mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-11-06 05:17:15 +00:00
Pedro Relvas
6bd9c10e32
A process that imported certifi before the package manager replaced its install environment keeps the deleted directory in `certifi.where()` for the rest of its life: the path is derived from the imported module's `__file__` and nothing re-derives it. httpx builds every SSL context through that path, so `httpx.Client(verify=True)` raises FileNotFoundError at construction — the OpenAI-compatible client factory turns that into `RuntimeError: Failed to initialize OpenAI client: [Errno 2] No such file or directory`, and every TLS tool that process owns fails until it restarts. `requests` fails one step further out: its DEFAULT_CA_BUNDLE_PATH is a string frozen when requests is imported, so a rotated environment leaves every call raising `OSError: Could not find a suitable TLS CA certificate bundle`. - agent/ssl_verify.py: certifi_bundle_path() re-executes the imported certifi module against the live sys.path when its bundle is gone, logs one WARNING naming the dead path and the recovered one, and reports None when there is nothing to re-resolve. resolve_httpx_verify() hands the platform context over in that case instead of the bare `True` httpx would resolve through the dead path; requests_verify() gives requests call sites a bundle that exists now. - plugins/browser/_common.py, plugins/web/keenable/provider.py: pass that bundle to the two requests call sites that inherit requests' frozen default. - tests/agent/test_ssl_verify.py: the rotation is simulated by importing certifi from a stand-in environment, deleting its directory and then building a client (no package manager involved).