Summary

When a non-default agent uses the message tool to send local media (e.g., an image via Telegram), the delivery fails with LocalMediaAccessError: Local media path is not under an allowed directory — even though the agent's workspace config correctly includes the media path.

In sendMessage(), when deliveryMode === "gateway", the callMessageGateway call does not include agentId in its RPC params. The gateway handler falls back to resolveSessionAgentId({ config: cfg }) without a session key, which returns the default agent ID. getAgentScopedMediaLocalRoots() then builds media roots from the default agent's workspace instead of the sending agent's workspace.

The direct delivery path (deliveryMode !== "gateway") correctly passes agentId: params.agentId. The gateway path does not.

Steps to reproduce

1. Configure two agents: main (default, workspace A) and oscar (workspace B)
2. Both agents on Telegram with separate bot accounts
3. Send a message to oscar in a Telegram group asking it to send a local image from workspace B
4. Oscar's LLM calls the message tool with a media path under workspace B
5. Fails with LocalMediaAccessError

Expected behavior

getAgentScopedMediaLocalRoots() should receive Oscar's agentId, include workspace B in the allowed roots, and the media send should succeed.

Actual behavior

getAgentScopedMediaLocalRoots() receives no agentId (or the default agent's ID), only includes workspace A in the allowed roots, and the media send is rejected.

OpenClaw version

2026.2.21-2

Operating system

OpenClaw 2026.2.21-2, macOS 13.7.8, Node.js v22.22.0, Telegram channel, multi-agent config with separate workspaces and bot accounts

Install method

No response

Logs, screenshots, and evidence

OpenClaw 2026.2.21-2, macOS 13.7.8, Node.js v22.22.0, Telegram channel, multi-agent config with separate workspaces and bot accounts

Impact and severity

No response

Additional information

Two changes needed:

1. Add agentId: params.agentId to the callMessageGateway RPC params in sendMessage()
2. In the gateway "send" handler, prefer request.agentId over the derived default: agentId: request.agentId ?? (providedSessionKey ? resolveSessionAgentId(...) : derivedAgentId)