fix(ssl): an unwritable HERMES_HOME keeps the requests TLS fallback

_platform_store_bundle() let a full or read-only home raise out of
requests_verify(), which is evaluated as a requests call argument, so the
browser / Keenable call failed with the disk error instead of falling back
to verify=True.

agent/ssl_verify.py

@@ -276,8 +276,12 @@ def _platform_store_bundle() -> Optional[str]:
     from utils import atomic_write_text
 
     path = get_hermes_home() / "cache" / "platform-ca-bundle.pem"
-    path.parent.mkdir(parents=True, exist_ok=True)
-    atomic_write_text(path, "".join(ssl.DER_cert_to_PEM_cert(der) for der in certs))
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        atomic_write_text(path, "".join(ssl.DER_cert_to_PEM_cert(der) for der in certs))
+    except OSError as exc:  # a full or read-only home must not replace the TLS fallback with a disk error
+        logger.debug("platform CA bundle not written: %s", exc, exc_info=True)
+        return None
     _PLATFORM_STORE_BUNDLE = str(path)
     return _PLATFORM_STORE_BUNDLE
 

tests/agent/test_ssl_verify.py

@@ -495,3 +495,24 @@ def test_requests_verify_hands_over_the_platform_store_without_openssl_files(tmp
     # requests takes the bundle: the request fails on the closed port, not on a missing CA file.
     with pytest.raises(requests.exceptions.ConnectionError):
         requests.get("https://127.0.0.1:9/", verify=verify, timeout=2)
+
+
+def test_platform_store_bundle_survives_an_unwritable_home(tmp_path, monkeypatch):
+    """A full or read-only HERMES_HOME leaves requests_verify on its ``True`` fallback
+    instead of raising the disk error out of the requests call site."""
+    from agent import ssl_verify
+
+    import ssl
+
+    class _StoreWithACert(ssl.SSLContext):
+        # A Linux CA directory loads lazily and lists nothing; give the store one cert so the
+        # write (and its failure) is what decides the result.
+        def get_ca_certs(self, binary_form=False):
+            return [b"0"]
+
+    blocker = tmp_path / "home"
+    blocker.write_text("not a directory")  # mkdir(cache) under a file raises OSError
+    monkeypatch.setenv("HERMES_HOME", str(blocker))
+    monkeypatch.setattr(ssl_verify, "_PLATFORM_STORE_BUNDLE", None)
+    monkeypatch.setattr(ssl_verify, "_stdlib_ssl_context_class", lambda: _StoreWithACert)
+    assert ssl_verify._platform_store_bundle() is None