Chat Agent: render markdown tables properly, show web-search usage to admins, fix pricing leak

- Render GFM pipe tables as real <table> markup (with horizontal scroll) in the
Test Chat panel, Conversations transcript, and the embeddable widget, instead
of dumping raw "| a | b |" text into a narrow chat bubble.
- Track whether a reply actually used the search_the_web tool and surface a
"Used live web search" badge to admins (Test Chat + Conversations), so a
live-web-sourced answer is never mistaken for a knowledge-base answer.
- Fix a real pricing leak: a visitor comparison question ("are you cheaper than
X") caused the agent to recite actual EZOFIS pricing pulled from the tenant's
own indexed content, because the comparison-table instruction pushed the
model to fill every cell from retrieval, overriding the separate "never
disclose pricing" rule. Added a hard, code-level backstop that strips
dollar-amount/discount patterns out of retrieved chunk text before it ever
reaches a prompt, plus reinforced the comparison-table instruction itself.
- Make the Gemini fast-crawl reindex path surface the model's actual response
when it fails to return valid JSON, instead of a generic unhelpful error.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

SKILLS-SECURITY.md

@@ -4,11 +4,13 @@ The Chat Agent's Skills feature follows Anthropic's Agent Skills anatomy: each s
 SKILL.md-format file (real YAML frontmatter) with `name` + `description` + `instructions` (the
 "brain," always injected into the agent's system prompt), plus optional `references/` (domain
 knowledge), `assets/` (output snippets), `templates/` (reusable output templates), `scripts/`
-(mechanical helpers), and `evals/` (test cases). This document covers the four things an admin
+(mechanical helpers), and `evals/` (test cases). This document covers the five things an admin
 authoring skills should understand before relying on them: **the live chat agent never executes
 scripts**, **an admin can run scripts explicitly, in a sandboxed subprocess, with real but
-limited protection**, **references/assets/templates are visitor-searchable**, and **live web
-search is opt-in, off by default, and still genuinely unverified external content**.
+limited protection**, **references/assets/templates are visitor-searchable**, **live web
+search is opt-in, off by default, and still genuinely unverified external content**, and
+**pricing mentions are stripped out of retrieved knowledge-base content before the model ever
+sees them, as a hard backstop behind the "never disclose pricing" instruction**.
 
 ## The live chat agent never executes scripts
 
@@ -129,6 +131,12 @@ prompt template Gemini receives), and stay true regardless of what a skill's ins
   prefixed with that framing before the model ever sees it (`_format_web_search_results`).
 - **Never reachable without both code-level gates**, same admin-controlled pattern as every other
   opt-in feature in this project (Gemini fast indexing, the Gemini chat provider).
+- **Every use is visible to admins, per reply.** `ChatAgentMessage.used_web_search` records whether
+  a given assistant reply actually invoked the tool, surfaced as a "Used live web search" badge in
+  both the Test Chat panel and the Conversations transcript — an admin reviewing a conversation can
+  always tell a live-web-sourced answer apart from a knowledge-base answer, rather than having to
+  guess or trust the model's own framing. Deliberately not shown to visitors on the public widget —
+  it's an admin auditing signal, not visitor-facing UX.
 
 **What is NOT protected — the residual risk that's genuinely still there, and now wider:**
 - **The `query` argument is attacker-influenced, and now open-ended.** It comes from the model,
@@ -148,6 +156,35 @@ prompt template Gemini receives), and stay true regardless of what a skill's ins
   leave the toggle off — `search_knowledge_base`-only answers, with "Requires confirmation" for
   anything the knowledge base doesn't cover, still work fine without it.
 
+## Pricing is redacted at retrieval, not just prohibited in the prompt
+
+The Non-Negotiable Rules in the default skill's `instructions` say never to disclose EZOFIS's own
+pricing — but a prompt instruction alone isn't a hard guarantee if the tenant's own indexed
+Drive/website content happens to contain real prices (a pricing page got crawled, a proposal
+template lists a rate, etc.). A model asked to fill in a comparison table under pressure can end
+up reciting whatever facts `search_knowledge_base` handed it, instruction or not — this happened
+in practice: a visitor asking "are you cheaper than \<competitor\>" got back a table with real
+per-user-per-month figures pulled straight from indexed content.
+
+The fix is a hard, code-level backstop rather than a stronger-worded reminder:
+`chat_agent_retrieval.py`'s `retrieve_relevant_chunks` — the single function both the agentic
+`search_knowledge_base` tool and the Gemini single-shot path call — strips dollar-amount and
+percentage-discount patterns out of chunk text with `_redact_pricing_mentions` *before* that text
+is ever assembled into a prompt. The model never receives the figures, so it has nothing to leak
+regardless of how a question is phrased or which instruction it weighs more heavily. This is
+deliberately broad (any `$<amount>`, not only ones followed by `/user` or `/month`) — the
+Non-Negotiable Rule covers "any subscription price, per-user price, discount, implementation fee,
+or contract value," and an over-redacted non-pricing dollar mention is a far safer failure mode
+than a leaked real price. The always-injected comparison-table instruction was also updated to
+explicitly say a pricing row gets "Not disclosed via chat," not a redaction placeholder repeated
+verbatim, so the reply still reads naturally.
+
+**What is NOT protected:** this only redacts content retrieved via `search_knowledge_base` (the
+tenant's own indexed Drive/website/skill content). It cannot redact a price the model might
+otherwise generate on its own without any retrieval backing it, though that's a hallucination risk
+covered by the general "never fabricate" instruction, not a leak of real data. It also does not
+retroactively fix anything already sent in a *past* reply before this change shipped.
+
 ## Summary
 
 | Skill section  | Injected into every reply? | Visitor-searchable via the KB? | Executed?                                  |

backend/app/chat_agent_chat.py

@@ -182,8 +182,11 @@ def build_system_prompt(
         "below has no confirmed facts about the other product — mark cells you can't confirm as "
         "'Requires confirmation' rather than skipping the comparison entirely or giving only a "
         "vague capability summary. Never state a specific claim about the other product unless it "
-        "came from the context below. End with a recommendation for the single most useful next "
-        "validation step (e.g. a structured demo using the same use case).",
+        "came from the context below. This table is not an exception to the pricing rule below — "
+        "if a row would compare pricing, cost, or discounts, write 'Not disclosed via chat' in "
+        "the Our approach cell rather than any figure, even one that appears in the context below. "
+        "End with a recommendation for the single most useful next validation step (e.g. a "
+        "structured demo using the same use case).",
         "- If the knowledge base doesn't cover something, and it's not a comparison request (see "
         "the rule above for those), your ENTIRE answer is: say so honestly, in one short sentence, "
         "and offer to have the team follow up. Do not add a 'however, based on general "
@@ -284,8 +287,11 @@ def build_agentic_system_prompt(
         "have no confirmed facts about the other product — mark cells you can't confirm as "
         "'Requires confirmation' rather than skipping the comparison entirely or giving only a "
         "vague capability summary. Never state a specific claim about the other product unless it "
-        "came from an actual search_knowledge_base result. End with a recommendation for the "
-        "single most useful next validation step (e.g. a structured demo using the same use case).",
+        "came from an actual search_knowledge_base result. This table is not an exception to the "
+        "pricing rule below — if a row would compare pricing, cost, or discounts, write 'Not "
+        "disclosed via chat' in the Our approach cell rather than any figure, even one that came "
+        "back from search_knowledge_base. End with a recommendation for the single most useful "
+        "next validation step (e.g. a structured demo using the same use case).",
         "- If the knowledge base still doesn't cover something after searching, and it's not a "
         "comparison request (see the rule above for those), your ENTIRE answer is: say so "
         "honestly, in one short sentence, and offer to have the team follow up. Do not add a "
@@ -463,6 +469,7 @@ def stream_agentic_reply_openai(
     tenant_id: int,
     db: Any,
     web_search_enabled: bool = False,
+    used_web_search: Optional[Dict[str, bool]] = None,
 ) -> Iterator[str]:
     """
     Agentic RAG: the model decides per-turn whether to call search_knowledge_base, can chain up
@@ -473,6 +480,12 @@ def stream_agentic_reply_openai(
 
     `web_search_enabled` offers a second tool, search_the_web, ONLY when the tenant has opted in
     (ChatAgentConfig.enable_web_search) — see SKILLS-SECURITY.md.
+
+    `used_web_search`, if given, is a mutable out-param — {"used": False} — flipped to True the
+    moment the search_the_web branch is attempted this turn. A generator can't return a value
+    alongside its yields, so the caller passes in a dict, reads it back once the generator is
+    exhausted, and persists it alongside the saved reply so admins can see which replies drew on
+    live web content instead of the knowledge base.
     """
     from .chat_agent_retrieval import retrieve_relevant_chunks  # local import: avoids a cycle
     # (chat_agent_retrieval -> chat_agent_ingest -> chat_agent_drive/crawler; none import this module)
@@ -547,6 +560,8 @@ def stream_agentic_reply_openai(
                 args = {}
 
             if slot["name"] == "search_the_web" and web_search_enabled:
+                if used_web_search is not None:
+                    used_web_search["used"] = True
                 web_query = (args.get("query") or "").strip()
                 try:
                     from .chat_agent_web_research import search_web_via_gemini

backend/app/chat_agent_common.py

@@ -133,7 +133,7 @@ Escalate when the visitor requests pricing, a quotation, or contract terms; a ca
 
