response: add Ok/Cancel factories and wire quit=1

When a provider can produce a credential it returns one. When it
deliberately can't (the user closed an auth prompt, no eligible
account was found, etc.) it currently has to throw, which routes
through the generic top-level exception handler and surfaces as
"fatal: ..." on stderr with exit -1. That conflates "the provider
decided not to authenticate" with "something went unexpectedly
wrong", and forces every "no credential" path through an
exception.

Give providers a non-exceptional way to express both outcomes:

* GitResponse.Ok(credential) -- successful response; same shape as
  the existing public constructor, just named for the intent.

* GitResponse.Cancel() -- cancellation response; carries no
  credential and tells the command layer to emit `quit=1` on
  standard output, which is the Git credential helper protocol's
  signal to abort the credential acquisition pipeline. Git
  responds by terminating the operation immediately, rather than
  falling back to an interactive terminal prompt that would just
  re-ask the user who already cancelled in a GUI dialog.

Enforce the invariant in GitResponse that cancelled responses
cannot carry a credential and that non-cancelled responses must.
The existing 1-arg constructor is retained as an alias for Ok so
in-tree providers keep compiling; migrating them to the factories
is the next commit.

Exit-code plumbing is deliberately not touched: `quit=1` is the
in-band protocol signal that the protocol actually defines for
this case, and Git's `die()` on receiving it makes the helper's
exit code irrelevant. Reserving non-zero exit for genuinely
unexpected internal errors (which already throw and route through
Application.OnException) keeps the two channels semantically
distinct.

Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>
Assisted-by: Claude Opus 4.7

Author: mjcheetham

src/Core.Tests/Commands/GetCommandTests.cs

@@ -121,6 +121,31 @@ public async Task GetCommand_ExecuteAsync_NoNegotiatedCapabilities_EmitsNoCapabi
             Assert.DoesNotContain("capability", actualOutput);
         }
 
+        [Fact]
+        public async Task GetCommand_ExecuteAsync_CancelledResponse_EmitsQuitAndNoCredential()
+        {
+            // A provider that declines to produce a credential (e.g. the user closed
+            // an auth prompt) returns GitResponse.Cancel(); the command MUST emit
+            // `quit=1` so Git aborts the credential acquisition pipeline rather than
+            // falling back to an interactive prompt that re-asks the user. No
+            // credential fields must be emitted.
+            var stdin = "protocol=https\nhost=example.com\n\n";
+
+            var providerMock = new Mock<IHostProvider>();
+            providerMock.Setup(x => x.GetCredentialAsync(It.IsAny<GitRequest>()))
+                        .ReturnsAsync(GitResponse.Cancel());
+            var providerRegistry = new TestHostProviderRegistry { Provider = providerMock.Object };
+            var context = new TestCommandContext { Streams = { In = stdin } };
+
+            var command = new GetCommand(context, providerRegistry);
+
+            await command.ExecuteAsync();
+
+            string actualOutput = context.Streams.Out.ToString().Replace("\r\n", "\n");
+
+            Assert.Equal("quit=1\n\n", actualOutput);
+        }
+
         #region Helpers
 
         private static IDictionary<string, string> ParseDictionary(StringBuilder sb) => ParseDictionary(sb.ToString());

src/Core.Tests/GitResponseTests.cs

@@ -52,4 +52,37 @@ public void GitResponse_AdditionalProperties_CanBeReplaced()
         Assert.Single(response.AdditionalProperties);
         Assert.Equal("allow", response.AdditionalProperties["ntlm"]);
     }
+
+    [Fact]
+    public void GitResponse_Constructor_NullCredential_Throws()
+    {
+        // The non-cancelled ctor requires a credential. Use Cancel() for the no-credential case.
+        Assert.Throws<System.ArgumentNullException>(() => new GitResponse(null));
+    }
+
+    [Fact]
+    public void GitResponse_Ok_ReturnsSuccessfulResponseWithCredential()
+    {
+        ICredential credential = new GitCredential("alice", "hunter2");
+
+        var response = GitResponse.Ok(credential);
+
+        Assert.Same(credential, response.Credential);
+        Assert.False(response.IsCancelled);
+    }
+
+    [Fact]
+    public void GitResponse_Ok_NullCredential_Throws()
+    {
+        Assert.Throws<System.ArgumentNullException>(() => GitResponse.Ok(null));
+    }
+
+    [Fact]
+    public void GitResponse_Cancel_ReturnsCancellationResponseWithNoCredential()
+    {
+        var response = GitResponse.Cancel();
+
+        Assert.True(response.IsCancelled);
+        Assert.Null(response.Credential);
+    }
 }

src/Core/Commands/GetCommand.cs

@@ -19,6 +19,20 @@ public GetCommand(ICommandContext context, IHostProviderRegistry hostProviderReg
         protected override async Task ExecuteInternalAsync(GitRequest request, IHostProvider provider)
         {
             GitResponse response = await provider.GetCredentialAsync(request);
+
+            if (response.IsCancelled)
+            {
+                // Provider declined to produce a credential. Tell Git to stop the
+                // credential acquisition pipeline (no fallback interactive prompt)
+                // via the `quit` protocol attribute. This avoids re-prompting a
+                // user who has already explicitly cancelled in a GUI dialog.
+                Context.Trace.WriteLine("Provider cancelled the credential request; emitting quit=1.");
+                Context.Streams.Error.WriteLine("info: user cancelled the credential request.");
+                Context.Streams.Out.WriteLine("quit=1");
+                Context.Streams.Out.WriteLine();
+                return;
+            }
+
             ICredential credential = response.Credential;
 
