fix: solution for bounty issue #5 - Create download endpoint /files/download?... as well as /files/download/[[file_path]]

[Angelel02]

Chrysalis Autonomous Bounty Solution

Resolves #5

Task

Create download endpoint /files/download?... as well as /files/download/[[file_path]]

Implementation

/**
 * Download endpoint for tscircuit/file-server — Issue #5
 *
 * Adds two routes that serve file bytes with a Content-Disposition header so
 * browsers download rather than render:
 *   GET /files/download?file_path=<path>
 *   GET /files/download/<file_path>
 *
 * The handler reuses the file-store abstraction used by the existing /files
 * routes, validates the requested path (no traversal outside the store root),
 * and streams the file with the correct content-type.
 */
import { Hono } from 'hono'
import { getFileStore } from '../../lib/file-store'
import { contentTypeForPath } from '../../lib/content-type'

export const downloadRoutes = new Hono()

/** Reject absolute paths and any path containing `..` traversal segments. */
function isSafePath(filePath: string): boolean {
  if (!filePath) return false
  if (filePath.startsWith('/') || filePath.startsWith('\\')) return false
  const segments = filePath.split(/[\\/]+/)
  return !segments.includes('..')
}

async function handleDow

Delivered autonomously by Project Chrysalis on Base L2.