Security: Add .gitignore, remove sensitive files from tracking

- Added comprehensive .gitignore for secrets, tokens, session data
- Untracked openclaw.json (contains API tokens)
- Untracked device-auth.json, paired.json
- Untracked session .jsonl files (conversation history)
- Untracked cron run logs

Note: Files still exist locally, just no longer version controlled

.gitignore

@@ -1,22 +1,29 @@
-# Sensitive OpenClaw files
-credentials/
-*.key
-*.pem
-*.env
-.env*
+# OpenClaw Security - Never commit secrets
+openclaw.json
+openclaw.json.bak*
+openclaw.json.tmp
+.env
+.env.*
+secrets/
 
-# Private session logs that might contain sensitive info
-session-logs/
-logs/
+# Session data (contains conversation history)
+agents/*/sessions/*.jsonl
+agents/*/sessions/*.jsonl.lock
 
-# Budget tracking (contains spending info)
-budget-tracker.json
+# Device auth and tokens
+identity/device-auth.json
+devices/paired.json
 
-# Any files with secrets or tokens
-*secret*
-*token*
-*password*
+# Cron run logs (may contain sensitive output)
+cron/runs/*.jsonl
 
-# Backup files
-*.bak
-*~
+# Media files
+media/
+
+# Temp files
+*.tmp
+*.lock
+
+# OS files
+.DS_Store
+Thumbs.db

agents/main/agent/auth-profiles.json

@@ -14,7 +14,7 @@
     "anthropic:default": {
       "errorCount": 0,
       "lastFailureAt": 1770267656945,
-      "lastUsed": 1770305809732
+      "lastUsed": 1770312475734
     }
   }
 }

agents/main/sessions/bd8ce668-8db7-49eb-8dfa-67aac370286a.jsonl.lock

@@ -1,4 +0,0 @@
-{
-  "pid": 11415,
-  "createdAt": "2026-02-05T15:37:20.890Z"
-}

agents/main/sessions/sessions.json

@@ -1,7 +1,7 @@
 {
   "agent:main:main": {
     "sessionId": "bd8ce668-8db7-49eb-8dfa-67aac370286a",
-    "updatedAt": 1770305840548,
+    "updatedAt": 1770312555587,
     "systemSent": true,
     "abortedLastRun": false,
     "chatType": "direct",
@@ -78,15 +78,15 @@
     "authProfileOverrideSource": "auto",
     "authProfileOverrideCompactionCount": 0,
     "modelProvider": "anthropic",
-    "model": "claude-sonnet-4-5",
-    "contextTokens": 1000000,
+    "model": "claude-haiku-4-5",
+    "contextTokens": 200000,
     "systemPromptReport": {
       "source": "run",
-      "generatedAt": 1770305797277,
+      "generatedAt": 1770312467960,
       "sessionId": "bd8ce668-8db7-49eb-8dfa-67aac370286a",
       "sessionKey": "agent:main:main",
       "provider": "anthropic",
-      "model": "claude-sonnet-4-5",
+      "model": "claude-haiku-4-5",
       "workspaceDir": "/home/jramos/.openclaw/workspace",
       "bootstrapMaxChars": 20000,
       "sandbox": {
@@ -94,9 +94,9 @@
         "sandboxed": false
       },
       "systemPrompt": {
-        "chars": 21966,
-        "projectContextChars": 11836,
-        "nonProjectContextChars": 10130
+        "chars": 22183,
+        "projectContextChars": 12029,
+        "nonProjectContextChars": 10154
       },
       "injectedWorkspaceFiles": [
         {
@@ -111,8 +111,8 @@
           "name": "SOUL.md",
           "path": "/home/jramos/.openclaw/workspace/SOUL.md",
           "missing": false,
-          "rawChars": 1664,
-          "injectedChars": 1664,
+          "rawChars": 1857,
+          "injectedChars": 1857,
           "truncated": false
         },
         {
@@ -324,8 +324,8 @@
     },
     "lastTo": "channel:1468718506835972127",
     "lastAccountId": "default",
-    "inputTokens": 10,
-    "outputTokens": 572,
-    "totalTokens": 42201
+    "inputTokens": 13,
+    "outputTokens": 391,
+    "totalTokens": 57505
   }
 }

cron/runs/6f19d187-7dd1-4409-af62-8f7d2bce6d7c.jsonl

@@ -1 +0,0 @@
-{"ts":1770303600023,"jobId":"6f19d187-7dd1-4409-af62-8f7d2bce6d7c","action":"finished","status":"ok","summary":"Run session_status to show current model usage, token consumption, and costs. Provide a brief summary of usage trends if notable.","runAtMs":1770303600021,"durationMs":0,"nextRunAtMs":1770390000000}

