Newly created (non-cloned) profile shows a model in the UI but fails every run with "No LLM provider configured"

[aaltaay]

Summary

Creating a profile with clone off produces a profile that looks fully configured in the UI — the Profiles page shows it with a model — but it has no credentials, so every run fails with No LLM provider configured. Nothing surfaces the missing credentials until a message actually fails.

This is specific to API-key providers such as OpenRouter.

Environment

• Ekko Studio 0.7.23, commit f9e002e52ed463b7ae03370ee71f82b0fd417ba7
• Source checkout, npm run dev
• Windows 11, Node v24.14.0
• Hermes Agent 0.21.3, provider OpenRouter (API key, not OAuth)

Steps to reproduce

1. Configure the default profile with an OpenRouter API key in <hermes home>/.env and a working model.
2. Profiles → Create Profile, name it test, leave Clone from current profile off.
3. The new profile card renders with a model (e.g. openai/gpt-...), implying it is ready to use.
4. Chat with it, or add it as a Hermes agent in a group-chat room.
5. Every run fails:

No LLM provider configured. Run `hermes -p test model` to select a provider,
or run `hermes -p test setup` for first-time configuration.

What the new profile actually contains

profiles/test/config.yaml names a provider and model:

model:
  default: openai/gpt-...
  provider: openrouter
  base_url: https://openrouter.ai/api/v1

But profiles/test/.env is a comment-only skeleton with no keys:

# Per-profile secrets for this Hermes profile.
# API keys and tokens set here override the shell environment.
# Behavioral settings belong in config.yaml, not here.

and there is no profiles/test/auth.json. Credentials are not inherited from the root profile, so the model named in config.yaml is unreachable.

Confirmed by forcing the provider explicitly, which works once the key is present:

hermes -z "Reply with exactly: OK" --cli --provider openrouter -m "<model>"

Expected behavior

Either:

1. Surface a "this profile has no credentials" state on the profile card and when adding it as a group-chat agent, rather than displaying a model that cannot run, or
2. Offer to inherit the model provider's credentials on create.

Related: copyModelProviderAuthForClone in packages/server/src/modules/hermes/services/profiles/profile-credentials.ts already handles credential inheritance, but only when clone: true, and only for the OAuth providers in MODEL_AUTH_PROVIDERS (openai-codex, claude-oauth, xai-oauth, qwen-oauth, nous, minimax-oauth). API-key providers like OpenRouter depend on .env being copied by the clone path, so a non-clone create leaves them with nothing.

Workaround

Copy the provider key line into the new profile's .env:

grep '^OPENROUTER_API_KEY=' .env >> profiles/test/.env

After that the profile works normally, including as a group-chat agent with its own per-agent model.