- M7: ResolveToken accepts the token via the HF_TOKEN env var (so it need
not appear in argv, where it's visible in ps/shell history); the HTTP
client refuses to send a token / API key over plaintext http:// to a
non-loopback host (use https://). Loopback http is still allowed for
local dev.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>