fix: hermes migrate openclaw imports secrets only with --migrate-secrets

First-run setup keeps passing --migrate-secrets (what core's old OpenClaw step did); the named
command forwarded setup's choice too, so API keys and bot tokens came over without being asked.

hermes_cli/migrate.py

@@ -29,7 +29,7 @@ def cmd_migrate(args: Any) -> int:
 
 # ``hermes migrate <agent>`` flags forwarded to ``hermes import-agent <agent>``, as (dest, flag).
 _AGENT_IMPORT_FLAGS = (("dry_run", "--dry-run"), ("overwrite", "--overwrite"), ("yes", "--yes"),
-                       ("activate_routines", "--activate-routines"))
+                       ("activate_routines", "--activate-routines"), ("migrate_secrets", "--migrate-secrets"))
 
 
 def cmd_migrate_agent(args: Any) -> int:

hermes_cli/setup_agent_import.py

@@ -156,8 +156,10 @@ def _import_child(source: ImportSource, hermes_home: Path, extra_args: tuple[str
     selector = [] if hermes_home.resolve().parent.name == "profiles" else ["--profile", "default"]
     # --from-setup: the plugin's import speaks as a step of this setup (no "run hermes setup" pointers,
     # OpenClaw's skipped items folded into one line).
-    argv = [sys.executable, "-P", "-m", "hermes_cli.main", *selector, "import-agent", source.name, *source.extra_args,
-            *extra_args, *(["--from-setup"] if from_setup else [])]
+    # source.extra_args are setup's own choices (OpenClaw's --migrate-secrets, what core's old setup
+    # step did); `hermes migrate` passes only what the user typed.
+    argv = [sys.executable, "-P", "-m", "hermes_cli.main", *selector, "import-agent", source.name,
+            *(source.extra_args if from_setup else ()), *extra_args, *(["--from-setup"] if from_setup else [])]
     env = served_profile_child_env(target_home=hermes_home)
     if os.environ.get("PYTHONPATH"):  # this same interpreter running Hermes: keep the source tree
         env["PYTHONPATH"] = os.environ["PYTHONPATH"]  # a checkout launched by path, which it strips

hermes_cli/subcommands/migrate.py

@@ -60,6 +60,9 @@ def _add_agent_import_parsers(migrate_subparsers) -> None:
         sub.add_argument("--dry-run", action="store_true", help="Preview only")
         sub.add_argument("--overwrite", action="store_true", help="Replace existing items on name conflicts")
         sub.add_argument("-y", "--yes", action="store_true", help="Skip the confirmation prompt")
+        if source.name == "openclaw":
+            sub.add_argument("--migrate-secrets", action="store_true",
+                             help="Also import OpenClaw's allowlisted API keys and bot tokens")
         if source.name in ("grok-bot", "openbot"):
             sub.add_argument("--activate-routines", action="store_true",
                              help="Create the imported cron jobs running instead of paused")

tests/hermes_cli/test_setup_agent_import.py

@@ -180,7 +180,12 @@ def test_hermes_migrate_names_an_agent_installs_the_plugin_and_forwards_its_flag
         ("import", ["--profile", "default", "import-agent", "grok-bot", "--yes", "--activate-routines",
                     "--source", str(user_home / "export.json"), "--bot", "Scout"], str(hermes_home)),
     ]
+    # Setup imports OpenClaw's secrets (its old step did); `hermes migrate openclaw` only on request.
+    calls.clear()
+    monkeypatch.setattr(step, "_ensure_plugin", lambda home: True)
+    openclaw = parser.parse_args(["migrate", "openclaw", "-y"])
+    assert openclaw.func(openclaw) == 0
+    assert calls[-1][1] == ["--profile", "default", "import-agent", "openclaw", "--yes"]
     # A failed import fails the command, so `hermes migrate x && ...` stops there.
     monkeypatch.setattr(step.subprocess, "run", lambda argv, env, check=False: subprocess.CompletedProcess(argv, 1))
-    monkeypatch.setattr(step, "_ensure_plugin", lambda home: True)
     assert args.func(args) == 1

website/docs/reference/cli-commands.md

@@ -604,7 +604,7 @@ hermes migrate <agent>         # openclaw, claude-code, codex, cursor, grok-bot
 hermes migrate <type>          # xai, relay
 ```
 
-Bare `hermes migrate` looks for OpenClaw, Claude Code, Codex CLI, Cursor, Grok Bot and OpenBot on this computer and offers to import what it finds, the same step a first `hermes setup` runs. `hermes migrate <agent>` imports from that agent even when nothing is detected: it installs the [`agent-importers`](../user-guide/import-from-other-agents.md) plugin from the catalog when it is missing, then runs `hermes import-agent <agent>` (preview, then confirmation). It takes `--source`, `--dry-run`, `--overwrite` and `-y`; `grok-bot` and `openbot` also take `--activate-routines` and `--bot <name>`.
+Bare `hermes migrate` looks for OpenClaw, Claude Code, Codex CLI, Cursor, Grok Bot and OpenBot on this computer and offers to import what it finds, the same step a first `hermes setup` runs. `hermes migrate <agent>` imports from that agent even when nothing is detected: it installs the [`agent-importers`](../user-guide/import-from-other-agents.md) plugin from the catalog when it is missing, then runs `hermes import-agent <agent>` (preview, then confirmation). It takes `--source`, `--dry-run`, `--overwrite` and `-y`; `grok-bot` and `openbot` also take `--activate-routines` and `--bot <name>`; `openclaw` takes `--migrate-secrets` (API keys and bot tokens come over only with it, unlike first-run setup, which passes it).
 
 The `xai` and `relay` types diagnose and (optionally) rewrite the active `config.yaml` to replace references to retired models or deprecated settings. A timestamped backup of the original `config.yaml` is taken before any rewrite (skip with `--no-backup`).