feat: add general knowledge selection scope

[alectimison-maker]

Summary

• add an explicit, default-off “Use general knowledge” option for custom selected-text questions
• carry a durable selection_context policy through prompt transport, retries, persistence, follow-ups, and the scope banner
• keep selected content untrusted and continue excluding the live page, screenshots, tools, attachments, and pre-selection history
• preserve selection_only for every fixed selection action and legacy conversation state
• ship matching Chrome/Firefox behavior and all 23 interface translations

Design

The broader policy permits only the model intrinsic knowledge in addition to the selected text. It does not widen browser or conversation access. Unknown policies fail closed, and only an exact custom-action opt-in can select the broader scope.

The selection popup uses a two-column fixed-action grid so the custom question remains reachable in narrow viewports after adding the scope control.

Testing

• npm test — 1641 main tests, 33 toolbar-guard tests, and 60 security checks passed
• npm run test:fixtures — 153 Chrome/Firefox browser fixtures passed
• git diff --check

Compatibility and risk

Legacy persisted selection scopes safely hydrate as selection_only. The policy is structural rather than inferred from prompt text, and both browser builds use the same allowlist and UI behavior.

Closes #2751

[vercel]

@alectimison-maker is attempting to deploy a commit to the esokullu's projects Team on Vercel.

A member of the Team first needs to authorize it.

[fly1d]

I found one defense-in-depth gap in the final policy boundary.

Agent._selectionGroundedRunOptions() accepts any allowlisted sourceGrounding independently of selectionAction. For example, at this PR's head:

const options = agent._selectionGroundedRunOptions(
  1,
  [{ role: 'system', content: 's' }],
  { sourceGrounding: 'selection_context', selectionAction: 'summarize' },
);

produces and persists:

{"sourceGrounding":"selection_context","selectionAction":"summarize"}

The popup/background path does currently emit selection_context only for custom Ask, so this is not reachable through the normal UI. However, the agent is the authoritative durable boundary (including retries/restores), and the PR description says only an exact custom-action opt-in may select the broader policy. A malformed or future transport path can therefore broaden a fixed action instead of failing closed.

Could _selectionGroundedRunOptions() downgrade selection_context to selection_only unless the normalized opening action is custom, and add a regression test for forged selection_context + summarize metadata?

[alectimison-maker]

Addressed in 9f71b69a.

The agent now normalizes the action first and downgrades selection_context to selection_only unless that normalized action is exactly custom. The same invariant is applied when hydrating or reusing durable scopes, so forged or legacy contradictory state is repaired before reuse.

Added a Chrome/Firefox regression covering both forged opening metadata and restored forged scope state.

Validation:

• 33/33 rich-text toolbar guard tests
• 1642/1642 main tests
• 60/60 security checks
• 153/153 fixture tests
• GitHub WebMCP smoke check passed