fix: preserve CRM website hosts during profile fetch

packages/shared/src/five08/resume_profile_processor.py

@@ -13,7 +13,7 @@
 from datetime import datetime, timezone
 from html import unescape
 from typing import Any, cast
-from urllib.parse import urljoin, urlsplit
+from urllib.parse import urljoin, urlsplit, urlunsplit
 
 from curl_cffi import CurlOpt, requests as curl_requests
 from curl_cffi.requests import BrowserTypeLiteral, RequestsError
@@ -1286,9 +1286,10 @@ def _build_initial_external_source_candidates(
  added_website_source_keys: set[str] = set()
  website_budget = PROFILE_SOURCE_MAX_WEBSITES
 
- explicit_website_links = self._coerce_website_links(explicit_personal_websites)
- for website_url in explicit_website_links:
- source_key = normalized_website_identity_key(website_url)
+ explicit_website_links = self._coerce_fetchable_website_links(
+ explicit_personal_websites
+ )
+ for website_url, source_key in explicit_website_links:
  if not source_key or source_key in added_website_source_keys:
  continue
  if website_budget <= 0:
@@ -1304,9 +1305,10 @@ def _build_initial_external_source_candidates(
  )
  )
 
- website_links = self._coerce_website_links(contact.get("cWebsiteLink"))
- for website_url in website_links:
- source_key = normalized_website_identity_key(website_url)
+ website_links = self._coerce_fetchable_website_links(
+ contact.get("cWebsiteLink")
+ )
+ for website_url, source_key in website_links:
  if not source_key or source_key in added_website_source_keys:
  continue
  if website_budget <= 0:
@@ -1454,7 +1456,22 @@ def inspect_profile_source_fetch(
  *,
  allow_javascript_fallback: bool = False,
  ) -> ProfileSourceFetchDiagnostics:
- response = self._fetch_external_profile_source_response(url)
+ response: ProfileSourceHttpResponse | None = None
+ last_fetch_error: ValueError | None = None
+ for candidate_url in self._iter_profile_source_fetch_urls(
+ url,
+ allow_javascript_fallback=allow_javascript_fallback,
+ ):
+ try:
+ response = self._fetch_external_profile_source_response(candidate_url)
+ break
+ except ValueError as exc:
+ last_fetch_error = exc
+ if not self._is_retryable_profile_fetch_error(str(exc)):
+ raise
+
+ if response is None:
+ raise last_fetch_error or ValueError("Profile fetch failed")
  extracted = ""
  extraction_error: ValueError | None = None
  try:
@@ -1513,6 +1530,82 @@ def inspect_profile_source_fetch(
  error=error,
  )
 
+ def _iter_profile_source_fetch_urls(
+ self,
+ url: str,
+ *,
+ allow_javascript_fallback: bool,
+ ) -> list[str]:
+ candidates = [url]
+ if not allow_javascript_fallback:
+ return candidates
+
+ try:
+ parsed = urlsplit(url)
+ except Exception:
+ return candidates
+
+ if parsed.scheme.lower() != "https":
+ return candidates
+
+ host = (parsed.hostname or "").strip()
+ if not host:
+ return candidates
+
+ seen = {url}
+ alternate_netloc = self._alternate_profile_host_netloc(parsed)
+ if parsed.port in {None, 443} and alternate_netloc:
+ alternate_https_candidate = urlunsplit(
+ parsed._replace(netloc=alternate_netloc)
+ )
+ if alternate_https_candidate not in seen:
+ seen.add(alternate_https_candidate)
+ candidates.append(alternate_https_candidate)
+
+ return candidates
+
+ @staticmethod
+ def _is_retryable_profile_fetch_error(error: str) -> bool:
+ normalized = error.casefold()
+ return "profile fetch failed:" in normalized and any(
+ marker in normalized
+ for marker in (
+ "tls connect error",
+ "tlsv1_alert_internal_error",
+ "tlsv1 alert internal error",
+ "ssl:",
+ )
+ )
+
+ @staticmethod
+ def _alternate_profile_host_netloc(parsed: Any) -> str | None:
+ host = (parsed.hostname or "").strip()
+ if not host:
+ return None
+ if host.casefold().startswith("www."):
+ alternate_host = host[4:]
+ else:
+ alternate_host = f"www.{host}"
+ return ResumeProfileProcessor._swap_url_port(
+ parsed,
+ new_host=alternate_host,
+ new_port=parsed.port,
+ )
+
+ @staticmethod
+ def _swap_url_port(
+ parsed: Any,
+ *,
+ new_host: str | None = None,
+ new_port: int | None,
+ ) -> str:
+ host = new_host or (parsed.hostname or "").strip()
+ if not host:
+ return parsed.netloc
+ if new_port is None:
+ return host
+ return f"{host}:{new_port}"
+
  def _fetch_external_profile_source_response(
  self, url: str
  ) -> ProfileSourceHttpResponse:
@@ -2274,6 +2367,37 @@ def _coerce_website_links(self, value: Any) -> list[str]:
 
  return normalized
 
+ def _coerce_fetchable_website_links(self, value: Any) -> list[tuple[str, str]]:
+ if value is None:
+ return []
+
+ if isinstance(value, str):
+ raw_values = [item for item in value.split(",") if item.strip()]
+ elif isinstance(value, (list, tuple, set)):
+ raw_values = list(value)
+ else:
+ return []
+
+ normalized: list[tuple[str, str]] = []
+ seen: set[str] = set()
+ for raw_value in raw_values:
+ if not isinstance(raw_value, str):
+ continue
+ raw_candidate = raw_value.strip()
+ normalized_link = self._normalize_website_url(raw_candidate)
+ if normalized_link is None:
+ continue
+ fetchable_link = self._normalize_fetchable_website_url(raw_candidate)
+ if fetchable_link is None:
+ continue
+ dedupe_key = normalized_website_identity_key(normalized_link)
+ if dedupe_key is None or dedupe_key in seen:
+ continue
+ seen.add(dedupe_key)
+ normalized.append((fetchable_link, dedupe_key))
+
+ return normalized
+
  def _merge_website_links(
  self, *, existing: list[str], extracted: list[str]
  ) -> list[str]:
@@ -2310,6 +2434,34 @@ def _merge_website_links(
  def _normalize_website_url(value: str) -> str | None:
  return normalize_website_url(value, allow_scheme_less=True)
 
+ @staticmethod
+ def _normalize_fetchable_website_url(value: str) -> str | None:
+ candidate = value.strip().strip(")]},.;:")
+ if not candidate:
+ return None
+
+ lower_candidate = candidate.lower()
+ if lower_candidate.startswith("www."):
+ candidate = f"https://{candidate}"
+ elif not lower_candidate.startswith(("http://", "https://")):
+ if not re.match(
+ r"(?i)^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}(?:[/?#].*)?$",
+ candidate,
+ ):
+ return None
+ candidate = f"https://{candidate}"
+
+ try:
+ parsed = urlsplit(candidate)
+ except Exception:
+ return None
+
+ if "@" in parsed.netloc:
+ return None
+ if not (parsed.hostname or "").strip():
+ return None
+ return parsed.geturl().rstrip("/")
+
  def _normalize_email_address(self, value: Any) -> str | None:
  if not isinstance(value, str):
  return None

tests/unit/test_resume_profile_processor.py

@@ -6,7 +6,7 @@
 from types import SimpleNamespace
 
 import pytest
-from unittest.mock import MagicMock, Mock, patch
+from unittest.mock import MagicMock, Mock, call, patch
 
 from curl_cffi import CurlOpt
 
@@ -691,6 +691,20 @@ def test_build_initial_external_source_candidates_caps_websites_globally() -> No
  assert github_urls == ["https://github.com/octocat"]
 
 
+def test_build_initial_external_source_candidates_preserves_www_host_from_crm() -> None:
+ """CRM website candidates should keep the stored host for the first fetch."""
+ processor = ResumeProfileProcessor()
+
+ candidates = processor._build_initial_external_source_candidates(
+ contact={"cWebsiteLink": ["https://www.example.com/about"]},
+ )
+
+ assert len(candidates) == 1
+ assert candidates[0].label == "Personal Website"
+ assert candidates[0].url == "https://www.example.com/about"
+ assert candidates[0].source_key == "website:example.com/about"
+
+
 def test_fetch_external_profile_sources_retries_alternate_candidate_after_failure() -> (
  None
 ):
@@ -795,6 +809,132 @@ def test_fetch_external_profile_source_text_skips_browser_for_github_sources() -
  )
 
 
+def test_inspect_profile_source_fetch_retries_personal_site_tls_variants() -> None:
+ """Personal website fetches should recover from apex TLS failures."""
+ processor = ResumeProfileProcessor()
+ http_response = ProfileSourceHttpResponse(
+ final_url="https://www.example.com/about",
+ status_code=200,
+ headers={"content-type": "text/html; charset=utf-8"},
+ body=b"<html><head><title>Portfolio</title></head><body>Builder</body></html>",
+ )
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=[
+ ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ ),
+ http_response,
+ ]
+ )
+
+ diagnostics = processor.inspect_profile_source_fetch(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ assert diagnostics.final_url == "https://www.example.com/about"
+ assert diagnostics.selected_text == "Title: Portfolio\nPortfolio Builder"
+ assert processor._fetch_external_profile_source_response.call_args_list == [
+ call("https://example.com/about"),
+ call("https://www.example.com/about"),
+ ]
+
+
+def test_inspect_profile_source_fetch_uses_stripped_host_as_www_fallback() -> None:
+ """Stored www hosts should fall back to the apex host after TLS failures."""
+ processor = ResumeProfileProcessor()
+ http_response = ProfileSourceHttpResponse(
+ final_url="https://example.com/about",
+ status_code=200,
+ headers={"content-type": "text/html; charset=utf-8"},
+ body=b"<html><head><title>Portfolio</title></head><body>Builder</body></html>",
+ )
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=[
+ ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ ),
+ http_response,
+ ]
+ )
+
+ diagnostics = processor.inspect_profile_source_fetch(
+ "https://www.example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ assert diagnostics.final_url == "https://example.com/about"
+ assert diagnostics.selected_text == "Title: Portfolio\nPortfolio Builder"
+ assert processor._fetch_external_profile_source_response.call_args_list == [
+ call("https://www.example.com/about"),
+ call("https://example.com/about"),
+ ]
+
+
+def test_iter_profile_source_fetch_urls_keeps_https_only() -> None:
+ """TLS retries should stay on HTTPS host variants without downgrading transport."""
+ processor = ResumeProfileProcessor()
+
+ assert processor._iter_profile_source_fetch_urls(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ ) == [
+ "https://example.com/about",
+ "https://www.example.com/about",
+ ]
+ assert processor._iter_profile_source_fetch_urls(
+ "https://www.example.com/about",
+ allow_javascript_fallback=True,
+ ) == [
+ "https://www.example.com/about",
+ "https://example.com/about",
+ ]
+
+
+def test_inspect_profile_source_fetch_does_not_retry_non_tls_errors() -> None:
+ """Non-TLS fetch failures should keep the existing error behavior."""
+ processor = ResumeProfileProcessor()
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=ValueError("Profile fetch failed: 404 Client Error")
+ )
+
+ with pytest.raises(ValueError, match="404 Client Error"):
+ processor.inspect_profile_source_fetch(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ processor._fetch_external_profile_source_response.assert_called_once_with(
+ "https://example.com/about"
+ )
+
+
+def test_inspect_profile_source_fetch_does_not_retry_github_tls_failures() -> None:
+ """GitHub-style sources should not try personal-website recovery variants."""
+ processor = ResumeProfileProcessor()
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ )
+ )
+
+ with pytest.raises(ValueError, match="TLS connect error"):
+ processor.inspect_profile_source_fetch(
+ "https://github.com/octocat",
+ allow_javascript_fallback=False,
+ )
+
+ processor._fetch_external_profile_source_response.assert_called_once_with(
+ "https://github.com/octocat"
+ )
+
+
 def test_validate_browser_profile_request_url_blocks_non_public_http_targets() -> None:
  """Browser fallback requests should reject non-public HTTP(S) targets."""
  processor = ResumeProfileProcessor()

packages/shared/src/five08/resume_profile_processor.py

@@ -13,7 +13,7 @@
 from datetime import datetime, timezone
 from html import unescape
 from typing import Any, cast
-from urllib.parse import urljoin, urlsplit
+from urllib.parse import urljoin, urlsplit, urlunsplit
 
 from curl_cffi import CurlOpt, requests as curl_requests
 from curl_cffi.requests import BrowserTypeLiteral, RequestsError
@@ -1286,9 +1286,10 @@ def _build_initial_external_source_candidates(
  added_website_source_keys: set[str] = set()
  website_budget = PROFILE_SOURCE_MAX_WEBSITES
 
