fix(dcode): apply the compatible-endpoint reasoning effort at runtime (#7971)

<!-- markdownlint-disable MD041 -->
## Summary

A NemoClaw-managed Deep Agents Code sandbox recorded a
compatible-endpoint reasoning effort in registry state but sent every
model request without it, so the endpoint default applied instead. The
managed image now bakes the recorded effort into a root-owned file, and
the managed provider resolver supplies it as an
`extra_body.reasoning_effort` request parameter.

## Related Issue

Fixes #7938

## Changes

- `agents/langchain-deepagents-code/Dockerfile` declares `ARG
NEMOCLAW_REASONING_EFFORT`, validates it as empty, `low`, `medium`, or
`high` at build time, and writes it to root-owned `0444`
`/usr/local/share/nemoclaw/dcode-reasoning-effort`. The
staged-Dockerfile patcher already rewrote this ARG name for OpenClaw;
with no matching declaration here the rewrite was a silent no-op.
- `agents/langchain-deepagents-code/managed-dcode-runtime.py` adds
`managed_reasoning_effort()`. It repeats the fail-closed shape of
`managed_auto_approval_mode()` because both read image state that
runtime must not trust: ownership, mode, exact size, `O_NOFOLLOW`, and a
read-race check. An unsafe or unrecognized file returns `None`, which
keeps the endpoint default. Direct-module cases in
`test/langchain-deepagents-code-reasoning-effort.test.ts` pin the
rejected shapes.
- `agents/langchain-deepagents-code/patch-managed-deepagents-code.py`
sets `extra_body.reasoning_effort` on the managed OpenAI adapter. The
hardened resolver never consumes the mutable `config.toml` params table,
so a generator-only change cannot reach the request. The same file adds
the new function to the stale-helper guard, which now covers every
managed capability rather than auto-approval alone.
- `agents/langchain-deepagents-code/generate-config.ts` records the
effort in the generated per-model params table. `extra_body` now merges
the Ultra template argument and the reasoning effort into one table; an
unset effort produces byte-identical output to before.
- `scripts/check-dcode-profile-import-gate.sh` allows the new ARG name.
The gate refuses any unlisted ARG, so the build fails without this
entry.
- Docs record the build-time behavior for Deep Agents Code and correct
the model-capabilities page, which previously implied `inference set`
could change the effort on a Deep Agents Code sandbox.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [x] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates
<!-- Check one tests line and one docs line. Check other lines when
applicable. Add every requested justification or approval reference. -->
- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [x] Docs updated for user-facing behavior changes
- [ ] Docs not applicable — justification:
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification:
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Documentation Writer Review
<!-- Required for code and documentation changes after the changes and
applicable validation are complete. Keep one review checkbox and one
instance of each visible or hidden field. For Evidence, list changed
documentation paths. For documentation-only changes, also state that the
writing rules and documentation style were reviewed. For other results,
explain why no documentation change is needed or why the review is
blocked. For Agent, use a consistent product and surface name, such as
Codex Desktop, Codex CLI, Claude Code, or Cursor. After committing all
review changes, put `git rev-parse --short HEAD` and `git rev-parse
--short HEAD:AGENTS.md` in the hidden metadata below. Rerun the review
and refresh that metadata after any new commit. This receipt is advisory
during the data-collection pilot. -->
- [ ] Documentation writer subagent reviewed the completed changes
- Result: `blocked`
- Evidence: `docs/get-started/quickstart-langchain-deepagents-code.mdx`,
`docs/inference/configure-model-capabilities.mdx`. The authoring host
ran with subagents disabled, so no documentation writer subagent
reviewed the change. `npm run docs` reports 0 errors, including the
route check that rejected an earlier cross-variant link.
- Agent: Claude Code
<!-- docs-review-head-sha: 2a09f90 -->
<!-- docs-review-agents-blob-sha: c052d60 -->

## DGX Station Hardware Evidence
<!-- Required only when scripts/prepare-dgx-station-host.sh changes.
Maintainers must review the linked evidence before approving or merging.
This is human-reviewed evidence, not authenticated hardware provenance.
Exceptional bypasses use existing repository governance and must be
documented on the PR. -->
- [ ] Tested on DGX Station
- Tested commit:
- Station profile/scenario:
- Result:
- Supporting evidence:

