Why
On #99, a new daemon integration test set NODE_TLS_REJECT_UNAUTHORIZED=0 and
rejectUnauthorized: false, copied from older tests. CodeQL flagged two high-severity
alerts and the PR needed a second review round to fix. A written lesson in
.agents/memory/LESSONS.md only helps if it's read and remembered; an ESLint rule catches
it every time, before review.
Expected outcome
pnpm lint fails when a test file sets process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0" or
passes rejectUnauthorized: false (or an equivalent TLS-verification bypass) to a TLS/HTTPS
client option. The correct pattern — trusting the daemon's own certificate via
ca: daemon.tls.current().certPem — is unaffected.
Constraints and non-goals
Repo already enforces module boundaries and no vi.mock via custom ESLint rules (#88); this
follows the same pattern. Should not fire on non-test files or on the daemon's own TLS setup
code, only on client/test code disabling verification. Out of scope: a general "no
insecure crypto" rule — just this specific bypass.
How we know it is done
pnpm lint fails on a test file containing NODE_TLS_REJECT_UNAUTHORIZED = "0" or
rejectUnauthorized: false.pnpm lint passes on a test that instead trusts the daemon's cert via ca: ...certPem.- Existing test suite is unaffected (no false positives on legitimate TLS setup code).
Alternatives considered
Rely on the memory lesson alone — rejected, since it already failed to prevent a repeat
within one PR cycle and CodeQL is a review-time backstop, not a pre-commit one.
Why
On #99, a new daemon integration test set
NODE_TLS_REJECT_UNAUTHORIZED=0andrejectUnauthorized: false, copied from older tests. CodeQL flagged two high-severityalerts and the PR needed a second review round to fix. A written lesson in
.agents/memory/LESSONS.mdonly helps if it's read and remembered; an ESLint rule catchesit every time, before review.
Expected outcome
pnpm lintfails when a test file setsprocess.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"orpasses
rejectUnauthorized: false(or an equivalent TLS-verification bypass) to a TLS/HTTPSclient option. The correct pattern — trusting the daemon's own certificate via
ca: daemon.tls.current().certPem— is unaffected.Constraints and non-goals
Repo already enforces module boundaries and no
vi.mockvia custom ESLint rules (#88); thisfollows the same pattern. Should not fire on non-test files or on the daemon's own TLS setup
code, only on client/test code disabling verification. Out of scope: a general "no
insecure crypto" rule — just this specific bypass.
How we know it is done
pnpm lintfails on a test file containingNODE_TLS_REJECT_UNAUTHORIZED = "0"orrejectUnauthorized: false.pnpm lintpasses on a test that instead trusts the daemon's cert viaca: ...certPem.Alternatives considered
Rely on the memory lesson alone — rejected, since it already failed to prevent a repeat
within one PR cycle and CodeQL is a review-time backstop, not a pre-commit one.