1package agent
2
3import (
4 "context"
5 "net/http"
6 "net/http/httptest"
7 "os"
8 "path/filepath"
9 "strings"
10 "testing"
11
12 "github.com/patriceckhart/zot/packages/provider"
13)
14
15func TestReadAgentsContextLoadsGlobalAndAncestors(t *testing.T) {
16 root := t.TempDir()
17 zotHome := filepath.Join(root, "zot-home")
18 project := filepath.Join(root, "repo")
19 nested := filepath.Join(project, "packages", "app")
20 if err := os.MkdirAll(zotHome, 0o755); err != nil {
21 t.Fatal(err)
22 }
23 if err := os.MkdirAll(nested, 0o755); err != nil {
24 t.Fatal(err)
25 }
26 if err := os.WriteFile(filepath.Join(zotHome, "AGENTS.md"), []byte("global rule"), 0o644); err != nil {
27 t.Fatal(err)
28 }
29 if err := os.WriteFile(filepath.Join(project, "AGENTS.md"), []byte("repo rule"), 0o644); err != nil {
30 t.Fatal(err)
31 }
32 if err := os.WriteFile(filepath.Join(nested, "AGENTS.md"), []byte("app rule"), 0o644); err != nil {
33 t.Fatal(err)
34 }
35
36 files := loadAgentsContext(nested, zotHome)
37 if len(files) != 3 {
38 t.Fatalf("loaded %d context files, want 3: %#v", len(files), files)
39 }
40 wantPaths := []string{
41 filepath.Join(zotHome, "AGENTS.md"),
42 filepath.Join(project, "AGENTS.md"),
43 filepath.Join(nested, "AGENTS.md"),
44 }
45 for idx, want := range wantPaths {
46 if files[idx].Path != want {
47 t.Fatalf("context file %d path = %q, want %q", idx, files[idx].Path, want)
48 }
49 }
50
51 got := formatAgentsContext(files)
52 for _, want := range []string{"global rule", "repo rule", "app rule"} {
53 if !strings.Contains(got, want) {
54 t.Fatalf("formatAgentsContext missing %q in:\n%s", want, got)
55 }
56 }
57 if strings.Index(got, "global rule") > strings.Index(got, "repo rule") || strings.Index(got, "repo rule") > strings.Index(got, "app rule") {
58 t.Fatalf("AGENTS.md files loaded in wrong order:\n%s", got)
59 }
60}
61
62func TestReadAgentsContextMissingFilesIsEmpty(t *testing.T) {
63 files := loadAgentsContext(t.TempDir(), t.TempDir())
64 if len(files) != 0 {
65 t.Fatalf("expected no context files, got %#v", files)
66 }
67 if got := formatAgentsContext(files); got != "" {
68 t.Fatalf("expected no context, got %q", got)
69 }
70}
71
72func TestResolveNoContextFilesSkipsAgentsInstructions(t *testing.T) {
73 zotHome := t.TempDir()
74 cwd := t.TempDir()
75 t.Setenv("ZOT_HOME", zotHome)
76 t.Setenv("OPENAI_API_KEY", "test-key")
77 if err := os.WriteFile(filepath.Join(zotHome, "AGENTS.md"), []byte("global rule"), 0o644); err != nil {
78 t.Fatal(err)
79 }
80 if err := os.WriteFile(filepath.Join(cwd, "AGENTS.md"), []byte("project rule"), 0o644); err != nil {
81 t.Fatal(err)
82 }
83
84 r, err := Resolve(Args{
85 Provider: "openai",
86 Model: "gpt-5",
87 CWD: cwd,
88 NoContextFiles: true,
89 }, false)
90 if err != nil {
91 t.Fatal(err)
92 }
93 if len(r.ContextFiles) != 0 {
94 t.Fatalf("ContextFiles = %#v, want empty", r.ContextFiles)
95 }
96 if strings.Contains(r.SystemPrompt, "global rule") || strings.Contains(r.SystemPrompt, "project rule") {
97 t.Fatalf("system prompt contains disabled context files:\n%s", r.SystemPrompt)
98 }
99}
100
101func TestResolveExplicitEmptySystemPromptOverridesPersistentPrompt(t *testing.T) {
102 zotHome := t.TempDir()
103 cwd := t.TempDir()
104 t.Setenv("ZOT_HOME", zotHome)
105 t.Setenv("OPENAI_API_KEY", "test-key")
