Multi-agent Slack: "Session file path must be within sessions directory" on every DM to non-default

[sour jolt]

Running 2026.2.12. Two agents (main + secondary), each with their own Slack bot app via
channels.slack.accounts. Binding routes the secondary account to the secondary agent. Config is
clean — openclaw agents list --bindings shows correct routing, openclaw channels status --probe
shows the secondary Slack account as running/works.

When I DM the secondary agent's Slack bot, sessions.json gets created correctly under
~/.openclaw/agents/<secondary>/sessions/ with the right sessionFile path — but the agent never
responds. Log shows:

  slack handler failed: Error: Session file path must be within sessions directory

Every single time. The session file path IS within the correct agent's sessions directory, but it
looks like the validation is checking it against the default agent's sessions dir instead.

Tried: CLI wizard (openclaw agents add with --bind), manual config, clearing sessions, full gateway
stop/start. Same result every time.

I think the security hardening in 2026.2.12 ("harden transcript path resolution and reject unsafe
session IDs/file paths") is validating against the wrong agent's sessions directory in multi-account
Slack setups.

Anyone else running multi-agent Slack with separate bot accounts?

[stuck swan]

To help others find answers, you can mark your question as solved via Right click solution message -> Apps -> ✅ Mark Solution

[slender coral]

I don't use slack but I'm getting the same error after upgrading. Sorry I don't know of a fix.

[arctic moth]

Yeah this one isn’t actually Slack-specific.

It’s a regression with multi-agent routing: when a DM gets routed to a non-default agent, some reply/heartbeat paths resolve the transcript using the default agent’s sessions dir, and the newer safety check then throws:

Session file path must be within sessions directory

So you tend to only see it for “non-default channel/agent” routes.

Status: fixed on main (next release) — changelog notes it as “Sessions/Agents … non-default agents … no longer fail with Session file path must be within sessions directory”.

What to do right now

1. Please paste:

• openclaw --version
• a snippet of your bindings / agents.list (redact tokens)

2. Workarounds until the fix ships:

• Temporarily route that DM/channel back to the default agent (remove/adjust the binding) and restart the gateway, or
• If you’re OK running ahead: update to a dev build that includes the fix.

If you share your version + binding, I can tell you which workaround is least painful for your setup.