Support installing extensions from archive files and URLs

[kkhomej33-netizen]

Qwen Code extensions can already be installed from git repositories, local directories, GitHub releases, npm packages, and marketplace sources. It would also be useful to install an extension directly from a supported archive.

Requested behavior:

• qwen extensions install /path/to/extension.zip installs a local zip archive.
• qwen extensions install /path/to/extension.tar.gz installs a local tar.gz archive.
• qwen extensions install https://example.com/extension.zip installs a remote zip archive.
• qwen extensions install https://example.com/extension.tar.gz installs a remote tar.gz archive.
• Archive installs should use the same extension validation and conversion path as other install sources.
• Remote archive installs should be updatable by replaying the stored install metadata.

The archive should contain a complete extension at its root, or a single top-level directory containing the extension.

[qwen-code-ci-bot]

Triage

• Type: Bug — unclear error messages when installing extensions from invalid GitHub release archives
• Labels: type/bug, scope/extensions, category/cli, priority/P2
• Status: Confirmed via source inspection; community PR welcome

Root cause (in packages/core/src/extension/github.ts):

• extractFile() delegates to tar / extract-zip — corrupt archives produce raw library errors with no mention of expected formats (.zip / .tar.gz)
• Post-extraction config validation only triggers when entries.length === 2; archives without qwen-extension.json that don't match this pattern silently pass, and loadExtensionConfig() later throws a generic "Configuration file not found" error
• installExtension() catches downloadFromGitHubRelease failure and falls back to cloneFromGit(), which masks the original error with a misleading git clone failure

Fix direction:

1. Wrap tar.x() / extract() in try-catch with a message: "Archive must be a valid .zip or .tar.gz file"
2. After extraction, explicitly validate that qwen-extension.json exists at the expected location; throw a clear error if missing
3. Consider re-throwing archive-specific errors from downloadFromGitHubRelease instead of letting the fallback to git clone swallow them

---

Stage 2: Source Analysis

Confidence: Confirmed — code path traced end-to-end.

Affected code paths:

• packages/core/src/extension/github.ts → extractFile() (line ~469): no try-catch around tar.x() or extract(); raw errors bubble up
• packages/core/src/extension/github.ts → downloadFromGitHubRelease() (line ~335): post-extraction entries.length === 2 check is the only path that validates config presence; archives extracting to flat structure or >2 entries bypass this entirely
• packages/core/src/extension/extensionManager.ts → installExtension() (line ~903): catch (_error) { await cloneFromGit(...) } silently swallows all downloadFromGitHubRelease errors including corrupt-archive failures, producing misleading git clone errors
• packages/core/src/extension/extensionManager.ts → loadExtensionConfig() (line ~807): throws Configuration file not found at <path> — technically correct but not actionable in the archive-install context

User-visible symptoms:

Scenario	Actual error	Expected error
Corrupt .tar.gz	Raw tar error (e.g. "Unexpected end of data") or misleading git clone error	"Archive must be a valid .zip or .tar.gz file"
Archive missing qwen-extension.json	"Configuration file not found at /tmp/..." or misleading git clone error	"Archive does not contain qwen-extension.json; not a compatible extension"

No clear reproduction steps provided (no exact commands, no error output). Fix is straightforward — the three gaps above each need ~5 lines of code.

中文说明

• 类型: Bug — 从 GitHub Release 安装扩展时，无效归档文件的错误信息不够清晰
• 标签: type/bug, scope/extensions, category/cli, priority/P2
• 状态: 已通过源码分析确认；欢迎社区 PR

根因（packages/core/src/extension/github.ts）：

• extractFile() 直接调用 tar / extract-zip，损坏的归档文件会产生原始库错误，未提示期望的格式（.zip / .tar.gz）
• 解压后的配置验证仅在 entries.length === 2 时触发；不含 qwen-extension.json 且不匹配此模式的归档文件会静默通过，之后 loadExtensionConfig() 抛出通用的"Configuration file not found"错误
• installExtension() 捕获 downloadFromGitHubRelease 失败后回退到 cloneFromGit()，将原始错误掩盖为误导性的 git clone 失败

修复方向：

1. 在 tar.x() / extract() 外包裹 try-catch，提示"归档文件必须是有效的 .zip 或 .tar.gz 文件"
2. 解压后显式验证 qwen-extension.json 是否存在，缺失时抛出明确错误
3. 考虑从 downloadFromGitHubRelease 重新抛出归档相关错误，避免被 git clone 回退吞掉

用户可见症状：

场景	实际错误	期望错误
损坏的 .tar.gz	原始 tar 错误（如"Unexpected end of data"）或误导性的 git clone 错误	"归档文件必须是有效的 .zip 或 .tar.gz 文件"
归档缺少 qwen-extension.json	"Configuration file not found at /tmp/..." 或误导性的 git clone 错误	"归档文件不包含 qwen-extension.json；不是兼容的扩展"

未提供具体复现步骤（无确切命令、无错误输出）。修复较为直接——上述三个问题各需约 5 行代码。

--- Qwen Code