feat: add remote workspaces and verified deliverables

tests/test_gateway_security.py

@@ -4,8 +4,8 @@ import pytest
 from fastapi.testclient import TestClient
 
 from agent_platform.gateway.app import create_app
-from agent_platform.gateway.provider import normalize_workspace_path, workspace_ref
-from agent_platform.gateway.schemas import ToolResult, WorkspaceStatus
+from agent_platform.gateway.provider import WorkspaceDownload, normalize_workspace_path, workspace_ref
+from agent_platform.gateway.schemas import ToolResult, WorkspaceListing, WorkspaceStatus
 
 
 def test_workspace_paths_cannot_escape() -> None:
@@ -62,6 +62,30 @@ class FakeProvider:
     async def cancel_process(self, *args, **kwargs):
         return ToolResult(ok=True)
 
+    async def browse_files(self, user_id, path):
+        return WorkspaceListing(
+            path=path,
+            entries=[
+                {
+                    "name": "报告.md",
+                    "path": "报告.md",
+                    "kind": "file",
+                    "size": 12,
+                    "modified_at": 1,
+                }
+            ],
+        )
+
+    async def download_file(self, user_id, path):
+        return WorkspaceDownload(filename="报告.md", media_type="text/markdown", content=b"report")
+
+    async def archive_files(self, user_id, path):
+        return WorkspaceDownload(
+            filename="workspace.tar.gz",
+            media_type="application/gzip",
+            chunks=iter((b"archive",)),
+        )
+
 
 def test_gateway_requires_service_key_and_signed_identity(settings, identity_jwt) -> None:
     app = create_app(settings, provider=FakeProvider())
@@ -74,6 +98,16 @@ def test_gateway_requires_service_key_and_signed_identity(settings, identity_jwt
         response = client.post("/v1/tools/list_files", headers=headers, json={"path": "src"})
         assert response.status_code == 200
         assert response.json()["output"] == "user-123:src"
+        listing = client.get("/v1/files", headers=headers, params={"path": "."})
+        assert listing.status_code == 200
+        assert listing.json()["entries"][0]["name"] == "报告.md"
+        download = client.get("/v1/files/download", headers=headers, params={"path": "报告.md"})
+        assert download.status_code == 200
+        assert download.content == b"report"
+        assert "filename*=UTF-8''" in download.headers["content-disposition"]
+        archive = client.get("/v1/files/archive", headers=headers)
+        assert archive.status_code == 200
+        assert archive.content == b"archive"
 
 
 def test_gateway_openapi_does_not_expose_auth_headers(settings) -> None: