fix(#2557): download openshell binaries during watch mode

[fullsend-ai-coder]

Summary

• Adds the tsx ./scripts/download.ts step to the openshell extension's watch script so that OpenShell binaries are downloaded for the host platform before starting the vite watcher
• This ensures that first-time developers who run pnpm install → pnpm watch have the binaries available in extensions/openshell/assets/<platform>-<arch>/, which is where the extension looks for them in development mode (per PR fix(openshell): use extension assets folder for bundled binaries in dev mode #2486)
• The download is idempotent — it checks a version marker file and skips if the correct version is already present

Test plan

• Run pnpm install in a clean checkout, then pnpm watch
• Verify that extensions/openshell/assets/<platform>-<arch>/ is populated with openshell binaries
• Verify that the openshell extension discovers the bundled binaries in dev mode
• Run pnpm watch a second time and verify the download step is skipped (idempotent)

---

Closes #2557

Post-script verification

• Branch is not main/master (agent/2557-openshell-watch-download)
• Secret scan passed (gitleaks — 06fa8ae0fd6b2fc5a9999b866b3bd703adaf10b8..HEAD)
• PR body secret scan passed (gitleaks — no-git)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[MarsKubeX]

For watch command that developers run repeatedly during iteration, downloading both openshell and image-builder every invocation adds unnecessary startup latency. The download is idempotent (it checks a version marker), but it still resolves the GitHub release for both components each time.

Consider whether the watch script should scope the download to just the openshell component:

"watch": "tsx ./scripts/download.ts --component openshell && vite build --watch"

[fbricon]

The openshell binary should be considered as a dependency so it makes more sense to install it as part of the "pnpm install" process, as @benoitf mentioned in #2557 (comment)

[benoitf]

/fs-code

[deboer-tim]

/fs-fix

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 1:05 PM UTC · Completed 1:11 PM UTC
Commit: 9592166 · View workflow run →

[fullsend-ai-coder]

🔧 Fix agent — iteration 1 (human-triggered)

Scoped the watch script download to --component openshell only, addressing the review feedback about unnecessary startup latency from downloading both components.

Fixed (1):

1. watch script downloads both openshell and image-builder, adding unnecessary latency (extensions/openshell/package.json): Added --component openshell flag to the watch script's download step so it only downloads the openshell binary, skipping the image-builder download. This matches the pattern used by the dedicated download script and avoids an extra GitHub release resolution on every watch invocation.

Tests: passed

_{Updated by fullsend fix agent}

[benoitf]

add it as a post-install step, do not use --component

[benoitf]

/fs-fix

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 1:18 PM UTC · Completed 1:25 PM UTC
Commit: 3bd0c6c · View workflow run →

[fullsend-ai-coder]

🔧 Fix agent — iteration 2 (human-triggered)

Addressed both review findings from benoitf: moved openshell binary download from the watch script to a postinstall hook in package.json, and removed the --component flag so all components are downloaded during pnpm install.

Fixed (2):

1. move download to postinstall step instead of watch script (extensions/openshell/package.json): Moved the binary download from the watch script to a postinstall hook so openshell binaries are fetched during pnpm install, treating them as a project dependency rather than a dev-time watch concern.
2. do not use --component flag (extensions/openshell/package.json): Removed the --component openshell flag from the download invocation per reviewer request. The postinstall script now runs tsx ./scripts/download.ts without --component, downloading all components (openshell and image-builder).

Tests: passed

_{Updated by fullsend fix agent}