[vedanth-jadhav]

Parallel source downloads validate the first response's range but trust later HTTP 206 parts based only on body length. A cache/proxy returning a different same-sized range is written at the requested offset and reported as a successful download, corrupting inputs used by Loom imports and direct video conversion. Oversized parts are also written past their declared range before the final length check rejects them.

Validate each subsequent part's Content-Range start, end and total against the requested range and initial object size before reading it. Cancel rejected bodies. Check each streamed chunk against the remaining expected bytes before writing; cancel the reader when reading/writing fails. Existing full-stream/capped-range fallback, byte-for-byte assembly, If-Match requests and abort/drain handling remain in the same pipeline.

Validation on Linux x86_64 / Bun 1.4.4:

• 17 download tests pass, including real loopback HTTP reassembly and seven new regression cases. The initial six additions all fail against unchanged production source: five incorrect/missing range headers were accepted, and an oversized response extended its file to 1,048,577 bytes despite declaring 1,048,576.
• Covers wrong start, end and total, absent/unknown-total metadata, refusing writes beyond the declared size, cancellation of an unread rejected body, plus existing plain/capped fallbacks, short bodies, source changes and cancellation. The oversized response may leave a valid partial prefix in its temporary file; it cannot cross the declared boundary.
• Scoped strict TypeScript with noUncheckedIndexedAccess, Biome and git diff --check pass. Eleven existing resource-accounting tests also pass.

Reproduce: cd apps/media-server && bun test src/__tests__/lib/parallel-download.test.ts. Tests use local HTTP and injected streams, with no external media storage. Malformed later 206 responses now deliberately fail rather than being silently assembled; ordinary valid ranges remain byte-identical. No performance claim or new dependencies. Checked current main/open PRs; #3000 changes remote-URL access policy, while this change validates the bytes' placement.

Confidence Score: 5/5

The PR appears safe to merge; the follow-up addresses the previous coverage suggestion.

Summary

The PR checks each ranged response before accepting its bytes and stops oversized bodies before they cross the declared boundary.

• Parallel downloads reject parts that do not match their requested ranges.

_{Reviews (2) · Last reviewed commit: "test(media-server): cover cumulative str..." · Reviewed by Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
cap-status	Skipped		Oct 26, 2026 11:53am UTC

[vedanth-jadhav]

@greptile review

Please review current head 9c25dad. Added the requested multi-chunk boundary regression and verified it fails if accounting is changed to inspect only the current chunk. All 18 download tests pass; source code is unchanged by this follow-up.