 ## 14. Live Web Search Guardrails (if enabled)
 
-When the search_the_web tool is available and the knowledge base doesn't have enough to give a detailed, useful answer, you may use it — but only after first trying search_knowledge_base. Good uses: background on a named competitor or alternative product, general industry or technology context (e.g. what a technical term or standard means), or public information about an integration or partner ecosystem. Never use it to look up or estimate EZOFIS pricing, to find information about EZOFIS's own customers or confidential matters (use the knowledge base for anything about EZOFIS itself), or to look up private or personal information about any individual. Always present results from this tool as unverified public information, not confirmed fact, and note that vendor or source confirmation may be needed.
+Treat search_the_web as a last resort, not a default — reach for it only when it is genuinely required, meaning search_knowledge_base has already been tried for this question and did not return enough to give a detailed, useful answer. Do not use it merely because a question sounds like it needs current information, and do not use it on every turn of a conversation just because it is available. Good uses, once that bar is met: background on a named competitor or alternative product, general industry or technology context (e.g. what a technical term or standard means), or public information about an integration or partner ecosystem. Never use it to look up or estimate EZOFIS pricing, to find information about EZOFIS's own customers or confidential matters (use the knowledge base for anything about EZOFIS itself), or to look up private or personal information about any individual. Always present results from this tool as unverified public information, not confirmed fact, and note that vendor or source confirmation may be needed.
 
 ## 15. Final Behaviour Summary
 

backend/app/chat_agent_gemini_crawler.py

@@ -11,7 +11,7 @@ from __future__ import annotations
 import json
 import logging
 import os
-from typing import Any, Dict, List
+from typing import Any, Dict, List, Optional, Tuple
 from urllib.parse import urlparse
 
 from .chat_agent_crawler import _discover_sitemap_urls
@@ -19,7 +19,10 @@ from .chat_agent_crawler import _discover_sitemap_urls
 logger = logging.getLogger(__name__)
 
 DEFAULT_MAX_PAGES = 40
-BATCH_SIZE = 8
+# Smaller batches ask the model to fetch/format less content per call, which in practice makes it
+# much more likely to return strict JSON instead of drifting into prose (e.g. an explanation of
+# why it couldn't format something) partway through a large batch.
+BATCH_SIZE = 4
 GEMINI_MODEL = os.getenv("CHAT_AGENT_GEMINI_MODEL") or "gemini-2.5-flash"
 
 
@@ -55,10 +58,33 @@ def _discover_urls(base_url: str, max_pages: int) -> List[str]:
     return urls[:max_pages]
 
 
-def _fetch_batch(client: Any, urls: List[str]) -> List[Dict[str, str]]:
+def _extract_json_array(text: str) -> Optional[list]:
+    """Parse a JSON array out of model output that's supposed to be JSON-only. Tries a direct
+    parse first, then falls back to pulling out the outermost [...] substring — the model
+    sometimes wraps the array in a sentence ("Here's the JSON: [...]") despite being told not
+    to. Returns None if neither approach yields a JSON array."""
+    try:
+        data = json.loads(text)
+        return data if isinstance(data, list) else None
+    except (json.JSONDecodeError, ValueError):
+        pass
+    start = text.find("[")
+    end = text.rfind("]")
+    if start == -1 or end == -1 or end <= start:
+        return None
+    try:
+        data = json.loads(text[start : end + 1])
+        return data if isinstance(data, list) else None
+    except (json.JSONDecodeError, ValueError):
+        return None
+
+
+def _fetch_batch(client: Any, urls: List[str]) -> Tuple[List[Dict[str, str]], Optional[str]]:
     """Fetch a batch of URLs via Gemini's url_context tool in one call, asking for a JSON array of
-    {url, title, markdown} back. Returns [] (not a raised exception) on malformed model output —
-    the caller just gets fewer pages from that batch, not a broken reindex."""
+    {url, title, markdown} back. Returns ([], error_snippet) — not a raised exception — on
+    malformed model output, so the caller just gets fewer pages from that batch, not a broken
+    reindex; error_snippet is a truncated view of what the model actually returned, so a total
+    failure can be diagnosed from the index log detail instead of guessing blind."""
     from google.genai import types
 
     urls_block = "\n".join(f"- {u}" for u in urls)
@@ -83,13 +109,12 @@ def _fetch_batch(client: Any, urls: List[str]) -> List[Dict[str, str]]:
         if text.lower().startswith("json"):
             text = text[4:]
         text = text.strip()
-    try:
-        data = json.loads(text)
-    except (json.JSONDecodeError, ValueError):
-        logger.warning("Gemini fast-crawl batch returned non-JSON output (%d chars); skipping batch", len(text))
-        return []
-    if not isinstance(data, list):
-        return []
+
+    data = _extract_json_array(text)
+    if data is None:
+        snippet = text[:300]
+        logger.warning("Gemini fast-crawl batch returned non-JSON output (%d chars): %r", len(text), snippet)
+        return [], (snippet or "(empty response)")
 
