sima-cli 2.1.18__tar.gz → 2.1.19__tar.gz

{sima_cli-2.1.18/sima_cli.egg-info → sima_cli-2.1.19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sima-cli
-Version: 2.1.18
+Version: 2.1.19
 Summary: CLI tool for SiMa Developer Portal to download models, firmware, and apps.
 Home-page: https://community.sima.ai/
 Author: SiMa.ai
@@ -27,7 +27,8 @@ Requires-Dist: rich==14.0.0
 Requires-Dist: InquirerPy==0.3.4
 Requires-Dist: tftpy==0.8.6
 Requires-Dist: psutil==7.0.0
-Requires-Dist: huggingface-hub<1.0,>=0.34.0
+Requires-Dist: huggingface-hub<3.0,>=2.2.0; python_version >= "3.10"
+Requires-Dist: huggingface-hub<2.0,>=0.34.0; python_version < "3.10"
 Requires-Dist: tabulate==0.9.0
 Dynamic: author
 Dynamic: license-file
@@ -148,6 +149,20 @@ sima-cli --internal login
 SIMA_CLI_INTERNAL=1 sima-cli install -v 2.1.2 tools/model-compiler/amd64
 ```
 
+Full-system SWU updates prefer RAM-backed `/tmp` when available memory can
+hold both the bundle and its extraction, plus a reserve of at least 512 MiB
+or 10% of total RAM (whichever is larger). Otherwise they stage in `/data`,
+with NVMe as a further fallback if `/data` lacks space. RAM staging is temporary;
+interrupted updates retained there do not survive a reboot.
+
+Public-mirror downloads, `models download`, and `neat artifacts` split files
+of at least 64 MiB into four byte ranges when supported by the server. Models
+and Neat artifacts share a limit of four active download connections across
+files and ranges, including single-connection fallbacks. Ranges must match the
+expected size and an object validator or the expected SHA-256 before the file is published. Models retain signed-URL refresh and
+cancellation handling. Existing public-mirror partial downloads continue
+sequentially; servers without range support use a single connection.
+
 ## Common Workflows
 
 Set up SDK containers:
@@ -157,6 +172,14 @@ sima-cli sdk setup
 sima-cli sdk neat
 ```
 
+When pairing with `sdk setup --devkit`, a new DevKit host key is automatically
+recorded in the SDK user's `~/.ssh/known_hosts`, including during unattended
+setup or after SDK container recreation. Subsequent pairing preserves saved
+keys and rejects a changed key at the same address and SSH port. After a device
+reimage or key rotation, verify the replacement fingerprint before explicitly
+updating that entry. For environments requiring verified trust before the first
+connection, provision verified host keys in the SDK user's `known_hosts`.
+
 Install Model Compiler from package metadata:
 
 ```bash
@@ -238,3 +261,13 @@ For command-specific prerequisites, see the generated [command reference](docs/s
 ## Support
 
 For issues and feature requests, use the sima-cli GitHub repository or contact the SiMa.ai development team.
+
+### Remote browser certificate help
+
+SDK setup stages a verified public mkcert CA certificate alongside the SDK HTTPS
+certificate. SDK images with browser certificate help can offer that file for
+download on the sign-in page, with instructions for the browser computer.
+Only the public certificate is staged; the mkcert private key stays on the host.
+If the issuing CA cannot be verified, including a plain self-signed fallback,
+no CA download is published. Re-running setup refreshes the staged file even
+when the existing HTTPS certificate does not need to be reissued.

{sima_cli-2.1.18 → sima_cli-2.1.19}/README.md

@@ -113,6 +113,20 @@ sima-cli --internal login
 SIMA_CLI_INTERNAL=1 sima-cli install -v 2.1.2 tools/model-compiler/amd64
 ```
 
