openclaw - 💡(How to fix) Fix [Bug]: x-openclaw-session-key header bypasses agentId resolution

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

When an HTTP client sends x-openclaw-session-key header, OpenClaw’s resolveSessionKey() (in http-utils-GEkok2ix.js line 60) returns the literal header value directly, bypassing buildAgentMainSessionKey() entirely. This causes the correct agentId (resolved from either x-openclaw-agent-id header or model field) to be discarded — all requests fall back to agent:main.

Steps to reproduce

1. Start OpenClaw Gateway (2026.5.22)
2. Send a POST to /v1/chat/completions with:
   • Header: x-openclaw-session-key: my-chat-id
   • Body: {"model": "openclaw/xiaoxia", "messages": [{"role": "user", "content": "What is your agent id?"}]}
3. Observe that the response comes from agent "main" instead of "xiaoxia"
4. Remove the x-openclaw-session-key header and repeat — agent correctly routes to "xiaoxia"

Expected behavior

When x-openclaw-session-key is provided, the resolved agentId (from model field or x-openclaw-agent-id header) should still be used to construct the session key.

For example:

• Header: x-openclaw-session-key: my-chat-id
• Model: openclaw/xiaoxia
• Expected session key: agent:xiaoxia:my-chat-id

Proposed fix in resolveSessionKey(): Instead of returning the explicit value directly, prepend the agentId prefix when the explicit value doesn't already contain it.

Actual behavior

When using the /v1/chat/completions endpoint with BOTH an x-openclaw-session-key header AND a model field containing an agent reference (e.g. model: "openclaw/xiaoxia"), the agent is always resolved as "main" instead of "xiaoxia".

This happens because resolveSessionKey() at http-utils-GEkok2ix.js line 60 returns the raw header value directly, completely bypassing buildAgentMainSessionKey() which would normally embed the resolved agentId into the session key.

Without the x-openclaw-session-key header, the model field correctly routes to the specified agent. Adding the header breaks this entirely.

OpenClaw version

2026.5.22

Operating system

macOS, Colima Docker, Open WebUI v0.9.5 via /v1/chat/completions

Install method

No response

Model

deepseek v4 pro

Provider / routing chain

deepseek

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response