OpenClaw Signals: Systemd Bus Migration, Silent Rate-Limiter Deep-Dives, and Path Hardening

Architecture

Systemd-Native Async Resolution via SD-Varlink

Merging the async resolver into the native systemd bus (sd-varlink integration) moves the daemon away from manual socket management. If you are extending the agent on real infrastructure, this standardizes service discovery and logging right out of the box.

Bug Fix

Dissecting the Silent Rate-Limiter Stall

The rate limiter falls asleep without releasing tickets when errors stack up, effectively freezing the agent executor. This deep dive is critical for debugging why your autonomous loops seem to 'hang' after passing the token limit.

Straighten Message Ordering for History Sync

When the API server scrambles the JSON-RPC message headers, bidirectional history synchronization fails silently. This patch ensures agent memory consistency doesn't get torn during background syncs.

Security

Harden Roboclaw Paths: Symlink and 'findup' Traversal Fixes

Path traversal attacks via symlinked directories are a classic vector for sandbox escapes. The sanitization logic strictly enforces that mounting target paths cannot resolve to 'findups', hardening the containerized file system isolation for builders.

Feature

Dynamic Environment Injection for Containerized Agents

Pass environment variables directly into containerized agents without secrets leaking into the repo configs. This provides a safer, more dynamic way to manage credential injection at execution time.