Fix backslash escaping for CodeQL warnings and update .gitignore

Author: Yikai-Liao

.gitignore

@@ -43,3 +43,7 @@ extension.js
 extension.js.map
 *.wasm
 i18n/
+
+# CodeQL local analysis artifacts
+/webview-ui/codeql-db/
+/codeql-results.sarif

webview-ui/src/utils/context-mentions.ts

@@ -65,11 +65,13 @@ export function insertMention(
 	 */
 	// Escape spaces, handling already escaped spaces
 	const formattedValue = value
-		.replace(/\\\\/g, "\\DOUBLE_BACKSLASH") // First preserve actual double backslashes
-		.replace(/\\ /g, "\\ESCAPED_SPACE") // Temporarily replace already escaped spaces
-		.replace(/ /g, "\\ ") // Escape all normal spaces
-		.replace(/\\ESCAPED_SPACE/g, "\\\\ ") // Restore escaped spaces with proper escaping
-		.replace(/\\DOUBLE_BACKSLASH/g, "\\\\") // Restore actual double backslashes
+		.replace(/\\\\\\\\/g, "\\DOUBLE_BACKSLASH") // First preserve actual double backslashes
+		.replace(/\\\\ /g, "\\ESCAPED_SPACE")   // Temporarily replace already escaped spaces
+		// ADDED: Escape standalone backslashes not part of the above patterns
+		.replace(/(?<!\\\\)\\\\(?! |\\\\)/g, '\\\\\\\\') // Makes \ -> \\
+		.replace(/ /g, "\\ ")                 // Escape normal spaces (makes ' ' -> '\\ ')
+		.replace(/\\ESCAPED_SPACE/g, "\\ ") // Restore escaped spaces correctly (makes '\\ESCAPED_SPACE' -> '\\ ')
+		.replace(/\\DOUBLE_BACKSLASH/g, "\\\\\\\\") // Restore actual double backslashes (makes \\)
 
 	if (lastAtIndex !== -1) {
 		// If there's an '@' symbol, replace text after it up to the next space/end

webview-ui/src/utils/path-mentions.ts

@@ -18,7 +18,7 @@ export function convertToMentionPath(path: string, cwd?: string): string {
 
 	if (!normalizedCwd) {
 		// If no CWD, just escape spaces in the original path
-		return processedPath.replace(/ /g, "\\ ");
+		return processedPath.replace(/\\/g, '\\\\').replace(/ /g, '\\ ');
 	}
 
 	// Remove trailing slash from cwd if it exists
@@ -53,10 +53,11 @@ export function convertToMentionPath(path: string, cwd?: string): string {
 		 * will undergo a second round of escaping, resulting in double backslashes.
 		 * This is necessary to preserve the escapes through the entire text processing pipeline.
 		 */
-		// Escape spaces
-		return mentionPath.replace(/ /g, "\\ ");
+		// Escape backslashes first, then spaces (single backslash for space)
+		return mentionPath.replace(/\\/g, '\\\\').replace(/ /g, '\\ ');
 	}
 
 	// If path doesn't start with CWD, escape spaces in the processed path
-	return processedPath.replace(/ /g, "\\ ");
+	// Escape backslashes first, then spaces (single backslash for space)
+	return processedPath.replace(/\\/g, '\\\\').replace(/ /g, '\\ ');
 }