git credential-* helpers are meant to be used internally by git itself and follow a specific interface.
When the helper is run with the
get subcommand, it waits for input on stdin and expects to read a series of "key=value" lines. For example,
host=github.com. This is how git tells the helper which credentials are needed.
When you run a program directly in a terminal, its stdin is just connected to keyboard input. After the first Enter keypress, the tool is already running but waiting for keyboard input, exactly like tools such as
After the second keypress, the program reads an empty line and treats it as an "end of input" indicator, i.e. that no more key=value lines will be entered. At this point it searches the keychain and finds whichever entry it thinks matches your "provided" filter.