fix: open external chat links in a new tab

src/app/components/markdown/markdown.component.html

@@ -16,6 +16,7 @@
 
 <markdown
   [data]="text()"
+  (ready)="openExternalLinksInNewTab()"
   [ngStyle]="{
               color: thought() ? '#9aa0a6' : 'inherit'
             }"

src/app/components/markdown/markdown.component.spec.ts

@@ -19,13 +19,15 @@ import {HttpClientTestingModule} from '@angular/common/http/testing';
 import {ComponentFixture, fakeAsync, TestBed, tick,} from '@angular/core/testing';
 import {MarkdownModule} from 'ngx-markdown';
 
+import {initTestBed} from '../../testing/utils';
 import {MarkdownComponent} from './markdown.component';
 
 describe('MarkdownComponent', () => {
   let component: MarkdownComponent;
   let fixture: ComponentFixture<MarkdownComponent>;
 
   beforeEach(async () => {
+    initTestBed();
     await TestBed
         .configureTestingModule({
           imports: [
@@ -54,6 +56,65 @@ describe('MarkdownComponent', () => {
        expect(element.querySelector('strong')?.textContent).toBe('bold');
      }));
 
+  it('opens HTTP and HTTPS links in a new tab safely', fakeAsync(() => {
+    fixture.componentRef.setInput('text', [
+      '[HTTP](http://example.com)',
+      '[HTTPS](https://example.com "Example")',
+      '<https://example.com/auto>',
+      'https://example.com/bare',
+      '<a href="https://example.com/html" rel="nofollow">HTML</a>',
+    ].join('\n\n'));
+    fixture.detectChanges();
+    tick(100);
+
+    const links = fixture.nativeElement.querySelectorAll('a');
+    expect(links.length).toBe(5);
+    links.forEach((link: HTMLAnchorElement) => {
+      expect(link.target).toBe('_blank');
+      expect(link.relList.contains('noopener')).toBeTrue();
+      expect(link.relList.contains('noreferrer')).toBeTrue();
+    });
+    expect(links[1].title).toBe('Example');
+    expect(links[4].relList.contains('nofollow')).toBeTrue();
+  }));
+
+  it('preserves relative, fragment and email link behavior', fakeAsync(() => {
+    fixture.componentRef.setInput('text',
+        '[Relative](./guide) [Fragment](#section) [Email](mailto:help@example.com)');
+    fixture.detectChanges();
+    tick(100);
+
+    const links = fixture.nativeElement.querySelectorAll('a');
+    expect(links.length).toBe(3);
+    links.forEach((link: HTMLAnchorElement) => {
+      expect(link.hasAttribute('target')).toBeFalse();
+      expect(link.hasAttribute('rel')).toBeFalse();
+    });
+  }));
+
+  it('opens links added by subsequent message updates in a new tab', fakeAsync(() => {
+    fixture.componentRef.setInput('text', 'Streaming response');
+    fixture.detectChanges();
+    tick(100);
+    fixture.componentRef.setInput('text', 'Streaming response [link](https://example.com)');
+    fixture.detectChanges();
+    tick(100);
+
+    const link: HTMLAnchorElement = fixture.nativeElement.querySelector('a');
+    expect(link.target).toBe('_blank');
+    expect(link.rel).toBe('noopener noreferrer');
+  }));
+
+  it('does not make unsafe links executable', fakeAsync(() => {
+    fixture.componentRef.setInput('text', '[Unsafe](javascript:alert%281%29)');
+    fixture.detectChanges();
+    tick(100);
+
+    const link: HTMLAnchorElement = fixture.nativeElement.querySelector('a');
+    expect(link.getAttribute('href')).not.toMatch(/^javascript:/i);
+    expect(link.hasAttribute('target')).toBeFalse();
+  }));
+
   // Skipped: Thought styling removed in UI refactor
   xit('should apply italic style when thought is true', () => {
     fixture.componentRef.setInput('thought', true);

src/app/components/markdown/markdown.component.ts

@@ -218,6 +218,17 @@ export class MarkdownComponent implements OnInit {
     });
   }
 
+  openExternalLinksInNewTab() {
+    // Run after each sanitized render, including streamed message updates.
+    const container: HTMLElement = this.elementRef.nativeElement;
+    container.querySelectorAll<HTMLAnchorElement>('a[href]').forEach((link) => {
+      if (/^https?:\/\//i.test(link.getAttribute('href') || '')) {
+        link.target = '_blank';
+        link.relList.add('noopener', 'noreferrer');
+      }
+    });
+  }
+
   private renderMermaid() {
     const container = this.elementRef.nativeElement;
     const codeElements = container.querySelectorAll('pre code.language-mermaid');