Telegram CLI: LocalMediaAccessError for --media paths outside allowed directories

Symptoms

• Telegram is healthy in openclaw status --deep, but a CLI send with a local file fails:

openclaw message send --channel telegram --target <chat> --media /some/path/image.jpg

• You see an error like:

LocalMediaAccessError: Local media path is not under an allowed directory: /some/path/image.jpg

• If you copy the file into ~/.openclaw/* and try again, the send succeeds.

Cause

OpenClaw treats local-file media reads as a security boundary.

By default, it only allows local media paths under specific OpenClaw-managed directories (state/media/workspace/tmp roots). This reduces the risk of accidentally uploading arbitrary host files.

So an explicit --media /root/clawd/cat.jpg path can still be rejected if it is outside those allowed roots.

Fix

1) Stage the file under an OpenClaw-managed media directory (recommended)

On the same host where you run openclaw message send:

mkdir -p ~/.openclaw/media
cp /some/path/image.jpg ~/.openclaw/media/image.jpg

Then send the staged path:

openclaw message send \\
  --channel telegram \\
  --target <chat> \\
  --media ~/.openclaw/media/image.jpg \\
  --message \"test local image\"

Why this helps: the staged file lives under an allowed root, so OpenClaw can safely read and upload it.

2) Prefer OpenClaw-managed temp/media paths for automation

If you generate files programmatically (screenshots, charts, exports), write them directly into an OpenClaw-managed directory like ~/.openclaw/media so you can send them without extra copy steps.

Verify

• Re-run the same openclaw message send command using the staged ~/.openclaw/media/... path.
• Confirm Telegram receives the image and the CLI output indicates success.
• Confirm the original failing path still fails (expected) — that means the guard is working as designed.

If it still fails, collect:

• your exact CLI command (redact tokens)
• the full LocalMediaAccessError line
• your OS + whether the file path is a symlink (OpenClaw resolves symlinks when validating)

Related

• /guides/telegram-setup
• /guides/openclaw-configuration
• OpenClaw docs: openclaw message, Telegram