[XiaoSeS]

Summary

• Preserve the configured registry base path for application-relative /api/... download URLs.
• Retain absolute and already-prefixed URL behavior, authentication headers, and error mapping.
• Add URL and real CLI subprocess install/sync regressions; isolate the oversized-package test from the host home.

Validation

• CLI suite: 765 passed, 0 failed; lint, typecheck, and build passed.
• Independent exact-diff review: no blocking findings.
• Seven focused acceptance cases passed, including real S3-compatible downloads, original bytes, independent fingerprints, clean/change detection, and revoked-token failures without successful installation state.
• Exact-head local Server/Web image and authentication smoke passed; the unchanged scanner image was reused.
• CLI CI passed on Linux, macOS, and Windows. Server tests and Web Node 22/24 checks passed.
• Exact-head real-service E2E run: 179 passed, 3 skipped. It was dispatched manually because CLI-only paths do not trigger the E2E workflow automatically. Skipped tests are not counted as passing.

Scope

No server API change, package version bump, tag, or package publication. CLI releases remain independent; this source change does not update previously published CLI packages.