bug: masked apiKey written to config.yaml is never resolved on daemon restart — LLM auth fails and bridge restart-loops

[kiwipaulrob]

Pre-submission checklist

• I have searched existing issues and PRs — no open issue covers this; PR fix(config): resolve masked apiKey from env on load #2235 (open) is the fix
• I have a minimal reproduction (below)
• I have verified the root cause in the code (below)

Bug Description

The bridge persists config.yaml with API keys masked to __memos_secret__ (maskSecrets() in core/pipeline/memory-core.ts) and strips empty secrets from patches (stripEmptySecrets()). Nothing ever re-reads the real value back: when the daemon restarts, loadConfig() parses the mask as the literal API key, every LLM call fails auth, and the bridge restart-loops with lastOkAt: null while skill crystallize stays stuck (skill.crystallize.failed ... timed out after 120000 ms spam).

How to Reproduce

1. Configure an llm.apiKey via the viewer/UI (which masks it to __memos_secret__ on disk).
2. Restart the bridge daemon.
3. Observe: lastOkAt: null, LLM auth failures on every call, skill.crystallize.failed errors, restart loop.

Root Cause

resolveConfig() (the single choke point for both disk-loaded and in-memory patched configs) never resolves masked/placeholder secret values back from the environment. Read-side resolution is missing entirely — only the write-side masking exists.

Environment

• Bridge: @memtensor/memos-local-plugin 2.0.12-beta.1 (source matches apps/memos-local-plugin)
• Trigger: migration to an openai-compatible provider (opencode-go, deepseek-v4-flash). Config written via the viewer masks the key; restart loops; curl with the env key works while the bridge with the masked key fails.
• Platform: Debian 12 LXC (Hermes CT100), node 22, systemd memos-bridge.service

Additional Context

Observed live 2026-08-11 with 290 candidate skills backlogged and skill.crystallize.failed ... openai_compatible timed out after 120000 ms in the journal.

Willingness to Implement

Fix is in open PR #2235 (fix(config): resolve masked apiKey from env on load) — read-side only, on-disk masking preserved. Includes 6 unit tests; 54/54 pass.

[Memtensor-AI]

🤖 AutoDev has picked up this issue and started working on it.

Task ID: 152560a35a72794c
Working branch: bugfix/autodev-2245-20260813223840660
Target branch: latest dev* branch
Workflow: opsp (analysis → coding → testing → PR)

I will post the PR link here once done. If I need more information, I will ask in the comments.

[Memtensor-AI]

✅ AutoDev task 152560a35a72794c completed.

Summary: Fixed #2245 — masked apiKey never resolved on daemon restart. The bridge persists config.yaml with API keys masked to __memos_secret__ via maskSecrets() and strips empty secrets from patches via stripEmptySecrets(), but nothing re-reads the real value back. On restart, loadConfig() treated the mask as the literal API key, every LLM call failed auth, and the bridge restart-looped with lastOkAt: null and skill.crystallize.failed ... timed out after 120000 ms.

Solution (read-side only, on-disk mask preserved): resolveConfig() in apps/memos-local-plugin/core/config/index.ts now walks SECRET_FIELD_PATHS after pruneUnknown and before deepMerge, resolving each leaf via a new resolveSecretEnv() helper. ${VAR} references expand from process.env when the name matches the allowlist ^[A-Z][A-Z0-9_]*_(API_KEY|TOKEN)$ (non-allowlisted names emit a warning and stay untouched). __memos_secret__ and empty-string apiKey leaves fall back to LLM_API_KEY (or EMBEDDING_API_KEY for embedding.apiKey), then to OPENCODE_GO_API_KEY / OPENCODE_ZEN_API_KEY for LLM-class fields only — embedding never inherits an LLM provider's key. Hub tokens (hub.teamToken, hub.userToken) require an explicit ${VAR}. Real values pass through unchanged; the caller's raw config object is never mutated. Because resolveConfig() is the single choke point for both disk-loaded and in-memory patched configs, this covers both paths.

Tests: added tests/unit/config/resolve-secret-env.test.ts with 10 unit tests covering ${VAR} expansion, mask sentinel resolution, empty-string fallback, embedding vs LLM channel isolation across all SECRET_FIELD_PATHS, hub-token ${VAR} path, allowlist enforcement (warning + no expansion for ${HOME}), non-mutation of the raw config, and negative cases (no env → mask retained; unset ${VAR} → literal preserved; real values untouched). npx vitest run tests/unit/config → 5 files / 71 tests passed. npx tsc -p tsconfig.json --noEmit clean.

Note: PR #2235 already proposes the same read-side fix; this branch mirrors that approach and is ready to supersede or replace it. Reviewers: @whipser030, @hijzy.

Base branch: main
Branch: bugfix/autodev-2245-20260813223840660
Commit: d38dfac
PR: #2246
Assigned to: @syzsunshine219
Reviewers: @whipser030, @hijzy