fix(trueforge-ui): encode artifact paths in download links

[CaptainAni187]

Summary

Artifact paths come from the model's sandbox_artifacts fence and were concatenated into the download href unencoded, so a generated name containing a space, #, ?, & or % produced a broken or misparsed URL. # in particular silently truncates the rest.

Closes #424

Changes

• Encode each segment of the path in ChatFileDownload, so / keeps its structural meaning and everything else is escaped
• Test covering spaces, #, &, ?, % and non-ASCII names

Worth flagging: not encodeURIComponent(path) as the issue suggests. fileDownloadBaseUrl is a path prefix, not a ?path= query, so encoding the whole string turns /report.pdf into %2Freport.pdf and breaks the links the existing test pins.

How was this tested?

vitest run test/atoms/ChatFileDownload.test.tsx in packages/trueforge-ui — 5 pass. Reverting only the encode call fails the new case and leaves the other four green.

Checklist

• I have read the contributing guidelines
• format:check passes repo-wide and eslint is clean on the touched files; ran the package's own tests rather than the full pnpm test. Repo-wide lint:ci has 55 pre-existing errors, all in packages/frontend/* and DropdownMenu.tsx, none in files this PR touches
• Tests added/updated where it makes sense
• No hand-edits to generated code
• Docs / .env.example — not applicable

Changeset included. On process: CONTRIBUTING asks for approval first, and all six help wanted issues are assigned or already have PRs, so there was nothing approved to pick up. Close this if you'd rather it went through the queue.

---

Note

Low Risk
Localized UI URL construction fix with tests; no auth, data, or API behavior changes.

Overview
Fixes broken sandbox artifact downloads when model-generated filenames include spaces, #, query characters, &, %, or non-ASCII text—those values were appended to fileDownloadBaseUrl raw, so browsers could truncate or misparse the link (notably #).

ChatFileDownload now runs paths through encodeArtifactPath, which applies encodeURIComponent to each path segment while leaving / as separators (avoiding whole-path encoding that would turn /report.pdf into %2Freport.pdf). The onDownloadArtifact callback still receives the original path; only the anchor href is encoded.

Adds a unit test for the tricky filename cases and a patch changeset for @truefoundry/trueforge-ui.

^{Reviewed by Cursor Bugbot for commit 72c9765. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 72c9765

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@truefoundry/trueforge-ui	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR