fix(agent): recover stale runs and improve new-user OA delivery

Fix DEV logout cookie clearing, materialize selected MindSpace OA assets before agent runs, and recover zombie runs from synced workspace pages. Add client run wait timeout, harness retry limits, page-edit asset forwarding, and logout/john2 scenario tests. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-10 20:05:52 +08:00
parent aede1e6fcb
commit 7f8d692d16
34 changed files with 1318 additions and 125 deletions
@@ -19,6 +19,43 @@ test('runBasicFileScan blocks inline script payloads', () => {
  assert.equal(result.riskLevel, 'high');
 });

+test('runBasicFileScan warns for sandboxed html with inline script and trusted Chart.js', () => {
+  const result = runBasicFileScan(
+    Buffer.from(`<!doctype html>
+      <script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.7/dist/chart.umd.min.js"></script>
+      <script>new Chart(document.createElement('canvas'), { type: 'bar', data: { labels: [] } });</script>`),
+    {
+      filename: 'dashboard.html',
+      mimeType: 'text/html',
+      htmlActiveContentPolicy: 'sandbox_warn',
+    },
+  );
+  assert.equal(result.scanStatus, 'warned');
+  assert.equal(result.riskLevel, 'medium');
+  assert.deepEqual(result.findings, ['trusted_html_active_content']);
+});
+
+test('runBasicFileScan still blocks unsafe html active content in sandbox mode', () => {
+  const javascriptUrl = runBasicFileScan(Buffer.from('<a href="javascript:alert(1)">go</a>'), {
+    filename: 'dashboard.html',
+    mimeType: 'text/html',
+    htmlActiveContentPolicy: 'sandbox_warn',
+  });
+  assert.equal(javascriptUrl.scanStatus, 'blocked');
+  assert.deepEqual(javascriptUrl.findings, ['javascript_url']);
+
+  const unknownScript = runBasicFileScan(
+    Buffer.from('<script src="https://evil.example/app.js"></script>'),
+    {
+      filename: 'dashboard.html',
+      mimeType: 'text/html',
+      htmlActiveContentPolicy: 'sandbox_warn',
+    },
+  );
+  assert.equal(unknownScript.scanStatus, 'blocked');
+  assert.deepEqual(unknownScript.findings, ['text_active_content']);
+});
+
 test('runBasicFileScan blocks suspicious zip compression ratio', () => {
  const buffer = Buffer.alloc(64);
  buffer.write('PK', 0);