@eeacms/volto-eea-chatbot 3.0.0 → 4.0.0

package/.github/workflows/betterleaks.yml

@@ -0,0 +1,133 @@
+name: Betterleaks
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    name: Scan for secrets
+    runs-on: ubuntu-latest
+    env:
+      SMTP_URL: ${{ secrets.SMTP_URL }}
+      SMTP_PORT: ${{ secrets.SMTP_PORT || '25' }}
+      SMTP_EMAIL: ${{ secrets.SMTP_EMAIL }}
+      SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Run Betterleaks
+        id: betterleaks
+        continue-on-error: true
+        uses: dortort/betterleaks-action@v0.1.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          scan-mode: dir
+          scan-path: .
+          config: .gitleaks.toml
+          report-format: json
+          report-path: betterleaks-report.json
+          redact: "true"
+          no-color: "true"
+          no-banner: "true"
+          fail-on-leak: "true"
+
+      - name: Upload Betterleaks report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: betterleaks-report
+          path: betterleaks-report.json
+          if-no-files-found: ignore
+
+      - name: Build Betterleaks email summary
+        id: leak_summary
+        if: steps.betterleaks.outcome == 'failure'
+        shell: bash
+        run: |
+          if [[ -s betterleaks-report.json ]]; then
+            jq -r '
+              def one_line:
+                tostring
+                | gsub("[\r\n]+"; " ")
+                | if length > 240 then .[0:240] + "..." else . end;
+
+              .[:20][]
+              | "- " + (.RuleID // "unknown-rule")
+                + " at " + (.File // "unknown-file")
+                + ":" + ((.StartLine // 0) | tostring)
+                + "\n  match: " + ((.Match // .Secret // "REDACTED") | one_line)
+            ' betterleaks-report.json > betterleaks-email-summary.txt
+
+            count="$(jq 'length' betterleaks-report.json)"
+            if (( count > 20 )); then
+              {
+                echo ""
+                echo "... and $((count - 20)) more finding(s). Download the artifact for full details."
+              } >> betterleaks-email-summary.txt
+            fi
+          else
+            echo "No JSON report was generated. Download the workflow logs for details." > betterleaks-email-summary.txt
+          fi
+
+          {
+            echo "text<<BETTERLEAKS_SUMMARY"
+            cat betterleaks-email-summary.txt
+            echo "BETTERLEAKS_SUMMARY"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Resolve committer email
+        id: committer
+        if: steps.betterleaks.outcome == 'failure'
+        shell: bash
+        run: |
+          committer_email="$(git log -1 --format='%ce')"
+          author_email="$(git log -1 --format='%ae')"
+          email="$committer_email"
+          if [[ -z "$email" || "$email" == *"noreply.github.com"* ]]; then
+            email="$author_email"
+          fi
+          if [[ "$email" =~ ^[^[:space:]@]+@[^[:space:]@]+\.[^[:space:]@]+$ && "$email" != *"noreply.github.com"* ]]; then
+            echo "email=$email" >> "$GITHUB_OUTPUT"
+          else
+            echo "No deliverable committer email found; skipping Betterleaks email notification."
+            echo "email=" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Email committer on Betterleaks failure
+        if: steps.betterleaks.outcome == 'failure' && steps.committer.outputs.email != '' && env.SMTP_URL != '' && env.SMTP_EMAIL != ''
+        uses: dawidd6/action-send-mail@v18
+        with:
+          server_address: ${{ env.SMTP_URL }}
+          server_port: ${{ env.SMTP_PORT }}
+          secure: ${{ env.SMTP_PORT == '465' }}
+          username: ${{ env.SMTP_EMAIL }}
+          password: ${{ env.SMTP_PASSWORD }}
+          from: ${{ env.SMTP_EMAIL }}
+          to: ${{ steps.committer.outputs.email }}
+          subject: "[Betterleaks] Secret scan failed in ${{ github.repository }}"
+          body: |
+            Betterleaks detected one or more potential secrets.
+
+            Repository: ${{ github.repository }}
+            Branch: ${{ github.ref_name }}
+            Commit: ${{ github.sha }}
+            Workflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+            Findings:
+            ${{ steps.leak_summary.outputs.text }}
+
+            Download the betterleaks-report artifact from the workflow run for details.
+
+      - name: Fail if Betterleaks found leaks
+        if: steps.betterleaks.outcome == 'failure'
+        run: |
+          echo "Betterleaks detected one or more secrets. Download the betterleaks-report artifact from this workflow run for details."
+          exit 1