106 if err := os.WriteFile(filepath.Join(zotHome, "SYSTEM.md"), []byte("persistent instructions"), 0o644); err != nil {
107 t.Fatal(err)
108 }
109
110 r, err := Resolve(Args{
111 Provider: "openai",
112 Model: "gpt-5",
113 CWD: cwd,
114 SystemPromptSet: true,
115 SystemPrompt: "",
116 NoContextFiles: true,
117 NoSkill: true,
118 }, false)
119 if err != nil {
120 t.Fatal(err)
121 }
122 for _, unwanted := range []string{"persistent instructions", defaultIdentity, "Zot's own docs are installed under"} {
123 if strings.Contains(r.SystemPrompt, unwanted) {
124 t.Fatalf("explicit empty system prompt unexpectedly contains %q:\n%s", unwanted, r.SystemPrompt)
125 }
126 }
127}
128
129// TestResolveFallsBackWhenConfiguredModelIsGone reproduces the
130// startup failure caught by the user's screenshot: the persisted
131// config.json points at a model id that's no longer in the active
132// catalogue (because they edited models.json or zot's bundled
133// catalogue changed). Resolve must NOT error — strands the user
134// with no way to fix it from the TUI — and should repair the config
135// so the next launch is silent.
136func TestResolveFallsBackWhenConfiguredModelIsGone(t *testing.T) {
137 t.Setenv("ZOT_HOME", t.TempDir())
138 t.Setenv("OPENAI_API_KEY", "test-key")
139 // Persist a stale model id.
140 stale := "gpt-5.5-pro-not-real"
141 if err := SaveConfig(Config{Provider: "openai", Model: stale}); err != nil {
142 t.Fatal(err)
143 }
144
145 r, err := Resolve(Args{}, false)
146 if err != nil {
147 t.Fatalf("Resolve refused to launch with stale model: %v", err)
148 }
149 if r.Model == stale {
150 t.Fatalf("Resolve kept stale model %q", r.Model)
151 }
152 if r.Provider != "openai" {
153 t.Errorf("provider drifted: got %q; want openai", r.Provider)
154 }
155
156 // Config on disk should now hold the fallback so subsequent
157 // launches don't repeat the warning.
158 cfg, _ := LoadConfig()
159 if cfg.Model == stale {
160 t.Errorf("config.json still pins the stale model %q", cfg.Model)
161 }
162 if cfg.Model == "" {
163 t.Errorf("config.json was emptied; expected the fallback model id")
164 }
165}
166
167func TestResolveAppliesJailByDefault(t *testing.T) {
168 for _, tc := range []struct {
169 name string
170 config Config
171 want bool
172 }{
173 {name: "missing defaults to unlocked", config: Config{Provider: "openai", Model: "gpt-5"}},
174 {name: "enabled starts locked", config: Config{Provider: "openai", Model: "gpt-5", JailByDefault: boolPtr(true)}, want: true},
175 } {
176 t.Run(tc.name, func(t *testing.T) {
177 t.Setenv("ZOT_HOME", t.TempDir())
178 t.Setenv("OPENAI_API_KEY", "test-key")
179 if err := SaveConfig(tc.config); err != nil {
180 t.Fatal(err)
181 }
182
183 r, err := Resolve(Args{}, false)
184 if err != nil {
185 t.Fatalf("Resolve failed: %v", err)
186 }
187 if got := r.Sandbox.Locked(); got != tc.want {
188 t.Fatalf("sandbox locked = %v, want %v", got, tc.want)
189 }
190 })
191 }
192}
193
194func boolPtr(v bool) *bool { return &v }
195
196// TestResolveExplicitFlagStaleDoesNotRepairConfig confirms the
197// repair-on-disk happens ONLY when the stale id came from the
198// persisted config. If the user passed --model X explicitly and X is
199// unknown, we still fall back, but we don't touch their config.
