fix(desktop): open remote-gateway artifacts via authenticated download

[OutThisLife]

Summary

Salvages #46663. That PR fixes a real bug but its diff is +19,324 / −19,269 because the four edited files were rewritten with CRLF line endings on Windows — the actual logical change is ~60 lines. It also makes the new download endpoint public (PUBLIC_API_PATHS), which exposes arbitrary managed-file downloads to any unauthenticated caller.

This branch reimplements the same fix on a clean LF base, DRY-er, with the security hole closed and tests added.

The bug

On a remote gateway connection, agent-written files live on the gateway host, not the desktop's disk. The Artifacts view built raw file:// hrefs and handed them to openExternal, so opening a file failed with "Invalid external URL" and image thumbnails 404'd.

The fix

• media.ts — mediaExternalUrl() is now remote-aware in one place: remote mode rewrites a gateway-local path to GET /api/files/download?path=…&token=…. Local mode is unchanged (file://).
• artifacts/index.tsx — artifactHref() resolves through mediaExternalUrl(). The existing chat-media (markdown-text) and generated-image callers inherit the remote behavior for free.
• web_server.py — new GET /api/files/download streams a managed file as a Content-Disposition: attachment, reusing _resolve_managed_path + the existing size cap.
• Security: the endpoint stays auth-gated. auth_middleware additionally accepts the session token via ?token= for this one path (_QUERY_TOKEN_API_PATHS) so a shell/browser-opened download — which can't set the session header — still authenticates. Same query-token tradeoff as the /api/pty WebSocket. Not added to PUBLIC_API_PATHS.

Diff size

+163 / −11 across 5 files (vs +19,324 / −19,269).

Credit preserved via Co-authored-by: qingshan89.

Test plan

• apps/desktop vitest — media.remote.test.ts (remote URL rewrite, local passthrough, no-token fallback)
• apps/desktop tsc --noEmit
• tests/hermes_cli/test_web_server_files.py — download returns attachment; ?token= authenticates / rejects bad/missing token; query token does not unlock other endpoints

[github-actions]

🔎 Lint report: bb/salvage-remote-artifact-download vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 10960 on HEAD, 10960 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 5772 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[pcaruba]

Heads-up: I opened #47481 to extend the artifact-open experience that this PR enabled.

This PR solved the download side (remote-gateway artifacts now stream via authenticated /api/files/download with the ?token= query auth path). Issue #47481 proposes the complementary trigger side: making the right rail auto-open for write_file (and other tool results) of known file types, so users don't have to navigate to the Artifacts page or file tree to see what the agent produced.

Concretely, the server-side change I'm planning in Track 1 enriches the tool.completed WebSocket event payload at gateway/platforms/api_server.py:3611-3619 with a flat path field sourced from the tool args or result.resolved_path. The desktop's existing structuredPreviewCandidate filter at apps/desktop/src/app/session/hooks/use-preview-routing.ts:65-88 already matches on that field — no schema change required on the renderer side.

The PDF info card in Track 2 is orthogonal and would also benefit from the authenticated-download path you wired up here, since remote-gateway PDFs would need the same ?token= query auth when opened externally.

Would love a sanity check from anyone who worked on this PR before I open the implementation PR.