fix(agent): recover stale runs and improve new-user OA delivery

Fix DEV logout cookie clearing, materialize selected MindSpace OA assets before agent runs, and recover zombie runs from synced workspace pages. Add client run wait timeout, harness retry limits, page-edit asset forwarding, and logout/john2 scenario tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

mindspace-assets.mjs

@@ -61,6 +61,26 @@ function asNumber(value) {
   return Number(value ?? 0);
 }
 
+function scanOptionsForCategoryFile(categoryCode, filename, mimeType) {
+  const normalizedName = String(filename ?? '').toLowerCase();
+  if (
+    categoryCode === 'public' &&
+    mimeType === 'text/html' &&
+    normalizedName.endsWith('.html')
+  ) {
+    return { htmlActiveContentPolicy: 'sandbox_warn' };
+  }
+  return {};
+}
+
+function assetStatusForScan(scan) {
+  return scan.scanStatus === 'blocked' ? 'quarantined' : 'ready';
+}
+
+function versionStatusForScan(scan) {
+  return scan.scanStatus === 'blocked' ? 'blocked' : scan.scanStatus;
+}
+
 function normalizeFilename(filename) {
   const normalized = String(filename ?? '').normalize('NFKC').trim();
   if (
@@ -636,9 +656,10 @@ export function createAssetService(pool, options = {}) {
       const scan = runBasicFileScan(storedBuffer, {
         filename: storedUploadFilename,
         mimeType: storedMimeType,
+        ...scanOptionsForCategoryFile(upload.category_code, storedUploadFilename, storedMimeType),
       });
-      const assetStatus = scan.scanStatus === 'passed' ? 'ready' : 'quarantined';
-      const versionScanStatus = scan.scanStatus === 'passed' ? 'passed' : 'blocked';
+      const assetStatus = assetStatusForScan(scan);
+      const versionScanStatus = versionStatusForScan(scan);
       const isImage = storedMimeType.startsWith('image/');
       const shouldPublishImage = isImage && scan.scanStatus === 'passed';
       let finalStorageKey = upload.temporary_storage_key;
@@ -1188,9 +1209,10 @@ export function createAssetService(pool, options = {}) {
       const scan = runBasicFileScan(storedBuffer, {
         filename: storedFilenameInput,
         mimeType: storedMimeType,
+        ...scanOptionsForCategoryFile(category.category_code, storedFilenameInput, storedMimeType),
       });
-      const assetStatus = scan.scanStatus === 'passed' ? 'ready' : 'quarantined';
-      const versionScanStatus = scan.scanStatus === 'passed' ? 'passed' : 'blocked';
+      const assetStatus = assetStatusForScan(scan);
+      const versionScanStatus = versionStatusForScan(scan);
       const shouldPublishImage = isImage && scan.scanStatus === 'passed';
       let finalStorageKey = path.posix.join('users', userId, 'assets', assetId, 'versions', versionId);
       let workspaceRelativePath = null;