fix(cli): make extension release downloads failure-atomic

[GautamSharma99]

Summary

Make GitHub-release extension downloads failure-atomic so request, response-stream, and filesystem failures reject cleanly without crashing the CLI or leaving a partial archive at the extraction path.

Previously, downloadFile() piped the HTTP response directly to the final destination and listened only for finish. Errors emitted after headers arrived or by the destination stream had no coordinated handler, allowing unhandled error events, hung installs, and incomplete archives.

Details

• Download into a sibling <destination>.downloading file instead of the final archive path.
• Coordinate the HTTP response and file writer with node:stream/promises.pipeline() so backpressure, stream errors, closure, and teardown are handled together.
• Atomically rename the completed temporary archive to the requested destination only after the pipeline succeeds.
• Remove stale temporary output before a new attempt and incomplete output after request, response, writer, or rename failures.
• Preserve the original transfer error if temporary-file cleanup itself fails, while logging the cleanup failure.
• Keep redirect handling inside the same transfer operation so recursive redirects cannot independently publish or clean up the archive.
• Resolve relative redirects and strip every case variant of the Authorization header before following a cross-origin redirect, including protocol or port changes.
• Destroy redirect and non-200 responses that will not be consumed.
• Preserve the existing redirect limit, request headers, GitHub token handling, and public API.

The tests now use real PassThrough stream behavior and add regressions for:

• request errors before a response is received;
• response errors after a partial transfer;
• destination write errors;
• same-origin credential retention and cross-origin credential stripping;
• bidirectional pipeline teardown;
• partial temporary-file removal; and
• atomic rename only after successful completion.

Related Issues

Fixes #28645

How to Validate

npm test --workspace @google/gemini-cli -- src/config/extensions/github.test.ts
npm run typecheck --workspace @google/gemini-cli
npx eslint packages/cli/src/config/extensions/github.ts packages/cli/src/config/extensions/github.test.ts
npx prettier --check packages/cli/src/config/extensions/github.ts packages/cli/src/config/extensions/github.test.ts
npm run pre-commit

Expected results:

• All 38 extension GitHub tests pass, including stream-failure and redirect-security regressions.
• The CLI package build passes in the test post-step.
• TypeScript, ESLint, Prettier, and staged pre-commit checks pass.
• Successful transfers write only to .downloading until atomic publication.
• Request, response, and writer errors reject and trigger temporary-file cleanup without renaming the archive.

Pre-Merge Checklist

• Documentation is not required; this corrects internal download behavior without changing user-facing configuration.
• Added regression tests for all reported failure sources.
• No breaking changes.
• Validated with npm on macOS.

[github-actions]

📊 PR Size: size/L

• Lines changed: 328
• Additions: +243
• Deletions: -85
• Files changed: 2

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request refactors the extension download process in the CLI to be failure-atomic. By downloading to a temporary file and utilizing the Node.js pipeline utility, the system now guarantees that incomplete or corrupted archives are not left behind if a download fails. The changes improve the reliability of the CLI by ensuring that network or filesystem interruptions result in a clean state, and they include robust regression tests to verify these failure modes.

Highlights

• Atomic File Downloads: Implemented a temporary .downloading file strategy to ensure that extension downloads are atomic, preventing partial archives from remaining on the filesystem upon failure.
• Stream Pipeline Management: Replaced manual pipe handling with node:stream/promises.pipeline to ensure robust backpressure, error propagation, and proper stream teardown.
• Improved Error Handling: Added comprehensive cleanup logic to remove temporary files on request, response, or filesystem errors, while preserving the original error for debugging.
• Regression Testing: Updated test suite with new failure scenarios, including request errors, response stream interruptions, and disk write failures, using mock streams to validate atomic behavior.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request refactors the downloadFile function to use a temporary file path (.downloading) during download, ensuring incomplete files are cleaned up on failure, and updates the stream handling using pipeline. It also adds comprehensive unit tests for various stream and request error scenarios. The review feedback correctly identifies a high-severity security vulnerability where the sensitive GitHub Authorization token is forwarded during HTTP redirects to potentially untrusted domains, and provides a clear remediation to strip the header when redirecting to a different host.