Summary

Fixes #20297

The webchat UI was rendering raw internal metadata in chat bubbles. This PR adds stripping for two categories of leaked metadata:

• Untrusted metadata blocks — Conversation info (untrusted metadata):, Sender (untrusted metadata):, Thread starter (untrusted, for context):, Replied message (untrusted, for context):, Forwarded message context (untrusted metadata):, and Chat history since last reply (untrusted, for context): followed by ```json code fences
• System event lines — System: [timestamp] event description lines prepended by prependSystemEvents()

Changes

Sanitization pipeline (after this fix)

raw message text
  → stripSystemEventLines()        — remove "System: [...]..." lines
  → stripEnvelope()                — remove [WhatsApp 2026-01-24 13:36] headers
  → stripUntrustedMetadataBlocks() — remove (untrusted ...) JSON blocks
  → stripMessageIdHints()          — remove [message_id: xxx] lines
clean user message text

Test plan

• npx vitest run src/gateway/chat-sanitize.test.ts — 10/10 pass
• npx vitest run src/auto-reply/reply/inbound-meta.test.ts — 13/13 pass
• pnpm build — pass
• pnpm lint — 0 errors, 0 warnings
• CI full test suite

🤖 Generated with Claude Code

Greptile Summary

Adds stripping for untrusted metadata blocks and system event lines that were leaking into webchat UI. The implementation correctly removes internal metadata like "Conversation info (untrusted metadata):" JSON blocks, "Sender (untrusted metadata):" blocks, and "System: [timestamp]" event lines. The fix is applied at both the gateway sanitization pipeline and the UI extraction layer for defense-in-depth.

• Adds stripUntrustedMetadataBlocks() with regex pattern to match all untrusted metadata block variants
• Adds stripSystemEventLines() to remove leading system event lines and trailing blank lines
• Wires both functions into the sanitization pipeline in the correct order: system events → envelope → untrusted blocks → message ID hints
• Includes comprehensive test coverage for all metadata block types and combined scenarios
• Defense-in-depth approach ensures metadata is stripped at multiple layers

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The implementation is well-designed with proper defense-in-depth, comprehensive test coverage covering all metadata block types and combined scenarios, correct regex patterns without ReDoS vulnerabilities, and appropriate sanitization order. The fix addresses a real metadata leakage issue without introducing new risks.
• No files require special attention

_{Last reviewed commit: efd894b}

_{(2/5) Greptile learns from your feedback when you react with thumbs up/down!}