fix(tui): strip inbound metadata from command messages before rendering (#59985) (thanks @MoerAI) (#59985)

Co-authored-by: Vincent Koc <vincentkoc@ieee.org>

src/tui/tui-formatters.test.ts

@@ -119,6 +119,29 @@ Actual user message`,
     expect(text).toBe("Actual user message");
   });
 
+  it("strips leading inbound metadata blocks for command messages (#59871)", () => {
+    const text = extractTextFromMessage({
+      command: true,
+      content: `Conversation info (untrusted metadata):
+\`\`\`json
+{
+  "message_id": "abc123"
+}
+\`\`\`
+
+Sender (untrusted metadata):
+\`\`\`json
+{
+  "label": "Someone"
+}
+\`\`\`
+
+Exec completed: task finished successfully`,
+    });
+
+    expect(text).toBe("Exec completed: task finished successfully");
+  });
+
   it("keeps metadata-like blocks for non-user messages", () => {
     const text = extractTextFromMessage({
       role: "assistant",

src/tui/tui-formatters.ts

@@ -325,7 +325,7 @@ export function extractTextFromMessage(
   }
   const text = extractTextBlocks(record.content, opts);
   if (text) {
-    if (record.role === "user") {
+    if (record.role === "user" || record.command === true) {
       return stripLeadingInboundMetadata(text);
     }
     return text;