Put the terminal back when a signal ends the mnemonic prompt (closes #91)

A SIGINT, SIGTERM or SIGHUP at the mnemonic prompt killed the tool
with echo still off. The prompt now catches them from before echo goes
off and reads the line in a goroutine. Once the line is read or a
signal arrives, it puts the terminal settings back and stops catching;
if a signal has arrived by then, it sends the tool the same signal
again, so the tool is still ended by it (130 for SIGINT in a shell).
A test sends SIGINT at the prompt on a pseudo-terminal.

The signals package moves from internal/cli to internal/signals, since
the mnemonic prompt now uses it as well.

Untested: a signal that comes just as the line is read.

Model: opus-5-5

README.md

@@ -65,10 +65,12 @@ calls into `internal/`. The packages there are:
   and decrypts with it.
 - `internal/childmnemonic` derives a child mnemonic from the main one using
   BIP-85's own mnemonic application.
+- `internal/signals` catches SIGINT, SIGTERM and SIGHUP for the commands that
+  clean up before they end, and for the mnemonic prompt, which puts the terminal
+  back before the signal ends the tool.
 - `internal/cli` builds the cobra command tree and runs it. Under it,
-  `cli/options` holds the flags every command shares, `cli/signals` catches
-  SIGINT, SIGTERM and SIGHUP for the commands that clean up before they end, and
-  `cli/ssh`, `cli/age` and `cli/mnemonic` are the command groups.
+  `cli/options` holds the flags every command shares, and `cli/ssh`, `cli/age`
+  and `cli/mnemonic` are the command groups.
 - `internal/bip39` is a copy of `github.com/tyler-smith/go-bip39` v1.1.0,
   trimmed to what keyfunc uses.
 
@@ -116,7 +118,11 @@ order; the first one found wins:
 2. Environment variable `KEYFUNC_MNEMONIC_COMMAND`: the same, as a shell command
    held in the environment.
 3. Environment variable `KEYFUNC_MNEMONIC`: the mnemonic itself.
-4. A prompt on the terminal with echo turned off.
+4. A prompt on the terminal with echo turned off. The mnemonic is what is typed
+   up to Enter, and echo is turned back on once it is read. Ctrl-D with nothing
+   typed ends the prompt at once and leaves the mnemonic empty, so the tool
+   refuses it and exits with status 1. After text has been typed, Ctrl-D has to
+   be pressed twice to end the prompt, and the text typed is the mnemonic.
 
 If none of these is available and standard input is not a terminal, the tool
 refuses and exits with status 1. A mnemonic that is empty, does not have 12, 15,
@@ -126,10 +132,12 @@ the list is named by its position, never printed. Keys are derived from the
 mnemonic's words joined by single spaces, whatever whitespace is around or
 between them, so one word per line, tabs or extra spaces give the same keys.
 
-The key index, `--words`, the `--to` recipients and the file `age encrypt` or
-`age decrypt` is given to read are checked before the mnemonic is looked for, so
-a run refused for one of them never prompts for the mnemonic or runs the
-mnemonic command.
+The key index, `--words`, the `--to` recipients, the file `age encrypt` or
+`age decrypt` is given to read and its `-o` path are checked before the mnemonic
+is looked for, so a run refused for one of them never prompts for the mnemonic
+or runs the mnemonic command. An `-o` path is refused at that point if it is a
+directory or a symlink to one, if its directory is missing or is not a
+directory, or if it is a symlink that points at nothing.
 
 `KEYFUNC_MNEMONIC` and `KEYFUNC_MNEMONIC_COMMAND` are removed from the
 environment before the mnemonic command, the system `ssh` (`keyfunc ssh to`) and
@@ -283,7 +291,9 @@ or a device, such as `/dev/null`, is written to directly.
 
 Decrypts the file (or standard input) with the derived identity. Output goes to
 `-o`, which is treated as for `encrypt`, or standard output. If the identity is
-not one of the recipients, the tool says so and exits with status 1.
+not one of the recipients, the tool says so and exits with status 1. The text
+form needs no flag, and up to 1024 bytes of blank lines in front of it are
+skipped, as `age` skips them.
 
 ## Derived mnemonics: `keyfunc mnemonic`
 
@@ -320,10 +330,11 @@ passes through `ssh`'s own exit status.
 