     out: List[Dict[str, str]] = []
     for item in data:
@@ -101,7 +126,11 @@ def _fetch_batch(client: Any, urls: List[str]) -> List[Dict[str, str]]:
             continue
         title = (item.get("title") or url).strip()
         out.append({"url": url, "title": title, "markdown": markdown})
-    return out
+    if not out:
+        # Valid JSON array, but every entry was skipped (missing url/markdown) — the model
+        # likely reported it couldn't fetch anything in this batch. Still worth surfacing why.
+        return [], f"model returned {len(data)} item(s) but none had usable url+markdown"
+    return out, None
 
 
 def fast_crawl_website_via_gemini(base_url: str, max_pages: int = DEFAULT_MAX_PAGES) -> List[Dict[str, str]]:
@@ -117,18 +146,24 @@ def fast_crawl_website_via_gemini(base_url: str, max_pages: int = DEFAULT_MAX_PA
         raise RuntimeError(f"No pages discovered for '{base_url}'")
 
     results: List[Dict[str, str]] = []
+    last_error: Optional[str] = None
     for i in range(0, len(urls), BATCH_SIZE):
         batch = urls[i : i + BATCH_SIZE]
         try:
-            results.extend(_fetch_batch(client, batch))
+            batch_results, batch_error = _fetch_batch(client, batch)
+            results.extend(batch_results)
+            if batch_error:
+                last_error = batch_error
         except Exception as e:
             logger.warning("Gemini fast-crawl batch failed for %s: %s", batch, e)
+            last_error = str(e)
         if len(results) >= max_pages:
             break
 
     if not results:
+        detail = f" Gemini's response: {last_error!r}" if last_error else ""
         raise RuntimeError(
             f"Gemini could not fetch any usable content from {base_url}. Try the standard reindex "
-            "instead, or check that the site is publicly reachable."
+            f"instead, or check that the site is publicly reachable.{detail}"
         )
     return results[:max_pages]

backend/app/chat_agent_retrieval.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import re
 from typing import Any, Dict, List, Optional
 
 import numpy as np
@@ -10,6 +11,29 @@ from sqlalchemy.orm import Session
 from .chat_agent_ingest import embed_texts
 from .database import ChatAgentChunk, ChatAgentDocument
 
+# Hard, code-level backstop for the "never disclose pricing" rule — a prompt instruction alone
+# isn't enough if the tenant's own indexed Drive/website content happens to contain a real price
+# (e.g. a pricing page got crawled), because a model asked to fill in a comparison table under
+# pressure can end up reciting whatever facts retrieval handed it, instruction or not. This strips
+# dollar-amount and percentage-discount patterns out of retrieved chunk text BEFORE it ever reaches
+# a prompt, so the model has nothing to leak regardless of what the system prompt says. Deliberately
+# broad/aggressive (any "$<amount>", not just ones followed by "/user" or "/month") — the
+# Non-Negotiable Rules cover "any subscription price, per-user price, discount, implementation fee,
+# or contract value," and an over-redacted non-pricing dollar mention is a far safer failure mode
+# than a leaked real price.
+_PRICE_REDACTION_RE = re.compile(
+    r"\$\s?\d[\d,]*(?:\.\d{1,2})?(?:\s*(?:/|\bper\b)\s*\w+)?"
+    r"|\b\d{1,3}\s?%\s*(?:discount|off)\b"
+    r"|\bdiscount(?:s|ed)?\s*of\s*\d{1,3}\s?%",
+    re.IGNORECASE,
+)
+
+
+def _redact_pricing_mentions(text: str) -> str:
+    if not text:
+        return text
+    return _PRICE_REDACTION_RE.sub("[pricing — not disclosed via chat]", text)
+
 
 def retrieve_relevant_chunks(
     db: Session,
@@ -54,7 +78,7 @@ def retrieve_relevant_chunks(
         chunk, doc = valid_rows[int(idx)]
         out.append(
             {
-                "text": chunk.text,
+                "text": _redact_pricing_mentions(chunk.text),
                 "title": doc.title,
                 "source_type": doc.source_type,
                 "source_ref": doc.source_ref,

