`gjdZddlmZddlZddlZddlZddlmZddlm Z m Z eje Z d dZdddd d d Zy) z8TLS verify resolution for httpx/OpenAI provider clients.) annotationsN)Path)AnyOptionalcp|duryt|tr!|jjdvryy)NFT>0noofffalse) isinstancestrstriplower) ssl_verifys C/root/.hermes/venv/lib/python3.12/site-packages/agent/ssl_verify.py_coerce_insecurers7U*c"z'7'7'9'?'?'AE`'` ) ca_bundlerbase_urlct|rtjd|xsdy|xsdjxst j ddjxspt j ddjxsJt j ddjxs$t j ddj}|rmt t|j}tjj|rtj| Stjd |y ) uResolve httpx ``verify`` for provider HTTP clients. Priority: 1. ``ssl_verify: false`` — disable verification (local dev only) 2. explicit ``ca_bundle`` (per-provider ``ssl_ca_cert`` config field) 3. ``HERMES_CA_BUNDLE``, ``SSL_CERT_FILE``, ``REQUESTS_CA_BUNDLE``, ``CURL_CA_BUNDLE`` env vars 4. ``True`` (httpx/certifi default) ``base_url`` is used only for the insecure-mode warning message. uTLS certificate verification DISABLED (ssl_verify: false) for %s — this is intended for local development only and is unsafe on any network you do not fully control.za custom provider endpointFrHERMES_CA_BUNDLE SSL_CERT_FILEREQUESTS_CA_BUNDLECURL_CA_BUNDLE)cafileuJCA bundle path does not exist: %s — falling back to default certificatesT) rloggerwarningrosgetenvr r expanduserpathisfilesslcreate_default_context)rrr effective_caca_paths rresolve_httpx_verifyr(s" # 0  44   b! 3 99' , 2 2 4 3 99_b ) / / 1 3 99)2 . 4 4 6 3 99%r * 0 0 2 d<(3356 77>>' "--W= = X   r)rrreturnbool)rz Optional[str]rrrr r)zbool | ssl.SSLContext)__doc__ __future__rloggingrr$pathlibrtypingrr getLogger__name__rrr(rrr3sg>"    8 $ $ ))) )  )r