From 6059d3e117a9b64bd542608b91b88ffce49ae05e Mon Sep 17 00:00:00 2001
From: Mathieu Tarral <mathieu.tarral@protonmail.com>
Date: Wed, 9 Sep 2026 03:54:15 +0200
Subject: [PATCH 1/2] feat: pass filename to the blob download endpoint

Add ?filename= query parameter to blob download requests to enable
Winbindex fast path for Windows PE file lookups.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NmATMvFbdupfLRq7Ldwabv
---
 src/utils/filesystem.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/utils/filesystem.ts b/src/utils/filesystem.ts
index a32516b..8835579 100644
--- a/src/utils/filesystem.ts
+++ b/src/utils/filesystem.ts
@@ -101,6 +101,7 @@ export async function downloadBlob(hash: string, filename: string): Promise<void
   }
 
   const url = new URL(`/blob/${hash}`, apiUri)
+  url.searchParams.set('filename', filename)
 
   const response = await fetch(url.toString())
 

From 2ef15066367920c36fbe13f1d2e7f28c2072dd31 Mon Sep 17 00:00:00 2001
From: Mathieu Tarral <mathieu.tarral@protonmail.com>
Date: Wed, 9 Sep 2026 04:13:56 +0200
Subject: [PATCH 2/2] fix(filesystem): send the real PE name to the blob
 endpoint

downloadBlob gained a third `saveAs` param (defaults to `filename`). The
decorated call site in FilesystemInspector now passes the plain `row.name` as
`?filename=` (so it can match Winbindex) and the
`getDownloadFilename(...)` decoration only as the save-as name. Previously the
decorated name like `kernel32_Windows-10-2004_abc12345.dll` was sent to the
server, never matched Winbindex, and thrashed its negative cache. `a.download`
still overrides Content-Disposition so the user-visible filename is unchanged.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NmATMvFbdupfLRq7Ldwabv
---
 src/components/FilesystemInspector.vue |  3 +--
 src/utils/filesystem.ts                | 12 ++++++++++--
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/src/components/FilesystemInspector.vue b/src/components/FilesystemInspector.vue
index 739bdb2..4e651c2 100644
--- a/src/components/FilesystemInspector.vue
+++ b/src/components/FilesystemInspector.vue
@@ -340,8 +340,7 @@ const comparisonModeColumns = computed<DataTableColumns<FilesystemDiffEntry>>(()
       const handleDownload = async (hash: string, commitName: string) => {
         downloadingHash.value = hash
         try {
-          const filename = getDownloadFilename(row.name, commitName, hash)
-          await downloadBlob(hash, filename)
+          await downloadBlob(hash, row.name, getDownloadFilename(row.name, commitName, hash))
         } catch (error) {
           console.error('Download failed:', error)
           alert(error instanceof Error ? error.message : 'Download failed')
diff --git a/src/utils/filesystem.ts b/src/utils/filesystem.ts
index 8835579..29a9fa2 100644
--- a/src/utils/filesystem.ts
+++ b/src/utils/filesystem.ts
@@ -93,8 +93,16 @@ export function generateBreadcrumbs(path: string, includeHome = true): Breadcrum
 
 /**
  * Download a blob by hash.
+ *
+ * `filename` is the real PE basename sent as `?filename=` so the API can resolve
+ * the blob on Winbindex. `saveAs` is the (possibly decorated) name shown to the
+ * user; it defaults to `filename` and never reaches the server.
  */
-export async function downloadBlob(hash: string, filename: string): Promise<void> {
+export async function downloadBlob(
+  hash: string,
+  filename: string,
+  saveAs: string = filename
+): Promise<void> {
   const apiUri = import.meta.env.VITE_OSWATCHER_API_URI
   if (!apiUri) {
     throw new Error('VITE_OSWATCHER_API_URI not configured')
@@ -115,7 +123,7 @@ export async function downloadBlob(hash: string, filename: string): Promise<void
 
   const a = document.createElement('a')
   a.href = downloadUrl
-  a.download = filename
+  a.download = saveAs
   document.body.appendChild(a)
   a.click()
   document.body.removeChild(a)