fix(desktop): omit invalid dashboard web dist env

[sweetcornna]

Summary

• add a pure desktop helper for resolving the Dashboard web dist passed to the Python backend
• prefer HERMES_DESKTOP_WEB_DIST and app.asar.unpacked/dist only when they exist as normal directories
• omit inherited/invalid HERMES_WEB_DIST when no usable backend dist exists, so hermes_cli.web_server can fall back to its packaged default
• keep the renderer-facing resolveWebDist() path unchanged for Electron's own ASAR loading

Fixes #39472.

Validation

• RED first: node --test electron/web-dist.test.cjs failed with Cannot find module './web-dist.cjs'
• node --test electron/web-dist.test.cjs
• npm run test:desktop:platforms
• npx eslint electron/main.cjs electron/web-dist.cjs electron/web-dist.test.cjs
• node --check electron/main.cjs; node --check electron/web-dist.cjs; node --check electron/web-dist.test.cjs
• npm run type-check
• git diff --check

[austinpickett]

Hermes Agent Review — ✅ Approve

Verified locally vs origin/main; ran the new test suite (5/5 pass).

Correct semantic fix. On origin/main, resolveWebDist() falls back to APP_ROOT/dist, which under asar:true is a path inside app.asar — not a real filesystem dir the Python dashboard backend can serve over HTTP — so HERMES_WEB_DIST got set to an unservable path, causing static-route 404s (refs #41327/#39472). The new resolveDashboardWebDist returns null in that case and applyDashboardWebDist then deletes HERMES_WEB_DIST from the spawn env (including any inherited value), letting the backend use its own default.

Key correctness points I confirmed:

• Wiring updated at both spawn sites (spawnPoolBackend, startHermes); both old inline HERMES_WEB_DIST: webDist assignments removed.
• Renderer path deliberately untouched — resolveWebDist()/resolveRendererIndex() keep the APP_ROOT/dist fallback, which is correct because Electron's renderer can load index.html from asar while the HTTP backend cannot. The asar-OK-for-renderer / asar-forbidden-for-backend split is the right distinction.
• Good guards: override path.resolve'd + existence-checked; unpackedPathFor regex app\.asar(?=$|[\\/]) correctly anchors the asar segment.

node --test apps/desktop/electron/web-dist.test.cjs  =>  5 pass, 0 fail

including the critical "does NOT fall back to asar-internal dist → null" case and both env strip/set cases. node --check clean on web-dist.cjs + main.cjs; test registered in test:desktop:platforms. No out-of-scope hunks (exactly the 4 declared files, +129/-11), no security surface.

Optional nit (non-blocking): origin/main's resolveWebDist logs a rememberLog warning when it lands on an asar-internal path; the new resolver returns null silently. A one-line breadcrumb when both override+unpacked tiers miss would aid future debugging. Not required.

Cluster note: same desktop module-extraction family as #37471/#38292/#38589/etc. — textual conflicts on main.cjs/package.json expected, no semantic overlap.

Reviewed by Hermes Agent (local node --test + origin/main verification).

[teknium1]

Thanks for the focused desktop hardening work. This is an automated hermes-sweeper review; the reported packaged-dashboard failure is already addressed on current main.

• apps/desktop/package.json:192-196 unpacks dist/**, making the packaged frontend available as a real filesystem directory (merged in 53a2ac8f2dba4b8fa647a8c5062b649d45b05464, PR fix(desktop): unpack dist/ from asar so dashboard static files are servable #41411).
• apps/desktop/electron/main.ts:3147-3176 validates the override and prefers app.asar.unpacked/dist; it also logs an actionable diagnostic if only an unusable ASAR-internal fallback remains.
• Both desktop backend spawn paths pass that resolved directory in HERMES_WEB_DIST (apps/desktop/electron/main.ts:6562-6585 and 6814-6843).
• The Desktop dashboard passes ASAR-internal HERMES_WEB_DIST, causing frontend 404 on macOS #39472 discussion already records this resolution and its follow-up hardening (fix(desktop): fail loudly instead of blank-paging when the renderer bundle is missing #41729).

The fixing commit is contained in release v2026.6.19, so this PR is now redundant.