feat: support ignoring API TLS certificate errors

README.md

@@ -429,6 +429,7 @@ Use this feature to monitor provider balances in `Provider Settings`.
 | Global Backoff Multiplier          | `networkSettings.retry.backoffMultiplier`      | Exponential backoff multiplier. Default: `2`; minimum: `1`.                                                                                           |
 | Global Jitter Factor               | `networkSettings.retry.jitterFactor`           | Jitter factor used to randomize delays. Default: `0.1`; range: `0`-`1`.                                                                               |
 | Global Retryable Status Codes      | `networkSettings.retry.statusCodes`            | HTTP status codes that trigger retries. When set, this fully replaces the default rules: `408`, `409`, `429`, and all status codes `>=500`.          |
+| Ignore SSL Certificate Errors      | `networkSettings.ignoreSSLErrors`              | Whether to ignore TLS certificate validation errors for provider API requests. Independent of proxy settings; default: `false`.                    |
 | Global Proxy Settings              | `networkSettings.proxy`                        | Global proxy settings for provider requests. See [Proxy Configuration](#proxy-configuration) for fields.                                             |
 | Enable Code Completion             | `completion.enabled`                           | Whether to enable this extension's code completion. Default: `true`; see [Completion Algorithm Parameters](#completion-algorithm-parameters).         |
 | Completion Providers               | `completion.providers`                         | Array of completion algorithm configurations. Default: `[]`; see [Completion Algorithm Parameters](#completion-algorithm-parameters).                |
@@ -458,6 +459,8 @@ Proxy settings can be configured globally through `unifyChatProvider.networkSett
 - `direct`: Connect directly and bypass VS Code/global proxy settings.
 - `custom`: Use `proxy.url`; optional fields are `authorization`, `strictSSL`, and `noProxy`.
 
+Whether API requests ignore SSL/TLS certificate errors is controlled independently by `networkSettings.ignoreSSLErrors`. A provider-level `ignoreSSLErrors` value can override the global setting.
+
 Supported custom proxy URL protocols are `http`, `https`, `socks`, `socks4`, `socks4a`, `socks5`, and `socks5h`. Proxy settings apply to provider HTTP requests, including chat requests, balance refreshes, and official model fetching.
 
 Example global proxy:
@@ -525,6 +528,7 @@ The following fields correspond to `ProviderConfig` (field names used in import/
 | Connection Timeout         | `timeout.connection`                             | Must be a positive integer. Inherits the global value when unset; built-in default: `60000` (60 seconds).                                                                                               |
 | Response Interval Timeout  | `timeout.response`                               | Must be a positive integer. Inherits the global value when unset; built-in default: `300000` (5 minutes).                                                                                              |
 | Retry                      | `retry`                                          | Provider-level retry override for chat requests. Retryable HTTP status codes can be configured only through global `networkSettings.retry.statusCodes`.                                                  |
+| Ignore SSL Certificate Errors | `ignoreSSLErrors`                            | Whether to ignore TLS certificate validation errors for this provider's API requests. Independent of proxy settings; default: `false`.                                                            |
 | Max Retries                | `retry.maxRetries`                               | Must be a non-negative integer. Inherits the global value when unset; built-in default: `10`.                                                                                                            |
 | Initial Delay              | `retry.initialDelayMs`                           | Must be a non-negative integer in milliseconds. Inherits the global value when unset; built-in default: `1000`.                                                                                         |
 | Max Delay                  | `retry.maxDelayMs`                               | Must be a positive integer in milliseconds. Inherits the global value when unset; built-in default: `60000`.                                                                                            |

README_zh-CN.md

@@ -429,6 +429,7 @@ Zed 编辑器使用自研的 Zeta 系列模型，这里推荐两种方式添加
 | 全局退避倍数               | `networkSettings.retry.backoffMultiplier`      | 指数退避倍数。默认：`2`，最小：`1`。                                                                                                        |
 | 全局抖动因子               | `networkSettings.retry.jitterFactor`           | 用于随机化延迟的抖动因子。默认：`0.1`，范围：`0`-`1`。                                                                                      |
 | 全局可重试状态码           | `networkSettings.retry.statusCodes`            | 触发重试的 HTTP 状态码数组。设置后会完整覆盖默认规则；默认规则为 `408`、`409`、`429` 及所有 `>=500` 状态码。                                  |
+| 忽略 SSL 证书错误           | `networkSettings.ignoreSSLErrors`              | 是否忽略供应商 API 请求的 TLS 证书校验错误。与代理设置独立，默认：`false`；启用后会降低连接安全性。                                        |
 | 全局代理配置               | `networkSettings.proxy`                        | 供应商请求的全局代理设置。字段请查看 [代理配置](#代理配置)。                                                                                 |
 | 启用代码补全               | `completion.enabled`                           | 是否启用本扩展的代码补全。默认：`true`；详细说明请查看 [补全算法参数](#补全算法参数)。                                                       |
 | 补全供应商                 | `completion.providers`                         | 补全算法配置数组。默认：`[]`；详细字段请查看 [补全算法参数](#补全算法参数)。                                                                |
@@ -458,6 +459,8 @@ Zed 编辑器使用自研的 Zeta 系列模型，这里推荐两种方式添加
 - `direct`：直连，并绕过 VS Code 与全局代理设置。
 - `custom`：使用 `proxy.url`；可选字段包括 `authorization`、`strictSSL` 和 `noProxy`。
 
