test(scenario): cover multi-image page generation end to end

The read_image poisoning fix had no end-to-end guard because scenarios could
only send text. Add an upload_images step that renders and uploads visually
distinct images, let chat steps attach them the same way the WeChat channel
does, and assert the generated page actually embeds every upload.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/run-scenario-test.mjs

@@ -9,6 +9,7 @@
  */
 import { loadH5Environment } from './load-env.mjs';
 import {
+  buildAssetImageUrl,
   createAgentRun,
   createReporter,
   listScenarios,
@@ -17,6 +18,7 @@ import {
   logoutViaApi,
   resolvePortalBase,
   snapshotPublicHtml,
+  uploadImageAssets,
   verifyPageAccess,
   verifySurveyDelivery,
   verifyChildrenHobbyDietSurvey,
@@ -95,6 +97,7 @@ async function runScenario(scenario, port) {
   let assistantCombinedLength = 0;
   let publishKey = null;
   let htmlBefore = [];
+  let uploadedAssetIds = [];
 
   for (const step of scenario.steps ?? []) {
     const label = step.label ?? step.action;
@@ -119,6 +122,20 @@ async function runScenario(scenario, port) {
       continue;
     }
 
+    if (step.action === 'upload_images') {
+      if (!auth) {
+        throw new Error('upload_images 步骤前必须先 login');
+      }
+      const assets = await uploadImageAssets(
+        baseUrl,
+        auth.cookie,
+        { images: step.images ?? [], categoryCode: step.categoryCode ?? 'oa' },
+        reporter,
+      );
+      uploadedAssetIds = assets.map((asset) => asset.id);
+      continue;
+    }
+
     if (step.action === 'chat') {
       if (!auth) {
         throw new Error('chat 步骤前必须先 login');
@@ -133,6 +150,9 @@ async function runScenario(scenario, port) {
         sessionId,
         selectedChatSkill: step.selectedChatSkill ?? null,
         selectedAssetIds: step.selectedAssetIds ?? null,
+        imageUrls: step.useUploadedAssets
+          ? uploadedAssetIds.map(buildAssetImageUrl)
+          : null,
       });
       reporter.pass('提交消息', `"${step.message}" → run ${run.runId}`);
 
@@ -191,6 +211,7 @@ async function runScenario(scenario, port) {
           replyText: reply.combined,
           htmlBefore,
           expect: step.expect.page,
+          uploadedAssetIds,
           reporter,
         });
       }