Summary

When agents.list defines non-default agents (e.g. host-cron, coding) but does NOT explicitly include the implicit main agent, all inbound channel messages (Telegram, Slack, WhatsApp) fail with Session file path must be within sessions directory. The main agent exists implicitly as the code default (DEFAULT_AGENT_ID = "main") and has a working sessions directory at ~/.openclaw/agents/main/sessions/, but the session path validation in resolvePathWithinSessionsDir() rejects absolute sessionFile paths from other agents when resolved against the main agent's sessions directory. Related to #15141 which was fixed in 2026.2.13, but the root cause (implicit vs explicit agent registration) persists.

Steps to reproduce

1. Configure agents.list with a non-default agent (e.g. host-cron) but do NOT include main in the list:

"agents": {
  "list": [
    { "id": "host-cron", "name": "Host Cron Runner", "workspace": "~/.openclaw/workspace" }
  ]
}

2. Enable Telegram (or any channel) with dmPolicy: "allowlist"
3. Send a DM to the bot from an allowed user
4. Observe error in logs: [telegram] handler failed: Error: Session file path must be within sessions directory
5. The bot receives the message (shows read receipts) but never responds

Expected behavior

Inbound channel messages should be processed and the agent should respond, regardless of whether main is explicitly listed in agents.list. The implicit main agent should work the same as an explicitly registered one for session path resolution.

Actual behavior

Every inbound Telegram message fails with:

[telegram] handler failed: Error: Session file path must be within sessions directory

The bot shows read receipts (eyes emoji) but never responds. The error occurs because resolvePathWithinSessionsDir() resolves the non-default agent's absolute sessionFile path against the main agent's sessions directory. For example, /Users/user/.openclaw/agents/host-cron/sessions/abc123.jsonl resolved against /Users/user/.openclaw/agents/main/sessions/ produces a relative path starting with ../ which fails the security check.

Adding main explicitly to agents.list resolves the issue immediately.

OpenClaw version

2026.2.12 and 2026.2.13

Operating system

macOS 26.2 (arm64) - Mac mini M4

Install method

npm global

Logs, screenshots, and evidence

2026-02-14T12:30:57.855Z [telegram] handler failed: Error: Session file path must be within sessions directory
2026-02-14T12:36:31.649Z [telegram] handler failed: Error: Session file path must be within sessions directory
2026-02-14T13:48:07.670Z [telegram] handler failed: Error: Session file path must be within sessions directory


The error fires on every inbound Telegram DM. The bot receives the message (shows read receipts/eyes emoji) but never processes or responds.

Config at time of error:

"agents": {
  "list": [
    { "id": "host-cron", "name": "Host Cron Runner", "workspace": "/Users/angus/.openclaw/workspace" },
    { "id": "coding", "name": "Coding Agent" }
  ]
}

Note: `main` is NOT in the list. Adding it fixes the issue:

{ "id": "main", "name": "Main Agent", "workspace": "/Users/angus/.openclaw/workspace" }

Impact and severity

• Affected: Any multi-agent setup where main is not explicitly in agents.list but other agents are. Affects all channel types (Telegram confirmed, likely WhatsApp/Slack/Discord too based on [Bug] Session file path validation failure in v2026.2.12 causing Telegram handler crashes #15141 and Multi-agent routing: session ID validation rejects auto-generated WhatsApp DM session keys #16211).
• Severity: Critical. The bot is completely non-functional for inbound messages. It can still send outbound but cannot receive or respond.
• Frequency: 100% reproducible. Every single inbound message fails.
• Consequence: Total loss of bot responsiveness. Users see read receipts but get no reply. Difficult to diagnose because openclaw doctor and openclaw status both report Telegram as OK.

Additional information

• Related issues: [Bug] Session file path validation failure in v2026.2.12 causing Telegram handler crashes #15141 (fixed in 2026.2.13), fix: pass agentId to resolveSessionFilePath for multi-agent path validation #15103, Multi-agent routing: session ID validation rejects auto-generated WhatsApp DM session keys #16211
• Discord thread with workaround: https://www.answeroverflow.com/m/1471729228897587324
• The [Bug] Session file path validation failure in v2026.2.12 causing Telegram handler crashes #15141 fix in 2026.2.13 passes agentId to session resolution, which helps but does not cover the case where main is implicit (not in agents.list). When main is missing from the list, some code paths still fall back to DEFAULT_AGENT_ID = "main" without properly resolving its sessions directory.
• Workaround: Add main explicitly to agents.list in openclaw.json.
• Alternative workaround (from Discord): Set session.store: "~/.openclaw/agents/{agentId}/sessions/sessions.json" to force per-agent store resolution.
• Suggestion: Either auto-register main when it's not in the list, or openclaw doctor should warn when main is missing from agents.list in a multi-agent setup.