Let’s go over the attack vectors involved for different common workflows. I’m going to use the specific case of how I use git.

1. Store passwords in pass, have them memorized and type them anew in every session to get a transient session token
2. Store passwords in pass, store API tokens in OSX keychain

Which is more secure? The thing that you’re saying is better-protected because it’s limited, doesn’t exist in workflow #1. They’re not limited to push and pull, because they’re limited to nothing.

If someone gets my password in case #2, they can still do anything. That’s my central point – you haven’t removed any point of vulnerability, you’ve created another point of vulnerability and then mandated that people use it. And this isn’t an abstract issue; there are several compromises of github data stemming from people’s API tokens being compromised. My assertion is that in some of those cases, using case #1 instead of storing the API tokens would have prevented the compromise. Maybe I am wrong in that. I know that password compromises happen too. But my point is, you’re not preventing anybody from getting their password compromised. Someone can still steal my password out of pass. Someone who puts a keylogger on my computer will have the passwords to my OSX keychain and pass, both. You’re simply introducing another point of compromise, additional to password compromises, and mandated storage of your new password-equivalents on storage where before you at least have the option of keeping them in your memory once you’re familiar with them, and typing them every time.