01f79b4315d182a37cd5be08864beb29ce953e8d
Replace the credential-in-URL clone (which git wrote into work/target/.git/config, readable by the review agent whose output is posted publicly) with a tokenless clone that supplies auth via an HTTP header through GIT_CONFIG_* env. The persisted remote is tokenless, so no repo file holds the PAT — fixing the leak at the source instead of deleting .git after the fact. Supersedes the previous rm -rf .git stopgap. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Merge pull request 'Hairpin NAT for NetBird proxy addresses + public-DNS cutover for roaming clients' (#361) from claude-bot/netbird-proxy-2-hairpin into master
Description
No description provided
32 MiB