+API 请求是否忽略 SSL/TLS 证书错误由 `networkSettings.ignoreSSLErrors` 控制，与是否使用代理无关。也可以在单个供应商的 `ignoreSSLErrors` 字段中覆盖该设置。
+
 自定义代理 URL 支持 `http`、`https`、`socks`、`socks4`、`socks4a`、`socks5` 和 `socks5h` 协议。代理设置会影响供应商 HTTP 请求，包括聊天请求、余额刷新和官方模型拉取。
 
 全局代理示例：
@@ -525,6 +528,7 @@ Zed 编辑器使用自研的 Zeta 系列模型，这里推荐两种方式添加
 | 建连超时                 | `timeout.connection`                             | 必须为正整数。未设置时继承全局值；内置默认：`60000`（60 秒）。                                                                                                                                       |
 | 响应间隔超时             | `timeout.response`                               | 必须为正整数。未设置时继承全局值；内置默认：`300000`（5 分钟）。                                                                                                                                     |
 | 重试配置                 | `retry`                                          | 聊天请求的供应商级重试覆盖；可重试 HTTP 状态码只能通过全局 `networkSettings.retry.statusCodes` 配置。                                                                                                 |
+| 忽略 SSL 证书错误        | `ignoreSSLErrors`                                | 是否忽略该供应商 API 请求的 TLS 证书校验错误。独立于代理设置，默认：`false`；启用后会降低连接安全性。                                                                                              |
 | 最大重试次数             | `retry.maxRetries`                               | 必须为非负整数。未设置时继承全局值；内置默认：`10`。                                                                                                                                                  |
 | 初始延迟                 | `retry.initialDelayMs`                           | 必须为非负整数，单位毫秒。未设置时继承全局值；内置默认：`1000`。                                                                                                                                     |
 | 最大延迟                 | `retry.maxDelayMs`                               | 必须为正整数，单位毫秒。未设置时继承全局值；内置默认：`60000`。                                                                                                                                      |

l10n/bundle.l10n.json

@@ -1000,6 +1000,9 @@
   "Please enter a valid HTTP(S) or SOCKS proxy URL": "Please enter a valid HTTP(S) or SOCKS proxy URL",
   "Proxy Authorization": "Proxy Authorization",
   "Proxy Strict SSL": "Proxy Strict SSL",
+  "Ignore SSL Certificate Errors": "Ignore SSL Certificate Errors",
+  "Disable TLS certificate validation for API requests": "Disable TLS certificate validation for API requests",
+  "Select whether to validate API certificates": "Select whether to validate API certificates",
   "Proxy Type": "Proxy Type",
   "Proxy URL": "Proxy URL",
   "Select proxy type": "Select proxy type",

l10n/bundle.l10n.zh-cn.json

@@ -1000,6 +1000,9 @@
   "Please enter a valid HTTP(S) or SOCKS proxy URL": "请输入有效的 HTTP(S) 或 SOCKS 代理 URL",
   "Proxy Authorization": "代理认证",
   "Proxy Strict SSL": "代理 Strict SSL",
+  "Ignore SSL Certificate Errors": "忽略 SSL 证书错误",
+  "Disable TLS certificate validation for API requests": "禁用 API 请求的 TLS 证书校验",
+  "Select whether to validate API certificates": "选择是否校验 API 证书",
   "Proxy Type": "代理类型",
   "Proxy URL": "代理 URL",
   "Select proxy type": "选择代理类型",

package.json

@@ -322,6 +322,11 @@
                 }
               }
             },
+            "ignoreSSLErrors": {
+              "type": "boolean",
+              "description": "%configuration.networkSettings.ignoreSSLErrors.description%",
+              "default": false
+            },
             "proxy": {
               "type": "object",
               "description": "%configuration.networkSettings.proxy.description%",
@@ -1050,6 +1055,11 @@
                   }
                 }
               },
+              "ignoreSSLErrors": {
+                "type": "boolean",
+                "description": "%configuration.endpoints.ignoreSSLErrors.description%",
+                "default": false
+              },
               "proxy": {
                 "type": "object",
                 "description": "%configuration.endpoints.proxy.description%",

