Bug Description

When using multi-agent routing with WhatsApp bindings, inbound DM messages routed to a non-default agent fail with:

Error: Session file path must be within sessions directory

Root Cause

The validateSessionId() function in paths-*.js uses this regex:

const SAFE_SESSION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/i;

However, WhatsApp DM routing generates session keys like:

• agent:wa-relay:whatsapp:+573144849423

These contain : and + characters which are rejected by the regex. The system generates session IDs that its own validation rejects.

Steps to Reproduce

1. Configure multi-agent routing with a non-default agent bound to WhatsApp:

{
  agents: {
    list: [
      { id: "main", default: true },
      { id: "wa-relay", name: "WA Relay", workspace: "~/.openclaw/workspace-wa-relay" }
    ]
  },
  bindings: [
    { agentId: "main", match: { channel: "whatsapp", peer: { kind: "direct", id: "+15551234567" } } },
    { agentId: "wa-relay", match: { channel: "whatsapp" } }
  ]
}

2. Have a third-party WhatsApp contact send a message
3. The message is correctly routed to wa-relay but fails at session creation

Expected Behavior

The session ID should be sanitized (e.g., replacing : with _ and + with p) before path validation, or the regex should be expanded to accept the characters that the routing system generates.

Environment

• OpenClaw: 2026.2.12
• OS: macOS (arm64)
• Channel: WhatsApp

Logs

info gateway/channels/whatsapp/inbound  Inbound message +573144849423 -> +573175499453 (direct, 117 chars)
error web-inbound  {"error":"Error: Session file path must be within sessions directory"} failed handling inbound web message