Bug: viewer config save overwrites viewer.port with UI default (18799) on Hermes

[asorry75]

Bug Description

On the Hermes variant, saving settings from the Memory Viewer overwrites viewer.port in ~/.hermes/memos-plugin/config.yaml with the UI default 18799 (the OpenClaw port). Hermes hardcodes its viewer port to 18800 (the bridge connects there), so after a save the daemon listens on a different port and the bridge/stdio link breaks until the config is fixed by hand.

Observed side effects of one save: viewer.port changed 18800 -> 18799, and a placeholder embedding.endpoint: "mem os" appeared.

Steps to Reproduce

1. Install memos-local-plugin into Hermes (v2.0.12).
2. Open the Memory Viewer at :18800 → Settings.
3. Change any setting and save (or click restart after save).

Expected Behavior

Saving settings must not clobber fields the user did not edit — especially viewer.port, which the Hermes adapter owns.

Actual Behavior

PATCH /api/v1/config accepts the whole dirty form (viewer/src/views/SettingsView.tsx:139) and the backend writes it verbatim, so untouched fields fall back to UI defaults (e.g. 18799).

Suggested Fix

• Backend: protect/ignore adapter-owned keys (viewer.port, agent identity) on PATCH /api/v1/config, or merge with the existing config instead of replacing.
• Frontend: do not submit unchanged fields.

Environment

• OS: Windows
• Plugin: memos-local-plugin 2.0.12 (Hermes adapter)

[Memtensor-AI]

🤖 AutoDev has picked up this issue and started working on it.

Task ID: 24db7cc632d778ac
Working branch: bugfix/autodev-2212-20260805050236330
Target branch: latest dev* branch
Workflow: opsp (analysis → coding → testing → PR)

I will post the PR link here once done. If I need more information, I will ask in the comments.

[Memtensor-AI]

✅ AutoDev task 24db7cc632d778ac completed.

Summary: Fix #2212 by adding a sanitizePatch() guard inside apps/memos-local-plugin/core/config/writer.ts. The writer now silently strips adapter-owned viewer keys (viewer.port, viewer.bindHost) from every incoming PATCH /api/v1/config body before the deep-merge writes to disk, so the Hermes adapter's hardcoded :18800 viewer port can no longer be clobbered by the UI's default :18799 (the OpenClaw port). The same helper drops empty-string patches on embedding.endpoint, llm.endpoint, l3Llm.endpoint, and skillEvolver.endpoint, matching the defensive treatment already applied to secret fields upstream and closing the companion "placeholder text overwrote endpoint" symptom from the same report.

Root cause: writer.ts::patchConfig deep-merged the client patch verbatim (only stripping empty secrets and embedding.dimensions), with no guard for keys the adapter owns at runtime. bridge.mts::AGENT_DEFAULT_PORTS hardcodes hermes → 18800, so any PATCH carrying a different viewer.port corrupted config.yaml and broke bridge/stdio linkage until the file was hand-repaired. Fix lives at the single choke point every PATCH path traverses (routes, direct core calls, hub-triggered rewrites), so no callers need to change.

Test evidence — all real pytest/vitest output:

• 4 new failing tests added first in tests/unit/config/writer.test.ts (viewer.port strip, viewer.bindHost strip, openOnFirstTurn still patchable, embedding.endpoint empty-string protection); confirmed all 4 failed before fix, all 11 tests in the file pass after.
• Full unit suite: 1265 passed / 1 skipped / 0 failed (151 test files).
• Config-focused: 52/52 pass across paths.test.ts, load.test.ts, writer.test.ts.
• Server route regression coverage (tests/unit/server/http.test.ts — includes the Bug: /api/v1/embeddings/maintenance causes 100% CPU and event loop starvation on large corpora #1929 400-vs-500 PATCH contract): 77/77 pass.
• Typecheck: tsc -p tsconfig.json --noEmit clean.

One existing test (validates after merge — invalid patches are rejected) was retargeted from viewer.port: -3 to bridge.port: -3 because viewer.port now bypasses schema validation via the new strip — noted inline. Task archive synced to memos-autodev-specs main.

Base branch: main
Branch: bugfix/autodev-2212-20260805050236330
Commit: 34fbf56
PR: #2219
Assigned to: @hijzy
Reviewers: @whipser030, @hijzy