200func TestResolveExplicitFlagStaleDoesNotRepairConfig(t *testing.T) {
201 t.Setenv("ZOT_HOME", t.TempDir())
202 t.Setenv("OPENAI_API_KEY", "test-key")
203 good := "gpt-5"
204 if err := SaveConfig(Config{Provider: "openai", Model: good}); err != nil {
205 t.Fatal(err)
206 }
207
208 r, err := Resolve(Args{Model: "gpt-totally-fake"}, false)
209 if err != nil {
210 t.Fatalf("Resolve errored on unknown --model: %v", err)
211 }
212 if r.Model == "gpt-totally-fake" {
213 t.Errorf("Resolve kept the bogus --model value")
214 }
215 cfg, _ := LoadConfig()
216 if cfg.Model != good {
217 t.Errorf("config.json was clobbered (was %q; now %q)", good, cfg.Model)
218 }
219}
220
221func TestResolveOpenRouterPreservesSavedRoutedModelID(t *testing.T) {
222 t.Setenv("ZOT_HOME", t.TempDir())
223 t.Setenv("OPENROUTER_API_KEY", "test-key")
224 want := "deepseek/deepseek-v4-flash"
225 if err := SaveConfig(Config{Provider: "openrouter", Model: want}); err != nil {
226 t.Fatal(err)
227 }
228
229 r, err := Resolve(Args{}, true)
230 if err != nil {
231 t.Fatalf("Resolve failed: %v", err)
232 }
233 if r.Provider != "openrouter" {
234 t.Fatalf("provider = %q, want openrouter", r.Provider)
235 }
236 if r.Model != want {
237 t.Fatalf("model = %q, want %q", r.Model, want)
238 }
239 if r.MaxOutput != 64000 {
240 t.Fatalf("MaxOutput = %d, want synthetic gateway default 64000", r.MaxOutput)
241 }
242}
243
244func TestResolveGatewayPlainUnknownModelFallsBack(t *testing.T) {
245 t.Setenv("ZOT_HOME", t.TempDir())
246 t.Setenv("OPENROUTER_API_KEY", "test-key")
247 stale := "not-a-routed-model"
248 if err := SaveConfig(Config{Provider: "openrouter", Model: stale}); err != nil {
249 t.Fatal(err)
250 }
251
252 r, err := Resolve(Args{}, true)
253 if err != nil {
254 t.Fatalf("Resolve failed: %v", err)
255 }
256 if r.Provider != "openrouter" {
257 t.Fatalf("provider = %q, want openrouter", r.Provider)
258 }
259 if r.Model == stale || r.Model == "" {
260 t.Fatalf("model = %q, want repaired gateway default", r.Model)
261 }
262}
263
264// TestResolveEnvOnlyBedrockDiscoveredWithoutConfig reproduces issue
265// #15: pointing ZOT_HOME at a fresh dir drops the persisted
266// config.json (which pinned provider=amazon-bedrock). Resolve must
267// still discover bedrock from the AWS env vars instead of falling back
268// to anthropic and reporting "not logged in".
269func TestResolveEnvOnlyBedrockDiscoveredWithoutConfig(t *testing.T) {
270 t.Setenv("ZOT_HOME", t.TempDir()) // fresh home: no config.json
271 // Disable the Kimi CLI token fallback so a developer machine with a
272 // real Kimi CLI login doesn't pre-empt bedrock in the scan.
273 if err := SetKimiCLIFallbackDisabled(true); err != nil {
274 t.Fatal(err)
275 }
276 t.Setenv("AWS_BEARER_TOKEN_BEDROCK", "test-bedrock-token")
277 t.Setenv("AWS_REGION", "us-east-1")
278 // Make sure no other provider's env credential pre-empts bedrock.
