From 82de48abbac8ae50f3c3859a4118a606145fc55a Mon Sep 17 00:00:00 2001
From: Agando <roduccomm@gmail.com>
Date: Wed, 21 Oct 2026 22:34:12 +0200
Subject: fix(newos4): download link uses the user's space; WebDAV share copies
 verified file links; preview fullscreen+share; files->WebDAV upload button
 (v4.6.45)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- download: URL built from _resolveSpaceName() (config url = logged-in user), not the page space
- WebDAV browser 🔗: shares selected FILES only, URL-encoded, HEAD-verified (200) before claiming success;
  folders offer a tar fallback instead of a guaranteed-403 link
- file manager preview: ⛶ fullscreen + 🔗 copy-link toolbar (was none)
- file manager toolbar: ☁ WebDAV publishes selected/current file via webdav-push
- modules/test/test-download-url.js: 4 PASS
- rebuild bundles, bump v4.6.44 -> v4.6.45 (loader + 3 script tags)
---
 main.html                          |  6 +--
 modules/core/core-bundle.js        | 10 +++-
 modules/core/module-fs.js          | 10 +++-
 modules/core/module-loader.js      |  2 +-
 modules/ext/critical-ext-bundle.js | 94 +++++++++++++++++++++++++++++++++++---
 modules/ext/filemgr.js             | 94 +++++++++++++++++++++++++++++++++++---
 modules/ext/webdav.js              | 48 +++++++++++++------
 modules/test/test-download-url.js  | 32 +++++++++++++
 8 files changed, 263 insertions(+), 33 deletions(-)
 create mode 100644 modules/test/test-download-url.js

diff --git a/main.html b/main.html
index b9b4d8c..1ca3751 100644
--- a/main.html
+++ b/main.html
@@ -1349,13 +1349,13 @@
     </script>
 
     <!-- v4.5.63: A2A scratchpad fixes + agent-register arg fix -->
-<script src="modules/core/core-bundle.js?v=v4.6.44"></script>
+<script src="modules/core/core-bundle.js?v=v4.6.45"></script>
 
     <!-- Async dependency-ordered module loader now only initializes terminal and loads optional ext modules -->
-<script src="modules/core/module-loader.js?v=v4.6.44"></script>
+<script src="modules/core/module-loader.js?v=v4.6.45"></script>
 
     <!-- Critical ext bundle loads AFTER webx11 exists so registerModule calls work -->
-<script src="modules/ext/critical-ext-bundle.js?v=v4.6.44"></script>
+<script src="modules/ext/critical-ext-bundle.js?v=v4.6.45"></script>
 
