fix(config): preserve raw user config across updates

[paraddox]

What does this PR do?

Fixes config persistence so Hermes stops silently rewriting user-authored ~/.hermes/config.yaml when setup or other config-changing flows run.

Before this change, several commands loaded the effective runtime config, which already had defaults merged in and environment variables expanded, then saved that object back to disk. That could:

• reset user overrides like compression.threshold
• expand a small config file into a large default-filled one
• replace raw placeholders like ${GLM_API_KEY} with resolved secret values

This PR fixes that by separating the two config views clearly:

• runtime code can still use the effective merged config
• anything that writes config.yaml now patches and saves the raw user config instead

That keeps the file minimal, preserves existing user overrides, and avoids writing expanded secrets back into config.yaml.

Related Issue

Fixes #3522

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Added a raw-preserving config save path in hermes_cli/config.py and centralized config writing through a shared writer.
• Updated setup and migration flows in hermes_cli/setup.py and hermes_cli/claw.py so they preserve existing user config instead of regenerating the whole file.
• Updated model/provider/config mutation flows in hermes_cli/main.py, hermes_cli/auth.py, hermes_cli/mcp_config.py, hermes_cli/skills_config.py, hermes_cli/tools_config.py, and cli.py to use the raw-preserving writer.
• Updated permanent allowlist persistence in tools/approval.py to preserve raw placeholders and unrelated user config.
• Updated gateway-side config writes in gateway/run.py and gateway/platforms/telegram.py to use the same shared config writer.
• Added regression coverage in:
  • tests/hermes_cli/test_config.py
  • tests/hermes_cli/test_setup.py
  • tests/hermes_cli/test_setup_openclaw_migration.py
  • tests/hermes_cli/test_claw.py
  • tests/hermes_cli/test_tools_config.py
  • tests/hermes_cli/test_mcp_config.py
  • tests/hermes_cli/test_skills_config.py
  • tests/test_model_provider_persistence.py
  • tests/tools/test_approval.py
  • tests/gateway/test_reasoning_command.py
  • tests/gateway/test_verbose_command.py
  • tests/gateway/test_dm_topics.py
  • tests/gateway/test_config_persistence.py

How to Test

1. Create a minimal ~/.hermes/config.yaml with a custom override like:

   compression:
     threshold: 0.80
   mcp_servers:
     zread:
       config:
         headers:
           Authorization: Bearer ${GLM_API_KEY}
   

2. Run config-changing flows such as hermes setup, hermes model, hermes tools, hermes mcp, hermes skills, or the gateway config commands, then confirm:

   • compression.threshold stays 0.80
   • ${GLM_API_KEY} stays raw in config.yaml
   • Hermes does not rewrite the file into a full default-expanded config

3. Run:

   source .venv/bin/activate
   python -m pytest tests/hermes_cli/test_config.py tests/hermes_cli/test_setup.py tests/hermes_cli/test_tools_config.py tests/hermes_cli/test_mcp_config.py tests/hermes_cli/test_skills_config.py tests/test_model_provider_persistence.py tests/
   tools/test_approval.py tests/gateway/test_reasoning_command.py tests/gateway/test_verbose_command.py tests/gateway/test_dm_topics.py tests/gateway/test_config_persistence.py -q
   Expected result:

   • 243 passed, 24 warnings

Checklist

Code

• I've read the Contributing Guide (https://github.com/NousResearch/hermes-agent/blob/main/CONTRIBUTING.md)
• My commit messages follow Conventional Commits (https://www.conventionalcommits.org/) (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs (https://github.com/NousResearch/hermes-agent/pulls) to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Ubuntu Linux

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A: N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A: N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A: N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide (https://github.com/NousResearch/hermes-agent/blob/main/CONTRIBUTING.md#cross-platform-compatibility) — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A: N/A

Screenshots / Logs

Focused verification:

$ source .venv/bin/activate
$ python -m pytest tests/hermes_cli/test_config.py tests/hermes_cli/test_setup.py tests/hermes_cli/test_tools_config.py tests/hermes_cli/test_mcp_config.py tests/hermes_cli/test_skills_config.py tests/test_model_provider_persistence.py tests/
tools/test_approval.py tests/gateway/test_reasoning_command.py tests/gateway/test_verbose_command.py tests/gateway/test_dm_topics.py tests/gateway/test_config_persistence.py -q
243 passed, 24 warnings in 8.14s

Full suite note:

• pytest tests/ -q was run during development in this environment, but it still has unrelated pre-existing failures/errors outside this PR, so that checklist item is left unchecked.