package.nls.json

@@ -55,6 +55,7 @@
   "configuration.networkSettings.retry.backoffMultiplier.description": "Backoff multiplier for exponential retry delay (chat requests).",
   "configuration.networkSettings.retry.jitterFactor.description": "Jitter factor (0-1) to randomize retry delay (chat requests).",
   "configuration.networkSettings.retry.statusCodes.description": "HTTP status codes that should trigger retries for chat requests. When set, this overrides the default retryable status codes.",
+  "configuration.networkSettings.ignoreSSLErrors.description": "Ignore TLS certificate validation errors for provider API requests. This is independent of proxy settings and is insecure.",
   "configuration.networkSettings.proxy.description": "Global proxy settings for provider requests.",
   "configuration.proxy.type.description": "Proxy mode.",
   "configuration.proxy.type.enumDescriptions.0": "Use VS Code HTTP proxy settings.",
@@ -148,6 +149,7 @@
   "configuration.endpoints.retry.maxDelayMs.description": "Maximum retry delay cap in milliseconds (chat requests).",
   "configuration.endpoints.retry.backoffMultiplier.description": "Backoff multiplier for exponential retry delay (chat requests).",
   "configuration.endpoints.retry.jitterFactor.description": "Jitter factor (0-1) to randomize retry delay (chat requests).",
+  "configuration.endpoints.ignoreSSLErrors.description": "Ignore TLS certificate validation errors for this provider's API requests. This is independent of proxy settings and is insecure.",
   "configuration.endpoints.proxy.description": "Proxy settings for this provider. Overrides global proxy settings.",
   "configuration.endpoints.autoFetchOfficialModels.description": "Automatically fetch and sync official models from the provider API.",
   "configuration.endpoints.models.description": "List of available models.",

package.nls.zh-cn.json

@@ -55,6 +55,7 @@
   "configuration.networkSettings.retry.backoffMultiplier.description": "聊天请求的指数退避倍数。",
   "configuration.networkSettings.retry.jitterFactor.description": "聊天请求的抖动因子（0-1），用于随机化重试延迟。",
   "configuration.networkSettings.retry.statusCodes.description": "聊天请求中触发重试的 HTTP 状态码。设置后会覆盖默认可重试状态码。",
+  "configuration.networkSettings.ignoreSSLErrors.description": "忽略供应商 API 请求的 TLS 证书校验错误。此选项独立于代理设置，启用后会降低连接安全性。",
   "configuration.networkSettings.proxy.description": "供应商请求的全局代理设置。",
   "configuration.proxy.type.description": "代理模式。",
   "configuration.proxy.type.enumDescriptions.0": "使用 VS Code HTTP 代理设置。",
@@ -148,6 +149,7 @@
   "configuration.endpoints.retry.maxDelayMs.description": "聊天请求的最大重试延迟上限（毫秒）。",
   "configuration.endpoints.retry.backoffMultiplier.description": "聊天请求的指数退避倍数。",
   "configuration.endpoints.retry.jitterFactor.description": "聊天请求的抖动因子（0-1），用于随机化重试延迟。",
+  "configuration.endpoints.ignoreSSLErrors.description": "忽略该供应商 API 请求的 TLS 证书校验错误。此选项独立于代理设置，启用后会降低连接安全性。",
   "configuration.endpoints.proxy.description": "此供应商的代理设置。会覆盖全局代理设置。",
   "configuration.endpoints.autoFetchOfficialModels.description": "自动从供应商 API 拉取并同步官方模型。",
   "configuration.endpoints.models.description": "可用模型列表。",

src/balance/balance-manager.ts

@@ -20,6 +20,7 @@ import {
   MainInstanceError,
 } from '../main-instance/errors';
 import { t } from '../i18n';
+import { resolveChatNetwork } from '../utils';
 
 const DEFAULT_PERIODIC_REFRESH_MS = 60_000;
 const DEFAULT_THROTTLE_WINDOW_MS = 10_000;
@@ -650,6 +651,7 @@ export class BalanceManager implements vscode.Disposable {
       const providerWithResolvedProxy = {
         ...snapshot.provider,
         proxy: this.resolveProviderProxy(snapshot.provider),
+        ignoreSSLErrors: resolveChatNetwork(snapshot.provider).ignoreSSLErrors,
       };
       const result = await balanceProvider.refresh({
         provider: providerWithResolvedProxy,
@@ -817,6 +819,8 @@ export class BalanceManager implements vscode.Disposable {
       useRawBaseUrl: provider.useRawBaseUrl === true,
       auth: provider.auth,
       balanceProvider: provider.balanceProvider,
+      ignoreSSLErrors: resolveChatNetwork(provider).ignoreSSLErrors,
+      proxy: this.resolveProviderProxy(provider),
     });
   }
 