- explicit_website_links = self._coerce_website_links(explicit_personal_websites)
- for website_url in explicit_website_links:
- source_key = normalized_website_identity_key(website_url)
+ explicit_website_links = self._coerce_fetchable_website_links(
+ explicit_personal_websites
+ )
+ for website_url, source_key in explicit_website_links:
  if not source_key or source_key in added_website_source_keys:
  continue
  if website_budget <= 0:
@@ -1304,9 +1305,10 @@ def _build_initial_external_source_candidates(
  )
  )
 
- website_links = self._coerce_website_links(contact.get("cWebsiteLink"))
- for website_url in website_links:
- source_key = normalized_website_identity_key(website_url)
+ website_links = self._coerce_fetchable_website_links(
+ contact.get("cWebsiteLink")
+ )
+ for website_url, source_key in website_links:
  if not source_key or source_key in added_website_source_keys:
  continue
  if website_budget <= 0:
@@ -1454,7 +1456,22 @@ def inspect_profile_source_fetch(
  *,
  allow_javascript_fallback: bool = False,
  ) -> ProfileSourceFetchDiagnostics:
- response = self._fetch_external_profile_source_response(url)
+ response: ProfileSourceHttpResponse | None = None
+ last_fetch_error: ValueError | None = None
+ for candidate_url in self._iter_profile_source_fetch_urls(
+ url,
+ allow_javascript_fallback=allow_javascript_fallback,
+ ):
+ try:
+ response = self._fetch_external_profile_source_response(candidate_url)
+ break
+ except ValueError as exc:
+ last_fetch_error = exc
+ if not self._is_retryable_profile_fetch_error(str(exc)):
+ raise
+
+ if response is None:
+ raise last_fetch_error or ValueError("Profile fetch failed")
  extracted = ""
  extraction_error: ValueError | None = None
  try:
@@ -1513,6 +1530,82 @@ def inspect_profile_source_fetch(
  error=error,
  )
 
+ def _iter_profile_source_fetch_urls(
+ self,
+ url: str,
+ *,
+ allow_javascript_fallback: bool,
+ ) -> list[str]:
+ candidates = [url]
+ if not allow_javascript_fallback:
+ return candidates
+
+ try:
+ parsed = urlsplit(url)
+ except Exception:
+ return candidates
+
+ if parsed.scheme.lower() != "https":
+ return candidates
+
+ host = (parsed.hostname or "").strip()
+ if not host:
+ return candidates
+
+ seen = {url}
+ alternate_netloc = self._alternate_profile_host_netloc(parsed)
+ if parsed.port in {None, 443} and alternate_netloc:
+ alternate_https_candidate = urlunsplit(
+ parsed._replace(netloc=alternate_netloc)
+ )
+ if alternate_https_candidate not in seen:
+ seen.add(alternate_https_candidate)
+ candidates.append(alternate_https_candidate)
+
+ return candidates
+
+ @staticmethod
+ def _is_retryable_profile_fetch_error(error: str) -> bool:
+ normalized = error.casefold()
+ return "profile fetch failed:" in normalized and any(
+ marker in normalized
+ for marker in (
+ "tls connect error",
+ "tlsv1_alert_internal_error",
+ "tlsv1 alert internal error",
+ "ssl:",
+ )
+ )
+
+ @staticmethod
+ def _alternate_profile_host_netloc(parsed: Any) -> str | None:
+ host = (parsed.hostname or "").strip()
+ if not host:
+ return None
+ if host.casefold().startswith("www."):
+ alternate_host = host[4:]
+ else:
+ alternate_host = f"www.{host}"
+ return ResumeProfileProcessor._swap_url_port(
+ parsed,
+ new_host=alternate_host,
+ new_port=parsed.port,
+ )
+
+ @staticmethod
+ def _swap_url_port(
+ parsed: Any,
+ *,
+ new_host: str | None = None,
+ new_port: int | None,
+ ) -> str:
+ host = new_host or (parsed.hostname or "").strip()
+ if not host:
+ return parsed.netloc
+ if new_port is None:
+ return host
+ return f"{host}:{new_port}"
+
  def _fetch_external_profile_source_response(
  self, url: str
  ) -> ProfileSourceHttpResponse:
@@ -2274,6 +2367,37 @@ def _coerce_website_links(self, value: Any) -> list[str]:
 
  return normalized
 
+ def _coerce_fetchable_website_links(self, value: Any) -> list[tuple[str, str]]:
+ if value is None:
+ return []
+
+ if isinstance(value, str):
+ raw_values = [item for item in value.split(",") if item.strip()]
+ elif isinstance(value, (list, tuple, set)):
+ raw_values = list(value)
+ else:
+ return []
+
+ normalized: list[tuple[str, str]] = []
+ seen: set[str] = set()
+ for raw_value in raw_values:
+ if not isinstance(raw_value, str):
+ continue
+ raw_candidate = raw_value.strip()
+ normalized_link = self._normalize_website_url(raw_candidate)
+ if normalized_link is None:
+ continue
+ fetchable_link = self._normalize_fetchable_website_url(raw_candidate)
+ if fetchable_link is None:
+ continue
+ dedupe_key = normalized_website_identity_key(normalized_link)
+ if dedupe_key is None or dedupe_key in seen:
+ continue
+ seen.add(dedupe_key)
+ normalized.append((fetchable_link, dedupe_key))
+
+ return normalized
+
  def _merge_website_links(
  self, *, existing: list[str], extracted: list[str]
  ) -> list[str]:
@@ -2310,6 +2434,34 @@ def _merge_website_links(
  def _normalize_website_url(value: str) -> str | None:
  return normalize_website_url(value, allow_scheme_less=True)
 
+ @staticmethod
+ def _normalize_fetchable_website_url(value: str) -> str | None:
+ candidate = value.strip().strip(")]},.;:")
+ if not candidate:
+ return None
+
+ lower_candidate = candidate.lower()
+ if lower_candidate.startswith("www."):
+ candidate = f"https://{candidate}"
+ elif not lower_candidate.startswith(("http://", "https://")):
+ if not re.match(
+ r"(?i)^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}(?:[/?#].*)?$",
+ candidate,
+ ):
+ return None
+ candidate = f"https://{candidate}"
+
+ try:
+ parsed = urlsplit(candidate)
+ except Exception:
+ return None
+
+ if "@" in parsed.netloc:
+ return None
+ if not (parsed.hostname or "").strip():
+ return None
+ return parsed.geturl().rstrip("/")
+
  def _normalize_email_address(self, value: Any) -> str | None:
  if not isinstance(value, str):
  return None

tests/unit/test_resume_profile_processor.py

@@ -6,7 +6,7 @@
 from types import SimpleNamespace
 
 import pytest
-from unittest.mock import MagicMock, Mock, patch
+from unittest.mock import MagicMock, Mock, call, patch
 
 from curl_cffi import CurlOpt
 
@@ -691,6 +691,20 @@ def test_build_initial_external_source_candidates_caps_websites_globally() -> No
  assert github_urls == ["https://github.com/octocat"]
 
 
+def test_build_initial_external_source_candidates_preserves_www_host_from_crm() -> None:
+ """CRM website candidates should keep the stored host for the first fetch."""
+ processor = ResumeProfileProcessor()
+
+ candidates = processor._build_initial_external_source_candidates(
+ contact={"cWebsiteLink": ["https://www.example.com/about"]},
+ )
+
+ assert len(candidates) == 1
+ assert candidates[0].label == "Personal Website"
+ assert candidates[0].url == "https://www.example.com/about"
+ assert candidates[0].source_key == "website:example.com/about"
+
+
 def test_fetch_external_profile_sources_retries_alternate_candidate_after_failure() -> (
  None
 ):
@@ -795,6 +809,132 @@ def test_fetch_external_profile_source_text_skips_browser_for_github_sources() -
  )
 
 
+def test_inspect_profile_source_fetch_retries_personal_site_tls_variants() -> None:
+ """Personal website fetches should recover from apex TLS failures."""
+ processor = ResumeProfileProcessor()
+ http_response = ProfileSourceHttpResponse(
+ final_url="https://www.example.com/about",
+ status_code=200,
+ headers={"content-type": "text/html; charset=utf-8"},
+ body=b"<html><head><title>Portfolio</title></head><body>Builder</body></html>",
+ )
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=[
+ ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ ),
+ http_response,
+ ]
+ )
+
+ diagnostics = processor.inspect_profile_source_fetch(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ assert diagnostics.final_url == "https://www.example.com/about"
+ assert diagnostics.selected_text == "Title: Portfolio\nPortfolio Builder"
+ assert processor._fetch_external_profile_source_response.call_args_list == [
+ call("https://example.com/about"),
+ call("https://www.example.com/about"),
+ ]
+
+
+def test_inspect_profile_source_fetch_uses_stripped_host_as_www_fallback() -> None:
+ """Stored www hosts should fall back to the apex host after TLS failures."""
+ processor = ResumeProfileProcessor()
+ http_response = ProfileSourceHttpResponse(
+ final_url="https://example.com/about",
+ status_code=200,
+ headers={"content-type": "text/html; charset=utf-8"},
+ body=b"<html><head><title>Portfolio</title></head><body>Builder</body></html>",
+ )
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=[
+ ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ ),
+ http_response,
+ ]
+ )
+
+ diagnostics = processor.inspect_profile_source_fetch(
+ "https://www.example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ assert diagnostics.final_url == "https://example.com/about"
+ assert diagnostics.selected_text == "Title: Portfolio\nPortfolio Builder"
+ assert processor._fetch_external_profile_source_response.call_args_list == [
+ call("https://www.example.com/about"),
+ call("https://example.com/about"),
+ ]
+
+
+def test_iter_profile_source_fetch_urls_keeps_https_only() -> None:
+ """TLS retries should stay on HTTPS host variants without downgrading transport."""
+ processor = ResumeProfileProcessor()
+
+ assert processor._iter_profile_source_fetch_urls(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ ) == [
+ "https://example.com/about",
+ "https://www.example.com/about",
+ ]
+ assert processor._iter_profile_source_fetch_urls(
+ "https://www.example.com/about",
+ allow_javascript_fallback=True,
+ ) == [
+ "https://www.example.com/about",
+ "https://example.com/about",
+ ]
+
+
+def test_inspect_profile_source_fetch_does_not_retry_non_tls_errors() -> None:
+ """Non-TLS fetch failures should keep the existing error behavior."""
+ processor = ResumeProfileProcessor()
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=ValueError("Profile fetch failed: 404 Client Error")
+ )
+
+ with pytest.raises(ValueError, match="404 Client Error"):
+ processor.inspect_profile_source_fetch(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ processor._fetch_external_profile_source_response.assert_called_once_with(
+ "https://example.com/about"
+ )
+
+
+def test_inspect_profile_source_fetch_does_not_retry_github_tls_failures() -> None:
+ """GitHub-style sources should not try personal-website recovery variants."""
+ processor = ResumeProfileProcessor()
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ )
+ )
+
+ with pytest.raises(ValueError, match="TLS connect error"):
+ processor.inspect_profile_source_fetch(
+ "https://github.com/octocat",
+ allow_javascript_fallback=False,
+ )
+
+ processor._fetch_external_profile_source_response.assert_called_once_with(
+ "https://github.com/octocat"
+ )
+
+
 def test_validate_browser_profile_request_url_blocks_non_public_http_targets() -> None:
  """Browser fallback requests should reject non-public HTTP(S) targets."""
  processor = ResumeProfileProcessor()

packages/shared/src/five08/resume_profile_processor.py

@@ -13,7 +13,7 @@
 from datetime import datetime, timezone
 from html import unescape
 from typing import Any, cast
-from urllib.parse import urljoin, urlsplit
+from urllib.parse import urljoin, urlsplit, urlunsplit
 
 from curl_cffi import CurlOpt, requests as curl_requests
 from curl_cffi.requests import BrowserTypeLiteral, RequestsError
@@ -1286,9 +1286,10 @@ def _build_initial_external_source_candidates(
  added_website_source_keys: set[str] = set()
  website_budget = PROFILE_SOURCE_MAX_WEBSITES
 
