feat(lightspeed): add Sources chip + popover for notebook context

[its-mitesh-kumar]

Description

Replace the inline SourcesCard in the Notebook view with a compact "N Sources" chip button that opens a PatternFly Popover displaying source documents. Each source is shown with a colored FileTypeIcon badge and optional description summary. This change is scoped exclusively to the Notebook context — the general chat view retains its original inline sources display.

Also consolidates source document handling during streaming to use the shared transformDocumentsToSources utility for consistency, and adds i18n translations for all 5 supported languages (Japanese, French, German, Spanish, Italian).

Fixed

• https://redhat.atlassian.net/browse/RHIDP-14655

UI after changes

S_.2026-07-03.at.1.02.25.PM.mov

S_.2026-07-03.at.1.03.36.PM.mov

S_.2026-07-03.at.1.04.11.PM.mov

S_.2026-07-03.at.2.11.46.PM.mov

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[rhdh-gh-app]

Important

This PR includes changes that affect public-facing API. Please ensure you are adding/updating documentation for new features or behavior.

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@red-hat-developer-hub/backstage-plugin-lightspeed	workspaces/lightspeed/plugins/lightspeed	minor	v2.9.1

[codecov]

Codecov Report

❌ Patch coverage is 68.88889% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 54.15%. Comparing base (c990755) to head (c087ef7).
⚠️ Report is 5 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3672      +/-   ##
==========================================
+ Coverage   54.12%   54.15%   +0.03%     
==========================================
  Files        2344     2346       +2     
  Lines       89539    89616      +77     
  Branches    25026    25055      +29     
==========================================
+ Hits        48460    48533      +73     
- Misses      39517    39521       +4     
  Partials     1562     1562              

Flag	Coverage Δ		*Carryforward flag
adoption-insights	83.70% <ø> (ø)		Carriedforward from 9182c07
ai-integrations	67.95% <ø> (ø)		Carriedforward from 9182c07
app-defaults	69.79% <ø> (ø)		Carriedforward from 9182c07
augment	46.39% <ø> (ø)		Carriedforward from 9182c07
boost	74.68% <ø> (ø)		Carriedforward from 9182c07
bulk-import	72.46% <ø> (ø)		Carriedforward from 9182c07
cost-management	14.10% <ø> (ø)		Carriedforward from 9182c07
dcm	61.81% <ø> (ø)		Carriedforward from 9182c07
extensions	61.53% <ø> (ø)		Carriedforward from 9182c07
global-floating-action-button	71.18% <ø> (ø)		Carriedforward from 9182c07
global-header	59.71% <ø> (ø)		Carriedforward from 9182c07
homepage	49.84% <ø> (ø)		Carriedforward from 9182c07
install-dynamic-plugins	56.77% <ø> (ø)		Carriedforward from 9182c07
konflux	91.49% <ø> (ø)		Carriedforward from 9182c07
lightspeed	68.86% <68.88%> (+0.36%)	⬆️
mcp-integrations	85.46% <ø> (ø)		Carriedforward from 9182c07
orchestrator	37.71% <ø> (ø)		Carriedforward from 9182c07
quickstart	65.63% <ø> (ø)		Carriedforward from 9182c07
sandbox	79.56% <ø> (ø)		Carriedforward from 9182c07
scorecard	82.67% <ø> (ø)		Carriedforward from 9182c07
theme	61.26% <ø> (ø)		Carriedforward from 9182c07
translations	7.25% <ø> (ø)		Carriedforward from 9182c07
x2a	78.68% <ø> (ø)		Carriedforward from 9182c07

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c990755...c087ef7. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[its-mitesh-kumar]

@HusneShabbir Lets firstly wait for @ShiranHi feedback, then only go for go for testing it. There are differences wrt to prototype like we are using PF popups and tried not overriding it much to look exactly as our prototype. Secondly in RHDH 2.1 we will not have the document summary, so we will be only showing documents name, that's why I added the lines between each doscuments.

[its-mitesh-kumar]

/fs-review

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:07 AM UTC · Completed 9:21 AM UTC
Commit: 0186e63 · View workflow run →

[fullsend-ai-review]

Review

Findings

Medium

• [injection-vuln] workspaces/lightspeed/plugins/lightspeed/src/components/SourcesChipModal.tsx:133 — The handleSourceClick function passes the link value directly to window.open() without URL scheme validation. The link originates from backend data (doc_url via transformDocumentsToSources). If backend data were poisoned, a javascript: URI could execute arbitrary code in the user's browser context. The if (link) guard only checks truthiness, not the URL scheme.
  Remediation: Validate the URL protocol before calling window.open():

  const url = new URL(link, window.location.origin);
  if (!['http:', 'https:'].includes(url.protocol)) return;

• [logic-error] workspaces/lightspeed/plugins/lightspeed/src/components/SourcesChipModal.tsx:139 — When isExternal is falsy, handleSourceClick calls window.open(link, '_self'), which navigates the entire browser window away from the Backstage SPA. This causes the user to lose their chat session and application state. In practice, transformDocumentsToSources sets isExternal: !!doc?.doc_url, so any source with a URL will have isExternal=true — making this branch reachable only if isExternal is explicitly set to false while a link is provided. The likelihood is low, but the logic is semantically incorrect.
  Remediation: Either always open links in a new tab (_blank with noopener,noreferrer) or use client-side navigation for internal links.

Low

• [test-inadequate] workspaces/lightspeed/plugins/lightspeed/src/components/__tests__/SourcesChipModal.test.tsx — The test suite covers rendering, popover open/close, fallback titles, and source display, but does not verify window.open behavior when a source link is clicked. The handleSourceClick function contains branching logic (external vs non-external) that would benefit from test coverage.

• [insufficient-referrer-protection] workspaces/lightspeed/plugins/lightspeed/src/components/SourcesChipModal.tsx:139 — When isExternal is true, window.open is called with 'noreferrer' but not 'noopener'. Modern browsers treat noreferrer as implying noopener, but using 'noopener,noreferrer' would be defense-in-depth.

• [translation-cast-idiom] workspaces/lightspeed/plugins/lightspeed/src/components/SourcesChipModal.tsx:193 — The translation call uses (t as Function)(...). While this pattern exists in ~7 places in the notebooks area, the dominant codebase convention (~16 occurrences) is t('key' as any, { params }). Consider aligning with the more prevalent pattern.

• [naming-convention] workspaces/lightspeed/plugins/lightspeed/src/components/LightspeedChatBox.tsx:118 — The prop useSourcesChipModal reads like a React hook name (the use prefix is conventionally reserved for hooks). Other boolean props in this component use patterns like topicRestrictionEnabled, isStreaming. Consider renaming to showSourcesChipPopover or sourcesChipPopoverEnabled.