feat: add allowSelfSignedCerts config for corporate TLS

[RobertLD]

Adds indexing.allowSelfSignedCerts config option to accept self-signed or untrusted TLS certificates when fetching URLs from internal servers.

Problem: Fetching from internal services (e.g. Confluence) behind corporate CAs with self-signed certificates fails with SELF_SIGNED_CERT_IN_CHAIN.

Fix:

• New config key: indexing.allowSelfSignedCerts (default: false)
• New env var: LIBSCOPE_ALLOW_SELF_SIGNED_CERTS
• CLI: libscope config set indexing.allowSelfSignedCerts true
• Temporarily sets NODE_TLS_REJECT_UNAUTHORIZED=0 during fetch, restores after
• Wired through CLI, MCP server, and API routes

Docs updated: README, docs site (configuration guide, reference, CLI reference), agents.md (added full Documentation section with checklist for future changes).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
libscope	Building	Preview, Comment	Mar 2, 2026 5:03pm

In general, the fix is to stop using the global NODE_TLS_REJECT_UNAUTHORIZED environment variable to disable TLS verification and instead configure TLS behaviour on a per‑connection or per‑request basis, or simply always enforce certificate validation. That way, TLS security is never globally turned off, and any exceptional handling of self‑signed certificates can be constrained and explicit.

For this code, the safest fix that preserves existing functionality as much as possible is:

• Remove the logic that mutates process.env["NODE_TLS_REJECT_UNAUTHORIZED"].
• Pass the allowSelfSignedCerts flag down into _fetchWithRedirects, and, inside that function, configure the underlying HTTP client for that single request. However, we don’t see _fetchWithRedirects’s implementation, so we must not assume or change its internals.
• Within the shown snippet, the only change we can safely make is to stop disabling TLS globally and instead ignore allowSelfSignedCerts here. This will enforce proper certificate validation for all requests, eliminating the vulnerability. The behavioural change is that self‑signed/untrusted certs will now cause fetch to fail instead of being accepted; given the security guidance, that is appropriate.

Concretely, in src/core/url-fetcher.ts, in fetchWithRedirects, remove lines 159–175 (the env var manipulation and try/finally) and replace the function body with a direct call to _fetchWithRedirects(url, timeout, maxRedirects, allowPrivateUrls);. The function signature can remain as is so existing callers don’t break; we just stop using allowSelfSignedCerts here. No new imports or helper methods are needed for this minimal, secure fix.