package/.gitleaks.toml

@@ -0,0 +1,89 @@
+title = "Betterleaks config"
+
+[extend]
+useDefault = true
+
+[[rules]]
+id = "secret-literal-assignment"
+description = "Secret-like literal assignment in source, YAML, env and config files"
+regex = '''(?i)([A-Za-z0-9_.-]*(?:password|passwd|pwd|api[_-]?key|apikey|access[_-]?key|secret[_-]?access[_-]?key|private[_-]?key|client[_-]?secret|consumer[_-]?key|consumer[_-]?secret|(?:auth|access|refresh|session|api|bearer|id|jwt|csrf|xsrf|oauth)[_-]?token|translate[_-]?auth|translation[_-]?auth|auth[_-]?password|auth[_-]?key|auth[_-]?credentials|database[_-]?url|connection[_-]?string)[A-Za-z0-9_.-]*)[ \t]*[:=][ \t]*["'']?([^"''[:space:]#{}$.][^"''\n#{}]{2,})["'']?'''
+secretGroup = 2
+keywords = [
+  "password",
+  "passwd",
+  "pwd",
+  "api_key",
+  "apikey",
+  "access_key",
+  "private_key",
+  "client_secret",
+  "consumer_key",
+  "consumer_secret",
+  "auth_token",
+  "access_token",
+  "refresh_token",
+  "session_token",
+  "api_token",
+  "bearer_token",
+  "id_token",
+  "jwt_token",
+  "csrf_token",
+  "xsrf_token",
+  "oauth_token",
+  "translate_auth",
+  "translation_auth",
+  "auth_password",
+  "auth_key",
+  "auth_credentials",
+  "database_url",
+  "connection_string"
+]
+tags = ["literal-secret"]
+
+[[rules]]
+id = "env-short-secret-assignment"
+description = "Uppercase env-style PASS/TOKEN/SECRET assignment"
+regex = '''\b((?:PASS|TOKEN|SECRET|[A-Z0-9_]*(?:_PASS|_TOKEN|_SECRET|PASS_|TOKEN_|SECRET_)[A-Z0-9_]*))[ \t]*[:=][ \t]*["'']?([^"''[:space:]#{}$.][^"''\n#{}]{2,})["'']?'''
+secretGroup = 2
+keywords = [
+  "PASS",
+  "TOKEN",
+  "SECRET"
+]
+tags = ["env", "literal-secret"]
+
+[[rules]]
+id = "standalone-sk-token"
+description = "Standalone sk-* token not attached to a secret-like variable name"
+regex = '''(?i)\b(sk-[A-Za-z0-9][A-Za-z0-9_-]{20,})\b'''
+secretGroup = 1
+entropy = 2.5
+keywords = ["sk-"]
+tags = ["standalone-token", "generic"]
+
+[[rules]]
+id = "dotenv-only-jest-setup"
+description = ".env may only contain the committed Jest setup lines"
+path = '''(?i)(^|/)\.env$'''
+regex = '''(?m)^(.+)$'''
+secretGroup = 1
+tags = ["file", "dotenv"]
+[[rules.allowlists]]
+regexTarget = "match"
+regexes = [
+  '''^JEST_USE_SETUP=OFF # Jest configuration variables: ON, OFF\r?$''',
+]
+
+[[rules]]
+id = "forbidden-secret-file"
+description = "Forbidden secret-bearing file committed to repository"
+path = '''(?i)(^|/)(\.env\..*|\.npmrc|\.pypirc|id_rsa|id_ed25519|.*\.(pem|key|p12|pfx|jks|kubeconfig))$'''
+regex = '''(?s).{1,}'''
+tags = ["file", "secret-file"]
+
+[[allowlists]]
+description = "Allow Jenkins SonarQube token environment variable reference"
+regexTarget = "match"
+regexes = [
+  '''SONAR_AUTH_TOKEN''',
+]

