From 7df744b68477191ec99dd634f4aa02f0f3ef5d55 Mon Sep 17 00:00:00 2001
From: bo0tzz <git@bo0tzz.me>
Date: Tue, 20 Oct 2026 15:34:55 +0200
Subject: [PATCH] fix(cli): only act on files that were sent in the bulk upload
 check (#32564)

(cherry picked from commit 9e20805e21c72b95f8c23f4985c8a20b4c3da12a)
---
 packages/cli/src/commands/asset.spec.ts | 33 +++++++++++++++++++++++++
 packages/cli/src/commands/asset.ts      |  6 +++++
 2 files changed, 39 insertions(+)

diff --git a/packages/cli/src/commands/asset.spec.ts b/packages/cli/src/commands/asset.spec.ts
index a105d09d4..e27d3fdc7 100644
--- a/packages/cli/src/commands/asset.spec.ts
+++ b/packages/cli/src/commands/asset.spec.ts
@@ -200,6 +200,39 @@ describe('checkForDuplicates', () => {
     });
   });
 
+  it('ignores accepted files that were not part of the request', async () => {
+    vi.mocked(checkBulkUpload).mockResolvedValue({
+      results: [
+        { action: AssetUploadAction.Accept, id: testFilePath },
+        { action: AssetUploadAction.Accept, id: '/etc/passwd' },
+      ],
+    });
+
+    await expect(checkForDuplicates([testFilePath], { concurrency: 1 })).resolves.toEqual({
+      duplicates: [],
+      newFiles: [testFilePath],
+    });
+  });
+
+  it('ignores rejected files that were not part of the request', async () => {
+    vi.mocked(checkBulkUpload).mockResolvedValue({
+      results: [
+        { action: AssetUploadAction.Accept, id: testFilePath },
+        {
+          action: AssetUploadAction.Reject,
+          id: '/etc/passwd',
+          assetId: 'fc5621b1-86f6-44a1-9905-403e607df9f5',
+          reason: AssetRejectReason.Duplicate,
+        },
+      ],
+    });
+
+    await expect(checkForDuplicates([testFilePath], { concurrency: 1 })).resolves.toEqual({
+      duplicates: [],
+      newFiles: [testFilePath],
+    });
+  });
+
   it('returns results when check duplicates retry is successful', async () => {
     let mocked = vi.mocked(checkBulkUpload);
     for (let i = 1; i < retry; i++) {
diff --git a/packages/cli/src/commands/asset.ts b/packages/cli/src/commands/asset.ts
index ac6f5eb99..ebf35ec12 100644
--- a/packages/cli/src/commands/asset.ts
+++ b/packages/cli/src/commands/asset.ts
@@ -232,8 +232,14 @@ export const checkForDuplicates = async (files: string[], { concurrency, skipHas
       const response = await checkBulkUpload({ assetBulkUploadCheckDto: { assets } });
 
       const results = response.results as AssetBulkUploadCheckResults;
+      const requested = new Set(assets.map(({ id }) => id));
 
       for (const { id: filepath, assetId, action } of results) {
+        if (!requested.has(filepath)) {
+          console.warn(`Ignoring unexpected file in bulk upload check response: ${filepath}`);
+          continue;
+        }
+
         if (action === AssetUploadAction.Accept) {
           newFiles.push(filepath);
         } else {