Fix misleading breadcrumb, path traversal error type, show attachment test

Three review fixes:

1. attachments list: download breadcrumb now only shown when at least
   one attachment has a download URL, avoiding misleading hints.

2. writeBodyToFile: path traversal error now returns output.ErrUsage
   for structured JSON/agent output, consistent with files.go.

3. TestShowInjectsFieldScopedAttachments: verifies generic show injects
   content_attachments/description_attachments (not flat "attachments")
   when content has bc-attachment tags.

Author: jeremy

internal/commands/attachments.go

@@ -163,8 +163,9 @@ func runAttachmentsList(cmd *cobra.Command, arg, recordType string) error {
 			Description: "Add comment",
 		})
 	}
-	if len(attachments) > 0 {
-		breadcrumbs = append(breadcrumbs, attachmentBreadcrumb(id, len(attachments)))
+	downloadable := downloadableAttachments(attachments)
+	if len(downloadable) > 0 {
+		breadcrumbs = append(breadcrumbs, attachmentBreadcrumb(id, len(downloadable)))
 	}
 
 	respOpts := []output.ResponseOption{
@@ -755,7 +756,7 @@ func writeBodyToFile(body io.Reader, dir, name string) (outputPath string, writt
 		expectedPrefix += string(filepath.Separator)
 	}
 	if !strings.HasPrefix(absPath, expectedPrefix) {
-		return "", 0, fmt.Errorf("invalid filename: path traversal detected")
+		return "", 0, output.ErrUsage("Invalid filename: path traversal detected")
 	}
 
 	outFile, err := createFile(outputPath)

internal/commands/show_test.go

@@ -675,3 +675,41 @@ func TestAllValidRecordTypesHandledInSwitch(t *testing.T) {
 		})
 	}
 }
+
+// --- Attachment discovery tests ---
+
+func TestShowInjectsFieldScopedAttachments(t *testing.T) {
+	transport := &showTrackingTransport{
+		responder: func(path string) (int, string) {
+			return 200, `{
+				"id": 42,
+				"type": "Message",
+				"title": "Design review",
+				"content": "<p>See <bc-attachment url=\"https://example.com/a.png\" filename=\"a.png\"></bc-attachment></p>",
+				"description": "<p>Also <bc-attachment url=\"https://example.com/b.pdf\" filename=\"b.pdf\"></bc-attachment></p>"
+			}`
+		},
+	}
+	app := showTestApp(t, transport)
+	buf := &bytes.Buffer{}
+	app.Output = output.New(output.Options{Format: output.FormatJSON, Writer: buf})
+
+	cmd := NewShowCmd()
+	cmd.SetArgs([]string{"message", "42"})
+	ctx := appctx.WithApp(context.Background(), app)
+	cmd.SetContext(ctx)
+	cmd.SetOut(&bytes.Buffer{})
+	cmd.SetErr(&bytes.Buffer{})
+
+	err := cmd.Execute()
+	require.NoError(t, err)
+
+	out := buf.String()
+	// Field-scoped keys present
+	assert.Contains(t, out, "content_attachments")
+	assert.Contains(t, out, "description_attachments")
+	// Flat "attachments" key not injected (avoids collision with native API field)
+	assert.NotContains(t, out, `"attachments"`)
+	// Notice mentions download command
+	assert.Contains(t, out, "attachment(s)")
+}