[rupayon123]

Summary

Exercise the Hugging Face request layer offline and correct four failures found at that boundary:

• Reject SafeTensors headers over the same 100 MiB limit as the local reader before issuing another download request.
• Reject HTTP 200 responses that ignore a requested nonzero byte range, rather than interpreting bytes from the wrong offset.
• Reject invalid negative seek/read positions and nonpositive stream chunk sizes without corrupting the cursor.
• Percent-encode file paths so spaces, fragments, query delimiters and literal percent signs remain part of the filename. Preserve directory separators.

Motivation

Addresses #28 with the original request-boundary coverage plus regressions for each reproduced behavior. Existing coverage includes authentication/Range headers, timeouts, bounded reads, error translation, single-file metadata, large-header continuation, 416 fallback, lazy shards and buffered reads/seeks.

Type of change

• Bug fixes
• Offline test coverage

Validation

Python 3.11, PYTHONPATH=src pytest -q: 84 passed. New test files pass ruff; git diff --check passes. Each new regression group failed before its fix. Network and token lookup are isolated in tests; no live model weights or credentials are used. The full-response test intentionally rejects unsupported range behavior rather than claiming transparent server compatibility.

Conventional commits include How to test instructions. Remote CI is verified separately on the new head.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: pipe1os/modelinfo-cli/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: f8e0d88e-f7e0-4a13-bc4b-cd17a2916ae0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 56 complexity · 0 duplication

Metric	Results
Complexity	56
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[rupayon123]

Follow-up: 1473e9a876fe898bd09eb19e96423a6d33102190 copies caller-provided headers before adding authentication. Previously, reusing the dictionary after the token was removed still sent the old bearer token. The new offline regression reproduced that behavior before the fix; all 85 local tests pass. The exact head now also passes all nine OS/Python CI jobs and Codacy. This exercises request construction with stubbed transport, not live gated-model access.