## Verification
<!-- Check each applicable item only when supported by the requested
evidence. Run targeted tests once per relevant change set and rerun
after later edits or hook autofixes that can affect the tested behavior.
Do not rerun hook-covered checks. -->
- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run validate:pr` passed after refreshing `origin/main` when hooks
were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — command/result or justification: `npx
vitest run --project integration
test/langchain-deepagents-code-config.test.ts
test/langchain-deepagents-code-reasoning-effort.test.ts
test/langchain-deepagents-code-direct-module-patch.test.ts
test/langchain-deepagents-code-nemotron-profile-plugin.test.ts
test/langchain-deepagents-code-image.test.ts
test/langchain-deepagents-code-auto-approval-image.test.ts
test/langchain-deepagents-code-profile-build-gate.test.ts` — 7 files,
150 tests passed. `npm run typecheck:cli` reports 0 errors.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result:
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
<!-- DCO sign-off is required in this PR description, and every commit
must appear as Verified in GitHub. Run: git config user.name && git
config user.email -->
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added configurable reasoning-effort levels—low, medium, or high—for
supported Deep Agents Code inference endpoints.
* Leaving the setting unset preserves the endpoint default; invalid or
unsafe values are safely ignored.
  * Changes require fresh onboarding with sandbox recreation.

* **Documentation**
  * Clarified supported workflows and configuration behavior.

* **Tests**
* Added coverage for valid, unset, invalid, unsafe, and
provider-specific settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Co-authored-by: J. Yaunches <jyaunches@nvidia.com>

Author: laitingsheng

agents/langchain-deepagents-code/Dockerfile

@@ -117,6 +117,7 @@ ARG NEMOCLAW_UPSTREAM_PROVIDER=nvidia
 ARG NEMOCLAW_UPSTREAM_ENDPOINT_URL=
 ARG NEMOCLAW_INFERENCE_BASE_URL=https://inference.local/v1
 ARG NEMOCLAW_INFERENCE_API=openai-completions
+ARG NEMOCLAW_REASONING_EFFORT=
 ARG NEMOCLAW_TOOL_DISCLOSURE=progressive
 ARG NEMOCLAW_DCODE_AUTO_APPROVAL=disabled
 ARG NEMOCLAW_BUILD_ID=default
@@ -131,6 +132,10 @@ RUN case "$NEMOCLAW_TOOL_DISCLOSURE" in \
     && case "$NEMOCLAW_DCODE_AUTO_APPROVAL" in \
         disabled|thread-opt-in) ;; \
         *) echo "ERROR: NEMOCLAW_DCODE_AUTO_APPROVAL must be disabled or thread-opt-in" >&2; exit 1 ;; \
+    esac \
+    && case "$NEMOCLAW_REASONING_EFFORT" in \
+        ""|low|medium|high) ;; \
+        *) echo "ERROR: NEMOCLAW_REASONING_EFFORT must be empty, low, medium, or high" >&2; exit 1 ;; \
     esac
 
 # The launcher and startup script read these root-owned files instead of
@@ -143,8 +148,9 @@ RUN install -d -m 0755 /usr/local/share/nemoclaw \
     && printf '%s\n' "$NEMOCLAW_PROXY_PORT" > /usr/local/share/nemoclaw/dcode-proxy-port \
     && printf '%s\n' "$NEMOCLAW_INFERENCE_BASE_URL" > /usr/local/share/nemoclaw/dcode-inference-base-url \
     && printf '%s\n' "$NEMOCLAW_DCODE_AUTO_APPROVAL" > /usr/local/share/nemoclaw/dcode-auto-approval \
-    && chown root:root /usr/local/share/nemoclaw/dcode-proxy-host /usr/local/share/nemoclaw/dcode-proxy-port /usr/local/share/nemoclaw/dcode-inference-base-url /usr/local/share/nemoclaw/dcode-auto-approval \
-    && chmod 0444 /usr/local/share/nemoclaw/dcode-proxy-host /usr/local/share/nemoclaw/dcode-proxy-port /usr/local/share/nemoclaw/dcode-inference-base-url /usr/local/share/nemoclaw/dcode-auto-approval \
+    && printf '%s\n' "$NEMOCLAW_REASONING_EFFORT" > /usr/local/share/nemoclaw/dcode-reasoning-effort \
+    && chown root:root /usr/local/share/nemoclaw/dcode-proxy-host /usr/local/share/nemoclaw/dcode-proxy-port /usr/local/share/nemoclaw/dcode-inference-base-url /usr/local/share/nemoclaw/dcode-auto-approval /usr/local/share/nemoclaw/dcode-reasoning-effort \
+    && chmod 0444 /usr/local/share/nemoclaw/dcode-proxy-host /usr/local/share/nemoclaw/dcode-proxy-port /usr/local/share/nemoclaw/dcode-inference-base-url /usr/local/share/nemoclaw/dcode-auto-approval /usr/local/share/nemoclaw/dcode-reasoning-effort \
     && unset OTEL_EXPORTER_OTLP_TRACES_ENDPOINT \
     && empty_prompt_log="$(mktemp)" \
     && if timeout 10 /usr/local/bin/dcode -n "" >"$empty_prompt_log" 2>&1; then empty_prompt_status=0; else empty_prompt_status=$?; fi \
@@ -165,6 +171,7 @@ ENV HOME=/sandbox \
     NEMOCLAW_UPSTREAM_ENDPOINT_URL=${NEMOCLAW_UPSTREAM_ENDPOINT_URL} \
     NEMOCLAW_INFERENCE_BASE_URL=${NEMOCLAW_INFERENCE_BASE_URL} \
     NEMOCLAW_INFERENCE_API=${NEMOCLAW_INFERENCE_API} \
+    NEMOCLAW_REASONING_EFFORT=${NEMOCLAW_REASONING_EFFORT} \
     NEMOCLAW_TOOL_DISCLOSURE=${NEMOCLAW_TOOL_DISCLOSURE} \
     NEMOCLAW_BUILD_ID=${NEMOCLAW_BUILD_ID} \
     DEEPAGENTS_CODE_NO_UPDATE_CHECK=1 \

agents/langchain-deepagents-code/generate-config.ts

@@ -10,13 +10,16 @@ import { chmodSync, mkdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
+type ReasoningEffort = "low" | "medium" | "high";
+
 type Settings = {
   model: string;
   baseUrl: string;
   providerKey: string;
   upstreamProvider: string;
   upstreamEndpointUrl: string | null;
   inferenceApi: string;
+  reasoningEffort: ReasoningEffort | null;
 };
 
 type ManagedDeepAgentsProvider = "openai" | "openrouter";
@@ -63,9 +66,19 @@ function readSettings(env: NodeJS.ProcessEnv): Settings {
       env.NEMOCLAW_INFERENCE_API || "openai-completions",
       "NEMOCLAW_INFERENCE_API",
     ),
+    reasoningEffort: normalizeReasoningEffort(env.NEMOCLAW_REASONING_EFFORT),
   };
 }
 
+function normalizeReasoningEffort(value: string | undefined): ReasoningEffort | null {
+  if (value === undefined || value.trim() === "") return null;
+  const text = value.trim();
+  if (text !== "low" && text !== "medium" && text !== "high") {
+    throw new Error("NEMOCLAW_REASONING_EFFORT must be low, medium, or high.");
+  }
+  return text;
+}
+
 function readRequiredEnv(env: NodeJS.ProcessEnv, name: string): string {
   const value = env[name];
   if (!value) throw new Error(`${name} is required`);
@@ -165,26 +178,38 @@ function modelNameForManagedProvider(model: string): string {
   return trimmed;
 }
 
