[BUG] Roo presents the ask_followup_question choice boxes if you ask it to describe how the function works

[MarkErik]

Problem (one or two sentences)

It showed the ask_followup_question prompt when it encountered the sample code for it, when using ask mode to: "Can you tell me about: /src/core/prompts/tools/ask-followup-question"

Context (who is affected and when)

I ran the following prompt with GLM4.5 Air (however I don't think it is related to the model) in Ask mode.

"Can you tell me about: /src/core/prompts/tools/ask-followup-question"

Reproduction steps

Latest VSCode and RooCode.
Latest github clone of RooCode repo.
LM Studio running GLM4.5 Air 8bit MLX.
In Ask mode use the prompt "Can you tell me about: /src/core/prompts/tools/ask-followup-question"

Expected result

Tools wouldn't get triggered from just presenting code snippets

Actual result

Tool was triggered when it shouldn't have been.

Variations tried (optional)

No response

App Version

3.28.5 (27ca2c0)

API Provider (optional)

None

Model Used (optional)

GLM4.5Air 8bit MLX

Roo Code Task Links (optional)

No response

Relevant logs or errors (optional)

[roomote]

I'm exploring a potential fix for this issue where the ask_followup_question tool is incorrectly triggered when displaying code snippets about the tool itself. I'll investigate the tool parsing logic and open a PR to share progress.

[roomote]

I've opened PR #8244 with a fix for this issue: #8244

The fix adds code block detection to all three message parsing implementations to prevent tool XML tags within code blocks (both inline and fenced) from being incorrectly parsed as actual tool invocations.

All CI checks have passed successfully. The implementation includes comprehensive test coverage to ensure the fix works correctly for various scenarios including the exact case reported in this issue.

[hannesrudolph]

If you have a solution for this then open an enhancement issue. This is not a bug in general use of the tool and only specific to working on the repo.

[MarkErik]

I was just thinking that this might be related to a sanitation/sandboxing of inputs/files read, and could be used in a malicious way, if people have auto-approve enabled for certain tools, e.g. execute_command.