package/CHANGELOG.md

@@ -4,7 +4,38 @@ All notable changes to this project will be documented in this file. Dates are d
 
 Generated by [`auto-changelog`](https://github.com/CookPete/auto-changelog).
 
-### [3.0.0](https://github.com/eea/volto-eea-chatbot/compare/2.0.5...3.0.0) - 7 July 2026
+### [4.0.0](https://github.com/eea/volto-eea-chatbot/compare/3.0.1...4.0.0) - 13 August 2026
+
+#### :bug: Bug Fixes
+
+- fix: correct 100.00% → High in ClaimModal snapshot [Tiberiu Ichim - [`2f3e620`](https://github.com/eea/volto-eea-chatbot/commit/2f3e620627faae3b050f0cb6ba1e3db4015dc5db)]
+- fix: avoid Betterleaks false positive on LLM_API_KEY example [Tiberiu Ichim - [`44e05bc`](https://github.com/eea/volto-eea-chatbot/commit/44e05bc74a042e7f08cc0e6878930f9acc1964b9)]
+- fix: filter skipped claims in span processor to prevent text duplication [Tiberiu Ichim - [`9477a42`](https://github.com/eea/volto-eea-chatbot/commit/9477a42d363d6961f4def628ed567a2409b316ea)]
+
+#### :house: Internal changes
+
+- chore: bump version to 4.0.0 (breaking change) [Tiberiu Ichim - [`e1038b6`](https://github.com/eea/volto-eea-chatbot/commit/e1038b6db64612f7c772a898b99ff802b3c133e9)]
+- style: Automated code fix [eea-jenkins - [`03891e2`](https://github.com/eea/volto-eea-chatbot/commit/03891e24e48ccd0eccb55d4ed42aabbcdf34251f)]
+
+#### :house: Documentation changes
+
+- docs: document rag-facts-check backend dependency for quality checks [Tiberiu Ichim - [`123c7ea`](https://github.com/eea/volto-eea-chatbot/commit/123c7ea5d56ee48e6d5c787049a010b6bebd5aef)]
+- docs: update README for rag-fact-checker integration [Tiberiu Ichim - [`4ae32b4`](https://github.com/eea/volto-eea-chatbot/commit/4ae32b41e838176d4a3ba1ea55367fc21e1a8cae)]
+
+#### :hammer_and_wrench: Others
+
+- test: update ClaimModal snapshots for categorical score labels [Tiberiu Ichim - [`3794be1`](https://github.com/eea/volto-eea-chatbot/commit/3794be1fc112b9f209a58c6577f99649350b1d59)]
+- Deduplicate sources by text before sending to fact-checker [Tiberiu Ichim - [`67dc793`](https://github.com/eea/volto-eea-chatbot/commit/67dc793f955058d9ba5dbc92ea23a652e4586172)]
+- Fix: use doc.content from final_documents when tool packets lack content [Tiberiu Ichim - [`4174212`](https://github.com/eea/volto-eea-chatbot/commit/4174212a90742c139ad2399f7a07feb99d619fbc)]
+- Replace numeric claim scores with categorical labels [Tiberiu Ichim - [`d0aaf77`](https://github.com/eea/volto-eea-chatbot/commit/d0aaf779a69340386af81e9af4aa5147d93be388)]
+- Send structured sources with document titles to fact-checker [Tiberiu Ichim - [`190c79b`](https://github.com/eea/volto-eea-chatbot/commit/190c79b2a888a7d655157e683633fd9901b8871c)]
+### [3.0.1](https://github.com/eea/volto-eea-chatbot/compare/3.0.0...3.0.1) - 7 August 2026
+
+#### :bug: Bug Fixes
+
+- fix: Add betterleaks github action - refs #304517 [dobri1408 - [`837c461`](https://github.com/eea/volto-eea-chatbot/commit/837c4619bd3dab3ffe06aeaabd0513c50e3066b4)]
+
+## [3.0.0](https://github.com/eea/volto-eea-chatbot/compare/2.0.5...3.0.0) - 7 July 2026
 