+Full-system SWU updates prefer RAM-backed `/tmp` when available memory can
+hold both the bundle and its extraction, plus a reserve of at least 512 MiB
+or 10% of total RAM (whichever is larger). Otherwise they stage in `/data`,
+with NVMe as a further fallback if `/data` lacks space. RAM staging is temporary;
+interrupted updates retained there do not survive a reboot.
+
+Public-mirror downloads, `models download`, and `neat artifacts` split files
+of at least 64 MiB into four byte ranges when supported by the server. Models
+and Neat artifacts share a limit of four active download connections across
+files and ranges, including single-connection fallbacks. Ranges must match the
+expected size and an object validator or the expected SHA-256 before the file is published. Models retain signed-URL refresh and
+cancellation handling. Existing public-mirror partial downloads continue
+sequentially; servers without range support use a single connection.
+
 ## Common Workflows
 
 Set up SDK containers:
@@ -122,6 +136,14 @@ sima-cli sdk setup
 sima-cli sdk neat
 ```
 
+When pairing with `sdk setup --devkit`, a new DevKit host key is automatically
+recorded in the SDK user's `~/.ssh/known_hosts`, including during unattended
+setup or after SDK container recreation. Subsequent pairing preserves saved
+keys and rejects a changed key at the same address and SSH port. After a device
+reimage or key rotation, verify the replacement fingerprint before explicitly
+updating that entry. For environments requiring verified trust before the first
+connection, provision verified host keys in the SDK user's `known_hosts`.
+
 Install Model Compiler from package metadata:
 
 ```bash
@@ -203,3 +225,13 @@ For command-specific prerequisites, see the generated [command reference](docs/s
 ## Support
 
 For issues and feature requests, use the sima-cli GitHub repository or contact the SiMa.ai development team.
+
+### Remote browser certificate help
+
+SDK setup stages a verified public mkcert CA certificate alongside the SDK HTTPS
+certificate. SDK images with browser certificate help can offer that file for
+download on the sign-in page, with instructions for the browser computer.
+Only the public certificate is staged; the mkcert private key stays on the host.
+If the issuing CA cannot be verified, including a plain self-signed fallback,
+no CA download is published. Re-running setup refreshes the staged file even
+when the existing HTTPS certificate does not need to be reissued.

{sima_cli-2.1.18 → sima_cli-2.1.19}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "sima-cli"
-version = "2.1.18"
+version = "2.1.19"
 description = "CLI tool for SiMa Developer Portal to download models, firmware, and apps."
 readme = "README.md"
 requires-python = ">=3.8"
@@ -33,7 +33,8 @@ dependencies = [
     "InquirerPy==0.3.4",
     "tftpy==0.8.6",
     "psutil==7.0.0",
-    "huggingface-hub>=0.34.0,<1.0",
+    "huggingface-hub>=2.2.0,<3.0; python_version >= '3.10'",
+    "huggingface-hub>=0.34.0,<2.0; python_version < '3.10'",
     "tabulate==0.9.0"
 ]
 

{sima_cli-2.1.18 → sima_cli-2.1.19}/requirements.txt

@@ -8,5 +8,6 @@ rich==14.0.0
 InquirerPy==0.3.4
 tftpy==0.8.6
 psutil==7.0.0
-huggingface-hub>=0.34.0,<1.0
+huggingface-hub>=2.2.0,<3.0; python_version >= "3.10"
+huggingface-hub>=0.34.0,<2.0; python_version < "3.10"
 tabulate==0.9.0

{sima_cli-2.1.18 → sima_cli-2.1.19}/setup.py

@@ -23,7 +23,8 @@ setup(
         "InquirerPy>=0.3.4,<0.4",
         "tftpy>=0.8.6,<0.9",
         "psutil>=7.0.0,<8.0",
-        "huggingface-hub>=0.34.0,<1.0",
+        "huggingface-hub>=2.2.0,<3.0; python_version >= '3.10'",
+        "huggingface-hub>=0.34.0,<2.0; python_version < '3.10'",
         "rich>=13.7,<14.0"
     ],
     entry_points={

