Remove download dependency to resolve transitive security findings (#373)

[jrothrock]

Summary

Resolves the transitive-dependency vulnerabilities reported in #373 by removing the download package entirely and replacing it with a small, dependency-light downloader.

The core-agent downloader previously used download, which is effectively unmaintained and pulls in a large transitive tree that accounts for all the reported findings:

• decompress — critical (Zip-Slip / arbitrary file write via archive extraction)
• got@8 — high (SSRF via redirect to a UNIX socket)
• http-cache-semantics@3 — high (ReDoS)
• plus tmp@0.2.6 — high (path traversal / symlink write), which was mis-declared as a runtime dependency but is only used by tests

Changes

• New lib/agent-downloaders/fetch-extract.ts — replaces download(url, dir, {extract}) using Node built-ins (https with redirect handling, zlib gunzip) plus tar-stream for extraction. It:
  • preserves archived file modes (the core-agent binary stays executable), and
  • adds path-traversal ("zip slip") protection — refusing any entry that resolves outside the target dir — which the old decompress path did not have. So this fixes the CVE class rather than just swapping libraries.
  • throws a typed HTTPError (with statusCode) on non-2xx responses.
• web.ts — both download(...) call sites now use downloadAndMaybeExtract(...); removed dead imports.
• package.json — dropped download + @types/download; added tar-stream + @types/tar-stream; moved tmp → devDependencies and bumped to 0.2.7.
• Regenerated yarn.lock (drops ~2,300 transitive packages).

Verification

• npm audit --omit=dev → 0 vulnerabilities (was 5). download, decompress, got, http-cache-semantics are gone from the tree.
• tsc build clean, lint clean.
• Downloader e2e suite: 9/9 pass against real S3 releases (ENABLE_BINARY_TESTS=true) — fresh download, cache populate/reuse, custom URL, and 404 handling.
• Direct checks: real download+extract (binary runs, mode 755) and a malicious ../ tar entry correctly rejected.
• End-to-end app run: scout.install() → real download → extract → core-agent daemon launched → live HTTP request instrumented.

Fixes #373

🤖 Generated with Claude Code