fix: profiles.create mirrors launch credentials so new profiles can run

[teknium1]

What

profiles.create (the ws RPC added in #85093) produced profiles that could not run a single turn: create_profile() deliberately seeds a comment-only .env, never copies auth.json, and a fresh (non-cloned) profile has no config.yaml — so the first message from a plugin-created profile failed with:

agent init failed: No inference provider configured. Run 'hermes model' to choose a provider and model, or set an API key (OPENROUTER_API_KEY, OPENAI_API_KEY, etc.) in ~/.hermes/.env.

That default is right for the interactive CLI (hermes profile create is followed by <profile> setup), but the headless ws path has no setup step to recover with — a profile spawned as an always-available teammate must be able to think out of the box.

Fix

profiles.create gains mirror_credentials (default true):

• copy the launch profile's .env → new profile (chmod 600) — only when the source has real (non-comment) content and the destination does NOT (never clobbers secrets a clone_from brought along)
• copy auth.json (OAuth tokens / credential pools) → new profile (chmod 600) — only when absent at the destination
• when the caller gave no explicit model+provider pin and no config was cloned, inherit the launch profile's model.provider/model.default via the same _write_profile_model writer the pin path uses

Callers that want an isolated, credential-free profile pass mirror_credentials: false — that path is byte-identical to the old behavior. Result payload gains a mirrored: {env, auth, model_inherited} receipt.

Not touched: hermes profile create CLI and POST /api/profiles REST keep their existing semantics — this is scoped to the headless ws door where the failure class lives.

Verification

Exercised end-to-end against the real registry (server._methods["profiles.create"] dispatch), no mocks:

• default: mirrored: {env: true, auth: true, model_inherited: true}; on disk the new profile's .env has real keys, auth.json present, config.yaml carries provider: nous / default: <model>; first-turn provider resolution succeeds
• mirror_credentials: false: mirrored all false, .env stays the comment-only stub, no auth.json, no config.yaml — old behavior preserved
• scratch profiles deleted via hermes profile delete

Symptom observed live: a profiles.create-born profile ("mr-tester") erroring "No inference provider configured" on its first message in the desktop app.

[github-actions]

૮ >ﻌ< ა ci review

_{ran on ba2a1fe — fix: profiles.create mirrors launch credentials so new profi}

⚠️ Warnings

OSV vulnerability scan · View job

3 known vulnerabilities found in pinned dependencies.

• CVE-2026-70608 in package-lock.json
• CVE-2026-56876 in package-lock.json
• CVE-2026-70606 in package-lock.json

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

---

debug info

CI timings

CI timings · View report · View job

Wall time 3m23s vs 6m43s (-49.6%). 8 job(s) slower, 12 faster, 4 unchanged.

• Check contributors / check-attribution: -62.0s
• Python tests / Run tests slice 3/12: +28.0s
• Python tests / Run tests slice 5/12: -19.0s
• Python tests / Run tests slice 8/12: +18.0s
• Python tests / Run tests slice 2/12: +15.0s