fix(install): retry download body stream, verification, and extraction

[fengmk2]

Problem

CI intermittently failed with three different errors that share one root cause: the HTTP retry logic wrapped only the request setup (send().await?.error_for_status()), which returns as soon as the response headers arrive. The body streaming to disk, hash verification, and tar/archive extraction all happened after the retry closure returned, so a truncated or corrupt download surfaced immediately and was never retried.

Flaky tests observed across recent runs:

Test	Crate	Symptom
test_detect_package_manager_with_yarn_config_cjs	vite_install	TarError UnexpectedEof
test_download_success_package_manager_with_sha1_and_sha224	vite_install	HashMismatch
test_execute_node_version	vite_js_runtime (via vite_global_cli)	node download failed

Fix

crates/vite_install/src/request.rs

• download_file: the request and the body stream are now a single retried unit, plus a Content-Length truncation check (bytes written != advertised length → error → re-download).
• download_and_extract_tgz_with_hash: wraps download → verify → extract in a content-integrity retry (is_retryable_extract_error retries only Io/HashMismatch; it deliberately excludes Reqwest — already retried inside download_file — so the caller's 404 → PackageManagerVersionNotFound mapping is preserved). Each attempt resets the target dir.

crates/vite_js_runtime/src/download.rs (node)

• download_file: same network-layer fix — request + body stream as one retried unit with the Content-Length truncation check.

crates/vite_js_runtime/src/runtime.rs (node)

• Wraps download → verify → extract in a content-integrity retry mirroring the install path, so a complete-but-corrupt node archive is re-downloaded instead of aborting. (download_file surfaces an exhausted download as DownloadFailed, which the predicate excludes, so there's no retry multiplication.)

Tests

• Added two deterministic httpmock regression tests proving a corrupt archive and a hash mismatch are retried by the full pipeline (they assert the server receives >1 hit; both failed before the fix with "only attempted 1 time(s)").
• cargo clippy -p vite_install -p vite_js_runtime --all-targets -- -D warnings → clean.
• vite_js_runtime lib → 104 passed (incl. the real test_download_node_integration).
• All three originally-flaky tests pass; the negative test_download_failed_package_manager_with_hash still returns HashMismatch.

Follow-ups (not in this PR)

• Centralize the retry + truncation logic into a shared vite_shared download helper, which would also cover get_bytes/vp upgrade and prevent the next download site from regressing.
• The Content-Length truncation check is a no-op for chunked responses (no Content-Length); the hash/extract retry is the backstop there.

---

Note

Medium Risk
Touches core download/install paths for package managers and Node with layered retries; behavior changes (404 handling preserved) but wrong predicates could over-retry or skip needed retries.

Overview
Fixes intermittent install/CI failures where HTTP retries only covered headers (send + error_for_status), so truncated bodies, hash mismatches, and bad archives failed once with no retry.

Network layer: download_file in vite_install and vite_js_runtime now retries request + body write as one unit and errors when bytes written ≠ advertised Content-Length (Node downloads also reset the progress bar each attempt).

Integrity layer: Package-manager tarballs use a single pipeline retry (download → hash → extract) via download_and_extract_tgz_with_hash_once, with is_retryable_download_error (retries I/O/hash/transient HTTP; not 404). Inner downloads use HttpClient::with_config(0, 0) to avoid nested retries. Node runtime install gets the same pattern with is_retryable_runtime_error after SHASUMS are resolved once.

Adds httpmock tests asserting corrupt archives and hash mismatches trigger more than one download attempt.

^{Reviewed by Cursor Bugbot for commit 0183c8f. Configure here.}

[netlify]

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	cd020be
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a1cddfd6af9670008136686

[fengmk2]

@cursor review

[fengmk2]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 0183c8f. Configure here.}