fix: support SSL_CERT_FILE for TLS certificate configuration

[mtorp]

Summary

• Fixes "unable to get local issuer certificate" errors for users behind corporate proxies with SSL inspection (e.g. Cloudflare)
• SSL_CERT_FILE now works for the parent socket-cli process, not just spawned child processes
• Manually reads extra CA certificates and passes them to HTTPS agents when NODE_EXTRA_CA_CERTS wasn't set at Node.js startup

Problem

Node.js reads NODE_EXTRA_CA_CERTS only at process startup (in C++, before any JS runs). The CLI mapped SSL_CERT_FILE → constants.ENV.NODE_EXTRA_CA_CERTS internally, but never propagated it to the TLS stack of the running process. This meant:

Env var	Parent process (socket-cli)	Child process (Coana CLI)
NODE_EXTRA_CA_CERTS	Worked	Worked
SSL_CERT_FILE only	Broken	Worked (via constants.processEnv)

Solution

sdk.mts — New getExtraCaCerts() function that:

• Returns undefined when NODE_EXTRA_CA_CERTS is already set (Node.js handles it)
• Reads the cert file from SSL_CERT_FILE and combines with tls.rootCertificates
• Results are cached to avoid repeated file reads
• Passes ca to HttpsAgent (no proxy) or HttpsProxyAgent (with proxy, including proxyConnectOptions)
• Logs a debug warning when the certificate file cannot be read

api.mts — New apiFetch() wrapper that:

• Falls back to node:https.request with a custom agent when extra CA certs are needed
• Uses regular fetch() when no extra certs are needed (zero overhead for normal users)
• Constructs a standard Response object from the https.request output
• Sets Content-Length header for request bodies to avoid chunked transfer encoding divergence from fetch()
• Follows 3xx redirects to match fetch() behavior (301/302/303 → GET; 307/308 preserve method/body; max 20 redirects)
• Strips Authorization, Cookie, and Proxy-Authorization headers on cross-origin redirects per the Fetch spec
• Exported for use by non-Socket-API callers (GitHub API, npm registry)

create-scan-from-github.mts — All 5 GitHub API fetch() calls now route through apiFetch(), so SSL_CERT_FILE also works for GitHub scan operations.

dlx-binary.mts — The npm registry fetch() call now routes through apiFetch(), so SSL_CERT_FILE also works for binary downloads.

Test plan

• Verify pnpm check passes (lint + typecheck)
• Verify pnpm test:unit src/utils/sdk.test.mts src/utils/api.test.mts passes (35 tests)
• Content-Length header is set for POST requests through httpsRequest path
• 3xx redirects are followed correctly in httpsRequest path
• Sensitive headers stripped on cross-origin redirects
• Sensitive headers preserved on same-origin redirects
• Test with SSL_CERT_FILE=/path/to/cert.pem socket scan create --reach . behind a corporate proxy
• Test with NODE_EXTRA_CA_CERTS=/path/to/cert.pem socket scan create --reach . (should still work)
• Test without any cert env vars (should behave exactly as before)

---

Note

Medium Risk
Introduces a new apiFetch implementation that reimplements parts of fetch() (HTTPS request handling + redirects + header stripping) and changes multiple network call sites to use it, so subtle HTTP/TLS behavior differences could affect downloads or API calls in edge cases.

Overview
Enables SSL_CERT_FILE to affect the running CLI process, not just spawned child processes, by adding getExtraCaCerts() in sdk.mts and wiring the resulting CA bundle into HttpsAgent/proxy agents during setupSdk.

Adds an apiFetch() wrapper in api.mts that conditionally uses node:https.request with a cached custom agent (including redirect following and sensitive-header stripping on cross-origin redirects), and updates direct fetch() usage to apiFetch() for Socket API calls, GitHub scan operations (create-scan-from-github.mts), and binary downloads (dlx-binary.mts).

Adds unit test coverage for the new CA-loading and apiFetch behaviors (sdk.test.mts, new api.test.mts).

^{Written by Cursor Bugbot for commit e92cf75. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

Comment @cursor review or bugbot run to trigger another review on this PR