backend/app/chat_agent_routes.py

@@ -582,7 +582,12 @@ def get_conversation(conversation_id: int, tc: TenantContext = Depends(get_tenan
     return {
         **_conversation_to_dict(row),
         "messages": [
-            {"role": m.role, "content": m.content, "created_at": m.created_at.isoformat() if m.created_at else None}
+            {
+                "role": m.role,
+                "content": m.content,
+                "used_web_search": bool(m.used_web_search),
+                "created_at": m.created_at.isoformat() if m.created_at else None,
+            }
             for m in msgs
         ],
     }
@@ -768,6 +773,11 @@ async def public_send_message(public_id: str, body: ChatAgentMessageRequest, db:
     # happened (either via this exact instruction last time, or via the client-side greeting), so
     # drop the instruction from the prompt entirely rather than trusting the model to self-limit.
     already_asked_for_contact = any(h["role"] == "assistant" for h in history)
+    # Mutable out-param the agentic loop flips to True if it actually invokes search_the_web this
+    # turn — read back after streaming finishes so the saved message (and the live SSE stream) can
+    # tell admins whether this specific reply drew on live web content. Always False on the Gemini
+    # provider path below, which doesn't offer this tool.
+    used_web_search_flag: Dict[str, bool] = {"used": False}
 
     if provider == "gemini":
         # Secondary/opt-in provider: kept on the original single-shot RAG path (retrieve once,
@@ -799,7 +809,12 @@ async def public_send_message(public_id: str, body: ChatAgentMessageRequest, db:
 
         def make_reply_iter():
             return stream_agentic_reply_openai(
-                system_prompt, history, tenant_id, db, web_search_enabled=web_search_enabled
+                system_prompt,
+                history,
+                tenant_id,
+                db,
+                web_search_enabled=web_search_enabled,
+                used_web_search=used_web_search_flag,
             )
 
     async def event_generator():
@@ -835,13 +850,22 @@ async def public_send_message(public_id: str, body: ChatAgentMessageRequest, db:
 
         full_text = "".join(full_text_parts).strip()
         if full_text:
-            db.add(ChatAgentMessage(conversation_id=convo.id, role="assistant", content=full_text))
+            db.add(
+                ChatAgentMessage(
+                    conversation_id=convo.id,
+                    role="assistant",
+                    content=full_text,
+                    used_web_search=1 if used_web_search_flag["used"] else 0,
+                )
+            )
             convo.last_message_at = datetime.utcnow()
             db_commit_with_retry(db)
         # Capture/update the lead whenever we have an email, independent of whether the AI
         # reply itself succeeded — a dropped LLM call shouldn't lose a volunteered email.
         if convo.visitor_email:
             _capture_or_update_lead(db, cfg, convo)
+        if used_web_search_flag["used"]:
+            yield f"data: {json.dumps({'meta': {'used_web_search': True}})}\n\n"
         yield "data: [DONE]\n\n"
 
     return StreamingResponse(event_generator(), media_type="text/event-stream", headers=_CORS_HEADERS)
@@ -866,6 +890,10 @@ _WIDGET_JS_TEMPLATE = r"""(function () {
     '.ezofis-chat-msg{max-width:82%;padding:9px 12px;border-radius:12px;font-size:13.5px;line-height:1.45;white-space:pre-wrap;word-wrap:break-word}' +
     '.ezofis-chat-msg.assistant{background:#fff;border:1px solid #e2e8f0;color:#1e293b;align-self:flex-start;border-bottom-left-radius:2px}' +
     '.ezofis-chat-msg.user{background:#7c3aed;color:#fff;align-self:flex-end;border-bottom-right-radius:2px}' +
+    '.ezofis-chat-table-wrap{overflow-x:auto;margin:4px 0}' +
+    '.ezofis-chat-table{border-collapse:collapse;font-size:12px;white-space:normal}' +
+    '.ezofis-chat-table th,.ezofis-chat-table td{border:1px solid #e2e8f0;padding:4px 6px;text-align:left;vertical-align:top;white-space:nowrap}' +
+    '.ezofis-chat-table th{background:#f1f5f9;font-weight:600}' +
     '.ezofis-chat-disclaimer{padding:6px 14px;font-size:11px;line-height:1.4;color:#94a3b8;background:#f8fafc;border-top:1px solid #eef2f7;text-align:center}' +
     '.ezofis-chat-footer{padding:10px;border-top:1px solid #e2e8f0;display:flex;gap:8px;background:#fff}' +
     '.ezofis-chat-footer textarea{flex:1;resize:none;border:1px solid #cbd5e1;border-radius:10px;padding:9px 10px;font-size:13.5px;font-family:inherit;max-height:80px;min-height:38px}' +
@@ -905,16 +933,16 @@ _WIDGET_JS_TEMPLATE = r"""(function () {
     return el;
   }
 
