This is a clean reroute of the closed PR for this change.

• Reuses the final intended payload from the previously closed work.
• Rebased onto origin/main and squashed to a single clean commit.
• This branch is clean and ready for normal review.

This supersedes #21643. The original PR became stale due a detached/dirty head after history churn while attempting rebase/cleanup.

Closes #21548.

Greptile Summary

This PR enhances security by preventing inbound metadata blocks from leaking into chat history and fixes streaming artifacts when reply tags are being processed.

Key changes:

• Added stripInboundMetadataBlocks() function to remove untrusted metadata prefixes (like "Conversation info (untrusted metadata):", "Sender (untrusted metadata):", etc.) from user messages at display boundaries
• Integrated the new stripping function into the sanitization pipeline in chat-sanitize.ts, applying it before envelope and message ID stripping
• Added guard in stripTrailingDirective() to handle incomplete reply-tag streaming by removing trailing [ characters that haven't formed complete [[directive]] tags yet
• Added comprehensive test coverage for the new metadata stripping behavior, including prefix-only matching (doesn't strip metadata blocks that appear mid-message)

The implementation correctly strips multiple consecutive metadata blocks at the start of messages using a loop with regex matching, then trims the result. The regex pattern properly escapes special characters in the header strings before building the alternation pattern.

Confidence Score: 4/5

• This PR is safe to merge with minor risk
• The changes are well-tested with comprehensive test coverage for the new stripping behavior. The security fix is straightforward and addresses a real vulnerability (metadata injection/leakage). The regex implementation is sound and the integration into existing sanitization pipeline is minimal and follows existing patterns. One minor logic concern was flagged regarding regex escaping, but this doesn't affect the current headers. The trailing [ guard is a simple defensive check that prevents streaming artifacts.
• Review src/shared/chat-envelope.ts line 27 to verify regex escape pattern is complete

_{Last reviewed commit: 900afd4}