{sima_cli-2.1.18 → sima_cli-2.1.19}/sima_cli/__version__.py

@@ -1,2 +1,2 @@
 # sima_cli/__version__.py
-__version__ = "2.1.18"
+__version__ = "2.1.19"

{sima_cli-2.1.18 → sima_cli-2.1.19}/sima_cli/cli.py

@@ -14,7 +14,7 @@ from sima_cli.update.swu import handle_update
 from sima_cli.model_zoo.model import list_models, download_model, describe_model
 from sima_cli.app_zoo.app import list_apps, download_app, describe_app
 from sima_cli.utils.config_loader import internal_resource_exists
-from sima_cli.mla.meminfo import monitor_simaai_mem_chart
+from sima_cli.mla.meminfo import MemoryTelemetryError, monitor_simaai_mem_chart
 from sima_cli.__version__ import __version__ 
 from sima_cli.utils.config import CONFIG_PATH
 from sima_cli.install.optiview import install_optiview
@@ -42,6 +42,7 @@ from sima_cli.upgrade.selfupdate import register_selfupdate_command
 from sima_cli.playbooks import register_playbook_commands
 from sima_cli.vulcan import register_vulcan_commands
 from sima_cli.models import register_models_commands
+from sima_cli.peripherals import register_peripherals_commands
 from sima_cli.cloudex import register_cloudex_commands
 from sima_cli.vulcan.commands import (
     ENV_METAVAR,
@@ -105,6 +106,13 @@ def _rerun_current_command() -> None:
     os.execvpe(sys.executable, cmd, env)
 
 
+# Command groups whose stdout is a machine-readable document: root diagnostics go to stderr for them.
+QUIET_STDOUT_SUBCOMMANDS = ("models", "peripherals")
+# Command groups that only read the DevKit they run on: no PyPI update check and no Artifactory
+# gate before them, so they work offline and never prompt or exit early.
+LOCAL_ONLY_SUBCOMMANDS = ("peripherals",)
+
+
 def _initialize_main_context(ctx, internal, yes):
     _configure_stdio_errors()
     auto_accept_update = yes or _update_auto_confirm_requested(sys.argv)
@@ -112,7 +120,8 @@ def _initialize_main_context(ctx, internal, yes):
     if auto_accept_update:
         os.environ["SIMA_CLI_AUTO_ACCEPT_UPDATE"] = "1"
     try:
-        if check_for_update('sima-cli') and _should_rerun_after_update(sys.argv):
+        if (ctx.invoked_subcommand not in LOCAL_ONLY_SUBCOMMANDS
+                and check_for_update('sima-cli') and _should_rerun_after_update(sys.argv)):
             _rerun_current_command()
     finally:
         if auto_accept_update:
@@ -128,14 +137,15 @@ def _initialize_main_context(ctx, internal, yes):
     if not internal:
         internal = os.getenv("SIMA_CLI_INTERNAL", "0") in ("1", "true", "yes")
 
-    defer_artifactory_access = ctx.invoked_subcommand == "update" or ctx.meta.get("daily_netboot", False)
+    local_only = ctx.invoked_subcommand in LOCAL_ONLY_SUBCOMMANDS
+    defer_artifactory_access = local_only or ctx.invoked_subcommand == "update" or ctx.meta.get("daily_netboot", False)
     if internal and not internal_resource_exists() and not defer_artifactory_access:
         click.echo("❌ You have specified -i or --internal argument to access internal resources, but you do not have an internal resource map configured.")
         click.echo("Refer to the confluence page to find out how to configure internal resource map.")
         exit(0)
 
     internal_reachable = True
-    if internal:
+    if internal and not local_only:
         internal_reachable = check_artifactory_reachability()
 
     if internal and not internal_reachable and not defer_artifactory_access and not _allows_external_prerelease_fallback(sys.argv):
@@ -170,7 +180,7 @@ class InspectionAwareGroup(click.Group):
             _command_name_from_argv(['sima-cli'] + options) == 'bootimg'
             and any(arg in ('--netboot', '-n', '--autoflash', '-a') for arg in options)
         )
-        if _command_name_from_argv(['sima-cli'] + options) == 'update' and '--inspect' in options:
+        if _command_name_from_argv(['sima-cli'] + options) == 'update' and any(arg in ('--inspect', '--swap') for arg in options):
             ctx.meta['update_inspect'] = True
         return super().parse_args(ctx, args)
 
@@ -198,11 +208,11 @@ def main(ctx, internal, yes):
         ctx.ensure_object(dict)
         ctx.obj.update(internal=internal, yes=yes)
         return
-    # Model Registry JSON must remain parseable on stdout. Route root-level
-    # update and environment diagnostics to stderr for this command group.
+    # Model Registry and peripherals JSON must remain parseable on stdout. Route root-level
+    # update and environment diagnostics to stderr for these command groups.
     output_context = (
         redirect_stdout(sys.stderr)
-        if ctx.invoked_subcommand == "models"
+        if ctx.invoked_subcommand in QUIET_STDOUT_SUBCOMMANDS
         else nullcontext()
     )
     with output_context:
@@ -216,6 +226,7 @@ register_sdk_commands(main)
 register_playbook_commands(main)
 register_vulcan_commands(main)
 register_models_commands(main)
+register_peripherals_commands(main)
 register_cloudex_commands(main)
 
 
@@ -352,14 +363,15 @@ def download(ctx, url, dest):
     "--dryrun",
     is_flag=True,
     default=False,
-    help="For eLxr updates, validate the update path and show the command without installing."
+    help="For eLxr, preview an update or slot swap without installing, switching slots, or rebooting."
 )
 @click.option("--inspect", "inspect_state", is_flag=True, help="Show eLxr 3.0+ A/B slots and overlay customizations without updating (local or --ip).")
+@click.option("--swap", is_flag=True, help="Select the available inactive eLxr 3.0+ slot for next boot; use --reboot to restart now.")
 @click.option("--verbose", is_flag=True, help="Show detailed overlay file categories during eLxr 3.0+ inspection or update.")
 @click.option("--signing-cert", metavar="URL_OR_FILE", help="SWUpdate PEM verification certificate: HTTP(S) URL or local file. Defaults to the certificate for the selected channel when configured (eLxr 3.0+).")
-@click.option("--reboot", is_flag=True, help="Reboot after successful eLxr 3.0+ installation; verify remote boot health.")
+@click.option("--reboot", is_flag=True, help="Reboot after successful eLxr 3.0+ installation or slot selection; verify remote boot health.")
 @click.pass_context
-def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force, troot_only, dryrun, inspect_state, verbose, reboot, signing_cert):
+def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force, troot_only, dryrun, inspect_state, verbose, reboot, signing_cert, swap):
     """
     Update a SiMa DevKit, remote device, or Linux PCIe host.
 
@@ -370,6 +382,15 @@ def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force,
 
     eLxr 3.0+ uses signed full-system SWU bundles. Use --inspect for A/B
     state, --ip for remote updates, and --reboot to reboot after installation.
+
+    Use --swap to select the valid inactive slot without downloading an update.
+    The current and target versions are shown before confirmation; --yes skips
+    confirmation. Reboot separately to apply, or add --reboot to restart now.
+    Shared data and overlay customizations persist and can override files in
+    the selected version. Blank, invalid, pending, and unknown states are refused.
+
+    Examples: sima-cli update --swap; sima-cli update --ip 192.168.6.5 --swap --reboot
+
     The verification certificate is downloaded for the selected channel when configured; use
     --signing-cert URL_OR_FILE for an image signed with your own certificate.
     Developer-portal version lookup for 3.0 is not available yet.
@@ -479,6 +500,7 @@ def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force,
         dryrun
         or troot_only
         or inspect_state
+        or swap
         or verbose
         or reboot
         or force
@@ -496,6 +518,8 @@ def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force,
         return
 