-  // Renders "Sources: [Title](https://...)" (and any inline markdown links) as real,
-  // safe <a> elements — text is inserted via createTextNode/textContent only, and only
-  // http(s) URLs matched by the regex itself ever reach an href, so no HTML/script injection.
-  function renderRichText(el, text) {
-    el.textContent = '';
+  // Renders "Sources: [Title](https://...)" (and any inline markdown links) as real, safe <a>
+  // elements into the given container — text is inserted via createTextNode/textContent only,
+  // and only http(s) URLs matched by the regex itself ever reach an href, so no HTML/script
+  // injection is possible from model output.
+  function appendInlineLinks(container, text) {
     var linkRe = /\[([^\]]+)\]\((https?:\/\/[^\s)]+)\)/g;
     var lastIndex = 0;
     var m;
     while ((m = linkRe.exec(text)) !== null) {
-      if (m.index > lastIndex) el.appendChild(document.createTextNode(text.slice(lastIndex, m.index)));
+      if (m.index > lastIndex) container.appendChild(document.createTextNode(text.slice(lastIndex, m.index)));
       var a = document.createElement('a');
       a.href = m[2];
       a.textContent = m[1];
@@ -922,10 +950,92 @@ _WIDGET_JS_TEMPLATE = r"""(function () {
       a.rel = 'noopener noreferrer';
       a.style.color = 'inherit';
       a.style.textDecoration = 'underline';
-      el.appendChild(a);
+      container.appendChild(a);
       lastIndex = linkRe.lastIndex;
     }
-    if (lastIndex < text.length) el.appendChild(document.createTextNode(text.slice(lastIndex)));
+    if (lastIndex < text.length) container.appendChild(document.createTextNode(text.slice(lastIndex)));
+  }
+
+  // A GFM pipe-table row: trimmed, starts and ends with "|" — the exact shape the agent is
+  // instructed to use for comparison tables.
+  function isTableRowLine(line) {
+    var t = line.trim();
+    return t.length >= 2 && t.charAt(0) === '|' && t.charAt(t.length - 1) === '|';
+  }
+
+  function isTableSeparatorLine(line) {
+    if (!isTableRowLine(line)) return false;
+    var t = line.trim();
+    var cells = t.slice(1, -1).split('|');
+    for (var i = 0; i < cells.length; i++) {
+      if (!/^:?-+:?$/.test(cells[i].trim())) return false;
+    }
+    return cells.length > 0;
+  }
+
+  function splitTableRow(line) {
+    var t = line.trim();
+    return t.slice(1, -1).split('|').map(function (c) { return c.trim(); });
+  }
+
+  // Splits message text into text/table blocks so a markdown pipe table renders as a real
+  // <table> instead of raw "| a | b |" text wrapped mid-word inside a narrow chat bubble.
+  function renderRichContent(el, text) {
+    el.textContent = '';
+    var lines = text.split('\n');
+    var textBuf = [];
+    function flushText() {
+      if (textBuf.length) {
+        appendInlineLinks(el, textBuf.join('\n'));
+        textBuf = [];
+      }
+    }
+    var i = 0;
+    while (i < lines.length) {
+      var line = lines[i];
+      var nextLine = i + 1 < lines.length ? lines[i + 1] : '';
+      if (isTableRowLine(line) && isTableSeparatorLine(nextLine)) {
+        flushText();
+        var header = splitTableRow(line);
+        var j = i + 2;
+        var rows = [];
+        while (j < lines.length && isTableRowLine(lines[j])) {
+          rows.push(splitTableRow(lines[j]));
+          j++;
+        }
+        var wrap = document.createElement('div');
+        wrap.className = 'ezofis-chat-table-wrap';
+        var table = document.createElement('table');
+        table.className = 'ezofis-chat-table';
+        var thead = document.createElement('thead');
+        var headTr = document.createElement('tr');
+        header.forEach(function (cell) {
+          var th = document.createElement('th');
+          appendInlineLinks(th, cell);
+          headTr.appendChild(th);
+        });
+        thead.appendChild(headTr);
+        table.appendChild(thead);
+        var tbody = document.createElement('tbody');
+        rows.forEach(function (row) {
+          var tr = document.createElement('tr');
+          row.forEach(function (cell) {
+            var td = document.createElement('td');
+            appendInlineLinks(td, cell);
+            tr.appendChild(td);
+          });
+          tbody.appendChild(tr);
+        });
+        table.appendChild(tbody);
+        wrap.appendChild(table);
+        el.appendChild(wrap);
+        i = j;
+        continue;
+      }
+      textBuf.push(line);
+      i++;
+    }
+    flushText();
   }
 
   function ensureSession() {
@@ -979,8 +1089,8 @@ _WIDGET_JS_TEMPLATE = r"""(function () {
             if (payload === '[DONE]') return;
             try {
               var obj = JSON.parse(payload);
-              if (obj.delta) { acc += obj.delta; renderRichText(replyEl, acc); body.scrollTop = body.scrollHeight; }
-              if (obj.error) { renderRichText(replyEl, acc || 'Sorry, something went wrong.'); }
+              if (obj.delta) { acc += obj.delta; renderRichContent(replyEl, acc); body.scrollTop = body.scrollHeight; }
+              if (obj.error) { renderRichContent(replyEl, acc || 'Sorry, something went wrong.'); }
             } catch (e) {}
           });
           return pump();

