fix(TLS 驗證): 移除 git 與 OpenRouter 的不安全憑證略過設定

app/test/git.test.js

@@ -96,7 +96,7 @@ describe('commitAndPush', () => {
 
     for (const { args, opts } of networkCalls) {
       assert.ok(opts?.env?.GIT_ASKPASS, `GIT_ASKPASS missing for git ${args[0]}`);
-      assert.equal(opts.env.GIT_SSL_NO_VERIFY, 'true', `GIT_SSL_NO_VERIFY missing for git ${args[0]}`);
+      assert.equal(opts.env.GIT_SSL_NO_VERIFY, undefined, `GIT_SSL_NO_VERIFY must not be forced for git ${args[0]}`);
     }
   });
 
@@ -267,7 +267,7 @@ describe('cloneRepo', () => {
     assert.ok(networkCalls.length > 0, 'expected at least one network git call');
     for (const { args, opts } of networkCalls) {
       assert.ok(opts?.env?.GIT_ASKPASS, `GIT_ASKPASS missing for git ${args[0]}`);
-      assert.equal(opts.env.GIT_SSL_NO_VERIFY, 'true', `GIT_SSL_NO_VERIFY missing for git ${args[0]}`);
+      assert.equal(opts.env.GIT_SSL_NO_VERIFY, undefined, `GIT_SSL_NO_VERIFY must not be forced for git ${args[0]}`);
     }
   });
 
@@ -310,7 +310,7 @@ describe('verifyRemoteAccess', () => {
     const lsRemote = calls.find(c => c.args[0] === 'ls-remote');
     assert.ok(lsRemote, 'expected git ls-remote to run');
     assert.ok(lsRemote.opts?.env?.GIT_ASKPASS, 'expected GIT_ASKPASS env for ls-remote');
-    assert.equal(lsRemote.opts.env.GIT_SSL_NO_VERIFY, 'true');
+    assert.equal(lsRemote.opts.env.GIT_SSL_NO_VERIFY, undefined);
   });
 
   it('does not leak the token in ls-remote args', () => {

app/test/usage.test.js

@@ -82,7 +82,7 @@ describe('fetchAccountQuota', () => {
     const get = async (url, opts) => {
       assert.match(url, /openrouter\.ai\/api\/v1\/auth\/key$/);
       assert.equal(opts.headers.Authorization, 'Bearer sk-or-xxx');
-      assert.equal(opts.httpsAgent.options.rejectUnauthorized, false);
+      assert.equal(opts.httpsAgent, undefined);
       return { data: { data: { usage: 12.4, limit: 100, limit_remaining: 87.6 } } };
     };
     const q = await fetchAccountQuota('openai', { apiKeys: ['sk-or-xxx'], baseURL: 'https://openrouter.ai/api/v1' }, { get });