[MadaBurns]

Summary

setup (and so update.js and /quartermaster:update-toolshed) looked up the latest claude-code-proxy release with an anonymous GitHub API call. Anonymous calls share 60 an hour per IP address, so a machine running several agents fails setup with a bare GitHub API returned 403, even when a working gh login is available.

 setup()
-  fetchUrl(api.github.com/.../releases/latest)              anonymous
+  fetchLatestRelease(REPO, { fetchUrl, log })
+    githubToken: GH_TOKEN → GITHUB_TOKEN → `gh auth token --hostname github.com` → anonymous
+    Authorization: Bearer <token> on the API call only
+    403/429 anonymous → "rate limited. Set GH_TOKEN or run `gh auth login`"
 fetchUrl redirect
-  forwards every header to the Location
+  drops Authorization when the redirect changes origin (other host, or https → http)

SKILL.md and getting-started/model-gateway.md describe the token sources and what an anonymous 403 means.

Evidence

• Before: curl -D - https://api.github.com/repos/raine/claude-code-proxy/releases/latest showed x-ratelimit-remaining: 0, and setup died with "GitHub API returned 403". Six minutes after a reset, the anonymous allowance was already down to 21 of 60.
• After: a live run printed "fetching latest release of raine/claude-code-proxy (authenticated via gh auth token)" and returned v0.1.47 with 12 assets. The authenticated limit is x-ratelimit-limit: 5000.
• Tests: test/github-release.test.js has 10 cases, all passing, with 100% line, 96.55% branch and 100% function coverage of lib/github-release.js.
• Negative controls:
  • Removing the bearer header fails "sends the token only as a bearer header".
  • Disabling redirect stripping fails the cross-host redirect test.
  • Comparing hosts instead of origins fails the https→http downgrade test.
• Full suite: 694/708. The failing files (gateway-drain, gateway-process-isolation, wiring-mode) fail the same tests on untouched origin/develop 65d5e20: 10 failures on both trees.
• CRAP: redirectRequest scores 2. setup's complexity fell.

Release fragment

No board ref. The fragment needs a maintainer-assigned ref (CONTRIBUTING, "Release fragment"). Suggested: --plugins model-gateway --bump patch.

Merge Danger

Door: two-way

With no token available, behaviour is unchanged. With a token, only the release lookup is authenticated.

Blast Radius: setup/update

Only setup's release lookup, and redirect handling in fetchUrl, change. Inference requests are untouched.

🤖 Generated with Claude Code

[Eigenwise]

Merged into develop through #794 with a maintainer fragment (GH-718, model-gateway patch). The cross-origin Authorization drop on redirect was a good catch on top of the rate-limit fix. Thanks.