fix(cli): default SSL cert file to certifi

pyproject.toml

@@ -21,6 +21,7 @@ classifiers = [
 
 dependencies = [
     "agentrun-sdk[core]>=0.0.37",
+    "certifi>=2024.0.0",
     "oss2>=2.19.1",
     "pyyaml>=6.0",
     "questionary>=2.0",

src/agentrun_cli/main.py

@@ -13,9 +13,12 @@
 import logging
 import os
 
+import certifi
 import click
 
 os.environ.setdefault("DISABLE_BREAKING_CHANGES_WARNING", "1")
+if "SSL_CERT_FILE" not in os.environ:
+    os.environ["SSL_CERT_FILE"] = certifi.where()
 
 from agentrun_cli import __version__
 from agentrun_cli.commands.config_cmd import config_group

tests/unit/test_main.py

@@ -1,13 +1,34 @@
 """Unit tests for agentrun_cli.main — main() entry point."""
 
-from unittest.mock import patch
+import importlib
+from unittest.mock import Mock, patch
 
-from agentrun_cli.main import main
+import agentrun_cli.main as main_module
 
 
 class TestMainEntryPoint:
     def test_main_function_directly(self):
         """Call main() directly — it delegates to cli()."""
         with patch("agentrun_cli.main.cli") as mock_cli:
-            main()
+            main_module.main()
             mock_cli.assert_called_once()
+
+    def test_default_ssl_cert_file_uses_certifi(self, monkeypatch):
+        """Default SSL_CERT_FILE to certifi when the user has not set it."""
+        monkeypatch.delenv("SSL_CERT_FILE", raising=False)
+        monkeypatch.setattr(main_module.certifi, "where", lambda: "/tmp/cacert.pem")
+
+        importlib.reload(main_module)
+
+        assert main_module.os.environ["SSL_CERT_FILE"] == "/tmp/cacert.pem"
+
+    def test_preserves_user_ssl_cert_file(self, monkeypatch):
+        """Do not override an explicit user SSL_CERT_FILE."""
+        monkeypatch.setenv("SSL_CERT_FILE", "/custom/ca.pem")
+        mock_where = Mock(return_value="/tmp/cacert.pem")
+        monkeypatch.setattr(main_module.certifi, "where", mock_where)
+
+        importlib.reload(main_module)
+
+        assert main_module.os.environ["SSL_CERT_FILE"] == "/custom/ca.pem"
+        mock_where.assert_not_called()