Bug type

Behavior bug (incorrect output/state without crash)

Summary

Description:

Bug

When sending media files via the message tool on the Mattermost channel, file attachments are silently dropped — only the text caption is posted. The message tool returns a success response, but no file is actually uploaded to Mattermost.

Root Cause

In extensions/mattermost/src/mattermost/send.ts line 179, loadWebMedia is called without passing localRoots:

const media = await core.media.loadWebMedia(mediaUrl);

This causes it to fall back to getDefaultMediaLocalRoots(), which explicitly excludes workspace-* directories (via the check rel.split(path.sep)[0].startsWith("workspace-")). As a result, any media file located in an agent workspace (e.g. ~/.openclaw/workspace-server/image.png) fails the path allowlist check.

The error is then caught silently (lines 188-191) and the send degrades to a text-only message without any indication of failure:

} catch (err) {
  uploadError = err instanceof Error ? err : new Error(String(err));
  // ...
  message = normalizeMessage(message, isHttpUrl(mediaUrl) ? mediaUrl : "");
}

Since agent workspace paths are not HTTP URLs, the fallback doesn't even append the path as text — the media is completely lost.

Suggested Fix

Pass mediaLocalRoots through the sendMedia call chain and into loadWebMedia:

const media = await core.media.loadWebMedia(mediaUrl, { localRoots: mediaLocalRoots });

Additionally, the silent fallback behavior should probably surface a warning or error to the caller instead of silently dropping attachments.

Workaround

Copy files to ~/.openclaw/media/ before sending — this directory is in the default allowlist and works correctly.

Environment

OpenClaw with Mattermost plugin (@openclaw/mattermost)
Multi-agent setup with per-agent workspaces (workspace-*)

Steps to reproduce

Configure a Mattermost channel with a bot
From an agent with a workspace (e.g. workspace-server), use the message tool to send a file:

message action=send media=/path/to/.openclaw/workspace-server/file.png target=user:<id>

Tool returns success, but only the text caption appears in Mattermost — no file attachment

Expected behavior

loadWebMedia should receive mediaLocalRoots (which includes the agent's workspace directory via getAgentScopedMediaLocalRoots), consistent with how other channels (Discord, etc.) handle media sends.

Actual behavior

Since agent workspace paths are not HTTP URLs, the fallback doesn't even append the path as text — the media is completely lost.

OpenClaw version

2026.2.26

Operating system

macOS

Install method

npm

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response