     is_elxr = is_devkit_running_elxr()
+    if swap and (inspect_state or version_or_url or force or troot_only or signing_cert is not None or flavor != "auto"):
+        raise click.UsageError("--swap cannot be combined with --inspect or installation options.")
     if inspect_state and (version_or_url or dryrun or force or troot_only or reboot or signing_cert is not None or flavor != 'auto'):
         raise click.UsageError("--inspect cannot be combined with installation options.")
     try:
@@ -503,7 +527,7 @@ def update(ctx, version_or_url, version_option, ip, yes, passwd, flavor, force,
                          internal=ctx.obj.get("internal", False),
                          auto_confirm=yes or ctx.obj.get("yes", False), dryrun=dryrun,
                          signing_cert=signing_cert, reboot=reboot, inspect=inspect_state, force=force,
-                         troot_only=troot_only, flavor=flavor, local_elxr=is_elxr, verbose=verbose):
+                         troot_only=troot_only, flavor=flavor, local_elxr=is_elxr, verbose=verbose, swap=swap):
             return
     except (click.ClickException, click.Abort):
         raise
@@ -632,8 +656,10 @@ def mla(ctx):
 @click.pass_context
 def show_mla_memory_usage(ctx):
     """Show MLA Memory usage overtime."""
-    monitor_simaai_mem_chart()
-    pass
+    try:
+        monitor_simaai_mem_chart()
+    except MemoryTelemetryError as exc:
+        raise click.ClickException(str(exc)) from exc
 
 
 # ----------------------

{sima_cli-2.1.18 → sima_cli-2.1.19}/sima_cli/cloudex/client.py

@@ -554,20 +554,14 @@ def _reconcile_existing_connection(profile, store, progress):
 
 def connect(profile, store, progress, attempts=3, transport="auto"):
     """Create a session and return its durable local record."""
-    try:
-        forwarder = find_forwarder()
-    except CloudExError:
-        # Import lazily: the installer reuses this module's privilege and error
-        # handling, while ordinary CloudEx commands should remain quick to load.
-        from .installer import DEFAULT_BRANCH, install_forwarder
+    from .installer import ensure_forwarder
 
-        progress.update("CloudEx forwarder is missing; installing from {}".format(DEFAULT_BRANCH))
-        forwarder = install_forwarder(DEFAULT_BRANCH, progress=progress)["path"]
     authorize_admin()
     api = CloudExAPI.from_profile(profile)
     existing = _reconcile_existing_connection(profile, store, progress)
     if existing:
         return existing
+    forwarder = ensure_forwarder(progress=progress)
     choices = (["p2p"] * attempts + ["routed"] if transport == "auto"
                else ["routed"] if transport == "turn" else ["p2p"] * attempts)
     last_error = None

{sima_cli-2.1.18 → sima_cli-2.1.19}/sima_cli/cloudex/installer.py

@@ -1,6 +1,7 @@
 """Install the native CloudEx forwarder from Kerrigan's Vulcan artifacts."""
 
 import hashlib
+import os
 import platform
 import re
 import subprocess
@@ -99,7 +100,30 @@ def _download_resource(client, base_url, resource, expected_sha256, destination)
     return path
 