- explicit_website_links = self._coerce_website_links(explicit_personal_websites)
- for website_url in explicit_website_links:
- source_key = normalized_website_identity_key(website_url)
+ explicit_website_links = self._coerce_fetchable_website_links(
+ explicit_personal_websites
+ )
+ for website_url, source_key in explicit_website_links:
  if not source_key or source_key in added_website_source_keys:
  continue
  if website_budget <= 0:
@@ -1304,9 +1305,10 @@ def _build_initial_external_source_candidates(
  )
  )
 
- website_links = self._coerce_website_links(contact.get("cWebsiteLink"))
- for website_url in website_links:
- source_key = normalized_website_identity_key(website_url)
+ website_links = self._coerce_fetchable_website_links(
+ contact.get("cWebsiteLink")
+ )
+ for website_url, source_key in website_links:
  if not source_key or source_key in added_website_source_keys:
  continue
  if website_budget <= 0:
@@ -1454,7 +1456,22 @@ def inspect_profile_source_fetch(
  *,
  allow_javascript_fallback: bool = False,
  ) -> ProfileSourceFetchDiagnostics:
- response = self._fetch_external_profile_source_response(url)
+ response: ProfileSourceHttpResponse | None = None
+ last_fetch_error: ValueError | None = None
+ for candidate_url in self._iter_profile_source_fetch_urls(
+ url,
+ allow_javascript_fallback=allow_javascript_fallback,
+ ):
+ try:
+ response = self._fetch_external_profile_source_response(candidate_url)
+ break
+ except ValueError as exc:
+ last_fetch_error = exc
+ if not self._is_retryable_profile_fetch_error(str(exc)):
+ raise
+
+ if response is None:
+ raise last_fetch_error or ValueError("Profile fetch failed")
  extracted = ""
  extraction_error: ValueError | None = None
  try:
@@ -1513,6 +1530,82 @@ def inspect_profile_source_fetch(
  error=error,
  )
 
+ def _iter_profile_source_fetch_urls(
+ self,
+ url: str,
+ *,
+ allow_javascript_fallback: bool,
+ ) -> list[str]:
+ candidates = [url]
+ if not allow_javascript_fallback:
+ return candidates
+
+ try:
+ parsed = urlsplit(url)
+ except Exception:
+ return candidates
+
+ if parsed.scheme.lower() != "https":
+ return candidates
+
+ host = (parsed.hostname or "").strip()
+ if not host:
+ return candidates
+
+ seen = {url}
+ alternate_netloc = self._alternate_profile_host_netloc(parsed)
+ if parsed.port in {None, 443} and alternate_netloc:
+ alternate_https_candidate = urlunsplit(
+ parsed._replace(netloc=alternate_netloc)
+ )
+ if alternate_https_candidate not in seen:
+ seen.add(alternate_https_candidate)
+ candidates.append(alternate_https_candidate)
+
+ return candidates
+
+ @staticmethod
+ def _is_retryable_profile_fetch_error(error: str) -> bool:
+ normalized = error.casefold()
+ return "profile fetch failed:" in normalized and any(
+ marker in normalized
+ for marker in (
+ "tls connect error",
+ "tlsv1_alert_internal_error",
+ "tlsv1 alert internal error",
+ "ssl:",
+ )
+ )
+
+ @staticmethod
+ def _alternate_profile_host_netloc(parsed: Any) -> str | None:
+ host = (parsed.hostname or "").strip()
+ if not host:
+ return None
+ if host.casefold().startswith("www."):
+ alternate_host = host[4:]
+ else:
+ alternate_host = f"www.{host}"
+ return ResumeProfileProcessor._swap_url_port(
+ parsed,
+ new_host=alternate_host,
+ new_port=parsed.port,
+ )
+
+ @staticmethod
+ def _swap_url_port(
+ parsed: Any,
+ *,
+ new_host: str | None = None,
+ new_port: int | None,
+ ) -> str:
+ host = new_host or (parsed.hostname or "").strip()
+ if not host:
+ return parsed.netloc
+ if new_port is None:
+ return host
+ return f"{host}:{new_port}"
+
  def _fetch_external_profile_source_response(
  self, url: str
  ) -> ProfileSourceHttpResponse:
@@ -2274,6 +2367,37 @@ def _coerce_website_links(self, value: Any) -> list[str]:
 
  return normalized
 
+ def _coerce_fetchable_website_links(self, value: Any) -> list[tuple[str, str]]:
+ if value is None:
+ return []
+
+ if isinstance(value, str):
+ raw_values = [item for item in value.split(",") if item.strip()]
+ elif isinstance(value, (list, tuple, set)):
+ raw_values = list(value)
+ else:
+ return []
+
+ normalized: list[tuple[str, str]] = []
+ seen: set[str] = set()
+ for raw_value in raw_values:
+ if not isinstance(raw_value, str):
+ continue
+ raw_candidate = raw_value.strip()
+ normalized_link = self._normalize_website_url(raw_candidate)
+ if normalized_link is None:
+ continue
+ fetchable_link = self._normalize_fetchable_website_url(raw_candidate)
+ if fetchable_link is None:
+ continue
+ dedupe_key = normalized_website_identity_key(normalized_link)
+ if dedupe_key is None or dedupe_key in seen:
+ continue
+ seen.add(dedupe_key)
+ normalized.append((fetchable_link, dedupe_key))
+
+ return normalized
+
  def _merge_website_links(
  self, *, existing: list[str], extracted: list[str]
  ) -> list[str]:
@@ -2310,6 +2434,34 @@ def _merge_website_links(
  def _normalize_website_url(value: str) -> str | None:
  return normalize_website_url(value, allow_scheme_less=True)
 
+ @staticmethod
+ def _normalize_fetchable_website_url(value: str) -> str | None:
+ candidate = value.strip().strip(")]},.;:")
+ if not candidate:
+ return None
+
+ lower_candidate = candidate.lower()
+ if lower_candidate.startswith("www."):
+ candidate = f"https://{candidate}"
+ elif not lower_candidate.startswith(("http://", "https://")):
+ if not re.match(
+ r"(?i)^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}(?:[/?#].*)?$",
+ candidate,
+ ):
+ return None
+ candidate = f"https://{candidate}"
+
+ try:
+ parsed = urlsplit(candidate)
+ except Exception:
+ return None
+
+ if "@" in parsed.netloc:
+ return None
+ if not (parsed.hostname or "").strip():
+ return None
+ return parsed.geturl().rstrip("/")
+
  def _normalize_email_address(self, value: Any) -> str | None:
  if not isinstance(value, str):
  return None

tests/unit/test_resume_profile_processor.py

@@ -6,7 +6,7 @@
 from types import SimpleNamespace
 
 import pytest
-from unittest.mock import MagicMock, Mock, patch
+from unittest.mock import MagicMock, Mock, call, patch
 
 from curl_cffi import CurlOpt
 
@@ -691,6 +691,20 @@ def test_build_initial_external_source_candidates_caps_websites_globally() -> No
  assert github_urls == ["https://github.com/octocat"]
 
 
+def test_build_initial_external_source_candidates_preserves_www_host_from_crm() -> None:
+ """CRM website candidates should keep the stored host for the first fetch."""
+ processor = ResumeProfileProcessor()
+
+ candidates = processor._build_initial_external_source_candidates(
+ contact={"cWebsiteLink": ["https://www.example.com/about"]},
+ )
+
+ assert len(candidates) == 1
+ assert candidates[0].label == "Personal Website"
+ assert candidates[0].url == "https://www.example.com/about"
+ assert candidates[0].source_key == "website:example.com/about"
+
+
 def test_fetch_external_profile_sources_retries_alternate_candidate_after_failure() -> (
  None
 ):
@@ -795,6 +809,132 @@ def test_fetch_external_profile_source_text_skips_browser_for_github_sources() -
  )
 
 
+def test_inspect_profile_source_fetch_retries_personal_site_tls_variants() -> None:
+ """Personal website fetches should recover from apex TLS failures."""
+ processor = ResumeProfileProcessor()
+ http_response = ProfileSourceHttpResponse(
+ final_url="https://www.example.com/about",
+ status_code=200,
+ headers={"content-type": "text/html; charset=utf-8"},
+ body=b"<html><head><title>Portfolio</title></head><body>Builder</body></html>",
+ )
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=[
+ ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ ),
+ http_response,
+ ]
+ )
+
+ diagnostics = processor.inspect_profile_source_fetch(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ assert diagnostics.final_url == "https://www.example.com/about"
+ assert diagnostics.selected_text == "Title: Portfolio\nPortfolio Builder"
+ assert processor._fetch_external_profile_source_response.call_args_list == [
+ call("https://example.com/about"),
+ call("https://www.example.com/about"),
+ ]
+
+
+def test_inspect_profile_source_fetch_uses_stripped_host_as_www_fallback() -> None:
+ """Stored www hosts should fall back to the apex host after TLS failures."""
+ processor = ResumeProfileProcessor()
+ http_response = ProfileSourceHttpResponse(
+ final_url="https://example.com/about",
+ status_code=200,
+ headers={"content-type": "text/html; charset=utf-8"},
+ body=b"<html><head><title>Portfolio</title></head><body>Builder</body></html>",
+ )
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=[
+ ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ ),
+ http_response,
+ ]
+ )
+
+ diagnostics = processor.inspect_profile_source_fetch(
+ "https://www.example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ assert diagnostics.final_url == "https://example.com/about"
+ assert diagnostics.selected_text == "Title: Portfolio\nPortfolio Builder"
+ assert processor._fetch_external_profile_source_response.call_args_list == [
+ call("https://www.example.com/about"),
+ call("https://example.com/about"),
+ ]
+
+
+def test_iter_profile_source_fetch_urls_keeps_https_only() -> None:
+ """TLS retries should stay on HTTPS host variants without downgrading transport."""
+ processor = ResumeProfileProcessor()
+
+ assert processor._iter_profile_source_fetch_urls(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ ) == [
+ "https://example.com/about",
+ "https://www.example.com/about",
+ ]
+ assert processor._iter_profile_source_fetch_urls(
+ "https://www.example.com/about",
+ allow_javascript_fallback=True,
+ ) == [
+ "https://www.example.com/about",
+ "https://example.com/about",
+ ]
+
+
+def test_inspect_profile_source_fetch_does_not_retry_non_tls_errors() -> None:
+ """Non-TLS fetch failures should keep the existing error behavior."""
+ processor = ResumeProfileProcessor()
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=ValueError("Profile fetch failed: 404 Client Error")
+ )
+
+ with pytest.raises(ValueError, match="404 Client Error"):
+ processor.inspect_profile_source_fetch(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ processor._fetch_external_profile_source_response.assert_called_once_with(
+ "https://example.com/about"
+ )
+
+
+def test_inspect_profile_source_fetch_does_not_retry_github_tls_failures() -> None:
+ """GitHub-style sources should not try personal-website recovery variants."""
+ processor = ResumeProfileProcessor()
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ )
+ )
+
+ with pytest.raises(ValueError, match="TLS connect error"):
+ processor.inspect_profile_source_fetch(
+ "https://github.com/octocat",
+ allow_javascript_fallback=False,
+ )
+
+ processor._fetch_external_profile_source_response.assert_called_once_with(
+ "https://github.com/octocat"
+ )
+
+
 def test_validate_browser_profile_request_url_blocks_non_public_http_targets() -> None:
  """Browser fallback requests should reject non-public HTTP(S) targets."""
  processor = ResumeProfileProcessor()

packages/shared/src/five08/resume_profile_processor.py

@@ -13,7 +13,7 @@
 from datetime import datetime, timezone
 from html import unescape
 from typing import Any, cast
-from urllib.parse import urljoin, urlsplit
+from urllib.parse import urljoin, urlsplit, urlunsplit
 
 from curl_cffi import CurlOpt, requests as curl_requests
 from curl_cffi.requests import BrowserTypeLiteral, RequestsError
@@ -1286,9 +1286,10 @@ def _build_initial_external_source_candidates(
  added_website_source_keys: set[str] = set()
  website_budget = PROFILE_SOURCE_MAX_WEBSITES
 
- explicit_website_links = self._coerce_website_links(explicit_personal_websites)
- for website_url in explicit_website_links:
- source_key = normalized_website_identity_key(website_url)
+ explicit_website_links = self._coerce_fetchable_website_links(
+ explicit_personal_websites
+ )
+ for website_url, source_key in explicit_website_links:
  if not source_key or source_key in added_website_source_keys:
  continue
  if website_budget <= 0:
@@ -1304,9 +1305,10 @@ def _build_initial_external_source_candidates(
  )
  )
 
- website_links = self._coerce_website_links(contact.get("cWebsiteLink"))
- for website_url in website_links:
- source_key = normalized_website_identity_key(website_url)
+ website_links = self._coerce_fetchable_website_links(
+ contact.get("cWebsiteLink")
+ )
+ for website_url, source_key in website_links:
  if not source_key or source_key in added_website_source_keys:
  continue
  if website_budget <= 0:
@@ -1454,7 +1456,22 @@ def inspect_profile_source_fetch(
  *,
  allow_javascript_fallback: bool = False,
  ) -> ProfileSourceFetchDiagnostics:
- response = self._fetch_external_profile_source_response(url)
+ response: ProfileSourceHttpResponse | None = None
+ last_fetch_error: ValueError | None = None
+ for candidate_url in self._iter_profile_source_fetch_urls(
+ url,
+ allow_javascript_fallback=allow_javascript_fallback,
+ ):
+ try:
+ response = self._fetch_external_profile_source_response(candidate_url)
+ break
+ except ValueError as exc:
+ last_fetch_error = exc
+ if not self._is_retryable_profile_fetch_error(str(exc)):
+ raise
+
+ if response is None:
+ raise last_fetch_error or ValueError("Profile fetch failed")
  extracted = ""
  extraction_error: ValueError | None = None
  try:
@@ -1513,6 +1530,82 @@ def inspect_profile_source_fetch(
  error=error,
  )
 
+ def _iter_profile_source_fetch_urls(
+ self,
+ url: str,
+ *,
+ allow_javascript_fallback: bool,
+ ) -> list[str]:
+ candidates = [url]
+ if not allow_javascript_fallback:
+ return candidates
+
+ try:
+ parsed = urlsplit(url)
+ except Exception:
+ return candidates
+
+ if parsed.scheme.lower() != "https":
+ return candidates
+
+ host = (parsed.hostname or "").strip()
+ if not host:
+ return candidates
+
+ seen = {url}
+ alternate_netloc = self._alternate_profile_host_netloc(parsed)
+ if parsed.port in {None, 443} and alternate_netloc:
+ alternate_https_candidate = urlunsplit(
+ parsed._replace(netloc=alternate_netloc)
+ )
+ if alternate_https_candidate not in seen:
+ seen.add(alternate_https_candidate)
+ candidates.append(alternate_https_candidate)
+
+ return candidates
+
+ @staticmethod
+ def _is_retryable_profile_fetch_error(error: str) -> bool:
+ normalized = error.casefold()
+ return "profile fetch failed:" in normalized and any(
+ marker in normalized
+ for marker in (
+ "tls connect error",
+ "tlsv1_alert_internal_error",
+ "tlsv1 alert internal error",
+ "ssl:",
+ )
+ )
+
+ @staticmethod
+ def _alternate_profile_host_netloc(parsed: Any) -> str | None:
+ host = (parsed.hostname or "").strip()
+ if not host:
+ return None
+ if host.casefold().startswith("www."):
+ alternate_host = host[4:]
+ else:
+ alternate_host = f"www.{host}"
+ return ResumeProfileProcessor._swap_url_port(
+ parsed,
+ new_host=alternate_host,
+ new_port=parsed.port,
+ )
+
+ @staticmethod
+ def _swap_url_port(
+ parsed: Any,
+ *,
+ new_host: str | None = None,
+ new_port: int | None,
+ ) -> str:
+ host = new_host or (parsed.hostname or "").strip()
+ if not host:
+ return parsed.netloc
+ if new_port is None:
+ return host
+ return f"{host}:{new_port}"
+
  def _fetch_external_profile_source_response(
  self, url: str
  ) -> ProfileSourceHttpResponse:
@@ -2274,6 +2367,37 @@ def _coerce_website_links(self, value: Any) -> list[str]:
 
  return normalized
 
+ def _coerce_fetchable_website_links(self, value: Any) -> list[tuple[str, str]]:
+ if value is None:
+ return []
+
+ if isinstance(value, str):
+ raw_values = [item for item in value.split(",") if item.strip()]
+ elif isinstance(value, (list, tuple, set)):
+ raw_values = list(value)
+ else:
+ return []
+
+ normalized: list[tuple[str, str]] = []
+ seen: set[str] = set()
+ for raw_value in raw_values:
+ if not isinstance(raw_value, str):
+ continue
+ raw_candidate = raw_value.strip()
+ normalized_link = self._normalize_website_url(raw_candidate)
+ if normalized_link is None:
+ continue
+ fetchable_link = self._normalize_fetchable_website_url(raw_candidate)
+ if fetchable_link is None:
+ continue
+ dedupe_key = normalized_website_identity_key(normalized_link)
+ if dedupe_key is None or dedupe_key in seen:
+ continue
+ seen.add(dedupe_key)
+ normalized.append((fetchable_link, dedupe_key))
+
+ return normalized
+
  def _merge_website_links(
  self, *, existing: list[str], extracted: list[str]
  ) -> list[str]:
@@ -2310,6 +2434,34 @@ def _merge_website_links(
  def _normalize_website_url(value: str) -> str | None:
  return normalize_website_url(value, allow_scheme_less=True)
 
+ @staticmethod
+ def _normalize_fetchable_website_url(value: str) -> str | None:
+ candidate = value.strip().strip(")]},.;:")
+ if not candidate:
+ return None
+
+ lower_candidate = candidate.lower()
+ if lower_candidate.startswith("www."):
+ candidate = f"https://{candidate}"
+ elif not lower_candidate.startswith(("http://", "https://")):
+ if not re.match(
+ r"(?i)^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}(?:[/?#].*)?$",
+ candidate,
+ ):
+ return None
+ candidate = f"https://{candidate}"
+
+ try:
+ parsed = urlsplit(candidate)
+ except Exception:
+ return None
+
+ if "@" in parsed.netloc:
+ return None
+ if not (parsed.hostname or "").strip():
+ return None
+ return parsed.geturl().rstrip("/")
+
  def _normalize_email_address(self, value: Any) -> str | None:
  if not isinstance(value, str):
  return None

tests/unit/test_resume_profile_processor.py

@@ -6,7 +6,7 @@
 from types import SimpleNamespace
 
 import pytest
-from unittest.mock import MagicMock, Mock, patch
+from unittest.mock import MagicMock, Mock, call, patch
 
 from curl_cffi import CurlOpt
 
@@ -691,6 +691,20 @@ def test_build_initial_external_source_candidates_caps_websites_globally() -> No
  assert github_urls == ["https://github.com/octocat"]
 
 
+def test_build_initial_external_source_candidates_preserves_www_host_from_crm() -> None:
+ """CRM website candidates should keep the stored host for the first fetch."""
+ processor = ResumeProfileProcessor()
+
+ candidates = processor._build_initial_external_source_candidates(
+ contact={"cWebsiteLink": ["https://www.example.com/about"]},
+ )
+
+ assert len(candidates) == 1
+ assert candidates[0].label == "Personal Website"
+ assert candidates[0].url == "https://www.example.com/about"
+ assert candidates[0].source_key == "website:example.com/about"
+
+
 def test_fetch_external_profile_sources_retries_alternate_candidate_after_failure() -> (
  None
 ):
@@ -795,6 +809,132 @@ def test_fetch_external_profile_source_text_skips_browser_for_github_sources() -
  )
 
 
+def test_inspect_profile_source_fetch_retries_personal_site_tls_variants() -> None:
+ """Personal website fetches should recover from apex TLS failures."""
+ processor = ResumeProfileProcessor()
+ http_response = ProfileSourceHttpResponse(
+ final_url="https://www.example.com/about",
+ status_code=200,
+ headers={"content-type": "text/html; charset=utf-8"},
+ body=b"<html><head><title>Portfolio</title></head><body>Builder</body></html>",
+ )
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=[
+ ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ ),
+ http_response,
+ ]
+ )
+
+ diagnostics = processor.inspect_profile_source_fetch(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ assert diagnostics.final_url == "https://www.example.com/about"
+ assert diagnostics.selected_text == "Title: Portfolio\nPortfolio Builder"
+ assert processor._fetch_external_profile_source_response.call_args_list == [
+ call("https://example.com/about"),
+ call("https://www.example.com/about"),
+ ]
+
+
+def test_inspect_profile_source_fetch_uses_stripped_host_as_www_fallback() -> None:
+ """Stored www hosts should fall back to the apex host after TLS failures."""
+ processor = ResumeProfileProcessor()
+ http_response = ProfileSourceHttpResponse(
+ final_url="https://example.com/about",
+ status_code=200,
+ headers={"content-type": "text/html; charset=utf-8"},
+ body=b"<html><head><title>Portfolio</title></head><body>Builder</body></html>",
+ )
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=[
+ ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ ),
+ http_response,
+ ]
+ )
+
+ diagnostics = processor.inspect_profile_source_fetch(
+ "https://www.example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ assert diagnostics.final_url == "https://example.com/about"
+ assert diagnostics.selected_text == "Title: Portfolio\nPortfolio Builder"
+ assert processor._fetch_external_profile_source_response.call_args_list == [
+ call("https://www.example.com/about"),
+ call("https://example.com/about"),
+ ]
+
+
+def test_iter_profile_source_fetch_urls_keeps_https_only() -> None:
+ """TLS retries should stay on HTTPS host variants without downgrading transport."""
+ processor = ResumeProfileProcessor()
+
+ assert processor._iter_profile_source_fetch_urls(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ ) == [
+ "https://example.com/about",
+ "https://www.example.com/about",
+ ]
+ assert processor._iter_profile_source_fetch_urls(
+ "https://www.example.com/about",
+ allow_javascript_fallback=True,
+ ) == [
+ "https://www.example.com/about",
+ "https://example.com/about",
+ ]
+
+
+def test_inspect_profile_source_fetch_does_not_retry_non_tls_errors() -> None:
+ """Non-TLS fetch failures should keep the existing error behavior."""
+ processor = ResumeProfileProcessor()
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=ValueError("Profile fetch failed: 404 Client Error")
+ )
+
+ with pytest.raises(ValueError, match="404 Client Error"):
+ processor.inspect_profile_source_fetch(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ processor._fetch_external_profile_source_response.assert_called_once_with(
+ "https://example.com/about"
+ )
+
+
+def test_inspect_profile_source_fetch_does_not_retry_github_tls_failures() -> None:
+ """GitHub-style sources should not try personal-website recovery variants."""
+ processor = ResumeProfileProcessor()
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ )
+ )
+
+ with pytest.raises(ValueError, match="TLS connect error"):
+ processor.inspect_profile_source_fetch(
+ "https://github.com/octocat",
+ allow_javascript_fallback=False,
+ )
+
+ processor._fetch_external_profile_source_response.assert_called_once_with(
+ "https://github.com/octocat"
+ )
+
+
 def test_validate_browser_profile_request_url_blocks_non_public_http_targets() -> None:
  """Browser fallback requests should reject non-public HTTP(S) targets."""
  processor = ResumeProfileProcessor()

packages/shared/src/five08/resume_profile_processor.py

@@ -13,7 +13,7 @@
 from datetime import datetime, timezone
 from html import unescape
 from typing import Any, cast
-from urllib.parse import urljoin, urlsplit
+from urllib.parse import urljoin, urlsplit, urlunsplit
 
 from curl_cffi import CurlOpt, requests as curl_requests
 from curl_cffi.requests import BrowserTypeLiteral, RequestsError
@@ -1286,9 +1286,10 @@ def _build_initial_external_source_candidates(
  added_website_source_keys: set[str] = set()
  website_budget = PROFILE_SOURCE_MAX_WEBSITES
 
