Token replacement unintentionally escapes prompt as HTML markup
>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3546948. --> Reported by: [codebymikey](https://www.drupal.org/user/3573206) Related to !215 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>When certain tokens are fetched through the token system, <a href="https://api.drupal.org/api/drupal/core%21lib%21Drupal%21Core%21Utility%21Token.php/function/Token%3A%3Areplace/11.x"><code>Token::replace()</code></a> escapes the token value if it contains HTML characters.</p> <p>Given that the prompts are typically plain text rather than markup, we should use <a href="https://api.drupal.org/api/drupal/core%21lib%21Drupal%21Core%21Utility%21Token.php/function/Token%3A%3AreplacePlain/11.x"><code>Token::replacePlain()</code></a> instead to avoid unintentional escapes.</p> <h4 id="summary-steps-reproduce">Steps to reproduce</h4> <p>Have a prompt that include special HTML characters like <code>" '</code> and the <code>[ai_agent:agent_instructions]</code> prompt is replaced with an HTML encoded version of its value.</p> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>1. <code>Token::replacePlain()</code> should be used to replace the token values rather than <code>Token::replace()</code><br> <del>2. The agent instructions returned from the token should be markup, so that it's no longer escaped (optional, should not longer be necessary with option 1).</del></p> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <p><del>Provide issue fork.</del></p> <h3 id="summary-ui-changes">User interface changes</h3> <p>N/A</p> <h3 id="summary-api-changes">API changes</h3> <p>N/A</p>
issue