fix(agent): recover stale runs and improve new-user OA delivery

Fix DEV logout cookie clearing, materialize selected MindSpace OA assets before agent runs, and recover zombie runs from synced workspace pages. Add client run wait timeout, harness retry limits, page-edit asset forwarding, and logout/john2 scenario tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/scenario-test-lib.mjs

@@ -75,6 +75,46 @@ export async function loginViaApi(baseUrl, { username, password }, reporter) {
   };
 }
 
+export async function logoutViaApi(baseUrl, cookie, reporter) {
+  const response = await fetch(`${baseUrl}/auth/logout`, {
+    method: 'POST',
+    headers: { Cookie: cookie },
+  });
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    throw new Error(`登出失败 ${response.status}: ${JSON.stringify(body)}`);
+  }
+
+  const setCookie = response.headers.getSetCookie?.() ?? [];
+  const cleared = setCookie.some((line) => /Max-Age=0/i.test(line) || /Expires=Thu, 01 Jan 1970/i.test(line));
+  if (!cleared) {
+    reporter.fail('登出 Cookie', '响应未包含清 Cookie 的 Set-Cookie');
+  } else {
+    reporter.pass('登出 Cookie', 'Set-Cookie 已清除会话');
+  }
+
+  const statusResponse = await fetch(`${baseUrl}/auth/status`, {
+    headers: { Cookie: cookie },
+  });
+  const statusBody = await statusResponse.json().catch(() => ({}));
+  if (statusBody?.authenticated) {
+    reporter.fail('登出状态', `/auth/status 仍为 authenticated`);
+  } else {
+    reporter.pass('登出状态', '未登录');
+  }
+
+  const protectedResponse = await fetch(`${baseUrl}/api/me`, {
+    headers: { Cookie: cookie },
+  });
+  if (protectedResponse.status === 401 || protectedResponse.status === 403) {
+    reporter.pass('登出后 API', `${protectedResponse.status} 已拒绝旧 Cookie`);
+  } else {
+    reporter.fail('登出后 API', `/api/me 返回 ${protectedResponse.status}，旧 Cookie 仍有效`);
+  }
+
+  return body;
+}
+
 function buildUserMessage(text, { selectedChatSkill = null } = {}) {
   const metadata = { userVisible: true, displayText: text };
   if (selectedChatSkill) {
@@ -88,13 +128,21 @@ function buildUserMessage(text, { selectedChatSkill = null } = {}) {
   };
 }
 
-export async function createAgentRun(baseUrl, cookie, { message, sessionId = null, selectedChatSkill = null }) {
+export async function createAgentRun(baseUrl, cookie, {
+  message,
+  sessionId = null,
+  selectedChatSkill = null,
+  selectedAssetIds = null,
+}) {
   const requestId = crypto.randomUUID();
   const body = {
     request_id: requestId,
     user_message: buildUserMessage(message, { selectedChatSkill }),
   };
   if (sessionId) body.session_id = sessionId;
+  if (Array.isArray(selectedAssetIds) && selectedAssetIds.length > 0) {
+    body.selected_asset_ids = selectedAssetIds;
+  }
 
   const response = await fetch(`${baseUrl}/api/agent/runs`, {
     method: 'POST',