Agent chat: links read as plain text with secrets masked; local preview cards only behind a Debug toggle

Merged
TE
16d ago
+575-100

Summary

Leo's report ("did we fix this bullshit yet"): an agent reply with a bare http://127.0.0.1:47811?token=… drew a full-width card. It had a globe, the raw address with its token in full, Open in tab and Open in, then a ~300px empty, see-through body around one Load preview button.

This PR started as a recut of #20931 that makes the unloaded preview card one compact row. Adopted from that PR, it now also covers the rest of the report:

  • Links read as plain link text, as in Claude Code desktop: no globe. A compact chip (favicon + title) appears only for a site cmux already has a title for. A local or private address (localhost, *.localhost, loopback, 0.0.0.0, RFC 1918, link-local, CGNAT/Tailscale, .local, IPv6 loopback/ULA/link-local) is never dressed as a site, whatever cmux has browsed there.
  • Secrets are masked in what is shown. Secret-looking query and fragment values (token, key, api_key, secret, auth, sig, X-Amz-Signature, password, code, session, …) and a userinfo password read as ••• in the link, its hover card and the preview card. The href keeps the real address, so a click still works. The logic is in chips/linkDisplay.ts.
  • Hover actions: the link's hover card offers Open (a cmux tab) and Open in ▾ (the existing OpenInMenu). The card stays up while that menu is open.
  • No preview card by default. The turn's local-page preview card shows only with the new Debug toggle agentPane.debug.turnPreviewCards (off; it sets data-turn-preview-cards="on"). With the toggle on, the card is the compact row until you click Load preview. The card and its frame now draw on the theme's solid surface (--cmux-surface-solid), not the page's transparent background.

Testing

Focused command, run from webviews/: bun's test runner on test/link-cards.test.tsx.

  • Red at 38422152 (tests only): 0 pass, 7 fail.
  • Green at 2cd9e95e: 7 pass, 0 fail.

Neighbouring suites: test/url-chip-hover, agent-pane-links-blue, link-preview-card-styles, transcript-*, agent-pane-chat-column, src/agent-session/acpmux/conversation and chips: 153 pass, 0 fail.
The test/*{markdown,chip,link,preview,reply,transcript}* set: 296 pass, 1 fail. The one failure is markdown-table-keys "Cmd-A selects…", which passes alone on both base and head (cross-file leakage).

Swift: AgentPaneThoughtTunablesTests.turnPreviewCardsAreOffByDefaultAndOnSetsTheirAttribute. Fleet run cmux-ci run --class light --script scripts/ci/run-swift-testing-suites.sh --arg Packages/macOS/CmuxNext at 88f5cff3; result posted below.

Gallery: new transcript variant token-link (Leo's case) and agent-pane.url-chip variant token-url. Before/after: https://cmux-lawrences-mac-mini.tail137216.ts.net:18796/compare/chat-preview-compact-row/

Observed / Not run

  • Observed: the results above. scripts/web-lint.sh reports one warning, jsx-a11y(prefer-tag-over-role) in UserBubble.tsx, a file this PR doesn't touch (base). prepush-gate.py: no new violations.
  • Not run: a live check in a tagged build. No Swift build on this Mac; the fleet run covers it.

Changelog

Changed: Links in agent replies read as plain link text with Open / Open in on hover, hide secret query values such as token=, and a mentioned local address no longer adds a large preview card under the answer

Agent session: cosmic-gray

🤖 Generated with Claude Code