fix(web): let modified clicks on PR links open in the browser

apps/web/src/lib/openPullRequestLink.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it, vi } from "vite-plus/test";
 
 import {
  findProjectForChangeRequest,
+ isModifiedClick,
  openPullRequestLink,
  parseChangeRequestUrl,
  PullRequestLinkOpenError,
@@ -136,6 +137,26 @@ describe("parseChangeRequestUrl", () => {
  });
 });
 
+describe("isModifiedClick", () => {
+ const plain = { button: 0, metaKey: false, ctrlKey: false, shiftKey: false, altKey: false };
+
+ it("leaves a plain primary click to the page", () => {
+ expect(isModifiedClick(plain)).toBe(false);
+ });
+
+ it("hands any modified or non-primary click to the browser", () => {
+ for (const click of [
+ { ...plain, metaKey: true },
+ { ...plain, ctrlKey: true },
+ { ...plain, shiftKey: true },
+ { ...plain, altKey: true },
+ { ...plain, button: 1 },
+ ]) {
+ expect(isModifiedClick(click), JSON.stringify(click)).toBe(true);
+ }
+ });
+});
+
 describe("findProjectForChangeRequest", () => {
  const project = (identity: Record<string, unknown>) =>
  ({ id: "p1", repositoryIdentity: identity }) as never;

apps/web/src/lib/openPullRequestLink.ts

@@ -159,10 +159,22 @@ export function findProjectForChangeRequest(
  });
 }
 
+/**
+ * A click whose modifiers spell out a browser destination — cmd/ctrl for a new tab, shift for a
+ * window, alt to download — or that is not the primary button at all. The reader said where the
+ * link should open, so the page never claims it.
+ */
+export function isModifiedClick(
+ event: Pick<MouseEvent<HTMLElement>, "button" | "metaKey" | "ctrlKey" | "shiftKey" | "altKey">,
+): boolean {
+ return event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey;
+}
+
 /**
  * Opens a change request link on the page, and says whether it did. Anything else — another
  * organisation's repository, a host nothing here is checked out from, a link that merely looks
- * like one — is left alone for the caller to handle as the ordinary link it is.
+ * like one, a cmd/ctrl/shift/alt-modified click — is left alone for the caller to handle as the
+ * ordinary link it is.
  *
  * Resolving the project here rather than on the page is what makes recognising a URL safe: a
  * lookalike hostname matches no project and stays a link, and the page is handed the project
@@ -176,7 +188,10 @@ export function findProjectForChangeRequest(
 export function useOpenChangeRequestLink(
  threadRef?: ScopedThreadRef,
 ): (
- event: Pick<MouseEvent<HTMLElement>, "preventDefault" | "stopPropagation">,
+ event: Pick<
+ MouseEvent<HTMLElement>,
+ "preventDefault" | "stopPropagation" | "button" | "metaKey" | "ctrlKey" | "shiftKey" | "altKey"
+ >,
  targetUrl: string,
  targetThreadRef?: ScopedThreadRef,
 ) => boolean {
@@ -186,6 +201,9 @@ export function useOpenChangeRequestLink(
  const primaryEnvironmentId = usePrimaryEnvironmentId();
  return useCallback(
  (event, targetUrl, targetThreadRef) => {
+ // A modified click already names its destination, so it stays a link: a markdown anchor's
+ // own target opens the tab, and `useOpenPrLink` falls through to the system browser.
+ if (isModifiedClick(event)) return false;
  const resolvedThreadRef = targetThreadRef ?? threadRef;
  const environmentId = resolvedThreadRef?.environmentId ?? primaryEnvironmentId;
  if (

apps/web/src/lib/openPullRequestLink.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it, vi } from "vite-plus/test";
 
 import {
  findProjectForChangeRequest,
+ isModifiedClick,
  openPullRequestLink,
  parseChangeRequestUrl,
  PullRequestLinkOpenError,
@@ -136,6 +137,26 @@ describe("parseChangeRequestUrl", () => {
  });
 });
 
+describe("isModifiedClick", () => {
+ const plain = { button: 0, metaKey: false, ctrlKey: false, shiftKey: false, altKey: false };
+
+ it("leaves a plain primary click to the page", () => {
+ expect(isModifiedClick(plain)).toBe(false);
+ });
+
+ it("hands any modified or non-primary click to the browser", () => {
+ for (const click of [
+ { ...plain, metaKey: true },
+ { ...plain, ctrlKey: true },
+ { ...plain, shiftKey: true },
+ { ...plain, altKey: true },
+ { ...plain, button: 1 },
+ ]) {
+ expect(isModifiedClick(click), JSON.stringify(click)).toBe(true);
+ }
+ });
+});
+
 describe("findProjectForChangeRequest", () => {
  const project = (identity: Record<string, unknown>) =>
  ({ id: "p1", repositoryIdentity: identity }) as never;

apps/web/src/lib/openPullRequestLink.ts

@@ -159,10 +159,22 @@ export function findProjectForChangeRequest(
  });
 }
 
+/**
+ * A click whose modifiers spell out a browser destination — cmd/ctrl for a new tab, shift for a
+ * window, alt to download — or that is not the primary button at all. The reader said where the
+ * link should open, so the page never claims it.
+ */
+export function isModifiedClick(
+ event: Pick<MouseEvent<HTMLElement>, "button" | "metaKey" | "ctrlKey" | "shiftKey" | "altKey">,
+): boolean {
+ return event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey;
+}
+
 /**
  * Opens a change request link on the page, and says whether it did. Anything else — another
  * organisation's repository, a host nothing here is checked out from, a link that merely looks
- * like one — is left alone for the caller to handle as the ordinary link it is.
+ * like one, a cmd/ctrl/shift/alt-modified click — is left alone for the caller to handle as the
+ * ordinary link it is.
  *
  * Resolving the project here rather than on the page is what makes recognising a URL safe: a
  * lookalike hostname matches no project and stays a link, and the page is handed the project
@@ -176,7 +188,10 @@ export function findProjectForChangeRequest(
 export function useOpenChangeRequestLink(
  threadRef?: ScopedThreadRef,
 ): (
- event: Pick<MouseEvent<HTMLElement>, "preventDefault" | "stopPropagation">,
+ event: Pick<
+ MouseEvent<HTMLElement>,
+ "preventDefault" | "stopPropagation" | "button" | "metaKey" | "ctrlKey" | "shiftKey" | "altKey"
+ >,
  targetUrl: string,
  targetThreadRef?: ScopedThreadRef,
 ) => boolean {
@@ -186,6 +201,9 @@ export function useOpenChangeRequestLink(
  const primaryEnvironmentId = usePrimaryEnvironmentId();
  return useCallback(
  (event, targetUrl, targetThreadRef) => {
+ // A modified click already names its destination, so it stays a link: a markdown anchor's
+ // own target opens the tab, and `useOpenPrLink` falls through to the system browser.
+ if (isModifiedClick(event)) return false;
  const resolvedThreadRef = targetThreadRef ?? threadRef;
  const environmentId = resolvedThreadRef?.environmentId ?? primaryEnvironmentId;
  if (

apps/web/src/lib/openPullRequestLink.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it, vi } from "vite-plus/test";
 
 import {
  findProjectForChangeRequest,
+ isModifiedClick,
  openPullRequestLink,
  parseChangeRequestUrl,
  PullRequestLinkOpenError,
@@ -136,6 +137,26 @@ describe("parseChangeRequestUrl", () => {
  });
 });
 
+describe("isModifiedClick", () => {
+ const plain = { button: 0, metaKey: false, ctrlKey: false, shiftKey: false, altKey: false };
+
+ it("leaves a plain primary click to the page", () => {
+ expect(isModifiedClick(plain)).toBe(false);
+ });
+
+ it("hands any modified or non-primary click to the browser", () => {
+ for (const click of [
+ { ...plain, metaKey: true },
+ { ...plain, ctrlKey: true },
+ { ...plain, shiftKey: true },
+ { ...plain, altKey: true },
+ { ...plain, button: 1 },
+ ]) {
+ expect(isModifiedClick(click), JSON.stringify(click)).toBe(true);
+ }
+ });
+});
+
 describe("findProjectForChangeRequest", () => {
  const project = (identity: Record<string, unknown>) =>
  ({ id: "p1", repositoryIdentity: identity }) as never;

apps/web/src/lib/openPullRequestLink.ts

@@ -159,10 +159,22 @@ export function findProjectForChangeRequest(
  });
 }
 
+/**
+ * A click whose modifiers spell out a browser destination — cmd/ctrl for a new tab, shift for a
+ * window, alt to download — or that is not the primary button at all. The reader said where the
+ * link should open, so the page never claims it.
+ */
+export function isModifiedClick(
+ event: Pick<MouseEvent<HTMLElement>, "button" | "metaKey" | "ctrlKey" | "shiftKey" | "altKey">,
+): boolean {
+ return event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey;
+}
+
 /**
  * Opens a change request link on the page, and says whether it did. Anything else — another
  * organisation's repository, a host nothing here is checked out from, a link that merely looks
- * like one — is left alone for the caller to handle as the ordinary link it is.
+ * like one, a cmd/ctrl/shift/alt-modified click — is left alone for the caller to handle as the
+ * ordinary link it is.
  *
  * Resolving the project here rather than on the page is what makes recognising a URL safe: a
  * lookalike hostname matches no project and stays a link, and the page is handed the project
@@ -176,7 +188,10 @@ export function findProjectForChangeRequest(
 export function useOpenChangeRequestLink(
  threadRef?: ScopedThreadRef,
 ): (
- event: Pick<MouseEvent<HTMLElement>, "preventDefault" | "stopPropagation">,
+ event: Pick<
+ MouseEvent<HTMLElement>,
+ "preventDefault" | "stopPropagation" | "button" | "metaKey" | "ctrlKey" | "shiftKey" | "altKey"
+ >,
  targetUrl: string,
  targetThreadRef?: ScopedThreadRef,
 ) => boolean {
@@ -186,6 +201,9 @@ export function useOpenChangeRequestLink(
  const primaryEnvironmentId = usePrimaryEnvironmentId();
  return useCallback(
  (event, targetUrl, targetThreadRef) => {
+ // A modified click already names its destination, so it stays a link: a markdown anchor's
+ // own target opens the tab, and `useOpenPrLink` falls through to the system browser.
+ if (isModifiedClick(event)) return false;
  const resolvedThreadRef = targetThreadRef ?? threadRef;
  const environmentId = resolvedThreadRef?.environmentId ?? primaryEnvironmentId;
  if (

apps/web/src/lib/openPullRequestLink.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it, vi } from "vite-plus/test";
 
 import {
  findProjectForChangeRequest,
+ isModifiedClick,
  openPullRequestLink,
  parseChangeRequestUrl,
  PullRequestLinkOpenError,
@@ -136,6 +137,26 @@ describe("parseChangeRequestUrl", () => {
  });
 });
 
+describe("isModifiedClick", () => {
+ const plain = { button: 0, metaKey: false, ctrlKey: false, shiftKey: false, altKey: false };
+
+ it("leaves a plain primary click to the page", () => {
+ expect(isModifiedClick(plain)).toBe(false);
+ });
+
+ it("hands any modified or non-primary click to the browser", () => {
+ for (const click of [
+ { ...plain, metaKey: true },
+ { ...plain, ctrlKey: true },
+ { ...plain, shiftKey: true },
+ { ...plain, altKey: true },
+ { ...plain, button: 1 },
+ ]) {
+ expect(isModifiedClick(click), JSON.stringify(click)).toBe(true);
+ }
+ });
+});
+
 describe("findProjectForChangeRequest", () => {
  const project = (identity: Record<string, unknown>) =>
  ({ id: "p1", repositoryIdentity: identity }) as never;

apps/web/src/lib/openPullRequestLink.ts

@@ -159,10 +159,22 @@ export function findProjectForChangeRequest(
  });
 }
 
+/**
+ * A click whose modifiers spell out a browser destination — cmd/ctrl for a new tab, shift for a
+ * window, alt to download — or that is not the primary button at all. The reader said where the
+ * link should open, so the page never claims it.
+ */
+export function isModifiedClick(
+ event: Pick<MouseEvent<HTMLElement>, "button" | "metaKey" | "ctrlKey" | "shiftKey" | "altKey">,
+): boolean {
+ return event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey;
+}
+
 /**
  * Opens a change request link on the page, and says whether it did. Anything else — another
  * organisation's repository, a host nothing here is checked out from, a link that merely looks
- * like one — is left alone for the caller to handle as the ordinary link it is.
+ * like one, a cmd/ctrl/shift/alt-modified click — is left alone for the caller to handle as the
+ * ordinary link it is.
  *
  * Resolving the project here rather than on the page is what makes recognising a URL safe: a
  * lookalike hostname matches no project and stays a link, and the page is handed the project
@@ -176,7 +188,10 @@ export function findProjectForChangeRequest(
 export function useOpenChangeRequestLink(
  threadRef?: ScopedThreadRef,
 ): (
- event: Pick<MouseEvent<HTMLElement>, "preventDefault" | "stopPropagation">,
+ event: Pick<
+ MouseEvent<HTMLElement>,
+ "preventDefault" | "stopPropagation" | "button" | "metaKey" | "ctrlKey" | "shiftKey" | "altKey"
+ >,
  targetUrl: string,
  targetThreadRef?: ScopedThreadRef,
 ) => boolean {
@@ -186,6 +201,9 @@ export function useOpenChangeRequestLink(
  const primaryEnvironmentId = usePrimaryEnvironmentId();
  return useCallback(
  (event, targetUrl, targetThreadRef) => {
+ // A modified click already names its destination, so it stays a link: a markdown anchor's
+ // own target opens the tab, and `useOpenPrLink` falls through to the system browser.
+ if (isModifiedClick(event)) return false;
  const resolvedThreadRef = targetThreadRef ?? threadRef;
  const environmentId = resolvedThreadRef?.environmentId ?? primaryEnvironmentId;
  if (

apps/web/src/lib/openPullRequestLink.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it, vi } from "vite-plus/test";
 
 import {
  findProjectForChangeRequest,
+ isModifiedClick,
  openPullRequestLink,
  parseChangeRequestUrl,
  PullRequestLinkOpenError,
@@ -136,6 +137,26 @@ describe("parseChangeRequestUrl", () => {
  });
 });
 
+describe("isModifiedClick", () => {
+ const plain = { button: 0, metaKey: false, ctrlKey: false, shiftKey: false, altKey: false };
+
+ it("leaves a plain primary click to the page", () => {
+ expect(isModifiedClick(plain)).toBe(false);
+ });
+
+ it("hands any modified or non-primary click to the browser", () => {
+ for (const click of [
+ { ...plain, metaKey: true },
+ { ...plain, ctrlKey: true },
+ { ...plain, shiftKey: true },
+ { ...plain, altKey: true },
+ { ...plain, button: 1 },
+ ]) {
+ expect(isModifiedClick(click), JSON.stringify(click)).toBe(true);
+ }
+ });
+});
+
 describe("findProjectForChangeRequest", () => {
  const project = (identity: Record<string, unknown>) =>
  ({ id: "p1", repositoryIdentity: identity }) as never;

