Greptile Summary

This PR fixes a bug where partial streaming chunks of silent reply tokens (e.g., NO before _REPLY arrives) were not being caught by isSilentReplyPrefixText and leaked as visible messages to webchat users. The fix removes the underscore gate, applies the uppercase-only regex to the un-uppercased text to reject natural-language mixed-case input, adds a minimum length of 2, and enforces strict prefix matching (so the full token falls through to isSilentReplyText).

Key changes:

• tokens.ts: Refactored isSilentReplyPrefixText — dropped toUpperCase() before the regex check, removed the includes('_') guard, enforced trimmed.length < 2 early exit, and tightened the return condition to trimmed.length < token.length && token.toUpperCase().startsWith(trimmed).
• tokens.test.ts: Updated test suite to assert the new behavior — "NO" and "HEART" are now recognized as valid prefixes, "NO_REPLY" and "HEARTBEAT_OK" (full tokens) are rejected as prefixes, and single-char / mixed-case inputs remain rejected.

Confidence Score: 5/5

• Safe to merge — the fix is logically sound, well-tested, and scoped entirely to the prefix detection utility.
• The change is minimal and targeted. The regex is now correctly applied before uppercasing, which is the key insight that prevents natural-language mixed-case words from matching while still catching all-caps streaming chunks. The strict prefix condition (trimmed.length < token.length) cleanly hands off the full token to isSilentReplyText. All 18 tests pass and the new cases added directly mirror the scenarios described in the bug report. No side effects on isSilentReplyText or stripSilentToken.
• No files require special attention.

_{Last reviewed commit: 05d949f}

Closing as superseded by merged #32183 plus already-landed #32116 for the webchat NO_REPLY leak family. This branch overlaps via shared token-prefix semantics and is broader than required for the canonical fix.