[westey (westey-m)]

Motivation & Context

Description & Review Guide

Improve UX handling of unsupported file types in DevUI

Related Issue

Fixes #

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details:

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

Embedded non-PDF outputs such as MP4/WebM lose working download links because getSafeFileUrl rejects their data URLs, requiring supported embedded content to be converted to local Blob URLs while preserving HTTP(S)-only remote links.

1 open issue

• Preserve downloads for embedded non-PDF outputs · New

What changed in this PR

This PR improves file handling in Python DevUI’s message renderer by restricting file links and explaining when opening or downloading is unavailable.

Changes:

• Adds HTTP(S) URL validation and embedded-PDF Blob conversion.
• Disables unavailable PDF actions and displays unsupported-link messages.
• Adds focused regression tests, a test command, and refreshed bundled CSS.

File	Description
python/​packages/​devui/​frontend/​test/​file-urls.test.mjs	Tests URL filtering, embedded PDFs, and file controls.
python/​packages/​devui/​frontend/​src/​lib/​file-urls.ts	Adds URL validation and PDF Blob helpers.
python/​packages/​devui/​frontend/​src/​components/​features/​agent/​message-renderers/​OpenAIContentRenderer.tsx	Applies link validation and unavailable-file feedback.
python/​packages/​devui/​frontend/​package.json	Adds the file-URL test command.
python/​packages/​devui/​agent_framework_devui/​ui/​assets/​index.css	Refreshes bundled CSS with minor color precision changes.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 61f6b34fc707
Model: gpt-5.6-sol

Overview

The change replaces direct navigation to untrusted file values with an HTTP(S) allowlist and locally generated PDF blob URLs, with cleanup on data changes or unmount and focused tests for unsafe schemes. Those guards close the unsafe-link path for PDFs and generic files, but the generic allowlist also makes backend-supported embedded MP4/WebM outputs inaccessible. One Medium compatibility finding remains.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/devui/frontend/src/components/features/agent/message-renderers/OpenAIContentRenderer.tsx

[Jose Alvarez (jpalvarezl)]

The implementation looks good. One small CI gap is worth closing while these focused tests are being added.