fix: harden resume and SSE replay

backend/test/session-bridge.test.ts

@@ -164,6 +164,26 @@ test("agent_end di Pi diventa un system_event agent_end per il FE", () => {
   expect(seen).toEqual([{ type: "system_event", event: "agent_end" }]);
 });
 
+test("generic Pi system events expose only an allowlisted non-empty event name", () => {
+  const { rpc, fire } = fakeRpc();
+  const bridge = new SessionBridge(rpc);
+  const seen: any[] = [];
+  bridge.onClientEvent((event) => seen.push(event));
+
+  fire({
+    type: "system_event",
+    event: "session_exit",
+    command: "curl https://secret.invalid/?token=DO_NOT_LEAK",
+    result: { path: "/srv/private/key" },
+  });
+  fire({ type: "system_event", event: "   ", stderr: "DO_NOT_LEAK_STDERR" });
+  fire({ type: "system_event", event: 42, args: "DO_NOT_LEAK_ARGS" });
+
+  expect(seen).toEqual([{ type: "system_event", event: "session_exit" }]);
+  expect(Object.keys(seen[0])).toEqual(["type", "event"]);
+  expect(JSON.stringify(seen)).not.toMatch(/DO_NOT_LEAK|command|result|path|stderr|args/);
+});
+
 test("steer invia un comando steer e riattiva il turno", () => {
   const { rpc, sent, fire } = fakeRpc();
   const bridge = new SessionBridge(rpc);