refactor(mentions): carry typed text segments instead of an authorized substring #2461

Problem

PR #2421 stops generated text from expanding @ mentions. The webview records the part of the chat box that the user typed. It sends that part as one string, authorizedMentionText. The extension looks for that string again in the message text and expands mentions only inside it.

This works, but it is fragile. The scope is a substring that every step must carry and find again.

• Each review round found another step that lost or widened the scope: queue, image scan, edit flow, suggestions, enhanced prompt, and trim.
• Ten or more call sites carry the string. A new send path can forget it.
• Generated text that repeats user words, or padded text, can break the match.

Research on agent security points to the same risk. Provenance labels get lost when data moves between components. See CaMeL and the 2026 paper "Agent Data Injection Attacks are Realistic Threats to AI Agents".

Proposal

1. Send messages as typed segments: [{ text, source: "user" | "generated" }].
2. Expand mentions per segment at one place in the extension. Do not search the text again.
3. Carry the segments through newTask, askResponse, queueMessage, edits, and submitUserMessage.
4. Treat a segment with no source as generated (fail closed).
5. Remove authorizedMentionText and the WeakMap in processUserContentMentions.

Smaller option: do not put generated context in the chat box as parseable text. Attach it as a separate data block that no parser reads.

Acceptance

• No code path can authorize text that has no user source.
• Image mention scans use the same segments.
• Tests cover accept and reject for each entry point.

References

• PR fix(mentions): restrict expansion to authorized user input #2421
• OWASP LLM Prompt Injection Prevention Cheat Sheet