 <script>
 // ═══ ONE TRUE VERSION SOURCE ═══
diff --git a/modules/core/core-bundle.js b/modules/core/core-bundle.js
index ee2e9d0..3f7e352 100644
--- a/modules/core/core-bundle.js
+++ b/modules/core/core-bundle.js
@@ -6716,7 +6716,15 @@ class FileSystemModule {
                             const baseUrl = wdav.config.url.replace(/\/+$/, '');
                             const hostMatch = baseUrl.match(/^(https?:\/\/[^\/]+)/);
                             const host = hostMatch ? hostMatch[1] : 'https://webx11.duckdns.org';
-                            downloadUrl = host + '/spaces/' + wdav._spaceName + '/downloads/' + encodeURIComponent(fname);
+                            // Build the public URL the user can tap.
+                            // The URL must use the space the PUT actually went to
+                            // (config.url = the logged-in user's space). _spaceName is
+                            // derived from the page path (/spaces/newos4/…) and is wrong
+                            // for users downloading into their own space (2026-10-21).
+                            const urlSpace = (typeof wdav._resolveSpaceName === 'function' && wdav._resolveSpaceName()) ||
+                                             (wdav._extractSpaceNameFromUrl && wdav._extractSpaceNameFromUrl(wdav.config.url)) ||
+                                             wdav._spaceName;
+                            downloadUrl = host + '/spaces/' + urlSpace + '/downloads/' + encodeURIComponent(fname);
                             this.terminal.print('Uploaded to: ' + downloadUrl, 'success');
                         } else {
                             this.terminal.print('WebDAV push failed: HTTP ' + resp.status, 'warning');
diff --git a/modules/core/module-fs.js b/modules/core/module-fs.js
index d94feb8..2b525f0 100644
--- a/modules/core/module-fs.js
+++ b/modules/core/module-fs.js
@@ -447,7 +447,15 @@ class FileSystemModule {
                             const baseUrl = wdav.config.url.replace(/\/+$/, '');
                             const hostMatch = baseUrl.match(/^(https?:\/\/[^\/]+)/);
                             const host = hostMatch ? hostMatch[1] : 'https://webx11.duckdns.org';
-                            downloadUrl = host + '/spaces/' + wdav._spaceName + '/downloads/' + encodeURIComponent(fname);
+                            // Build the public URL the user can tap.
+                            // The URL must use the space the PUT actually went to
+                            // (config.url = the logged-in user's space). _spaceName is
+                            // derived from the page path (/spaces/newos4/…) and is wrong
+                            // for users downloading into their own space (2026-10-21).
+                            const urlSpace = (typeof wdav._resolveSpaceName === 'function' && wdav._resolveSpaceName()) ||
+                                             (wdav._extractSpaceNameFromUrl && wdav._extractSpaceNameFromUrl(wdav.config.url)) ||
+                                             wdav._spaceName;
+                            downloadUrl = host + '/spaces/' + urlSpace + '/downloads/' + encodeURIComponent(fname);
                             this.terminal.print('Uploaded to: ' + downloadUrl, 'success');
                         } else {
                             this.terminal.print('WebDAV push failed: HTTP ' + resp.status, 'warning');
diff --git a/modules/core/module-loader.js b/modules/core/module-loader.js
index 7416e02..3aedc0d 100644
--- a/modules/core/module-loader.js
+++ b/modules/core/module-loader.js
@@ -4,7 +4,7 @@
     // Core module bundle loaded synchronously in main.html.
     // This loader only handles version cache-busting, splash, terminal init, and optional ext modules.
 
-    const LATEST_VER = 'v4.6.44';
+    const LATEST_VER = 'v4.6.45';
     const CACHE = '?v=' + LATEST_VER;
     const stored = localStorage.getItem('webx11_cache_ver');
     if (stored !== LATEST_VER) {
diff --git a/modules/ext/critical-ext-bundle.js b/modules/ext/critical-ext-bundle.js
index 8f63081..dc3a858 100644
--- a/modules/ext/critical-ext-bundle.js
+++ b/modules/ext/critical-ext-bundle.js
@@ -1372,6 +1372,16 @@ class FileManagerModule {
         batchBar.appendChild(selModeBtn);
         toolbar.appendChild(batchBar);
 
+        // 2026-10-21: publish a VFS file to the user's WebDAV space was terminal-only.
+        const wdavBtn = document.createElement('button');
+        wdavBtn.textContent = '☁ WebDAV';
+        wdavBtn.title = 'Upload the selected/current file to your WebDAV space and get its public link';
+        wdavBtn.style.cssText = 'background:var(--bg-tertiary);border:1px solid var(--border-color);' +
+            'color:var(--text-color);cursor:pointer;padding:4px 10px;border-radius:4px;' +
+            'font-family:inherit;font-size:0.9em;min-height:32px;touch-action:manipulation;';
+        wdavBtn.onclick = () => this._uploadSelectionToWebdav();
+        toolbar.appendChild(wdavBtn);
+
         overlay.appendChild(toolbar);
 
         // Main area — wraps sidebar + preview in a responsive flex container
@@ -1840,7 +1850,8 @@ class FileManagerModule {
 
         // For raw mode, show raw text regardless of type
         if (this._rawMode && typeof content === 'string') {
-            preview.innerHTML = '<div style="padding:12px"><div style="color:var(--text-muted);font-size:0.85em;margin-bottom:8px">RAW: ' + this._escapeHtml(path) + '</div><pre style="white-space:pre-wrap;font-family:var(--font-primary);font-size:0.9em;margin:0;overflow-x:auto">' + this._escapeHtml(content.substring(0, 10000)) + '</pre></div>';
+            preview.innerHTML = this._previewShell(path, '<div style="padding:12px"><div style="color:var(--text-muted);font-size:0.85em;margin-bottom:8px">RAW: ' + this._escapeHtml(path) + '</div><pre style="white-space:pre-wrap;font-family:var(--font-primary);font-size:0.9em;margin:0;overflow-x:auto">' + this._escapeHtml(content.substring(0, 10000)) + '</pre></div>');
+            this._wirePreviewToolbar(path);
             this._updateStatus('Preview: ' + path);
             return;
         }
@@ -1850,19 +1861,88 @@ class FileManagerModule {
         const textTypes = ['md', 'text', 'json', 'code', 'csv', 'other'];
         if (textTypes.includes(type) && typeof content === 'string' && content.length > 51200) {
             content = content.substring(0, 51200);
-            preview.innerHTML = this._getPreviewHtml(path, content);
-            const truncatedMsg = document.createElement('div');
-            truncatedMsg.style.cssText = 'color:var(--warning-color);padding:8px 12px;border-top:1px solid var(--border-color);font-size:0.85em;';
-            truncatedMsg.textContent = '(truncated — file exceeds 50KB)';
-            preview.appendChild(truncatedMsg);
+            preview.innerHTML = this._previewShell(path,
+                this._getPreviewHtml(path, content) +
+                '<div style="color:var(--warning-color);padding:8px 12px;border-top:1px solid var(--border-color);font-size:0.85em;">(truncated — file exceeds 50KB)</div>');
+            this._wirePreviewToolbar(path);
             this._updateStatus('Preview: ' + path);
             return;
         }
 
-        preview.innerHTML = this._getPreviewHtml(path, content);
+        preview.innerHTML = this._previewShell(path, this._getPreviewHtml(path, content));
+        this._wirePreviewToolbar(path);
         this._updateStatus('Preview: ' + path);
     }
 
+    // 2026-10-21: preview pane had no fullscreen and no share action.
+    _previewShell(path, innerHtml) {
+        return '<div class="fm-preview-toolbar" style="display:flex;gap:6px;justify-content:flex-end;' +
+               'padding:6px 8px;border-bottom:1px solid var(--border-color);flex-shrink:0">' +
+               '<button class="fm-btn-fs" title="Fullscreen preview" aria-label="Fullscreen preview" style="background:var(--bg-tertiary);' +
+               'border:1px solid var(--border-color);color:var(--text-color);padding:2px 8px;border-radius:4px;' +
+               'cursor:pointer;font-size:0.85em;min-height:24px;">⛶</button>' +
+               '<button class="fm-btn-share" title="Copy share link" aria-label="Copy share link" style="background:var(--bg-tertiary);' +
+               'border:1px solid var(--border-color);color:var(--text-color);padding:2px 8px;border-radius:4px;' +
+               'cursor:pointer;font-size:0.85em;min-height:24px;">🔗</button>' +
+               '</div><div class="fm-preview-body" style="flex:1;min-height:0;overflow:auto">' + innerHtml + '</div>';
+    }
+
+    _previewShareUrl(path) {
+        const wdav = this.terminal && this.terminal.moduleManager && this.terminal.moduleManager.modules
+            ? this.terminal.moduleManager.modules.WebDAVModule : null;
+        const space = (wdav && wdav._resolveSpaceName && wdav._resolveSpaceName()) || '';
+        const clean = String(path).replace(/^\/+/, '');
+        return 'https://webx11.duckdns.org/spaces/' + space + '/' +
+            clean.split('/').map(encodeURIComponent).join('/');
+    }
+
+    // 2026-10-21: publish VFS file(s) to WebDAV (was terminal-only: webdav-push)
+    async _uploadSelectionToWebdav() {
+        let targets = this._getSelectedPaths ? this._getSelectedPaths() : [];
+        if (!targets || !targets.length) targets = this._selectedFile ? [this._selectedFile] : [];
+        if (!targets.length) { this._updateStatus('☁ Select a file first'); return; }
+        const wdav = this.terminal && this.terminal.moduleManager && this.terminal.moduleManager.modules
+            ? this.terminal.moduleManager.modules.WebDAVModule : null;
+        if (!wdav) { this._updateStatus('☁ WebDAV module not loaded'); return; }
+        if (!wdav.config || !wdav.config.url) { try { await wdav._autoBootstrap(); } catch (e) {} }
+        if (!wdav.config || !wdav.config.url) { this._updateStatus('☁ WebDAV not configured — run webdav-config'); return; }
+        for (const p of targets) {
+            const clean = String(p).replace(/^\/+/, '');
+            try {
+                await this.terminal.security.checkAndRun('webdav-push ' + clean);
+                const shareUrl = this._previewShareUrl(clean);
+                this._updateStatus('☁ Uploaded ' + clean + ' → ' + shareUrl);
+                if (this.terminal.print) this.terminal.print('☁ WebDAV: ' + shareUrl, 'success');
+            } catch (e) {
+                this._updateStatus('☁ Upload failed: ' + (e && e.message ? e.message : e));
+            }
+        }
+    }
+
+    _wirePreviewToolbar(path) {
+        const pane = document.getElementById('filemgr-preview');
+        if (!pane) return;
+        const fsBtn = pane.querySelector('.fm-btn-fs');
+        const shBtn = pane.querySelector('.fm-btn-share');
+        if (fsBtn) fsBtn.onclick = () => {
+            const body = pane.querySelector('.fm-preview-body') || pane;
+            if (document.fullscreenElement) { document.exitFullscreen(); return; }
+            if (body.requestFullscreen) body.requestFullscreen().catch(() => this._updateStatus('⛶ Fullscreen blocked by this browser'));
+            else if (body.webkitRequestFullscreen) body.webkitRequestFullscreen();
+            else this._updateStatus('⛶ Fullscreen not supported here');
+        };
+        if (shBtn) shBtn.onclick = () => {
+            const url = this._previewShareUrl(path);
+            if (navigator.clipboard && navigator.clipboard.writeText) {
+                navigator.clipboard.writeText(url)
+                    .then(() => this._updateStatus('🔗 Link copied: ' + url))
+                    .catch(() => prompt('Copy share link:', url));
+            } else {
+                prompt('Copy share link:', url);
+            }
+        };
+    }
+
     _renderPreviewError(msg) {
         const preview = document.getElementById('filemgr-preview');
         if (!preview) return;
diff --git a/modules/ext/filemgr.js b/modules/ext/filemgr.js
index e099a34..01d1da9 100644
--- a/modules/ext/filemgr.js
+++ b/modules/ext/filemgr.js
@@ -439,6 +439,16 @@ class FileManagerModule {
         batchBar.appendChild(selModeBtn);
         toolbar.appendChild(batchBar);
 
+        // 2026-10-21: publish a VFS file to the user's WebDAV space was terminal-only.
+        const wdavBtn = document.createElement('button');
+        wdavBtn.textContent = '☁ WebDAV';
+        wdavBtn.title = 'Upload the selected/current file to your WebDAV space and get its public link';
+        wdavBtn.style.cssText = 'background:var(--bg-tertiary);border:1px solid var(--border-color);' +
+            'color:var(--text-color);cursor:pointer;padding:4px 10px;border-radius:4px;' +
+            'font-family:inherit;font-size:0.9em;min-height:32px;touch-action:manipulation;';
+        wdavBtn.onclick = () => this._uploadSelectionToWebdav();
+        toolbar.appendChild(wdavBtn);
+
         overlay.appendChild(toolbar);
 
         // Main area — wraps sidebar + preview in a responsive flex container
@@ -907,7 +917,8 @@ class FileManagerModule {
 
