fix(desktop): drop manual Content-Length in OAuth net.request (ERR_INVALID_ARGUMENT)

[Kyzcreig]

Changing the model from the desktop app Settings → Models → Apply (and any other body-bearing POST) fails for remote-backend OAuth users with:

Error invoking remote method 'hermes:api': Error: net::ERR_INVALID_ARGUMENT

Root cause

fetchJsonViaOauthSession() in apps/desktop/electron/main.cjs manually sets Content-Length on the Electron net.request:

request.setHeader('Content-Type', 'application/json')
if (body) request.setHeader('Content-Length', String(body.length))

Electron's net.request (ClientRequest, Chromium net stack) treats Content-Length as a protected header it computes itself from request.write(body). Setting it explicitly throws net::ERR_INVALID_ARGUMENT, so the request fails before it ever leaves the app.

This only bit the OAuth/remote path (electronNet) on body-bearing POSTs (e.g. POST /api/model/set). GET and bodyless POSTs were unaffected, and the local/token path (fetchJson, Node http) tolerates a manual Content-Length — which is why it regressed only for remote-backend OAuth users. Introduced in #39921.

Empirical verification

Headless Electron net.request probe (Electron 40):

WITH Content-Length    -> net::ERR_INVALID_ARGUMENT   (matches the report)
WITHOUT Content-Length -> net::ERR_UNSAFE_PORT         (header validation passed; only the test port was rejected)

Fix

Remove the manual Content-Length header; let Electron compute it from request.write(body). The backend POST /api/model/set was verified to return 200 for the same payload, confirming the failure was entirely client-side.

[tonydwb]

Approved. Drops manual Content-Length header in desktop OAuth net.request to fix ERR_INVALID_ARGUMENT.

[Kyzcreig]

Closing as implemented on current main (7c14d2a046217c5ccbaa06a9449b0fcf329221f9). The OAuth Electron request path now lives in apps/desktop/electron/oauth-net-request.ts / oauth-session-request.test.ts: setJsonRequestHeaders sets only Content-Type, Chromium frames the serialized body, and no forbidden Content-Length is set. Current verification: npx tsx --test electron/oauth-net-request.test.ts electron/oauth-session-request.test.ts → 4 passed, 0 failed. Porting the old main.cjs hunk onto current main.ts would reintroduce obsolete structure.