Function readSecretInput

cli/cliui/prompt.go:212–263

readSecretInput reads secret input from the terminal rune-by-rune, masking each character with an asterisk.

(f *os.File, w io.Writer)

// readSecretInput reads secret input from the terminal rune-by-rune,
// masking each character with an asterisk.
func readSecretInput(f *os.File, w io.Writer) (string, error) {
	// Put terminal into raw mode (no echo, no line buffering).
	oldState, err := pty.MakeInputRaw(f.Fd())
	if err != nil {
		return "", err
	}
	defer func() {
		_ = pty.RestoreTerminal(f.Fd(), oldState)
	}()

	reader := bufio.NewReader(f)
	var runes []rune

	for {
		r, _, err := reader.ReadRune()
		if err != nil {
			return "", err
		}

		switch {
		case r == '\r' || r == '\n':
			// Finish on Enter
			if _, err := fmt.Fprint(w, "\r\n"); err != nil {
				return "", err
			}
			return string(runes), nil

		case r == 3:
			// Ctrl+C
			return "", ErrCanceled

		case r == 127 || r == '\b':
			// Backspace/Delete: remove last rune
			if len(runes) > 0 {
				// Erase the last '*' on the screen
				if _, err := fmt.Fprint(w, "\b \b"); err != nil {
					return "", err
				}
				runes = runes[:len(runes)-1]
			}

		default:
			// Only mask printable, non-control runes
			if !unicode.IsControl(r) {
				runes = append(runes, r)
				if _, err := fmt.Fprint(w, "*"); err != nil {
					return "", err
				}
			}
		}
	}
}