Summary

OpenClaw browser upload rejects files that are already inside the allowed uploads directory (/tmp/openclaw/uploads) with an invalid-path error.

Steps to reproduce

1. mkdir -p /tmp/openclaw/uploads
2. cp ~/Downloads/some-image.png /tmp/openclaw/uploads/porcupine_final.png
3. Attach a Chrome relay tab with
4. Run:
   openclaw browser --browser-profile chrome upload /tmp/openclaw/uploads/porcupine_final.png --target-id --input-ref
5. Observe: Error: Invalid path: must stay within uploads directory (/tmp/openclaw/uploads)

Also fails with relative path from upload dir:
cd /tmp/openclaw/uploads
openclaw browser --browser-profile chrome upload porcupine_final.png --target-id --input-ref

Expected behavior

Any regular file inside /tmp/openclaw/uploads should be accepted and attached to the target file input.

Actual behavior

Upload is blocked with: "Invalid path: must stay within uploads directory (/tmp/openclaw/uploads)" even though file exists and is under that directory.

OpenClaw version

2026.2.21-2

Operating system

macOS Darwin 25.3.0 (arm64)

Install method

Homebrew npm global + LaunchAgent gateway

Logs, screenshots, and evidence

CLI output:
Error: Invalid path: must stay within uploads directory (/tmp/openclaw/uploads)

File confirmed present:
ls -l /tmp/openclaw/uploads/porcupine_final.png

Gateway status healthy:
openclaw gateway status -> RPC probe: ok

Impact and severity

Affected: Browser automation users that need file attachments (social posting, uploads, forms)
Severity: High (blocks end-to-end automation workflows)
Frequency: 100% reproducible in this environment
Consequence: Human has to manually pick files; automation cannot complete fully

Additional information

Potentially related to path normalization/root handling in resolveExistingPathsWithinRoot + DEFAULT_UPLOAD_DIR. Browser control otherwise works (tabs/snapshot/click/type). Gateway restart did not resolve.