fix(auto-reply): sanitize stranded-reply retry prompt text (#85714)

Jerry-Xin · Jerry-Xin · commit bc5a7d9fb1e1 · 2026-07-10T00:05:31.000+08:00
The stranded-reply recovery retry embedded the raw private final text
into a synthetic prompt asking the agent to redeliver via
message(action=send). The message tool sanitizes runtime/inbound
metadata but not reply directives, so directive tokens
([[reply_to:...]], [[audio_as_voice]], MEDIA: lines) in the final could
survive the retry and be re-sent unsanitized, breaking the
message_tool_only privacy/directive boundary.

Run the same normalization the normal final-delivery path applies
(normalizeReplyPayloadDirectives) on the final text before quoting it in
the retry prompt, so the retry replays only the normalized visible text.
Add regression coverage: a directive-laden final has its directives
stripped from the retry prompt while the visible message survives and
the recovery guard flags persist; a directive-free final is quoted
unchanged.
diff --git a/src/auto-reply/reply/agent-runner.misc.runreplyagent.test.ts b/src/auto-reply/reply/agent-runner.misc.runreplyagent.test.ts
@@ -3579,6 +3579,45 @@ describe("runReplyAgent private message_tool_only final warning (#85714)", () =>
     expect(retryPrompt).toContain("Here is the answer");
   });
 
+  it("strips reply directives from the quoted final before replaying it (#85714)", async () => {
+    // A stranded final can embed reply directives ([[reply_to:...]], [[audio_as_voice]],
+    // MEDIA: lines). The message tool sanitizes runtime/inbound metadata but NOT reply
+    // directives, so quoting the raw final would let those tokens survive the retry and
+    // be re-sent unsanitized via message(action=send). The retry prompt must quote the
+    // normalized visible text, matching the normal final-delivery normalization.
+    await runPrivateFinalCase({
+      strandedReplyRecovery: true,
+      finalAssistantText:
+        "[[reply_to:123]] [[audio_as_voice]] Hello there — here is the substantive answer " +
+        "the user asked about. It is long enough to read like a real user-facing reply " +
+        "rather than a short private note, so recovery should trigger.\nMEDIA: /tmp/x.png",
+    });
+    expect(vi.mocked(enqueueFollowupRun)).toHaveBeenCalledTimes(1);
+    const retryRun = vi.mocked(enqueueFollowupRun).mock.calls[0]?.[1];
+    const retryPrompt = retryRun?.prompt ?? "";
+    // The visible message survives; the directive tokens do not.
+    expect(retryPrompt).toContain("Hello there");
+    expect(retryPrompt).not.toContain("[[reply_to:");
+    expect(retryPrompt).not.toContain("[[audio_as_voice]]");
+    expect(retryPrompt).not.toContain("MEDIA:");
+    expect(retryPrompt).not.toContain("/tmp/x.png");
+    // The retry still enqueues with the recovery guard and individual drain.
+    expect(retryRun?.strandedReplyRetry).toBe(true);
+    expect(retryRun?.disableCollectBatching).toBe(true);
+  });
+
+  it("quotes a plain directive-free final unchanged (#85714)", async () => {
+    // No directives means nothing to strip: the normalization must leave the
+    // quoted final byte-for-byte so the agent redelivers the intended reply.
+    const plainFinal =
+      "Here is the substantive answer the user asked about. It is long enough to read like " +
+      "a real user-facing reply rather than a short private note, so recovery should trigger.";
+    await runPrivateFinalCase({ strandedReplyRecovery: true, finalAssistantText: plainFinal });
+    expect(vi.mocked(enqueueFollowupRun)).toHaveBeenCalledTimes(1);
+    const retryPrompt = vi.mocked(enqueueFollowupRun).mock.calls[0]?.[1]?.prompt ?? "";
+    expect(retryPrompt).toContain(`"${plainFinal}"`);
+  });
+
   it("does not enqueue retry for short private final replies", async () => {
     await runPrivateFinalCase({
       strandedReplyRecovery: true,
diff --git a/src/auto-reply/reply/agent-runner.ts b/src/auto-reply/reply/agent-runner.ts
@@ -120,6 +120,7 @@ import {
   type FollowupRun,
   type QueueSettings,
 } from "./queue.js";
+import { normalizeReplyPayloadDirectives } from "./reply-delivery.js";
 import { createReplyMediaContext } from "./reply-media-paths.js";
 import { resolveReplyOperationRunState } from "./reply-operation-run-state.js";
 import {
@@ -2614,12 +2615,23 @@ export async function runReplyAgent(params: {
         // still fires unconditionally; only the retry enqueue is gated.
         const strandedReplyRecoveryEnabled = cfg.messages?.strandedReplyRecovery === true;
         if (!isRetryRun && strandedReplyRecoveryEnabled) {
+          // #85714: Strip reply directives before replaying the private final into
+          // the model. The message tool sanitizes runtime/inbound metadata but NOT
+          // reply directives, so quoting the raw final would let directive tokens
+          // ([[reply_to:...]], [[audio_as_voice]], MEDIA:, reactions) survive the
+          // retry and be re-sent unsanitized via message(action=send). Run the same
+          // normalization the normal final-delivery path applies (buildReplyPayloads).
+          const strandedReplyVisibleText =
+            normalizeReplyPayloadDirectives({
+              payload: { text: assistantFinalText },
+              parseMode: "always",
+            }).payload.text ?? "";
           // #85714: Enqueue a retry turn so the agent can deliver via message(action=send),
           // preserving the message_tool_only privacy contract instead of bypassing suppression.
           const retryPrompt =
             `[System] Your previous reply was not delivered to the conversation because ` +
             `you did not call message(action=send). Your reply text was:\n\n` +
-            `"${assistantFinalText}"\n\n` +
+            `"${strandedReplyVisibleText}"\n\n` +
             `Please deliver this reply now by calling message(action=send). ` +
             `Do not add any extra commentary — just deliver the original reply.`;
           const retryEnqueued = enqueueFollowupRun(
