fix(web): links in HTML renders open like chat links

[maria-rcks]

Every link inside an agent's HTML render opened a new browser tab, even a pull request link that opens in the right panel when it shows up in chat.

HTML render links now go through the same path as chat links. A pull request from the thread's project opens in the right panel. Any other link follows Settings > Open links in. Cmd/Ctrl-click goes straight to the system browser without reading settings. The page bootstrap now sends the click's Cmd/Ctrl state with its ui/open-link request, and the frame gets the thread from the timeline and from the files panel.

The server injects the bootstrap when the page is published, so only renders published after this change send the modifier state. Older renders still get panel routing on a plain click.

Evidence

Dev server, web client, a Claude agent publishing a render with a link to #18887. Same thread and render in both runs.

Before (main): a plain click opens GitHub in a new tab, and no panel opens.

After: the pull request opens in the right panel.

Verification

• vp test run packages/shared/src/htmlRender.test.ts apps/web/src/components/files/AttachmentFilePreview.test.tsx, plus web typecheck and lint on the changed files (all ran on Blacksmith)
• Unverified: Cmd/Ctrl-click to the system browser. The headless test browser can't send a modifier click or show an external browser.

Written by Claude Opus 5.5 (claude-opus-5-5) in Claude Code, running in T3 Code.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This changes the production default behavior for links inside HTML renders, routing pull requests to the right panel and other links through the configured link-target preference instead of always opening a browser tab. The implementation is localized, but the user-visible default change warrants deliberate review.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.9 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 80664d5 · PR result: b3e3b1d · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6b431c62-9b3f-4f19-b681-9c923cfd7845

📥 Commits

Reviewing files that changed from the base of the PR and between 5889d9b and b3e3b1d.

📒 Files selected for processing (1)

• apps/web/src/components/files/BrowserDocumentFrame.tsx

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

📝 Walkthrough

HTML-render link requests now carry Cmd/Ctrl modifier state. Preview components pass an optional thread reference to HTML-render documents, which route links through change-request handling or the app’s link-opening hooks instead of calling window.open directly.

Changes: HTML render links

Layer / File(s)	Summary
Link request modifier protocol packages/shared/src/htmlRender.ts, packages/shared/src/htmlRender.test.ts	The bootstrap includes click modifier keys in link requests. The parser returns each modifier as true only when its value is exactly true. Tests cover omitted and non-boolean values.
Thread-aware link routing apps/web/src/components/chat/HtmlRenderFrame.tsx, apps/web/src/components/chat/MessagesTimeline.tsx, apps/web/src/components/files/AttachmentFilePreview.tsx, apps/web/src/components/files/BrowserDocumentFrame.tsx, apps/web/src/components/files/FilePreviewPanel.tsx	Chat and attachment previews pass an optional thread reference to HTML-render documents. Cmd/Ctrl-clicked links open externally. Other links use change-request handling when a thread exists, then fall back to the app’s link-opening hook.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant HtmlRenderBootstrap
  participant HtmlRenderDocument
  participant openChangeRequestLink
  participant openLink
  HtmlRenderBootstrap->>HtmlRenderDocument: Send URL and modifier keys
  HtmlRenderDocument->>openChangeRequestLink: Offer URL when a thread reference exists
  openChangeRequestLink-->>HtmlRenderDocument: Return handled or unhandled result
  HtmlRenderDocument->>openLink: Pass URL when unhandled or no thread exists

Loading

Suggested reviewers: t3dotgg

Merge Risk: ⚪ Minimal · up to b3e3b

HTML-render links now use thread-aware pull-request routing and the app’s link opener. No concrete user-facing failure is established that warrants delaying merge.

Security architecture risk: 🟡 Moderate · up to b3e3b

Existing sandbox and permission checks remain, but interactive HTML gains access to additional navigation outcomes inside the signed-in app. Its scripts can request navigation during recent user activity without proving that the reader selected that destination. The exposure is constrained by thread context, browser preferences, and permissions.

Retained concerns

• Medium · security · inferred: HTML scripts can use ambient frame focus and user activation to request arbitrary HTTP(S) navigation, without a host-verifiable association to a reader-selected link. This admission policy predates the PR, but its outcomes now include authenticated preview opens under the configured browser profile and thread-aware PR-panel routing. Thread, capability, preference, and permission checks bound the exposure; they do not distinguish an actual link click from another message emitted by the frame.

Security review details

Security Blast Radius

• inferred — The demonstrated additional reach is navigation within the supplied thread's environment and eligible PR projects. Preview reach requires app-browser preference, runtime availability, and preview-operate permission. The inspected evidence does not establish cross-environment access or the ultimate browser network and credential exposure.

Security Findings and Attack Paths

• inferred — A script in an attacker-influenced render can post its own ui/open-link message while the frame is focused and user activation is available. The injected listener's trusted-anchor check is not a host-side requirement. The PR lets such a message reach preview or PR-panel routing rather than only the previous external opener; downstream compromise has not been established.

Trust Boundaries and Controls

• observed — Preview-operate scope is checked by the client and enforced against the authenticated connection's scopes on the server. PR routing restricts project selection to the thread environment and requires pull-request capability; host-based fallback additionally requires threadPullRequests capability.

Resilience and Maintainability Implications

• observed — Navigation dispatch and asynchronous completion are separate: the HTML result is posted before preview or external opening settles. Failures are handled by the existing opener or logged by the host. The inspected protocol does not establish a completed-navigation acknowledgement or request-id deduplication guarantee.

Hardening Proposals

• proposed — Consider host-controlled confirmation for navigation from sandboxed HTML into authenticated preview contexts, or retain external-only routing where reader intent cannot be established. A one-shot admission policy could also bound repeated requests during a single activation window.

Pre-merge checks · 4

Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly and concisely describes the main change: HTML render links now use chat-link behavior.
Description check		The description covers the problem, the implementation, affected behavior, evidence, verification commands, an unverified modifier-click case, and the agent details. It does not include a separate Sco…

✨ Finishing Touches 💡 1

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

Dismissing prior approval to re-evaluate b3e3b1d