Browser pane: downloads fail from iframes/subframes (Gmail, embedded viewers, PDF Download button)

[arzafran]

Tracking upstream cmux manaflow-ai#6754 + manaflow-ai#6756 (same root cause). Confirmed in our fork; needs two product decisions before implementing.

Root cause (our code): Sources/Panels/BrowserPanel.swift:6257-6259 (and BrowserPopupWindowController.swift:588-591) blanket-.allow every isForMainFrame==false navigation before checking Content-Disposition, so any download started inside an iframe never fires. (The scripted-download machinery the upstream issues mention does not exist in our fork.)

Decision 1 — iframe download trigger: (A, recommended) only on explicit Content-Disposition: attachment; (B) also on non-inline-renderable MIME (risks force-downloading embedded PDFs/media/ads).

Decision 2 — save location: downloadDidFinish (BrowserPanel.swift:5891-5912) always shows an NSSavePanel. Issue wants Safari-style auto-save to ~/Downloads. (A) keep panel; (B) auto-save; (C) setting.

Implement as one PR across the two browser files once decided. No typing-latency hot paths.

Upstream: manaflow-ai#6754, manaflow-ai#6756

[arzafran]

Decision (from owner):

• Iframe download trigger → Option A: download subframe responses only on explicit Content-Disposition: attachment. The non-renderable-MIME → download rule stays main-frame-only (avoids force-downloading inline-renderable iframe content like embedded PDFs/media).
• Testing: via the existing tests_v2/test_browser_*.py harness (drives the in-app WKWebView through the programa browser socket commands). Playwright is not applicable — it automates external browsers, not the app's embedded WKWebView.

Still open: save-location (keep NSSavePanel / auto-save to ~/Downloads / make it a setting).

[arzafran]

Decision: Build. Spec locked.

• Trigger: download a subframe nav only on explicit Content-Disposition: attachment (stop the blanket .allow of every isForMainFrame == false nav before the CD check). Avoids force-downloading embedded PDFs/media/ads.
• Save location: auto-save to ~/Downloads (Safari-style); remove the unconditional NSSavePanel.
• Files: Sources/Panels/BrowserPanel.swift:6257-6259 (nav) and :5891-5912 (downloadDidFinish); mirror in BrowserPopupWindowController.swift:588-591. One PR across both browser files.

---

Generated by Claude Code