[Feature] Download/export assets — save-as in Web & Desktop UI, plus zn CLI / MCP parity

[gtheys]

Context: Self-hosted server vault. Notes embed assets as ![[assets/image.png]]. The server already exposes GET /api/assets/raw?path=... (the web and desktop clients use it internally to render images — apps/web/src/bridge/http-bridge.ts, apps/desktop/src/main/remote/server-client.ts), but as a user I have no way to actually download an asset out of the vault.

What's missing today:

1. Web app UI — no download button in the Assets view, no "save image as…" on images embedded in a note.
2. Desktop app UI — same, including when connected to a remote/self-hosted vault.
3. zn CLI — no zn asset list/get/put commands.
4. MCP server — no asset tools, so agents/scripts have to hand-roll raw curl calls against /api/assets/raw to pull embedded images.

Related papercut: unknown paths outside /api/* return the SPA's index.html with HTTP 200 (e.g. /files/assets/image.png, /assets/image.png). Naive download attempts therefore "succeed" but yield an HTML file. A 404 for non-API asset-ish paths (or at least correct content-type handling) would prevent silent failures.

Requested surfaces:

• Web UI: download action in Assets view + context menu on embedded images
• Desktop UI: same, for local and remote vaults
• CLI: zn asset list / zn asset get <path> / (optionally zn asset put)
• MCP: list_assets / get_asset tools mirroring the HTTP API

Keyboard-first note: the download actions should be reachable without a mouse (e.g. a key on the Assets view rows / command-palette entry), in line with the project's keyboard-first principle.

[gtheys]

Implementation proposal

I dug through the source to see what each surface would need. Good news: the server API already does the heavy lifting — GET /api/assets/raw?path=... (apps/server/internal/httpserver/server.go:192, handler at :1018) is authenticated, serves correct MIME types, and both clients already use it internally to render images (apps/web/src/bridge/http-bridge.ts, apps/desktop/src/main/remote/server-client.ts:435). Most of this is surfacing what's already there.

1. Server: ?download=1 on rawAsset (~5 lines — unlocks the web UI)

In rawAsset, when r.URL.Query().Get("download") == "1":

w.Header().Set("Content-Disposition",
    fmt.Sprintf("attachment; filename*=UTF-8''%s", url.PathEscape(filepath.Base(abs))))

Now a plain <a href> download works in the web app with zero blob plumbing.

2. Server: fix the SPA false-200 (the papercut from the issue body)

In serveStatic (server.go:1232), the fallback serves index.html for any unknown path — including /files/assets/image.png, with HTTP 200 and text/html. Naive download attempts therefore "succeed" but yield an HTML file. Suggested guard before the fallback:

if err != nil {
    if ext := strings.ToLower(filepath.Ext(urlPath)); ext != "" && ext != ".html" {
        http.NotFound(w, r) // don't serve index.html for /files/foo.png
        return
    }
    s.serveIndexHTML(w)
    return
}

Keeps SPA routing intact, kills the silent failure mode.

3. Web UI: AssetsView context menu + keyboard (~20 lines, one file)

packages/app-core/src/components/AssetsView.tsx already has a context menu (menuItems(), line ~190: Copy embed / Rename… / Move to trash). Add:

{ label: 'Download…', onSelect: () => downloadAsset(asset) }

where downloadAsset builds resolveVaultAssetUrl(...) + '&download=1' and clicks a hidden <a download>. Pure renderer code, no bridge-contract change. Keyboard-first: handle d in the row's existing onKeyDown (next to the Enter/Space handler, line ~271).

4. Desktop UI: bridge method + save dialog (~40 lines)

• packages/bridge-contract/src/bridge.ts: add downloadAsset(relPath: string): Promise<void> (next to renameAsset/deleteAsset, line ~325)
• apps/desktop/src/main/index.ts: IPC handler → dialog.showSaveDialog (default filename = basename; patterns already exist at :2025 and :3156) → local vault: fs.copyFile; remote vault: requireRemoteWorkspaceClient().fetchAssetResponse(rel) then pipe response.body to a write stream — both halves already exist in the file
• Preload passthrough, then the same Download… item in AssetsView (shared app-core, so web and desktop get it together)

5. CLI: zn asset list / zn asset get <path> [-o out] (~80 lines, new file)

New apps/desktop/src/cli/commands/assets.ts, registered in cli/index.ts, documented in help.ts (same shape as commands/notes.ts). Add readAsset(rel: string): Promise<Uint8Array> to the VaultBackend interface (cli/backend.ts:116 — it already has listAssets()): local = read under root, remote = GET /api/assets/raw in cli/remote/client.ts. Without -o, stream to stdout so zn asset get assets/img.png > x.png works.

6. MCP: get_asset tool (~25 lines)

apps/desktop/src/mcp/server.ts already has list_assets (line 199) — add a sibling get_asset (path in, base64 + mimeType + size out, mirroring read_note's "pass the path verbatim" discipline), with a size cap (~10 MB) that points agents at the CLI for bigger files.

Tests

Per CONTRIBUTING: Go test for the download=1 header + SPA-404 in asset_ops_test.go; vitest for the AssetsView menu item; a cli/commands/base.test.ts-style test for zn asset get (local + mocked remote).

Suggested split

• PR 1 (small, self-contained): items 1–3 — server param + SPA guard + web UI
• PR 2: items 4–6 — desktop dialog, CLI, MCP parity

Happy to take a run at PR 1 if the approach looks right.