'reqwest' client for inference/provider requests uses bundled webpki-roots, ignoring custom/private CAs

[DavidLeNsogroup]

Summary

The gateway's outbound HTTP client for provider/inference requests (reqwest, feature rustls-tls per Cargo.toml:70) resolves to rustls-tls-webpki-roots — a fixed, compiled-in copy of Mozilla's public root CA list. It never reads the host's system trust store, and there is no config surface (checked the full gateway.toml schema) to supply a custom CA bundle for this client.

This makes it impossible to configure an openai-type inference provider whose endpoint uses a certificate from a private/internal CA or a self-signed cert — which is a common setup for internal LiteLLM/vLLM/TGI deployments behind a corporate or air-gapped network.

Steps to reproduce

1. Stand up an OpenAI-compatible inference backend (e.g. LiteLLM) behind a certificate issued by an internal CA (not a public root).
2. openshell provider create --type openai --name my-provider --config OPENAI_BASE_URL=https://my-internal-endpoint --credential OPENAI_API_KEY=...
3. openshell inference set --provider my-provider --model <model>
4. Launch an agent in a sandbox and send a chat request through https://inference.local.

Actual behavior

Requests fail. Sandbox-side OCSF logs show a NET:FAIL on inference.local:443 with no policy [reason:...] suffix (i.e. not a policy denial — it's a downstream connection failure), because the gateway's reqwest client can't complete the TLS handshake against the internal CA.

Expected behavior

Some supported way to trust an internal/private CA for outbound provider connections — for example:

• Switch reqwest to the rustls-tls-native-roots feature (mirroring what tokio-tungstenite already does per Cargo.toml:73, via rustls-tls-native-roots) so the OS trust store is honored, and/or
• Add an explicit config surface (e.g. a ca_bundle_path provider config key, or a [openshell.gateway] extra_ca_certs gateway.toml key) to point at a custom CA/CA bundle without relying on OS-level trust.

Workaround currently in use

Terminating the internal endpoint with a cert chained to a publicly-trusted root (e.g. via a reverse proxy with a Let's Encrypt cert), which isn't viable for fully air-gapped deployments.

Environment

• OpenShell version: 0.0.97
• OS version: Ubuntu 22.04.5 LTS