openclaw

name	openclaw
description	Manages the OpenClaw trading system on openroach.exe.xyz. SSH admin operations for Kalshi proxy, credentials, kill switch, logs, and trade queries. Triggers include "openclaw", "check trades", "kill switch", "trading logs", "restart proxy", or /openclaw.
version	1.0.0
author	Tyler

OpenClaw — Trading System Admin

Manage the OpenClaw trading system running on openroach.exe.xyz via SSH.

Connection

SSH login as root@ maps to the exedev user (exe.dev platform behavior). Use sudo for privileged operations:

ssh [e-mail] "sudo <command>"

The trader user has nologin shell — it's a service account. Access its files via sudo -u trader or sudo cat/ls.

Available Operations

When invoked without a specific request, present Q with the operation menu using AskUserQuestion:

Question: "What do you want to do on OpenClaw?"

Operation	Description
View logs	Read recent trade logs
Query trades	Query the trades database
System status	Check proxy service status
Restart proxy	Restart the Kalshi proxy service
Kill switch	Activate the emergency kill switch
Edit credentials	Open Kalshi credentials for editing
Deploy PEM	Deploy a Kalshi PEM certificate

Operation Details

View Logs

ssh [e-mail] "sudo cat /home/trader/log/trades.log"

For recent entries only:

ssh [e-mail] "sudo tail -100 /home/trader/log/trades.log"

Query Trades

Default — all trades:

ssh [e-mail] "sudo -u trader sqlite3 /home/trader/data/trades.db 'SELECT * FROM trades;'"

Recent trades (last 24h):

ssh [e-mail] "sudo -u trader sqlite3 /home/trader/data/trades.db \"SELECT * FROM trades WHERE created_at > datetime('now', '-1 day') ORDER BY created_at DESC;\""

Trade count:

ssh [e-mail] "sudo -u trader sqlite3 /home/trader/data/trades.db 'SELECT COUNT(*) FROM trades;'"

Schema inspection:

ssh [e-mail] "sudo -u trader sqlite3 /home/trader/data/trades.db '.schema trades'"

Open positions:

ssh [e-mail] "curl -s http://localhost:8100/markets/{ticker}"

System Status

Check if proxy is running:

ssh [e-mail] "sudo systemctl status kalshi-proxy"

Health check (includes Kalshi connection, DB, kill switch):

ssh [e-mail] "curl -s http://localhost:8100/health"

Check kill switch state:

ssh [e-mail] "sudo cat /home/trader/etc/kill_switch 2>/dev/null || echo 'not set'"

Restart Proxy

ssh [e-mail] "sudo systemctl restart kalshi-proxy"

After restarting, verify:

ssh [e-mail] "sudo systemctl status kalshi-proxy && curl -s http://localhost:8100/health"

Kill Switch (DANGER)

This halts all trading. Always confirm with Q before executing.

Activate:

ssh [e-mail] "sudo bash -c 'echo halt > /home/trader/etc/kill_switch'"

Check state:

ssh [e-mail] "sudo cat /home/trader/etc/kill_switch 2>/dev/null || echo 'not set'"

Resume trading (if Q approves):

ssh [e-mail] "sudo bash -c 'echo active > /home/trader/etc/kill_switch && chown trader:trader /home/trader/etc/kill_switch'"

Note: The kill switch is an ALLOW switch — the file must exist with content "active" to permit trading. Deleting the file blocks all orders.

Edit Credentials

Read the current env (redact secrets in output):

ssh [e-mail] "sudo cat /home/trader/etc/env"

Update a specific value non-interactively:

ssh [e-mail] "sudo sed -i 's/^KALSHI_API_KEY=.*/KALSHI_API_KEY=new-key-here/' /home/trader/etc/env"

For interactive editing, tell Q to run directly: ssh [e-mail] "sudo -u trader nano /home/trader/etc/env"

Deploy Credentials from 1Password

Kalshi API credentials are stored in 1Password under "Kalshi" (API_CREDENTIAL type, ID: jgqpz2rdz3igdoasebbsb763hy).

