fix(auth): honor SSL CA env vars across httpx + requests callsites

[0xbyt4]

Summary

Closes two related gaps in Hermes' SSL/TLS handling, both reported on Discord:

1. macOS Homebrew Python + Nous Portal OAuth: on macOS, Homebrew's OpenSSL cannot locate the system trust store, causing CERTIFICATE_VERIFY_FAILED against valid public certs. Extends the weixin fix (3a0ec1d) pattern to the shared _resolve_verify() helper in hermes_cli/auth.py.

2. Custom providers with self-signed certs: agent/model_metadata.py's raw requests.get() calls for custom provider /v1/models endpoints accepted no explicit verify= argument, leaving SSL config to requests' implicit env var handling — which reads REQUESTS_CA_BUNDLE only. Users who set SSL_CERT_FILE or HERMES_CA_BUNDLE were silently ignored.

Details

hermes_cli/auth.py

• Added _default_verify() helper: on darwin, explicitly loads certifi.where() into an ssl.SSLContext; other platforms return True (httpx default, which uses certifi via its own dependency).
• _resolve_verify() default and missing-CA fallback paths now return _default_verify() instead of raw True.
• Added REQUESTS_CA_BUNDLE to env var fallback chain — same env var now works for both httpx (_resolve_verify) and requests callsites.
• effective_insecure short-circuit unchanged.

agent/model_metadata.py

• Added _resolve_requests_verify() reading HERMES_CA_BUNDLE → REQUESTS_CA_BUNDLE → SSL_CERT_FILE in priority order, falling through to True when none exist.
• Applied explicit verify=_resolve_requests_verify() to all 6 requests.get() callsites in the module (including the /v1/models fetch at L630 that surfaced the custom-provider report).

Empirical test (behind the change)

Verified against a self-signed HTTPS server that:

• requests honors REQUESTS_CA_BUNDLE only — ignores SSL_CERT_FILE
• httpx honors SSL_CERT_FILE only — ignores REQUESTS_CA_BUNDLE

Hermes now honors all three env vars consistently across both libs.

Behavior matrix

Scenario	Before	After
macOS + no env var	`True` (implicit certifi)	`SSLContext(cafile=certifi.where())` — explicit
Linux/Windows + no env var	`True`	`True` — unchanged
`insecure=True`	`False`	`False` — unchanged
`HERMES_CA_BUNDLE` + valid	`SSLContext`	`SSLContext` — unchanged
`REQUESTS_CA_BUNDLE` set (httpx paths)	ignored	`SSLContext`/path — new support
`SSL_CERT_FILE` set (requests paths)	ignored	path — new support

Never returns `False` from any default path. Only broadens what counts as a valid CA source.

Test plan

• 18 new unit tests (`tests/agent/test_model_metadata_ssl.py`, `tests/hermes_cli/test_auth_ssl_macos.py`) — env var precedence, platform gating, certifi ImportError fallback
• Existing `TestResolveVerifyFallback` tests pinned with autouse `sys.platform="linux"` fixture to keep their "returns True" assertions platform-independent
• Full regression: 4341/4346 tests pass; 5 pre-existing failures unrelated (verified against `main`)
• AST parse + import smoke check

Related

• Prior fix for the same family of problems: 3a0ec1d (weixin: macOS certifi fallback for aiohttp)
• Discord reports triggered this work — @ee.dd can confirm context