 #### :bug: Bug Fixes
 

package/README.md

@@ -40,7 +40,7 @@ The **Volto Chatbot** block allows the integration of an AI-powered chatbot into
 | `enableShowTotalFailMessage` | Show total failure message.                                                     | Boolean  | `false`                          |
 | `showAssistantTitle`         | Display or hide the assistant's title in the chat interface.                    | Boolean  | `true`                           |
 | `showAssistantDescription`   | Display or hide the assistant's description in the chat interface.              | Boolean  | `true`                           |
-| `qualityCheck`               | Show Halloumi-based automated quality check.                                    | Dropdown | `Disabled`                       |
+| `qualityCheck`               | Show automated fact-checking of AI answers against source documents.            | Dropdown | `Disabled`                       |
 | `onDemandInputToggle`        | Sets the default state of the fact-check AI toggle.                             | Boolean  | `true`                           |
 | `showTools`                  | Show or hide tools in the chat interface.                                       | Array    | `["internal_search_tool_start"]` |
 | `scrollToInput`              | Automatically scroll the page to focus on the chat input when interacting.      | Boolean  | `false`                          |
@@ -116,6 +116,44 @@ Go to http://localhost:3000
 
    For a legacy Volto 17 project, install the package with `yarn` and restart the frontend as usual.
 
+## Quality Checks (Fact-Checking)
+
+When `qualityCheck` is enabled, the chatbot sends AI answers and their source
+documents to a fact-checking backend that extracts claims, verifies each
+against the sources, and returns per-claim verdicts with evidence.
+
+### Backend dependency
+
+The fact-checking feature requires the
+[eea/rag-facts-check](https://github.com/eea/rag-facts-check) service running
+and reachable at the URL configured in `RAG_FACT_CHECKER_URL`.
+
+**Without this backend, quality checks will fail with a connection error.**
+
+The backend exposes a halloumi-compatible endpoint (`POST /halloumi/generate`)
+so the frontend can call it without code changes. It also provides a native
+`POST /check` endpoint with a richer response schema.
+
+### Deploying the backend
+
+```bash
+# Clone and build
+ git clone https://github.com/eea/rag-facts-check.git
+cd rag-facts-check
+docker build -t rag-fact-check .
+
+# Run (requires an LLM endpoint)
+# Set LLM_API_KEY to your actual API key before running
+docker run -p 8000:8000 \
+  -e LLM_API_BASE=http://your-llm:4002/v1 \
+  -e LLM_API_KEY \
+  -e LLM_MODEL=gemma \
+  rag-fact-check
+```
+
+See the [backend README](https://github.com/eea/rag-facts-check#rag-facts-check)
+for full configuration options.
+
 ## Environment Configuration
 
 To properly configure the middleware and authenticate with the Onyx service, ensure that the following environment variables are set:
@@ -131,20 +169,13 @@ This document lists the environment variables used in the Volto Chatbot project.
 - `JEST_USE_SETUP`
   Used in Jest configuration. When set to 'ON', it enables a specific Jest setup.
 