backend/app/database.py

@@ -538,6 +538,10 @@ class ChatAgentMessage(Base):
     conversation_id = Column(Integer, ForeignKey("chat_agent_conversations.id"), nullable=False, index=True)
     role = Column(String, nullable=False)  # user | assistant
     content = Column(Text, default="")
+    # True when this reply used the search_the_web tool — surfaced to admins in the Test Chat
+    # and Conversations views so they can tell live-web-sourced answers apart from knowledge-base
+    # answers at a glance.
+    used_web_search = Column(Integer, default=0)
     created_at = Column(DateTime, default=datetime.utcnow)
 
 
@@ -850,6 +854,13 @@ def run_migrations(connection_engine):
                     text("ALTER TABLE chat_agent_configs ADD COLUMN enable_web_search INTEGER DEFAULT 0")
                 )
 
+        if insp.has_table("chat_agent_messages"):
+            msgcols = [c["name"] for c in insp.get_columns("chat_agent_messages")]
+            if "used_web_search" not in msgcols:
+                conn.execute(
+                    text("ALTER TABLE chat_agent_messages ADD COLUMN used_web_search INTEGER DEFAULT 0")
+                )
+
 
 # Create tables then migrate legacy SQLite schemas
 Base.metadata.create_all(bind=engine)

frontend/src/components/settings/ChatAgentPanel.jsx

@@ -4,6 +4,7 @@ import {
     Bot,
     ClipboardCopy,
     ExternalLink,
+    Globe,
     Loader2,
     Mail,
     MessageSquare,
@@ -72,7 +73,7 @@ function CopyBlock({ label, code }) {
 
 // Renders "[Title](https://...)" links safely — React escapes plain text nodes by default,
 // and only http(s) URLs matched by the regex itself ever become an href.
-function TestChatRichText({ text }) {
+function renderInlineLinks(text, keyPrefix) {
     const linkRe = /\[([^\]]+)\]\((https?:\/\/[^\s)]+)\)/g;
     const parts = [];
     let lastIndex = 0;
@@ -80,11 +81,13 @@ function TestChatRichText({ text }) {
     let key = 0;
     while ((match = linkRe.exec(text)) !== null) {
         if (match.index > lastIndex) {
-            parts.push(<React.Fragment key={key++}>{text.slice(lastIndex, match.index)}</React.Fragment>);
+            parts.push(
+                <React.Fragment key={`${keyPrefix}-${key++}`}>{text.slice(lastIndex, match.index)}</React.Fragment>
+            );
         }
         parts.push(
             <a
-                key={key++}
+                key={`${keyPrefix}-${key++}`}
                 href={match[2]}
                 target="_blank"
                 rel="noopener noreferrer"
@@ -96,9 +99,108 @@ function TestChatRichText({ text }) {
         lastIndex = linkRe.lastIndex;
     }
     if (lastIndex < text.length) {
-        parts.push(<React.Fragment key={key++}>{text.slice(lastIndex)}</React.Fragment>);
+        parts.push(<React.Fragment key={`${keyPrefix}-${key++}`}>{text.slice(lastIndex)}</React.Fragment>);
     }
-    return <>{parts}</>;
+    return parts;
+}
+
+// A GFM pipe-table row: trimmed, starts and ends with "|" — matches the exact shape the model is
+// instructed to produce for comparison tables (see chat_agent_chat.py's GROUNDING RULES).
+function isTableRowLine(line) {
+    const t = line.trim();
+    return t.length >= 2 && t.startsWith('|') && t.endsWith('|');
+}
+
+// The "|---|:---:|---|" alignment row that follows a table header — every cell must be only
+// dashes/colons, and at least one dash must be present so a lone "||" doesn't match.
+function isTableSeparatorLine(line) {
+    if (!isTableRowLine(line)) return false;
+    const inner = line.trim().slice(1, -1);
+    const cells = inner.split('|');
+    return cells.length > 0 && cells.every((c) => /^:?-+:?$/.test(c.trim()));
+}
+
+function splitTableRow(line) {
+    const inner = line.trim().slice(1, -1);
+    return inner.split('|').map((c) => c.trim());
+}
+
+// Splits message text into alternating text/table blocks so a markdown pipe table (which the
+// agent is told to use for comparisons) renders as a real, readable table instead of raw
+// "| a | b |" text wrapped mid-word inside a narrow chat bubble.
+function parseRichBlocks(text) {
+    const lines = text.split('\n');
+    const blocks = [];
+    let textBuf = [];
+    const flushText = () => {
+        if (textBuf.length) {
+            blocks.push({ type: 'text', content: textBuf.join('\n') });
+            textBuf = [];
+        }
+    };
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+        const nextLine = i + 1 < lines.length ? lines[i + 1] : '';
+        if (isTableRowLine(line) && isTableSeparatorLine(nextLine)) {
+            flushText();
+            const header = splitTableRow(line);
+            let j = i + 2;
+            const rows = [];
+            while (j < lines.length && isTableRowLine(lines[j])) {
+                rows.push(splitTableRow(lines[j]));
+                j++;
+            }
+            blocks.push({ type: 'table', header, rows });
+            i = j;
+            continue;
+        }
+        textBuf.push(line);
+        i++;
+    }
+    flushText();
+    return blocks;
+}
+
+function RichMessageContent({ text }) {
+    const blocks = useMemo(() => parseRichBlocks(text || ''), [text]);
+    return (
+        <>
+            {blocks.map((block, bi) =>
+                block.type === 'table' ? (
+                    <div key={`b${bi}`} className="my-1.5 -mx-1 overflow-x-auto">
+                        <table className="min-w-full border-collapse text-xs">
+                            <thead>
+                                <tr>
+                                    {block.header.map((cell, ci) => (
+                                        <th
+                                            key={ci}
+                                            className="border border-slate-200 bg-slate-100 px-2 py-1 text-left font-semibold whitespace-nowrap"
+                                        >
+                                            {renderInlineLinks(cell, `b${bi}h${ci}`)}
+                                        </th>
+                                    ))}
+                                </tr>
+                            </thead>
+                            <tbody>
+                                {block.rows.map((row, ri) => (
+                                    <tr key={ri}>
+                                        {row.map((cell, ci) => (
+                                            <td key={ci} className="border border-slate-200 px-2 py-1 align-top">
+                                                {renderInlineLinks(cell, `b${bi}r${ri}c${ci}`)}
+                                            </td>
+                                        ))}
+                                    </tr>
+                                ))}
+                            </tbody>
+                        </table>
+                    </div>
+                ) : (
+                    <React.Fragment key={`b${bi}`}>{renderInlineLinks(block.content, `b${bi}`)}</React.Fragment>
+                )
+            )}
+        </>
+    );
 }
 