apps/web/src/lib/openPullRequestLink.ts

@@ -159,10 +159,22 @@ export function findProjectForChangeRequest(
  });
 }
 
+/**
+ * A click whose modifiers spell out a browser destination — cmd/ctrl for a new tab, shift for a
+ * window, alt to download — or that is not the primary button at all. The reader said where the
+ * link should open, so the page never claims it.
+ */
+export function isModifiedClick(
+ event: Pick<MouseEvent<HTMLElement>, "button" | "metaKey" | "ctrlKey" | "shiftKey" | "altKey">,
+): boolean {
+ return event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey;
+}
+
 /**
  * Opens a change request link on the page, and says whether it did. Anything else — another
  * organisation's repository, a host nothing here is checked out from, a link that merely looks
- * like one — is left alone for the caller to handle as the ordinary link it is.
+ * like one, a cmd/ctrl/shift/alt-modified click — is left alone for the caller to handle as the
+ * ordinary link it is.
  *
  * Resolving the project here rather than on the page is what makes recognising a URL safe: a
  * lookalike hostname matches no project and stays a link, and the page is handed the project
@@ -176,7 +188,10 @@ export function findProjectForChangeRequest(
 export function useOpenChangeRequestLink(
  threadRef?: ScopedThreadRef,
 ): (
- event: Pick<MouseEvent<HTMLElement>, "preventDefault" | "stopPropagation">,
+ event: Pick<
+ MouseEvent<HTMLElement>,
+ "preventDefault" | "stopPropagation" | "button" | "metaKey" | "ctrlKey" | "shiftKey" | "altKey"
+ >,
  targetUrl: string,
  targetThreadRef?: ScopedThreadRef,
 ) => boolean {
@@ -186,6 +201,9 @@ export function useOpenChangeRequestLink(
  const primaryEnvironmentId = usePrimaryEnvironmentId();
  return useCallback(
  (event, targetUrl, targetThreadRef) => {
+ // A modified click already names its destination, so it stays a link: a markdown anchor's
+ // own target opens the tab, and `useOpenPrLink` falls through to the system browser.
+ if (isModifiedClick(event)) return false;
  const resolvedThreadRef = targetThreadRef ?? threadRef;
  const environmentId = resolvedThreadRef?.environmentId ?? primaryEnvironmentId;
  if (

apps/web/src/lib/openPullRequestLink.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it, vi } from "vite-plus/test";
 
 import {
  findProjectForChangeRequest,
+ isModifiedClick,
  openPullRequestLink,
  parseChangeRequestUrl,
  PullRequestLinkOpenError,
@@ -136,6 +137,26 @@ describe("parseChangeRequestUrl", () => {
  });
 });
 
+describe("isModifiedClick", () => {
+ const plain = { button: 0, metaKey: false, ctrlKey: false, shiftKey: false, altKey: false };
+
+ it("leaves a plain primary click to the page", () => {
+ expect(isModifiedClick(plain)).toBe(false);
+ });
+
+ it("hands any modified or non-primary click to the browser", () => {
+ for (const click of [
+ { ...plain, metaKey: true },
+ { ...plain, ctrlKey: true },
+ { ...plain, shiftKey: true },
+ { ...plain, altKey: true },
+ { ...plain, button: 1 },
+ ]) {
+ expect(isModifiedClick(click), JSON.stringify(click)).toBe(true);
+ }
+ });
+});
+
 describe("findProjectForChangeRequest", () => {
  const project = (identity: Record<string, unknown>) =>
  ({ id: "p1", repositoryIdentity: identity }) as never;

apps/web/src/lib/openPullRequestLink.ts

@@ -159,10 +159,22 @@ export function findProjectForChangeRequest(
  });
 }
 
+/**
+ * A click whose modifiers spell out a browser destination — cmd/ctrl for a new tab, shift for a
+ * window, alt to download — or that is not the primary button at all. The reader said where the
+ * link should open, so the page never claims it.
+ */
+export function isModifiedClick(
+ event: Pick<MouseEvent<HTMLElement>, "button" | "metaKey" | "ctrlKey" | "shiftKey" | "altKey">,
+): boolean {
+ return event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey;
+}
+
 /**
  * Opens a change request link on the page, and says whether it did. Anything else — another
  * organisation's repository, a host nothing here is checked out from, a link that merely looks
- * like one — is left alone for the caller to handle as the ordinary link it is.
+ * like one, a cmd/ctrl/shift/alt-modified click — is left alone for the caller to handle as the
+ * ordinary link it is.
  *
  * Resolving the project here rather than on the page is what makes recognising a URL safe: a
  * lookalike hostname matches no project and stays a link, and the page is handed the project
@@ -176,7 +188,10 @@ export function findProjectForChangeRequest(
 export function useOpenChangeRequestLink(
  threadRef?: ScopedThreadRef,
 ): (
- event: Pick<MouseEvent<HTMLElement>, "preventDefault" | "stopPropagation">,
+ event: Pick<
+ MouseEvent<HTMLElement>,
+ "preventDefault" | "stopPropagation" | "button" | "metaKey" | "ctrlKey" | "shiftKey" | "altKey"
+ >,
  targetUrl: string,
  targetThreadRef?: ScopedThreadRef,
 ) => boolean {
@@ -186,6 +201,9 @@ export function useOpenChangeRequestLink(
  const primaryEnvironmentId = usePrimaryEnvironmentId();
  return useCallback(
  (event, targetUrl, targetThreadRef) => {
+ // A modified click already names its destination, so it stays a link: a markdown anchor's
+ // own target opens the tab, and `useOpenPrLink` falls through to the system browser.
+ if (isModifiedClick(event)) return false;
  const resolvedThreadRef = targetThreadRef ?? threadRef;
  const environmentId = resolvedThreadRef?.environmentId ?? primaryEnvironmentId;
  if (

