openclaw - 💡(How to fix) Fix [Bug]: secret-file symlink test fails in infra-state CI

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

Current CI fails in checks-node-core-runtime-infra-state because src/infra/secret-file.test.ts expects the non-throwing secret-file read path to return undefined for a symlink, but @openclaw/fs-safe now throws FsSafeError for the same case.

Steps to reproduce

1. Run CI for a branch based on current main.
2. Observe checks-node-core-runtime-infra-state.
3. The shard fails in src/infra/secret-file.test.ts under readSecretFileSync.

Concrete observed run:

• PR: https://github.com/openclaw/openclaw/pull/82258
• Head: f7f6c275955464221e1565046f094233a9f13366
• Failing job: https://github.com/openclaw/openclaw/actions/runs/26185403697/job/77039419750

Expected behavior

The non-throwing secret-file helper test should match the current @openclaw/fs-safe contract. Either the wrapper should return undefined for the symlink case, or the test should expect the thrown FsSafeError if that is the intended contract.

Actual behavior

checks-node-core-runtime-infra-state fails with one test failure in src/infra/secret-file.test.ts.

OpenClaw version

Current main / CI head around 1a7669bc63a0c3731577465b130873e849fc2773; downstream PR observed at f7f6c275955464221e1565046f094233a9f13366.

Operating system

GitHub Actions Linux runner.

Install method

GitHub Actions CI.

Model

N/A

Provider / routing chain

N/A

Additional provider/model setup details

N/A

Logs, screenshots, and evidence

src/infra/secret-file.test.ts (15 tests | 1 failed)

FAIL  infra src/infra/secret-file.test.ts > readSecretFileSync > 'returns undefined from the non-throwi…'
FsSafeError: Telegram bot token file at /tmp/openclaw-secret-file-test-eGmC5z/dir-6/secret-link.txt must not be a symlink.
  ❯ tryReadSecretFileSync node_modules/@openclaw/fs-safe/dist/secret-file.js:147:11
  ❯ src/infra/secret-file.test.ts:145:12

Test Files 1 failed | 233 passed (234)
Tests 1 failed | 3291 passed | 5 skipped (3297)

Impact and severity

Affected: PRs based on current main that run checks-node-core-runtime-infra-state. Severity: Medium; blocks otherwise unrelated PRs from going green. Frequency: Observed on the current Slack PR CI run after rebasing/merging current main. Consequence: unrelated PRs inherit a red infra-state check.

Additional information

I searched for an existing direct tracker using these terms and did not find one: secret-file.test.ts, readSecretFileSync, tryReadSecretFileSync, must not be a symlink, and Telegram bot token file.

Closest related PR found: #84631 (Patch/fs safe 0.2.6 integration), but its own current infra-state failure is in src/infra/archive.test.ts, while src/infra/secret-file.test.ts passes there, so this appears to need separate triage or a follow-up fix.