 
-def install_forwarder(branch=DEFAULT_BRANCH, progress=None, client=None):
+def ensure_forwarder(progress=None):
+    """Resolve the current published binary before starting a new tunnel."""
+    try:
+        installed = find_forwarder()
+    except CloudExError:
+        installed = None
+    else:
+        if os.environ.get("SIMA_CLOUDEX_FORWARDER"):
+            # Preserve an existing controlled binary, but allow the normal
+            # installer to bootstrap a missing controlled installation.
+            return installed
+    return install_forwarder(
+        DEFAULT_BRANCH, progress=progress, current_path=installed
+    )["path"]
+
+
+def _matches_binary(path, checksum):
+    try:
+        return hashlib.sha256(Path(path).read_bytes()).hexdigest() == checksum.lower()
+    except OSError:
+        return False
+
+
+def install_forwarder(branch=DEFAULT_BRANCH, progress=None, client=None, current_path=None):
     """Install or update the forwarder and return artifact/install details."""
     branch = _validate_branch(branch)
     variant = _platform_variant()
@@ -119,6 +143,12 @@ def install_forwarder(branch=DEFAULT_BRANCH, progress=None, client=None):
     metadata, resources, script_resource = _checked_metadata(
         client, result.metadata_url, variant
     )
+    expected_sha256 = metadata["resources-checksum"][resources[0]]
+    if current_path is not None and _matches_binary(current_path, expected_sha256):
+        if progress:
+            progress.update("CloudEx forwarder is up to date")
+        return {"path": current_path, "branch": branch,
+                "version": metadata["version"], "artifact": result.resolved_spec}
     base_url = result.metadata_url.rsplit("/", 1)[0]
     with tempfile.TemporaryDirectory(prefix="sima-cloudex-forwarder-") as temporary:
         root = Path(temporary)
@@ -156,6 +186,8 @@ def install_forwarder(branch=DEFAULT_BRANCH, progress=None, client=None):
             raise CloudExError("CloudEx forwarder installation failed: {}".format(detail[:1024]))
 
     installed = find_forwarder()
+    if current_path is not None and not _matches_binary(installed, expected_sha256):
+        raise CloudExError("CloudEx forwarder update did not replace the active binary; check PATH")
     return {
         "path": installed,
         "branch": branch,

{sima_cli-2.1.18 → sima_cli-2.1.19}/sima_cli/download/downloader.py

@@ -1,4 +1,10 @@
 import os
+import json
+import hashlib
+import re
+from pathlib import Path
+from sima_cli.utils.streaming import DOWNLOAD_CHUNK_SIZE, publish_partial
+from sima_cli.download.parallel import PARALLEL_MIN_SIZE, download_parallel
 import requests
 from urllib.parse import urlparse
 from tqdm import tqdm
@@ -74,10 +80,11 @@ def download_file_from_url(url: str, dest_folder: str = ".", internal: bool = Fa
     os.makedirs(dest_folder, exist_ok=True)
     dest_path = os.path.join(dest_folder, file_name)
 
-    resume_header = {}
-    headers = {}
-    mode = 'wb'
+    partial = Path(dest_path + ".part")
+    receipt = Path(dest_path + ".part.json")
+    headers = {"Accept-Encoding": "identity"}
     existing_size = 0
+    session = None
 
     try:
         if internal:
@@ -102,48 +109,98 @@ def download_file_from_url(url: str, dest_folder: str = ".", internal: bool = Fa
             request_fn = session.get
             head_fn = session.head            
 
-        # HEAD request to get total file size
-        head = head_fn(url, headers=headers, timeout=10)
-        head.raise_for_status()
-        total_size = int(head.headers.get('content-length', 0))
-
-        # Check for existing file
-        if os.path.exists(dest_path):
-            existing_size = os.path.getsize(dest_path)
-
-            if existing_size == total_size:
+        # Only resume a partial when a strong validator identifies its bytes.
+        head = head_fn(url, headers=headers, timeout=10, allow_redirects=True)
+        try:
+            head.raise_for_status()
+            raw_size = head.headers.get('content-length')
+            total_size = int(raw_size) if raw_size is not None else None
+            etag = head.headers.get('ETag', '')
+            accepts_ranges = head.headers.get('Accept-Ranges', '').lower() == 'bytes'
+        finally:
+            head.close()
+        if etag.startswith('W/'):
+            etag = ''
+        identity = {"url_sha256": hashlib.sha256(url.encode()).hexdigest(), "etag": etag}
+        if os.path.exists(dest_path) and total_size is not None:
+            if os.path.getsize(dest_path) == total_size:
                 print(f"✔  File already exists and is complete: {file_name}")
                 return dest_path
-            elif existing_size < total_size:
-                resume_header['Range'] = f'bytes={existing_size}-'
-                mode = 'ab'
-                headers['Range'] = resume_header['Range']
-            else:
-                existing_size = 0
-                mode = 'wb'
+        if partial.exists() and etag:
+            try:
+                if json.loads(receipt.read_text()) == identity:
+                    existing_size = partial.stat().st_size
+            except (OSError, ValueError):
+                pass
+        if total_size is not None and existing_size >= total_size:
+            existing_size = 0
+        # Keep existing contiguous partials resumable. Parallelism is limited
+        # to the public mirror; authenticated/custom sessions retain their path.
+        if (not existing_size and parsed_url.scheme == 'https'
+                and parsed_url.hostname == 'artifacts.neat.sima.ai'
+                and not internal and total_size is not None
+                and total_size >= PARALLEL_MIN_SIZE and etag and accepts_ranges):
+            if download_parallel(url, dest_path, total_size, etag):
+                partial.unlink(missing_ok=True)
+                receipt.unlink(missing_ok=True)
+                return dest_path
+        if existing_size:
+            headers['Range'] = f'bytes={existing_size}-'
+            headers['If-Range'] = etag
 
