Improve WeChat MP replies and ship MindSpace/H5 production updates.

Add WeChat service account routing with sync acks, connectivity tests, and context isolation; document deploy runbooks; and bundle related MindSpace, voice, Plaza, and server gateway changes for production rollout.

Co-authored-by: Cursor <cursoragent@cursor.com>

capabilities.test.mjs

@@ -120,6 +120,23 @@ test('buildPageEditAgentPolicy without shell keeps empty developer tools', () =>
   assert.deepEqual(narrowed.extensionOverrides, []);
 });
 
+test('buildPageEditAgentPolicy grants shell for static_publish sandbox users with shell capability', () => {
+  const base = {
+    ...buildAgentExtensionPolicy(
+      { ...DEFAULT_USER_CAPABILITIES, static_publish: true, shell: true },
+      {
+        sandboxMcp: {
+          serverPath: '/tmp/mindspace-sandbox-mcp.mjs',
+          sandboxRoot: '/tmp/sandbox',
+        },
+      },
+    ),
+    capabilities: { ...DEFAULT_USER_CAPABILITIES, static_publish: true, shell: true },
+  };
+  const narrowed = buildPageEditAgentPolicy(base);
+  assert.deepEqual(narrowed.extensionOverrides?.[0]?.available_tools, ['shell']);
+});
+
 test('sandboxMcpTools returns correct tool list based on capabilities', () => {
   const base = { ...DEFAULT_USER_CAPABILITIES, static_publish: true };
   assert.deepEqual(sandboxMcpTools(base), ['read_file', 'write_file', 'edit_file', 'create_dir']);