Fix #10: Sanitize GitHub token from git clone command lines

[chenhaot]

Closes #10

Issue

Sanitize GitHub token from git clone command lines

In github.py, clone_repo() embeds the GitHub token directly in the git clone URL: https://x-access-token:{_token}@github.com/.... This exposes the token in process listings (ps aux), shell history, and any logs that capture subprocess arguments.

Suggested fix: Use git credential helpers or pass credentials via GIT_ASKPASS environment variable instead of embedding them in the URL. For example, set the token via the subprocess env parameter using GIT_ASKPASS pointing to a helper script, or us

Changes

Done. Here's what was changed:

minbot/github.py: Replaced the inline token in the git clone URL with a GIT_ASKPASS-based approach:

• New _git_clone_with_token() helper creates a temporary shell script that returns x-access-token for username prompts and reads the token from the GIT_TOKEN env var for password prompts
• The token is passed via the subprocess env parameter (not visible in ps aux or logs)
• The clone URL is now a plain https://github.com/{repo}.git with no embedded credentials
• The temp script is cleaned up in a finally block

tests/test_github.py: Updated test_clone_repo_clones_if_new to mock the new tempfile/chmod/unlink calls and assert the token doesn't appear in command-line arguments.

---

Automated by minbot using Claude Code.