laster 0.0.1

agent/app/core/downloader.py

@@ -33,6 +33,7 @@ class Downloader:
         self.repository.add_log(self.task_id, "info", f"Downloading {url}")
         with httpx.stream("GET", url, follow_redirects=True, timeout=120) as response:
             response.raise_for_status()
+            self._validate_response(url, response)
             with destination.open("wb") as handle:
                 for chunk in response.iter_bytes():
                     handle.write(chunk)
@@ -40,3 +41,13 @@ class Downloader:
         self.repository.add_log(self.task_id, "info", f"Downloaded to {destination}")
         return destination
 
+    def _validate_response(self, requested_url: str, response: httpx.Response) -> None:
+        final_url = str(response.url)
+        validate_url_host(final_url, settings.allowed_download_hosts)
+
+        content_type = response.headers.get("content-type", "").split(";", 1)[0].strip().lower()
+        if content_type in {"text/html", "text/plain"}:
+            raise ValueError(
+                "download did not return a package file "
+                f"(requested {requested_url}, final {final_url}, content-type {content_type or 'unknown'})"
+            )