fix: prefer gh auth over SHPIT_GH_TOKEN for installs

Formula/meshix-cli.rb

@@ -8,8 +8,8 @@ def initialize(url, name, version, **meta)
         url,
         [
           "GitHub authentication is required to download the private meshix-cli release asset.",
-          "Set HOMEBREW_GITHUB_API_TOKEN, GH_TOKEN, GITHUB_TOKEN, or SHPIT_GH_TOKEN,",
-          "or log in with gh auth login."
+          "Set HOMEBREW_GITHUB_API_TOKEN, GH_TOKEN, or GITHUB_TOKEN,",
+          "or log in with gh auth login. SHPIT_GH_TOKEN is also supported for SHPIT automation."
         ].join(" ")
       )
     end
@@ -23,7 +23,7 @@ def initialize(url, name, version, **meta)
   private
 
   def resolve_github_token
-    %w[HOMEBREW_GITHUB_API_TOKEN GH_TOKEN GITHUB_TOKEN SHPIT_GH_TOKEN].each do |key|
+    %w[HOMEBREW_GITHUB_API_TOKEN GH_TOKEN GITHUB_TOKEN].each do |key|
       value = ENV[key]&.strip
       return value unless value.nil? || value.empty?
     end
@@ -42,6 +42,9 @@ def resolve_github_token
       next
     end
 
+    value = ENV["SHPIT_GH_TOKEN"]&.strip
+    return value unless value.nil? || value.empty?
+
     nil
   end
 

Formula/osyrra.rb

@@ -8,8 +8,8 @@ def initialize(url, name, version, **meta)
         url,
         [
           "GitHub authentication is required to download the private osyrra release asset.",
-          "Set HOMEBREW_GITHUB_API_TOKEN, GH_TOKEN, GITHUB_TOKEN, or SHPIT_GH_TOKEN,",
-          "or log in with gh auth login."
+          "Set HOMEBREW_GITHUB_API_TOKEN, GH_TOKEN, or GITHUB_TOKEN,",
+          "or log in with gh auth login. SHPIT_GH_TOKEN is also supported for SHPIT automation."
         ].join(" ")
       )
     end
@@ -23,7 +23,7 @@ def initialize(url, name, version, **meta)
   private
 
   def resolve_github_token
-    %w[HOMEBREW_GITHUB_API_TOKEN GH_TOKEN GITHUB_TOKEN SHPIT_GH_TOKEN].each do |key|
+    %w[HOMEBREW_GITHUB_API_TOKEN GH_TOKEN GITHUB_TOKEN].each do |key|
       value = ENV[key]&.strip
       return value unless value.nil? || value.empty?
     end
@@ -42,6 +42,9 @@ def resolve_github_token
       next
     end
 
+    value = ENV["SHPIT_GH_TOKEN"]&.strip
+    return value unless value.nil? || value.empty?
+
     nil
   end
 

Formula/tabex.rb

@@ -8,8 +8,8 @@ def initialize(url, name, version, **meta)
         url,
         [
           "GitHub authentication is required to download the private tabex release asset.",
-          "Set HOMEBREW_GITHUB_API_TOKEN, GH_TOKEN, GITHUB_TOKEN, or SHPIT_GH_TOKEN,",
-          "or log in with gh auth login."
+          "Set HOMEBREW_GITHUB_API_TOKEN, GH_TOKEN, or GITHUB_TOKEN,",
+          "or log in with gh auth login. SHPIT_GH_TOKEN is also supported for SHPIT automation."
         ].join(" ")
       )
     end
@@ -23,7 +23,7 @@ def initialize(url, name, version, **meta)
   private
 
   def resolve_github_token
-    %w[HOMEBREW_GITHUB_API_TOKEN GH_TOKEN GITHUB_TOKEN SHPIT_GH_TOKEN].each do |key|
+    %w[HOMEBREW_GITHUB_API_TOKEN GH_TOKEN GITHUB_TOKEN].each do |key|
       value = ENV[key]&.strip
       return value unless value.nil? || value.empty?
     end
@@ -42,6 +42,9 @@ def resolve_github_token
       next
     end
 
+    value = ENV["SHPIT_GH_TOKEN"]&.strip
+    return value unless value.nil? || value.empty?
+
     nil
   end
 

