fix(responses): HERMES_DISABLE_REASONING_INCLUDE env-var escape hatch

[nnnet]

Summary

agent/transports/codex.py and agent/auxiliary_client.py unconditionally set

kwargs["include"] = ["reasoning.encrypted_content"]

on every Responses-API call whenever reasoning_enabled is true (the default). The parameter is only valid for reasoning-capable models (o1 / o3 / o4-mini / gpt-5*). For every other OpenAI model the API returns:

HTTP 400: Encrypted content is not supported with this model.
param='include', code='model_not_found'

Users running Hermes against api.openai.com with a non-reasoning model (e.g. gpt-4o-mini for cost reasons) currently have no way to opt out — every request fails.

Add an env-var escape hatch: HERMES_DISABLE_REASONING_INCLUDE=true suppresses both include and reasoning in the outgoing Responses-API kwargs. Default behaviour is preserved when the env var is unset / falsy.

Repro (end-to-end on the fork's Docker setup)

1. ~/.hermes/.env: OPENAI_API_KEY=sk-...
2. ~/.hermes/config.yaml:

   model:
     default: gpt-4o-mini
     provider: auto
     base_url: https://api.openai.com/v1

3. docker compose restart gateway
4. curl -s -X POST http://127.0.0.1:8642/v1/responses -H "Authorization: Bearer $API_SERVER_KEY" -H "Content-Type: application/json" -d '{"model":"hermes-agent","input":"Say OK","conversation":"repro","stream":false}'

Observed:

HTTP 400: Encrypted content is not supported with this model.
provider=openrouter base_url=https://api.openai.com/v1 model=gpt-4o-mini

Expected: 200 OK with a normal reply.

Root cause

agent/transports/codex.py:109,124 and agent/auxiliary_client.py:690 set include=["reasoning.encrypted_content"] whenever reasoning_enabled is True (the default). There is no model-family check before the include is added, so non-reasoning models hit the OpenAI 400.

Fix

Add _reasoning_include_disabled() in agent/transports/codex.py:

def _reasoning_include_disabled() -> bool:
    return (os.getenv("HERMES_DISABLE_REASONING_INCLUDE", "") or "").strip().lower() in {
        "1", "true", "yes", "on",
    }

Gate both call sites (codex transport build_kwargs, auxiliary client codex-responses path) on not _reasoning_include_disabled(). When the flag is on, both kwargs["include"] and kwargs["reasoning"] are skipped — equivalent to running without the reasoning add-ons.

Why an env var, not auto-detection of the reasoning family?

Roughly 30 tests across tests/agent/test_auxiliary_client.py, tests/agent/transports/test_codex_transport.py, tests/run_agent/test_provider_parity.py, and friends prescriptively assert include == ["reasoning.encrypted_content"] whenever a reasoning code path runs. Adding agent.model_metadata.is_reasoning_model() and switching the transports to consult it would require updating every one of those expectations — a much larger refactor and a riskier PR.

The env var is opt-in and 100% backward-compatible, which lets users unblock themselves today without us having to coordinate a test-rewrite. A follow-up PR can introduce automatic detection in agent/model_metadata.py and deprecate the env var once the rewrite lands.

Testing

End-to-end verified on the fork's Docker setup:

Test 1 — sanity (default reasoning model, env unset)

• Config: model.default: gpt-5-nano (reasoning-capable), HERMES_DISABLE_REASONING_INCLUDE unset.
• POST /v1/responses → 200, "OK" returned, no regression. include=["reasoning.encrypted_content"] is still sent.

Test 2.1 — repro of the bug (non-reasoning model, env unset)

• Config: model.default: gpt-4o-mini (non-reasoning), HERMES_DISABLE_REASONING_INCLUDE unset.
• POST /v1/responses →

  HTTP 400: Encrypted content is not supported with this model.
  provider=openrouter base_url=https://api.openai.com/v1 model=gpt-4o-mini
  

• Confirms the bug is present with the unmodified code path.

Test 2.2 — fix verified (non-reasoning model, env set)

• Same config as 2.1, but HERMES_DISABLE_REASONING_INCLUDE=true exported into the gateway container.
• Verified the env reached the container: docker exec hermes printenv HERMES_DISABLE_REASONING_INCLUDE → true.
• POST /v1/responses →

  {"status": "completed", "output": [{"role": "assistant", "content": [{"text": "PASS"}]}]}
  

• Container logs contain zero HTTP 400 / Encrypted content entries during the test.
• Fix verified.

Plus the in-process unit-style check from the original branch: _reasoning_include_disabled() returns False by default and True for any of {"1", "true", "yes", "on"}. With the env set, ResponsesApiTransport.build_kwargs("gpt-4o-mini", ...) returns kwargs that contain no include and no reasoning block.

Breaking changes

None. Default behaviour is unchanged. The env var is opt-in.

Follow-up

A separate PR can introduce agent.model_metadata.is_reasoning_model(model_id) -> bool and switch the transports to consult it automatically, at which point the env var becomes a forced override (e.g. for users behind proxies that munge requests). I'd like to land this escape hatch first because it unblocks anyone hitting the bug today without touching the prescriptive tests.

---

PR by Claude Code on behalf of @nnnet. Tracks internal bug tracker entry BUG-2.

[alt-glitch]

Resubmission of #25102 (closed without merge).

Competing PRs for the same root cause (#23450):

• fix(transports/codex): remove unsupported include parameter for standard OpenAI Chat Completions API #23460 — removes include parameter entirely for Chat Completions API
• fix: only send reasoning.encrypted_content include for supported models #24234 — allowlist-based fix, only sends include for known reasoning models

This PR adds an env-var escape hatch (HERMES_DISABLE_REASONING_INCLUDE) instead of auto-detecting model capability.

[teknium1]

Thanks for documenting a concrete Responses-API failure and identifying both main and auxiliary construction paths.

Problems

• The proposed HERMES_DISABLE_REASONING_INCLUDE is a new user-facing behavioral environment variable, but repository policy requires non-secret behavior to live in config.yaml (AGENTS.md:102-105).
• The transport-level gate would also suppress xAI's encrypted-reasoning include. Current main deliberately requires that include for xAI cross-turn replay (agent/transports/codex.py:265-281; tests/agent/transports/test_codex_transport.py:275-290; b4afc6546).
• No tests accompany the request-construction changes, and the PR bundles unrelated CI, gateway, TTS, STT, and model-routing work.

Suggested changes

• Split unrelated commits, re-scope the control through config.yaml, preserve xAI replay, and add direct-OpenAI, auxiliary, and xAI regression tests.

Automated hermes-sweeper review.