Bug Report: Session File Path Validation Failure

Environment

• OpenClaw Version: 2026.2.12
• OS: Windows 11 Pro 10.0.26200
• Node Version: 22.22.0
• Installation Method: npm global install

Description

Session file path validation fails when heartbeat or Telegram handler attempts to access session files, causing:

1. Heartbeat failures
2. Telegram message handler crashes
3. Bot unable to respond to messages

Error Messages

[heartbeat] failed: Session file path must be within sessions directory
[telegram] handler failed: Error: Session file path must be within sessions directory

Reproduction Steps

1. Configure agents with heartbeat enabled in agents.defaults.heartbeat
2. Configure Telegram bot integration
3. Send message to Telegram bot or wait for heartbeat trigger
4. Observe error in logs

Configuration

Agents configuration:

{
  "agents": {
    "defaults": {
      "workspace": "C:\\Users\\admin\\.openclaw\\workspace",
      "heartbeat": {
        "every": "10m",
        "model": "newapi/deepseek-v3.2"
      }
    },
    "list": [
      {
        "id": "main",
        "default": true,
        "model": "anthropic/claude-opus-4-6"
      },
      {
        "id": "goldclaw",
        "workspace": "C:\\Users\\admin\\.openclaw\\workspace-goldclaw",
        "agentDir": "C:\\Users\\admin\\.openclaw\\agents\\goldclaw\\agent",
        "model": "anthropic/claude-opus-4-6",
        "heartbeat": {
          "every": "10m"
        }
      }
    ]
  }
}

Actual Session File Path

Session files are correctly located in the sessions directory:

C:\Users\admin\.openclaw\agents\main\sessions\b55b02f8-8ffa-4dc7-8d62-d3725b74f706.jsonl

sessions.json content:

{
  "agent:main:main": {
    "sessionFile": "C:\\Users\\admin\\.openclaw\\agents\\main\\sessions\\b55b02f8-8ffa-4dc7-8d62-d3725b74f706.jsonl",
    ...
  }
}

Expected Behavior

• Session path validation should pass since file is within sessions directory
• Heartbeat should complete successfully
• Telegram handler should process messages without crashing

Actual Behavior

• Path validation fails despite correct path
• Heartbeat crashes with session path error
• Telegram handler crashes, preventing bot from responding
• Error appears in both gateway heartbeat and telegram channel handler

Impact

• Critical: Telegram bot completely non-functional
• High: Heartbeat feature unusable
• Affects all users with multi-agent setups and Telegram integration

Workaround

Temporarily disable heartbeat in configuration:

{
  "agents": {
    "defaults": {
      // Remove heartbeat configuration
    }
  }
}

However, even with heartbeat disabled, Telegram handler still occasionally fails with the same error.

Logs

2026-02-13T02:47:24.000Z error gateway/heartbeat {"subsystem":"gateway/heartbeat"} {"error":"Session file path must be within sessions directory"} heartbeat failed: Session file path must be within sessions directory

2026-02-13T02:51:09.000Z error gateway/channels/telegram {"subsystem":"gateway/channels/telegram"} handler failed: Error: Session file path must be within sessions directory

2026-02-13T02:57:24.582Z error gateway/heartbeat {"subsystem":"gateway/heartbeat"} {"error":"Session file path must be within sessions directory"} heartbeat failed: Session file path must be within sessions directory

2026-02-13T02:57:45.987Z error gateway/channels/telegram {"subsystem":"gateway/channels/telegram"} handler failed: Error: Session file path must be within sessions directory

Suspected Root Cause

Session path validation logic in 2026.2.12 appears to have incorrect path comparison/normalization, possibly:

• Windows path separator handling (backslash vs forward slash)
• Absolute vs relative path comparison
• Path normalization before validation

Additional Context

• Issue appeared after updating from 2026.2.9 to 2026.2.12
• Multiple agents configured (9 total: main + 7 workers + goldclaw)
• Both Telegram and WhatsApp channels enabled
• Session files physically exist and are readable

System Information

Directory structure:
C:\Users\admin\.openclaw\
├── agents\
│   ├── main\
│   │   ├── agent\
│   │   └── sessions\
│   │       ├── sessions.json
│   │       └── [session-id].jsonl
│   ├── goldclaw\
│   │   ├── agent\
│   │   └── sessions\
│   └── worker1-7\ (similar structure)
└── openclaw.json

Reporter: Goldenmonstew ([email protected])
Date: 2026-02-13
Urgency: High (bot non-functional)