PR #63913: fix(daemon): prevent systemd restart storm on config validation failure [AI-assisted]

• Repository: openclaw/openclaw
• Author: neo1027144-creator
• State: closed | merged: True
• Link: https://github.com/openclaw/openclaw/pull/63913

Description (problem / solution / changelog)

What

Prevent the OpenClaw gateway systemd service from entering an unbounded restart loop when configuration validation fails (e.g. gateway.mode is missing).

Closes #63912

Why

When gateway.mode is unset, the gateway exits with code 1. Because the generated systemd unit uses Restart=always without any StartLimit* guards, systemd restarts the process every 5 seconds indefinitely. On low-resource hosts (1 vCPU / 2 GiB), this consumes enough CPU to make SSH and VNC completely unresponsive, requiring a hard reboot.

This is a real-world scenario: fresh npm install -g openclaw@latest + openclaw onboard --install-daemon without completing the configuration wizard leaves gateway.mode unset while the systemd service is already installed and running.

Changes

1. src/daemon/systemd-unit.ts — Add StartLimitBurst=5 and StartLimitIntervalSec=60 to the [Unit] section so systemd stops restarting after 5 failures within 60 seconds. Add RestartPreventExitStatus=78 to the [Service] section so configuration errors are never retried.

2. src/cli/gateway-cli/run.ts — Use EX_CONFIG (exit code 78, from sysexits.h) instead of exit code 1 for configuration guard failures. This lets systemd distinguish misconfigured, don't retry from runtime crash, worth retrying.

3. src/daemon/systemd-unit.test.ts — Add assertions for the new systemd directives.

4. src/cli/gateway-cli/run.option-collisions.test.ts — Update the expected exit code from 1 to 78 for the config-missing guard test.

Testing

• Existing tests updated to cover new behavior
• 4 files changed, 15 insertions(+), 2 deletions(-)
• No refactoring or unrelated changes mixed in

AI Disclosure

• Mark as AI-assisted in the PR title
• Degree of testing: tests updated; CI will validate
• I understand what the code does — the fix uses standard sysexits.h exit codes and well-documented systemd directives
• The bug was encountered firsthand on a real server (Ubuntu 20.04, 1C2G, restart counter reached 27)

Notes

• The RestartSec=5 value was already the project's recommended default; this PR does not change it.
• Existing service-audit.ts already validates RestartSec — the new StartLimit* directives align with that existing audit philosophy.
• Note for existing users: running openclaw gateway install --force after upgrading will regenerate the systemd unit with the new guards.

Changed files

• CHANGELOG.md (modified, +1/-0)
• src/cli/gateway-cli/run.option-collisions.test.ts (modified, +1/-1)
• src/cli/gateway-cli/run.ts (modified, +10/-3)
• src/daemon/systemd-unit.test.ts (modified, +3/-0)
• src/daemon/systemd-unit.ts (modified, +3/-0)