Description

In version 2026.2.12, resolveSessionFilePath() is called without passing agentId in the opts parameter at three call sites in loader-BpQdnOY1.js. This causes all non-default agents (any agent that isn't "main") to fail on every inbound Telegram message with:

Error: Session file path must be within sessions directory
    at resolvePathWithinSessionsDir (paths-mF4iWwgm.js:38:68)
    at resolveSessionFilePath (paths-mF4iWwgm.js:52:24)
    at runPreparedReply (loader-BpQdnOY1.js:42047:22)

The error fires on every inbound message, completely blocking all communication for the affected agent.

Root Cause

resolveSessionFilePath(sessionId, entry, opts) calls resolveSessionsDir(opts) which falls back to resolveAgentSessionsDir(opts?.agentId). Without agentId, it defaults to DEFAULT_AGENT_ID = "main", resolving to ~/.openclaw/agents/main/sessions/.

When a non-default agent (e.g. agent "vera") has a sessionFile that is an absolute path like ~/.openclaw/agents/vera/sessions/<uuid>.jsonl, the security check in resolvePathWithinSessionsDir computes:

path.relative("/agents/main/sessions/", "/agents/vera/sessions/file.jsonl")
  = "../../vera/sessions/file.jsonl"

This starts with .. → security check rejects it.

Affected Call Sites

All three are in loader-BpQdnOY1.js:

1. Line 42047 (runPreparedReply) — CRITICAL, blocks all messages

   // Current (broken):
   const sessionFile = resolveSessionFilePath(sessionIdFinal, sessionEntry);
   // Fix:
   const sessionFile = resolveSessionFilePath(sessionIdFinal, sessionEntry, { agentId });

   Note: agentId is already destructured from params at line 41915.

2. Line 36513 (compaction path)

   // Current (broken):
   sessionFile: resolveSessionFilePath(sessionId, params.sessionEntry),
   // Fix:
   sessionFile: resolveSessionFilePath(sessionId, params.sessionEntry, { agentId: params.agentId }),

   params.agentId is available (used at line 36502).

3. Line 17582 (readUsageFromSessionLog) — stats function, less critical but still throws

Reproduction

1. Configure any agent with an ID other than "main" (e.g. "vera")
2. Bind it to a Telegram bot
3. Send a message to the bot
4. Gateway logs show the error on every message; agent never responds

Version

• OpenClaw: 2026.2.12
• Node: 22.22.0
• Previous working version: 2026.2.9

Workaround

Monkey-patch the three call sites in dist/loader-BpQdnOY1.js to pass { agentId } as described above.