- explicit_website_links = self._coerce_website_links(explicit_personal_websites)
- for website_url in explicit_website_links:
- source_key = normalized_website_identity_key(website_url)
+ explicit_website_links = self._coerce_fetchable_website_links(
+ explicit_personal_websites
+ )
+ for website_url, source_key in explicit_website_links:
  if not source_key or source_key in added_website_source_keys:
  continue
  if website_budget <= 0:
@@ -1304,9 +1305,10 @@ def _build_initial_external_source_candidates(
  )
  )
 
- website_links = self._coerce_website_links(contact.get("cWebsiteLink"))
- for website_url in website_links:
- source_key = normalized_website_identity_key(website_url)
+ website_links = self._coerce_fetchable_website_links(
+ contact.get("cWebsiteLink")
+ )
+ for website_url, source_key in website_links:
  if not source_key or source_key in added_website_source_keys:
  continue
  if website_budget <= 0:
@@ -1454,7 +1456,22 @@ def inspect_profile_source_fetch(
  *,
  allow_javascript_fallback: bool = False,
  ) -> ProfileSourceFetchDiagnostics:
- response = self._fetch_external_profile_source_response(url)
+ response: ProfileSourceHttpResponse | None = None
+ last_fetch_error: ValueError | None = None
+ for candidate_url in self._iter_profile_source_fetch_urls(
+ url,
+ allow_javascript_fallback=allow_javascript_fallback,
+ ):
+ try:
+ response = self._fetch_external_profile_source_response(candidate_url)
+ break
+ except ValueError as exc:
+ last_fetch_error = exc
+ if not self._is_retryable_profile_fetch_error(str(exc)):
+ raise
+
+ if response is None:
+ raise last_fetch_error or ValueError("Profile fetch failed")
  extracted = ""
  extraction_error: ValueError | None = None
  try:
@@ -1513,6 +1530,82 @@ def inspect_profile_source_fetch(
  error=error,
  )
 
+ def _iter_profile_source_fetch_urls(
+ self,
+ url: str,
+ *,
+ allow_javascript_fallback: bool,
+ ) -> list[str]:
+ candidates = [url]
+ if not allow_javascript_fallback:
+ return candidates
+
+ try:
+ parsed = urlsplit(url)
+ except Exception:
+ return candidates
+
+ if parsed.scheme.lower() != "https":
+ return candidates
+
+ host = (parsed.hostname or "").strip()
+ if not host:
+ return candidates
+
+ seen = {url}
+ alternate_netloc = self._alternate_profile_host_netloc(parsed)
+ if parsed.port in {None, 443} and alternate_netloc:
+ alternate_https_candidate = urlunsplit(
+ parsed._replace(netloc=alternate_netloc)
+ )
+ if alternate_https_candidate not in seen:
+ seen.add(alternate_https_candidate)
+ candidates.append(alternate_https_candidate)
+
+ return candidates
+
+ @staticmethod
+ def _is_retryable_profile_fetch_error(error: str) -> bool:
+ normalized = error.casefold()
+ return "profile fetch failed:" in normalized and any(
+ marker in normalized
+ for marker in (
+ "tls connect error",
+ "tlsv1_alert_internal_error",
+ "tlsv1 alert internal error",
+ "ssl:",
+ )
+ )
+
+ @staticmethod
+ def _alternate_profile_host_netloc(parsed: Any) -> str | None:
+ host = (parsed.hostname or "").strip()
+ if not host:
+ return None
+ if host.casefold().startswith("www."):
+ alternate_host = host[4:]
+ else:
+ alternate_host = f"www.{host}"
+ return ResumeProfileProcessor._swap_url_port(
+ parsed,
+ new_host=alternate_host,
+ new_port=parsed.port,
+ )
+
+ @staticmethod
+ def _swap_url_port(
+ parsed: Any,
+ *,
+ new_host: str | None = None,
+ new_port: int | None,
+ ) -> str:
+ host = new_host or (parsed.hostname or "").strip()
+ if not host:
+ return parsed.netloc
+ if new_port is None:
+ return host
+ return f"{host}:{new_port}"
+
  def _fetch_external_profile_source_response(
  self, url: str
  ) -> ProfileSourceHttpResponse:
@@ -2274,6 +2367,37 @@ def _coerce_website_links(self, value: Any) -> list[str]:
 
  return normalized
 
+ def _coerce_fetchable_website_links(self, value: Any) -> list[tuple[str, str]]:
+ if value is None:
+ return []
+
+ if isinstance(value, str):
+ raw_values = [item for item in value.split(",") if item.strip()]
+ elif isinstance(value, (list, tuple, set)):
+ raw_values = list(value)
+ else:
+ return []
+
+ normalized: list[tuple[str, str]] = []
+ seen: set[str] = set()
+ for raw_value in raw_values:
+ if not isinstance(raw_value, str):
+ continue
+ raw_candidate = raw_value.strip()
+ normalized_link = self._normalize_website_url(raw_candidate)
+ if normalized_link is None:
+ continue
+ fetchable_link = self._normalize_fetchable_website_url(raw_candidate)
+ if fetchable_link is None:
+ continue
+ dedupe_key = normalized_website_identity_key(normalized_link)
+ if dedupe_key is None or dedupe_key in seen:
+ continue
+ seen.add(dedupe_key)
+ normalized.append((fetchable_link, dedupe_key))
+
+ return normalized
+
  def _merge_website_links(
  self, *, existing: list[str], extracted: list[str]
  ) -> list[str]:
@@ -2310,6 +2434,34 @@ def _merge_website_links(
  def _normalize_website_url(value: str) -> str | None:
  return normalize_website_url(value, allow_scheme_less=True)
 
+ @staticmethod
+ def _normalize_fetchable_website_url(value: str) -> str | None:
+ candidate = value.strip().strip(")]},.;:")
+ if not candidate:
+ return None
+
+ lower_candidate = candidate.lower()
+ if lower_candidate.startswith("www."):
+ candidate = f"https://{candidate}"
+ elif not lower_candidate.startswith(("http://", "https://")):
+ if not re.match(
+ r"(?i)^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}(?:[/?#].*)?$",
+ candidate,
+ ):
+ return None
+ candidate = f"https://{candidate}"
+
+ try:
+ parsed = urlsplit(candidate)
+ except Exception:
+ return None
+
+ if "@" in parsed.netloc:
+ return None
+ if not (parsed.hostname or "").strip():
+ return None
+ return parsed.geturl().rstrip("/")
+
  def _normalize_email_address(self, value: Any) -> str | None:
  if not isinstance(value, str):
  return None

tests/unit/test_resume_profile_processor.py

@@ -6,7 +6,7 @@
 from types import SimpleNamespace
 
 import pytest
-from unittest.mock import MagicMock, Mock, patch
+from unittest.mock import MagicMock, Mock, call, patch
 
 from curl_cffi import CurlOpt
 
@@ -691,6 +691,20 @@ def test_build_initial_external_source_candidates_caps_websites_globally() -> No
  assert github_urls == ["https://github.com/octocat"]
 
 
+def test_build_initial_external_source_candidates_preserves_www_host_from_crm() -> None:
+ """CRM website candidates should keep the stored host for the first fetch."""
+ processor = ResumeProfileProcessor()
+
+ candidates = processor._build_initial_external_source_candidates(
+ contact={"cWebsiteLink": ["https://www.example.com/about"]},
+ )
+
+ assert len(candidates) == 1
+ assert candidates[0].label == "Personal Website"
+ assert candidates[0].url == "https://www.example.com/about"
+ assert candidates[0].source_key == "website:example.com/about"
+
+
 def test_fetch_external_profile_sources_retries_alternate_candidate_after_failure() -> (
  None
 ):
@@ -795,6 +809,132 @@ def test_fetch_external_profile_source_text_skips_browser_for_github_sources() -
  )
 
 
+def test_inspect_profile_source_fetch_retries_personal_site_tls_variants() -> None:
+ """Personal website fetches should recover from apex TLS failures."""
+ processor = ResumeProfileProcessor()
+ http_response = ProfileSourceHttpResponse(
+ final_url="https://www.example.com/about",
+ status_code=200,
+ headers={"content-type": "text/html; charset=utf-8"},
+ body=b"<html><head><title>Portfolio</title></head><body>Builder</body></html>",
+ )
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=[
+ ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ ),
+ http_response,
+ ]
+ )
+
+ diagnostics = processor.inspect_profile_source_fetch(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ assert diagnostics.final_url == "https://www.example.com/about"
+ assert diagnostics.selected_text == "Title: Portfolio\nPortfolio Builder"
+ assert processor._fetch_external_profile_source_response.call_args_list == [
+ call("https://example.com/about"),
+ call("https://www.example.com/about"),
+ ]
+
+
+def test_inspect_profile_source_fetch_uses_stripped_host_as_www_fallback() -> None:
+ """Stored www hosts should fall back to the apex host after TLS failures."""
+ processor = ResumeProfileProcessor()
+ http_response = ProfileSourceHttpResponse(
+ final_url="https://example.com/about",
+ status_code=200,
+ headers={"content-type": "text/html; charset=utf-8"},
+ body=b"<html><head><title>Portfolio</title></head><body>Builder</body></html>",
+ )
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=[
+ ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ ),
+ http_response,
+ ]
+ )
+
+ diagnostics = processor.inspect_profile_source_fetch(
+ "https://www.example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ assert diagnostics.final_url == "https://example.com/about"
+ assert diagnostics.selected_text == "Title: Portfolio\nPortfolio Builder"
+ assert processor._fetch_external_profile_source_response.call_args_list == [
+ call("https://www.example.com/about"),
+ call("https://example.com/about"),
+ ]
+
+
+def test_iter_profile_source_fetch_urls_keeps_https_only() -> None:
+ """TLS retries should stay on HTTPS host variants without downgrading transport."""
+ processor = ResumeProfileProcessor()
+
+ assert processor._iter_profile_source_fetch_urls(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ ) == [
+ "https://example.com/about",
+ "https://www.example.com/about",
+ ]
+ assert processor._iter_profile_source_fetch_urls(
+ "https://www.example.com/about",
+ allow_javascript_fallback=True,
+ ) == [
+ "https://www.example.com/about",
+ "https://example.com/about",
+ ]
+
+
+def test_inspect_profile_source_fetch_does_not_retry_non_tls_errors() -> None:
+ """Non-TLS fetch failures should keep the existing error behavior."""
+ processor = ResumeProfileProcessor()
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=ValueError("Profile fetch failed: 404 Client Error")
+ )
+
+ with pytest.raises(ValueError, match="404 Client Error"):
+ processor.inspect_profile_source_fetch(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ processor._fetch_external_profile_source_response.assert_called_once_with(
+ "https://example.com/about"
+ )
+
+
+def test_inspect_profile_source_fetch_does_not_retry_github_tls_failures() -> None:
+ """GitHub-style sources should not try personal-website recovery variants."""
+ processor = ResumeProfileProcessor()
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ )
+ )
+
+ with pytest.raises(ValueError, match="TLS connect error"):
+ processor.inspect_profile_source_fetch(
+ "https://github.com/octocat",
+ allow_javascript_fallback=False,
+ )
+
+ processor._fetch_external_profile_source_response.assert_called_once_with(
+ "https://github.com/octocat"
+ )
+
+
 def test_validate_browser_profile_request_url_blocks_non_public_http_targets() -> None:
  """Browser fallback requests should reject non-public HTTP(S) targets."""
  processor = ResumeProfileProcessor()

packages/shared/src/five08/resume_profile_processor.py

@@ -13,7 +13,7 @@
 from datetime import datetime, timezone
 from html import unescape
 from typing import Any, cast
-from urllib.parse import urljoin, urlsplit
+from urllib.parse import urljoin, urlsplit, urlunsplit
 
 from curl_cffi import CurlOpt, requests as curl_requests
 from curl_cffi.requests import BrowserTypeLiteral, RequestsError
@@ -1286,9 +1286,10 @@ def _build_initial_external_source_candidates(
  added_website_source_keys: set[str] = set()
  website_budget = PROFILE_SOURCE_MAX_WEBSITES
 
