Skip to content

[Bug]: Multi-agent setup: "Session file path must be within sessions directory" error #15410

@haitran1922

Description

@haitran1922

When using multiple agents with different workspaces (e.g., main and family agents), sessions fail with error:
Error: Session file path must be within sessions directory
Root Cause:

The resolveSessionFilePath() function in several modules doesn't receive the agentId parameter, causing it to default to the main agent's sessions directory. When a session belongs to a different agent (e.g., family), the absolute path validation fails.

This appears to be a regression introduced by the security hardening in v2026.2.12 (transcript path resolution improvements).

Affected Files:

• loader-DsT_r87T.js (lines ~36546, ~42080)
• extensionAPI.js (lines ~20051-20053, ~20145, ~20683, ~23716, ~23046-23047, ~23117, ~24027, ~38423)
• pi-embedded-DY_lx0y_.js (similar locations)
• reply-SjB6cawm.js (similar locations)
Steps to Reproduce:

  1. Configure multiple agents in openclaw.json:
    {
    "agents": {
    "list": [
    { "id": "main", "workspace": "/data/workspace" },
    { "id": "family", "workspace": "/data/workspace-family" }
    ]
    },
    "bindings": [
    {
    "agentId": "family",
    "match": {
    "channel": "telegram",
    "peer": { "kind": "group", "id": "-123456789" }
    }
    }
    ]
    }
  2. Send a message to the bound group chat
  3. Error occurs in Telegram handler
    Expected Behavior:
    Session files should resolve to the correct agent's sessions directory.

Actual Behavior:
Error: Session file path must be within sessions directory

Workaround Applied:

Modified calls to resolveSessionFilePath() to pass { agentId } or { agentId: params.agentId }:

Example:
// Before
const sessionFile = resolveSessionFilePath(sessionIdFinal, sessionEntry);

// After
const sessionFile = resolveSessionFilePath(sessionIdFinal, sessionEntry, { agentId });
Also updated readUsageFromSessionLog() signature to accept and pass agentId.

Environment:

• OpenClaw version: 2026.2.12
• OS: Debian 12 (Railway container)
• Node: v22.22.0
Additional Context:
This affects all multi-agent setups where agents have different workspaces and sessions are bound to specific agents via bindings.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions