@neta-art/cohub-cli 3.6.0 → 3.6.1

package/dist/work-download.d.ts

@@ -6,7 +6,8 @@ type DownloadResult = {
     output: string;
     files: number;
     bytes: number;
-    verified: true;
+    verified: boolean;
+    unverifiedFiles: number;
 };
 export declare function downloadWork(detail: WorkGetResponse, outputOption?: string, fetcher?: typeof fetch): Promise<DownloadResult>;
 export {};

package/dist/work-download.js

@@ -5,6 +5,7 @@ import { basename, dirname, join, posix, resolve } from "node:path";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
 const MANIFEST_MAX_BYTES = 4 * 1024 * 1024;
+const MAX_CONTENT_FILE_BYTES = 1024 * 1024 * 1024;
 const DOWNLOAD_CONCURRENCY = 4;
 function safeRelativePath(value, label) {
     if (!value || value.includes("\\") || value.includes("\0") || posix.isAbsolute(value)) {
@@ -110,22 +111,18 @@ async function downloadFile(url, output, expected, fetcher) {
         throw new Error(`Failed to download ${expected.outputPath} (${response.status})`);
     await mkdir(dirname(output), { recursive: true });
     let sizeBytes = 0;
-    const hash = createHash("sha256");
     const verifier = new Transform({
         transform(chunk, _encoding, callback) {
             sizeBytes += chunk.byteLength;
-            if (sizeBytes > expected.sizeBytes) {
-                callback(new Error(`Downloaded file verification failed: ${expected.outputPath}`));
+            if (sizeBytes > MAX_CONTENT_FILE_BYTES) {
+                callback(new Error(`Downloaded file is too large: ${expected.outputPath}`));
                 return;
             }
-            hash.update(chunk);
             callback(null, chunk);
         },
     });
     await pipeline(Readable.fromWeb(response.body), verifier, createWriteStream(output, { flags: "wx" }));
-    if (sizeBytes !== expected.sizeBytes || hash.digest("hex") !== expected.sha256) {
-        throw new Error(`Downloaded file verification failed: ${expected.outputPath}`);
-    }
+    return sizeBytes;
 }
 function outputExistsError(output) {
     return new Error(`Output already exists: ${output}`);
@@ -181,6 +178,7 @@ async function installDirectoryNoReplace(stage, output) {
     }
 }
 async function downloadFiles(input) {
+    const downloadedBytes = new Array(input.files.length);
     let next = 0;
     let failed = false;
     let failure;
@@ -191,7 +189,7 @@ async function downloadFiles(input) {
             if (!file)
                 continue;
             try {
-                await downloadFile(artifactUrl(input.contentUrl, file.artifactPath), join(input.stage, ...file.outputPath.split("/")), file, input.fetcher);
+                downloadedBytes[index] = await downloadFile(artifactUrl(input.contentUrl, file.artifactPath), join(input.stage, ...file.outputPath.split("/")), file, input.fetcher);
             }
             catch (cause) {
                 if (!failed)
@@ -203,6 +201,7 @@ async function downloadFiles(input) {
     await Promise.all(workers);
     if (failed)
         throw failure;
+    return downloadedBytes.reduce((sum, size) => sum + size, 0);
 }
 export async function downloadWork(detail, outputOption, fetcher = fetch) {
     const { work, content } = detail;
@@ -228,7 +227,7 @@ export async function downloadWork(detail, outputOption, fetcher = fetch) {
     const stage = await mkdtemp(join(dirname(output), `.${basename(output)}.cohub-download-`));
     try {
         const files = hasDirectoryOutput ? manifest.files : [entry];
-        await downloadFiles({ files, contentUrl: content.url, stage, fetcher });
+        const downloadedBytes = await downloadFiles({ files, contentUrl: content.url, stage, fetcher });
         if (hasDirectoryOutput) {
             await installDirectoryNoReplace(stage, output);
         }
@@ -243,8 +242,9 @@ export async function downloadWork(detail, outputOption, fetcher = fetch) {
             kind: hasDirectoryOutput ? "directory" : "file",
             output,
             files: files.length,
-            bytes: files.reduce((sum, file) => sum + file.sizeBytes, 0),
-            verified: true,
+            bytes: downloadedBytes,
+            verified: false,
+            unverifiedFiles: files.length,
         };
     }
     catch (cause) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neta-art/cohub-cli",
-  "version": "3.6.0",
+  "version": "3.6.1",
   "description": "CLI for Cohub — spaces, sessions, and agent collaboration.",
   "type": "module",
   "license": "Apache-2.0",