fix(agent): honor custom CA certs for custom_providers HTTPS endpoints

[HexLab98]

Summary

• Add resolve_httpx_verify() so the primary OpenAI/httpx client honors HERMES_CA_BUNDLE, SSL_CERT_FILE, and per-provider ssl_ca_cert settings.
• Add ssl_ca_cert / ssl_verify fields to custom_providers / providers config and wire them into agent client creation.

Fixes the APIConnectionError: Connection error reported when pointing Hermes at HTTPS Ollama/LiteLLM endpoints signed by a private CA (mkcert, corporate proxy, etc.).

Test plan

• scripts/run_tests.sh tests/agent/test_ssl_verify.py tests/hermes_cli/test_custom_provider_tls.py tests/run_agent/test_create_openai_client_ssl_verify.py
• Manual: Ollama behind Caddy + mkcert with ssl_ca_cert: /path/to/rootCA.pem in custom_providers

[tonydwb]

LGTM — clean implementation of per-provider TLS settings for custom providers. The ssl_verify.py module is well-structured with clear priority ordering, and the test coverage (ssl_verify, custom_provider_tls, keepalive_client) is thorough. Minor note: the bare except: pass in agent_init.py and switch_model catches all exceptions including potential import errors, but this is acceptable for a non-critical init path.

[alt-glitch]

This was generated by AI during triage.

Related: this is part of the SSL/custom-CA cluster — it implements feature issue #48440 (per-provider ssl_ca_cert) and overlaps OPEN PRs #48891 (broader stacked-branch version that bundles extra features) and #28271 (ssl_verify-only), plus issue #28260 and merged #14533 (env-var CA across requests callsites). This PR is the cleanest focused implementation of the per-provider CA path with verification kept on by default; flagging the cluster so a maintainer can pick one canonical approach. Not a duplicate — no earlier same-scope open PR it copies.

[tonydwb]

Code Review Summary

Verdict: LGTM

Adds custom CA certificate support for custom_providers HTTPS endpoints. New agent/ssl_verify.py module resolves httpx verify from config, env vars, and per-provider settings.

Looks Good

• Clean priority chain: ssl_verify:false > ca_bundle > env vars > True
• Per-provider ssl_ca_cert and ssl_verify config fields properly normalized
• Keepalive httpx client correctly receives verify parameter
• Comprehensive tests: 3 test files covering verify resolution, custom provider TLS, and client creation
• Exception handling in agent_init is appropriate (best-effort TLS)

---

Reviewed by Hermes Agent

[kshitijk4poor]

Merged via #56681 — #56681

Your two commits were cherry-picked with authorship preserved (rebase-merge), so they land on main as yours (7e957cbd0, 3a2ba959c). Thanks for the fix!

We extended it on top in a follow-up:

• Auxiliary-client parity — the salvaged change fixed the main OpenAI client, but auxiliary tasks (compression, vision, web_extract, title generation, session_search) build a separate keepalive client via agent/process_bootstrap.build_keepalive_http_client, which had the identical no-verify pattern. So chat worked against a private-CA endpoint but every auxiliary call still threw APIConnectionError. Now both paths share the same resolve_httpx_verify resolution.
• switch_model reads custom_providers from live config (not the init-time snapshot) so ssl_ca_cert/ssl_verify edits apply on a mid-session model switch.
• Dropped the dead client-level verify= where a custom httpx transport owns the SSL context; added CURL_CA_BUNDLE to the env chain and a loud warning when ssl_verify: false disables verification; case-insensitive base_url match.

This closes the SSL/custom-CA cluster (implements #48440 and #28260).