- explicit_website_links = self._coerce_website_links(explicit_personal_websites)
- for website_url in explicit_website_links:
- source_key = normalized_website_identity_key(website_url)
+ explicit_website_links = self._coerce_fetchable_website_links(
+ explicit_personal_websites
+ )
+ for website_url, source_key in explicit_website_links:
  if not source_key or source_key in added_website_source_keys:
  continue
  if website_budget <= 0:
@@ -1304,9 +1305,10 @@ def _build_initial_external_source_candidates(
  )
  )
 
- website_links = self._coerce_website_links(contact.get("cWebsiteLink"))
- for website_url in website_links:
- source_key = normalized_website_identity_key(website_url)
+ website_links = self._coerce_fetchable_website_links(
+ contact.get("cWebsiteLink")
+ )
+ for website_url, source_key in website_links:
  if not source_key or source_key in added_website_source_keys:
  continue
  if website_budget <= 0:
@@ -1454,7 +1456,22 @@ def inspect_profile_source_fetch(
  *,
  allow_javascript_fallback: bool = False,
  ) -> ProfileSourceFetchDiagnostics:
- response = self._fetch_external_profile_source_response(url)
+ response: ProfileSourceHttpResponse | None = None
+ last_fetch_error: ValueError | None = None
+ for candidate_url in self._iter_profile_source_fetch_urls(
+ url,
+ allow_javascript_fallback=allow_javascript_fallback,
+ ):
+ try:
+ response = self._fetch_external_profile_source_response(candidate_url)
+ break
+ except ValueError as exc:
+ last_fetch_error = exc
+ if not self._is_retryable_profile_fetch_error(str(exc)):
+ raise
+
+ if response is None:
+ raise last_fetch_error or ValueError("Profile fetch failed")
  extracted = ""
  extraction_error: ValueError | None = None
  try:
@@ -1513,6 +1530,82 @@ def inspect_profile_source_fetch(
  error=error,
  )
 
+ def _iter_profile_source_fetch_urls(
+ self,
+ url: str,
+ *,
+ allow_javascript_fallback: bool,
+ ) -> list[str]:
+ candidates = [url]
+ if not allow_javascript_fallback:
+ return candidates
+
+ try:
+ parsed = urlsplit(url)
+ except Exception:
+ return candidates
+
+ if parsed.scheme.lower() != "https":
+ return candidates
+
+ host = (parsed.hostname or "").strip()
+ if not host:
+ return candidates
+
+ seen = {url}
+ alternate_netloc = self._alternate_profile_host_netloc(parsed)
+ if parsed.port in {None, 443} and alternate_netloc:
+ alternate_https_candidate = urlunsplit(
+ parsed._replace(netloc=alternate_netloc)
+ )
+ if alternate_https_candidate not in seen:
+ seen.add(alternate_https_candidate)
+ candidates.append(alternate_https_candidate)
+
+ return candidates
+
+ @staticmethod
+ def _is_retryable_profile_fetch_error(error: str) -> bool:
+ normalized = error.casefold()
+ return "profile fetch failed:" in normalized and any(
+ marker in normalized
+ for marker in (
+ "tls connect error",
+ "tlsv1_alert_internal_error",
+ "tlsv1 alert internal error",
+ "ssl:",
+ )
+ )
+
+ @staticmethod
+ def _alternate_profile_host_netloc(parsed: Any) -> str | None:
+ host = (parsed.hostname or "").strip()
+ if not host:
+ return None
+ if host.casefold().startswith("www."):
+ alternate_host = host[4:]
+ else:
+ alternate_host = f"www.{host}"
+ return ResumeProfileProcessor._swap_url_port(
+ parsed,
+ new_host=alternate_host,
+ new_port=parsed.port,
+ )
+
+ @staticmethod
+ def _swap_url_port(
+ parsed: Any,
+ *,
+ new_host: str | None = None,
+ new_port: int | None,
+ ) -> str:
+ host = new_host or (parsed.hostname or "").strip()
+ if not host:
+ return parsed.netloc
+ if new_port is None:
+ return host
+ return f"{host}:{new_port}"
+
  def _fetch_external_profile_source_response(
  self, url: str
  ) -> ProfileSourceHttpResponse:
@@ -2274,6 +2367,37 @@ def _coerce_website_links(self, value: Any) -> list[str]:
 
  return normalized
 
+ def _coerce_fetchable_website_links(self, value: Any) -> list[tuple[str, str]]:
+ if value is None:
+ return []
+
+ if isinstance(value, str):
+ raw_values = [item for item in value.split(",") if item.strip()]
+ elif isinstance(value, (list, tuple, set)):
+ raw_values = list(value)
+ else:
+ return []
+
+ normalized: list[tuple[str, str]] = []
+ seen: set[str] = set()
+ for raw_value in raw_values:
+ if not isinstance(raw_value, str):
+ continue
+ raw_candidate = raw_value.strip()
+ normalized_link = self._normalize_website_url(raw_candidate)
+ if normalized_link is None:
+ continue
+ fetchable_link = self._normalize_fetchable_website_url(raw_candidate)
+ if fetchable_link is None:
+ continue
+ dedupe_key = normalized_website_identity_key(normalized_link)
+ if dedupe_key is None or dedupe_key in seen:
+ continue
+ seen.add(dedupe_key)
+ normalized.append((fetchable_link, dedupe_key))
+
+ return normalized
+
  def _merge_website_links(
  self, *, existing: list[str], extracted: list[str]
  ) -> list[str]:
@@ -2310,6 +2434,34 @@ def _merge_website_links(
  def _normalize_website_url(value: str) -> str | None:
  return normalize_website_url(value, allow_scheme_less=True)
 
+ @staticmethod
+ def _normalize_fetchable_website_url(value: str) -> str | None:
+ candidate = value.strip().strip(")]},.;:")
+ if not candidate:
+ return None
+
+ lower_candidate = candidate.lower()
+ if lower_candidate.startswith("www."):
+ candidate = f"https://{candidate}"
+ elif not lower_candidate.startswith(("http://", "https://")):
+ if not re.match(
+ r"(?i)^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}(?:[/?#].*)?$",
+ candidate,
+ ):
+ return None
+ candidate = f"https://{candidate}"
+
+ try:
+ parsed = urlsplit(candidate)
+ except Exception:
+ return None
+
+ if "@" in parsed.netloc:
+ return None
+ if not (parsed.hostname or "").strip():
+ return None
+ return parsed.geturl().rstrip("/")
+
  def _normalize_email_address(self, value: Any) -> str | None:
  if not isinstance(value, str):
  return None

tests/unit/test_resume_profile_processor.py

@@ -6,7 +6,7 @@
 from types import SimpleNamespace
 
 import pytest
-from unittest.mock import MagicMock, Mock, patch
+from unittest.mock import MagicMock, Mock, call, patch
 
 from curl_cffi import CurlOpt
 
@@ -691,6 +691,20 @@ def test_build_initial_external_source_candidates_caps_websites_globally() -> No
  assert github_urls == ["https://github.com/octocat"]
 
 
+def test_build_initial_external_source_candidates_preserves_www_host_from_crm() -> None:
+ """CRM website candidates should keep the stored host for the first fetch."""
+ processor = ResumeProfileProcessor()
+
+ candidates = processor._build_initial_external_source_candidates(
+ contact={"cWebsiteLink": ["https://www.example.com/about"]},
+ )
+
+ assert len(candidates) == 1
+ assert candidates[0].label == "Personal Website"
+ assert candidates[0].url == "https://www.example.com/about"
+ assert candidates[0].source_key == "website:example.com/about"
+
+
 def test_fetch_external_profile_sources_retries_alternate_candidate_after_failure() -> (
  None
 ):
@@ -795,6 +809,132 @@ def test_fetch_external_profile_source_text_skips_browser_for_github_sources() -
  )
 
 
+def test_inspect_profile_source_fetch_retries_personal_site_tls_variants() -> None:
+ """Personal website fetches should recover from apex TLS failures."""
+ processor = ResumeProfileProcessor()
+ http_response = ProfileSourceHttpResponse(
+ final_url="https://www.example.com/about",
+ status_code=200,
+ headers={"content-type": "text/html; charset=utf-8"},
+ body=b"<html><head><title>Portfolio</title></head><body>Builder</body></html>",
+ )
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=[
+ ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ ),
+ http_response,
+ ]
+ )
+
+ diagnostics = processor.inspect_profile_source_fetch(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ assert diagnostics.final_url == "https://www.example.com/about"
+ assert diagnostics.selected_text == "Title: Portfolio\nPortfolio Builder"
+ assert processor._fetch_external_profile_source_response.call_args_list == [
+ call("https://example.com/about"),
+ call("https://www.example.com/about"),
+ ]
+
+
+def test_inspect_profile_source_fetch_uses_stripped_host_as_www_fallback() -> None:
+ """Stored www hosts should fall back to the apex host after TLS failures."""
+ processor = ResumeProfileProcessor()
+ http_response = ProfileSourceHttpResponse(
+ final_url="https://example.com/about",
+ status_code=200,
+ headers={"content-type": "text/html; charset=utf-8"},
+ body=b"<html><head><title>Portfolio</title></head><body>Builder</body></html>",
+ )
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=[
+ ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ ),
+ http_response,
+ ]
+ )
+
+ diagnostics = processor.inspect_profile_source_fetch(
+ "https://www.example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ assert diagnostics.final_url == "https://example.com/about"
+ assert diagnostics.selected_text == "Title: Portfolio\nPortfolio Builder"
+ assert processor._fetch_external_profile_source_response.call_args_list == [
+ call("https://www.example.com/about"),
+ call("https://example.com/about"),
+ ]
+
+
+def test_iter_profile_source_fetch_urls_keeps_https_only() -> None:
+ """TLS retries should stay on HTTPS host variants without downgrading transport."""
+ processor = ResumeProfileProcessor()
+
+ assert processor._iter_profile_source_fetch_urls(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ ) == [
+ "https://example.com/about",
+ "https://www.example.com/about",
+ ]
+ assert processor._iter_profile_source_fetch_urls(
+ "https://www.example.com/about",
+ allow_javascript_fallback=True,
+ ) == [
+ "https://www.example.com/about",
+ "https://example.com/about",
+ ]
+
+
+def test_inspect_profile_source_fetch_does_not_retry_non_tls_errors() -> None:
+ """Non-TLS fetch failures should keep the existing error behavior."""
+ processor = ResumeProfileProcessor()
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=ValueError("Profile fetch failed: 404 Client Error")
+ )
+
+ with pytest.raises(ValueError, match="404 Client Error"):
+ processor.inspect_profile_source_fetch(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ processor._fetch_external_profile_source_response.assert_called_once_with(
+ "https://example.com/about"
+ )
+
+
+def test_inspect_profile_source_fetch_does_not_retry_github_tls_failures() -> None:
+ """GitHub-style sources should not try personal-website recovery variants."""
+ processor = ResumeProfileProcessor()
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ )
+ )
+
+ with pytest.raises(ValueError, match="TLS connect error"):
+ processor.inspect_profile_source_fetch(
+ "https://github.com/octocat",
+ allow_javascript_fallback=False,
+ )
+
+ processor._fetch_external_profile_source_response.assert_called_once_with(
+ "https://github.com/octocat"
+ )
+
+
 def test_validate_browser_profile_request_url_blocks_non_public_http_targets() -> None:
  """Browser fallback requests should reject non-public HTTP(S) targets."""
  processor = ResumeProfileProcessor()

packages/shared/src/five08/resume_profile_processor.py

@@ -13,7 +13,7 @@
 from datetime import datetime, timezone
 from html import unescape
 from typing import Any, cast
-from urllib.parse import urljoin, urlsplit
+from urllib.parse import urljoin, urlsplit, urlunsplit
 
 from curl_cffi import CurlOpt, requests as curl_requests
 from curl_cffi.requests import BrowserTypeLiteral, RequestsError
@@ -1286,9 +1286,10 @@ def _build_initial_external_source_candidates(
  added_website_source_keys: set[str] = set()
  website_budget = PROFILE_SOURCE_MAX_WEBSITES
 