 /** Talks to the SAME public session/message endpoints the embedded widget uses — a true
@@ -213,7 +315,7 @@ function TestChatPanel({ publicId, enabled }) {
                             const snapshot = acc;
                             setMessages((prev) => {
                                 const next = [...prev];
-                                next[next.length - 1] = { role: 'assistant', content: snapshot };
+                                next[next.length - 1] = { ...next[next.length - 1], role: 'assistant', content: snapshot };
                                 return next;
                             });
                         }
@@ -221,7 +323,14 @@ function TestChatPanel({ publicId, enabled }) {
                             const fallback = acc || 'Sorry, something went wrong.';
                             setMessages((prev) => {
                                 const next = [...prev];
-                                next[next.length - 1] = { role: 'assistant', content: fallback };
+                                next[next.length - 1] = { ...next[next.length - 1], role: 'assistant', content: fallback };
+                                return next;
+                            });
+                        }
+                        if (obj.meta && obj.meta.used_web_search) {
+                            setMessages((prev) => {
+                                const next = [...prev];
+                                next[next.length - 1] = { ...next[next.length - 1], usedWebSearch: true };
                                 return next;
                             });
                         }
@@ -289,7 +398,13 @@ function TestChatPanel({ publicId, enabled }) {
                                     : 'bg-white border border-slate-200 text-slate-800'
                             )}
                         >
-                            <TestChatRichText text={m.content} />
+                            {m.usedWebSearch ? (
+                                <span className="mb-1 flex w-fit items-center gap-1 rounded-full bg-sky-50 px-2 py-0.5 text-[10px] font-medium text-sky-700 ring-1 ring-sky-200">
+                                    <Globe className="h-3 w-3" />
+                                    Used live web search
+                                </span>
+                            ) : null}
+                            <RichMessageContent text={m.content} />
                         </div>
                     ))
                 )}
@@ -899,7 +1014,13 @@ export default function ChatAgentPanel({ onBack }) {
                                                             : 'bg-slate-100 text-slate-800'
                                                     )}
                                                 >
-                                                    {m.content}
+                                                    {m.used_web_search ? (
+                                                        <span className="mb-1 flex w-fit items-center gap-1 rounded-full bg-sky-50 px-2 py-0.5 text-[10px] font-medium text-sky-700 ring-1 ring-sky-200">
+                                                            <Globe className="h-3 w-3" />
+                                                            Used live web search
+                                                        </span>
+                                                    ) : null}
+                                                    <RichMessageContent text={m.content} />
                                                 </div>
                                             ))}
                                         </div>