test(image): cover OpenClaw writable state symlinks

[cursor]

Summary

Adds a focused regression test for the Docker base-image OpenClaw writable-state layout. The test pins the EACCES-prone runtime paths added in the recent image fix: exec-approvals.json, telegram/, and credentials/.

Risky behavior now covered:

• OpenClaw runtime-writable state must be created under /sandbox/.openclaw-data.
• Immutable /sandbox/.openclaw must expose those state paths via symlinks instead of unwritable direct paths.

Test files added/updated:

• test/dockerfile-base.test.js

Why these tests materially reduce regression risk:

• The base image is rebuilt on merges touching Dockerfile.base; a missed symlink silently breaks runtime persistence with EACCES in sandboxed agents.
• This static regression test is deterministic, fast, and catches accidental removal/renaming of the exact writable-state contracts without building Docker images.

Related Issue

• Fixes OpenClaw GatewayRequestError — EACCES permission denied NVIDIA/NemoClaw#1027
• Refs Telegram channel setup fails: EACCES on /sandbox/.openclaw/telegram due to root-owned overlayfs layers NVIDIA/NemoClaw#975
• Refs Error: EACCES: permission denied - Models , Whatsapp & Telegram NVIDIA/NemoClaw#1114

Changes

• Add a root-level Vitest test that validates Dockerfile.base creates and links the runtime-writable OpenClaw state paths.

Type of Change

• Code change for a new feature, bug fix, or refactor.
• Code change with doc updates.
• Doc only. Prose changes without code sample modifications.
• Doc only. Includes code sample changes.

Testing

• npx prek run --all-files passes (or equivalently make check).
• npm test passes.
• make docs builds without warnings. (for doc-only changes)

Focused validation run:

• ./node_modules/.bin/vitest run --project cli test/dockerfile-base.test.js passes (3 tests).

Notes:

• Full npm test/make check were not run; this PR only adds a focused static regression test.
• VM has Node v22.14.0 while repo requires >=22.16.0; validation required npm install --include=dev --ignore-scripts after the repo prepare script pruned dev tools.
• No Aikido or Opsera scan MCP tool/skill was available in this environment.

Checklist

General

• I have read and followed the contributing guide.
• I have read and followed the style guide. (for doc-only changes)

Code Changes

• Formatters applied — npx prek run --all-files auto-fixes formatting (or make format for targeted runs).
• Tests added or updated for new or changed behavior.
• No secrets, API keys, or credentials committed.
• Doc pages updated for any user-facing behavior changes (new commands, changed defaults, new features, bug fixes that contradict existing docs).

Doc Changes

• Follows the style guide. Try running the update-docs agent skill to draft changes while complying with the style guide. For example, prompt your agent with "/update-docs catch up the docs for the new changes I made in this PR."
• New pages include SPDX license header and frontmatter, if creating a new page.
• Cross-references and links verified.

---

Signed-off-by: Cursor Agent cursoragent@cursor.com