[Build] onnxruntime-node install fails: "Failed to download build list. HTTP status code = 302" (script doesn't follow redirects)

Nobody has claimed this yet.

### Describe the issue

onnxruntime-node postinstall script (script/install-utils.js) fails on any environment where the NuGet feed (or the proxy in front of it) returns an HTTP 3xx redirect. The script treats any non-200 status as a hard failure because it uses Node's native https.get(), which does not follow redirects.

This is a regression / gap in the install script, not a network problem on our side: curl -L downloads the same URLs successfully, and the failure is entirely deterministic from the script's redirect handling.
Root cause
script/install-utils.js has two download helpers that never handle 3xx:

async function downloadFile(url, dest) {
return new Promise((resolve, reject) => {
const file = fs.createWriteStream(dest);
https
.get(url, (res) => {
if (res.statusCode !== 200) { // 302 rejected as hard error
file.close();
fs.unlinkSync(dest);
reject(new Error(`Failed to download from ${url}. HTTP status code = ${res.statusCode}`));
return;
}
...
async function downloadJson(url) {
return new Promise((resolve, reject) => {
https
.get(url, (res) => {
const { statusCode } = res;
const contentType = res.headers['content-type'];
if (!statusCode) { ... }
if (statusCode >= 400 && statusCode < 500) { resolve(null); return; }
else if (statusCode !== 200) { // 302 rejected as hard error
reject(new Error(`Failed to download build list. HTTP status code = ${statusCode}`));
return;
}
...
Node's built-in https.get() follows no redirects by default, so any 301/302/307/308 from the feed fails the install. This is especially visible behind HTTP proxies (which commonly rewrite/redirect), but is also reproducible without a proxy against feeds that redirect.

Suggested fix
Follow redirects in both helpers (max ~5 hops, guard against redirect loops), or use fetch() (Node 18+), which follows redirects by default:

async function downloadJson(url) {
const res = await fetch(url, { redirect: 'follow' });
if (!res.ok) {
throw new Error(`Failed to download build list. HTTP status code = ${res.status}`);
}
const contentType = res.headers.get('content-type') || '';
if (!/^application\/json/.test(contentType)) {
throw new Error(`unexpected content type: ${contentType}`);
}
return res.json();
}

async function downloadFile(url, dest) {
const res = await fetch(url, { redirect: 'follow' });
if (!res.ok) {
throw new Error(`Failed to download from ${url}. HTTP status code = ${res.status}`);
}
const buf = Buffer.from(await res.arrayBuffer());
fs.writeFileSync(dest, buf);
}
(Keep the existing https-based approach and add manual Location-header handling if you need to stay on older Node versions.)

### Urgency

_No response_

### Target platform

OS: Linux x64 (also reproducible on macOS arm64) Node.js: v22.23.2 npm: 10.9.8 onnxruntime-node: 1.27.0 (also affected in 1.24.x range)

### Build script

npm install -g gitnexus@latest

### Error / output

npm error command failed
npm error command sh -c node ./script/install
npm error /.../onnxruntime-node/script/install-utils.js:57
npm error reject(new Error(`Failed to download build list. HTTP status code = ${statusCode}`));
npm error Error: Failed to download build list. HTTP status code = 302

### Visual Studio Version

_No response_

### GCC / Compiler Version

_No response_

Start in script/install-utils.js and inspect the downloadFile and downloadJson helpers, then reproduce the install failure with the reported npm command. Update both download paths to handle the stated redirect cases safely while preserving existing error handling, and verify that npm install succeeds when the feed returns HTTP 3xx responses.

Written by the indexing model from the issue text.