修复附件询价：公网打开上传页不再出骨架 JSON，未上传时打字能正常回话。

Co-authored-by: Cursor <cursoragent@cursor.com>

inquiry-agent/tests/test_attachment_inquiry.py

@@ -239,13 +239,34 @@ class AttachmentInquiryTests(unittest.TestCase):
         )
         self.assertEqual(name, "attachment_inquiry")
 
-    def test_follow_text_not_create_ticket_before_upload(self) -> None:
+    def test_text_inquiry_before_upload_gets_reply(self) -> None:
+        """发卡后还没传材料：销售改口打字询价必须有回话，不能默收。"""
         handle_attachment_inquiry(
             InboundMessage(sender_id="s1", message_id="m1", content="附件询价"),
             store=self.store,
         )
         name = dispatch_inbound(
-            InboundMessage(sender_id="s1", message_id="m2", content="海运上海到纽约 2个40尺"),
+            InboundMessage(sender_id="s1", message_id="m2", content=SEA_ORAL),
+            RouteDecision(intent="ordinary_text_inquiry"),
+        )
+        self.assertEqual(name, "ordinary_text_inquiry")
+        self.assertIsNone(get_attach_wave_book().active("s1"))
+        self.assertIsNotNone(get_sea_text_flow().session_of("s1"))
+
+    def test_follow_text_while_recognizing_not_new_ticket(self) -> None:
+        """已经开始认附件：期间的字并进口播，不另开文字询价。"""
+        handle_attachment_inquiry(
+            InboundMessage(sender_id="s1", message_id="m1", content="附件询价"),
+            store=self.store,
+        )
+        accept_h5_uploads(
+            sender_id="s1",
+            files=[("sea.xlsx", b"fake")],
+            store=self.store,
+            process_now=False,
+        )
+        name = dispatch_inbound(
+            InboundMessage(sender_id="s1", message_id="m2", content="只要整柜"),
             RouteDecision(intent="ordinary_text_inquiry"),
         )
         self.assertEqual(name, "attach_wave_follow_text")

inquiry-agent/tests/test_attachment_upload_h5.py

@@ -66,6 +66,30 @@ class AttachmentUploadH5Tests(unittest.TestCase):
         self.assertEqual(miss.status_code, 410)
         self.assertIn("过期", miss.text)
 
+    def test_bare_token_opens_upload_page_not_json(self) -> None:
+        """
+        公网 Nginx 会把 /inquiry-form/upload/{token} 改写成 /inquiry-form/{token}。
+        附件票必须出上传页，不能把补问骨架 JSON 直接给销售。
+        """
+        token = self._open_card()
+        hit = self.client.get(f"/inquiry-form/{token}")
+        self.assertEqual(hit.status_code, 200)
+        self.assertIn("text/html", hit.headers.get("content-type", ""))
+        self.assertIn("Excel", hit.text)
+        self.assertNotIn("骨架", hit.text)
+        self.assertNotIn("s1", hit.text)
+        miss = self.client.get("/inquiry-form/not-a-real-token")
+        self.assertIn(miss.status_code, (410, 422))
+
+    def test_bare_token_post_png_rejected(self) -> None:
+        token = self._open_card()
+        hit = self.client.post(
+            f"/inquiry-form/{token}",
+            files=[("files", ("shot.png", b"\x89PNG", "image/png"))],
+        )
+        self.assertEqual(hit.status_code, 400)
+        self.assertIn("Excel", hit.text)
+
     def test_upload_page_uses_card_chrome(self) -> None:
         from agent.channel.h5.upload_page import expired_upload_page, render_upload_message, render_upload_page