2 files changed, 29 insertions, 1 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/portable-name.js b/packages/meshbay-hub/src/meshbay_hub/static/portable-name.js
index bb2438c..34085ae 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/portable-name.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/portable-name.js
@@ -20,8 +20,13 @@ const WINDOWS_RESERVED = new Set([
 ]);
 
 const RESERVED_CHARS = new Set('<>:"/\\|?*');
+// The bidirectional controls: "invoice\u202efdp.exe" displays as
+// "invoiceexe.pdf", and a saved name must say what the file is.
+const BIDI_CONTROLS = new Set('\u061c\u200e\u200f\u202a\u202b\u202c\u202d\u202e'
+                              + '\u2066\u2067\u2068\u2069');
 
-const reserved = (c) => RESERVED_CHARS.has(c) || c.charCodeAt(0) < 32;
+const reserved = (c) => RESERVED_CHARS.has(c) || BIDI_CONTROLS.has(c)
+  || c.charCodeAt(0) < 32;
 
 function isPortable(name) {
   if (!name || name === '.' || name === '..') return false;
diff --git a/packages/meshbay-hub/tests/test_desktop_shell.py b/packages/meshbay-hub/tests/test_desktop_shell.py
index 4426dd7..60aa32f 100644
--- a/packages/meshbay-hub/tests/test_desktop_shell.py
+++ b/packages/meshbay-hub/tests/test_desktop_shell.py
@@ -701,3 +701,26 @@ def test_an_account_made_in_the_application_starts_without_browser_access():
     assert "platform.keys.createdHere(reg.userId)" in register
     assert "userId" in (STATIC / "keyderive.js").read_text(encoding="utf-8").split(
         "async function registerUser", 1)[1].split("\n}\n", 1)[0]
+
+
+def _handler(name: str) -> str:
+    source = _main()
+    start = source.index(f"handle('{name}'")
+    return source[start:source.index("\n  });", start)]
+
+
+def test_a_finished_download_carries_the_mark_of_the_web():
+    """What a browser leaves on every download, so Windows applies SmartScreen
+    and Protected View. Only checkable here by reading: the stream exists on
+    NTFS alone, and this suite does not run on Windows."""
+    assert "markFromInternet(sink.path)" in _handler("save:end")
+    source = _main()
+    mark = source[source.index("function markFromInternet"):]
+    mark = mark[:mark.index("\n  }\n")]
+    assert "Zone.Identifier" in mark and "ZoneId=3" in mark
+    assert "process.platform !== 'win32'" in mark
+
+
+def test_a_saved_name_cannot_hide_its_extension():
+    begin = _handler("save:begin")
+    assert "\\u202a-\\u202e" in begin and "\\u2066-\\u2069" in begin