[lelia]

Manifest lists can produce repeated multipart field names when paths are repeated, normalized, or stripped against different base paths. Uploads now fail locally with a clear error instead of sending a request the API rejects.

Root Cause

Lazy manifest preparation and eager manifest uploads duplicated key calculation without checking whether two source paths resolved to the same key. Full scans also accepted prebuilt multipart entries with repeated field names.

Fix

Share key calculation and validate all upload keys before reading file contents or sending requests. Use the installed multipart encoder to compare escaped field names and raise ValueError with the duplicate key and both source paths. Preserve valid upload order and contents, normalize base paths once per upload, and bump the patch version to 3.6.3.

Validation

• Unit suite: 245 passed, 1 skipped with both urllib3 2.8.0 and 1.26.20.
• Regression coverage includes repeated paths, collisions across base paths, Windows separator normalization, eager and lazy uploads, prepared full-scan entries, iterators and mapping inputs, omitted parts, byte keys, multipart escaping collisions, legacy encoders, and valid uploads.
• Source and wheel builds, Twine validation, and isolated wheel import passed.

Public Changelog

Reject duplicate multipart upload keys before sending manifest uploads or full scans, with an error naming the colliding key and source paths.

Fixes CE-449

[cursor]

PR Summary

Medium Risk
Changes shared upload path/key logic used by manifest and full-scan flows; mistakes could block valid uploads or miss collisions, but behavior is heavily tested and fails fast with clear errors.

Overview
Manifest and full-scan uploads now reject duplicate multipart field names locally before reading files or calling the API. Shared helpers in Utils compute upload keys (calculate_upload_key / prepare_upload_keys) and validate_upload_keys detects collisions using the same wire-name escaping as the installed multipart encoder, raising ValueError with the duplicate key and both source paths.

Lazy manifest loading, eager manifest uploads, and full-scan post (including caller-prepared multipart entries) all run this validation. Eager full-scan mode no longer passes raw files through unchanged—it normalizes keys from mappings/lists/iterators without consuming one-shot iterables before requests encodes them. Duplicate logic was removed from UploadManifests._calculate_key_name in favor of the shared utilities.

Version is bumped to 3.6.3 with changelog and a broad unit test suite for path normalization, encoder edge cases, and both lazy and prepared upload shapes.

^{Reviewed by Cursor Bugbot for commit e95bb8b. Configure here.}

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e95bb8b. Configure here.}