[LinuxDevil]

Fixes audit finding SWE-3 (Vercel competitor audit, 2026-10-19).

What was wrong

webhookChannel replied with the full ExecutionResult. A signed webhook call returned {"text":…,"messages":[{"role":"system","content":"<system prompt>"},…all prior turns…],"toolCalls":…,"usage":…,"stepUsage":…}, leaking the system prompt and whole transcript to the caller, and growing every turn.

What changed

• Default reply is now { sessionId, text, finishReason, approval?, approvals? }, matching httpChannel. On an approval pause, approvalPrompt is kept (documented behavior).
• New option fullResult: true restores the previous body (whole ExecutionResult, plus approvalPrompt when paused).
• JSDoc updated on the option and on webhookChannel().

Behavior change: webhook replies no longer include messages, toolCalls, usage, stepUsage or approvalId by default. Consumers that read these must pass fullResult: true, or read the approval id from approval.id.

Doc wording for docs/channels.md (owned by V2): "The webhook channel replies with { sessionId, text, finishReason } (plus approval/approvalPrompt when the turn paused for approval). It never echoes the transcript or system prompt. Pass fullResult: true to receive the whole ExecutionResult; only do so when every caller is trusted with the system prompt and conversation."

Tests

• New: default body has no messages/stepUsage/usage/toolCalls and no system prompt text, has sessionId/text/finishReason; fullResult: true returns messages incl. the system prompt; approval-pause test now checks approval + approvalPrompt and no messages.
• npx tsc --noEmit, typecheck:tests, lint clean; vitest run src/channels 247 passed. Full test:coverage had 57 environment failures (timeouts under load, missing packages dist, CHANGELOG alpha.24 baseline), none in channels, so no full coverage file and fallow could not be run meaningfully.

Changelog: webhookChannel replies with { sessionId, text, finishReason, approval? } by default instead of the full ExecutionResult (no transcript or system prompt echo); opt in with fullResult: true.

🤖 Generated with Claude Code