[BUG] Config files do not work as expected

[DRKV333]

Bug Description

I'm trying to change the settings of VIIPER with a config file, and noticed some strange behavior.

To Reproduce

Consider these two config files and the VIIPER executable in the working directory:

server.json

{
  "api": {
    "addr": ":9999",
    "autoAttachLocalClient": false,
    "deviceHandlerConnectTimeout": "5s",
    "requireLocalHostAuth": true
  },
  "connectionTimeout": "30s",
  "usb": {
    "addr": ":8888",
    "busCleanupTimeout": "0s",
    "writeBatchFlushInterval": "1ms"
  }
}

server2.json

{
  "api": {
    "addr": ":7777",
    "autoAttachLocalClient": false,
    "deviceHandlerConnectTimeout": "5s",
    "requireLocalHostAuth": true
  },
  "connectionTimeout": "30s",
  "usb": {
    "addr": ":6666",
    "busCleanupTimeout": "0s",
    "writeBatchFlushInterval": "1ms"
  }
}

These were generated with the viiper config init server command.

Now run VIIPER like this:

$ ./viiper server --log.level="trace" --config=./server2.json
2026-06-26T01:27:23.114765+02:00  INFO Starting VIIPER USB-IP server addr=:8888
2026-06-26T01:27:23.115000+02:00  INFO USBIP server listening addr=[::]:8888
2026-06-26T01:27:23.115022+02:00  INFO Auto-attach is enabled, checking prerequisites...
2026-06-26T01:27:23.115035+02:00 DEBUG usbip tool found in PATH
2026-06-26T01:27:23.115165+02:00 DEBUG vhci-hcd kernel module is loaded
2026-06-26T01:27:23.115170+02:00  INFO Auto-attach prerequisites satisfied
2026-06-26T01:27:23.115190+02:00  INFO API listening addr=[::]:9999
2026-06-26T01:27:27.297059+02:00 DEBUG continuing unauthenticated connection
2026-06-26T01:27:27.297089+02:00  INFO api cmd path=ping
2026-06-26T01:27:27.297116+02:00 DEBUG api handler success path=ping

Expected Behavior

• Ports should be 7777 and 6666 from server2.json
• autoAttachLocalClient should be disabled
• requireLocalHostAuth should be enabled

Actual Behavior

• Ports are 9999 and 8888 from server.json
• autoAttachLocalClient is enabled, even though it's set to false in both configs
• requireLocalHostAuth is not enabled, as indicated by the accepted unauthenticated connection, even though it's set to true in both configs

Screenshots/Logs

(See above.)

Environment

• OS: arch linux
• VIIPER Version: 0.7.0-7-g88f66f1
• USB-IP Version: 7.0.12-1

Additional Context

Passing --config with absolute path makes no difference.

It looks like maybe server.json from the working directory is taking precedence over --config, which is not correct according to the docs.
Deleting server.json and rerunning the same command does end up using the ports from server2.json, but the two bools are still incorrect.

Setting the config file with the VIIPER_CONFIG env var has the same effect.

Changing the autoAttachLocalClient and requireLocalHostAuth options with commandline parameters or with env vars does work.

$ ./viiper server --log.level="trace" --api.auto-attach-local-client=false --api.require-local-host-auth=true
2026-06-26T01:29:11.319208+02:00  INFO Starting VIIPER USB-IP server addr=:8888
2026-06-26T01:29:11.319423+02:00  INFO USBIP server listening addr=[::]:8888
2026-06-26T01:29:11.319566+02:00  INFO API listening addr=[::]:9999
2026-06-26T01:29:17.897563+02:00 ERROR authentication required