- explicit_website_links = self._coerce_website_links(explicit_personal_websites)
- for website_url in explicit_website_links:
- source_key = normalized_website_identity_key(website_url)
+ explicit_website_links = self._coerce_fetchable_website_links(
+ explicit_personal_websites
+ )
+ for website_url, source_key in explicit_website_links:
  if not source_key or source_key in added_website_source_keys:
  continue
  if website_budget <= 0:
@@ -1304,9 +1305,10 @@ def _build_initial_external_source_candidates(
  )
  )
 
- website_links = self._coerce_website_links(contact.get("cWebsiteLink"))
- for website_url in website_links:
- source_key = normalized_website_identity_key(website_url)
+ website_links = self._coerce_fetchable_website_links(
+ contact.get("cWebsiteLink")
+ )
+ for website_url, source_key in website_links:
  if not source_key or source_key in added_website_source_keys:
  continue
  if website_budget <= 0:
@@ -1454,7 +1456,22 @@ def inspect_profile_source_fetch(
  *,
  allow_javascript_fallback: bool = False,
  ) -> ProfileSourceFetchDiagnostics:
- response = self._fetch_external_profile_source_response(url)
+ response: ProfileSourceHttpResponse | None = None
+ last_fetch_error: ValueError | None = None
+ for candidate_url in self._iter_profile_source_fetch_urls(
+ url,
+ allow_javascript_fallback=allow_javascript_fallback,
+ ):
+ try:
+ response = self._fetch_external_profile_source_response(candidate_url)
+ break
+ except ValueError as exc:
+ last_fetch_error = exc
+ if not self._is_retryable_profile_fetch_error(str(exc)):
+ raise
+
+ if response is None:
+ raise last_fetch_error or ValueError("Profile fetch failed")
  extracted = ""
  extraction_error: ValueError | None = None
  try:
@@ -1513,6 +1530,82 @@ def inspect_profile_source_fetch(
  error=error,
  )
 
+ def _iter_profile_source_fetch_urls(
+ self,
+ url: str,
+ *,
+ allow_javascript_fallback: bool,
+ ) -> list[str]:
+ candidates = [url]
+ if not allow_javascript_fallback:
+ return candidates
+
+ try:
+ parsed = urlsplit(url)
+ except Exception:
+ return candidates
+
+ if parsed.scheme.lower() != "https":
+ return candidates
+
+ host = (parsed.hostname or "").strip()
+ if not host:
+ return candidates
+
+ seen = {url}
+ alternate_netloc = self._alternate_profile_host_netloc(parsed)
+ if parsed.port in {None, 443} and alternate_netloc:
+ alternate_https_candidate = urlunsplit(
+ parsed._replace(netloc=alternate_netloc)
+ )
+ if alternate_https_candidate not in seen:
+ seen.add(alternate_https_candidate)
+ candidates.append(alternate_https_candidate)
+
+ return candidates
+
+ @staticmethod
+ def _is_retryable_profile_fetch_error(error: str) -> bool:
+ normalized = error.casefold()
+ return "profile fetch failed:" in normalized and any(
+ marker in normalized
+ for marker in (
+ "tls connect error",
+ "tlsv1_alert_internal_error",
+ "tlsv1 alert internal error",
+ "ssl:",
+ )
+ )
+
+ @staticmethod
+ def _alternate_profile_host_netloc(parsed: Any) -> str | None:
+ host = (parsed.hostname or "").strip()
+ if not host:
+ return None
+ if host.casefold().startswith("www."):
+ alternate_host = host[4:]
+ else:
+ alternate_host = f"www.{host}"
+ return ResumeProfileProcessor._swap_url_port(
+ parsed,
+ new_host=alternate_host,
+ new_port=parsed.port,
+ )
+
+ @staticmethod
+ def _swap_url_port(
+ parsed: Any,
+ *,
+ new_host: str | None = None,
+ new_port: int | None,
+ ) -> str:
+ host = new_host or (parsed.hostname or "").strip()
+ if not host:
+ return parsed.netloc
+ if new_port is None:
+ return host
+ return f"{host}:{new_port}"
+
  def _fetch_external_profile_source_response(
  self, url: str
  ) -> ProfileSourceHttpResponse:
@@ -2274,6 +2367,37 @@ def _coerce_website_links(self, value: Any) -> list[str]:
 
  return normalized
 
+ def _coerce_fetchable_website_links(self, value: Any) -> list[tuple[str, str]]:
+ if value is None:
+ return []
+
+ if isinstance(value, str):
+ raw_values = [item for item in value.split(",") if item.strip()]
+ elif isinstance(value, (list, tuple, set)):
+ raw_values = list(value)
+ else:
+ return []
+
+ normalized: list[tuple[str, str]] = []
+ seen: set[str] = set()
+ for raw_value in raw_values:
+ if not isinstance(raw_value, str):
+ continue
+ raw_candidate = raw_value.strip()
+ normalized_link = self._normalize_website_url(raw_candidate)
+ if normalized_link is None:
+ continue
+ fetchable_link = self._normalize_fetchable_website_url(raw_candidate)
+ if fetchable_link is None:
+ continue
+ dedupe_key = normalized_website_identity_key(normalized_link)
+ if dedupe_key is None or dedupe_key in seen:
+ continue
+ seen.add(dedupe_key)
+ normalized.append((fetchable_link, dedupe_key))
+
+ return normalized
+
  def _merge_website_links(
  self, *, existing: list[str], extracted: list[str]
  ) -> list[str]:
@@ -2310,6 +2434,34 @@ def _merge_website_links(
  def _normalize_website_url(value: str) -> str | None:
  return normalize_website_url(value, allow_scheme_less=True)
 
+ @staticmethod
+ def _normalize_fetchable_website_url(value: str) -> str | None:
+ candidate = value.strip().strip(")]},.;:")
+ if not candidate:
+ return None
+
+ lower_candidate = candidate.lower()
+ if lower_candidate.startswith("www."):
+ candidate = f"https://{candidate}"
+ elif not lower_candidate.startswith(("http://", "https://")):
+ if not re.match(
+ r"(?i)^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}(?:[/?#].*)?$",
+ candidate,
+ ):
+ return None
+ candidate = f"https://{candidate}"
+
+ try:
+ parsed = urlsplit(candidate)
+ except Exception:
+ return None
+
+ if "@" in parsed.netloc:
+ return None
+ if not (parsed.hostname or "").strip():
+ return None
+ return parsed.geturl().rstrip("/")
+
  def _normalize_email_address(self, value: Any) -> str | None:
  if not isinstance(value, str):
  return None

tests/unit/test_resume_profile_processor.py

@@ -6,7 +6,7 @@
 from types import SimpleNamespace
 
 import pytest
-from unittest.mock import MagicMock, Mock, patch
+from unittest.mock import MagicMock, Mock, call, patch
 
 from curl_cffi import CurlOpt
 
@@ -691,6 +691,20 @@ def test_build_initial_external_source_candidates_caps_websites_globally() -> No
  assert github_urls == ["https://github.com/octocat"]
 
 
+def test_build_initial_external_source_candidates_preserves_www_host_from_crm() -> None:
+ """CRM website candidates should keep the stored host for the first fetch."""
+ processor = ResumeProfileProcessor()
+
+ candidates = processor._build_initial_external_source_candidates(
+ contact={"cWebsiteLink": ["https://www.example.com/about"]},
+ )
+
+ assert len(candidates) == 1
+ assert candidates[0].label == "Personal Website"
+ assert candidates[0].url == "https://www.example.com/about"
+ assert candidates[0].source_key == "website:example.com/about"
+
+
 def test_fetch_external_profile_sources_retries_alternate_candidate_after_failure() -> (
  None
 ):
@@ -795,6 +809,132 @@ def test_fetch_external_profile_source_text_skips_browser_for_github_sources() -
  )
 
 
+def test_inspect_profile_source_fetch_retries_personal_site_tls_variants() -> None:
+ """Personal website fetches should recover from apex TLS failures."""
+ processor = ResumeProfileProcessor()
+ http_response = ProfileSourceHttpResponse(
+ final_url="https://www.example.com/about",
+ status_code=200,
+ headers={"content-type": "text/html; charset=utf-8"},
+ body=b"<html><head><title>Portfolio</title></head><body>Builder</body></html>",
+ )
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=[
+ ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ ),
+ http_response,
+ ]
+ )
+
+ diagnostics = processor.inspect_profile_source_fetch(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ assert diagnostics.final_url == "https://www.example.com/about"
+ assert diagnostics.selected_text == "Title: Portfolio\nPortfolio Builder"
+ assert processor._fetch_external_profile_source_response.call_args_list == [
+ call("https://example.com/about"),
+ call("https://www.example.com/about"),
+ ]
+
+
+def test_inspect_profile_source_fetch_uses_stripped_host_as_www_fallback() -> None:
+ """Stored www hosts should fall back to the apex host after TLS failures."""
+ processor = ResumeProfileProcessor()
+ http_response = ProfileSourceHttpResponse(
+ final_url="https://example.com/about",
+ status_code=200,
+ headers={"content-type": "text/html; charset=utf-8"},
+ body=b"<html><head><title>Portfolio</title></head><body>Builder</body></html>",
+ )
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=[
+ ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ ),
+ http_response,
+ ]
+ )
+
+ diagnostics = processor.inspect_profile_source_fetch(
+ "https://www.example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ assert diagnostics.final_url == "https://example.com/about"
+ assert diagnostics.selected_text == "Title: Portfolio\nPortfolio Builder"
+ assert processor._fetch_external_profile_source_response.call_args_list == [
+ call("https://www.example.com/about"),
+ call("https://example.com/about"),
+ ]
+
+
+def test_iter_profile_source_fetch_urls_keeps_https_only() -> None:
+ """TLS retries should stay on HTTPS host variants without downgrading transport."""
+ processor = ResumeProfileProcessor()
+
+ assert processor._iter_profile_source_fetch_urls(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ ) == [
+ "https://example.com/about",
+ "https://www.example.com/about",
+ ]
+ assert processor._iter_profile_source_fetch_urls(
+ "https://www.example.com/about",
+ allow_javascript_fallback=True,
+ ) == [
+ "https://www.example.com/about",
+ "https://example.com/about",
+ ]
+
+
+def test_inspect_profile_source_fetch_does_not_retry_non_tls_errors() -> None:
+ """Non-TLS fetch failures should keep the existing error behavior."""
+ processor = ResumeProfileProcessor()
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=ValueError("Profile fetch failed: 404 Client Error")
+ )
+
+ with pytest.raises(ValueError, match="404 Client Error"):
+ processor.inspect_profile_source_fetch(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ processor._fetch_external_profile_source_response.assert_called_once_with(
+ "https://example.com/about"
+ )
+
+
+def test_inspect_profile_source_fetch_does_not_retry_github_tls_failures() -> None:
+ """GitHub-style sources should not try personal-website recovery variants."""
+ processor = ResumeProfileProcessor()
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ )
+ )
+
+ with pytest.raises(ValueError, match="TLS connect error"):
+ processor.inspect_profile_source_fetch(
+ "https://github.com/octocat",
+ allow_javascript_fallback=False,
+ )
+
+ processor._fetch_external_profile_source_response.assert_called_once_with(
+ "https://github.com/octocat"
+ )
+
+
 def test_validate_browser_profile_request_url_blocks_non_public_http_targets() -> None:
  """Browser fallback requests should reject non-public HTTP(S) targets."""
  processor = ResumeProfileProcessor()

packages/shared/src/five08/resume_profile_processor.py

@@ -13,7 +13,7 @@
 from datetime import datetime, timezone
 from html import unescape
 from typing import Any, cast
-from urllib.parse import urljoin, urlsplit
+from urllib.parse import urljoin, urlsplit, urlunsplit
 
 from curl_cffi import CurlOpt, requests as curl_requests
 from curl_cffi.requests import BrowserTypeLiteral, RequestsError
@@ -1286,9 +1286,10 @@ def _build_initial_external_source_candidates(
  added_website_source_keys: set[str] = set()
  website_budget = PROFILE_SOURCE_MAX_WEBSITES
 