Requires: op CLI signed in (eval $(op signin))

Deploy API key:

API_KEY=$(op item get jgqpz2rdz3igdoasebbsb763hy --fields "API key id")
ssh [e-mail] "sudo sed -i 's/^KALSHI_API_KEY=.*/KALSHI_API_KEY=${API_KEY}/' /home/trader/etc/env"

Deploy PEM (credential field contains the RSA private key — needs reformatting to proper 64-char line breaks):

op item get jgqpz2rdz3igdoasebbsb763hy --fields "credential" --reveal | \
  ssh [e-mail] "sudo tee /home/trader/etc/kalshi.pem > /dev/null && \
  sudo chown trader:trader /home/trader/etc/kalshi.pem && \
  sudo chmod 600 /home/trader/etc/kalshi.pem"

Important: The PEM from 1Password is stored as a single line. After deploying, reformat it:

ssh [e-mail] "sudo python3 -c \"
import re
with open('/home/trader/etc/kalshi.pem') as f:
    content = f.read().strip()
m = re.match(r'(-----BEGIN [^-]+-----)\s*(.*?)\s*(-----END [^-]+-----)', content, re.DOTALL)
if m:
    header, body, footer = m.groups()
    body = body.replace(' ', '').replace('\n', '')
    lines = [body[i:i+64] for i in range(0, len(body), 64)]
    with open('/home/trader/etc/kalshi.pem', 'w') as f:
        f.write(header + '\n' + '\n'.join(lines) + '\n' + footer + '\n')
    print('PEM reformatted')
\""

After deploying credentials, restart proxy: sudo systemctl restart kalshi-proxy

Safety Rules

• Kill switch: Always confirm with Q before activating or deactivating. This is an irreversible action during the halt period.
• Restart proxy: Confirm with Q. Restarting interrupts active connections.
• Credentials: Never display API keys or secrets in output. Redact sensitive values.
• PEM files: Verify file exists locally before attempting deploy.
• All mutations: Any command that changes state (restart, kill, deploy, edit) requires explicit Q approval.

Paths Reference

Path	Purpose
/home/trader/etc/env	Kalshi credentials
/home/trader/etc/kalshi.pem	Kalshi PEM certificate
/home/trader/etc/kill_switch	Kill switch file
/home/trader/log/trades.log	Trade log
/home/trader/data/trades.db	SQLite trades database

Known Behaviors

• Lazy connection: The proxy connects to Kalshi on-demand (per request), not at startup. kalshi_connected: false in /health is normal when idle — it does NOT mean auth is broken.
• Health endpoint fields:
  • kalshi_configured: true — credentials are loaded
  • kalshi_connected: false — no active session (normal when idle)
  • kill_switch_ok: true / kill_switch_active: true — file exists with "active", trading ALLOWED
  • kill_switch_ok: false / kill_switch_active: false — file missing or not "active", trading BLOCKED
  • db_ok: true — SQLite database is accessible
• Kill switch is an ALLOW switch: The file must exist and contain "active" to permit trading. Deleting the file or writing "halt" both BLOCK all orders. This is inverted from what the name suggests.
  • To ALLOW trading: echo active > /home/trader/etc/kill_switch
  • To HALT trading: echo halt > /home/trader/etc/kill_switch (or delete the file)
• PEM format: 1Password stores the PEM as a single line. Must reformat to 64-char line-wrapped PEM before the proxy can use it.

Host

• Server: openroach.exe.xyz
• SSH User: root (maps to exedev user — use sudo for privileged ops)
• Service User: trader (nologin shell, service account)
• Service: kalshi-proxy (systemd)
• Proxy: http://localhost:8100 (only accessible from server)
• Kalshi API: https://api.elections.kalshi.com
• 1Password: Kalshi API_CREDENTIAL ID: jgqpz2rdz3igdoasebbsb763hy