feat: support manifest-based distribution updates

[Tantanz20020918]

Summary

Allow an optional extension provider to select a stable distribution manifest while the CLI owns version checks, verified artifact downloads, and coordinated CLI and Skills updates. Existing package-manager update behavior remains unchanged when no manifest is configured.

Changes

• Add the optional DistributionProvider contract and lifecycle guidance in extension/transport
• Add manifest parsing, artifact download, SHA-256 verification, archive preparation, and rollback-capable installation in internal/distribution
• Integrate manifest targets with the asynchronous update cache and lark-cli update check/install paths
• Report the active distribution through lark-cli doctor and keep Skills state scoped to its source identity

Extension contract boundary

DistributionProvider is an optional capability on the existing process-wide transport provider so a wrapper has one aggregate registration point for outbound-network customization; it does not transfer update execution into the extension.

The provider performs only a fast, local lookup of the configured Manifest URL. It does not fetch or parse the Manifest, add authentication headers, download artifacts, verify checksums, unpack archives, compare versions, install files, or perform rollback. Those behaviors remain owned by lark-cli's internal distribution and self-update code.

The returned Manifest URL and artifact URLs contained in that Manifest are final download addresses. They bypass the extension URL rewriter and request interceptor, while retaining the CLI's built-in proxy and custom-CA handling. The current contract has no arbitrary request-header callback; authenticated sources should use an address that is directly fetchable by the built-in client, such as a signed URL, or rely on the configured network/proxy/CA environment.

Test Plan

• make unit-test passed
• make quality-gate passed
• local HTTP install-and-upgrade E2E passed (1/1 flow)
• manual verification: lark-cli update --check --json followed by lark-cli update --json upgraded a local fixture from 1.0.1 to 1.0.2 and synchronized three Skills directories

Related Issues

N/A

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 5779564d-d0e9-4436-93a3-f3d4bd383b98

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Tantanz20020918]

Confirmed:

1. feat: support URL rewriting and manifest-based updates #2581 has been fully superseded by feat: support URL rewriting extensions #2595 and feat: support manifest-based distribution updates #2596. I have closed it and left a note linking the two focused replacements.
2. DistributionProvider only performs a fast, local lookup of the Manifest URL. It does not supply arbitrary authentication headers and does not fetch or parse the Manifest, download artifacts, verify checksums, unpack archives, compare versions, install files, or perform rollback; all of those remain owned by lark-cli. It is an optional capability on the existing aggregate transport provider to avoid introducing a second process-wide registry or breaking the existing Provider interface. Manifest and artifact URLs are final addresses and bypass extension rewriting/interception while retaining the built-in proxy and custom-CA policy.

I have added this contract boundary to the PR description. Thanks — please continue with the full code and security review.