0j dZddlmZddlZddlZddlZddlmZddlm Z ej e Z dZ hdZdd Zdd ZddZddddZddZddZdS)zPreventive SSL CA certificate checks for Hermes Agent. This module catches broken CA bundle paths before OpenAI/httpx turns them into opaque ``FileNotFoundError: [Errno 2] No such file or directory`` failures. ) annotationsN)Path)SSLConfigurationError)HERMES_CA_BUNDLE SSL_CERT_FILEREQUESTS_CA_BUNDLECURL_CA_BUNDLE>1onyestruereturnboolctjddtvS)NHERMES_SKIP_SSL_GUARD)osgetenvstriplower _SKIP_VALUES5/home/rurouni/.hermes/hermes-agent/agent/ssl_guard.py_skip_ssl_guard_enabledrs2 9,b 1 1 7 7 9 9 ? ? A A\ QQrstrc dS)NzRepair: python -m pip install --force-reinstall certifi openai httpx If you configured a custom corporate CA bundle, fix or unset the broken CA bundle environment variable.rrrr _repair_hintr s 1rmessagercBt|dtS)z=Create a consistent, user-actionable SSL configuration error. )rr)rs r_ssl_errr"(s" G!?!?|~~!?!? @ @@rFrequire_substantiallabelvaluer$Nonec>t|}|st|d||st|d||r2|jdkrt|d|d tjt|}n*#t$r}t|d|d||d}~wwxYw| st|d|d dS) Nz points to a missing CA bundle: z% does not point to a CA bundle file: iz at z appears corrupted (too small))cafilez CA bundle at z cannot be loaded: z did not load any certificates) r expanduserexistsr"is_filestatst_sizesslcreate_default_contextr Exception get_ca_certs)r%r&r$pathctxexcs r_validate_bundle_pathr6-s[ ;; ! ! # #D ;;==J%HHHHIII <<>>O%MMeMMNNNLtyy{{2T99%JJUJJJKKKY(D ::: YYY%NNuNNNNOOUXXY     V%TTuTTTUUUVVs'"C C1C,,C1cvtrtddStD](}t j|}|rt ||) ddl}n%#t$r}td||d}~wwxYwt| }t d|ddS)aVerify configured and bundled CA certificates are present and loadable. Raises: SSLConfigurationError: If an explicit CA-bundle environment variable points at a bad path, or if certifi's bundled ``cacert.pem`` is missing/corrupt. z5SSL CA bundle guard skipped via HERMES_SKIP_SSL_GUARDNrzcertifi is not importable: certifiTr#) rloggerdebug_CA_BUNDLE_ENV_VARSrrr6r8r1r"rwhere)env_varr&r8r5 ca_bundles rverify_ca_bundler?=s   LMMM&22 '""  2 !'5 1 1 1E EEE:S::;;DEGMMOO$$I)YDIIIIIIsA!! B+A>>Bc"tdS)aBackward-compatible wrapper for older call sites. The old PR name mentioned a platform fallback, but allowing startup with a broken certifi bundle still leaves httpx/OpenAI and requests call sites failing later. Keep the wrapper name but enforce the same check. N)r?rrrverify_ca_bundle_with_fallbackrAWsr)rr)rr)rrrr)r%rr&rr$rrr')rr')__doc__ __future__rloggingrr/pathlibr agent.errorsr getLogger__name__r9r;rrrr"r6r?rArrrrIs. #""""" ......  8 $ $*)) RRRRAAAA RW V V V V V V JJJJ4r