fix(security): scope TLS client to login request, don't mutate http.DefaultTransport (#66) (#86)

When --insecure-skip-tls-verify was set, the code globally replaced
http.DefaultTransport, affecting all concurrent and future HTTP calls
in the process. Create a scoped *http.Client instead and pass it via
context to the OIDC/login flow only.

The runLogin function doesn't make any direct HTTP calls itself (it
only starts a local callback server and waits for the OIDC redirect),
so the DefaultTransport mutation was both harmful and unnecessary.
The get_token.go refreshToken function already correctly uses a scoped
http.Client passed via oidc.ClientContext.

Co-authored-by: OpenClaw Bot <bot@openclaw.ai>
Co-authored-by: Mangirdas Judeikis <mangirdas@judeikis.lt>

Author: 3 people

pkg/cli/cmd/login.go

@@ -142,17 +142,6 @@ func runLogin(ctx context.Context, hubURL string, insecure bool) error {
 		fmt.Printf("Could not open browser automatically.\nPlease open the following URL in your browser:\n\n  %s\n\n", authorizeURL)
 	}
 
-	// TODO(#66): This globally replaces http.DefaultTransport when --insecure-skip-tls-verify
-	// is set, poisoning TLS verification for every subsequent HTTP call in the process.
-	// Use a scoped *http.Client per-request instead, or remove entirely (this block
-	// appears to serve no purpose since runLogin doesn't make direct hub HTTP calls).
-	// https://github.com/faroshq/kedge/issues/66
-	if insecure {
-		http.DefaultTransport = &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec
-		}
-	}
-
 	fmt.Println("Waiting for login to complete...")
 
 	// 6. Wait for the callback response.