fix(install-source): preserve URL credential validation error (#1762)

* fix(install-source): preserve URL credential validation error

* test(install-source): cover URL credential validation error

Author: cosin2077

src/platforms/__tests__/install-source-download.test.ts

@@ -71,6 +71,7 @@ test('download errors do not disclose URL credentials or query values', async ()
       headers: { authorization: 'private-header' },
       signal: new AbortController().signal,
     }).catch((caught: unknown) => caught);
+    assert.match((error as Error).message, /credentials are not allowed/i);
     const serialized = JSON.stringify(error);
     for (const secret of ['private-user', 'private-pass', 'private-query', 'private-header']) {
       assert.equal(serialized.includes(secret), false, secret);

src/platforms/install-source-download.ts

@@ -179,13 +179,15 @@ function readHeader(
 }
 
 function parseSourceUrl(raw: string): URL {
+  let parsed: URL;
   try {
-    const parsed = new URL(raw);
-    if (parsed.username || parsed.password) {
-      throw new AppError('INVALID_ARGS', 'Source URL credentials are not allowed');
-    }
-    return parsed;
+    parsed = new URL(raw);
   } catch {
     throw new AppError('INVALID_ARGS', 'Invalid source URL');
   }
+
+  if (parsed.username || parsed.password) {
+    throw new AppError('INVALID_ARGS', 'Source URL credentials are not allowed');
+  }
+  return parsed;
 }