Add attachment text extraction, auto web news skill, and chat/voice UI updates.

Simplify asset upload temp paths, refresh deploy docs for Aliyun DNS topology, and ship MindSpace content-scan and auth improvements.

Co-authored-by: Cursor <cursoragent@cursor.com>

mindspace-content-scan.mjs

@@ -148,6 +148,11 @@ const HTML_RULES = [
   },
 ];
 
+const ACKNOWLEDGEABLE_HTML_ACTIVE_TYPES = new Set([
+  'html_script',
+  'html_inline_handler',
+]);
+
 const TRUSTED_EXTERNAL_HOSTS = new Set([
   'fonts.googleapis.com',
   'fonts.gstatic.com',
@@ -182,12 +187,16 @@ function uniqueMatches(content, pattern) {
   ];
 }
 
-function applyRule(content, rule, findings, redactions) {
+function applyRule(content, rule, findings, redactions, options = {}) {
   let matches = uniqueMatches(content, rule.pattern);
   if (rule.type === 'external_link') {
     matches = matches.filter((match) => !isTrustedExternalUrl(match[0]));
   }
   if (!matches.length) return content;
+  const blocking =
+    options.allowHtmlActiveContent && ACKNOWLEDGEABLE_HTML_ACTIVE_TYPES.has(rule.type)
+      ? false
+      : rule.blocking;
   findings.push({
     id: crypto
       .createHash('sha256')
@@ -199,7 +208,7 @@ function applyRule(content, rule, findings, redactions) {
     riskLevel: rule.riskLevel,
     occurrenceCount: matches.length,
     sampleMasked: rule.mask(matches[0][0], matches[0]),
-    blocking: rule.blocking,
+    blocking,
   });
   let next = String(content);
   if (typeof rule.replacement === 'function') {
@@ -224,11 +233,11 @@ export function scanContent(content, options = {}) {
   const findings = [];
   const working = String(content ?? '');
   for (const rule of TEXT_RULES) {
-    applyRule(working, rule, findings, []);
+    applyRule(working, rule, findings, [], options);
   }
   if (format === 'html') {
     for (const rule of HTML_RULES) {
-      applyRule(working, rule, findings, []);
+      applyRule(working, rule, findings, [], options);
     }
   }
   return finalizeResult(findings);