[0]}`);
     }
   });
 
@@ -267,7 +267,7 @@ describe('cloneRepo', () => {
     assert.ok(networkCalls.length > 0, 'expected at least one network git call');
     for (const { args, opts } of networkCalls) {
       assert.ok(opts?.env?.GIT_ASKPASS, `GIT_ASKPASS missing for git ${args[0]}`);
-      assert.equal(opts.env.GIT_SSL_NO_VERIFY, 'true', `GIT_SSL_NO_VERIFY missing for git ${args[0]}`);
+      assert.equal(opts.env.GIT_SSL_NO_VERIFY, undefined, `GIT_SSL_NO_VERIFY must not be forced for git ${args[0]}`);
     }
   });
 
@@ -310,7 +310,7 @@ describe('verifyRemoteAccess', () => {
     const lsRemote = calls.find(c => c.args[0] === 'ls-remote');
     assert.ok(lsRemote, 'expected git ls-remote to run');
     assert.ok(lsRemote.opts?.env?.GIT_ASKPASS, 'expected GIT_ASKPASS env for ls-remote');
-    assert.equal(lsRemote.opts.env.GIT_SSL_NO_VERIFY, 'true');
+    assert.equal(lsRemote.opts.env.GIT_SSL_NO_VERIFY, undefined);
   });
 
   it('does not leak the token in ls-remote args', () => {
diff --git a/app/test/usage.test.js b/app/test/usage.test.js
index 6ce0c95..37f11d4 100644
--- a/app/test/usage.test.js
+++ b/app/test/usage.test.js
@@ -82,7 +82,7 @@ describe('fetchAccountQuota', () => {
     const get = async (url, opts) => {
       assert.match(url, /openrouter\.ai\/api\/v1\/auth\/key$/);
       assert.equal(opts.headers.Authorization, 'Bearer sk-or-xxx');
-      assert.equal(opts.httpsAgent.options.rejectUnauthorized, false);
+      assert.equal(opts.httpsAgent, undefined);
       return { data: { data: { usage: 12.4, limit: 100, limit_remaining: 87.6 } } };
     };
     const q = await fetchAccountQuota('openai', { apiKeys: ['sk-or-xxx'], baseURL: 'https://openrouter.ai/api/v1' }, { get });
diff --git a/app/usage.js b/app/usage.js
index 3e37821..93c53f7 100644
--- a/app/usage.js
+++ b/app/usage.js
@@ -1,5 +1,4 @@
 import axios from 'axios';
-import { getInsecureHttpsAgent } from './config.js';
 import { warn } from './log.js';
 
 /** 本次執行的 token 累計（跨所有 LLM 呼叫）。 */
@@ -177,7 +176,6 @@ async function fetchOpenRouterQuota({ apiKey, baseURL }, get) {
   const resp = await get(`${stripSlash(baseURL)}/auth/key`, {
     headers: { Authorization: `Bearer ${apiKey}` },
     timeout: 30000,
-    httpsAgent: getInsecureHttpsAgent(),
   });
   const d = resp.data?.data || {};
   const used = num(d.usage);