README.md

@@ -8,8 +8,8 @@ This repo is the tap source of truth. Formulae are updated by repo-owned scripts
 
 | Formula | Upstream | Notes |
 |---|---|---|
-| `meshix-cli` | `shpitdev/meshix-observability` GitHub Releases | Private darwin arm64 release asset fetched through the GitHub Releases API. The formula reads `HOMEBREW_GITHUB_API_TOKEN`, `GH_TOKEN`, `GITHUB_TOKEN`, or `SHPIT_GH_TOKEN`, and falls back to `gh auth token` when available. |
-| `tabex` | `shpitdev/tabex` GitHub Releases | Private darwin arm64 release asset fetched through the GitHub Releases API. The formula reads `HOMEBREW_GITHUB_API_TOKEN`, `GH_TOKEN`, `GITHUB_TOKEN`, or `SHPIT_GH_TOKEN`, and falls back to `gh auth token` when available. |
+| `meshix-cli` | `shpitdev/meshix-observability` GitHub Releases | Private darwin arm64 release asset fetched through the GitHub Releases API. The formula first checks `HOMEBREW_GITHUB_API_TOKEN`, `GH_TOKEN`, and `GITHUB_TOKEN`, then falls back to `gh auth token`, and only then checks `SHPIT_GH_TOKEN` for SHPIT automation environments. |
+| `tabex` | `shpitdev/tabex` GitHub Releases | Private darwin arm64 release asset fetched through the GitHub Releases API. The formula first checks `HOMEBREW_GITHUB_API_TOKEN`, `GH_TOKEN`, and `GITHUB_TOKEN`, then falls back to `gh auth token`, and only then checks `SHPIT_GH_TOKEN` for SHPIT automation environments. |
 | `osyrra` | `shpitdev/osyrra` GitHub Releases | Private darwin arm64 release asset fetched through the GitHub Releases API. Same auth path as `tabex`. |
 
 ## Automation
@@ -48,7 +48,7 @@ That saves browser config, installs or updates the managed Chrome extension loca
 
 - All current formulae are macOS arm64 only. The upstream releases do not ship a `darwin_amd64` asset today; add one upstream and the updater scripts can gain an `on_intel` block where appropriate.
 - `meshix-cli`, `tabex`, and `osyrra` currently come from private upstream repos, so these install paths remain SHPIT-internal until their release assets become public.
-- Automation reads those private releases with the `SHPIT_GH_TOKEN` secret.
+- Automation reads those private releases with the `SHPIT_GH_TOKEN` secret, but local installs should usually rely on your logged-in `gh` session or one of the standard Homebrew GitHub token env vars.
 
 ## Local Usage
 

docs/setup.md

@@ -85,8 +85,9 @@ That uses your local GitHub CLI session for private release access.
 
 For local installs, all three SHPIT formulae (`meshix-cli`, `tabex`, and `osyrra`) use the same private-auth path:
 
-- they first check `HOMEBREW_GITHUB_API_TOKEN`, `GH_TOKEN`, `GITHUB_TOKEN`, and `SHPIT_GH_TOKEN`
-- if none are set, they fall back to `gh auth token`
+- they first check `HOMEBREW_GITHUB_API_TOKEN`, `GH_TOKEN`, and `GITHUB_TOKEN`
+- if none of those are set, they fall back to `gh auth token`
+- only after that do they check `SHPIT_GH_TOKEN`, so a logged-in local `gh` session wins over an automation token that happens to be exported
 - in headless environments, prefer `HOMEBREW_GITHUB_API_TOKEN="$(gh auth token)" brew install ...`
 
 For `tabex`, the formula caveat currently points users at:
@@ -101,13 +102,14 @@ That is intentional. `v0.0.4` is the first stable release that ships the source-
 
 All three current SHPIT formulae use install-side GitHub auth:
 
-- they check `HOMEBREW_GITHUB_API_TOKEN`, `GH_TOKEN`, `GITHUB_TOKEN`, and `SHPIT_GH_TOKEN`
-- if no token env var is present, they fall back to `gh auth token`
+- they check `HOMEBREW_GITHUB_API_TOKEN`, `GH_TOKEN`, and `GITHUB_TOKEN`
+- if no standard token env var is present, they fall back to `gh auth token`
+- `SHPIT_GH_TOKEN` remains supported as a final SHPIT automation fallback
 
 All current SHPIT formulae are macOS arm64 only today. An Intel Mac install will fail with an architecture guard until the upstream release adds a `darwin_amd64` asset and the relevant formula gains an `on_intel` block.
 
