Fix/agent session key normalization (openclaw#15707) thanks @rodrigouroz

Verified:
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: rodrigouroz <384037+rodrigouroz@users.noreply.github.com>
Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>

src/gateway/server-methods/agent.test.ts

@@ -336,4 +336,54 @@ describe("gateway agent handler", () => {
     expect(call?.message).toBe(BARE_SESSION_RESET_PROMPT);
     expect(call?.sessionId).toBe("reset-session-id");
   });
+
+  it("rejects malformed agent session keys early in agent handler", async () => {
+    mocks.agentCommand.mockClear();
+    const respond = vi.fn();
+
+    await agentHandlers.agent({
+      params: {
+        message: "test",
+        sessionKey: "agent:main",
+        idempotencyKey: "test-malformed-session-key",
+      },
+      respond,
+      context: makeContext(),
+      req: { type: "req", id: "4", method: "agent" },
+      client: null,
+      isWebchatConnect: () => false,
+    });
+
+    expect(mocks.agentCommand).not.toHaveBeenCalled();
+    expect(respond).toHaveBeenCalledWith(
+      false,
+      undefined,
+      expect.objectContaining({
+        message: expect.stringContaining("malformed session key"),
+      }),
+    );
+  });
+
+  it("rejects malformed session keys in agent.identity.get", async () => {
+    const respond = vi.fn();
+
+    await agentHandlers["agent.identity.get"]({
+      params: {
+        sessionKey: "agent:main",
+      },
+      respond,
+      context: makeContext(),
+      req: { type: "req", id: "5", method: "agent.identity.get" },
+      client: null,
+      isWebchatConnect: () => false,
+    });
+
+    expect(respond).toHaveBeenCalledWith(
+      false,
+      undefined,
+      expect.objectContaining({
+        message: expect.stringContaining("malformed session key"),
+      }),
+    );
+  });
 });