Function handleInboundMessage

src/hooks/useReplBridge.tsx:203–245

(msg: SDKMessage)

          // await — messages with attachments just land in the queue slightly
          // later, which is fine (web messages aren't rapid-fire).
          async function handleInboundMessage(msg: SDKMessage): Promise<void> {
            try {
              const fields = extractInboundMessageFields(msg);
              if (!fields) return;

              const { uuid } = fields;

              // Dynamic import keeps the bridge code out of non-BRIDGE_MODE builds.
              const { resolveAndPrepend } = await import('../bridge/inboundAttachments.js');
              const rawContent = fields.content;
              let sanitized: string | Array<{ type: string; [key: string]: unknown }> =
                typeof rawContent === 'string'
                  ? rawContent
                  : (rawContent as unknown as Array<{ type: string; [key: string]: unknown }>);
              if (feature('KAIROS_GITHUB_WEBHOOKS')) {
                /* eslint-disable @typescript-eslint/no-require-imports */
                const { sanitizeInboundWebhookContent } =
                  require('../bridge/webhookSanitizer.js') as typeof import('../bridge/webhookSanitizer.js');
                /* eslint-enable @typescript-eslint/no-require-imports */
                if (typeof sanitized === 'string') {
                  sanitized = sanitizeInboundWebhookContent(sanitized);
                }
              }
              const content = await resolveAndPrepend(msg, sanitized as string | ContentBlockParam[]);

              const preview = typeof content === 'string' ? content.slice(0, 80) : `[${content.length} content blocks]`;
              logForDebugging(`[bridge:repl] Injecting inbound user message: ${preview}${uuid ? ` uuid=${uuid}` : ''}`);
              enqueue({
                value: content,
                mode: 'prompt' as const,
                uuid,
                // skipSlashCommands stays true as defense-in-depth —
                // processUserInputBase overrides it internally when bridgeOrigin
                // is set AND the resolved command passes isBridgeSafeCommand.
                // This keeps exit-word suppression and immediate-command blocks
                // intact for any code path that checks skipSlashCommands directly.
                skipSlashCommands: true,
                bridgeOrigin: true,
              });
            } catch (e) {
              logForDebugging(`[bridge:repl] handleInboundMessage failed: ${e}`, { level: 'error' });
            }
          }

          // State change callback — maps bridge lifecycle events to AppState.
          function handleStateChange(state: BridgeState, detail?: string): void {