fix(desktop): trust system certificates (#25837)

packages/desktop/src/main/index.ts

@@ -4,6 +4,7 @@ import { existsSync } from "node:fs"
 import { createServer } from "node:net"
 import { homedir } from "node:os"
 import { join } from "node:path"
+import { getCACertificates, setDefaultCACertificates } from "node:tls"
 import type { Event } from "electron"
 import { app, BrowserWindow, dialog } from "electron"
 import pkg from "electron-updater"
@@ -65,6 +66,8 @@ const pendingDeepLinks: string[] = []
 const serverReady = defer<ServerReadyData>()
 const logger = initLogging()
 
+useSystemCertificates()
+
 logger.log("app starting", {
   version: app.getVersion(),
   packaged: app.isPackaged,
@@ -122,6 +125,14 @@ function setupApp() {
   })
 }
 
+function useSystemCertificates() {
+  try {
+    setDefaultCACertificates([...new Set([...getCACertificates("default"), ...getCACertificates("system")])])
+  } catch (error) {
+    logger.warn("failed to load system certificates", error)
+  }
+}
+
 function emitDeepLinks(urls: string[]) {
   if (urls.length === 0) return
   pendingDeepLinks.push(...urls)

packages/opencode/src/server/adapter.node.ts

@@ -1,3 +1,4 @@
+import { EventEmitter } from "node:events"
 import { createAdaptorServer, type ServerType } from "@hono/node-server"
 import { createNodeWebSocket } from "@hono/node-ws"
 import type { Hono } from "hono"
@@ -7,6 +8,7 @@ async function listen(app: FetchApp, opts: Opts, inject?: (server: ServerType) =
   const start = (port: number) =>
     new Promise<ServerType>((resolve, reject) => {
       const server = createAdaptorServer({ fetch: app.fetch })
+      const events = server as EventEmitter
       inject?.(server)
       const fail = (err: Error) => {
         cleanup()
@@ -17,11 +19,11 @@ async function listen(app: FetchApp, opts: Opts, inject?: (server: ServerType) =
         resolve(server)
       }
       const cleanup = () => {
-        server.off("error", fail)
-        server.off("listening", ready)
+        events.off("error", fail)
+        events.off("listening", ready)
       }
-      server.once("error", fail)
-      server.once("listening", ready)
+      events.once("error", fail)
+      events.once("listening", ready)
       server.listen(port, opts.hostname)
     })