fix: downloads are marked and keep their extension; Explorer files are refused

The desktop app writes the Mark-of-the-Web on each file it saves on Windows, as
a browser does. Bidirectional controls are reserved characters in a saved name
(portable-name.js and paths.sanitize_for_download, and again in the main
process), so a name cannot display one extension and carry another. The node
refuses uploads of files Windows Explorer acts on by itself: desktop.ini,
.lnk, .url, .scf, .library-ms, .searchConnector-ms (F-19).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 23 insertions, 0 deletions

diff --git a/packages/meshbay-hub/tests/test_desktop_shell.py b/packages/meshbay-hub/tests/test_desktop_shell.py
index 4426dd7..60aa32f 100644
--- a/packages/meshbay-hub/tests/test_desktop_shell.py
+++ b/packages/meshbay-hub/tests/test_desktop_shell.py
@@ -701,3 +701,26 @@ def test_an_account_made_in_the_application_starts_without_browser_access():
     assert "platform.keys.createdHere(reg.userId)" in register
     assert "userId" in (STATIC / "keyderive.js").read_text(encoding="utf-8").split(
         "async function registerUser", 1)[1].split("\n}\n", 1)[0]
+
+
+def _handler(name: str) -> str:
+    source = _main()
+    start = source.index(f"handle('{name}'")
+    return source[start:source.index("\n  });", start)]
+
+
+def test_a_finished_download_carries_the_mark_of_the_web():
+    """What a browser leaves on every download, so Windows applies SmartScreen
+    and Protected View. Only checkable here by reading: the stream exists on
+    NTFS alone, and this suite does not run on Windows."""
+    assert "markFromInternet(sink.path)" in _handler("save:end")
+    source = _main()
+    mark = source[source.index("function markFromInternet"):]
+    mark = mark[:mark.index("\n  }\n")]
+    assert "Zone.Identifier" in mark and "ZoneId=3" in mark
+    assert "process.platform !== 'win32'" in mark
+
+
+def test_a_saved_name_cannot_hide_its_extension():
+    begin = _handler("save:begin")
+    assert "\\u202a-\\u202e" in begin and "\\u2066-\\u2069" in begin