Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix iMessage attachments blocked by local media path allowlist [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#60046•Fetched 2026-04-08 02:37:00
View on GitHub
Comments
0
Participants
1
Timeline
0
Reactions
0
Author
CuttingwaterCuttingwater
Participants
CuttingwaterCuttingwater

When an iMessage includes an image attachment, the agent attempts to analyze it via the image tool. The attachment path points to ~/Library/Messages/Attachments/..., which is not in the hardcoded media local roots. This causes a LocalMediaAccessError: path-not-allowed and the agent cannot process any iMessage image attachments.

Error Message

[tools] image failed: Local media path is not under an allowed directory: 
/Users/.../Library/Messages/Attachments/.../file.pluginPayloadAttachment

Root Cause

buildMediaLocalRoots() in web-media-CkaAIY0r.js only allows:

  • Preferred tmp dir
  • ~/.openclaw/media
  • ~/.openclaw/workspace
  • ~/.openclaw/sandboxes

There is no config option to add additional allowed paths, and the iMessage channel plugin does not copy attachments into an allowed directory before passing them to tools.

Code Example

[tools] image failed: Local media path is not under an allowed directory: 
/Users/.../Library/Messages/Attachments/.../file.pluginPayloadAttachment
RAW_BUFFERClick to expand / collapse

Summary

When an iMessage includes an image attachment, the agent attempts to analyze it via the image tool. The attachment path points to ~/Library/Messages/Attachments/..., which is not in the hardcoded media local roots. This causes a LocalMediaAccessError: path-not-allowed and the agent cannot process any iMessage image attachments.

Environment

  • OpenClaw version: 2026.4.1 (da64a97)
  • Channel: iMessage
  • OS: macOS (Darwin 25.4.0 arm64)

Error

[tools] image failed: Local media path is not under an allowed directory: 
/Users/.../Library/Messages/Attachments/.../file.pluginPayloadAttachment

Root Cause

buildMediaLocalRoots() in web-media-CkaAIY0r.js only allows:

  • Preferred tmp dir
  • ~/.openclaw/media
  • ~/.openclaw/workspace
  • ~/.openclaw/sandboxes

There is no config option to add additional allowed paths, and the iMessage channel plugin does not copy attachments into an allowed directory before passing them to tools.

Suggested Fix

Either:

  1. Config option: Add a tools.media.localRoots (or similar) config key to allow users to add custom allowed directories
  2. Channel-level fix: Have the iMessage channel plugin copy attachments into ~/.openclaw/media/ before passing them to tools
  3. Automatic widening: When a channel plugin provides an attachment path, automatically add that path's parent to the allowed roots for that tool invocation

Option 2 seems safest - the channel plugin already knows about the attachment and can stage it.

Version

OpenClaw 2026.4.1 (commit da64a97)

extent analysis

TL;DR

The most likely fix is to modify the iMessage channel plugin to copy attachments into an allowed directory, such as ~/.openclaw/media/, before passing them to tools.

Guidance

  • Identify the iMessage channel plugin code responsible for handling attachments and modify it to copy attachments to an allowed directory.
  • Verify that the buildMediaLocalRoots() function in web-media-CkaAIY0r.js is correctly configured to allow access to the new directory.
  • Test the modified plugin with various image attachments to ensure that the LocalMediaAccessError is resolved.
  • Consider adding error handling to the plugin to handle cases where the attachment cannot be copied to the allowed directory.

Example

// Example code snippet to copy attachment to allowed directory
const fs = require('fs');
const path = require('path');

// Assuming 'attachmentPath' is the path to the attachment
const allowedDir = path.join('~', '.openclaw', 'media');
const filename = path.basename(attachmentPath);
const destPath = path.join(allowedDir, filename);

fs.copyFile(attachmentPath, destPath, (err) => {
  if (err) {
    console.error(`Error copying attachment: ${err}`);
  } else {
    // Pass the destPath to the tool instead of the original attachmentPath
  }
});

Notes

This fix assumes that the iMessage channel plugin has the necessary permissions to copy attachments to the allowed directory. Additionally, this fix may have security implications, as it allows the plugin to access and modify files in the allowed directory.

Recommendation

Apply workaround: Modify the iMessage channel plugin to copy attachments to an allowed directory, as this seems to be the safest and most straightforward solution.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#runtime error#dependency conflict#environment setup#docker error#permission error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING