Summary

resolveSessionFilePath(sessionIdFinal, sessionEntry) is called without agentId in the reply dispatch path, causing all sub-agent (multi-agent agents.list[]) inbound messages to fail with "Session file path must be within sessions directory". The session transcript path is validated against the main agent's sessions directory instead of the sub-agent's own directory.

Steps to reproduce

1. Configure multiple agents via agents.list[] in openclaw.yaml (e.g., commerce, socialmedia)
2. Bind sub-agents to channel rooms (tested with Nextcloud Talk, but affects all channels)
3. Send a message to a sub-agent's room/conversation
4. The webhook is received, session key resolves correctly (e.g., agent:commerce:nextcloud-talk:group:xyz)
5. resolveSessionFilePath is called without { agentId } in the 3rd parameter
6. Error: Session file path must be within sessions directory

Expected behavior

Sub-agent sessions should resolve their transcript paths relative to their own sessions directory (~/.openclaw/agents/<agentId>/sessions/), not the main agent's.

Actual behavior

All sub-agent inbound messages fail with:

[nextcloud-talk:default] webhook error: Session file path must be within sessions directory

The main agent works fine. Only agents defined in agents.list[] are affected.

OpenClaw version

2026.2.12

Operating system

Ubuntu 24.04 (x64)

Install method

npm global

Logs, screenshots, and evidence

Gateway log showing the error on each sub-agent webhook:

14:41:28 [nextcloud-talk:default] webhook error: Session file path must be within sessions directory
14:41:29 [nextcloud-talk:default] webhook error: Session file path must be within sessions directory
14:41:30 [nextcloud-talk:default] webhook error: Session file path must be within sessions directory

Impact and severity

Affected: All users with multi-agent setups (agents.list[]) on any channel
Severity: Critical — sub-agents are completely non-functional, cannot process any inbound messages
Frequency: 100% reproducible on every message to a sub-agent
Consequence: Sub-agents silently fail; no error visible to the user sending the message

Additional information

Root cause

In the reply dispatch code (reply-*.js), resolveSessionFilePath is called at three locations without passing agentId:

// Broken (current):
const sessionFile = resolveSessionFilePath(sessionIdFinal, sessionEntry);

// Fixed:
const sessionFile = resolveSessionFilePath(sessionIdFinal, sessionEntry, { agentId });

resolveSessionFilePath → resolveSessionsDir(opts) → resolveAgentSessionsDir(undefined) → returns main agent's dir. The sub-agent's sessionEntry.sessionFile (absolute path in ~/.openclaw/agents/<agentId>/sessions/) fails validation against the main agent's sessions dir.

The same pattern exists in: reply-*.js, pi-embedded-*.js, loader-*.js, extensionAPI.js.

The agentId variable IS in scope at all affected call sites, just not passed.

Workaround

Patch compiled JS bundles:

for f in dist/*.js; do
  sed -i 's/resolveSessionFilePath(sessionIdFinal, sessionEntry);/resolveSessionFilePath(sessionIdFinal, sessionEntry, { agentId });/g' "$f"
done

Must be reapplied after each update.