[Amir-R25]

Summary

ContextInjection filled placeholders in the agent's own message history, in place, before every model call. Once a tool call sent the conversation back to the model, the already-filled messages were filled a second time. So text passed through rt.escape_braces was only delivered as written on the first call, and a context value containing {other_key} was expanded into that key's value on the next call.

Each message used to be marked as filled after the first pass. #1441 removed that marker along with the inject_prompt switch, so this regressed in 1.5.0.

• ContextInjection now fills a copy of the history and passes that copy on, so the caller's messages are never changed.
• Added a regression test: an agent with one tool, two model calls, and both cases above.

Type of change

• Bug fix
• Feature
• Breaking change
• Docs
• Refactor / chore / build / tests

Checklist

• Lint & format pass (ruff check . && ruff format .)
• Tests added/updated and pass locally (pytest tests)
• Docs updated if user-facing behavior changed
• Breaking changes include migration notes

Notes

The conversation an agent returns now keeps the placeholders as written (for example {user_name}) rather than the filled-in values. The model and the recorded LLM events still see the filled prompt.

Follow-up: _wire_history in llm_helpers.py still copies the system message and gives in-place filling as the reason; that reason no longer holds.

[CoronRing]

@Amir-R25

One suggestion before merging:

1. Copy the messages, not the whole history

deepcopy(message_history) runs on every model call and copies everything in the history, including attachments (base64 images, PDFs) and tool results, even though only UserMessage and SystemMessage string content is ever filled. fill_prompt reassigns _content rather than mutating it, so a shallow copy of each message is enough:

filled = inject_context(MessageHistory([copy(m) for m in message_history]))

I swapped this in, and your new test plus the prompt, middleware and built_nodes suites all pass. It also lines up with #1695, which is moving the hot paths off deepcopy because it is slow on large values and crashes on non-copyable ones. _llm_observe already deep-copies the history once per call, so this isn't a new failure mode, just a second full copy per round trip that we don't need.

---

Agreed on _wire_history: once this land