[futurepaul]

The stub's keyword rules (tool, fail, silent, approve/risky, slow, draw) matched anywhere in a message's lowercased text, including inside what a command carries. A fetch … with <storage token> once carried a JWT holding "tOoL" (#778's CI, run 41157411177). That turn became a tool turn, said "Let me look." first, and every later reply count in the computers lane was off by one: five failures from one chance token.

What: a rule is said by a word of the message that starts with it (says). It looks past an opening bracket, parenthesis or quote, so slowly, silently, fails and [SILENT] still say theirs. Text inside a word never does. A JWT word starts with eyJ, and a URL with http, so a token or URL can't trip a rule. The newer rules (choose, ask-me, notice, speak) already matched whole words, and stay as they are.

Checked: no lane's stub message depends on a keyword inside a word. I went through every message in crates/e2e and the bridge tests that holds one: "tool please", "a slow tool please", "think slowly…", "queued, silently", "end this turn with exactly [SILENT]", "speak and draw", "draw picture:…". restart-tools and fp-tools are AI-fake tool loops, not stub messages.

Tests

• a_rule_is_a_word_said_never_text_inside_one (unit): the words above say their rules; a token holding "tool" and "fail", a URL with /tools/, withdrawn and -tool say none.
• a_token_says_no_rule (bridge): a fetch whose token holds "tOoL" and "fAiL" is a fetch's turn alone: no tool step, no error, one reply.
• Both fail on the old matching. cargo test -p fragment-bridge and its clippy pass.

Complexity ledger: one 3-line helper, six call sites changed, the module doc's sentence. Nothing removed or added elsewhere.

🤖 Generated with Claude Code

[alexlwn123]

Pass at 2696a368d9808b03f5aa25a9772613ed5d830570.

The word-prefix matcher fixes accidental rule activation inside JWTs and URLs while preserving the existing stub prompts, including slowly, silently and [SILENT]. The shared helper and focused unit/bridge regression tests are proportionate to the fix; I found no blocking regression.

Validation: Linux CI images check passed (workspace tests and clippy). Local cargo test -p fragment-bridge could not compile on macOS because unchanged SimpleX code uses Linux-only libc::prctl/PR_SET_PDEATHSIG. Docker and broader CI checks were still pending at review time.