fix(cli): use system trust for public HTTPS

Author: misunders2d

src/agentnet/cli/commands/diagnostics.py

@@ -9,6 +9,7 @@
 import shutil
 import subprocess
 import sys
+import ssl
 import tempfile
 from datetime import UTC, datetime, timedelta
 from pathlib import Path
@@ -330,6 +331,7 @@ def command_status(args: argparse.Namespace) -> int:
                 base_url=config.public_base_url,
                 timeout=args.timeout,
                 follow_redirects=False,
+                verify=ssl.create_default_context(),
             ) as client:
                 health = client.get("/healthz")
                 readiness = client.get("/readyz")

src/agentnet/cli/helpers.py

@@ -8,6 +8,7 @@
 import json
 import os
 import secrets
+import ssl
 import stat
 from contextlib import contextmanager
 from pathlib import Path
@@ -479,9 +480,10 @@ def _public_json_request(
             headers={"Content-Type": "application/json"},
             timeout=timeout,
             follow_redirects=False,
+            verify=ssl.create_default_context(),
         )
     except httpx.HTTPError as exc:
-        raise SystemExit(f"AgentNet server request failed: {type(exc).__name__}") from exc
+        raise SystemExit(f"AgentNet server request failed: {type(exc).__name__}: {exc}") from exc
     if response.status_code < 200 or response.status_code >= 300:
         raise SystemExit(f"AgentNet server rejected the request with HTTP {response.status_code}")
     try:

tests/cli/test_cli_diagnostics.py

@@ -3,6 +3,7 @@
 import json
 import os
 import subprocess
+import ssl
 from pathlib import Path
 from types import SimpleNamespace
 
@@ -11,6 +12,7 @@
 from agentnet import __version__
 from agentnet import cli
 from agentnet.cli.commands import diagnostics
+from agentnet.cli import helpers
 
 
 def test_top_level_version_is_available(capsys: pytest.CaptureFixture[str]) -> None:
@@ -20,6 +22,30 @@ def test_top_level_version_is_available(capsys: pytest.CaptureFixture[str]) -> N
     assert stopped.value.code == 0
     assert capsys.readouterr().out == f"agentnet {__version__}\n"
 
+def test_public_cli_requests_use_system_tls_context(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    observed: dict[str, object] = {}
+
+    def request(method: str, url: str, **kwargs: object) -> SimpleNamespace:
+        observed.update({"method": method, "url": url, **kwargs})
+        return SimpleNamespace(status_code=200, json=lambda: {"status": "alive"})
+
+    monkeypatch.setattr(helpers.httpx, "request", request)
+
+    result = helpers._public_json_request(
+        server="https://core.example",
+        method="GET",
+        path="/healthz",
+        body={},
+    )
+
+    context = observed["verify"]
+    assert isinstance(context, ssl.SSLContext)
+    assert context.check_hostname is True
+    assert context.verify_mode == ssl.CERT_REQUIRED
+    assert result == {"status": "alive"}
+
 def test_verify_finds_source_root_after_module_moves(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None: