Bug
The message tool's media path validation uses getDefaultMediaLocalRoots() instead of getAgentScopedMediaLocalRoots(), so files under the agent's configured workspace directory are rejected with LocalMediaAccessError: path-not-allowed.
Reproduction
- Agent workspace:
/home/rav/clawd (configured in agents.defaults.workspace)
- File to send:
/home/rav/clawd/daycare-enrolment-form.html
- Channel: WhatsApp
- Result:
Local media path is not under an allowed directory
Expected
getAgentScopedMediaLocalRoots(cfg, agentId) in src/media/local-roots.ts already appends the agent workspace to the allowed roots. But the message/send tool path doesn't call it — it uses getDefaultMediaLocalRoots() which only includes ~/.openclaw/media, ~/.openclaw/agents, ~/.openclaw/workspace, ~/.openclaw/sandboxes, and the preferred tmp dir.
Workaround
Copy files to ~/.openclaw/media/outbound/ before sending.
Version
OpenClaw 2026.3.2 (85377a2)
Bug
The
messagetool's media path validation usesgetDefaultMediaLocalRoots()instead ofgetAgentScopedMediaLocalRoots(), so files under the agent's configured workspace directory are rejected withLocalMediaAccessError: path-not-allowed.Reproduction
/home/rav/clawd(configured inagents.defaults.workspace)/home/rav/clawd/daycare-enrolment-form.htmlLocal media path is not under an allowed directoryExpected
getAgentScopedMediaLocalRoots(cfg, agentId)insrc/media/local-roots.tsalready appends the agent workspace to the allowed roots. But the message/send tool path doesn't call it — it usesgetDefaultMediaLocalRoots()which only includes~/.openclaw/media,~/.openclaw/agents,~/.openclaw/workspace,~/.openclaw/sandboxes, and the preferred tmp dir.Workaround
Copy files to
~/.openclaw/media/outbound/before sending.Version
OpenClaw 2026.3.2 (85377a2)