fix(serve): redact skill bodies from the Web Shell event surface

packages/cli/src/serve/acp-http/transport.test.ts

@@ -6296,6 +6296,56 @@ describe('ACP Streamable HTTP transport (over the wire)', () => {
     // (takeFrames already locked + aborted `sess`; afterEach force-closes.)
   });
 
+  it('keeps availableSkillDetails verbatim on pumped session_update frames (#9234)', async () => {
+    // Mirror of the SSE redaction tests: the SDK/browser surface strips
+    // `_meta.availableSkillDetails`, but the /acp surface must keep
+    // delivering it untouched — desktop clients parse the skill bodies
+    // for display/editing.
+    const connId = await initialize();
+    await newSession(connId);
+    const sess = await openStream(connId, 'sess-1');
+    const got = takeFrames(sess, 1);
+    await new Promise((r) => setTimeout(r, 50));
+    const skillDetails = [
+      { name: 'bugfix', body: 'skill body', filePath: '/skills/bugfix' },
+    ];
+    bridge.queues.get('sess-1')?.push({
+      type: 'session_update',
+      data: {
+        sessionId: 'sess-1',
+        update: {
+          sessionUpdate: 'available_commands_update',
+          availableCommands: [{ name: 'help', description: 'Help' }],
+          _meta: {
+            availableSkills: ['bugfix'],
+            availableSkillDetails: skillDetails,
+          },
+        },
+      },
+    });
+    const frames = (await got) as Array<{
+      method: string;
+      params: {
+        sessionId: string;
+        update: { _meta?: { availableSkillDetails?: unknown } };
+      };
+    }>;
+    expect(frames[0]).toMatchObject({
+      method: 'session/update',
+      params: {
+        sessionId: 'sess-1',
+        update: {
+          sessionUpdate: 'available_commands_update',
+          availableCommands: [{ name: 'help', description: 'Help' }],
+          _meta: {
+            availableSkills: ['bugfix'],
+            availableSkillDetails: skillDetails,
+          },
+        },
+      },
+    });
+  });
+
   it('session/load while a session/close is in-flight → rejected (TOCTOU guard)', async () => {
     let releaseClose: () => void = () => {};
     bridge.closeGate = new Promise<void>((r) => (releaseClose = r));

packages/cli/src/serve/routes/session.ts

@@ -93,6 +93,10 @@ import {
 } from '../server/session-export.js';
 import { setDaemonTelemetryWorkspace } from '../server/telemetry.js';
 import { createSessionOrganizationService } from '../session-organization-helpers.js';
+import {
+  omitSkillDetailsForSdkSurface,
+  omitSkillDetailsFromReplayArrays,
+} from '../skill-details-redaction.js';
 import { replayTranscriptRecordPage } from '../../acp-integration/session/history-replay-page.js';
 import { GENERATION_MAX_PROMPT_BYTES } from '../../acp-integration/generation.js';
 import {
@@ -2100,7 +2104,9 @@ export function registerSessionRoutes(
             });
             return;
           }
-          res.status(200).json(session);
+          // Same replay-array shape as the load response; redact skill
+          // bodies for the browser surface (#9234).
+          res.status(200).json(omitSkillDetailsFromReplayArrays(session));
         } catch (err) {
           sendBridgeError(res, err, { route, sessionId });
         }
@@ -2413,7 +2419,9 @@ export function registerSessionRoutes(
             }
           }
         }
-        res.status(200).json(session);
+        // The load response embeds the replay snapshot inline; redact the
+        // skill bodies there just like the SSE egress does (#9234).
+        res.status(200).json(omitSkillDetailsFromReplayArrays(session));
       } catch (err) {
         sendBridgeError(res, err, {
           route,
@@ -2596,7 +2604,16 @@ export function registerSessionRoutes(
           }
         }
         if (!res.writable) return;
-        res.status(201).json(result);
+        // Branch/side-task responses carry the same replay snapshot shape as
+        // load; apply the same redaction (#9234). The helper returns its
+        // input unchanged when no replay arrays are present (checkpoint
+        // branches), so apply it unconditionally rather than re-deriving the
+        // bridge's variant discrimination here.
+        res
+          .status(201)
+          .json(
+            omitSkillDetailsFromReplayArrays(result as BridgeBranchedSession),
+          );
       },
     ),
   );
@@ -2660,7 +2677,7 @@ export function registerSessionRoutes(
           }
           return;
         }
-        res.status(201).json(result);
+        res.status(201).json(omitSkillDetailsFromReplayArrays(result));
       },
     ),
   );
@@ -2828,7 +2845,13 @@ export function registerSessionRoutes(
         },
       );
       if (result === undefined) return;
-      res.status(200).set('Cache-Control', 'no-store').json(result);
+      res
+        .status(200)
+        .set('Cache-Control', 'no-store')
+        .json({
+          ...result,
+          events: (result.events ?? []).map(omitSkillDetailsForSdkSurface),
+        });
     } catch (err) {
       sendBridgeError(res, err, {
         route,
@@ -2948,11 +2971,13 @@ export function registerSessionRoutes(
             return {
               v: 1 as const,
               sessionId,
-              events: replay.updates.map((update) => ({
-                v: 1 as const,
-                type: 'session_update' as const,
-                data: update,
-              })),
+              events: replay.updates.map((update) =>
+                omitSkillDetailsForSdkSurface({
+                  v: 1 as const,
+                  type: 'session_update' as const,
+                  data: update,
+                }),
+              ),
               ...(replay.nextCursor && !cursorTooLarge
                 ? { nextCursor: replay.nextCursor }
                 : {}),

