fix(TLS 驗證): 移除 git 與 OpenRouter 的不安全憑證略過設定

app/git.js

@@ -64,7 +64,6 @@ function withAskpass(workspace, fn, token = GITEA_TOKEN) {
   const credEnv = {
     ...process.env,
     GIT_ASKPASS: askpassScript,
-    GIT_SSL_NO_VERIFY: 'true',
     GIT_USERNAME: 'x-token',
     GIT_TOKEN: token,
   };

app/test/git.test.js

@@ -96,7 +96,7 @@ describe('commitAndPush', () => {
 
     for (const { args, opts } of networkCalls) {
       assert.ok(opts?.env?.GIT_ASKPASS, `GIT_ASKPASS missing for git ${args[0]}`);
-      assert.equal(opts.env.GIT_SSL_NO_VERIFY, 'true', `GIT_SSL_NO_VERIFY missing for git ${args[0]}`);
+      assert.equal(opts.env.GIT_SSL_NO_VERIFY, undefined, `GIT_SSL_NO_VERIFY must not be forced for git ${args[0]}`);
     }
   });
 
@@ -267,7 +267,7 @@ describe('cloneRepo', () => {
     assert.ok(networkCalls.length > 0, 'expected at least one network git call');
     for (const { args, opts } of networkCalls) {
       assert.ok(opts?.env?.GIT_ASKPASS, `GIT_ASKPASS missing for git ${args[0]}`);
-      assert.equal(opts.env.GIT_SSL_NO_VERIFY, 'true', `GIT_SSL_NO_VERIFY missing for git ${args[0]}`);
+      assert.equal(opts.env.GIT_SSL_NO_VERIFY, undefined, `GIT_SSL_NO_VERIFY must not be forced for git ${args[0]}`);
     }
   });
 
@@ -310,7 +310,7 @@ describe('verifyRemoteAccess', () => {
     const lsRemote = calls.find(c => c.args[0] === 'ls-remote');
     assert.ok(lsRemote, 'expected git ls-remote to run');
     assert.ok(lsRemote.opts?.env?.GIT_ASKPASS, 'expected GIT_ASKPASS env for ls-remote');
-    assert.equal(lsRemote.opts.env.GIT_SSL_NO_VERIFY, 'true');
+    assert.equal(lsRemote.opts.env.GIT_SSL_NO_VERIFY, undefined);
   });
 
   it('does not leak the token in ls-remote args', () => {

app/test/usage.test.js

@@ -82,7 +82,7 @@ describe('fetchAccountQuota', () => {
     const get = async (url, opts) => {
       assert.match(url, /openrouter\.ai\/api\/v1\/auth\/key$/);
       assert.equal(opts.headers.Authorization, 'Bearer sk-or-xxx');
-      assert.equal(opts.httpsAgent.options.rejectUnauthorized, false);
+      assert.equal(opts.httpsAgent, undefined);
       return { data: { data: { usage: 12.4, limit: 100, limit_remaining: 87.6 } } };
     };
     const q = await fetchAccountQuota('openai', { apiKeys: ['sk-or-xxx'], baseURL: 'https://openrouter.ai/api/v1' }, { get });

app/usage.js

@@ -1,5 +1,4 @@
 import axios from 'axios';
-import { getInsecureHttpsAgent } from './config.js';
 import { warn } from './log.js';
 
 /** 本次執行的 token 累計（跨所有 LLM 呼叫）。 */
@@ -177,7 +176,6 @@ async function fetchOpenRouterQuota({ apiKey, baseURL }, get) {
   const resp = await get(`${stripSlash(baseURL)}/auth/key`, {
     headers: { Authorization: `Bearer ${apiKey}` },
     timeout: 30000,
-    httpsAgent: getInsecureHttpsAgent(),
   });
   const d = resp.data?.data || {};
   const used = num(d.usage);