 ## Recommended Follow-Up
 
 1. Confirm `SHPIT_GH_TOKEN` is attached to this repo.
-2. Validate real `brew install shpitdev/tap/meshix-cli`, `brew install shpitdev/tap/tabex`, and `brew install shpitdev/tap/osyrra` flows on a macOS arm64 machine.
+2. Validate real `brew install shpitdev/tap/meshix-cli`, `brew install shpitdev/tap/tabex`, and `brew install shpitdev/tap/osyrra` flows on a macOS arm64 machine, especially in shells where `SHPIT_GH_TOKEN` may already be exported.
 3. Keep the package-manager caveats aligned with the upstream installers when shell or setup UX changes.

scripts/update-meshix-cli.sh

@@ -141,8 +141,8 @@ class MeshixCliGitHubReleaseDownloadStrategy < CurlDownloadStrategy
         url,
         [
           "GitHub authentication is required to download the private meshix-cli release asset.",
-          "Set HOMEBREW_GITHUB_API_TOKEN, GH_TOKEN, GITHUB_TOKEN, or SHPIT_GH_TOKEN,",
-          "or log in with gh auth login."
+          "Set HOMEBREW_GITHUB_API_TOKEN, GH_TOKEN, or GITHUB_TOKEN,",
+          "or log in with gh auth login. SHPIT_GH_TOKEN is also supported for SHPIT automation."
         ].join(" ")
       )
     end
@@ -156,7 +156,7 @@ class MeshixCliGitHubReleaseDownloadStrategy < CurlDownloadStrategy
   private
 
   def resolve_github_token
-    %w[HOMEBREW_GITHUB_API_TOKEN GH_TOKEN GITHUB_TOKEN SHPIT_GH_TOKEN].each do |key|
+    %w[HOMEBREW_GITHUB_API_TOKEN GH_TOKEN GITHUB_TOKEN].each do |key|
       value = ENV[key]&.strip
       return value unless value.nil? || value.empty?
     end
@@ -175,6 +175,9 @@ class MeshixCliGitHubReleaseDownloadStrategy < CurlDownloadStrategy
       next
     end
 
+    value = ENV["SHPIT_GH_TOKEN"]&.strip
+    return value unless value.nil? || value.empty?
+
     nil
   end
 

scripts/update-osyrra.sh

@@ -110,8 +110,8 @@ class OsyrraGitHubReleaseDownloadStrategy < CurlDownloadStrategy
         url,
         [
           "GitHub authentication is required to download the private osyrra release asset.",
-          "Set HOMEBREW_GITHUB_API_TOKEN, GH_TOKEN, GITHUB_TOKEN, or SHPIT_GH_TOKEN,",
-          "or log in with gh auth login."
+          "Set HOMEBREW_GITHUB_API_TOKEN, GH_TOKEN, or GITHUB_TOKEN,",
+          "or log in with gh auth login. SHPIT_GH_TOKEN is also supported for SHPIT automation."
         ].join(" ")
       )
     end
@@ -125,7 +125,7 @@ class OsyrraGitHubReleaseDownloadStrategy < CurlDownloadStrategy
   private
 
   def resolve_github_token
-    %w[HOMEBREW_GITHUB_API_TOKEN GH_TOKEN GITHUB_TOKEN SHPIT_GH_TOKEN].each do |key|
+    %w[HOMEBREW_GITHUB_API_TOKEN GH_TOKEN GITHUB_TOKEN].each do |key|
       value = ENV[key]&.strip
       return value unless value.nil? || value.empty?
     end
@@ -144,6 +144,9 @@ class OsyrraGitHubReleaseDownloadStrategy < CurlDownloadStrategy
       next
     end
 
+    value = ENV["SHPIT_GH_TOKEN"]&.strip
+    return value unless value.nil? || value.empty?
+
     nil
   end
 

scripts/update-tabex.sh

@@ -110,8 +110,8 @@ class TabexGitHubReleaseDownloadStrategy < CurlDownloadStrategy
         url,
         [
           "GitHub authentication is required to download the private tabex release asset.",
-          "Set HOMEBREW_GITHUB_API_TOKEN, GH_TOKEN, GITHUB_TOKEN, or SHPIT_GH_TOKEN,",
-          "or log in with gh auth login."
+          "Set HOMEBREW_GITHUB_API_TOKEN, GH_TOKEN, or GITHUB_TOKEN,",
+          "or log in with gh auth login. SHPIT_GH_TOKEN is also supported for SHPIT automation."
         ].join(" ")
       )
     end
@@ -125,7 +125,7 @@ class TabexGitHubReleaseDownloadStrategy < CurlDownloadStrategy
   private
 
   def resolve_github_token
-    %w[HOMEBREW_GITHUB_API_TOKEN GH_TOKEN GITHUB_TOKEN SHPIT_GH_TOKEN].each do |key|
+    %w[HOMEBREW_GITHUB_API_TOKEN GH_TOKEN GITHUB_TOKEN].each do |key|
       value = ENV[key]&.strip
       return value unless value.nil? || value.empty?
     end
@@ -144,6 +144,9 @@ class TabexGitHubReleaseDownloadStrategy < CurlDownloadStrategy
       next
     end
 
+    value = ENV["SHPIT_GH_TOKEN"]&.strip
+    return value unless value.nil? || value.empty?
+
     nil
   end