Summary

Hook completion system events are broadcast to the default agent's main session regardless of which agent processed the hook. This leaks email content (and potentially other hook payloads) across agent boundaries.

Steps to Reproduce

1. Configure multi-agent setup with agents exec (default) and dev
2. Set up a Gmail hook mapping with "agentId": "dev" routing to the dev agent
3. Send an email that triggers the hook
4. The dev agent processes the email correctly
5. However, a system event containing the hook result summary (including email content) is also sent to the exec agent's main session via enqueueSystemEvent()

Root Cause

In the dispatchAgentHook function (gateway-cli), after a hook completes:

const mainSessionKey = resolveMainSessionKeyFromConfig();
// ...
enqueueSystemEvent(`${prefix}: ${summary}`, { sessionKey: mainSessionKey });

The summary is always sent to mainSessionKey (the default agent's session), not the hook's target agent session. This means the default agent sees the full result text of every hook, regardless of which agent was targeted.

Security Impact

• In a multi-agent setup where different agents handle different users' or clients' email, email content leaks across agent boundaries
• This breaks agent isolation for any setup where hooks route to non-default agents
• Particularly problematic for business/client data isolation (e.g., a Fringe/work agent processing client emails while a personal assistant agent receives the summaries)

Expected Behavior

The system event should be routed to the hook's target agent's main session, not the global default. Something like:

const hookAgentMainSession = buildAgentMainSessionKey({ agentId: hookAgentId, mainKey: "main" });
enqueueSystemEvent(`${prefix}: ${summary}`, { sessionKey: hookAgentMainSession });

Environment

• OpenClaw 2026.2.22-2
• Multi-agent config with exec (default) and dev agents
• Gmail hooks with per-agent routing via agentId in hook mappings

Related

• Hook/cron lanes resolve auth from hardcoded 'main' agent path, ignoring default agent #24016 (auth context routing for hooks — fixed in 2026.2.22-2)
• This is the second cross-agent isolation issue found in the hook system