fix(proxy): passthrough /rate_limit for CLI proxy liveness probe

internal/proxy/handler.go

@@ -59,9 +59,9 @@ func (h *proxyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// gh CLI probes /meta during initialization for feature detection.
-	// Treat it like GraphQL introspection metadata and pass through unfiltered.
-	if r.Method == http.MethodGet && rawPath == "/meta" {
+	// gh CLI probes /meta and /rate_limit during initialization for feature detection
+	// and connectivity checks. These are safe metadata endpoints — pass through unfiltered.
+	if r.Method == http.MethodGet && (rawPath == "/meta" || rawPath == "/rate_limit") {
 		h.passthrough(w, r, fullPath)
 		return
 	}

internal/proxy/handler_test.go

@@ -118,6 +118,30 @@ func TestServeHTTP_MetaPassthrough(t *testing.T) {
 	assert.Contains(t, w.Body.String(), "verifiable_password_authentication")
 }
 
+func TestServeHTTP_RateLimitPassthrough(t *testing.T) {
+	receivedURLCh := make(chan string, 1)
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		receivedURLCh <- r.URL.RequestURI()
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		_, err := w.Write([]byte(`{"resources":{"core":{"limit":5000}}}`))
+		require.NoError(t, err)
+	}))
+	defer upstream.Close()
+
+	s := newTestServer(t, upstream.URL)
+	h := &proxyHandler{server: s}
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v3/rate_limit", nil)
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, req)
+
+	receivedURL := <-receivedURLCh
+	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Equal(t, "/rate_limit", receivedURL)
+	assert.Contains(t, w.Body.String(), "core")
+}
+
 // ─── ServeHTTP: write operations (non-GraphQL POST/PUT/DELETE/PATCH) ─────────
 
 func TestServeHTTP_WriteOperationsPassthrough(t *testing.T) {