apps/web/src/lib/openPullRequestLink.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it, vi } from "vite-plus/test";
 
 import {
  findProjectForChangeRequest,
+ isModifiedClick,
  openPullRequestLink,
  parseChangeRequestUrl,
  PullRequestLinkOpenError,
@@ -136,6 +137,26 @@ describe("parseChangeRequestUrl", () => {
  });
 });
 
+describe("isModifiedClick", () => {
+ const plain = { button: 0, metaKey: false, ctrlKey: false, shiftKey: false, altKey: false };
+
+ it("leaves a plain primary click to the page", () => {
+ expect(isModifiedClick(plain)).toBe(false);
+ });
+
+ it("hands any modified or non-primary click to the browser", () => {
+ for (const click of [
+ { ...plain, metaKey: true },
+ { ...plain, ctrlKey: true },
+ { ...plain, shiftKey: true },
+ { ...plain, altKey: true },
+ { ...plain, button: 1 },
+ ]) {
+ expect(isModifiedClick(click), JSON.stringify(click)).toBe(true);
+ }
+ });
+});
+
 describe("findProjectForChangeRequest", () => {
  const project = (identity: Record<string, unknown>) =>
  ({ id: "p1", repositoryIdentity: identity }) as never;

apps/web/src/lib/openPullRequestLink.ts

@@ -159,10 +159,22 @@ export function findProjectForChangeRequest(
  });
 }
 
+/**
+ * A click whose modifiers spell out a browser destination — cmd/ctrl for a new tab, shift for a
+ * window, alt to download — or that is not the primary button at all. The reader said where the
+ * link should open, so the page never claims it.
+ */
+export function isModifiedClick(
+ event: Pick<MouseEvent<HTMLElement>, "button" | "metaKey" | "ctrlKey" | "shiftKey" | "altKey">,
+): boolean {
+ return event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey;
+}
+
 /**
  * Opens a change request link on the page, and says whether it did. Anything else — another
  * organisation's repository, a host nothing here is checked out from, a link that merely looks
- * like one — is left alone for the caller to handle as the ordinary link it is.
+ * like one, a cmd/ctrl/shift/alt-modified click — is left alone for the caller to handle as the
+ * ordinary link it is.
  *
  * Resolving the project here rather than on the page is what makes recognising a URL safe: a
  * lookalike hostname matches no project and stays a link, and the page is handed the project
@@ -176,7 +188,10 @@ export function findProjectForChangeRequest(
 export function useOpenChangeRequestLink(
  threadRef?: ScopedThreadRef,
 ): (
- event: Pick<MouseEvent<HTMLElement>, "preventDefault" | "stopPropagation">,
+ event: Pick<
+ MouseEvent<HTMLElement>,
+ "preventDefault" | "stopPropagation" | "button" | "metaKey" | "ctrlKey" | "shiftKey" | "altKey"
+ >,
  targetUrl: string,
  targetThreadRef?: ScopedThreadRef,
 ) => boolean {
@@ -186,6 +201,9 @@ export function useOpenChangeRequestLink(
  const primaryEnvironmentId = usePrimaryEnvironmentId();
  return useCallback(
  (event, targetUrl, targetThreadRef) => {
+ // A modified click already names its destination, so it stays a link: a markdown anchor's
+ // own target opens the tab, and `useOpenPrLink` falls through to the system browser.
+ if (isModifiedClick(event)) return false;
  const resolvedThreadRef = targetThreadRef ?? threadRef;
  const environmentId = resolvedThreadRef?.environmentId ?? primaryEnvironmentId;
  if (

