v0.3.6 — caPemPath becomes real, and fetching can reach the network

0.3.6 - caPemPath becomes real, and fetching can reach the network

caPemPath has been in this plugin's own cordis.patch.yml since the very first commit, annotated "Every value below is validated against the plugin's Config schema". It was not:

• not in the Config schema,
• not read anywhere in index.js,
• not mentioned in either README.

zod's loose mode let the key through silently, so it looked configurable while having no effect. This release makes it real — declared, read, and honoured.

Why it mattered here

ctk_fetch_and_index could not fetch a single public page on this machine. Every https request failed with:

UNABLE_TO_VERIFY_LEAF_SIGNATURE

Node's built-in roots do not include the local TLS-inspection certificate. The plugin even had a branch that described this failure — "the TLS handshake failed. A local interception certificate is the usual cause." — while offering no way to fix it.

What it does now

caPemPath names the trust store:

Value	Meaning
auto (default)	<DSH_HOME>/context-mode/ca/windows-roots.pem — this machine's exported Windows roots
an absolute path	that PEM file
empty	Node's default roots

When a bundle is configured, fetching goes through node:https with ca set and follows redirects by hand. The built-in fetch cannot take a per-call CA — its dispatcher is undici's, and undici is not importable from a plugin here (ERR_MODULE_NOT_FOUND), which is exactly why the original attempt never landed. The output now states which trust store was used, and an unreadable path is reported rather than silently falling back — falling back would recreate the failure the setting exists to prevent.

Measured

Condition	Result
default trust store	UNABLE_TO_VERIFY_LEAF_SIGNATURE
bundle injected	HTTPS 200, including a two-hop redirect

Tests. 92 offline (4 new: default / real file / unreadable path / file without a certificate), 27 client, 20 package, 34 release gate. Reverting the implementation fails "caPemPath resolves a real PEM file" immediately.

Also visible on the settings page: the field is staged with bilingual labels, so the fix is one edit away if the path ever moves.