279 for _, k := range []string{"ANTHROPIC_API_KEY", "ANTHROPIC_OAUTH_TOKEN", "OPENAI_API_KEY", "GEMINI_API_KEY", "GOOGLE_API_KEY", "DEEPSEEK_API_KEY", "KIMI_API_KEY", "MOONSHOT_API_KEY"} {
280 t.Setenv(k, "")
281 }
282
283 r, err := Resolve(Args{}, true)
284 if err != nil {
285 t.Fatalf("Resolve errored with env-only bedrock: %v", err)
286 }
287 if r.Provider != "amazon-bedrock" {
288 t.Fatalf("provider = %q, want amazon-bedrock", r.Provider)
289 }
290 if !r.HasCredential() {
291 t.Fatalf("bedrock credential not resolved from env")
292 }
293}
294
295func TestResolveOllamaUsesModelBaseURLBeforeDefault(t *testing.T) {
296 t.Setenv("ZOT_HOME", t.TempDir())
297 provider.SetLiveModels(nil)
298 defer provider.SetLiveModels(nil)
299 provider.SetUserModels([]provider.Model{{
300 Provider: "ollama",
301 ID: "qwen-local",
302 DisplayName: "Qwen Local",
303 ContextWindow: 32768,
304 MaxOutput: 8192,
305 BaseURL: "http://localhost:8000/v1",
306 }})
307
308 r, err := Resolve(Args{Provider: "ollama", Model: "qwen-local"}, false)
309 if err != nil {
310 t.Fatalf("Resolve failed: %v", err)
311 }
312 if r.BaseURL != "http://localhost:8000/v1" {
313 t.Fatalf("BaseURL = %q, want models.json baseUrl", r.BaseURL)
314 }
315}
316
317func TestResolveUsesInheritedSwarmCredential(t *testing.T) {
318 t.Setenv("ZOT_HOME", t.TempDir())
319 t.Setenv("OPENAI_API_KEY", "")
320
321 r, err := Resolve(Args{
322 Provider: "openai",
323 Model: "gpt-5",
324 inheritedCredential: "inherited-key",
325 inheritedAuthMethod: "apikey",
326 inheritedAccountID: "account-id",
327 }, true)
328 if err != nil {
329 t.Fatal(err)
330 }
331 if r.Credential != "inherited-key" || r.AuthMethod != "apikey" || r.AccountID != "account-id" {
332 t.Fatalf("inherited credential was not preserved: %+v", r)
333 }
334}
335
336func TestResolveLlamaCPPUsesRouterInferenceURL(t *testing.T) {
337 t.Setenv("ZOT_HOME", t.TempDir())
338 t.Setenv("LLAMA_BASE_URL", "http://127.0.0.1:8080/v1/")
339 t.Setenv("LLAMA_API_KEY", "")
340 provider.SetManagedModels(nil)
341 t.Cleanup(func() { provider.SetManagedModels(nil) })
342
343 r, err := Resolve(Args{Provider: "llama.cpp", Model: "local-model"}, true)
344 if err != nil {
345 t.Fatalf("Resolve failed: %v", err)
346 }
347 if r.BaseURL != "http://127.0.0.1:8080/v1" {
348 t.Fatalf("BaseURL = %q", r.BaseURL)
349 }
350 if r.Credential != "local" || !r.HasCredential() {
351 t.Fatalf("credential = %q", r.Credential)
352 }
353 if got := r.NewClient().Name(); got != "openai" {
354 t.Fatalf("client name = %q", got)
355 }
356}
357
358func TestResolveLlamaCPPUsesStoredLogin(t *testing.T) {
359 t.Setenv("ZOT_HOME", t.TempDir())
360 t.Setenv("LLAMA_BASE_URL", "")
361 t.Setenv("LLAMA_API_KEY", "")
362 if err := AuthStoreFor().SetEndpointCredential("llama.cpp", "http://localhost:9090", "stored-key"); err != nil {
363 t.Fatal(err)
364 }
365
366 r, err := Resolve(Args{Provider: "llama.cpp", Model: "stored-model"}, true)
367 if err != nil {
368 t.Fatalf("Resolve failed: %v", err)
369 }
370 if r.BaseURL != "http://localhost:9090/v1" || r.Credential != "stored-key" {
371 t.Fatalf("resolved = base %q credential %q", r.BaseURL, r.Credential)
372 }
373}
374
375func TestResolveCustomProviderModelBaseURLBeatsProviderBaseURL(t *testing.T) {
376 t.Setenv("ZOT_HOME", t.TempDir())
377 t.Setenv("MY_COMPANY_API_KEY", "test-key")
378 path := filepath.Join(t.TempDir(), "models.json")
379 if err := os.WriteFile(path, []byte(`{
380 "providers": {
381 "my-company": {
382 "baseUrl": "https://provider.example.com/v1",
383 "api": "openai",
384 "models": [
