major update

app/main.py

@@ -1,5 +1,57 @@
 """FastAPI application entry point with lifespan management."""
 
+# ---------------------------------------------------------------------------
+# SSL + proxy injection — MUST happen before any HTTP client imports
+# ---------------------------------------------------------------------------
+import os as _os
+import ssl as _ssl
+from pathlib import Path as _Path
+
+_COMBINED_CERT = _Path(__file__).resolve().parent.parent / "combined-ca-bundle.pem"
+
+if _COMBINED_CERT.exists():
+    _cert_path = str(_COMBINED_CERT)
+    # Env vars for libraries that respect them (requests, urllib3)
+    _os.environ["SSL_CERT_FILE"] = _cert_path
+    _os.environ["REQUESTS_CA_BUNDLE"] = _cert_path
+    _os.environ["CURL_CA_BUNDLE"] = _cert_path
+
+    # Monkey-patch ssl.create_default_context so that ALL libraries
+    # (aiohttp, httpx, google-genai, alpaca-py, etc.) automatically
+    # use our combined CA bundle that includes the corporate root cert.
+    _original_create_default_context = _ssl.create_default_context
+
+    def _patched_create_default_context(
+        purpose=_ssl.Purpose.SERVER_AUTH, *, cafile=None, capath=None, cadata=None
+    ):
+        ctx = _original_create_default_context(
+            purpose, cafile=cafile, capath=capath, cadata=cadata
+        )
+        # Always load our combined bundle on top of whatever was loaded
+        ctx.load_verify_locations(cafile=_cert_path)
+        return ctx
+
+    _ssl.create_default_context = _patched_create_default_context
+
+    # Also patch aiohttp's cached SSL context objects directly, since
+    # aiohttp creates them at import time and may have already cached
+    # a context without our corporate CA bundle.
+    try:
+        import aiohttp.connector as _aio_conn
+        if hasattr(_aio_conn, '_SSL_CONTEXT_VERIFIED') and _aio_conn._SSL_CONTEXT_VERIFIED is not None:
+            _aio_conn._SSL_CONTEXT_VERIFIED.load_verify_locations(cafile=_cert_path)
+        if hasattr(_aio_conn, '_SSL_CONTEXT_UNVERIFIED') and _aio_conn._SSL_CONTEXT_UNVERIFIED is not None:
+            _aio_conn._SSL_CONTEXT_UNVERIFIED.load_verify_locations(cafile=_cert_path)
+    except ImportError:
+        pass
+
+# Corporate proxy — needed when Kiro spawns the process (no .zshrc sourced)
+_PROXY = "http://aproxy.corproot.net:8080"
+_NO_PROXY = "corproot.net,sharedtcs.net,127.0.0.1,localhost,bix.swisscom.com,swisscom.com"
+_os.environ.setdefault("HTTP_PROXY", _PROXY)
+_os.environ.setdefault("HTTPS_PROXY", _PROXY)
+_os.environ.setdefault("NO_PROXY", _NO_PROXY)
+
 import logging
 import sys
 from contextlib import asynccontextmanager