[codex] fix auth startup and profile model defaults (#966)

* docs release 0.6.0 changelog

* fix auth startup and profile model defaults

tests/server/config-mutating-controllers.test.ts

@@ -37,7 +37,15 @@ async function loadSkillsController() {
 }
 
 function makeCtx(body: unknown): any {
-  return { request: { body }, status: 200, body: undefined, query: {}, params: {} }
+  return {
+    request: { body },
+    status: 200,
+    body: undefined,
+    query: {},
+    params: {},
+    state: {},
+    get: vi.fn(() => ''),
+  }
 }
 
 beforeEach(async () => {
@@ -75,6 +83,24 @@ describe('config mutating controllers', () => {
     expect(config.terminal.backend).toBe('local')
   })
 
+  it('setConfigModel uses the requested profile header when auth has not populated state.profile', async () => {
+    const researchDir = join(hermesHome, 'profiles', 'research')
+    await mkdir(researchDir, { recursive: true })
+    await writeFile(join(hermesHome, 'config.yaml'), 'model:\n  default: root-model\n', 'utf-8')
+    await writeFile(join(researchDir, 'config.yaml'), 'model:\n  default: old-research\n', 'utf-8')
+    const { setConfigModel } = await loadModelsController()
+    const ctx = makeCtx({ default: 'research-model', provider: 'deepseek' })
+    ctx.get = vi.fn((name: string) => name.toLowerCase() === 'x-hermes-profile' ? 'research' : '')
+
+    await setConfigModel(ctx)
+
+    expect(ctx.body).toEqual({ success: true })
+    const rootConfig = YAML.load(await readFile(join(hermesHome, 'config.yaml'), 'utf-8')) as any
+    const researchConfig = YAML.load(await readFile(join(researchDir, 'config.yaml'), 'utf-8')) as any
+    expect(rootConfig.model.default).toBe('root-model')
+    expect(researchConfig.model).toEqual({ default: 'research-model', provider: 'deepseek' })
+  })
+
   it('skill toggle preserves unrelated config while adding and removing disabled skills', async () => {
     await writeFile(join(hermesHome, 'config.yaml'), [
       'model:',