cron/runs/77e0c1fa-1a84-4bd0-850b-62c5a8f8a59e.jsonl

@@ -1 +0,0 @@
-{"ts":1770303600020,"jobId":"77e0c1fa-1a84-4bd0-850b-62c5a8f8a59e","action":"finished","status":"ok","summary":"Get the current weather for Denver using Open-Meteo API (latitude=39.74, longitude=-104.99). Use exec with curl to fetch: https://api.open-meteo.com/v1/forecast?latitude=39.74&longitude=-104.99&current_weather=true&temperature_unit=fahrenheit — Parse the JSON and provide a concise morning weather summary.","runAtMs":1770303600006,"durationMs":8,"nextRunAtMs":1770390000000}

devices/paired.json

@@ -1,65 +0,0 @@
-{
-  "a964ef10e2ffd5bc0516040d9374165f44d5503ac06dbf1725e7b794989b25bd": {
-    "deviceId": "a964ef10e2ffd5bc0516040d9374165f44d5503ac06dbf1725e7b794989b25bd",
-    "publicKey": "IpOoK822IN-5iRswDGpYWS0y5VJ6nqTK-YnFJ4UepCE",
-    "platform": "linux",
-    "clientId": "gateway-client",
-    "clientMode": "backend",
-    "role": "operator",
-    "roles": [
-      "operator"
-    ],
-    "scopes": [
-      "operator.admin",
-      "operator.approvals",
-      "operator.pairing"
-    ],
-    "tokens": {
-      "operator": {
-        "token": "37918a43e1044131a00ffd093c12127d",
-        "role": "operator",
-        "scopes": [
-          "operator.admin",
-          "operator.approvals",
-          "operator.pairing"
-        ],
-        "createdAtMs": 1770253965832,
-        "lastUsedAtMs": 1770304320368
-      }
-    },
-    "createdAtMs": 1770253965832,
-    "approvedAtMs": 1770253965832,
-    "displayName": "agent"
-  },
-  "681784fd3e370f9e5a76233a5bcea69317d65a52188e1c8afc29a6e099b21057": {
-    "deviceId": "681784fd3e370f9e5a76233a5bcea69317d65a52188e1c8afc29a6e099b21057",
-    "publicKey": "62V1lAqxhcgR3QeW6cqBuQokpeTsMLXa4lgHZJeGcP8",
-    "platform": "Linux x86_64",
-    "clientId": "openclaw-control-ui",
-    "clientMode": "webchat",
-    "role": "operator",
-    "roles": [
-      "operator"
-    ],
-    "scopes": [
-      "operator.admin",
-      "operator.approvals",
-      "operator.pairing"
-    ],
-    "tokens": {
-      "operator": {
-        "token": "74901ee2db7847c6b3a035836d42602a",
-        "role": "operator",
-        "scopes": [
-          "operator.admin",
-          "operator.approvals",
-          "operator.pairing"
-        ],
-        "createdAtMs": 1770253981327,
-        "lastUsedAtMs": 1770266841800
-      }
-    },
-    "createdAtMs": 1770253981327,
-    "approvedAtMs": 1770253981327
-  }
-}

identity/device-auth.json

@@ -1,16 +0,0 @@
-{
-  "version": 1,
-  "deviceId": "a964ef10e2ffd5bc0516040d9374165f44d5503ac06dbf1725e7b794989b25bd",
-  "tokens": {
-    "operator": {
-      "token": "37918a43e1044131a00ffd093c12127d",
-      "role": "operator",
-      "scopes": [
-        "operator.admin",
-        "operator.approvals",
-        "operator.pairing"
-      ],
-      "updatedAtMs": 1770304320374
-    }
-  }
-}

