fix(image-analysis): harden runtime and provisioning

lib/hooks/image-analysis-runtime.cjs

@@ -9,6 +9,7 @@ const DEFAULT_MODEL = 'gemini-2.5-flash';
 const DEFAULT_TIMEOUT_SEC = 60;
 const MAX_FILE_SIZE_MB = 10;
 const MAX_FILE_SIZE_BYTES = MAX_FILE_SIZE_MB * 1024 * 1024;
+const MAX_PROMPT_TEMPLATE_BYTES = 32 * 1024;
 const SCREENSHOT_NAME_REGEX =
   /(screen[-_ ]?shot|screen[-_ ]?capture|screencap|snapshot|snip|clip|capture)/i;
 const TEMPLATE_FILE_NAMES = {
@@ -103,6 +104,10 @@ function selectPromptTemplate(filePath, requestedTemplate) {
 
 function readPromptFile(filePath) {
   try {
+    const stats = fs.statSync(filePath);
+    if (stats.size > MAX_PROMPT_TEMPLATE_BYTES) {
+      return null;
+    }
     const content = fs.readFileSync(filePath, 'utf8').trim();
     return content.length > 0 ? content : null;
   } catch {
@@ -189,10 +194,6 @@ function getRuntimeBaseUrl() {
         return normalizedBaseUrl;
       }
 
-      if (normalizedPath.length > 0 && normalizedPath !== '/') {
-        return normalizedBaseUrl;
-      }
-
       parsed.pathname = runtimePath;
       return parsed.toString().replace(/\/+$/, '');
     } catch {
@@ -217,6 +218,11 @@ function getApiKey() {
   return process.env.CCS_CLIPROXY_API_KEY || process.env.ANTHROPIC_AUTH_TOKEN || 'ccs-internal-managed';
 }
 
+function shouldAllowSelfSigned() {
+  const value = `${process.env.CCS_IMAGE_ANALYSIS_RUNTIME_ALLOW_SELF_SIGNED || ''}`.trim().toLowerCase();
+  return value === '1' || value === 'true' || value === 'yes';
+}
+
 function getTimeoutMs(timeoutMs) {
   if (typeof timeoutMs === 'number' && timeoutMs > 0) {
     return timeoutMs;
@@ -301,6 +307,7 @@ function analyzeViaCliProxy(base64Data, mediaType, model, prompt, timeoutMs) {
   return new Promise((resolve, reject) => {
     const endpoint = new URL(getRuntimeEndpoint());
     const transport = endpoint.protocol === 'https:' ? https : http;
+    const apiKey = getApiKey();
     const requestBody = JSON.stringify({
       model,
       max_tokens: 4096,
@@ -325,9 +332,13 @@ function analyzeViaCliProxy(base64Data, mediaType, model, prompt, timeoutMs) {
         headers: {
           'Content-Type': 'application/json',
           'Content-Length': Buffer.byteLength(requestBody),
-          'x-api-key': getApiKey(),
+          'x-api-key': apiKey,
+          Authorization: `Bearer ${apiKey}`,
         },
         timeout: timeoutMs,
+        ...(endpoint.protocol === 'https:' && shouldAllowSelfSigned()
+          ? { rejectUnauthorized: false }
+          : {}),
       },
       (res) => {
         let data = '';