Greptile Summary

This PR ships three improvements: (1) a custom link-safety modal that portals to document.body (fixing scroll-behind-modal on the chat history), with trusted-domain persistence and hardened getDomain against userinfo bypass; (2) an inline display directive on artifact-producing tools so the model can auto-display results without a follow-up display_artifacts call; and (3) a min-w-0 flexbox fix to prevent long code lines from overflowing the chat bubble.

All issues from the previous review round have been addressed: the userinfo (@-syntax) bypass is rejected in getDomain, the setTimeout is cleared via copyTimerRef on unmount, duplicate artifact IDs in getDisplaySelectionForRound are deduplicated with Set, and LLM-controlled regex is guarded by safe-regex with a length cap before execution.

Confidence Score: 5/5

Safe to merge — all prior security and logic findings have been remediated and no new P0/P1 issues were found.

Every issue flagged in the previous review round (userinfo URL bypass, setTimeout leak, duplicate artifact IDs, ReDoS) has been directly addressed in this PR. The new inline-display feature is well-structured: the display argument is stripped before MCP forwarding, built-in executors ignore it safely, safe-regex guards the if_output_matches path, and the sub-agent executor destructures only { task } so the field is never forwarded to the API.

No files require special attention.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Model
    participant executeToolCalls
    participant Executor as Tool Executor (built-in / MCP)
    participant applyInlineDisplay
    participant MultiModelResponse

    Model->>executeToolCalls: tool_call { name, arguments: { ...params, display: { when, match, layout } } }
    executeToolCalls->>Executor: toolCall (MCP: stripDisplayArg strips display first)
    Executor-->>executeToolCalls: ToolExecutionResult { success, artifacts[] }
    executeToolCalls->>applyInlineDisplay: (toolCall, result)
    note over applyInlineDisplay: Reads display directive from toolCall.arguments<br/>Runs safeRegex + length cap for if_output_matches<br/>Appends display_selection artifact if condition met
    applyInlineDisplay-->>executeToolCalls: result (with optional display_selection artifact)
    executeToolCalls-->>MultiModelResponse: results map
    MultiModelResponse->>MultiModelResponse: getDisplaySelectionForRound merges all display_selection artifacts, deduplicates IDs via Set
    MultiModelResponse-->>Model: rendered artifact panel

_{Reviews (2): Last reviewed commit: "Review fixes" | Re-trigger Greptile}

@greptile-apps