shell: diagnostic accumulation, external-browser modifier, review fixes

ts/packages/shell/src/main/shellWindow.ts

@@ -6,6 +6,7 @@ import {
     DevicePermissionHandlerHandlerDetails,
     globalShortcut,
     ipcMain,
+    shell,
     WebContents,
     WebContentsView,
 } from "electron";
@@ -1276,10 +1277,29 @@ function createMainWindow(inputOnly: boolean): BrowserWindow {
 
     mainWindow.removeMenu();
 
-    // make sure links are opened in the the shell
-    mainWindow.webContents.setWindowOpenHandler(() => {
-        // TODO: add logic for opening in external browser if a modifier key is pressed
-        //shell.openExternal(details.url);
+    // Track whether a modifier key is held so the window-open handler can
+    // decide whether to open in the system browser instead.
+    let modifierHeld = false;
+    mainWindow.webContents.on("before-input-event", (_event, input) => {
+        modifierHeld =
+            (isMac ? input.meta : input.control) || input.shift || input.alt;
+    });
+
+    // make sure links are opened in the the shell; open in system browser when
+    // the user holds a modifier key (Ctrl/Meta, Shift, or Alt) while clicking
+    mainWindow.webContents.setWindowOpenHandler((details) => {
+        if (modifierHeld) {
+            // Only allow http/https URLs to prevent malicious schemes (e.g., file:, javascript:).
+            try {
+                const { protocol } = new URL(details.url);
+                if (protocol === "http:" || protocol === "https:") {
+                    shell.openExternal(details.url);
+                }
+            } catch {
+                // Invalid URL — deny silently.
+            }
+            return { action: "deny" };
+        }
         return { action: "allow" };
     });
 

ts/packages/shell/src/renderer/src/chat/chatView.ts

@@ -646,6 +646,10 @@ export class ChatView {
         this.getMessageGroup(requestId)?.setActionData(requestId, data);
     }
 
+    appendDiagnosticData(requestId: RequestId, data: any) {
+        this.getMessageGroup(requestId)?.appendDiagnosticData(requestId, data);
+    }
+
     private getNotificationMessageGroupId(
         requestId: string | RequestId | undefined,
         source: string,

ts/packages/shell/src/renderer/src/chat/messageGroup.ts

@@ -94,6 +94,16 @@ export class MessageGroup {
         agentMessage.updateActionData(data);
     }
 
+    public appendDiagnosticData(_requestId: RequestId, data: any) {
+        const agentMessage = this.ensureAgentMessage({
+            message: "",
+            source: "",
+            actionIndex: undefined,
+        });
+
+        agentMessage.appendDiagnosticData(data);
+    }
+
     private requestCompleted(result: CommandResult | undefined) {
         this.updateMetrics(result?.metrics);
         if (result?.cancelled) {

ts/packages/shell/src/renderer/src/main.ts

@@ -176,8 +176,7 @@ function registerClient(
             chatView.addAgentMessage(message, { appendMode: mode });
         },
         appendDiagnosticData: (requestId, data) => {
-            // TODO: append data instead of replace
-            chatView.setActionData(requestId, data);
+            chatView.appendDiagnosticData(requestId, data);
         },
         setDynamicDisplay: (
             requestId,

ts/packages/shell/src/renderer/src/messageContainer.ts

@@ -162,14 +162,36 @@ export class MessageContainer {
         if (this.action !== undefined && !Array.isArray(this.action)) {
             label.setAttribute(
                 "action-data",
-                "<pre>" + JSON.stringify(this.action, undefined, 2) + "</pre>",
+                JSON.stringify(this.action, undefined, 2),
             );
 
             // mark the span as clickable
             this.nameSpan.classList.add("clickable");
         }
     }
 
+    private diagnosticData: any[] | undefined;
+
+    public appendDiagnosticData(data: any) {
+        if (this.diagnosticData === undefined) {
+            this.diagnosticData = [data];
+        } else {
+            this.diagnosticData.push(data);
+        }
+        const label = this.timestampDiv.firstChild as HTMLSpanElement;
+        label.setAttribute(
+            "action-data",
+            JSON.stringify(
+                this.diagnosticData.length === 1
+                    ? this.diagnosticData[0]
+                    : this.diagnosticData,
+                undefined,
+                2,
+            ),
+        );
+        this.nameSpan.classList.add("clickable");
+    }
+
     private createTimestampDiv(timestamp: Date, className: string) {
         const timeStampDiv = document.createElement("div");
         timeStampDiv.classList.add(className);

ts/packages/shell/src/renderer/src/setContent.ts

@@ -377,12 +377,24 @@ export function swapContent(
         return;
     }
 
-    if (targetElement.classList.contains("chat-message-action-data")) {
-        targetElement.classList.remove("chat-message-action-data");
-    } else {
+    const showingData = !targetElement.classList.contains(
+        "chat-message-action-data",
+    );
+    if (showingData) {
         targetElement.classList.add("chat-message-action-data");
+    } else {
+        targetElement.classList.remove("chat-message-action-data");
     }
 
     sourceElement.setAttribute("action-data", originalMessage);
-    targetElement.innerHTML = data;
+    if (showingData) {
+        // Render raw JSON data safely via textContent to prevent XSS.
+        targetElement.innerHTML = "";
+        const pre = document.createElement("pre");
+        pre.textContent = data;
+        targetElement.appendChild(pre);
+    } else {
+        // Restore the original trusted message HTML.
+        targetElement.innerHTML = data;
+    }
 }