[amandhaw]

MARSOHS-2451

Problem

--harness hermes is refused:

$ doctl harness-runtime launch --harness hermes --prompt "..."
Error: Couldn't complete that request
unsupported --harness "hermes"; supported values: opencode, claude-code, codex, codex-agentapi, openhands

hermes is an accepted adapter on the --spec path, and AGENT_KIND_HERMES
is in isSupportedAgentKind's default allow-set. Only the --harness flag map
did not list it.

Change

Add hermes to the map, with the credential wiring that makes the session
usable. A bare map entry is not enough: the gateway's render-config.sh warns
that the first turn will fail when no key and no model are set, which is
exactly what --harness hermes with no other flags would produce.

• Resolve hermes to the new hermesAgentName, display it as "Hermes", and
  name it in the unsupported-value error.
• Write HARNESS_INFERENCE_MODEL from the new defaultHermesModel. Hermes has
  no fallback model of its own.
• Take the managed-key opt-in, as openhands does, so harness-api mints
  HARNESS_INFERENCE_API_KEY. Hermes reads that key when no native
  OPENAI_API_KEY is set. The decision is read off the manifest, so a --spec
  file that says harness: hermes gets the key too.

Hermes does not get the two fields openhands needs:

• No template pin. templateForAgentKind already resolves the kind to
  coding-hermes, and no flipper gates that template per team (only
  openHandsTemplateName is gated).
• No keep_warm: false. The server defaults hermes to warm on purpose: the
  gateway is driven over a port-forward tunnel that idle-pause's activity
  tracking cannot see, so pausing would break a live conversation.

One stale comment in knownAgentAdapters is corrected in passing.

Result

$ doctl harness-runtime create --harness hermes --name hm --prompt "test" --dry-run
env:
  HARNESS_INFERENCE_MODEL: openai-gpt-5.5
harness: hermes
name: hm
permissions:
  default: allow

That manifest passes harness-runtime validate with no warnings. --model
overrides the default.

Testing

go test ./commands/ passes. Three tests are added: harness resolution and
display name, the generated manifest shape (model present, no secrets, no
template, no keep_warm), and the managed-key create path.

Not covered: no live session was created, so the minted key and the first turn
are untested end to end.

🤖 Generated with Claude Code

[vneema-do]

What is none for?

[amandhaw]

used when the user is not setting any harness specifically, using a bare sandbox

found more info here

doctl/commands/agents.go

Line 945 in 9379c12

// `none` stays the manifest's word for a session with no agent — a --spec

[adilhafeez]

while you're at it can you remove "Bare sandbox" and rename it to "Sandbox"

[amandhaw]

done

[vneema-do]

should we remove "none": bareSandboxAgent,

[adilhafeez]

should we remove "none": bareSandboxAgent,

@vneema-do none is in use today - that is how we communicate that there is no coding harness and that developers are using just the compute sandbox.

[SSharma-10]

LGTM