-function openAiModelRequestParamLines(model: string): string[] {
+function openAiModelRequestParamLines(
+  model: string,
+  reasoningEffort: ReasoningEffort | null,
+): string[] {
   // Source boundary: NVIDIA's Ultra serving template owns the empty assistant
   // content behavior; this generator owns only the managed per-model request
   // parameters. Keep the exact invalid state, regression proof, and separate
   // removal conditions for this option and the dispatch guard in
   // dependency-review.md under "Managed Ultra compatibility workarounds."
-  return NEMOTRON_ULTRA_MODEL_IDS.has(model)
-    ? [
-        "",
-        `[models.providers.openai.params.${tomlString(model)}]`,
-        "# Nemotron Ultra coding-agent requests need nonempty content when tool calls and reasoning are combined.",
-        "extra_body = { chat_template_kwargs = { force_nonempty_content = true } }",
-      ]
-    : [];
+  const isUltra = NEMOTRON_ULTRA_MODEL_IDS.has(model);
+  const extraBodyEntries = [
+    ...(isUltra ? ["chat_template_kwargs = { force_nonempty_content = true }"] : []),
+    ...(reasoningEffort ? [`reasoning_effort = ${tomlString(reasoningEffort)}`] : []),
+  ];
+  if (extraBodyEntries.length === 0) return [];
+  return [
+    "",
+    `[models.providers.openai.params.${tomlString(model)}]`,
+    ...(isUltra
+      ? [
+          "# Nemotron Ultra coding-agent requests need nonempty content when tool calls and reasoning are combined.",
+        ]
+      : []),
+    `extra_body = { ${extraBodyEntries.join(", ")} }`,
+  ];
 }
 
 function providerConfigLines(
   provider: ManagedDeepAgentsProvider,
   model: string,
   baseUrl: string,
+  reasoningEffort: ReasoningEffort | null,
 ): string[] {
   return [
     `[models.providers.${provider}]`,
@@ -199,7 +224,7 @@ function providerConfigLines(
           "# NemoClaw-managed inference.local currently exposes Chat Completions.",
           "# Remove this override when that route supports OpenAI Responses API.",
           "use_responses_api = false",
-          ...openAiModelRequestParamLines(model),
+          ...openAiModelRequestParamLines(model, reasoningEffort),
         ]
       : []),
   ];
@@ -216,7 +241,7 @@ function buildConfig(settings: Settings): ManagedDeepAgentsConfig {
     "[models]",
     `default = ${tomlString(defaultModel)}`,
     "",
-    ...providerConfigLines(provider, model, settings.baseUrl),
+    ...providerConfigLines(provider, model, settings.baseUrl, settings.reasoningEffort),
     "",
     "[update]",
     "check = false",

agents/langchain-deepagents-code/managed-dcode-runtime.py

@@ -41,6 +41,15 @@
     b"disabled\n": _AUTO_APPROVAL_DISABLED,
     b"thread-opt-in\n": _AUTO_APPROVAL_THREAD_OPT_IN,
 }
+_REASONING_EFFORT_FILE = Path(
+    "/usr/local/share/nemoclaw/dcode-reasoning-effort"
+)
+_REASONING_EFFORT_CONTENTS: dict[bytes, str | None] = {
+    b"\n": None,
+    b"low\n": "low",
+    b"medium\n": "medium",
+    b"high\n": "high",
+}
 _MANAGED_FILE_OWNER_UID = 0
 _CREDENTIAL_NAME = re.compile(
     r"(?:^|[_-])(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|CREDENTIAL)$",
@@ -1309,6 +1318,64 @@ def managed_auto_approval_enabled() -> bool:
     return managed_auto_approval_mode() == _AUTO_APPROVAL_THREAD_OPT_IN
 
