Composer attachments & references: image paste, drag-drop, file mentions (Editor UX 7/7)

[pawelkrystkiewicz]

Final and largest chunk — has a backend half. Doc chat is text-only today: src/api/complete.ts builds a plain text prompt; apps/desktop/src-tauri/src/sidecar.rs api_complete passes {doc, message, history}.

Scope

1. Image paste: pasting an image into the composer attaches it (thumbnail chip above the composer, removable). Send path: image persisted under the draft's dir (.vanguard/drafts/<id>-assets/), passed to __complete as a file path, and forwarded to the agent SDK as an image content block. If the selected provider/model rejects images, surface a clear inline error before sending — never silently drop the attachment.
2. Drag-and-drop: dropping a file on the composer attaches it. Images as in (1); text files (≤64KB) are inlined into the prompt as a fenced block tagged with the filename; other/binary files are rejected with an inline notice.
3. File mentions: typing @ opens an autocomplete over the project repo's tracked files (new sidecar board request that shells git ls-files in the project repo, capped + fuzzy-filtered). A selected mention inserts @path/to/file and the send path inlines that file's content (same 64KB cap) into the prompt context.

Constraints

• The CLI surface is a frozen public contract: extend the __complete/__sidecar JSON protocols additively only.
• No credentials in the webview or events; asset files live under .vanguard/ like drafts.
• Attachment/mention payloads bounded: total inlined content ≤ 256KB per send, error above.

Non-goals

Slash-commands (the drawer already has model selection; nothing else to command yet). Live preview.

Verification

Root pnpm lint && pnpm typecheck && pnpm test; desktop tsc --noEmit + vitest; cargo test for sidecar changes. Tests: paste-attach chip lifecycle, oversize rejection, mention autocomplete filtering, prompt assembly inlines mentioned file.

[pawelkrystkiewicz]

<spec_manifest>
{
"files": [
{ "path": "apps/desktop/src/features/task/ChatPane.tsx", "required": true },
{ "path": "src/api/complete.ts", "required": true },
{ "path": "apps/desktop/src-tauri/src/sidecar.rs", "required": true }
],
"tests": [
{ "id": "attach-chip-lifecycle", "file": "apps/desktop/src/features/task/ChatPane.test.tsx", "required": true },
{ "id": "mention-autocomplete", "file": "apps/desktop/src/features/task/ChatPane.test.tsx", "required": true },
{ "id": "prompt-inlines-mention", "file": "src/api/complete.test.ts", "required": true }
],
"acceptance": [
{ "id": "image-paste", "description": "Pasted image becomes a removable chip; sent as an image content block; unsupported provider errors inline before send", "required": true },
{ "id": "drag-drop", "description": "Dropped text files inline as fenced blocks (64KB cap); binaries rejected with notice", "required": true },
{ "id": "file-mentions", "description": "@ opens tracked-file autocomplete; selected mention inlines file content into the prompt", "required": true },
{ "id": "bounded-payload", "description": "Total inlined content capped at 256KB with a clear error above", "required": true }
]
}
</spec_manifest>

[pawelkrystkiewicz]

Vanguard opened a PR for review: #370