refac: make markdown embed rendering opt-in (#29985)

The embed flag defaults to off and is now forwarded through every markdown render path, including the standalone tool-call branch, colon fences and alerts, so embeds render only where a call site opts in. Assistant responses opt in for the viewer's own chat; channel messages pass it explicitly off.

src/lib/components/channel/Messages/Message.svelte

@@ -537,6 +537,7 @@
 									id={renderedMessageId}
 									output={messageOutput}
 									done={message?.meta?.done ?? false}
+									allowEmbeds={false}
 								/>
 							{:else if (message?.content ?? '').trim() === '' && message?.meta?.model_id}
 								<Skeleton />
@@ -546,7 +547,7 @@
 										id={renderedMessageId}
 										content={message.content}
 										paragraphTag="span"
-										allowEmbeds={!!message?.meta?.model_id}
+										allowEmbeds={false}
 									/>
 								</span>{#if message.created_at !== message.updated_at && (message?.meta?.model_id ?? null) === null}<span
 										class="text-gray-500 text-[0.625rem] pl-1 self-center"

src/lib/components/chat/Messages/ContentRenderer.svelte

@@ -89,6 +89,7 @@
 
 	export let editCodeBlock = true;
 	export let topPadding = false;
+	export let allowEmbeds = false;
 
 	export let onSave = (e) => {};
 	export let onSourceClick = (e) => {};
@@ -293,6 +294,7 @@
 			{preview}
 			{compactPreview}
 			{done}
+			{allowEmbeds}
 			{editCodeBlock}
 			{topPadding}
 			{sourceIds}
@@ -317,6 +319,7 @@
 				{preview}
 				{compactPreview}
 				{done}
+				{allowEmbeds}
 				{editCodeBlock}
 				{topPadding}
 				{sourceIds}
@@ -343,6 +346,7 @@
 					{preview}
 					{compactPreview}
 					{done}
+					{allowEmbeds}
 					{onToolCallResolved}
 				/>
 			</div>

src/lib/components/chat/Messages/Markdown.svelte

@@ -48,7 +48,7 @@
 	export let paragraphTag = 'p';
 	export let editCodeBlock = true;
 	export let topPadding = false;
-	export let allowEmbeds = true;
+	export let allowEmbeds = false;
 
 	export let sourceIds = [];
 

src/lib/components/chat/Messages/Markdown/AlertRenderer.svelte

@@ -75,6 +75,7 @@
 	export let alert: AlertData;
 	export let id = '';
 	export let tokenIdx = 0;
+	export let allowEmbeds = false;
 	export let onTaskClick: ((event: MouseEvent) => void) | undefined = undefined;
 	export let onSourceClick: ((event: MouseEvent) => void) | undefined = undefined;
 </script>
@@ -105,6 +106,12 @@ Renders the following Markdown as alerts:
 		<span class=" font-normal">{alert.type}</span>
 	</div>
 	<div class="pb-2">
-		<MarkdownTokens id={`${id}-${tokenIdx}`} tokens={alert.tokens} {onTaskClick} {onSourceClick} />
+		<MarkdownTokens
+			id={`${id}-${tokenIdx}`}
+			tokens={alert.tokens}
+			{allowEmbeds}
+			{onTaskClick}
+			{onSourceClick}
+		/>
 	</div>
 </div>

src/lib/components/chat/Messages/Markdown/ColonFenceBlock.svelte

@@ -14,6 +14,7 @@
 
 	export let done: boolean = true;
 	export let editCodeBlock: boolean = true;
+	export let allowEmbeds: boolean = false;
 	export let sourceIds: string[] = [];
 	export let onTaskClick: Function = () => {};
 	export let onSourceClick: Function = () => {};
@@ -80,6 +81,7 @@
 			id={`${id}-${tokenIdx}-cf`}
 			tokens={token.tokens}
 			{done}
+			{allowEmbeds}
 			{editCodeBlock}
 			{sourceIds}
 			{onTaskClick}

src/lib/components/chat/Messages/Markdown/ConsecutiveDetailsGroup.svelte

@@ -35,7 +35,7 @@
 	}> = [];
 
 	export let messageDone = true;
-	export let allowEmbeds = true;
+	export let allowEmbeds = false;
 	export let compactPreview = false;
 	export let resolvable = false;
 	export let resolvingCallId = '';

src/lib/components/chat/Messages/Markdown/MarkdownTokens.svelte

@@ -46,7 +46,7 @@
 
 	export let editCodeBlock = true;
 	export let topPadding = false;
-	export let allowEmbeds = true;
+	export let allowEmbeds = false;
 