             // Negotiate capabilities by intersecting what Git advertised with what GCM supports.

src/Core/GitResponse.cs

@@ -9,38 +9,104 @@ namespace GitCredentialManager;
 /// </summary>
 /// <remarks>
 /// <para>
-/// Holds the resolved <see cref="ICredential"/> together with any non-credential
-/// output the provider wants to emit back to Git. Strongly-typed properties for
-/// newer Git credential protocol fields (e.g. <c>state[]</c>, <c>continue</c>,
-/// <c>authtype</c>, <c>credential</c>, <c>ephemeral</c>, <c>password_expiry_utc</c>,
-/// <c>oauth_refresh_token</c>) will be added here as the corresponding
-/// capabilities are wired up; see <see cref="GitCapabilities"/>.
+/// A successful response holds the resolved <see cref="ICredential"/> together
+/// with any non-credential output the provider wants to emit back to Git
+/// (see <see cref="AdditionalProperties"/>).
 /// </para>
 /// <para>
-/// Until then, <see cref="AdditionalProperties"/> remains the escape hatch for
-/// arbitrary extra output keys (for example, the generic provider's
-/// <c>ntlm=allow</c> hint).
+/// A response can also be a <em>cancellation</em>: the provider was asked for a
+/// credential but deliberately declined to produce one (the user closed an
+/// auth prompt, no eligible account was found, and so on). A cancelled
+/// response has no <see cref="Credential"/> and causes the command layer to
+/// emit <c>quit=1</c> to Git, which terminates the credential acquisition
+/// pipeline without falling back to an interactive prompt.
+/// </para>
+/// <para>
+/// Use the <see cref="Ok(ICredential)"/> and <see cref="Cancel"/> factory
+/// methods rather than the constructor where possible; they make the intent
+/// of each call site obvious.
+/// </para>
+/// <para>
+/// Strongly-typed properties for newer Git credential protocol fields
+/// (e.g. <c>state[]</c>, <c>continue</c>, <c>authtype</c>, <c>credential</c>,
+/// <c>ephemeral</c>, <c>password_expiry_utc</c>, <c>oauth_refresh_token</c>)
+/// will be added here as the corresponding capabilities are wired up; see
+/// <see cref="GitCapabilities"/>. Until then, <see cref="AdditionalProperties"/>
+/// remains the escape hatch for arbitrary extra output keys (for example, the
+/// generic provider's <c>ntlm=allow</c> hint).
 /// </para>
 /// </remarks>
 public class GitResponse
 {
-    public GitResponse(ICredential credential)
+    private GitResponse(ICredential credential, bool isCancelled)
     {
+        if (isCancelled && credential is not null)
+        {
+            throw new ArgumentException(
+                "A cancelled response cannot carry a credential.",
+                nameof(credential));
+        }
+
+        if (!isCancelled && credential is null)
+        {
+            throw new ArgumentNullException(
+                nameof(credential),
+                "A non-cancelled response must carry a credential. Use Cancel() instead.");
+        }
+
         Credential = credential;
+        IsCancelled = isCancelled;
+    }
+
+    /// <summary>
+    /// Construct a successful response carrying the given credential.
+    /// </summary>
+    /// <remarks>Equivalent to <see cref="Ok(ICredential)"/>.</remarks>
+    public GitResponse(ICredential credential)
+        : this(credential, isCancelled: false)
+    {
     }
 
     /// <summary>
-    /// The credential resolved or generated for the request.
+    /// Construct a successful response carrying the given credential.
+    /// </summary>
+    public static GitResponse Ok(ICredential credential) =>
+        new GitResponse(credential, isCancelled: false);
+
+    /// <summary>
+    /// Construct a cancellation response: the provider declined to produce a
+    /// credential for this request.
+    /// </summary>
+    /// <remarks>
+    /// The command layer translates a cancelled response into a <c>quit=1</c>
+    /// line on standard output, which tells Git to abort the credential
+    /// acquisition pipeline immediately without falling back to an interactive
+    /// prompt. Any <see cref="AdditionalProperties"/> set on a cancelled
+    /// response are ignored.
+    /// </remarks>
+    public static GitResponse Cancel() =>
+        new GitResponse(credential: null, isCancelled: true);
+
+    /// <summary>
+    /// The credential resolved or generated for the request, or <see langword="null"/>
+    /// when <see cref="IsCancelled"/> is <see langword="true"/>.
     /// </summary>
     public ICredential Credential { get; }
 
+    /// <summary>
+    /// <see langword="true"/> when the provider declined to produce a credential
+    /// for this request. The command layer translates this into a <c>quit=1</c>
+    /// signal to Git rather than any specific exit code.
+    /// </summary>
+    public bool IsCancelled { get; }
+
     /// <summary>
     /// Additional, untyped output to be emitted alongside the credential.
     /// </summary>
     /// <remarks>
     /// This is the legacy escape hatch for non-credential output. New code
     /// should prefer typed properties on <see cref="GitResponse"/> as they
-    /// are added.
+    /// are added. Ignored on cancelled responses.
     /// </remarks>
     public IDictionary<string, string> AdditionalProperties { get; set; }
         = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);