Token replacement unintentionally escapes prompt as HTML markup
>>> [!note] Migrated issue
<!-- Drupal.org comment -->
<!-- Migrated from issue #3546948. -->
Reported by: [codebymikey](https://www.drupal.org/user/3573206)
Related to !215
>>>
<h3 id="summary-problem-motivation">Problem/Motivation</h3>
<p>When certain tokens are fetched through the token system, <a href="https://api.drupal.org/api/drupal/core%21lib%21Drupal%21Core%21Utility%21Token.php/function/Token%3A%3Areplace/11.x"><code>Token::replace()</code></a> escapes the token value if it contains HTML characters.</p>
<p>Given that the prompts are typically plain text rather than markup, we should use <a href="https://api.drupal.org/api/drupal/core%21lib%21Drupal%21Core%21Utility%21Token.php/function/Token%3A%3AreplacePlain/11.x"><code>Token::replacePlain()</code></a> instead to avoid unintentional escapes.</p>
<h4 id="summary-steps-reproduce">Steps to reproduce</h4>
<p>Have a prompt that include special HTML characters like <code>" '</code> and the <code>[ai_agent:agent_instructions]</code> prompt is replaced with an HTML encoded version of its value.</p>
<h3 id="summary-proposed-resolution">Proposed resolution</h3>
<p>1. <code>Token::replacePlain()</code> should be used to replace the token values rather than <code>Token::replace()</code><br>
<del>2. The agent instructions returned from the token should be markup, so that it's no longer escaped (optional, should not longer be necessary with option 1).</del></p>
<h3 id="summary-remaining-tasks">Remaining tasks</h3>
<p><del>Provide issue fork.</del></p>
<h3 id="summary-ui-changes">User interface changes</h3>
<p>N/A</p>
<h3 id="summary-api-changes">API changes</h3>
<p>N/A</p>
issue