git-lfs-creds

Credential helper bridge for Git LFS (git credential fill/approve/reject).

LFS endpoints are usually HTTPS, and HTTPS auth needs a username and password. Rather than maintaining a separate credential store, this crate defers to git's existing one: whatever the user has already configured for their git remote (osxkeychain, libsecret, manager, store, plain cache, …) is what LFS uses too.

A Helper trait represents each credential source, and a HelperChain tries them in order: in-process cache first, then git credential, with GIT_ASKPASS / SSH_ASKPASS and ~/.netrc slotting in as additional sources. Success and failure are broadcast to every helper in the chain so caches stay in sync with the upstream source of truth.

SSH remotes follow a different model. Rather than asking the user for credentials, we run git-lfs-authenticate <path> <operation> over SSH and parse a short-lived HTTPS token from the response. The SSH key the user already manages is the only credential involved; results are cached with the server-supplied expiry honored.