[ZEVIN17]

Summary

downloadSourceFile rejects a 200 response with invalid content headers without cancelling its body, leaving the rejected download stream open. downloadSkillContent already cancels its body on the equivalent path.

Cancel the Source File response body before returning the existing typed error, and ignore cancellation rejections. Normal downloads, request counts, protocol validation and size limits remain unchanged. Regression tests cover every header rejection condition, cancellation failure, absent bodies and valid empty/nonempty downloads.

AI-assisted implementation. An independent static review found no blocking issues.

Tests

• Baseline regression tests: 16 failed, 3 passed; rejected streams were not cancelled.
• Fixed regression tests: 19/19 passed.
• Complete agents-client unit suite: 760/760 passed across 23 files.
• agents-client TypeScript typecheck and git diff --check: passed.
• Credential-free localhost HTTP reproduction: in a 300 ms observation window after rejection, the baseline response stayed open (26 server writes observed); the fixed response closed (0 writes observed). This is a stream-cleanup demonstration, not a performance benchmark.

Go, database, Web/Playwright, the full repository gate and live-provider acceptance were not run.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}