feat: use gitoxide.credentials.helperStderr key to control how stderr is handled with helpers.

That way users can configure each repository instance according to their needs,
with which includes disabling the `stderr` of credential helpers.

 Please enter the message for your patch. Lines starting with

Author: Byron

gix/src/config/cache/init.rs

@@ -402,10 +402,16 @@ fn apply_environment_overrides(
             "gitoxide",
             Some(Cow::Borrowed("credentials".into())),
             git_prefix,
-            &[{
-                let key = &gitoxide::Credentials::TERMINAL_PROMPT;
-                (env(key), key.name)
-            }],
+            &[
+                {
+                    let key = &gitoxide::Credentials::TERMINAL_PROMPT;
+                    (env(key), key.name)
+                },
+                {
+                    let key = &gitoxide::Credentials::HELPER_STDERR;
+                    (env(key), key.name)
+                },
+            ],
         ),
         (
             "gitoxide",

gix/src/config/snapshot/credential_helpers.rs

@@ -2,6 +2,7 @@ use std::{borrow::Cow, convert::TryFrom};
 
 pub use error::Error;
 
+use crate::config::cache::util::ApplyLeniency;
 use crate::{
     bstr::{ByteSlice, ByteVec},
     config::{
@@ -25,6 +26,8 @@ mod error {
         },
         #[error("core.askpass could not be read")]
         CoreAskpass(#[from] gix_config::path::interpolate::Error),
+        #[error(transparent)]
+        BooleanConfig(#[from] crate::config::boolean::Error),
     }
 }
 
@@ -145,7 +148,10 @@ impl Snapshot<'_> {
                 .ignore_empty()?
                 .map(|c| Cow::Owned(c.into_owned())),
             mode: self
-                .boolean(Credentials::TERMINAL_PROMPT.logical_name().as_str())
+                .try_boolean(Credentials::TERMINAL_PROMPT.logical_name().as_str())
+                .map(|val| Credentials::TERMINAL_PROMPT.enrich_error(val))
+                .transpose()
+                .with_leniency(self.repo.config.lenient_config)?
                 .and_then(|val| (!val).then_some(gix_prompt::Mode::Disable))
                 .unwrap_or_default(),
         }
@@ -156,7 +162,12 @@ impl Snapshot<'_> {
                 use_http_path,
                 // The default ssh implementation uses binaries that do their own auth, so our passwords aren't used.
                 query_user_only: url.scheme == gix_url::Scheme::Ssh,
-                ..Default::default()
+                stderr: self
+                    .try_boolean(Credentials::HELPER_STDERR.logical_name().as_str())
+                    .map(|val| Credentials::HELPER_STDERR.enrich_error(val))
+                    .transpose()
+                    .with_leniency(self.repo.options.lenient_config)?
+                    .unwrap_or(true),
             },
             gix_credentials::helper::Action::get_for_url(url.to_bstring()),
             prompt_options,

gix/src/config/tree/sections/gitoxide.rs

@@ -467,6 +467,13 @@ mod subsections {
         pub const TERMINAL_PROMPT: keys::Boolean = keys::Boolean::new_boolean("terminalPrompt", &Gitoxide::CREDENTIALS)
             .with_note("This is a custom addition to provide an alternative to the respective environment variable.")
             .with_environment_override("GIT_TERMINAL_PROMPT");
+
+        /// The `gitoxide.credentials.helperStderr` key to control what happens with the credential helpers `stderr`.
+        ///
+        /// If `true`, the default, `stderr` of credential helper programs will be inherited, just like with `git`.
+        /// If `false`, will be suppressed completely.
+        pub const HELPER_STDERR: keys::Boolean = keys::Boolean::new_boolean("helperStderr", &Gitoxide::CREDENTIALS)
+            .with_environment_override("GIX_CREDENTIALS_HELPER_STDERR");
     }
 
     impl Section for Credentials {
@@ -475,7 +482,7 @@ mod subsections {
         }
 
         fn keys(&self) -> &[&dyn Key] {
-            &[&Self::TERMINAL_PROMPT]
+            &[&Self::TERMINAL_PROMPT, &Self::HELPER_STDERR]
         }
 
         fn parent(&self) -> Option<&dyn Section> {

gix/tests/gix-init.rs

@@ -40,6 +40,7 @@ mod with_overrides {
             .set("EMAIL", "user email")
             .set("GIX_PACK_CACHE_MEMORY", "0")
             .set("GIX_OBJECT_CACHE_MEMORY", "5m")
+            .set("GIX_CREDENTIALS_HELPER_STDERR", "creds-stderr")
             .set("GIT_SSL_CAINFO", "./env.pem")
             .set("GIT_SSL_VERSION", "tlsv1.3")
             .set("GIT_SSH_VARIANT", "ssh-variant-env")
@@ -254,6 +255,7 @@ mod with_overrides {
             ("gitoxide.pathspec.noglob", "pathspecs-noglob"),
             ("gitoxide.pathspec.literal", "pathspecs-literal"),
             ("gitoxide.credentials.terminalPrompt", "42"),
+            ("gitoxide.credentials.helperStderr", "creds-stderr"),
         ] {
             assert_eq!(
                 config