(GjdZddlmZddlZddlZddlZddlmZddlm Z m Z ej e Z dd Zddd d ddZdS)z8TLS verify resolution for httpx/OpenAI provider clients.) annotationsN)Path)AnyOptional ssl_verifyrreturnboolc|durdSt|tr*|dvrdSdS)NFT>0noofffalse) isinstancestrstriplower)rs 6/home/rurouni/.hermes/hermes-agent/agent/ssl_verify.py_coerce_insecurersQUt*c""z'7'7'9'9'?'?'A'AE`'`'`t 5) ca_bundlerbase_urlr Optional[str]rrbool | ssl.SSLContextct|rtd|pddS|pdpt jddptt jddpMt jddp&t jdd}|r}t t|}tj |rtj | Std |d S) uResolve httpx ``verify`` for provider HTTP clients. Priority: 1. ``ssl_verify: false`` — disable verification (local dev only) 2. explicit ``ca_bundle`` (per-provider ``ssl_ca_cert`` config field) 3. ``HERMES_CA_BUNDLE``, ``SSL_CERT_FILE``, ``REQUESTS_CA_BUNDLE``, ``CURL_CA_BUNDLE`` env vars 4. ``True`` (httpx/certifi default) ``base_url`` is used only for the insecure-mode warning message. uTLS certificate verification DISABLED (ssl_verify: false) for %s — this is intended for local development only and is unsafe on any network you do not fully control.za custom provider endpointFrHERMES_CA_BUNDLE SSL_CERT_FILEREQUESTS_CA_BUNDLECURL_CA_BUNDLE)cafileuJCA bundle path does not exist: %s — falling back to default certificatesT) rloggerwarningrosgetenvrr expanduserpathisfilesslcreate_default_context)rrr effective_caca_paths rresolve_httpx_verifyr,sZ" ## 0  44    u b!! 3 9' , , 2 2 4 4 3 9_b ) ) / / 1 1 3 9)2 . . 4 4 6 6 3 9%r * * 0 0 2 2  d<((335566 7>>' " " >-W=== = X     4r)rrrr )rrrrrrrr)__doc__ __future__rloggingr#r(pathlibrtypingrr getLogger__name__r!rr,rrr5s>>""""""   8 $ $ $ ))))))))r