Problem

Custom OpenAI-compatible providers behind Cloudflare WAF get 403 blocked because Hermes doesn't send a proper User-Agent header. There is no way to configure custom HTTP headers via config.yaml.

Root Cause

1. headers not in valid config fields — _VALID_CUSTOM_PROVIDER_FIELDS in config.py (line 1711) does not include headers, so it's silently ignored.

2. _apply_client_headers_for_base_url strips headers for unknown providers — run_agent.py line 4647: self._client_kwargs.pop("default_headers", None) removes ALL headers for any provider not in the hardcoded list (openrouter/copilot/kimi/qwen).

3. switch_model drops headers — run_agent.py line 4586: explicitly pops default_headers on model switch.

Expected

Add headers as a supported config field for custom_providers:

custom_providers:
  - name: MyProvider
    base_url: https://api.example.com/v1
    api_key: sk-xxxxx
    model: some-model
    headers:
      User-Agent: Mozilla/5.0 (compatible; OpenAI-Client/1.0)

Headers should be applied to the OpenAI client, survive switch_model, and work in session overrides.

Impact

Common for Chinese provider ecosystem where Cloudflare-protected proxy endpoints are widespread. Currently the only fix is patching source code, which breaks on hermes update.