 	export let onSave: Function = () => {};
 	export let onUpdate: Function = () => {};
@@ -303,7 +303,7 @@
 	{:else if token.type === 'blockquote'}
 		{@const alert = alertComponent(token)}
 		{#if alert}
-			<AlertRenderer {token} {alert} />
+			<AlertRenderer {token} {alert} {allowEmbeds} />
 		{:else}
 			<blockquote dir="auto">
 				<svelte:self
@@ -312,6 +312,7 @@
 					{messageId}
 					tokens={token.tokens}
 					{done}
+					{allowEmbeds}
 					{save}
 					{preview}
 					{compactPreview}
@@ -353,6 +354,7 @@
 							tokens={item.tokens}
 							top={token.loose}
 							{done}
+							{allowEmbeds}
 							{save}
 							{preview}
 							{compactPreview}
@@ -393,6 +395,7 @@
 									tokens={item.tokens}
 									top={token.loose}
 									{done}
+									{allowEmbeds}
 									{save}
 									{preview}
 									{compactPreview}
@@ -410,6 +413,7 @@
 								tokens={item.tokens}
 								top={token.loose}
 								{done}
+								{allowEmbeds}
 								{save}
 								{preview}
 								{compactPreview}
@@ -469,6 +473,7 @@
 									tokens={marked.lexer(decode(detailToken.text))}
 									attributes={detailToken?.attributes}
 									{done}
+									{allowEmbeds}
 									{save}
 									{preview}
 									{compactPreview}
@@ -503,6 +508,7 @@
 				id={`${id}-${tokenIdx}-tc`}
 				attributes={token.attributes}
 				resultContent={getDetailTextContent(token)}
+				{allowEmbeds}
 				resolvable={!!chatId && !!messageId && save}
 				resolving={resolvingCallId === token.attributes?.id}
 				onResolve={(approved) => resolveToolCall(token.attributes?.id ?? '', approved)}
@@ -528,6 +534,7 @@
 						tokens={marked.lexer(decode(token.text))}
 						attributes={token?.attributes}
 						{done}
+						{allowEmbeds}
 						{save}
 						{preview}
 						{compactPreview}
@@ -627,6 +634,7 @@
 			{token}
 			{tokenIdx}
 			{done}
+			{allowEmbeds}
 			{editCodeBlock}
 			{sourceIds}
 			{onTaskClick}

src/lib/components/chat/Messages/ResponseMessage.svelte

@@ -715,7 +715,7 @@
 							</div>
 						{/if}
 
-						{#if message?.embeds && message.embeds.length > 0}
+						{#if !readOnly && message?.embeds && message.embeds.length > 0}
 							<div
 								class="my-1 w-full flex overflow-x-auto gap-2 flex-wrap"
 								id={`${message.id}-embeds-container`}
@@ -843,6 +843,7 @@
 									{editCodeBlock}
 									{topPadding}
 									done={message?.done ?? false}
+									allowEmbeds={!readOnly}
 									{model}
 									onTaskClick={async (e) => {
 										console.log(e);

src/lib/components/chat/Messages/StructuredOutputRenderer.svelte

@@ -27,6 +27,7 @@
 	export let renderMarkdown = true;
 	export let editCodeBlock = true;
 	export let topPadding = false;
+	export let allowEmbeds = false;
 	export let sourceIds: string[] = [];
 	export let formatMessageContent: (content: string) => string = (content) => content;
 	export let onSave: any = () => {};
@@ -83,6 +84,7 @@
 					{preview}
 					{compactPreview}
 					{done}
+					{allowEmbeds}
 					{editCodeBlock}
 					{topPadding}
 					{sourceIds}
@@ -103,6 +105,7 @@
 			tokens={displayItem.tokens}
 			messageDone={done}
 			{compactPreview}
+			{allowEmbeds}
 			resolvable={!!chatId && !!messageId && save}
 			{resolvingCallId}
 			onResolve={resolveToolCall}
@@ -139,6 +142,7 @@
 										{messageId}
 										content={detailToken.text}
 										{done}
+										{allowEmbeds}
 										{save}
 										{preview}
 										{compactPreview}
@@ -173,6 +177,7 @@
 				id={`${id}-${displayItem.id}-tool-call`}
 				attributes={detailToken.attributes}
 				resultContent={detailToken.text}
+				{allowEmbeds}
 				resolvable={!!chatId && !!messageId && save}
 				resolving={resolvingCallId === detailToken.attributes?.id}
 				onResolve={(approved) => resolveToolCall(detailToken.attributes?.id ?? '', approved)}
@@ -197,6 +202,7 @@
 							{messageId}
 							content={detailToken.text}
 							{done}
+							{allowEmbeds}
 							{save}
 							{preview}
 							{compactPreview}

src/lib/components/common/ToolCallDisplay.svelte

@@ -35,6 +35,7 @@
 
 	export let open = false;
 	export let grouped = false;
+	export let allowEmbeds = false;
 	export let className = '';
 	export let resolvable = false;
 	export let resolving = false;
@@ -173,7 +174,7 @@
 </script>
 
 <div {id} class={className}>
-	{#if !grouped && embeds && Array.isArray(embeds) && embeds.length > 0}
+	{#if allowEmbeds && !grouped && embeds && Array.isArray(embeds) && embeds.length > 0}
 		<!-- Embed Mode: Show iframes without collapsible behavior -->
 		<div class="py-1 w-full cursor-pointer">
 			<div class="w-full text-xs text-gray-500">