update README

Author: phealy

README.md

@@ -5,68 +5,76 @@ A Git credential helper that uses Azure CLI to obtain OAuth tokens for Azure Dev
 ## Prerequisites
 
 - [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli) installed and authenticated (`az login`)
+- Go 1.21+ (for building from source)
 
 ## Installation
 
-### Option 1: Build from source (Go)
-
 ```bash
 go build -o git-credential-azure-cli .
-cp git-credential-azure-cli /usr/local/bin/
+sudo cp git-credential-azure-cli /usr/local/bin/
 ```
 
-### Option 2: Use Python script
-
-Requires Python 3.6+
+Or use the `init` command after building:
 
 ```bash
-cp git-credential-azure-cli.py /usr/local/bin/git-credential-azure-cli
-chmod +x /usr/local/bin/git-credential-azure-cli
+git-credential-azure-cli init
 ```
 
-Then configure Git to use the helper.
+This will configure Git to use the cache helper (to prevent rate limiting) and add this tool as a credential helper.
 
 ## Configuration
 
-### Credential Caching (Recommended)
+### Quick Setup
+
+The easiest way to configure is using the `init` command:
+
+```bash
+git-credential-azure-cli init
+```
+
+### Manual Setup
 
 Add the cache helper first to prevent Entra ID rate limiting. The helper provides `password_expiry_utc` so the cache knows when to refresh:
 
 ```bash
 git config --global --replace-all credential.helper cache
-git config --global --add credential.helper git-credential-azure-cli
+git config --global --add credential.helper /path/to/git-credential-azure-cli
 ```
 
-### Global Helper
+### Allowed Domains
 
-Configure the helper globally with domain filtering:
+Set which domains the helper should process. Uses "ends with" matching, so `visualstudio.com` matches `msazure.visualstudio.com`:
 
 ```bash
-git config --global credential.helper git-credential-azure-cli
+git config --global --add azureCliCredentialHelper.allowedDomain "visualstudio.com"
+git config --global --add azureCliCredentialHelper.allowedDomain "dev.azure.com"
 ```
 
-By default, this handles hosts ending with `visualstudio.com`, `dev.azure.com`, or `goproxyprod.goms.io`.
+Default: `visualstudio.com`, `dev.azure.com`
 
-### GOPROXY Authentication
+### Resource Overrides
 
-This helper can also be used for Go module proxy authentication via the `GOAUTH` environment variable:
+For hosts that need a different token resource (e.g., Go module proxies):
 
 ```bash
-export GOAUTH="git /"
+git config --global "azureCliCredentialHelper.https://mydomain.com.resource" "https://myoauth2resourceURL"
 ```
 
-This tells Go to use the git credential system for authentication, which will invoke this helper for matching domains. `/` can be used as the directory because the credential helper is in the user's 
-global configuration. If configured in a specific directory, use that path instead.
+### GOAUTH Authentication
 
-### Allowed Domains
+This helper can be used for Go module proxy authentication via the `GOAUTH` environment variable:
 
-Set which domains the helper should process (comma-separated). Uses "ends with" matching, so `visualstudio.com` matches `msazure.visualstudio.com`:
+```bash
+eval "$(git-credential-azure-cli exports)"
+```
+
+Or add to your shell profile:
 
 ```bash
-git config --global credential.azureCliHelper.allowedDomains "visualstudio.com,dev.azure.com"
+git-credential-azure-cli exports >> ~/.bashrc
 ```
 
-Default: `visualstudio.com,dev.azure.com,goproxyprod.goms.io`
+This sets `GOAUTH` to use the git credential system for authentication.
 
 ## How It Works
 
@@ -77,8 +85,8 @@ Default: `visualstudio.com,dev.azure.com,goproxyprod.goms.io`
    - The host matches one of the allowed domains
 
 3. It attempts to get an OAuth token from Azure CLI:
-   - If the host has a resource override (e.g., `goproxyprod.goms.io` uses `https://microsoft.onmicrosoft.com/AKSGoProxyMSFT`), uses that resource
-   - Otherwise tries: `az account get-access-token --resource https://<host>/`
+   - If the host has a resource override configured, uses that resource
+   - Otherwise constructs the resource from the host URL
    - If that fails and a `realm` is present in the WWW-Authenticate headers, tries that realm as the resource
 
 4. If a token is obtained, it outputs credentials in the format Git expects:
@@ -89,6 +97,16 @@ Default: `visualstudio.com,dev.azure.com,goproxyprod.goms.io`
    password_expiry_utc=<unix_timestamp>
    ```
 
+## Commands
+
+- `init` - Configure git credential helpers
+- `exports` - Output environment variable exports for GOAUTH
+- `get` - Get credentials (called by git automatically)
+- `store` - No-op (credentials managed by Azure CLI)
+- `erase` - No-op (credentials managed by Azure CLI)
+
+Use `-v`, `-vv`, or `-vvv` for increasing verbosity levels.
+
 ## Troubleshooting
 
 ### Verify Azure CLI is authenticated
@@ -100,13 +118,19 @@ az account show
 ### Test the helper manually
 
 ```bash
-echo -e "protocol=https\nhost=msazure.visualstudio.com\n" | git-credential-azure-cli get
+echo -e "protocol=https\nhost=dev.azure.com\n" | git-credential-azure-cli get
+```
+
+### Debug mode
+
+```bash
+echo -e "protocol=https\nhost=dev.azure.com\n" | git-credential-azure-cli -vvv get
 ```
 
-### Check allowed domains configuration
+### Check configuration
 
 ```bash
-git config --get credential.azureCliHelper.allowedDomains
+git config --global --get-all azureCliCredentialHelper.allowedDomain
 ```
 
 ## License