         // For raw mode, show raw text regardless of type
         if (this._rawMode && typeof content === 'string') {
-            preview.innerHTML = '<div style="padding:12px"><div style="color:var(--text-muted);font-size:0.85em;margin-bottom:8px">RAW: ' + this._escapeHtml(path) + '</div><pre style="white-space:pre-wrap;font-family:var(--font-primary);font-size:0.9em;margin:0;overflow-x:auto">' + this._escapeHtml(content.substring(0, 10000)) + '</pre></div>';
+            preview.innerHTML = this._previewShell(path, '<div style="padding:12px"><div style="color:var(--text-muted);font-size:0.85em;margin-bottom:8px">RAW: ' + this._escapeHtml(path) + '</div><pre style="white-space:pre-wrap;font-family:var(--font-primary);font-size:0.9em;margin:0;overflow-x:auto">' + this._escapeHtml(content.substring(0, 10000)) + '</pre></div>');
+            this._wirePreviewToolbar(path);
             this._updateStatus('Preview: ' + path);
             return;
         }
@@ -917,19 +928,88 @@ class FileManagerModule {
         const textTypes = ['md', 'text', 'json', 'code', 'csv', 'other'];
         if (textTypes.includes(type) && typeof content === 'string' && content.length > 51200) {
             content = content.substring(0, 51200);
-            preview.innerHTML = this._getPreviewHtml(path, content);
-            const truncatedMsg = document.createElement('div');
-            truncatedMsg.style.cssText = 'color:var(--warning-color);padding:8px 12px;border-top:1px solid var(--border-color);font-size:0.85em;';
-            truncatedMsg.textContent = '(truncated — file exceeds 50KB)';
-            preview.appendChild(truncatedMsg);
+            preview.innerHTML = this._previewShell(path,
+                this._getPreviewHtml(path, content) +
+                '<div style="color:var(--warning-color);padding:8px 12px;border-top:1px solid var(--border-color);font-size:0.85em;">(truncated — file exceeds 50KB)</div>');
+            this._wirePreviewToolbar(path);
             this._updateStatus('Preview: ' + path);
             return;
         }
 
-        preview.innerHTML = this._getPreviewHtml(path, content);
+        preview.innerHTML = this._previewShell(path, this._getPreviewHtml(path, content));
+        this._wirePreviewToolbar(path);
         this._updateStatus('Preview: ' + path);
     }
 
+    // 2026-10-21: preview pane had no fullscreen and no share action.
+    _previewShell(path, innerHtml) {
+        return '<div class="fm-preview-toolbar" style="display:flex;gap:6px;justify-content:flex-end;' +
+               'padding:6px 8px;border-bottom:1px solid var(--border-color);flex-shrink:0">' +
+               '<button class="fm-btn-fs" title="Fullscreen preview" aria-label="Fullscreen preview" style="background:var(--bg-tertiary);' +
+               'border:1px solid var(--border-color);color:var(--text-color);padding:2px 8px;border-radius:4px;' +
+               'cursor:pointer;font-size:0.85em;min-height:24px;">⛶</button>' +
+               '<button class="fm-btn-share" title="Copy share link" aria-label="Copy share link" style="background:var(--bg-tertiary);' +
+               'border:1px solid var(--border-color);color:var(--text-color);padding:2px 8px;border-radius:4px;' +
+               'cursor:pointer;font-size:0.85em;min-height:24px;">🔗</button>' +
+               '</div><div class="fm-preview-body" style="flex:1;min-height:0;overflow:auto">' + innerHtml + '</div>';
+    }
+
+    _previewShareUrl(path) {
+        const wdav = this.terminal && this.terminal.moduleManager && this.terminal.moduleManager.modules
+            ? this.terminal.moduleManager.modules.WebDAVModule : null;
+        const space = (wdav && wdav._resolveSpaceName && wdav._resolveSpaceName()) || '';
+        const clean = String(path).replace(/^\/+/, '');
+        return 'https://webx11.duckdns.org/spaces/' + space + '/' +
+            clean.split('/').map(encodeURIComponent).join('/');
+    }
+
+    // 2026-10-21: publish VFS file(s) to WebDAV (was terminal-only: webdav-push)
+    async _uploadSelectionToWebdav() {
+        let targets = this._getSelectedPaths ? this._getSelectedPaths() : [];
+        if (!targets || !targets.length) targets = this._selectedFile ? [this._selectedFile] : [];
+        if (!targets.length) { this._updateStatus('☁ Select a file first'); return; }
+        const wdav = this.terminal && this.terminal.moduleManager && this.terminal.moduleManager.modules
+            ? this.terminal.moduleManager.modules.WebDAVModule : null;
+        if (!wdav) { this._updateStatus('☁ WebDAV module not loaded'); return; }
+        if (!wdav.config || !wdav.config.url) { try { await wdav._autoBootstrap(); } catch (e) {} }
+        if (!wdav.config || !wdav.config.url) { this._updateStatus('☁ WebDAV not configured — run webdav-config'); return; }
+        for (const p of targets) {
+            const clean = String(p).replace(/^\/+/, '');
+            try {
+                await this.terminal.security.checkAndRun('webdav-push ' + clean);
+                const shareUrl = this._previewShareUrl(clean);
+                this._updateStatus('☁ Uploaded ' + clean + ' → ' + shareUrl);
+                if (this.terminal.print) this.terminal.print('☁ WebDAV: ' + shareUrl, 'success');
+            } catch (e) {
+                this._updateStatus('☁ Upload failed: ' + (e && e.message ? e.message : e));
+            }
+        }
+    }
+
+    _wirePreviewToolbar(path) {
+        const pane = document.getElementById('filemgr-preview');
+        if (!pane) return;
+        const fsBtn = pane.querySelector('.fm-btn-fs');
+        const shBtn = pane.querySelector('.fm-btn-share');
+        if (fsBtn) fsBtn.onclick = () => {
+            const body = pane.querySelector('.fm-preview-body') || pane;
+            if (document.fullscreenElement) { document.exitFullscreen(); return; }
+            if (body.requestFullscreen) body.requestFullscreen().catch(() => this._updateStatus('⛶ Fullscreen blocked by this browser'));
+            else if (body.webkitRequestFullscreen) body.webkitRequestFullscreen();
+            else this._updateStatus('⛶ Fullscreen not supported here');
+        };
+        if (shBtn) shBtn.onclick = () => {
+            const url = this._previewShareUrl(path);
+            if (navigator.clipboard && navigator.clipboard.writeText) {
+                navigator.clipboard.writeText(url)
+                    .then(() => this._updateStatus('🔗 Link copied: ' + url))
+                    .catch(() => prompt('Copy share link:', url));
+            } else {
+                prompt('Copy share link:', url);
+            }
+        };
+    }
+
     _renderPreviewError(msg) {
         const preview = document.getElementById('filemgr-preview');
         if (!preview) return;
diff --git a/modules/ext/webdav.js b/modules/ext/webdav.js
index 310d6f3..ed312a5 100644
--- a/modules/ext/webdav.js
+++ b/modules/ext/webdav.js
@@ -1722,20 +1722,42 @@ class WebDAVModule {
             if (window.webx11 && window.webx11.inputField) window.webx11.inputField.focus();
         };
 
-        // Share: copy direct folder URL to clipboard
-        document.getElementById('wdav-share').onclick = function() {
-            const spaceName = self._resolveSpaceName();
-            const cleanPath = (path || '/').replace(/\/+$/, '') + '/';
-            const shareUrl = 'https://webx11.duckdns.org/spaces/' + (spaceName || '') + cleanPath;
-            if (navigator.clipboard && navigator.clipboard.writeText) {
-                navigator.clipboard.writeText(shareUrl).then(function() {
-                    self.terminal.print('🔗 Shared URL copied: ' + shareUrl, 'success');
-                }, function() {
-                    self.terminal.print('🔗 Share URL: ' + shareUrl, 'info');
-                });
-            } else {
-                self.terminal.print('🔗 Share URL: ' + shareUrl, 'info');
+        // Share: copy the public URL of the selected FILE(s). Folder listings need the
+        // owner session, so a folder URL is a guaranteed 403 for the recipient (2026-10-21).
+        document.getElementById('wdav-share').onclick = async function() {
+            const space = self._resolveSpaceName() || '';
+            const sel = Object.keys(self._selected || {}).filter(function(n) { return self._selected[n]; });
+            const files = sel.filter(function(n) {
+                const e = (allEntries || []).find(function(x) { return x.name === n; });
+                return e && e.type === 'file';
+            });
+            if (!files.length) {
+                const dirName = String(path || '/').replace(/^\/+/, '').replace(/\/+$/, '');
+                const _mods = self.terminal && self.terminal.moduleManager && self.terminal.moduleManager.modules;
+                const gz = _mods && _mods.CryptoGzipModule;
+                if (gz && dirName) {
+                    self.terminal.print('🔗 Folders cannot be shared directly — archiving ' + dirName + ' …', 'info');
+                    try { await self.terminal.security.checkAndRun('tar -c ' + dirName); } catch (e) {}
+                    self.terminal.print('Now select the resulting .tar and press 🔗 (it is a file).', 'info');
+                } else {
+                    self.terminal.print('🔗 Select one or more FILES to share — folder listings require the owner session and return 403 for everyone else.', 'warning');
+                }
+                return;
             }
+            const dir = String(path || '/').replace(/^\/+/, '').replace(/\/+$/, '');
+            const prefix = 'https://webx11.duckdns.org/spaces/' + space + '/' + (dir ? dir + '/' : '');
+            const urls = files.map(function(n) { return prefix + encodeURIComponent(n); });
+            const verified = [];
+            for (let i = 0; i < urls.length; i++) {
+                let st = null;
+                try { const h = await fetch(urls[i], { method: 'HEAD', credentials: 'omit' }); st = h.status; } catch (e) {}
+                if (st === 200) verified.push(urls[i]);
+                else self.terminal.print('⚠️ Not shareable: ' + urls[i] + ' → HTTP ' + (st === null ? 'no network' : st), 'warning');
+            }
+            if (!verified.length) return;
+            const text = verified.join('\n');
+            try { await navigator.clipboard.writeText(text); } catch (e) { prompt('Copy share link(s):', text); }
+            self.terminal.print('🔗 Copied ' + verified.length + ' verified link(s): ' + verified.join(' , '), 'success');
         };
 
         function renderList() {
diff --git a/modules/test/test-download-url.js b/modules/test/test-download-url.js
new file mode 100644
index 0000000..63cabde
--- /dev/null
+++ b/modules/test/test-download-url.js
@@ -0,0 +1,32 @@
+// node modules/test/test-download-url.js
+// Regression guard for the download/share URL space (2026-10-21).
+// The URL must follow the WebDAV config (the logged-in user's space), NOT the
+// page path — /spaces/newos4/ is the app, not the user.
+const cases = [
+  { page: '/spaces/newos4/', cfg: 'https://webx11.duckdns.org/spaces/agando/', want: 'agando' },
+  { page: '/spaces/newos4/', cfg: 'https://webx11.duckdns.org/spaces/mindtech/', want: 'mindtech' },
+  { page: '/spaces/agando/', cfg: 'https://webx11.duckdns.org/spaces/agando/', want: 'agando' },
+  { page: '/spaces/newos4/', cfg: '', want: 'newos4' }, // no config → fall back to the page space
+];
+
+function detectSpaceName(path) {
+  const parts = path.split('/').filter(Boolean);
+  const i = parts.indexOf('spaces');
+  return (i >= 0 && i + 1 < parts.length) ? parts[i + 1] : '';
+}
+function extractSpaceNameFromUrl(url) {
+  if (!url) return '';
+  const parts = new URL(url).pathname.split('/').filter(Boolean);
+  const i = parts.indexOf('spaces');
+  return (i >= 0 && i + 1 < parts.length) ? parts[i + 1] : '';
+}
+
+let bad = 0;
+for (const c of cases) {
+  const got = extractSpaceNameFromUrl(c.cfg) || detectSpaceName(c.page);
+  const ok = got === c.want;
+  if (!ok) bad++;
+  console.log((ok ? 'PASS' : 'FAIL'), c.page, 'cfg=' + (c.cfg || '(none)'), '→', got, '(want', c.want + ')');
+}
+console.log(bad ? `\n${bad} FAILED` : `\n${cases.length} PASS`);
+process.exit(bad ? 1 : 0);
-- 
cgit v1.2.3