[Bug]: Selecting text in an inline HTML render shows no Cite button #16689

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/web

Steps to reproduce

1. In a thread, have the agent publish a page with html_render so it appears inline in the timeline.
2. Select some text inside the inline render.

Expected behavior

The floating Cite button appears, as it does when you select text in an assistant message, and clicking it adds a quote chip to the composer.

Actual behavior

Nothing appears. The text is selected, but there is no Cite button.

Cause:

• The render is loaded in an iframe with sandbox="allow-scripts allow-forms" and deliberately no allow-same-origin (apps/web/src/components/files/BrowserDocumentFrame.tsx, HtmlRenderDocument). The selection lives in the frame's own document. AssistantSelectionToolbar only reads the parent's window.getSelection() and selectionchange, so it never sees it.
• HtmlRenderTimelineRow (apps/web/src/components/chat/MessagesTimeline.tsx) is not wrapped in AssistantCitationSource.
• AssistantCitation (packages/contracts/src/assistantCitations.ts) requires a messageId plus UTF-16 offsets into the rendered message text. A render is an attachment (attachmentId) on its own turn item, not a message.

Possible fix (outline, not tested):

• Frame side: the render bootstrap in packages/shared/src/htmlRender.ts already posts JSON-RPC to the parent for size and link opening. It can also post a selection notification: the selected text (capped at the citation limit + 1) and the last client rect, or null when the selection clears.
• Parent side: accept the message only from an inline render frame inside the timeline that has focus, decode it with a schema, translate the rect by the frame's bounds, and show the existing Cite button. Thread and attachment ids come from the parent's own props, never from the page.
• Contract: a render-citation variant that carries attachmentId instead of messageId and has no start/end/prefix/suffix, since the parent cannot read the frame's text to check them. Tying the quote to a nearby assistant message does not work: the render is published before the reply, and the reply does not contain the quoted text.
• Composer: make the live source anchor optional. With no anchor, the comment editor already anchors to the chip.
• Jump-back: scroll to the render row by attachmentId, without highlighting text inside the page.
• Not in scope: the side panel preview and creating render citations on mobile.
• Known limit: the bootstrap is written into the stored HTML when the page is published (apps/server/src/htmlRender/HtmlRender.ts), so pages published before a fix will not get Cite unless the server injects it at serve time.

Not a fix for:

• allow-same-origin: it would expose the app session to agent script.
• Re-rendering the HTML in the parent: that either runs untrusted script in the app's origin or loses the page's scripts.

Related: #16327 / #16389. Providers currently receive cited quotes as raw t3-citation links, so render quotes would only reach the agent as readable text after that lands.

Impact

Minor bug or occasional failure

Version or commit

Nightly desktop; code references are from main @ bfec238

Environment

Web and desktop, inline HTML renders in the chat timeline. Applies to all providers.

Workaround

Copy the text out of the render and paste it into the composer by hand.