PR #14374: fix(agent): retry TLS certificate transport errors

• Repository: NousResearch/hermes-agent
• Author: sgaofen
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/14374

Description (problem / solution / changelog)

Root cause

ssl.SSLCertVerificationError inherits from ValueError, so the inline local-validation guard treated TLS certificate failures as non-retryable request-shaping bugs. Those failures are provider transport errors and should stay on the normal retry/failover path.

Closes #14367.

Fix

• Add a small _is_local_validation_error() helper for the request-shaping guard.
• Exclude ssl.SSLError from local-validation classification, which covers SSLCertVerificationError and related TLS transport failures.
• Add regression coverage proving certificate errors are not treated as local validation while ordinary ValueError/TypeError still are.

Tests

• uv run --frozen --python 3.11 --extra dev pytest -o addopts= tests/run_agent/test_run_agent.py::test_ssl_cert_verification_error_is_not_local_validation tests/run_agent/test_run_agent.py::test_request_shaping_errors_are_local_validation tests/run_agent/test_run_agent.py::test_unicode_encode_error_is_not_local_validation -q -> 4 passed
• uv run --frozen --python 3.11 --extra dev pytest -o addopts= tests/agent/test_error_classifier.py -q -> 111 passed
• uv run --frozen --python 3.11 --extra dev pytest -o addopts= tests/run_agent/test_run_agent.py -q -> 297 passed
• git diff --check

Changed files

• run_agent.py (modified, +10/-4)
• tests/run_agent/test_run_agent.py (modified, +20/-0)

PR #14434: fix(agent): exclude ssl.SSLError from local validation error check

• Repository: NousResearch/hermes-agent
• Author: nftpoetrist
• State: closed | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/14434

Description (problem / solution / changelog)

What does this PR do?

ssl.SSLCertVerificationError inherits from SSLError → OSError → ValueError. The is_local_validation_error guard in run_agent.py caught it via isinstance(api_error, ValueError) and triggered a non-retryable abort — even though the error classifier already returns retryable=True for all OSError subclasses (transport heuristic, step 7).

The inline isinstance check fires before classified.retryable is consulted, so the classifier's correct verdict is overridden. Fix: add ssl.SSLError to the exclusion tuple alongside the existing UnicodeEncodeError, mirroring the same pattern already in place.

Related Issue

Fixes #14367

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• run_agent.py: add import ssl (stdlib, no new dependency); extend exclusion tuple to (UnicodeEncodeError, ssl.SSLError) with inline comment explaining the MRO
• tests/run_agent/test_14367_ssl_local_validation.py: new test file covering the reported case (SSLCertVerificationError), the parent class (ssl.SSLError), the MRO prerequisite, the preserved UnicodeEncodeError exclusion, and regression checks that plain ValueError/TypeError remain local errors

How to Test

1. Confirm the MRO that caused the bug:

   import ssl
   e = ssl.SSLCertVerificationError("cert error")
   print(isinstance(e, ValueError))  # True — this was the root cause

2. Run the new tests:

   pytest tests/run_agent/test_14367_ssl_local_validation.py -v

3. All 7 tests should pass.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Changed files

• run_agent.py (modified, +2/-1)
• tests/run_agent/test_14367_ssl_local_validation.py (added, +77/-0)

PR #14445: fix(agent): exclude ssl.SSLError from is_local_validation_error to prevent non-retryable abort

• Repository: NousResearch/hermes-agent
• Author: Bartok9
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/14445

Description (problem / solution / changelog)

Problem

Fixes #14367.

ssl.SSLError (and its subclass ssl.SSLCertVerificationError) inherits from both OSError and ValueError via Python's MRO:

ssl.SSLCertVerificationError
  └─ ssl.SSLError
       ├─ OSError
       └─ (via adapter) ValueError

The is_local_validation_error check at run_agent.py ~line 10681:

is_local_validation_error = (
    isinstance(api_error, (ValueError, TypeError))
    and not isinstance(api_error, UnicodeEncodeError)
)

…catches ssl.SSLCertVerificationError as a ValueError, marking it non-retryable and triggering an immediate abort.

The error classifier already maps SSLCertVerificationError to FailoverReason.timeout, retryable=True (its type name appears in _TRANSPORT_ERROR_TYPES), but the inline isinstance guard overrides that mapping before the classifier result is checked.

Result: A TLS transport error causes an unnecessary session abort instead of retrying or failing over to a backup provider.

Fix

Add ssl.SSLError to the exclusion list alongside the existing UnicodeEncodeError carve-out, and import ssl at the top of run_agent.py:

import ssl
# …
is_local_validation_error = (
    isinstance(api_error, (ValueError, TypeError))
    and not isinstance(api_error, UnicodeEncodeError)
    and not isinstance(api_error, ssl.SSLError)   # ← new
)

Verification

import ssl
e = ssl.SSLCertVerificationError("certificate verify failed")

# Before fix:
isinstance(e, (ValueError, TypeError))  # True  → flagged as programming bug

# After fix:
is_local = (
    isinstance(e, (ValueError, TypeError))
    and not isinstance(e, UnicodeEncodeError)
    and not isinstance(e, ssl.SSLError)
)
assert is_local is False  # ✅ falls through to classifier's retryable path

Changed files

• run_agent.py (modified, +9/-0)