385 {"id": "fast", "baseUrl": "https://model.example.com/v1"}
386 ]
387 }
388 }
389 }`), 0o644); err != nil {
390 t.Fatal(err)
391 }
392 models, warnings := provider.LoadUserModelsWithWarnings(path)
393 if len(warnings) != 0 {
394 t.Fatalf("warnings = %v", warnings)
395 }
396 provider.SetLiveModels(nil)
397 provider.SetUserModels(models)
398 t.Cleanup(func() { provider.SetLiveModels(nil) })
399
400 r, err := Resolve(Args{Provider: "my-company", Model: "fast"}, true)
401 if err != nil {
402 t.Fatalf("Resolve failed: %v", err)
403 }
404 if r.BaseURL != "https://model.example.com/v1" {
405 t.Fatalf("BaseURL = %q, want model-level baseUrl", r.BaseURL)
406 }
407}
408
409func TestCustomProviderUsesOpenAIResponsesAPI(t *testing.T) {
410 requestPath := make(chan string, 1)
411 srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
412 requestPath <- r.URL.Path
413 w.Header().Set("Content-Type", "text/event-stream")
414 w.WriteHeader(http.StatusOK)
415 }))
416 t.Cleanup(srv.Close)
417
418 path := filepath.Join(t.TempDir(), "models.json")
419 if err := os.WriteFile(path, []byte(`{
420 "providers": {
421 "company-responses": {
422 "baseUrl": "`+srv.URL+`/v1",
423 "api": "openai-responses",
424 "models": [{"id": "reasoning-model", "reasoning": true}]
425 }
426 }
427 }`), 0o644); err != nil {
428 t.Fatal(err)
429 }
430 models, warnings := provider.LoadUserModelsWithWarnings(path)
431 if len(warnings) != 0 {
432 t.Fatalf("warnings = %v", warnings)
433 }
434 provider.SetLiveModels(nil)
435 provider.SetUserModels(models)
436 t.Cleanup(func() { provider.SetLiveModels(nil) })
437
438 r := Resolved{
439 Provider: "company-responses",
440 Credential: "test-key",
441 BaseURL: srv.URL + "/v1",
442 }
443 events, err := r.NewClient().Stream(context.Background(), provider.Request{
444 Model: "reasoning-model",
445 Messages: []provider.Message{{Role: provider.RoleUser, Content: []provider.Content{provider.TextBlock{Text: "hello"}}}},
446 })
447 if err != nil {
448 t.Fatal(err)
449 }
450 for range events {
451 }
452 if got := <-requestPath; got != "/v1/responses" {
453 t.Fatalf("request path = %q, want /v1/responses", got)
454 }
455}
456
457func TestResolveCustomProviderInsecureFromModelsJSONBaseURL(t *testing.T) {
458 t.Setenv("ZOT_HOME", t.TempDir())
459 t.Setenv("LOCAL_PROXY_API_KEY", "test-key")
460 path := filepath.Join(t.TempDir(), "models.json")
461 if err := os.WriteFile(path, []byte(`{
462 "providers": {
463 "local-proxy": {
464 "baseUrl": "https://proxy.example.com/v1",
465 "api": "openai",
466 "models": [{"id": "default"}]
467 }
468 }
469 }`), 0o644); err != nil {
470 t.Fatal(err)
471 }
472 models, warnings := provider.LoadUserModelsWithWarnings(path)
473 if len(warnings) != 0 {
474 t.Fatalf("warnings = %v", warnings)
475 }
476 provider.SetLiveModels(nil)
477 provider.SetUserModels(models)
478 t.Cleanup(func() { provider.SetLiveModels(nil) })
479
480 r, err := Resolve(Args{Provider: "local-proxy", Model: "default", InsecureTLS: true}, true)
481 if err != nil {
482 t.Fatalf("Resolve failed: %v", err)
483 }
484 if !r.InsecureTLS {
485 t.Fatal("InsecureTLS must be set for --insecure with models.json custom baseUrl")
486 }
487}
488
489func TestResolveOllamaFallsBackToDefaultBaseURL(t *testing.T) {
490 t.Setenv("ZOT_HOME", t.TempDir())
491 provider.SetLiveModels(nil)
492 defer provider.SetLiveModels(nil)
493
494 r, err := Resolve(Args{Provider: "ollama", Model: "any-local-model"}, false)
495 if err != nil {
496 t.Fatalf("Resolve failed: %v", err)
497 }
498 if r.BaseURL != "http://localhost:11434" {
