PR #13914: fix(web): deep-merge config on PUT /api/config to preserve unrelated sections

• Repository: NousResearch/hermes-agent
• Author: HiddenPuppy
• State: open | merged: False
• Link: https://github.com/NousResearch/hermes-agent/pull/13914

Description (problem / solution / changelog)

Summary

Fixes #13396

Problem

PUT /api/config replaces the entire ~/.hermes/config.yaml file with the provided payload. If a dashboard UI sends only the sections it manages (e.g. agent, display), everything else (model, custom_providers, compression, auxiliary, fallback_model, etc.) is silently deleted.

Impact

• Third-party dashboards (e.g. outsourc-e/hermes-workspace Settings screen) silently destroy user-managed fields they don't know about
• Users have to re-edit config.yaml from memory
• Happens invisibly — no warning, no backup before the overwrite

Fix

In update_config(), load the existing config first, deep-merge the incoming payload into it, then save the merged result. Keys present in the payload overwrite existing values; keys absent from the payload are preserved.

The _deep_merge function already exists in hermes_cli/config.py and is used elsewhere for the same purpose.

Changes

• hermes_cli/web_server.py: update_config() — added load_config() + _deep_merge() before save_config()

Verification

• curl -X PUT /api/config with partial payload → inspect config.yaml → unrelated sections preserved
• Keys in payload correctly overwrite existing values

Checklist

• Bug fix (non-breaking change which fixes an issue)
• New feature
• Breaking change
• Requires documentation update

Changed files

• agent/anthropic_adapter.py (modified, +7/-0)
• agent/auxiliary_client.py (modified, +10/-2)
• cli.py (modified, +15/-1)
• hermes_cli/web_server.py (modified, +5/-1)
• scripts/release.py (modified, +2/-0)

---

PR #106: fix(config): deep-merge dashboard saveConfig to prevent data loss (#85)

• Repository: outsourc-e/hermes-workspace
• Author: outsourc-e
• State: closed | merged: True
• Link: https://github.com/outsourc-e/hermes-workspace/pull/106

Description (problem / solution / changelog)

Fixes #85 — a critical silent data-loss bug in zero-fork mode.

Root cause

saveConfig() in src/server/hermes-dashboard-api.ts was sending a PUT /api/config with only the partial fields the caller passed. The Hermes dashboard's handler replaces the entire config on write, so tweaking display.personality in Settings wiped model.provider, custom_providers, compression, and auxiliary.* from ~/.hermes/config.yaml.

Fix

Client-side fetch-then-deep-merge before the PUT:

1. GET /api/config
2. deep-merge the caller's patch on top (arrays + primitives replace; objects recurse; null = explicit removal)
3. PUT the merged config

Callers still pass ONLY the fields they want to change — no API change.

Why this path (not upstream Hermes)

@joaompfp's writeup linked NousResearch/hermes-agent#13396 for a server-side merge. That's the right long-term fix but depends on upstream. This PR ships the immediate user-facing fix in hermes-workspace without waiting. Once the upstream merge lands, this client-side merge is redundant but harmless (deep-merge of full config against itself is idempotent).

Test plan

• pnpm tsc --noEmit passes
• With dashboard running + multi-section config.yaml: tweak one field in Settings → other sections survive
• Null in a patch removes that key
• Array values are replaced wholesale (not concatenated)

Impact

Severe — resolves silent data loss. Users on zero-fork mode with provider/compression/auxiliary configs were losing them on any Settings change.

Changed files

• src/server/hermes-dashboard-api.ts (modified, +64/-1)