-- `LLMGW_URL`
-  The URL for the LLM Gateway service.
-
-- `LLMGW_TOKEN`
-  The token for authenticating with the LLM Gateway service.
+- `RAG_FACT_CHECKER_URL`
+  The base URL for the [rag-facts-check](https://github.com/eea/rag-facts-check)
+  fact-checking backend. Required when `qualityCheck` is enabled.
+  Default: `http://localhost:8000`.
 
 ### Development-specific environment variables
 
-- `MOCK_HALLOUMI_FILE_PATH`
-  When set, this specifies the absolute path to the JSON file containing the mocked Halloumi response. Setting this variable enables mocking of Halloumi API calls.
-
-- `DUMP_HALLOUMI_FILE_PATH`
-  When set, the Halloumi response will be dumped to the specified absolute file path for debugging or to create new mock files.
-
 - `MOCK_LLM_FILE_PATH`
   When set, this specifies the absolute path to the JSONL file containing the mocked Onyx stream response. Setting this variable enables mocking of Onyx LLM calls.
 
@@ -162,6 +193,65 @@ See [RELEASE.md](https://github.com/eea/volto-eea-chatbot/blob/master/RELEASE.md
 
 See [DEVELOP.md](https://github.com/eea/volto-eea-chatbot/blob/master/DEVELOP.md).
 
+## Secret Scanning
+
+This repository uses the Betterleaks GitHub Action to scan the current
+repository content on every push and pull request. The scan uses the rules in
+`.gitleaks.toml` and uploads a `betterleaks-report` artifact when a finding is
+detected.
+
+If the optional SMTP secrets are configured, failed scans also send an email to
+the last commit committer. The workflow expects these repository or
+organization secrets:
+
+- `SMTP_URL`
+- `SMTP_PORT` (optional, defaults to `25`)
+- `SMTP_EMAIL`
+- `SMTP_PASSWORD` (optional if the SMTP server does not require authentication)
+
+Port `465` is sent with direct TLS; other ports use the default SMTP handshake.
+The email includes a short finding summary from the redacted Betterleaks report,
+including the redacted matched line from each finding.
+
+There are three common outcomes:
+
+1. **Everything is OK.** The `Betterleaks / Scan for secrets` check is green and
+   no action is needed. Regular references to runtime values are OK, for example:
+
+   ```js
+   const tokenFromCookie = req.universalCookies.get('auth_token');
+   ```
+
+2. **A real secret was found.** The check is red and the workflow log asks you to
+   download the `betterleaks-report` artifact. Open the artifact from the GitHub
+   Actions run and check the reported file, line and rule. Remove the committed
+   value, move it to the proper secret store, and rotate it if it was exposed.
+   A report entry looks like this:
+
+   ```json
+   {
+     "RuleID": "secret-literal-assignment",
+     "File": "src/config.js",
+     "StartLine": 12,
+     "Secret": "[REDACTED]"
+   }
+   ```
+
+3. **The finding is a false positive.** Keep the value only if it is clearly not
+   sensitive, such as a test fixture, placeholder, or public example. Add
+   `betterleaks:allow` on the same line and include a short explanation in the
+   pull request.
+
+   ```js
+   const testPassword = 'admin'; //betterleaks:allow
+   ```
+
+   ```yaml
+   password: "admin" #betterleaks:allow
+   ```
+
+Do not add `betterleaks:allow` to real credentials.
+
 ## Copyright and license
 
 The Initial Owner of the Original Code is European Environment Agency (EEA).

package/RELEASE.md

@@ -33,7 +33,7 @@ Release-it is a tool that automates 4 important steps in the release process:
 To configure the authentification, you need to export GITHUB_TOKEN for [GitHub](https://github.com/settings/tokens)
 
    ```
-   export GITHUB_TOKEN=XXX-XXXXXXXXXXXXXXXXXXXXXX
+   export GITHUB_TOKEN="${GITHUB_TOKEN}"
    ```
 
  To configure npm, you can use the `npm login` command or use a configuration file with a TOKEN :

