XS✔ ◾ fix: don't require or send a GitHub PAT for the public stable release channel

src/backend/ipc/release-channel-handlers.test.ts

@@ -372,4 +372,24 @@ describe("ReleaseChannelIPCHandlers — PR releases require a healthy GitHub tok
     expect(verifyGitHubTokenMock).not.toHaveBeenCalled();
     expect(result).toEqual({ available: false, currentVersion: "1.2.3" });
   });
+
+  it("does not attach a saved (possibly invalid/expired) token as an auth header when switching to the latest stable (public) channel (#600)", async () => {
+    // The stable channel is served from a public GitHub repo and must not require — or send — a
+    // GitHub token at all. Before the fix, configureAutoUpdater() unconditionally attached any
+    // saved token as a Bearer header before branching on channel type, so an invalid/expired token
+    // (which the user is never prompted to fix, since the stable channel doesn't gate on health)
+    // was still sent to the public GitHub releases provider.
+    getChannelMock.mockResolvedValue({ type: "latest" });
+    getTokenMock.mockResolvedValue("saved-but-possibly-invalid-token");
+
+    const { autoUpdater } = (await import("electron-updater")) as unknown as {
+      autoUpdater: { requestHeaders?: Record<string, string> };
+    };
+    autoUpdater.requestHeaders = {};
+
+    const handlers = new ReleaseChannelIPCHandlers();
+    await handlers.configureAutoUpdater({ type: "latest" });
+
+    expect(autoUpdater.requestHeaders?.Authorization).toBeUndefined();
+  });
 });

src/backend/ipc/release-channel-handlers.ts

@@ -571,16 +571,17 @@ export class ReleaseChannelIPCHandlers {
       return;
     }
 
-    const githubToken = await this.tokenStore.getToken();
-    if (githubToken) {
-      autoUpdater.requestHeaders = {
-        ...autoUpdater.requestHeaders,
-        Authorization: `Bearer ${githubToken}`,
-      };
-    }
-
     // Configure autoUpdater based on channel
     if (channel.type === "latest") {
+      // #600 — the stable channel is served from this repo's *public* GitHub releases, which never
+      // need authentication. Don't attach a saved token here at all: a saved-but-invalid/expired
+      // token (which this channel never gates on, unlike PR channels below) would otherwise be sent
+      // as a Bearer header on every request to the public provider, risking spurious 401s instead of
+      // the clean unauthenticated request GitHub expects for public repos. Explicitly clear any
+      // Authorization header a previous PR-channel configuration may have left behind.
+      const { Authorization: _unused, ...headersWithoutAuth } = autoUpdater.requestHeaders ?? {};
+      autoUpdater.requestHeaders = headersWithoutAuth;
+
       autoUpdater.channel = "latest";
       autoUpdater.allowPrerelease = false;
       autoUpdater.allowDowngrade = false;
@@ -618,6 +619,17 @@ export class ReleaseChannelIPCHandlers {
         return;
       }
 
+      // Only attach the token once it's confirmed healthy above (#600) — PR release assets are
+      // downloaded via a "generic" feed pointed at this repo's own GitHub releases, which needs
+      // authentication headers to avoid anonymous rate limits during the download.
+      const githubToken = await this.tokenStore.getToken();
+      if (githubToken) {
+        autoUpdater.requestHeaders = {
+          ...autoUpdater.requestHeaders,
+          Authorization: `Bearer ${githubToken}`,
+        };
+      }
+
       // For PR channels, we need to find the latest release tag first
       const prNumber = this.extractPRNumberFromChannel(channel.channel);
       if (prNumber) {

src/ui/src/components/settings/release-channels/ReleaseChannelSetting.test.tsx

@@ -153,6 +153,28 @@ describe("ReleaseChannelSetting (#423)", () => {
     });
   });
 
+  it("keeps 'Check for Updates' enabled for the Latest Stable channel with no GitHub token saved (#600)", async () => {
+    hasToken.mockResolvedValue(false);
+    verifyToken.mockResolvedValue({ isValid: false });
+
+    render(<ReleaseChannelSetting isActive={true} />);
+    await screen.findByText("1.2.3");
+
+    const button = await screen.findByRole("button", { name: /check for updates/i });
+    await waitFor(() => expect(button).toBeEnabled());
+  });
+
+  it("keeps 'Check for Updates' enabled for the Latest Stable channel with an invalid/expired GitHub token saved (#600)", async () => {
+    hasToken.mockResolvedValue(true);
+    verifyToken.mockResolvedValue({ isValid: false, error: "Invalid or expired token" });
+
+    render(<ReleaseChannelSetting isActive={true} />);
+    await screen.findByText("1.2.3");
+
+    const button = await screen.findByRole("button", { name: /check for updates/i });
+    await waitFor(() => expect(button).toBeEnabled());
+  });
+
   it("keeps the version card's bump label consistent with the toast when the update check resolves before loadCurrentVersion", async () => {
     // loadCurrentVersion() never resolves (simulates it not having finished yet), so
     // `currentVersion` state starts empty; the version card's label must still match

src/ui/src/components/settings/release-channels/ReleaseChannelSetting.tsx

@@ -370,7 +370,12 @@ export function ReleaseChannelSetting({ isActive }: ReleaseChannelSettingProps)
         <Button
           onClick={handleCheckUpdates}
           disabled={
-            isLoading || !selectValue || (channel.type === "pr" ? !isTokenHealthy : !hasGitHubToken)
+            isLoading ||
+            !selectValue ||
+            // #600 — the stable ("latest") channel is a public GitHub release and never needs a
+            // token; only PR channels are token-gated (#919). A user with no token, or an
+            // invalid/expired one, must still be able to check for stable updates.
+            (channel.type === "pr" ? !isTokenHealthy : false)
           }
         >
           Check for Updates