feat: support ignoring API TLS certificate errors - #284
Open
gh0stkey wants to merge 1 commit into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new ignoreSSLErrors network setting that can be configured globally and overridden per-provider, and propagates it through model fetching, balance refresh, completion, and multiple HTTP/SSE/WebSocket transports. This is intended for trusted/self-signed endpoints and defaults to false.
Changes:
- Introduce
ignoreSSLErrorsin network resolution and provider config types, plus config normalization/parsing. - Thread
ignoreSSLErrorsthrough fetch/retry plumbing, proxy/dispatcher creation, and multiple provider clients/transports. - Add UI/config/docs/localization updates and unit coverage for draft model-fetch propagation.
Reviewed changes
Copilot reviewed 46 out of 46 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| test/unit/official-models-manager.test.ts | Asserts draft ignoreSSLErrors is preserved through provider creation for official model fetch. |
| test/unit/balance-manager-auth-snapshot.test.ts | Extends VS Code test mocks for new UI/config usage. |
| src/utils.ts | Adds ignoreSSLErrors to network resolution and fetch/proxy/undici dispatcher plumbing. |
| src/ui/screens/timeout-form-screen.ts | Adds UI control to set provider-level ignoreSSLErrors override. |
| src/ui/screens/provider-form-screen.ts | Wires ignoreSSLErrors into timeout/network settings route. |
| src/ui/screens/provider-draft-form-screen.ts | Wires ignoreSSLErrors into timeout/network settings route. |
| src/ui/screens/model-list-screen.ts | Includes ignoreSSLErrors in official-models draft input building. |
| src/ui/router/types.ts | Extends route typing to carry ignoreSSLErrors. |
| src/types.ts | Extends ProviderConfig with ignoreSSLErrors. |
| src/official-models-manager.ts | Includes ignoreSSLErrors in fetch signatures and draft/provider inputs. |
| src/main-instance/register-handlers.ts | Parses/persists ignoreSSLErrors in provider config and fetch state. |
| src/config-store.ts | Normalizes provider ignoreSSLErrors values on load/save. |
| src/config-ops.ts | Adds ignoreSSLErrors to provider config key list. |
| src/completion/api/http.ts | Passes ignoreSSLErrors through completion HTTP calls. |
| src/client/zed/runtime.ts | Passes ignoreSSLErrors through Zed client fetch options. |
| src/client/utils.ts | Extends custom fetch options to accept/pass ignoreSSLErrors. |
| src/client/openai/responses-websocket-transport.ts | Applies ignoreSSLErrors to OpenAI Responses WebSocket connection options. |
| src/client/openai/responses-client.ts | Resolves network once and passes ignoreSSLErrors to fetch + WS transport. |
| src/client/openai/codex-client.ts | Propagates ignoreSSLErrors to OpenAI Codex provider requests. |
| src/client/openai/chat-completion-client.ts | Propagates ignoreSSLErrors to OpenAI chat completion requests. |
| src/client/ollama/client.ts | Propagates ignoreSSLErrors to Ollama requests. |
| src/client/google/code-assist-client.ts | Propagates ignoreSSLErrors to Google Code Assist requests. |
| src/client/google/ai-studio-client.ts | Propagates ignoreSSLErrors through Google AI Studio fetch and logging wrappers. |
| src/client/github-copilot/client.ts | Propagates ignoreSSLErrors to GitHub Copilot provider requests. |
| src/client/anthropic/client.ts | Propagates ignoreSSLErrors to Anthropic provider requests. |
| src/balance/providers/synthetic.ts | Passes ignoreSSLErrors into balance refresh HTTP calls. |
| src/balance/providers/siliconflow.ts | Passes ignoreSSLErrors into balance refresh HTTP calls. |
| src/balance/providers/openrouter.ts | Passes ignoreSSLErrors into balance refresh HTTP calls. |
| src/balance/providers/newapi.ts | Threads ignoreSSLErrors through NewAPI balance calls. |
| src/balance/providers/moonshot-ai.ts | Passes ignoreSSLErrors into balance refresh HTTP calls. |
| src/balance/providers/minimax.ts | Passes ignoreSSLErrors into balance refresh HTTP calls. |
| src/balance/providers/litellm.ts | Passes ignoreSSLErrors into balance refresh HTTP calls. |
| src/balance/providers/kimi-code.ts | Passes ignoreSSLErrors into balance refresh HTTP calls. |
| src/balance/providers/deepseek.ts | Passes ignoreSSLErrors into balance refresh HTTP calls. |
| src/balance/providers/codex.ts | Passes ignoreSSLErrors into balance refresh HTTP calls. |
| src/balance/providers/code-assist-quota.ts | Passes ignoreSSLErrors into quota refresh HTTP call. |
| src/balance/providers/claude-relay-service.ts | Threads ignoreSSLErrors through multiple CRS balance HTTP calls. |
| src/balance/providers/aihubmix.ts | Passes ignoreSSLErrors into balance refresh HTTP call. |
| src/balance/balance-manager.ts | Resolves and forwards effective ignoreSSLErrors into balance refresh snapshot/provider wiring. |
| README.md | Documents global + provider-level ignoreSSLErrors configuration. |
| README_zh-CN.md | Chinese documentation for ignoreSSLErrors configuration. |
| package.nls.zh-cn.json | Adds localized config descriptions for ignoreSSLErrors. |
| package.nls.json | Adds config descriptions for ignoreSSLErrors. |
| package.json | Adds configuration schema entries for global/provider ignoreSSLErrors. |
| l10n/bundle.l10n.zh-cn.json | Adds localized UI strings for the new network setting. |
| l10n/bundle.l10n.json | Adds UI strings for the new network setting. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+1991
to
1993
| if (ignoreSSLErrors || !settings.proxyStrictSSL) { | ||
| connect.rejectUnauthorized = false; | ||
| } |
Comment on lines
+75
to
+80
| description: | ||
| route.ignoreSSLErrors === undefined | ||
| ? t('default ({0})', t('Disabled')) | ||
| : route.ignoreSSLErrors | ||
| ? t('Enabled') | ||
| : t('Disabled'), |
Comment on lines
+1885
to
+1889
| ignoreSSLErrors: boolean, | ||
| ): Dispatcher { | ||
| const proxy = settings.proxy; | ||
| if (proxy === undefined) { | ||
| return new Agent(createAgentOptions(base, settings)); | ||
| return new Agent(createAgentOptions(base, settings, ignoreSSLErrors)); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ignoreSSLErrorsnetwork setting for API requests.false.Validation
npm run compilenpm run test:unit(104 test files, 1233 tests passed)The setting is intended for trusted internal or self-signed API endpoints and reduces TLS connection security when enabled.