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eeacms/volto-eea-chatbot",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "description": "@eeacms/volto-eea-chatbot: Volto add-on",
   "main": "src/index.js",
   "author": "European Environment Agency: IDM2 A-Team",

package/src/ChatBlock/chat/AIMessage.tsx

@@ -81,31 +81,21 @@ function addQualityMarkersPlugin() {
   };
 }
 
-export function addHalloumiContext(doc: any, text: string) {
-  // TODO: CLEAN UP
-  // const updatedDate = doc.updated_at
-  //   ? new Date(doc.updated_at).toLocaleString('en-GB', {
-  //       year: 'numeric',
-  //       month: 'long',
-  //       day: '2-digit',
-  //       hour: '2-digit',
-  //       minute: '2-digit',
-  //     })
-  //   : '';
-
-  // const docIndex = doc.index ? `DOCUMENT ${doc.index}: ` : '';
-  // const sources: any = { web: 'Website', file: 'File' };
-
-  // const sourceType = doc.source_type
-  //   ? sources[doc.source_type] || capitalize(doc.source_type)
-  //   : '';
-
-  // const header = `${docIndex}${doc.semantic_identifier}${
-  //   sourceType ? `\nSource: ${sourceType}` : ''
-  // }${updatedDate ? `\nUpdated: ${updatedDate}` : ''}`;
-
-  // return `${header}\n${text}`;
-  return text.replace(/\u00A0/g, ' ');
+/**
+ * Build a structured source object for the fact-checker backend.
+ *
+ * The backend accepts {text, title, source_type} dicts so it can
+ * include document titles in LLM prompts without polluting the raw
+ * text (which would break span-offset matching).
+ */
+export function buildHalloumiSource(doc: any, text: string) {
+  const cleanedText = text.replace(/\u00A0/g, ' ');
+  return {
+    text: cleanedText,
+    title: doc.semantic_identifier || null,
+    source_type: doc.source_type || null,
+    link: doc.link || null,
+  };
 }
 
 function mapToolDocumentsToText(message: any) {
@@ -135,24 +125,36 @@ function getContextSources(
   const documentIdToText = mapToolDocumentsToText(message);
 
   return qualityCheckContext === 'citations'
-    ? sources.map((doc: any) => ({
-        ...doc,
-        id: doc.document_id,
-        text: documentIdToText[doc.document_id] || '',
-        halloumiContext: addHalloumiContext(
-          doc,
-          documentIdToText[doc.document_id] || '',
-        ),
-      }))
+    ? sources.map((doc: any) => {
+        // Prefer content from tool packets (may have enriched text),
+        // but fall back to doc.content from final_documents.
+        // Without this fallback, sources sent to the fact-checker are
+        // empty strings when tool packets don't carry full content.
+        const text = documentIdToText[doc.document_id] || doc.content || '';
+        const cleanedText = text.replace(/\u00A0/g, ' ');
+        return {
+          ...doc,
+          id: doc.document_id,
+          text,
+          // Keep for ClaimSegments span highlighting (plain text)
+          halloumiContext: cleanedText,
+          // Structured source for the fact-checker backend
+          halloumiSource: buildHalloumiSource(doc, text),
+        };
+      })
     : (message.toolCalls || []).reduce(
         (acc: any, cur: any) => [
           ...acc,
-          ...(cur.tool_result || []).map((doc: any) => ({
-            ...doc,
-            id: doc.document_id,
-            text: doc.content,
-            halloumiContext: addHalloumiContext(doc, doc.content),
-          })),
+          ...(cur.tool_result || []).map((doc: any) => {
+            const cleanedText = (doc.content || '').replace(/\u00A0/g, ' ');
+            return {
+              ...doc,
+              id: doc.document_id,
+              text: doc.content,
+              halloumiContext: cleanedText,
+              halloumiSource: buildHalloumiSource(doc, doc.content || ''),
+            };
+          }),
         ], // TODO: make sure we don't add multiple times the same doc
         // TODO: this doesn't have the index for source
         [],
@@ -281,7 +283,24 @@ export function AIMessage({
     qualityCheckContext,
   );
 