src/balance/providers/aihubmix.ts

@@ -225,6 +225,7 @@ export class AiHubMixBalanceProvider implements BalanceProvider {
         method: 'GET',
         headers,
         logger,
+        ignoreSSLErrors: input.provider.ignoreSSLErrors,
         proxy: input.provider.proxy,
       });
 

src/balance/providers/claude-relay-service.ts

@@ -573,19 +573,41 @@ export class ClaudeRelayServiceBalanceProvider implements BalanceProvider {
 
     try {
       const proxy = input.provider.proxy;
-      const apiId = await this.fetchApiId(baseUrl, apiKey, logger, proxy);
+      const ignoreSSLErrors = input.provider.ignoreSSLErrors === true;
+      const apiId = await this.fetchApiId(
+        baseUrl,
+        apiKey,
+        logger,
+        proxy,
+        ignoreSSLErrors,
+      );
       const [userStats, dailyStats, weeklyStats, monthlyStats] =
         await Promise.all([
-          this.fetchUserStats(baseUrl, apiId, logger, proxy),
-          this.fetchUserModelStats(baseUrl, apiId, 'daily', logger, proxy),
+          this.fetchUserStats(baseUrl, apiId, logger, proxy, ignoreSSLErrors),
+          this.fetchUserModelStats(
+            baseUrl,
+            apiId,
+            'daily',
+            logger,
+            proxy,
+            ignoreSSLErrors,
+          ),
           this.fetchUserModelStats(
             baseUrl,
             apiId,
             'natural_weekly',
             logger,
             proxy,
+            ignoreSSLErrors,
+          ),
+          this.fetchUserModelStats(
+            baseUrl,
+            apiId,
+            'monthly',
+            logger,
+            proxy,
+            ignoreSSLErrors,
           ),
-          this.fetchUserModelStats(baseUrl, apiId, 'monthly', logger, proxy),
         ]);
 
       const usage = this.aggregateUsage(userStats, {
@@ -731,6 +753,7 @@ export class ClaudeRelayServiceBalanceProvider implements BalanceProvider {
     apiKey: string,
     logger: ReturnType<typeof createSimpleHttpLogger>,
     proxy: ProxyConfig | undefined,
+    ignoreSSLErrors: boolean,
   ): Promise<string> {
     const endpoint = createEndpoint(baseUrl, 'get-key-id');
     const response = await fetchWithRetry(endpoint, {
@@ -741,6 +764,7 @@ export class ClaudeRelayServiceBalanceProvider implements BalanceProvider {
       },
       body: JSON.stringify({ apiKey }),
       logger,
+      ignoreSSLErrors,
       proxy,
     });
 
@@ -793,6 +817,7 @@ export class ClaudeRelayServiceBalanceProvider implements BalanceProvider {
     apiId: string,
     logger: ReturnType<typeof createSimpleHttpLogger>,
     proxy: ProxyConfig | undefined,
+    ignoreSSLErrors: boolean,
   ): Promise<CrsUserStatsPayload> {
     const endpoint = createEndpoint(baseUrl, 'user-stats');
     const response = await fetchWithRetry(endpoint, {
@@ -803,6 +828,7 @@ export class ClaudeRelayServiceBalanceProvider implements BalanceProvider {
       },
       body: JSON.stringify({ apiId }),
       logger,
+      ignoreSSLErrors,
       proxy,
     });
 
@@ -884,6 +910,7 @@ export class ClaudeRelayServiceBalanceProvider implements BalanceProvider {
     period: CrsModelStatsPeriod,
     logger: ReturnType<typeof createSimpleHttpLogger>,
     proxy: ProxyConfig | undefined,
+    ignoreSSLErrors: boolean,
   ): Promise<CrsModelStatsPayload[]> {
     const endpoint = createEndpoint(baseUrl, 'user-model-stats');
     const response = await fetchWithRetry(endpoint, {
@@ -894,6 +921,7 @@ export class ClaudeRelayServiceBalanceProvider implements BalanceProvider {
       },
       body: JSON.stringify({ apiId, period }),
       logger,
+      ignoreSSLErrors,
       proxy,
     });
 

src/balance/providers/code-assist-quota.ts

@@ -331,6 +331,7 @@ export async function refreshCodeAssistQuota(
         },
         body: JSON.stringify({ project: projectId }),
         logger,
+        ignoreSSLErrors: input.provider.ignoreSSLErrors,
         proxy: input.provider.proxy,
       });
 

src/balance/providers/codex.ts

@@ -503,6 +503,7 @@ export class CodexBalanceProvider implements BalanceProvider {
             ...(accountId ? { 'ChatGPT-Account-Id': accountId } : {}),
           },
           logger,
+          ignoreSSLErrors: input.provider.ignoreSSLErrors,
           proxy: input.provider.proxy,
         });