fix(agent): honor custom CA certs for custom_providers HTTPS endpoints (main + aux)

[hashbender]

Summary

Pointing Hermes at an HTTPS custom_providers endpoint signed by a private CA (mkcert, corporate proxy, self-signed LiteLLM/Ollama) now works instead of failing with APIConnectionError: Connection error.

Root cause: the agent's httpx client uses a custom HTTPTransport, which disables httpx's trust_env SSL auto-read — so neither per-provider config nor SSL_CERT_FILE/HERMES_CA_BUNDLE reached the client verifying against certifi only.

Salvage of NousResearch#56393 by @HexLab98, plus a follow-up extending the fix to the auxiliary-client path and hardening TLS resolution.

Changes

• agent/ssl_verify.py (new): resolve_httpx_verify() — priority ssl_verify:false > explicit ca_bundle > HERMES_CA_BUNDLE/SSL_CERT_FILE/REQUESTS_CA_BUNDLE/CURL_CA_BUNDLE env > True. Emits a loud logger.warning (naming the endpoint) whenever ssl_verify:false disables verification.
• hermes_cli/config.py: ssl_ca_cert / ssl_verify fields on custom_providers (normalized, validated, mapped to provider config); get_custom_provider_tls_settings() (case-insensitive exact base_url match — no prefix bypass) + apply_custom_provider_tls_to_client_kwargs().
• Main client: AIAgent._build_keepalive_http_client + create_openai_client + switch_model forward the resolved verify. switch_model reads custom_providers from live config (not the init-time snapshot) so TLS edits apply on mid-session switch, matching the Bug: /model switch to named custom provider ignores custom_providers model context_length NousResearch/hermes-agent#15779 context-length reload.
• Auxiliary client: agent/process_bootstrap.build_keepalive_http_client accepts/forwards verify; agent/auxiliary_client._resolve_aux_verify() mirrors the main-client resolution (read-only config fast path) so compression/vision/web_extract/title-gen/session_search honor the same CA. Without this, chat worked but every auxiliary call to the same endpoint still threw APIConnectionError.
• Dropped the dead client-level verify= where a custom transport is used (httpx ignores it there); demoted best-effort except: pass to logger.debug.

New config lives in config.yaml under custom_providers (not .env); HERMES_CA_BUNDLE is a pre-existing convention.

Validation

	Before	After
HTTPS custom_provider + private CA (ssl_ca_cert) — main chat	APIConnectionError	works
Same endpoint — auxiliary tasks (compression/vision/web_extract)	APIConnectionError	works
ssl_verify: false (local dev)	n/a	disables verification + warns
Mid-session /model switch after editing ssl_ca_cert	stale	picks up new CA
Non-matching / prefix endpoint	default	verify=True (unchanged, no bypass)

• 21 targeted tests pass (verify resolution, custom_provider_tls matching incl. case-insensitive + prefix-bypass, main + aux keepalive client SSL context, keepalive reuse invariant).
• E2E verified with a temp HERMES_HOME + real config.yaml: config → _resolve_aux_verify → aux http_client carries the custom SSLContext; ssl_verify:false returns False and warns; non-matching endpoints stay on True.

Credit

Salvaged from NousResearch#56393 by @HexLab98 (authorship preserved via rebase). Closes the SSL/custom-CA cluster: implements NousResearch#48440 and NousResearch#28260.

---

Mirror-of: NousResearch#56681
NousResearch#56681