499 t.Fatalf("BaseURL = %q, want ollama default", r.BaseURL)
500 }
501}
502
503func TestCanonicalProviderResolvesAliases(t *testing.T) {
504 cases := map[string]string{
505 "bedrock": "amazon-bedrock",
506 "AWS-Bedrock": "amazon-bedrock",
507 " bedrock ": "amazon-bedrock",
508 "vertex": "google-vertex",
509 "gemini": "google",
510 "azure": "azure-openai-responses",
511 "copilot": "github-copilot",
512 "codex": "openai-codex",
513 "moonshot": "moonshotai",
514 "vercel": "vercel-ai-gateway",
515 "hf": "huggingface",
516 "anthropic": "anthropic", // canonical passes through
517 "amazon-bedrock": "amazon-bedrock", // already canonical
518 "totally-unknown": "totally-unknown", // unknown returned unchanged (lowered)
519 "Totally-UNKNOWN": "totally-unknown",
520 "": "",
521 }
522 for in, want := range cases {
523 if got := canonicalProvider(in); got != want {
524 t.Errorf("canonicalProvider(%q) = %q, want %q", in, got, want)
525 }
526 }
527}
528
529func TestCanonicalProviderAliasesAreKnown(t *testing.T) {
530 for alias, canon := range providerAliases {
531 if !isKnownProvider(canon) {
532 t.Errorf("alias %q maps to %q which is not a known provider", alias, canon)
533 }
534 }
535}
536
537func TestResolveInsecureOnlyWithExplicitBaseURL(t *testing.T) {
538 orig := http.DefaultTransport
539 t.Cleanup(func() { http.DefaultTransport = orig })
540
541 t.Setenv("ZOT_HOME", t.TempDir())
542 t.Setenv("OPENAI_API_KEY", "test-key")
543
544 resolved, err := Resolve(Args{Provider: "moonshotai", InsecureTLS: true}, false)
545 if err != nil {
546 t.Fatalf("Resolve: %v", err)
547 }
548 if resolved.InsecureTLS {
549 t.Fatal("InsecureTLS must not be set for built-in provider base URLs")
550 }
551 assertDefaultTransportStillSecure(t)
552
553 resolved, err = Resolve(Args{Provider: "openai", InsecureTLS: true, BaseURL: "https://my-llm.internal/v1"}, false)
554 if err != nil {
555 t.Fatalf("Resolve: %v", err)
556 }
557 if !resolved.InsecureTLS {
558 t.Fatal("InsecureTLS must be set with --insecure and explicit --base-url")
559 }
560 assertDefaultTransportStillSecure(t)
561}
562
563func TestResolveInsecureFromConfigRequiresExplicitBaseURL(t *testing.T) {
564 orig := http.DefaultTransport
565 t.Cleanup(func() { http.DefaultTransport = orig })
566
567 t.Setenv("ZOT_HOME", t.TempDir())
568 t.Setenv("OPENAI_API_KEY", "test-key")
569 if err := SaveConfig(Config{Provider: "openai", Insecure: true}); err != nil {
570 t.Fatal(err)
571 }
572
573 resolved, err := Resolve(Args{Provider: "openai"}, false)
574 if err != nil {
575 t.Fatalf("Resolve: %v", err)
576 }
577 if resolved.InsecureTLS {
578 t.Fatal("InsecureTLS must not be set without a custom base URL")
579 }
580 assertDefaultTransportStillSecure(t)
581
582 resolved, err = Resolve(Args{Provider: "openai", BaseURL: "https://my-llm.internal/v1"}, false)
583 if err != nil {
584 t.Fatalf("Resolve: %v", err)
585 }
586 if !resolved.InsecureTLS {
587 t.Fatal("InsecureTLS must be set when config insecure=true and --base-url is provided")
588 }
589 assertDefaultTransportStillSecure(t)
590}
591
592func TestDefaultXAIModelIsGrok45(t *testing.T) {
593 if got := defaultModelForProvider("xai"); got != "grok-4.5" {
594 t.Fatalf("default xAI model = %q, want grok-4.5", got)
595 }
596}
597
598func assertDefaultTransportStillSecure(t *testing.T) {
599 t.Helper()
600 tr, ok := http.DefaultTransport.(*http.Transport)
601 if !ok {
602 return
603 }
604 if tr.TLSClientConfig != nil && tr.TLSClientConfig.InsecureSkipVerify {
605 t.Fatal("http.DefaultTransport must not be made insecure")
606 }
607}