[Bug]: GitHub source bundles are corrupted and fail to extract with authentication

[gblanc-1a]

Description

When using GitHub source type with authentication (both automated gh authentication and personal access token), downloaded bundles are corrupted and cannot be extracted. The bundle names in the list only show the tag name instead of the expected <collection-name>-<tag> format.

Steps to Reproduce

1. Configure a private GitHub repository source in Prompt Registry
2. Authenticate using either automated gh authentication or personal access token in extension settings
3. Synchronize bundles from the GitHub source
4. Attempt to install a bundle from the list

Expected Behavior

• Bundle names should display as <collection-name>-<tag> format
• Downloaded zip files should be valid and extractable
• Installation should complete successfully

Actual Behavior

• Bundle names only show the tag name
• Downloaded bundles are corrupted and cannot be unzipped
• Installation fails with ADM-ZIP error

Error Logs

[2025-11-14T14:11:32.331Z] ERROR: Failed to install bundle
  Error: Failed to extract bundle: ADM-ZIP: Invalid or unsupported zip format. No END header found
  Stack: Error: Failed to extract bundle: ADM-ZIP: Invalid or unsupported zip format. No END header found

Operating System

macOS

VS Code Version

1.106.2

Extension Version

0.0.6

Registry Source Type

GitHub

Additional Context

• Using a private GitHub repository that requires authentication
• Tested with both automated gh authentication and personal access token - same issue with both methods
• Manually downloading the same zip file from GitHub using the same authentication method works correctly and unzips properly
• This suggests the extension is corrupting the file during download or the download URL/headers may be incorrect

[wherka-ama]

Hi @gblanc-1a ,
I belive we should be ok with this one. v0.0.7 should address this problem.

I'm waiting for your feedback before closing it though.

[gblanc-1a]

Hello I confirm this issue has been adressed with #12 the issue was the overall authentication mechanism in place that if the initial token provided did not have the proper rights then it was cached and always reused.

Then instead of the zip file downloaded was actually the html of the authentication page.