diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-09-30 13:22:17 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-09-30 13:22:17 +0200 |
| commit | f211a13dc2e5dd82eaba49222171d6f29d858eb5 (patch) | |
| tree | 222b9d55116179e35c3013239b7f8e1120907e91 /docs/MESHBAY_DESIGN.md | |
| parent | 87725dc7a2da27c2ca3b9e58af751f0e6f8c9de7 (diff) | |
| download | meshbay-f211a13dc2e5dd82eaba49222171d6f29d858eb5.tar.gz | |
fix(hub): a downloaded file opens in a tab only under a type that runs nothing
Open is offered for PDFs, raster images, audio, video and plain text, typed
from the name; HTML, SVG and the rest are not opened in the hub's origin.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'docs/MESHBAY_DESIGN.md')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index b44359f..9076ebc 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -2364,6 +2364,14 @@ Specific rules the download path is built on: the frame source policy, the frame-ancestors policy and the legacy frame option. Same-origin framing is what a streamed download needs; refusing every foreign origin is unaffected. +- **A downloaded file is opened in a tab only under a type that runs nothing.** + A tab on a `blob:` URL is a document of the hub's origin, with its session and + its keys; measured in Chrome and Firefox, HTML typed `text/html` runs there and + the same bytes typed `text/plain` do not. So "Open" is offered for PDFs, raster + images, audio, video and plain text, under a type chosen from the name — never + the one the browser would guess from the bytes — and not at all otherwise + (`downloads.openInTab`). Like resumability, whether a row can be opened is + declared by its target. **Pause and resume, and where resumability actually lives.** A pause button that quietly restarts a download from zero is worse than no pause button, so the |