Bug Description

When a heartbeat handler runs tool calls (e.g. exec, cron list), the embedded agent outputs [TOOL_CALL]{tool: "exec", args: {...}}[/TOOL_CALL] blocks in its response. These leak into user-facing Telegram/Discord messages instead of being silently discarded.

Steps to Reproduce

1. Have HEARTBEAT.md content that triggers an exec or other tool call
2. Any inbound message or scheduled heartbeat poll fires
3. The heartbeat embedded agent runs
4. User receives a message containing [TOOL_CALL]{...}[/TOOL_CALL] — raw agent tool-call output

Example

[TOOL_CALL]
{tool => "exec", args => {
--command "ls memory/..."
}}
[/TOOL_CALL]

Root Cause

In agent-runner-payloads.ts, the buildReplyPayloads function has two branches:

• Normal messages: HEARTBEAT_TOKEN stripping + full sanitization
• isHeartbeat=true: payloads pass through without any text filtering

const sanitizedPayloads = params.isHeartbeat
  ? params.payloads  // ← no stripping, no sanitization
  : params.payloads.flatMap(...)

When the embedded agent executes a tool, the result is injected back into the model as an observation. The model then generates a response that may contain [TOOL_CALL] bracket-format blocks. Since no stripping happens in heartbeat mode, this text flows into replyPayload.text and gets delivered to the user.

Note: [TOOL_CALL] (bracket format) is distinct from <tool_call> (XML format). PR #42260 addresses the XML format but does not cover the bracket format.

Expected Behavior

Heartbeat tool executions should never produce user-visible [TOOL_CALL] blocks.

Related

• Bug: Heartbeat tool_use blocks leak into parent session transcript, corrupting Anthropic sessions #41329: Heartbeat tool_use blocks leak into parent session transcript
• Heartbeat ACK overrides normal reply when gateway poll and user message arrive simultaneously #50797: Heartbeat ACK overrides normal reply
• PR fix(agents): strip tool_call/tool_result XML leaking into channel messages #42260: Fixes XML tool markup leaking (does not cover bracket format)