fix: address streamer review edge cases

src/core/AnonymizedFile.ts

@@ -508,7 +508,7 @@ export default class AnonymizedFile {
             resolve();
           });
       } catch (error) {
-        handleError(error, res);
+        reject(error);
       }
     });
   }

src/core/source/GitHubStream.ts

@@ -105,7 +105,7 @@ export default class GitHubStream extends GitHubBase {
     const url = githubRawFileUrl(
       this.data.organization,
       this.data.repoName,
-      this.data.commit,
+      this.data.commit || "HEAD",
       filePath
     );
     logger.debug("downloading via raw URL (LFS)", { url });

src/core/zipStream.ts

@@ -75,17 +75,23 @@ export async function streamAnonymizedZip(
     on(event: string, listener: (...args: unknown[]) => void): unknown;
   }
 ): Promise<void> {
-  const source = new GitHubDownload({
-    repoId: opt.repoId,
-    organization: opt.organization,
-    repoName: opt.repoName,
-    commit: opt.commit,
-    getToken: opt.getToken,
-  });
-
   let response;
   try {
-    response = await source.getZipUrl();
+    const token = await opt.getToken();
+    if (!token) {
+      // The API already checked public access. Codeload serves public archives
+      // directly, avoiding the streamer's shared unauthenticated REST quota.
+      response = { url: `https://codeload.github.com/${encodeURIComponent(opt.organization)}/${encodeURIComponent(opt.repoName)}/zip/${encodeURIComponent(opt.commit || "HEAD")}` };
+    } else {
+      const source = new GitHubDownload({
+        repoId: opt.repoId,
+        organization: opt.organization,
+        repoName: opt.repoName,
+        commit: opt.commit,
+        getToken: () => token,
+      });
+      response = await source.getZipUrl();
+    }
   } catch (error) {
     const code = await classifyGitHubMissError(error, {
       organization: opt.organization,