repo clone / remote-add: a way to push without storing the API key in .git/config #27

Problem

As the README says, eds repo clone and eds repo remote-add embed the API key as basic-auth credentials in the remote URL (https://eds:<KEY>@…) in .git/config. Anything that can read the checkout, including AI coding agents working in it, can read the key, and the key covers more than this one repository.

Request

An option that keeps the remote URL credential-free, for example:

• --credential-helper: configure a git credential helper (e.g. eds credential-helper get) that returns eds / the API key from the environment or the OS keychain at push time; or
• print the credential-free URL and document GIT_ASKPASS usage.

A workaround that works today: a GIT_ASKPASS script that answers eds to the Username prompt and $EDS_API_KEY to the Password prompt, then git -c credential.helper= push "$URL" <sha>:refs/heads/<branch>.