-  const stableContextSources = useDeepCompareMemoize(contextSources);
+  // Deduplicate sources by text content. The streaming backend often sends
+  // the same document in multiple packets (MESSAGE_START, SEARCH_TOOL_DELTA,
+  // etc.), resulting in 40+ copies of the same text. Dedup keeps the first
+  // occurrence, preserving order. Critical: texts must remain identical
+  // between frontend (span highlighting) and backend (evidence spans).
+  const dedupedSources = useMemo(() => {
+    const seen = new Set<string>();
+    return contextSources.filter((src: any) => {
+      const key = src.halloumiContext || src.halloumiSource?.text || '';
+      if (key && !seen.has(key)) {
+        seen.add(key);
+        return true;
+      }
+      return false;
+    });
+  }, [contextSources]);
+
+  const stableContextSources = useDeepCompareMemoize(dedupedSources);
 
   const doQualityControl =
     messageDisplayed &&

package/src/ChatBlock/components/markdown/ClaimModal.jsx

@@ -1,6 +1,6 @@
 import { Modal, ModalContent, ModalHeader } from 'semantic-ui-react';
 import cx from 'classnames';
-import { convertToPercentage } from '@eeacms/volto-eea-chatbot/ChatBlock/utils';
+import { scoreToLabel } from '@eeacms/volto-eea-chatbot/ChatBlock/utils';
 import SVGIcon from '@eeacms/volto-eea-chatbot/ChatBlock/components/Icon';
 import { getSupportedBgColor } from './colors';
 import { ClaimSegments } from './ClaimSegments';
@@ -70,9 +70,9 @@ export function ClaimModal({ claim, markers, text, citedSources }) {
           <div className="score-badge-section">
             <div className="score-badge">
               <span className="score-percentage">
-                {convertToPercentage(claim.score)}
+                {scoreToLabel(claim.score)}
               </span>
-              <span className="score-label">Citation Support</span>
+              <span className="score-label">Verification</span>
             </div>
             <div className="score-progress-bar">
               <div

package/src/ChatBlock/components/markdown/index.jsx

@@ -43,6 +43,7 @@ export function components(message, markers, citedSources) {
         const end = child.position.end.offset;
         const claims = markers.claims?.filter(
           (claim) =>
+            !claim.skipped &&
             claim.score !== null &&
             ((start >= claim.startOffset && end <= claim.endOffset) ||
               (start <= claim.endOffset && end >= claim.endOffset) ||

package/src/ChatBlock/hooks/useQualityMarkers.js

@@ -48,7 +48,16 @@ export function useQualityMarkers(
 
   React.useEffect(() => {
     async function handler() {
-      const textSources = sources.map(({ halloumiContext }) => halloumiContext);
+      // Prefer structured sources (with title metadata) over plain text.
+      // Fall back to halloumiContext strings for backward compatibility.
+      const firstSource = sources[0];
+      const hasStructuredSources =
+        firstSource && typeof firstSource.halloumiSource === 'object';
+
+      const halloumiSources = hasStructuredSources
+        ? sources.map(({ halloumiSource }) => halloumiSource)
+        : sources.map(({ halloumiContext }) => halloumiContext);
+
       if (sources.length === 0) {
         setHalloumiResponse(empty(message, FAILURE_RATIONALE));
         return;
@@ -59,7 +68,7 @@ export function useQualityMarkers(
       try {
         const feedback = await fetchHalloumi(
           message,
-          textSources,
+          halloumiSources,
           maxContextSegments,
         );
         const body = await feedback.json();