fix: OpenClaw migration overwrites defaults and setup wizard skips imported sections

[teknium1]

Summary

Two bugs caused the OpenClaw migration during first-time setup to appear to do nothing, forcing users to reconfigure everything manually.

Bug 1: Default config creates false conflicts

_offer_openclaw_migration() called save_config(load_config()) to create config.yaml before migration. This wrote ALL defaults (e.g. model: anthropic/claude-opus-4.6). The migrator then ran with overwrite=False, saw existing values for everything, and reported them all as "conflicts" — even though they were just defaults.

Fix: Use overwrite=True during setup-time migration. This is safe because only defaults exist at that point. The hermes claw migrate CLI command still defaults to overwrite=False for post-setup use where real user values may exist.

Bug 2: Setup wizard continues unconditionally after migration

After migration, all 5 setup sections ran regardless of what was imported, forcing the user through model/terminal/agent/messaging/tools configuration from scratch.

Fix: Add _get_section_config_summary() and _skip_configured_section() helpers. After migration, each section checks if it's already configured:

• Model & Provider: checks for API keys in .env or active OAuth provider
• Terminal Backend: always shows current backend setting
• Agent Settings: always shows current max turns
• Messaging Platforms: checks for platform bot tokens (Telegram, Discord, Slack, WhatsApp, Signal)
• Tools: checks for tool API keys (ElevenLabs, Browserbase, Firecrawl)

Configured sections show a summary and ask Reconfigure [section]? [y/N] with default No. Unconfigured sections (e.g. no messaging tokens were imported) still run the full interactive flow.

Test plan

• 23 tests pass in test_setup_openclaw_migration.py (was 10)
• Added 13 new tests: unit tests for helpers + integration test with stateful mock simulating migration importing an API key mid-flow
• All 6 pre-existing failures in test_setup.py / test_setup_model_provider.py remain unchanged
• Zero new failures

Reported by Dev Bredda on social media.

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: Install hook files modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/setup.py

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.