This report is sanitized. No tokens, auth headers, API keys, private keys, or account secrets are included.

Bug Report: Codex OpenAI SDK TypeError on Malformed Backend Response

Component: Hermes auxiliary_client (OpenAI Codex provider)
Severity: High (breaks Slack gateway + cron jobs)
Status: Reproducible

Summary

When using the ChatGPT Pro Codex OAuth subscription path, the OpenAI SDK throws TypeError: 'NoneType' object is not iterable when the Codex backend returns HTTP 200 with a malformed response payload (output=None). The error occurs before Hermes's adapter normalization guard can intervene.

Technical Details

Failure Location

File:

/opt/hermes/.venv/lib/python3.13/site-packages/openai/lib/_parsing/_responses.py:61

Code:

for output in response.output:

Call stack:

CodexAuxiliaryClient.create()
  -> OpenAI SDK streaming handler
    -> parse_response()
      -> for output in response.output:
        -> TypeError: 'NoneType' object is not iterable

Impact

• Slack Gateway fails on any request using the Codex provider.
• Cron jobs using Codex fail with cascading TypeError messages.
• End users see raw provider failure messages instead of a classified provider error.
• Workflows recover only after switching Hermes to a non-Codex provider.

Workaround

Configure Hermes to use a non-Codex provider, for example OpenRouter Claude Haiku 4.5:

model:
  provider: openrouter
  base_url: https://openrouter.ai/api/v1
  default: anthropic/claude-haiku-4.5
  api_mode: chat_completions
  max_tokens: 8000

Root Cause

The Codex backend appears to return HTTP 200 with output=None instead of the expected list of response objects. The OpenAI SDK parsing layer tries to iterate directly over response.output before Hermes's adapter can catch and normalize the malformed shape.

Observed sequence:

Auth succeeds
HTTP status is 200 OK
Response payload has output=None
SDK iteration fails
Hermes adapter guard is not reached
Raw TypeError propagates

Requested Fix

Please handle malformed Codex responses before raw TypeError reaches users.

Suggested behavior:

• Validate that response.output is a list before SDK iteration, if Hermes can intercept at that layer.
• If the SDK raises TypeError from malformed output, catch it near the Codex provider boundary.
• Surface a clear provider error such as: Codex backend returned 200 OK with invalid output=None.
• Allow configured fallback providers to take over cleanly.
• Add diagnostic logging for HTTP status and response shape without logging tokens or auth headers.

Reproduction

This was reproduced with Hermes's Codex subscription route, using a valid ChatGPT OAuth token and the endpoint:

https://chatgpt.com/backend-api/codex/responses

Minimal test shape:

from agent.auxiliary_client import _build_codex_client

client, model = _build_codex_client("gpt-5.5")
response = client.chat.completions.create(
    model="gpt-5.5",
    messages=[{"role": "user", "content": "Reply with OK only."}],
    max_tokens=10,
)

Observed result:

TypeError: 'NoneType' object is not iterable

Environment

• Hermes running in Docker
• Python 3.13
• OpenAI SDK installed in Hermes virtualenv
• Auth route: ChatGPT Pro OAuth subscription path
• Endpoint: https://chatgpt.com/backend-api/codex/responses
• Model: gpt-5.5

Additional Notes

• Subscription path routing was verified as correct.
• Authentication appears to work, because the request reaches the Codex backend and returns HTTP 200.
• This is separate from the paid OpenAI API endpoint at https://api.openai.com/v1/responses.
• Production workaround is stable on OpenRouter Claude Haiku 4.5.
• No tokens, auth headers, API keys, private keys, or account secrets are included in this report.