-
-
Notifications
You must be signed in to change notification settings - Fork 52.7k
Description
When using multiple agents with different workspaces (e.g., main and family agents), sessions fail with error:
Error: Session file path must be within sessions directory
Root Cause:
The resolveSessionFilePath() function in several modules doesn't receive the agentId parameter, causing it to default to the main agent's sessions directory. When a session belongs to a different agent (e.g., family), the absolute path validation fails.
This appears to be a regression introduced by the security hardening in v2026.2.12 (transcript path resolution improvements).
Affected Files:
• loader-DsT_r87T.js (lines ~36546, ~42080)
• extensionAPI.js (lines ~20051-20053, ~20145, ~20683, ~23716, ~23046-23047, ~23117, ~24027, ~38423)
• pi-embedded-DY_lx0y_.js (similar locations)
• reply-SjB6cawm.js (similar locations)
Steps to Reproduce:
- Configure multiple agents in openclaw.json:
{
"agents": {
"list": [
{ "id": "main", "workspace": "/data/workspace" },
{ "id": "family", "workspace": "/data/workspace-family" }
]
},
"bindings": [
{
"agentId": "family",
"match": {
"channel": "telegram",
"peer": { "kind": "group", "id": "-123456789" }
}
}
]
} - Send a message to the bound group chat
- Error occurs in Telegram handler
Expected Behavior:
Session files should resolve to the correct agent's sessions directory.
Actual Behavior:
Error: Session file path must be within sessions directory
Workaround Applied:
Modified calls to resolveSessionFilePath() to pass { agentId } or { agentId: params.agentId }:
Example:
// Before
const sessionFile = resolveSessionFilePath(sessionIdFinal, sessionEntry);
// After
const sessionFile = resolveSessionFilePath(sessionIdFinal, sessionEntry, { agentId });
Also updated readUsageFromSessionLog() signature to accept and pass agentId.
Environment:
• OpenClaw version: 2026.2.12
• OS: Debian 12 (Railway container)
• Node: v22.22.0
Additional Context:
This affects all multi-agent setups where agents have different workspaces and sessions are bound to specific agents via bindings.