1 files changed, 30 insertions, 0 deletions
diff --git a/packages/meshbay-hub/tests/test_spa_ordering.py b/packages/meshbay-hub/tests/test_spa_ordering.py
index 04c5159..79d7c9a 100644
--- a/packages/meshbay-hub/tests/test_spa_ordering.py
+++ b/packages/meshbay-hub/tests/test_spa_ordering.py
@@ -199,3 +199,33 @@ def test_the_files_panel_no_longer_carries_its_own_progress_bars():
     app = APP.read_text()
     for gone in ("setUlState", "setDlState", "dl-bar"):
         assert gone not in app, f"{gone} survived the move to the transfer widget"
+
+
+# ── Downloading a selection ─────────────────────────────────────────────────
+
+def test_a_multi_file_download_waits_for_each_picker():
+    """
+    A browser allows one file picker at a time. Firing every download at once
+    meant the first opened a dialog and the rest were rejected — two files
+    selected, one file downloaded.
+    """
+    app = APP.read_text()
+    block = app[app.index("${selectedFiles.length > 0 && html`"):]
+    block = block[:block.index("`}")]
+    assert "await downloadFile(e)" in block, (
+        "downloads are fired without awaiting again; only the first will ask "
+        "for a save location and the others will be rejected")
+
+
+def test_links_in_chat_are_built_as_elements_not_markup():
+    """
+    A message is something another member wrote. It becomes an anchor element,
+    never HTML, and only for http(s) — otherwise javascript: would be one
+    message away from running here.
+    """
+    app = APP.read_text()
+    fn = app[app.index("function linkify("):]
+    fn = fn[:fn.index("\nfunction ", 1)]
+    assert "innerHTML" not in fn and "dangerouslySetInnerHTML" not in fn
+    assert 'rel="noopener noreferrer"' in fn
+    assert "https?" in app[app.index("const URL_RE"):app.index("function linkify(")]