Macro managed_client 

macro_rules! managed_client {
    (
        $(#[$meta:meta])*
        $vis:vis struct $name:ident => $binary:expr
        $(, token_env = ($svc:expr, $var:expr) )?
        $(, scrub_env = [ $($scrub:expr),* $(,)? ] )?
        $(,)?
    ) => { ... };
}

Emit the common client scaffold every CLI wrapper hand-writes around a ManagedClient.

vcs-git, vcs-jj, vcs-github, and vcs-gitlab each wrap a ManagedClient in a thin newtype that re-exposes the same handful of constructors and default-applying builders — new / Default / with_runner / default_timeout / default_env / default_env_remove / default_cancel_on — with byte-identical bodies and doc strings. This macro generates that shared part so it can’t drift between backends; each wrapper keeps its capability builders (with_retry, with_credentials, every verb, the …At view, …) hand-written in a separate impl block.

The generated newtype is struct $name<R: ProcessRunner = JobRunner> with a single private core: ManagedClient<R> field — accessible to the rest of the wrapper crate (same module). All paths are fully qualified, so the expansion compiles regardless of what the caller has imported.

• $name — the wrapper type (e.g. Git). The struct-level doc comment (and any other attributes) written before struct are attached to it verbatim.
• $binary — the program the client drives (an expression, typically the crate’s BINARY const).
• token_env = ($svc, $var) — optional. When given, new/with_runner chain ManagedClient::with_token_env so a resolved credential is injected into the $var environment variable for service $svc (the forge case: GH_TOKEN, GITLAB_TOKEN). Omit it for the ambient-auth backends (git, jj).
• scrub_env = [ $var, … ] — optional. When given, new/with_runner chain ManagedClient::default_env_remove for each var, so every client the macro generates drops those inherited environment variables by default (vcs-git uses it to scrub the repo-redirector vars — GIT_DIR, … — so a value leaking from the parent process can’t retarget commands). Must come after token_env when both are present.

vcs_cli_support::managed_client! {
    /// The real GitHub client.
    pub struct GitHub => BINARY, token_env = (CredentialService::GitHub, "GH_TOKEN")
}
vcs_cli_support::managed_client! {
    /// The real Git client — scrubs the repo-redirector env vars by default.
    pub struct Git => BINARY, scrub_env = ["GIT_DIR", "GIT_WORK_TREE"]
}