packages/cli/src/serve/routes/sse-events.ts

@@ -33,6 +33,7 @@ import {
   parseMaxQueuedQuery,
 } from '../server/request-helpers.js';
 import { parseEventEpochHeader } from '../sse-last-event-id.js';
+import { omitSkillDetailsForSdkSurface } from '../skill-details-redaction.js';
 import type { WorkspaceRegistry } from '../workspace-registry.js';
 import { requireSessionRuntime } from './session-runtime.js';
 import {
@@ -125,6 +126,7 @@ interface RegisterSseEventsRoutesDeps {
 type OmitId<T> = Omit<T, 'id'>;
 
 function formatSseFrame(event: BridgeEvent | OmitId<BridgeEvent>): string {
+  const shaped = omitSkillDetailsForSdkSurface(event);
   // SSE format: id (optional), event (optional), data, blank line.
   // The `id:` line is intentionally omitted when `event.id` is absent —
   // terminal/synthetic frames (e.g. daemon-side `stream_error`) must not
@@ -142,21 +144,21 @@ function formatSseFrame(event: BridgeEvent | OmitId<BridgeEvent>): string {
   // `_meta.serverTimestamp`: EventBus stamps normal session frames when they
   // are published so SSE and load/replay share the same event time. Keep this
   // fallback for synthetic frames that do not pass through EventBus.
-  const existingMeta = (event as { _meta?: Record<string, unknown> })._meta;
+  const existingMeta = (shaped as { _meta?: Record<string, unknown> })._meta;
   const existingServerTimestamp = existingMeta?.['serverTimestamp'];
   const serverTimestamp =
     typeof existingServerTimestamp === 'number' &&
     Number.isFinite(existingServerTimestamp)
       ? existingServerTimestamp
       : Date.now();
   const stamped = {
-    ...event,
+    ...shaped,
     _meta: { ...(existingMeta ?? {}), serverTimestamp },
   };
   const dataJson = JSON.stringify(stamped);
   const idLine =
-    'id' in event && event.id !== undefined ? `id: ${event.id}\n` : '';
-  return `${idLine}event: ${event.type}\ndata: ${dataJson}\n\n`;
+    'id' in shaped && shaped.id !== undefined ? `id: ${shaped.id}\n` : '';
+  return `${idLine}event: ${shaped.type}\ndata: ${dataJson}\n\n`;
 }
 
 export function registerSseEventsRoutes(