app/test/config.test.js

@@ -48,4 +48,8 @@ describe('getLLMConfig', () => {
     assert.equal(agent.options.rejectUnauthorized, false);
   });
 
+  it('disables Node TLS certificate verification globally', () => {
+    assert.equal(process.env.NODE_TLS_REJECT_UNAUTHORIZED, '0');
+  });
+
 });

app/test/git.test.js

@@ -96,6 +96,7 @@ describe('commitAndPush', () => {
 
     for (const { args, opts } of networkCalls) {
       assert.ok(opts?.env?.GIT_ASKPASS, `GIT_ASKPASS missing for git ${args[0]}`);
+      assert.equal(opts.env.GIT_SSL_NO_VERIFY, 'true', `GIT_SSL_NO_VERIFY missing for git ${args[0]}`);
     }
   });
 
@@ -266,6 +267,7 @@ describe('cloneRepo', () => {
     assert.ok(networkCalls.length > 0, 'expected at least one network git call');
     for (const { args, opts } of networkCalls) {
       assert.ok(opts?.env?.GIT_ASKPASS, `GIT_ASKPASS missing for git ${args[0]}`);
+      assert.equal(opts.env.GIT_SSL_NO_VERIFY, 'true', `GIT_SSL_NO_VERIFY missing for git ${args[0]}`);
     }
   });
 
@@ -308,6 +310,7 @@ describe('verifyRemoteAccess', () => {
     const lsRemote = calls.find(c => c.args[0] === 'ls-remote');
     assert.ok(lsRemote, 'expected git ls-remote to run');
     assert.ok(lsRemote.opts?.env?.GIT_ASKPASS, 'expected GIT_ASKPASS env for ls-remote');
+    assert.equal(lsRemote.opts.env.GIT_SSL_NO_VERIFY, 'true');
   });
 
   it('does not leak the token in ls-remote args', () => {

app/test/usage.test.js

@@ -82,6 +82,7 @@ describe('fetchAccountQuota', () => {
     const get = async (url, opts) => {
       assert.match(url, /openrouter\.ai\/api\/v1\/auth\/key$/);
       assert.equal(opts.headers.Authorization, 'Bearer sk-or-xxx');
+      assert.equal(opts.httpsAgent.options.rejectUnauthorized, false);
       return { data: { data: { usage: 12.4, limit: 100, limit_remaining: 87.6 } } };
     };
     const q = await fetchAccountQuota('openai', { apiKeys: ['sk-or-xxx'], baseURL: 'https://openrouter.ai/api/v1' }, { get });