 
+def _unset_reasoning_effort(reason: str) -> None:
+    if os.environ.get("NEMOCLAW_DEBUG") == "1":
+        print(
+            f"NemoClaw managed reasoning effort unset: {reason}",
+            file=sys.stderr,
+        )
+    return None
+
+
+def managed_reasoning_effort() -> str | None:
+    """Return the reasoning effort baked into the image, or None for the endpoint default."""
+    path = _REASONING_EFFORT_FILE
+    try:
+        if path.is_symlink():
+            return _unset_reasoning_effort("capability path is a symlink")
+        flags = os.O_RDONLY | getattr(os, "O_CLOEXEC", 0)
+        flags |= getattr(os, "O_NOFOLLOW", 0)
+        descriptor = os.open(path, flags)
+    except OSError:
+        return _unset_reasoning_effort("capability file is missing or unreadable")
+
+    try:
+        metadata = os.fstat(descriptor)
+        if (
+            not stat.S_ISREG(metadata.st_mode)
+            or metadata.st_uid != _MANAGED_FILE_OWNER_UID
+            or stat.S_IMODE(metadata.st_mode) != 0o444
+            or metadata.st_size not in {
+                len(content) for content in _REASONING_EFFORT_CONTENTS
+            }
+        ):
+            return _unset_reasoning_effort("capability metadata is unsafe")
+
+        chunks: list[bytes] = []
+        remaining = metadata.st_size
+        while remaining:
+            chunk = os.read(descriptor, remaining)
+            if not chunk:
+                return _unset_reasoning_effort("capability file was truncated")
+            chunks.append(chunk)
+            remaining -= len(chunk)
+        if os.read(descriptor, 1):
+            return _unset_reasoning_effort("capability file changed while reading")
+    except OSError:
+        return _unset_reasoning_effort("capability file read failed")
+    finally:
+        try:
+            os.close(descriptor)
+        except OSError:
+            # Cleanup cannot weaken the endpoint-default capability result.
+            pass
+
+    raw = b"".join(chunks)
+    if raw not in _REASONING_EFFORT_CONTENTS:
+        return _unset_reasoning_effort("capability contents are invalid")
+    return _REASONING_EFFORT_CONTENTS[raw]
+
+
 def managed_display_provider(adapter_provider: object) -> str:
     """Return the provider label to show for the managed inference adapter.
 

agents/langchain-deepagents-code/patch-managed-deepagents-code.py

@@ -511,7 +511,10 @@ def _get_provider_kwargs(provider: str, *, model_name: str | None = None) -> dic
     """Return only the NemoClaw-managed inference constructor contract."""
     del model_name
     from deepagents_code.model_config import ModelConfig, ModelConfigError
-    from deepagents_code._nemoclaw_managed import managed_inference_base_url
+    from deepagents_code._nemoclaw_managed import (
+        managed_inference_base_url,
+        managed_reasoning_effort,
+    )
 
     if provider not in {"openai", "openrouter"}:
         raise ModelConfigError(
@@ -527,6 +530,9 @@ def _get_provider_kwargs(provider: str, *, model_name: str | None = None) -> dic
     }
     if provider == "openai":
         kwargs["use_responses_api"] = False
+        reasoning_effort = managed_reasoning_effort()
+        if reasoning_effort is not None:
+            kwargs["extra_body"] = {"reasoning_effort": reasoning_effort}
     return kwargs
 '''
 
@@ -1735,9 +1741,10 @@ def main() -> None:
             else ""
         )
         analytics_guard = 'os.environ["LANGGRAPH_CLI_NO_ANALYTICS"] = "1"'
-        auto_approval_guards = (
+        capability_guards = (
             "def managed_auto_approval_mode() -> str:",
             "def managed_auto_approval_enabled() -> bool:",
+            "def managed_reasoning_effort() -> str | None:",
         )
         if (
             PATCH_MARKER not in helper_source
@@ -1752,7 +1759,7 @@ def main() -> None:
                     for line in helper_source.splitlines()
                 )
                 != 1
-                for guard in auto_approval_guards
+                for guard in capability_guards
             )
         ):
             raise RuntimeError(

