feat(web): add file downloads to the Files panel

[0x4bs3nt]

What Changed

Added a Download action to the right-click menu for files in the right-side Files panel.

Downloads use a signed attachment URL from the connected environment, preserving the original file contents and supporting binary and large files. The action works with both local and remote environments and is not shown for folders.

Why

The Files panel allowed users to open files, copy mentions, and add files to chat, but it did not provide a way to download them.

Using the existing signed asset endpoint keeps the implementation remote-ready and avoids the limitations of the text-preview API, which rejects binary files and truncates large files.

UI Changes

Before

After

Interaction

Screen.Recording.2026-07-30.at.12.48.17.mov

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

---

Note

Medium Risk
Expands the signed asset endpoint to arbitrary workspace files when disposition is attachment, which is intentional but increases the sensitivity of correct path scoping and token validation on the existing asset security boundary.

Overview
Adds Download to the Files panel context menu for file entries (not folders). Downloads go through the existing signed asset API instead of the text-preview path, so binary and large files keep full contents.

The workspace-file asset resource now accepts optional disposition: "attachment. Issuing skips preview-only type checks for attachments, uses exact workspace-file claims with disposition encoded in the token, and resolution returns that disposition. Asset HTTP responses set Content-Disposition: attachment and Cache-Control: private, no-store for downloads while preview assets stay cacheable.

The web layer adds downloadWorkspaceFile (requests the attachment URL, triggers download via a hidden anchor with target="_blank") and wires it from FilePreviewPanel into FileBrowserPanel via buildFileBrowserContextMenuItems.

^{Reviewed by Cursor Bugbot for commit 1a4f778. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add file download support to the Files panel

• Adds a Download context menu item for files in the file browser, wired through FileBrowserPanel via a new onDownloadFile prop and built by a new buildFileBrowserContextMenuItems helper.
• Implements downloadWorkspaceFile in downloadWorkspaceFile.ts, which requests a workspace-file asset URL with disposition: "attachment" and triggers a browser download via a hidden anchor element.
• Extends the asset pipeline in AssetAccess and the contracts schema to support disposition: "attachment" on workspace-file claims, encoding it in the signed token and returning it in the resolved asset.
• Sets Content-Disposition: attachment and Cache-Control: private, no-store response headers for attachment assets in the HTTP asset route handler.

^{Macroscope summarized 1a4f778.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 296b2878-45ea-4fd0-b935-b154ba92ef3d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new user-facing feature (file downloads in the Files panel) with new download logic, context menu additions, server-side asset handling changes, and HTTP header modifications. New features introducing user-facing behavior warrant human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c91a5e6. Configure here.}

[juliusmarminge]

Closing as part of the open-PR backlog sweep (wave 1).

Reason: Jul conflicted Files-panel downloads; file viewer/download stack rewritten.
Related: #9143 #9292

Reopen if this is still wanted and you’re willing to rebase onto current main.