-        # Begin download with appropriate handler
         with request_fn(url, stream=True, headers=headers, timeout=30) as r:
             r.raise_for_status()
-
-            content_length = int(r.headers.get('content-length', 0))
-            final_total = existing_size + content_length
-
-            with open(dest_path, mode) as f, tqdm(
-                desc=f"⬇️  Downloading {file_name}",
-                total=final_total,
-                initial=existing_size,
-                unit='B',
-                unit_scale=True,
-                unit_divisor=1024
+            if r.headers.get('Content-Encoding', 'identity').lower() != 'identity':
+                raise ValueError("Server ignored identity content encoding")
+            raw_length = r.headers.get('content-length')
+            content_length = int(raw_length) if raw_length is not None else None
+            if r.status_code == 206:
+                match = re.fullmatch(r'bytes (\d+)-(\d+)/(\d+)', r.headers.get('Content-Range', ''))
+                if not existing_size or not match:
+                    raise ValueError("Invalid partial download response")
+                start, end, size = map(int, match.groups())
+                if (start != existing_size or end != size - 1 or end < start
+                        or (content_length is not None and content_length != end - start + 1)
+                        or (total_size is not None and size != total_size)
+                        or (r.headers.get('ETag') and r.headers['ETag'] != etag)):
+                    raise ValueError("Inconsistent partial download response")
+                final_total = size
+            elif r.status_code == 200:
+                # Range ignored, or If-Range detected a changed object: restart.
+                existing_size = 0
+                final_total = content_length if content_length is not None else total_size
+            else:
+                raise ValueError(f"Unexpected download status: {r.status_code}")
+            response_etag = r.headers.get('ETag', '')
+            if existing_size:
+                response_etag = etag
+            identity['etag'] = response_etag if not response_etag.startswith('W/') else ''
+            # Truncate before updating the receipt so old bytes cannot acquire a new validator.
+            with partial.open('ab' if existing_size else 'wb') as f, tqdm(
+                desc=f"⬇️  Downloading {file_name}", total=final_total,
+                initial=existing_size, unit='B', unit_scale=True, unit_divisor=1024
             ) as bar:
-                for chunk in r.iter_content(chunk_size=8192):
+                receipt.write_text(json.dumps(identity), encoding='utf-8')
+                size = existing_size
+                for chunk in r.iter_content(chunk_size=DOWNLOAD_CHUNK_SIZE):
                     if chunk:
                         f.write(chunk)
+                        size += len(chunk)
                         bar.update(len(chunk))
+                        if final_total is not None and size > final_total:
+                            raise ValueError("Download exceeds expected size")
+                if final_total is not None and size != final_total:
+                    raise ValueError("Download size mismatch")
+                f.flush()
+                os.fsync(f.fileno())
+            publish_partial(partial, dest_path)
+            receipt.unlink(missing_ok=True)
 
     except Exception as e:
         raise RuntimeError(f"Download failed: {e}")
+    finally:
+        if session is not None:
+            session.close()
     
 
     return dest_path