feat: chat uploads, vision turn isolation, and MindSpace agent improvements

Add chat file/image upload UX, attachment proxying, vision thumbnails, and per-turn image scoping so agents only use the current upload. Extend MindSpace asset context, billing token state, OA/scenario verify scripts, and related runtime config.

Co-authored-by: Cursor <cursoragent@cursor.com>

mindspace-runtime-config.test.mjs

@@ -12,6 +12,8 @@ import {
   resolveMindSpaceServerRuntimeOptions,
   resolveMindSpaceStorageRoot,
   resolveMindSpaceUserPublishDir,
+  resolveWorkspaceMindSpacePublicUrl,
+  isPublicWorkspaceHtmlRelativePath,
 } from './mindspace-runtime-config.mjs';
 
 test('resolveMindSpaceStorageRoot uses env override when present', () => {
@@ -131,3 +133,25 @@ test('createMindSpaceLocalRuntime builds a local storage-backed facade', async (
     'https://example.com/MindSpace/user-1/public/report.html',
   );
 });
+
+test('resolveWorkspaceMindSpacePublicUrl builds MindSpace public html urls only', () => {
+  const url = resolveWorkspaceMindSpacePublicUrl({
+    h5Root: '/tmp/h5',
+    env: { H5_PUBLIC_BASE_URL: 'https://example.com' },
+    userId: '32035858-9a20-425b-89da-c118ef0779aa',
+    relativePath: 'public/demo.html',
+  });
+  assert.equal(
+    url,
+    'https://example.com/MindSpace/32035858-9a20-425b-89da-c118ef0779aa/public/demo.html',
+  );
+  assert.equal(
+    resolveWorkspaceMindSpacePublicUrl({
+      h5Root: '/tmp/h5',
+      userId: 'user-1',
+      relativePath: 'oa/report.csv',
+    }),
+    null,
+  );
+  assert.equal(isPublicWorkspaceHtmlRelativePath('public/index.html'), true);
+});