Skip to content

fix(chat): make inline web citations clickable - #599

Merged
Deodat-Lawson merged 1 commit into
mainfrom
codex/fix-chat-citation-links
Nov 8, 2026
Merged

Deodat-Lawson merged 1 commit into
mainfrom
codex/fix-chat-citation-links

Conversation

@Deodat-Lawson

@Deodat-Lawson Deodat-Lawson commented Nov 8, 2026 •

Copy link
Copy Markdown
Owner

Chat answers displayed [Source N] as plain text even though each answer already retained the source URLs. Resolve those labels against the answer’s own web-source metadata so clicking a citation opens the matching page in a new tab, with the source title on hover. This covers streamed and saved answers, stopped/error answers, and proposed plans.

The Markdown renderer links only known HTTP(S) sources and preserves citation examples inside code and existing links. Unknown citation numbers remain plain text; document citation navigation is unchanged.

Validation: 83 tests passed across ChatMarkdown, AskPanel citations/timeline, and useChatRuntime; web TypeScript checking and targeted ESLint passed. A local Next.js browser check confirmed that completing a response produces inline links and clicking [Source 1] opens the expected vLLM Docker documentation in a new tab.


Note

Medium Risk
New automatic outbound links from chat content rely on URL allowlisting; document citation chips and behavior are unchanged but misclassified tool URLs could still mislead users.

Overview
Chat answers that include [Source N] labels now render as clickable links resolved from each message’s webSources metadata (tool-returned URLs), instead of staying plain text.

ChatMarkdown gains a linkWebCitations rehype step that maps numbered citations to safe HTTP(S) URLs via safeChatUri, skips code/pre/existing links, and leaves unknown or unsafe sources as text. AskPanel, AnswerProse, and ProposedPlan thread webSources through so streaming, stopped/error, saved, and plan-mode answers all link consistently when metadata arrives.

Tests cover multi-citation answers, delayed webSources on stream, plan UI, per-answer source isolation, and rejected malicious URLs.

Reviewed by Cursor Bugbot for commit cf9c3f2. Bugbot is set up for automated code reviews on this repo. Configure here.

@vercel

vercel Bot commented Nov 8, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated
pdr-ai-v2 Ignored Ignored Nov 8, 2026 1:19am UTC

@cursor

cursor Bot commented Nov 8, 2026

Copy link
Copy Markdown

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: bc4bd8d3-fe9d-42b2-b343-9f3256426d0d)

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 8, 2026 •

Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-08T01:20:55.469205Z cf9c3f2 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@Deodat-Lawson
Deodat-Lawson merged commit ff51e07 into main Nov 8, 2026
22 of 23 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant