feat(cli): add optional GitHub token support for higher API rate limits

[orbisai0security]

Summary

Adds optional GitHub Personal Access Token support to the CLI so users can raise the GitHub API rate limit from 60 to 5,000 requests/hour. This is a rate-limit convenience feature, not a security fix — the original cli/src/utils/github.ts had no hardcoded token.

This supersedes closed PR #186 and incorporates the safeguards requested during its review.

Changes

• cli/src/utils/github.ts

  • getAuthHeaders() now accepts an optional token param; precedence: explicit arg → UI_PRO_MAX_GITHUB_TOKEN env var → GITHUB_TOKEN env var
  • Whitespace-trim guard prevents malformed Authorization headers from empty env vars
  • Added exported getGitHubTokenGuidance() helper used in rate-limit error messages
  • fetchReleases, getLatestRelease, downloadRelease accept optional token param

• cli/src/index.ts

  • Added -t, --token <token> option to init, versions, update commands

• cli/src/commands/init.ts / update.ts / versions.ts

  • Thread token through options interfaces and GitHub helper calls
  • Rate-limit catch in tryGitHubInstall now shows getGitHubTokenGuidance() before falling back

• cli/README.md

  • New "GitHub Authentication" section documenting --token flag, UI_PRO_MAX_GITHUB_TOKEN, GITHUB_TOKEN fallback, PAT creation steps, and a CI warning about GITHUB_TOKEN scope

Why UI_PRO_MAX_GITHUB_TOKEN instead of GITHUB_TOKEN

GitHub Actions automatically injects GITHUB_TOKEN with broad repo permissions into every workflow. Using that as the primary name would silently attach those credentials to every release fetch, which is the actual token-exposure risk. UI_PRO_MAX_GITHUB_TOKEN is project-scoped and explicit; GITHUB_TOKEN is kept as an opt-in fallback.

Verification

• bun run build passes (bun required)
• uipro init --token ghp_fake attaches Authorization: Bearer ghp_fake header
• uipro init with no token makes unauthenticated requests (no Authorization header)
• UI_PRO_MAX_GITHUB_TOKEN=x uipro versions picks up env token
• Rate-limit error shows guidance message before template fallback

[mrgoonie]

Summary: This PR tries to add optional GitHub API authentication for release fetch/download calls, but it reintroduces a narrower and weaker version of prior closed PR #186 without the CLI/docs wiring or token-safety guidance.

Risk level: Medium

Mandatory gates:

• Duplicate/prior implementation: overlap found — closed PR #186 already implemented a broader optional-token design for the same GitHub release helper path and received maintainer review feedback.
• Project standards: issue found — changing CLI auth behavior should include documented user-facing configuration and validation, not an implicit environment-only behavior.
• Strategic necessity: questionable as submitted — avoiding rate limits is useful, but the stated hardcoded-token security issue is not present in current cli/src/utils/github.ts.
• CI/checks: missing / locally blocked — no PR checks are reported and bun is unavailable in this cron environment, so I could not run the TypeScript build.

Findings:

• Important: The PR claims to fix possible hardcoded GitHub token exposure, but current origin/main:cli/src/utils/github.ts has no hardcoded token and only sends unauthenticated fetch requests. The actual change silently starts reading a GitHub token from the environment and attaching it to every release/download request, without README/CLI documentation, token naming guidance, or warning about secret exposure. That makes this a rate-limit feature, not the described security fix, and it needs product/UX documentation before merge.
• Important: This overlaps with PR #186, which already proposed optional GitHub token support plus docs and command wiring, and was closed after review feedback around secret handling, --token UX, empty-token guards, and auth/rate-limit messaging. Please either reopen/supersede that design deliberately or explain why this narrower env-only version is the preferred approach and incorporate the relevant safeguards.

Verdict: REQUEST_CHANGES

[orbisai0security]

Summary: This PR tries to add optional GitHub API authentication for release fetch/download calls, but it reintroduces a narrower and weaker version of prior closed PR #186 without the CLI/docs wiring or token-safety guidance.

Risk level: Medium

Mandatory gates:

• Duplicate/prior implementation: overlap found — closed PR feat(cli): add optional GitHub token support and actionable rate-limit guidance #186 already implemented a broader optional-token design for the same GitHub release helper path and received maintainer review feedback.
• Project standards: issue found — changing CLI auth behavior should include documented user-facing configuration and validation, not an implicit environment-only behavior.
• Strategic necessity: questionable as submitted — avoiding rate limits is useful, but the stated hardcoded-token security issue is not present in current cli/src/utils/github.ts.
• CI/checks: missing / locally blocked — no PR checks are reported and bun is unavailable in this cron environment, so I could not run the TypeScript build.

Findings:

• Important: The PR claims to fix possible hardcoded GitHub token exposure, but current origin/main:cli/src/utils/github.ts has no hardcoded token and only sends unauthenticated fetch requests. The actual change silently starts reading a GitHub token from the environment and attaching it to every release/download request, without README/CLI documentation, token naming guidance, or warning about secret exposure. That makes this a rate-limit feature, not the described security fix, and it needs product/UX documentation before merge.
• Important: This overlaps with PR feat(cli): add optional GitHub token support and actionable rate-limit guidance #186, which already proposed optional GitHub token support plus docs and command wiring, and was closed after review feedback around secret handling, --token UX, empty-token guards, and auth/rate-limit messaging. Please either reopen/supersede that design deliberately or explain why this narrower env-only version is the preferred approach and incorporate the relevant safeguards.

Verdict: REQUEST_CHANGES

Addressed. Pls review.

[mrgoonie]

Summary: The updated PR now addresses the prior token-support blockers: CLI flag wiring, project-scoped env var precedence, empty-token trimming, rate-limit guidance, and user-facing docs are present.

Risk level: Medium

Mandatory gates:

• Duplicate/prior implementation: overlap found with closed PR #186, but this PR now deliberately supersedes it and incorporates the relevant safeguards.
• Project standards: passed — CLI behavior is wired through command options and documented in cli/README.md.
• Strategic necessity: clear value — optional auth helps users avoid GitHub unauthenticated API rate limits without changing default unauthenticated behavior.
• CI/checks: missing — no PR checks are reported for this branch, so merge should still rely on branch protection/manual build if required.

Findings:

• Critical: none.
• Important: none.
• Suggestion: consider avoiding direct --token examples with realistic token-looking strings in future docs, since env vars are safer for shell history; the current warning is enough for this PR.

Verdict: APPROVE