fix(xmtp): render reply inner content instead of dumping raw JSON

[saulmc]

Summary

normalizeMessageContent serialized a reply's inner content with JSON.stringify whenever it wasn't a string. For a reply that carries a remote attachment (someone replies to a message with a photo), that dumped the decoded attachment envelope verbatim into the message text — including the AES key material (secret/salt/nonce) — instead of the [remote attachment: …] display string. Downstream consumers (e.g. the Herald agent webhook) then handed that raw blob to the agent.

This renders the reply's inner content through normalizeMessageContent recursively, using the inner contentType the decoded EnrichedReply already carries, so a reply-wrapped remote/inline attachment (or any nested content) becomes its display string:

reply to "see attached" (7739f5bd): [remote attachment: photo.jpg (4521 bytes) https://…]

A text reply still hits the existing string fast-path; an unknown inner type falls back to the prior JSON behavior.

Why

A reply was the one path that never delegated to the per-type renderers below it, so it was the only way encryption key material leaked into agent-visible text.

Tests

Added normalizeMessageContent coverage: text reply, reply→remote attachment (asserts no secret/salt/nonce in output), reply→inline attachment, and the unknown-type JSON fallback.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SRUJWMudi3sSaGffXyzk52

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

Note

Fix normalizeMessageContent to render reply inner content instead of raw JSON

Replies carrying non-text payloads (e.g. remote/inline attachments) previously serialized the decoded content as raw JSON, which could expose key material. normalizeMessageContent in xmtp.ts now reads the inner contentType of a reply and recursively normalizes it; it falls back to JSON.stringify only for unknown content types. New tests in xmtp.test.ts cover plain text, text replies, attachment replies, and the JSON fallback path.

^{Macroscope summarized 15c464b.}

[macroscopeapp]

Approvability

Verdict: Approved

Small, focused bug fix that prevents AES key material from leaking into message text by reusing the existing content normalizer for nested reply payloads. The change improves security, is well-tested, and follows established patterns in the codebase.

^{You can customize Macroscope's approvability policy. Learn more.}