fix(cli): GitHub Releases 403 on anyr update and empty /latest 404 in setup.sh - #33
Merged
Merged
Conversation
anyr update listed releases via unauthenticated api.github.com, which returns 403 from rate-limited shared IPs. Prefer GH_TOKEN/GITHUB_TOKEN on the REST API; without a token, read github.com/releases HTML instead of the unauth quota. Failures are actionable, not `GitHub Releases API HTTP 403`. setup.sh defaulted to /releases/latest/download, which 404s because stable v0.1.11 has zero assets. Probe that URL, then install from a release that actually has binaries (currently a v0.1.12-beta.* prerelease). No new stable tag. Closes #32 Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Duyet Le <me@duyet.net> Co-authored-by: duyetbot <bot@duyet.net>
Contributor
anyr size and startupStartup is wall time for a cold Size budget:
Budget check: ok raw timings[
{
"asset": "anyr-darwin-arm64",
"kind": "native",
"path": "/Users/runner/work/cli/cli/anyr-darwin-arm64",
"bytes": 2828184,
"size": "2.7 MiB",
"version": "0.1.11 (built 2026-08-28 07:42:46)",
"target": "aarch64-apple-darwin",
"os": "macos-latest",
"startup_version": {
"n": 21,
"min_ms": 3.14,
"median_ms": 3.26,
"p95_ms": 3.76,
"mean_ms": 3.43
},
"startup_help": {
"n": 21,
"min_ms": 2.3,
"median_ms": 2.75,
"p95_ms": 4.17,
"mean_ms": 2.94
}
},
{
"asset": "anyr-darwin-x86_64",
"kind": "native",
"path": "/Users/runner/work/cli/cli/anyr-darwin-x86_64",
"bytes": 3039152,
"size": "2.9 MiB",
"version": "0.1.11 (built 2026-08-28 07:43:13)",
"target": "x86_64-apple-darwin",
"os": "macos-latest",
"startup_version": {
"n": 21,
"min_ms": 33.59,
"median_ms": 44.66,
"p95_ms": 49.37,
"mean_ms": 43.27
},
"startup_help": {
"n": 21,
"min_ms": 29.09,
"median_ms": 36.48,
"p95_ms": 43.39,
"mean_ms": 35.88
}
},
{
"asset": "anyr-linux-arm64",
"kind": "native",
"path": "/home/runner/work/cli/cli/anyr-linux-arm64",
"bytes": 2823208,
"size": "2.7 MiB",
"version": "0.1.11 (built 2026-08-28 07:42:29)",
"target": "aarch64-unknown-linux-gnu",
"os": "ubuntu-24.04-arm",
"startup_version": {
"n": 21,
"min_ms": 0.69,
"median_ms": 0.74,
"p95_ms": 0.85,
"mean_ms": 0.76
},
"startup_help": {
"n": 21,
"min_ms": 0.74,
"median_ms": 0.79,
"p95_ms": 0.83,
"mean_ms": 0.79
}
},
{
"asset": "anyr-linux-x86_64",
"kind": "native",
"path": "/home/runner/work/cli/cli/anyr-linux-x86_64",
"bytes": 3134536,
"size": "3.0 MiB",
"version": "0.1.11 (built 2026-08-28 07:42:34)",
"target": "x86_64-unknown-linux-gnu",
"os": "ubuntu-latest",
"startup_version": {
"n": 21,
"min_ms": 0.92,
"median_ms": 0.95,
"p95_ms": 1.0,
"mean_ms": 0.96
},
"startup_help": {
"n": 21,
"min_ms": 0.91,
"median_ms": 0.93,
"p95_ms": 1.0,
"mean_ms": 0.94
}
},
{
"asset": "anyr-windows-x86_64.exe",
"kind": "native",
"path": "D:\\a\\cli\\cli\\anyr-windows-x86_64.exe",
"bytes": 2598912,
"size": "2.5 MiB",
"version": "0.1.11 (built 2026-08-28T07:44:09Z)",
"target": "x86_64-pc-windows-msvc",
"os": "windows-latest",
"startup_version": {
"n": 21,
"min_ms": 8.81,
"median_ms": 9.99,
"p95_ms": 11.43,
"mean_ms": 9.91
},
"startup_help": {
"n": 21,
"min_ms": 8.77,
"median_ms": 10.72,
"p95_ms": 12.19,
"mean_ms": 10.6
}
},
{
"asset": "anyr.wasm",
"kind": "wasm",
"path": "/home/runner/work/cli/cli/target/wasm-pkg/anyr_cli_bg.wasm",
"bytes": 179307,
"size": "175.1 KiB",
"version": "wasm",
"target": "wasm32-unknown-unknown",
"os": ""
}
] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #32.
Summary
Unauthenticated
api.github.comis rate-limited from shared IPs (403). GitHub/releases/latestis v0.1.11 with zero assets, soanyr-linux-x86_64404s. Beta tags (v0.1.12-beta.*) have the binaries.anyr update: never call the Releases REST API withoutGH_TOKEN/GITHUB_TOKEN. With a token, sendUser-Agent+Accept: application/vnd.github+json+Authorization. Without a token, listgithub.com/releasesHTML (andexpanded_assets) instead of the unauth quota. A 403 is an actionable error, notGitHub Releases API HTTP 403.setup.sh: probe/releases/latest/download/{asset}(follow redirects). On 404, pick a tagged release that actually has the binary — stable-with-assets first, then newest prerelease with binaries. Defaultchannel=stabletherefore installs a realanyr-linux-x86_64(todayv0.1.12-beta.102) instead of 404ing. No new stable tag (v0.1.11 stays GitHub latest; it is empty).anyr update(stable) explains that and suggests--beta.Does not touch release-please. Does not depend on PR #30.
Checklist
How to verify
From a box without
GH_TOKEN/GITHUB_TOKEN(this was the 403 repro):https://github.com/anyrouter-dev/cli/releases/latest/download/anyr-linux-x86_64still 404s until a non-prerelease ships assets. That is GitHub’s/latestpointer at empty v0.1.11; this PR does not invent a stable tag. Usesetup.sh(or a/releases/download/<tag>/URL).Tests:
cargo test --locked --all-targetsandbash tests/setup-sh.test.sh(fake curl: empty/latest404, unauth API not called, token path sendsAuthorization).