docs/get-started/quickstart-langchain-deepagents-code.mdx

@@ -121,6 +121,9 @@ After the terminal smoke checks, onboarding runs `dcode --version` and compares
 Fresh and resumed onboarding exit nonzero instead of reporting the runtime ready when the installed version is too old, uses an incompatible version scheme, or cannot be verified.
 If the version check fails, review the reported version error and run `nemo-deepagents <sandbox-name> rebuild` before resuming onboarding.
 NemoClaw writes `/sandbox/.deepagents/config.toml` with an OpenAI-compatible provider pointed at `https://inference.local/v1`, uses a scoped placeholder API key for that managed route, and sets `use_responses_api = false` for Chat Completions compatibility.
+When onboarding records a reasoning effort on a `compatible-endpoint` route that uses `openai-completions`, the managed image bakes that value into a root-owned file and Deep Agents Code model requests carry it as an `extra_body.reasoning_effort` request parameter.
+Leave `NEMOCLAW_REASONING_EFFORT` unset to keep the endpoint's own default.
+Deep Agents Code has no runtime `inference set` path, so re-onboard the sandbox with `nemo-deepagents onboard --fresh --name <sandbox-name> --recreate-sandbox` to change the recorded effort.
 When you use NVIDIA Endpoints without selecting another model, new Deep Agents Code sandboxes default to `nvidia/nemotron-3-ultra-550b-a55b`.
 For this model, the managed image maps the OpenAI-compatible route to Deep Agents `0.7.0a6`'s native Nemotron 3 Ultra harness profile, including model-specific tool-calling, filesystem, retry, context, and final-answer safeguards.
 Rebuild existing Deep Agents Code sandboxes after upgrading to NemoClaw v0.0.76 or later so their image includes this profile.

docs/inference/configure-model-capabilities.mdx

@@ -86,7 +86,10 @@ Onboarding records the reasoning flag and the reasoning effort in the sandbox's
 A resumed onboard and `nemoclaw <sandbox-name> rebuild` both replay those recorded values, so exporting `NEMOCLAW_REASONING` or `NEMOCLAW_REASONING_EFFORT` before either command does not change them.
 When a resumed onboard on the `compatible-endpoint` provider sees an explicit `NEMOCLAW_REASONING` or `NEMOCLAW_REASONING_EFFORT` that disagrees with the recorded value, it reports the recorded value and the recreate command instead of applying the variable.
 
