openclaw - 💡(How to fix) Fix STT regression: audio preflight transcription fails with "Command failed" between v2026.5.7 and v2026.5.12

Description

After upgrading from v2026.5.7 to v2026.5.12, voice message transcription (STT) via whisper-cli fails silently. The agent receives <media:audio> with no transcript and falls back to attempting manual whisper execution.

Log output

warn media-understanding audio: failed (0/1) reason=Command failed

This appears twice per voice message (once for preflight, once for the main media understanding pass).

Observations

• All openclaw-media-cli-* temp directories are empty after processing — no .wav files, no partial ffmpeg output
• The only change in the audio transcription pipeline between these versions is that resolveCliMediaPath in runner.entries.ts now wraps the ffmpeg WAV conversion in writeExternalFileWithinRoot (from @openclaw/fs-safe), using an atomic temp-file-then-rename pattern
• Previously, ffmpeg wrote directly to the output path
• The senderAllowedForAudioPreflight change (switching from isSenderAllowed to the full ingress authorization chain) is a red herring for DMs — the preflight condition is always satisfied for direct messages regardless of that flag

STT config

{
  "audio": {
    "enabled": true,
    "maxBytes": 20971520,
    "models": [
      {
        "type": "cli",
        "command": "whisper-cli",
        "args": [
          "-m",
          "/opt/whisper-models/ggml-base.en.bin",
          "-f",
          "{{MediaPath}}",
          "-np",
          "-nt"
        ],
        "timeoutSeconds": 45
      }
    ]
  }
}

Likely cause

The writeExternalFileWithinRoot wrapper in resolveCliMediaPath appears to throw during path validation (possibly assertNoSymlinkParents or the atomic rename step), preventing ffmpeg from producing the WAV file. Without the WAV conversion, whisper-cli receives no valid input and exits with "Command failed".

Reproduction

1. Configure whisper-cli as the STT provider
2. Send a voice message via Telegram DM on v2026.5.12
3. Observe "Command failed" in logs and empty temp directories

Workaround

Downgrade to v2026.5.7.

Issue submitted by civil's clanker 🤖