fix(ca-bundle): resolve SSL_CERT_* the way CaBundle does

CaBundle::getEnvVariable() prefers $_SERVER and falls back to getenv()
only under the CLI SAPI. The port read the live process environment for
both SSL_CERT_FILE and SSL_CERT_DIR, skipping the snapshot entirely.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 11 insertions, 2 deletions

diff --git a/crates/shirabe-ca-bundle/src/ca_bundle.rs b/crates/shirabe-ca-bundle/src/ca_bundle.rs
index b8e4c391..9f15b55e 100644
--- a/crates/shirabe-ca-bundle/src/ca_bundle.rs
+++ b/crates/shirabe-ca-bundle/src/ca_bundle.rs
@@ -23,7 +23,7 @@ impl CaBundle {
     // not consult OpenSSL's default cert locations, does not validate the
     // candidate before returning it, and has no bundled cacert.pem fallback.
     pub fn get_system_ca_root_bundle_path(_logger: ()) -> String {
-        if let Ok(file) = std::env::var("SSL_CERT_FILE")
+        if let Some(file) = Self::get_env_variable("SSL_CERT_FILE")
             && std::path::Path::new(&file).is_file()
         {
             return file;
@@ -49,7 +49,7 @@ impl CaBundle {
             }
         }
 
-        if let Ok(dir) = std::env::var("SSL_CERT_DIR")
+        if let Some(dir) = Self::get_env_variable("SSL_CERT_DIR")
             && std::path::Path::new(&dir).is_dir()
         {
             return dir;
@@ -65,6 +65,15 @@ impl CaBundle {
         String::new()
     }
 
+    fn get_env_variable(name: &str) -> Option<String> {
+        if let Some(value) = shirabe_php_shim::PHP_SERVER.lock().unwrap().get(name) {
+            return Some(value.to_string_lossy().into_owned());
+        }
+
+        // PHP_SAPI is always 'cli' for this application
+        shirabe_php_shim::getenv(name).map(|value| value.to_string_lossy().into_owned())
+    }
+
     // TODO(http): Dummy stand-in until reqwest validates certificates itself.
     // The original parses the file with OpenSSL and rejects malformed or expired
     // bundles; here we only require the file to exist and be non-empty.