Dogfood SDK downloadBundle/downloadSkill in CLI

[shwetank-dev]

Summary

The CLI currently has manual download logic (fetch URL, convert to buffer, verify SHA256, write to disk) duplicated across 4 files. Once downloadBundle and downloadSkill land in the SDK (packages/sdk-typescript/), we should dogfood them in the CLI to replace this manual logic.

Files to update

packages/cli/src/commands/packages/pull.ts

• Lines 96–102 — manual fetch(downloadInfo.url), arrayBuffer(), writeFileSync()
• Replace with sdk.downloadBundle()

packages/cli/src/commands/packages/run.ts

• Lines 410–422 — local downloadBundle() helper function (fetch + writeFileSync)
• Line 547 — call site: await downloadBundle(downloadInfo.url, tempPath)
• Remove local helper, replace with sdk.downloadBundle()

packages/cli/src/commands/skills/pull.ts

• Lines 59–75 — manual fetch(downloadInfo.url), buffer conversion, SHA256 verification, write to disk
• Replace with sdk.downloadSkill()

packages/cli/src/commands/skills/install.ts

• Lines 82–98 — manual fetch(downloadInfo.url), buffer conversion, SHA256 verification
• Line 111 — writeFileSync(tempPath, buffer)
• Replace with sdk.downloadSkill()

Why

• Dogfooding: We should use our own SDK instead of reimplementing download + verification logic
• DRY: SHA256 verification and download logic is duplicated across all 4 files
• Consistency: Any future improvements to download logic (retries, progress, etc.) will apply everywhere automatically

Blocked by

SDK downloadBundle / downloadSkill implementation (in progress on separate branch).

[shwetank-dev]

Blocked by PR #32

[shwetank-dev]

Additional: Merge getSkillDownload and getSkillVersionDownload

While dogfooding, we should also merge getSkillDownload (latest-only) and getSkillVersionDownload (specific version) into a single method with an optional version parameter — mirroring how getBundleDownload already works.

This is the right time to do it since we'll be updating all the CLI call sites anyway.