fix(cli): verify TLS against the OS trust store

AGENTS.md

@@ -50,6 +50,10 @@ service is serving — confirm with `haystack-enterprise service-status SERVICE`
 
 Set `CI=true` to replace spinners and progress bars with plain line output.
 
+The CLI verifies TLS against the OS trust store (via `truststore`), so a corporate proxy's root CA
+installed in Windows or macOS is trusted. The SDK used as a library does not; call
+`truststore.inject_into_ssl()` yourself if you hit `CERTIFICATE_VERIFY_FAILED` behind such a proxy.
+
 `deploy --env KEY=VALUE`, `--env KEY` (value read from the environment) and `--env-file FILE` set
 service secrets on the target service. Existing names are updated and others left alone, and the
 values apply on the next request without a redeploy.

haystack_enterprise_sdk/cli.py

@@ -21,6 +21,7 @@
 import click
 import httpx
 import structlog
+import truststore
 import typer
 from dotenv import dotenv_values
 from tabulate import tabulate
@@ -2118,6 +2119,9 @@ def run_packaged() -> None:
     This is the console-script entrypoint (``haystack-enterprise``) declared in ``pyproject.toml``;
     it is not a subcommand. It runs the Typer app and turns API errors into a clean exit.
     """
+    # Verify TLS against the OS trust store instead of certifi, so CAs installed by corporate
+    # TLS-inspecting proxies (common on Windows) are trusted. CLI only: the library leaves `ssl` alone.
+    truststore.inject_into_ssl()
     try:
         cli_app()
     except HaystackEnterpriseAPIError as err:

pyproject.toml

@@ -51,6 +51,7 @@ dependencies = [
   "pydantic>=2.11.4",
   "ruamel.yaml>=0.18.10",
   "sniffio>=1.3.1",
+  "truststore>=0.10.0",    # CLI verifies TLS against the OS trust store (corporate proxy CAs on Windows)
 ]
 
 [project.optional-dependencies]

tests/unit/test_cli.py

@@ -26,7 +26,7 @@
     UploadSessionWriteModeEnum,
     WriteMode,
 )
-from haystack_enterprise_sdk.cli import _browser_login, _configure_cli_logging, _ui_url_for, cli_app
+from haystack_enterprise_sdk.cli import _browser_login, _configure_cli_logging, _ui_url_for, cli_app, run_packaged
 from haystack_enterprise_sdk.models import UserInfo
 from haystack_enterprise_sdk.workflows.sync_client.files import download as sync_download
 
@@ -720,3 +720,12 @@ def test_verbose_shows_info_and_debug(self, capsys: pytest.CaptureFixture) -> No
         combined = captured.out + captured.err
         assert "info-line" in combined
         assert "debug-line" in combined
+
+
+def test_run_packaged_uses_os_trust_store() -> None:
+    with (
+        patch("haystack_enterprise_sdk.cli.truststore.inject_into_ssl") as inject,
+        patch("haystack_enterprise_sdk.cli.cli_app"),
+    ):
+        run_packaged()
+    inject.assert_called_once_with()