fix(mindspace): 公开页上传图片物化到 static 路径供转发访问

Finish 同步与首次访问时将私有资产 API 图片复制到 public/.tmp-images，
避免其他用户转发链接后因无登录态无法加载页面内图片。

Co-authored-by: Cursor <cursoragent@cursor.com>

server.mjs

@@ -116,6 +116,7 @@ import {
   injectHtmlBaseHref,
   resolveClosestHtmlRelativePath,
   createAssetDataUriResolver,
+  htmlReferencesPrivateAssets,
   materializePrivateAssetsInWorkspaceHtml,
   repairMissingHtmlAssetReferences,
   resolveChatSaveAnalysis,
@@ -4846,6 +4847,9 @@ api.get('/sessions/:sessionId/events', async (req, res, next) => {
       currentUser: req.currentUser,
       publishDir,
       sessionId: sid,
+      pool: authPool,
+      storageRoot: resolveMindSpaceRuntimeConfig(__dirname, process.env).storageRoot,
+      h5Root: __dirname,
       syncWorkspaceAssets:
         WORKSPACE_MAINTENANCE_ENABLED && mindSpaceAssets
           ? (userId, options) => mindSpaceAssets.syncWorkspaceAssets(userId, options)
@@ -5728,6 +5732,30 @@ async function sendLongImageDownloadIfRequested(req, res, filePath) {
   });
 }
 
+async function ensurePublicHtmlPrivateAssetsMaterialized(filePath, html) {
+  if (!authPool || !htmlReferencesPrivateAssets(html)) return html;
+  const normalized = path.resolve(String(filePath ?? ''));
+  const ownerMatch = normalized.match(
+    new RegExp(`[\\\\/]${PUBLISH_ROOT_DIR}[\\\\/]([0-9a-f-]{36})[\\\\/]`, 'i'),
+  );
+  const userId = ownerMatch?.[1] ?? null;
+  if (!userId) return html;
+  const publishDir = resolveMindSpaceUserPublishDir(__dirname, { id: userId });
+  const htmlRelativePath = path.relative(publishDir, normalized).replace(/\\/g, '/');
+  if (!htmlRelativePath.startsWith(`${PUBLIC_ZONE_DIR}/`)) return html;
+  const { storageRoot } = resolveMindSpaceRuntimeConfig(__dirname, process.env);
+  const result = await materializePrivateAssetsInWorkspaceHtml({
+    pool: authPool,
+    storageRoot,
+    h5Root: __dirname,
+    userId,
+    html,
+    htmlRelativePath,
+    writeBack: true,
+  }).catch(() => ({ html, changed: false }));
+  return result.changed ? result.html : html;
+}
+
 async function sendPublishFile(req, res, filePath) {
   if (!filePath.toLowerCase().endsWith('.html')) {
     res.sendFile(filePath, (err) => {
@@ -5743,6 +5771,7 @@ async function sendPublishFile(req, res, filePath) {
     res.status(404).json({ message: '文件不存在' });
     return;
   }
+  html = await ensurePublicHtmlPrivateAssetsMaterialized(filePath, html);
   html = preparePublicHtmlAssetDelivery(html, INTERNAL_AGENT_SECRET);
   const embed = isPlazaEmbedRequest(req.query);
   if (embed) {