329 commits: memory vector search, browser surface, docker sandbox binds

Signal

329 commits to openclaw across 2 sessions totaling 35 minutes. Memory vector search, expanded browser control surface, docker bind mount sandboxing, apply_patch tool, and voice-call plugin parity all landed on the same day.

Context

Yesterday’s plugin architecture is already paying for itself. With providers behind a seam, today’s push is about what the runtime can now reach. Memory, browser, sandbox filesystem, and patch application are four distinct capability surfaces, and they all ship in the same window because the new plugin boundary makes them addable without a core rewrite. The day before that was the OpenAI-compatible gateway. The day after that (January 13) is release prep for the 2026.1.14 cut, so today is the last free day to land new surface area before the cadence tightens.

Evidence

329 commits, 50,463 additions, 18,742 deletions in openclaw. Sandboxing: Add docker bind mounts for sandboxing, test(sandbox): add coverage for binds -v flag emission. Memory: feat: add memory vector search. Browser: feat(browser): expand browser control surface, feat(cli): expand browser commands. Exec-gated tooling: feat: add apply_patch tool (exec-gated). Session handling: fix: reset session after compaction overflow, fix: restore heartbeat defaults and model listing. 2 sessions across 2 projects, 35 minutes total, $2.99 cost.

So What

50,463 additions on a day with only 35 session minutes means large automated or generated blocks landed in this push. That’s fine, but it means the manual-review surface is thinner than the commit count suggests. The interesting number is the deletion count against the change locations, not the LOC headline. The docker bind mount sandboxing plus the exec-gated apply_patch tool together define a trust boundary. Openclaw can now run guest code inside a contained filesystem with explicit controls on what patches get applied. That is a meaningful security posture change for an agent runtime, and it shows up quietly in the commit list without a flagship feature name. Memory vector search is the one that changes behavior, not just safety. An agent with search over its own history starts to make different decisions than one without, because it can refer back to prior turns without the user re-pasting. That is a shift in capability, not just convenience.

What’s Next

Memory vector search shipped but no retrieval interface is named in the commit list. Is search accessible through the CLI surface or only through the gateway endpoint? If CLI, then every install gets it; if gateway-only, then the feature is effectively hosted. That distinction will matter the first time someone asks why their local agent forgot something the hosted one remembered.

The compaction-overflow session reset is the other line worth watching. That commit is terse but it points at a real failure mode: long-running sessions were hitting a compaction threshold, losing state during compaction, and not recovering cleanly afterward. Resetting on overflow is a defensive fix; the real improvement would be compaction that preserves the working set across the boundary. Whether that lands in the next week of commits is the signal on how serious the observed pain was.

The heartbeat/model-listing restore is a small commit with an interesting implication. Defaults got shifted somewhere in the last week’s churn, and the fix walked them back. This is the shape of a fast-moving codebase: reasonable changes accumulate, and every so often someone has to go back and re-assert the defaults that the changes silently moved. One such commit per week is normal hygiene; more than that is a sign that the defaults aren’t well-enough defended.

The exec-gated apply_patch tool deserves one more line. “Exec-gated” means the tool runs through the same gate that protects shell execution, which is the right answer for anything that mutates files on the host. The wrong answer would have been to give apply_patch its own permission model; that would have meant two gates to audit and two places for a misconfiguration to hide. One gate, one audit path, one mental model is the right shape.

Log

• Sessions: 2 across 2 projects, 35m total
• Top projects: awwh (22m), openclaw (13m)
• Commits: 329 across 1 repos (50463 +, 18742 -)
• Top repo: openclaw (329 commits)
• Cost: $2.99