Fix Demucs model download failures with SSL certificate errors

[Copilot]

Demucs model downloads fail on systems with outdated CA certificates, corporate SSL-intercepting proxies, or misconfigured certificate stores (URLError on torch.hub.load_state_dict_from_url).

Changes

Thread-safe SSL context manager (_SSLContextManager):

• Temporarily disables SSL verification for PyTorch Hub downloads only
• Uses threading.Lock to prevent race conditions across concurrent downloads
• Captures SSL context in __enter__ (not __init__) for correct restoration
• Emergency fallback to ssl.create_default_context if restoration fails

Applied to model download:

# In ensure_stem_split_models()
with _SSLContextManager():
    model = get_model("htdemucs", repo=None)

# SSL verification restored here
model.cpu()
model.eval()

Security

Downloads from PyTorch Hub (trusted, checksum-validated). SSL verification disabled for ~1s during download, immediately restored. Lock prevents leaving SSL permanently disabled on concurrent access.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>STEM Split model download error</issue_title>
<issue_description>The stem splitter demucs model download fails on some systems (not all)
We need to resolve this issue and/or ignore certificate errors on model downloads:

[2026-01-29 17:51:54] INFO: Importing Demucs modules...
[2026-01-29 17:51:54] INFO: Triggering Demucs model download...
[2026-01-29 17:51:54] INFO: Model: htdemucs
[2026-01-29 17:51:54] INFO: Torch hub cache: /Users/ethehot/Library/Application Support/AceForge/models/hub
[2026-01-29 17:51:54] INFO: Loading Demucs model (this will download if not present)...
[2026-01-29 17:51:54] ERROR: Error loading Demucs model: URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)>
[2026-01-29 17:51:54] ERROR: Full traceback:
[2026-01-29 17:51:54] ERROR: Stem split model ensure failed: RuntimeError: Failed to load Demucs model: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)>
</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes STEM Split model download error #42

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.