- explicit_website_links = self._coerce_website_links(explicit_personal_websites)
- for website_url in explicit_website_links:
- source_key = normalized_website_identity_key(website_url)
+ explicit_website_links = self._coerce_fetchable_website_links(
+ explicit_personal_websites
+ )
+ for website_url, source_key in explicit_website_links:
  if not source_key or source_key in added_website_source_keys:
  continue
  if website_budget <= 0:
@@ -1304,9 +1305,10 @@ def _build_initial_external_source_candidates(
  )
  )
 
- website_links = self._coerce_website_links(contact.get("cWebsiteLink"))
- for website_url in website_links:
- source_key = normalized_website_identity_key(website_url)
+ website_links = self._coerce_fetchable_website_links(
+ contact.get("cWebsiteLink")
+ )
+ for website_url, source_key in website_links:
  if not source_key or source_key in added_website_source_keys:
  continue
  if website_budget <= 0:
@@ -1454,7 +1456,22 @@ def inspect_profile_source_fetch(
  *,
  allow_javascript_fallback: bool = False,
  ) -> ProfileSourceFetchDiagnostics:
- response = self._fetch_external_profile_source_response(url)
+ response: ProfileSourceHttpResponse | None = None
+ last_fetch_error: ValueError | None = None
+ for candidate_url in self._iter_profile_source_fetch_urls(
+ url,
+ allow_javascript_fallback=allow_javascript_fallback,
+ ):
+ try:
+ response = self._fetch_external_profile_source_response(candidate_url)
+ break
+ except ValueError as exc:
+ last_fetch_error = exc
+ if not self._is_retryable_profile_fetch_error(str(exc)):
+ raise
+
+ if response is None:
+ raise last_fetch_error or ValueError("Profile fetch failed")
  extracted = ""
  extraction_error: ValueError | None = None
  try:
@@ -1513,6 +1530,82 @@ def inspect_profile_source_fetch(
  error=error,
  )
 
+ def _iter_profile_source_fetch_urls(
+ self,
+ url: str,
+ *,
+ allow_javascript_fallback: bool,
+ ) -> list[str]:
+ candidates = [url]
+ if not allow_javascript_fallback:
+ return candidates
+
+ try:
+ parsed = urlsplit(url)
+ except Exception:
+ return candidates
+
+ if parsed.scheme.lower() != "https":
+ return candidates
+
+ host = (parsed.hostname or "").strip()
+ if not host:
+ return candidates
+
+ seen = {url}
+ alternate_netloc = self._alternate_profile_host_netloc(parsed)
+ if parsed.port in {None, 443} and alternate_netloc:
+ alternate_https_candidate = urlunsplit(
+ parsed._replace(netloc=alternate_netloc)
+ )
+ if alternate_https_candidate not in seen:
+ seen.add(alternate_https_candidate)
+ candidates.append(alternate_https_candidate)
+
+ return candidates
+
+ @staticmethod
+ def _is_retryable_profile_fetch_error(error: str) -> bool:
+ normalized = error.casefold()
+ return "profile fetch failed:" in normalized and any(
+ marker in normalized
+ for marker in (
+ "tls connect error",
+ "tlsv1_alert_internal_error",
+ "tlsv1 alert internal error",
+ "ssl:",
+ )
+ )
+
+ @staticmethod
+ def _alternate_profile_host_netloc(parsed: Any) -> str | None:
+ host = (parsed.hostname or "").strip()
+ if not host:
+ return None
+ if host.casefold().startswith("www."):
+ alternate_host = host[4:]
+ else:
+ alternate_host = f"www.{host}"
+ return ResumeProfileProcessor._swap_url_port(
+ parsed,
+ new_host=alternate_host,
+ new_port=parsed.port,
+ )
+
+ @staticmethod
+ def _swap_url_port(
+ parsed: Any,
+ *,
+ new_host: str | None = None,
+ new_port: int | None,
+ ) -> str:
+ host = new_host or (parsed.hostname or "").strip()
+ if not host:
+ return parsed.netloc
+ if new_port is None:
+ return host
+ return f"{host}:{new_port}"
+
  def _fetch_external_profile_source_response(
  self, url: str
  ) -> ProfileSourceHttpResponse:
@@ -2274,6 +2367,37 @@ def _coerce_website_links(self, value: Any) -> list[str]:
 
  return normalized
 
+ def _coerce_fetchable_website_links(self, value: Any) -> list[tuple[str, str]]:
+ if value is None:
+ return []
+
+ if isinstance(value, str):
+ raw_values = [item for item in value.split(",") if item.strip()]
+ elif isinstance(value, (list, tuple, set)):
+ raw_values = list(value)
+ else:
+ return []
+
+ normalized: list[tuple[str, str]] = []
+ seen: set[str] = set()
+ for raw_value in raw_values:
+ if not isinstance(raw_value, str):
+ continue
+ raw_candidate = raw_value.strip()
+ normalized_link = self._normalize_website_url(raw_candidate)
+ if normalized_link is None:
+ continue
+ fetchable_link = self._normalize_fetchable_website_url(raw_candidate)
+ if fetchable_link is None:
+ continue
+ dedupe_key = normalized_website_identity_key(normalized_link)
+ if dedupe_key is None or dedupe_key in seen:
+ continue
+ seen.add(dedupe_key)
+ normalized.append((fetchable_link, dedupe_key))
+
+ return normalized
+
  def _merge_website_links(
  self, *, existing: list[str], extracted: list[str]
  ) -> list[str]:
@@ -2310,6 +2434,34 @@ def _merge_website_links(
  def _normalize_website_url(value: str) -> str | None:
  return normalize_website_url(value, allow_scheme_less=True)
 
+ @staticmethod
+ def _normalize_fetchable_website_url(value: str) -> str | None:
+ candidate = value.strip().strip(")]},.;:")
+ if not candidate:
+ return None
+
+ lower_candidate = candidate.lower()
+ if lower_candidate.startswith("www."):
+ candidate = f"https://{candidate}"
+ elif not lower_candidate.startswith(("http://", "https://")):
+ if not re.match(
+ r"(?i)^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}(?:[/?#].*)?$",
+ candidate,
+ ):
+ return None
+ candidate = f"https://{candidate}"
+
+ try:
+ parsed = urlsplit(candidate)
+ except Exception:
+ return None
+
+ if "@" in parsed.netloc:
+ return None
+ if not (parsed.hostname or "").strip():
+ return None
+ return parsed.geturl().rstrip("/")
+
  def _normalize_email_address(self, value: Any) -> str | None:
  if not isinstance(value, str):
  return None

tests/unit/test_resume_profile_processor.py

@@ -6,7 +6,7 @@
 from types import SimpleNamespace
 
 import pytest
-from unittest.mock import MagicMock, Mock, patch
+from unittest.mock import MagicMock, Mock, call, patch
 
 from curl_cffi import CurlOpt
 
@@ -691,6 +691,20 @@ def test_build_initial_external_source_candidates_caps_websites_globally() -> No
  assert github_urls == ["https://github.com/octocat"]
 
 
+def test_build_initial_external_source_candidates_preserves_www_host_from_crm() -> None:
+ """CRM website candidates should keep the stored host for the first fetch."""
+ processor = ResumeProfileProcessor()
+
+ candidates = processor._build_initial_external_source_candidates(
+ contact={"cWebsiteLink": ["https://www.example.com/about"]},
+ )
+
+ assert len(candidates) == 1
+ assert candidates[0].label == "Personal Website"
+ assert candidates[0].url == "https://www.example.com/about"
+ assert candidates[0].source_key == "website:example.com/about"
+
+
 def test_fetch_external_profile_sources_retries_alternate_candidate_after_failure() -> (
  None
 ):
@@ -795,6 +809,132 @@ def test_fetch_external_profile_source_text_skips_browser_for_github_sources() -
  )
 
 
+def test_inspect_profile_source_fetch_retries_personal_site_tls_variants() -> None:
+ """Personal website fetches should recover from apex TLS failures."""
+ processor = ResumeProfileProcessor()
+ http_response = ProfileSourceHttpResponse(
+ final_url="https://www.example.com/about",
+ status_code=200,
+ headers={"content-type": "text/html; charset=utf-8"},
+ body=b"<html><head><title>Portfolio</title></head><body>Builder</body></html>",
+ )
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=[
+ ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ ),
+ http_response,
+ ]
+ )
+
+ diagnostics = processor.inspect_profile_source_fetch(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ assert diagnostics.final_url == "https://www.example.com/about"
+ assert diagnostics.selected_text == "Title: Portfolio\nPortfolio Builder"
+ assert processor._fetch_external_profile_source_response.call_args_list == [
+ call("https://example.com/about"),
+ call("https://www.example.com/about"),
+ ]
+
+
+def test_inspect_profile_source_fetch_uses_stripped_host_as_www_fallback() -> None:
+ """Stored www hosts should fall back to the apex host after TLS failures."""
+ processor = ResumeProfileProcessor()
+ http_response = ProfileSourceHttpResponse(
+ final_url="https://example.com/about",
+ status_code=200,
+ headers={"content-type": "text/html; charset=utf-8"},
+ body=b"<html><head><title>Portfolio</title></head><body>Builder</body></html>",
+ )
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=[
+ ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ ),
+ http_response,
+ ]
+ )
+
+ diagnostics = processor.inspect_profile_source_fetch(
+ "https://www.example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ assert diagnostics.final_url == "https://example.com/about"
+ assert diagnostics.selected_text == "Title: Portfolio\nPortfolio Builder"
+ assert processor._fetch_external_profile_source_response.call_args_list == [
+ call("https://www.example.com/about"),
+ call("https://example.com/about"),
+ ]
+
+
+def test_iter_profile_source_fetch_urls_keeps_https_only() -> None:
+ """TLS retries should stay on HTTPS host variants without downgrading transport."""
+ processor = ResumeProfileProcessor()
+
+ assert processor._iter_profile_source_fetch_urls(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ ) == [
+ "https://example.com/about",
+ "https://www.example.com/about",
+ ]
+ assert processor._iter_profile_source_fetch_urls(
+ "https://www.example.com/about",
+ allow_javascript_fallback=True,
+ ) == [
+ "https://www.example.com/about",
+ "https://example.com/about",
+ ]
+
+
+def test_inspect_profile_source_fetch_does_not_retry_non_tls_errors() -> None:
+ """Non-TLS fetch failures should keep the existing error behavior."""
+ processor = ResumeProfileProcessor()
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=ValueError("Profile fetch failed: 404 Client Error")
+ )
+
+ with pytest.raises(ValueError, match="404 Client Error"):
+ processor.inspect_profile_source_fetch(
+ "https://example.com/about",
+ allow_javascript_fallback=True,
+ )
+
+ processor._fetch_external_profile_source_response.assert_called_once_with(
+ "https://example.com/about"
+ )
+
+
+def test_inspect_profile_source_fetch_does_not_retry_github_tls_failures() -> None:
+ """GitHub-style sources should not try personal-website recovery variants."""
+ processor = ResumeProfileProcessor()
+ processor._fetch_external_profile_source_response = Mock(
+ side_effect=ValueError(
+ "Profile fetch failed: Failed to perform, curl: (35) TLS connect "
+ "error: error:10000438:SSL routines:OPENSSL_internal:"
+ "TLSV1_ALERT_INTERNAL_ERROR."
+ )
+ )
+
+ with pytest.raises(ValueError, match="TLS connect error"):
+ processor.inspect_profile_source_fetch(
+ "https://github.com/octocat",
+ allow_javascript_fallback=False,
+ )
+
+ processor._fetch_external_profile_source_response.assert_called_once_with(
+ "https://github.com/octocat"
+ )
+
+
 def test_validate_browser_profile_request_url_blocks_non_public_http_targets() -> None:
  """Browser fallback requests should reject non-public HTTP(S) targets."""
  processor = ResumeProfileProcessor()