-To change the reasoning effort on a running sandbox without a recreate, pass `--reasoning-effort` to `inference set`.
+Deep Agents Code applies the recorded reasoning effort from the sandbox image instead, and has no `inference set` path.
+Refer to [Quickstart with Deep Agents](/user-guide/deepagents/get-started/quickstart) for that agent's behavior.
+
+To change the reasoning effort on a running OpenClaw sandbox without a recreate, pass `--reasoning-effort` to `inference set`.
 
 ```bash
 nemoclaw <sandbox-name> inference set --provider compatible-endpoint --model <model> --endpoint-url <recorded-url> --reasoning-effort high

scripts/check-dcode-profile-import-gate.sh

@@ -39,7 +39,7 @@ for dockerfile in \
   agents/langchain-deepagents-code/Dockerfile; do
   while IFS= read -r arg_name; do
     case "${arg_name}" in
-      BASE_IMAGE | NEMOCLAW_CORPORATE_CA_B64 | NEMOCLAW_MODEL | NEMOCLAW_INFERENCE_PROVIDER_ID | NEMOCLAW_PROVIDER_KEY | NEMOCLAW_UPSTREAM_PROVIDER | NEMOCLAW_UPSTREAM_ENDPOINT_URL | NEMOCLAW_INFERENCE_BASE_URL | NEMOCLAW_INFERENCE_API | NEMOCLAW_TOOL_DISCLOSURE | NEMOCLAW_DCODE_AUTO_APPROVAL | NEMOCLAW_BUILD_ID | NEMOCLAW_DARWIN_VM_COMPAT | NEMOCLAW_PROXY_HOST | NEMOCLAW_PROXY_PORT | PERL_VERSION | PERL_SHA256 | PERL_PACKAGE_REVISION) ;;
+      BASE_IMAGE | NEMOCLAW_CORPORATE_CA_B64 | NEMOCLAW_MODEL | NEMOCLAW_INFERENCE_PROVIDER_ID | NEMOCLAW_PROVIDER_KEY | NEMOCLAW_UPSTREAM_PROVIDER | NEMOCLAW_UPSTREAM_ENDPOINT_URL | NEMOCLAW_INFERENCE_BASE_URL | NEMOCLAW_INFERENCE_API | NEMOCLAW_REASONING_EFFORT | NEMOCLAW_TOOL_DISCLOSURE | NEMOCLAW_DCODE_AUTO_APPROVAL | NEMOCLAW_BUILD_ID | NEMOCLAW_DARWIN_VM_COMPAT | NEMOCLAW_PROXY_HOST | NEMOCLAW_PROXY_PORT | PERL_VERSION | PERL_SHA256 | PERL_PACKAGE_REVISION) ;;
       *)
         echo "ERROR: plain-progress build refuses unreviewed ARG ${arg_name} in ${dockerfile}" >&2
         exit 1

src/lib/onboard/managed-startup-agent-environment.test.ts

@@ -219,7 +219,7 @@ function dcodeProfile(): ManagedStartupProfile {
       contextWindow: null,
       maxTokens: null,
       reasoning: null,
-      reasoningEffort: null,
+      reasoningEffort: "high",
     },
     corporateCa: { bundleSha256: CA_SHA256 },
   };
@@ -526,6 +526,7 @@ describe("managed startup agent environment", () => {
       NEMOCLAW_INFERENCE_BASE_URL: "https://inference.local/v1",
       NEMOCLAW_INFERENCE_PROVIDER_ID: "inference",
       NEMOCLAW_MODEL: "openai/gpt-5.4",
+      NEMOCLAW_REASONING_EFFORT: "high",
       NEMOCLAW_TOOL_DISCLOSURE: "progressive",
       NEMOCLAW_UPSTREAM_ENDPOINT_URL: "https://openrouter.ai/api/v1",
       NEMOCLAW_UPSTREAM_PROVIDER: "openrouter",
@@ -536,6 +537,7 @@ describe("managed startup agent environment", () => {
     });
     const expectedDcodeRuntime = { ...result.configurationEnvironment };
     delete expectedDcodeRuntime.NEMOCLAW_INFERENCE_BASE_URL;
+    delete expectedDcodeRuntime.NEMOCLAW_REASONING_EFFORT;
     for (const name of [
       "HTTP_PROXY",
       "HTTPS_PROXY",
@@ -563,6 +565,7 @@ describe("managed startup agent environment", () => {
     expect(result.runtimeEnvironment).not.toHaveProperty("HTTP_PROXY");
     expect(result.runtimeEnvironment).not.toHaveProperty("HTTPS_PROXY");
     expect(result.runtimeEnvironment).not.toHaveProperty("NEMOCLAW_INFERENCE_BASE_URL");
+    expect(result.runtimeEnvironment).not.toHaveProperty("NEMOCLAW_REASONING_EFFORT");
 
     expect(result.materials).toEqual([
       {
@@ -606,6 +609,15 @@ describe("managed startup agent environment", () => {
         group: "root",
         mode: 0o444,
       },
+      {
+        kind: "root-owned-file",
+        legacyInput: "NEMOCLAW_REASONING_EFFORT",
+        path: "/usr/local/share/nemoclaw/dcode-reasoning-effort",
+        contents: "high\n",
+        owner: "root",
+        group: "root",
+        mode: 0o444,
+      },
     ]);
     expect(result.actions).toEqual([
       {

src/lib/onboard/managed-startup-onboard-profile.test.ts

@@ -295,7 +295,7 @@ describe("buildManagedStartupOnboardProfile", () => {
         contextWindow: null,
         maxTokens: null,
         reasoning: null,
-        reasoningEffort: null,
+        reasoningEffort: "default",
       },
     });
   });

src/lib/onboard/managed-startup-profile-builder.test.ts

@@ -398,6 +398,7 @@ describe("buildManagedStartupProfile", () => {
           NEMOCLAW_PROXY_HOST: "10.200.0.1",
           NEMOCLAW_PROXY_PORT: "3128",
           NEMOCLAW_OBSERVABILITY: "1",
+          NEMOCLAW_REASONING_EFFORT: "high",
         },
       }),
     );
@@ -434,7 +435,7 @@ describe("buildManagedStartupProfile", () => {
         contextWindow: null,
         maxTokens: null,
         reasoning: null,
-        reasoningEffort: null,
+        reasoningEffort: "high",
       },
     });
     expect(decodeManagedStartupProfile(built.encodedProfile)).toEqual(built.profile);