@make-u-free/migi 0.2.2 → 0.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@make-u-free/migi",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Your AI right-hand agent. Works anywhere, with any LLM API.",
   "type": "module",
   "bin": {

package/src/tls.js

@@ -2,13 +2,14 @@ import { existsSync, readFileSync } from 'fs'
 import { join } from 'path'
 import { homedir } from 'os'
 import https from 'https'
+import tls from 'tls'
 
 // CA ファイルの検索順（単体 .crt / bundle.pem どちらでも可）
 const CA_CANDIDATES = [
-  process.env.NODE_EXTRA_CA_CERTS,                       // 環境変数で明示指定
-  join(homedir(), '.migi', 'zscaler-ca.pem'),            // Zscaler 推奨パス
-  join(homedir(), '.migi', 'zscaler-ca.crt'),            // .crt 形式でも OK
-  join(homedir(), '.migi', 'ca-bundle.pem'),             // 複数CA連結 bundle
+  process.env.NODE_EXTRA_CA_CERTS,
+  join(homedir(), '.migi', 'zscaler-ca.pem'),
+  join(homedir(), '.migi', 'zscaler-ca.crt'),
+  join(homedir(), '.migi', 'ca-bundle.pem'),
 ].filter(Boolean)
 
 function findCA() {
@@ -20,12 +21,31 @@ function findCA() {
 
 export const caPath = findCA()
 
-// NODE_EXTRA_CA_CERTS: Node 18+ built-in fetch / undici 向け
-if (caPath && !process.env.NODE_EXTRA_CA_CERTS) {
-  process.env.NODE_EXTRA_CA_CERTS = caPath
+let _httpsAgent = null
+
+if (caPath) {
+  const caCert = readFileSync(caPath)
+
+  // ① tls.createSecureContext パッチ
+  //    Node 18+ built-in fetch (undici) を含む全TLS接続に効く
+  const _origCreate = tls.createSecureContext
+  tls.createSecureContext = (options = {}) => {
+    const extra = [caCert]
+    const existing = options.ca
+      ? (Array.isArray(options.ca) ? options.ca : [options.ca])
+      : []
+    return _origCreate({ ...options, ca: [...existing, ...extra] })
+  }
+
+  // ② NODE_EXTRA_CA_CERTS（環境変数で起動する場合のフォールバック）
+  if (!process.env.NODE_EXTRA_CA_CERTS) {
+    process.env.NODE_EXTRA_CA_CERTS = caPath
+  }
+
+  // ③ https.Agent（node-fetch 系フォールバック）
+  _httpsAgent = new https.Agent({ ca: caCert })
+
+  console.error(`  [TLS] CA loaded: ${caPath}`)
 }
 
-// https.Agent: openai SDK の httpAgent オプション向け
-export const httpsAgent = caPath
-  ? new https.Agent({ ca: readFileSync(caPath) })
-  : null
+export const httpsAgent = _httpsAgent