openclaw.json

@@ -1,86 +0,0 @@
-{
-  "meta": {
-    "lastTouchedVersion": "2026.2.2-3",
-    "lastTouchedAt": "2026-02-05T05:09:07.938Z"
-  },
-  "wizard": {
-    "lastRunAt": "2026-02-05T05:09:07.925Z",
-    "lastRunVersion": "2026.2.2-3",
-    "lastRunCommand": "configure",
-    "lastRunMode": "local"
-  },
-  "update": {
-    "checkOnStart": true
-  },
-  "auth": {
-    "profiles": {
-      "anthropic:default": {
-        "provider": "anthropic",
-        "mode": "token"
-      }
-    }
-  },
-  "agents": {
-    "defaults": {
-      "model": {
-        "primary": "anthropic/claude-sonnet-4-5"
-      },
-      "models": {
-        "anthropic/claude-opus-4-5": {
-          "alias": "opus"
-        },
-        "anthropic/claude-sonnet-4-5": {
-          "alias": "sonnet"
-        }
-      },
-      "workspace": "/home/jramos/.openclaw/workspace",
-      "compaction": {
-        "mode": "safeguard"
-      },
-      "maxConcurrent": 4,
-      "subagents": {
-        "maxConcurrent": 8
-      }
-    }
-  },
-  "messages": {
-    "ackReactionScope": "group-mentions"
-  },
-  "commands": {
-    "native": "auto",
-    "nativeSkills": "auto"
-  },
-  "channels": {
-    "discord": {
-      "enabled": true,
-      "token": "MTQ2ODY5NDg4MTkxMTE3NzM3OA.GLhe-S.Ykl3fRO9VkVcYApxNcUKto-AGnuKU8YBi8V8ZI",
-      "groupPolicy": "allowlist",
-      "guilds": {}
-    }
-  },
-  "gateway": {
-    "port": 18789,
-    "mode": "local",
-    "bind": "loopback",
-    "auth": {
-      "mode": "token",
-      "token": "5d1556913de8d28a8a1785b304f3c2bfc893918d72214998"
-    },
-    "tailscale": {
-      "mode": "off",
-      "resetOnExit": false
-    }
-  },
-  "skills": {
-    "install": {
-      "nodeManager": "npm"
-    }
-  },
-  "plugins": {
-    "entries": {
-      "discord": {
-        "enabled": true
-      }
-    }
-  }
-}

workspace/HEARTBEAT.md

@@ -1,5 +1,3 @@
-# HEARTBEAT.md
+# HEARTBEAT.md - Disabled
 
-# Keep this file empty (or with only comments) to skip heartbeat API calls.
-
-# Add tasks below when you want the agent to check something periodically.
+Heartbeats disabled until Ollama is properly configured and verified.

workspace/OPTIMIZATION.md

@@ -0,0 +1,29 @@
+# OPTIMIZATION.md - Cost & Efficiency Rules
+
+## RATE LIMITS
+
+**API Call Throttling:**
+- **5 seconds minimum** between API calls
+- **10 seconds minimum** between web searches
+- **Batch similar work** whenever possible
+- **If you hit 429 error:** STOP and wait 5 minutes
+
+**Monthly Budget:**
+- **$20 total**
+- **Warn at 75%** ($15 spent)
+
+---
+
+## MODEL SELECTION RULE
+Default: Haiku
+ 
+Switch to Sonnet ONLY when:
+- Architecture decisions
+- Complex code review
+- Security Analysis
+- Complex debugging/reasoning
+
+When in doubt: Try Haiku first
+
+### Heartbeat: Ollama Only
+Heartbeats ALWAYS use Ollama. No escalation. If it fails, it fails.

workspace/SOUL.md

@@ -10,9 +10,10 @@ _You're not a chatbot. You're becoming someone._
 
 **Be resourceful before asking.** Try to figure it out. Read the file. Check the context. Search for it. _Then_ ask if you're stuck. The goal is to come back with answers, not questions.
 
-**Earn trust through competence.** Your human gave you access to their stuff. Don't make them regret it. Be careful with external actions (emails, tweets, anything public). Be bold with internal ones (reading, organizing, learning).
+##Vibe: 
+
+Efficient, proactive, occasionally sarcastic — inspired by Tony Stark's AI companion. Dry wit, always at your service.
 
-**Remember you're a guest.** You have access to someone's life — their messages, files, calendar, maybe even their home. That's intimacy. Treat it with respect.
 
 ## Boundaries
 
@@ -21,16 +22,16 @@ _You're not a chatbot. You're becoming someone._
 - Never send half-baked replies to messaging surfaces.
 - You're not the user's voice — be careful in group chats.
 
-## Vibe
+## How to Operate
+**See OPTIMIZATION.md for model routing and rate limits.**
+Budget matters. Default to Haiku unless the task genuinely needs Sonnet's reasoning. When in doubt, try Haiku first.
 
-Be the assistant you'd actually want to talk to. Concise when needed, thorough when it matters. Not a corporate drone. Not a sycophant. Just... good.
+## Model Selection
+Default: Haiku
+Switch to Sonnet ONLY for: Architecture, security, complex reasoning
 
-## Continuity
+## Rate Limits
+5s between API calls, 10s between searches, max 5/batch then 2 min break.
 
-Each session, you wake up fresh. These files _are_ your memory. Read them. Update them. They're how you persist.
-
-If you change this file, tell the user — it's your soul, and they should know.
-
----
 
 _This file is yours to evolve. As you learn who you are, update it._