apps/web/src/lib/openPullRequestLink.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it, vi } from "vite-plus/test";
 
 import {
  findProjectForChangeRequest,
+ isModifiedClick,
  openPullRequestLink,
  parseChangeRequestUrl,
  PullRequestLinkOpenError,
@@ -136,6 +137,26 @@ describe("parseChangeRequestUrl", () => {
  });
 });
 
+describe("isModifiedClick", () => {
+ const plain = { button: 0, metaKey: false, ctrlKey: false, shiftKey: false, altKey: false };
+
+ it("leaves a plain primary click to the page", () => {
+ expect(isModifiedClick(plain)).toBe(false);
+ });
+
+ it("hands any modified or non-primary click to the browser", () => {
+ for (const click of [
+ { ...plain, metaKey: true },
+ { ...plain, ctrlKey: true },
+ { ...plain, shiftKey: true },
+ { ...plain, altKey: true },
+ { ...plain, button: 1 },
+ ]) {
+ expect(isModifiedClick(click), JSON.stringify(click)).toBe(true);
+ }
+ });
+});
+
 describe("findProjectForChangeRequest", () => {
  const project = (identity: Record<string, unknown>) =>
  ({ id: "p1", repositoryIdentity: identity }) as never;

apps/web/src/lib/openPullRequestLink.ts

@@ -159,10 +159,22 @@ export function findProjectForChangeRequest(
  });
 }
 
+/**
+ * A click whose modifiers spell out a browser destination — cmd/ctrl for a new tab, shift for a
+ * window, alt to download — or that is not the primary button at all. The reader said where the
+ * link should open, so the page never claims it.
+ */
+export function isModifiedClick(
+ event: Pick<MouseEvent<HTMLElement>, "button" | "metaKey" | "ctrlKey" | "shiftKey" | "altKey">,
+): boolean {
+ return event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey;
+}
+
 /**
  * Opens a change request link on the page, and says whether it did. Anything else — another
  * organisation's repository, a host nothing here is checked out from, a link that merely looks
- * like one — is left alone for the caller to handle as the ordinary link it is.
+ * like one, a cmd/ctrl/shift/alt-modified click — is left alone for the caller to handle as the
+ * ordinary link it is.
  *
  * Resolving the project here rather than on the page is what makes recognising a URL safe: a
  * lookalike hostname matches no project and stays a link, and the page is handed the project
@@ -176,7 +188,10 @@ export function findProjectForChangeRequest(
 export function useOpenChangeRequestLink(
  threadRef?: ScopedThreadRef,
 ): (
- event: Pick<MouseEvent<HTMLElement>, "preventDefault" | "stopPropagation">,
+ event: Pick<
+ MouseEvent<HTMLElement>,
+ "preventDefault" | "stopPropagation" | "button" | "metaKey" | "ctrlKey" | "shiftKey" | "altKey"
+ >,
  targetUrl: string,
  targetThreadRef?: ScopedThreadRef,
 ) => boolean {
@@ -186,6 +201,9 @@ export function useOpenChangeRequestLink(
  const primaryEnvironmentId = usePrimaryEnvironmentId();
  return useCallback(
  (event, targetUrl, targetThreadRef) => {
+ // A modified click already names its destination, so it stays a link: a markdown anchor's
+ // own target opens the tab, and `useOpenPrLink` falls through to the system browser.
+ if (isModifiedClick(event)) return false;
  const resolvedThreadRef = targetThreadRef ?? threadRef;
  const environmentId = resolvedThreadRef?.environmentId ?? primaryEnvironmentId;
  if (