 SIGINT, SIGTERM and SIGHUP end any command at once, at the mnemonic prompt too,
 with the status a shell gives a program killed by that signal (130 for SIGINT).
-While `age encrypt -o` or `age decrypt -o` is writing a new file or replacing a
-regular one, the signal makes it remove the unfinished file, leave a file
-already at the named path as it was, and exit with status 1. That holds for a
-signal that has reached `keyfunc` when its input ends; a later one leaves the
+At the prompt the terminal's settings are put back as they were first, so echo
+is on again. While `age encrypt -o` or `age decrypt -o` is writing a new file or
+replacing a regular one, the signal makes it remove the unfinished file, leave a
+file already at the named path as it was, and exit with status 1. That holds for
+a signal that has reached `keyfunc` when its input ends; a later one leaves the
 whole file in place. Ctrl-C on a pipeline ends the input at the same moment, and
 on Linux `keyfunc` sees the signal first, though no system promises that. A
 named pipe or a device at the `-o` path, or a path that is the same file as

go.mod

@@ -6,9 +6,11 @@ require (
 	filippo.io/age v1.3.2
 	github.com/btcsuite/btcd v0.25.0
 	github.com/btcsuite/btcd/btcutil v1.2.0
+	github.com/creack/pty v1.1.25-0.20260601142114-9246436fffe8 // v1.1.24's Open can return another pty's terminal
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.12.1
 	golang.org/x/crypto v0.57.0
+	golang.org/x/sys v0.48.0
 	golang.org/x/term v0.46.0
 	sneak.berlin/go/secret v0.0.0-20261007105610-ef0ae90768c8
 )
@@ -22,5 +24,4 @@ require (
 	github.com/kcalvinalvin/anet v0.0.0-20251112173137-d8ddc1f6dbee // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/sys v0.48.0 // indirect
 )

go.sum

@@ -13,6 +13,8 @@ github.com/btcsuite/btcd/btcutil v1.2.0/go.mod h1:/Taflm113pYjUpbWKKQEfa6XOtI/+W
 github.com/btcsuite/btcd/chaincfg/chainhash v1.2.0 h1:yMIg99+4aBvqfl/HzJRKfxTX9rGfikoI9uvFzterhc8=
 github.com/btcsuite/btcd/chaincfg/chainhash v1.2.0/go.mod h1:Y72Ren9gfhlEvnwnT78BGcSNO2UMphTKLn9AorF+5rg=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/creack/pty v1.1.25-0.20260601142114-9246436fffe8 h1:CY3gjC7naqYGLMiywvj3suPfa1i0p/QEr7o8ujxL/2M=
+github.com/creack/pty v1.1.25-0.20260601142114-9246436fffe8/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc=

internal/agekey/agekey.go

@@ -4,6 +4,7 @@ package agekey
 
 import (
 	"bufio"
+	"bytes"
 	"errors"
 	"fmt"
 	"io"
@@ -187,12 +188,18 @@ func (k *Key) Decrypt(dst io.Writer, src io.Reader) error {
 }
 
 // unarmored strips the text form when the input begins with the line
-// that starts one, and leaves binary input alone.
+// that starts one, and leaves binary input alone. Like age, it looks
+// past up to 1024 bytes of whitespace for that line, and the text form
+// reader skips blank lines in front of it.
 func unarmored(src io.Reader) io.Reader {
+	const maxWhitespace = 1024
+
 	buffered := bufio.NewReader(src)
 
-	start, err := buffered.Peek(len(armor.Header))
-	if err == nil && string(start) == armor.Header {
+	// A shorter input gives an error along with all of it, which is
+	// enough to look at.
+	start, _ := buffered.Peek(maxWhitespace + len(armor.Header))
+	if bytes.HasPrefix(bytes.TrimSpace(start), []byte(armor.Header)) {
 		return armor.NewReader(buffered)
 	}
 

internal/agekey/agekey_test.go

@@ -2,6 +2,7 @@ package agekey_test
 
 import (
 	"bytes"
+	"io"
 	"strings"
 	"testing"
 
@@ -99,6 +100,27 @@ func TestTheArmoredFormIsText(t *testing.T) {
 	))
 }
 
+func TestTheTextFormIsReadWithWhitespaceInFront(t *testing.T) {
+	t.Parallel()
+
+	key := forIndex(t, 0)
+
+	var sealed bytes.Buffer
+
+	err := key.Encrypt(&sealed, strings.NewReader("hello"), nil, true)
+	require.NoError(t, err)
+
+	// A blank line and a line of two spaces, as pasting can leave. age
+	// refuses spaces on the first line of the text form itself, and so
+	// does this.
+	pasted := io.MultiReader(strings.NewReader("\n  \n"), &sealed)
+
+	var opened bytes.Buffer
+
+	require.NoError(t, key.Decrypt(&opened, pasted))
+	require.Equal(t, "hello", opened.String())
+}
+
 func TestAFileForSomebodyElseIsRefused(t *testing.T) {
 	t.Parallel()
 

internal/cli/age/age.go

@@ -11,12 +11,13 @@ import (
 	"os"
 	"os/signal"
 	"path/filepath"
+	"syscall"
 
 	"github.com/spf13/cobra"
 	"sneak.berlin/go/keyfunc/internal/agekey"
 	"sneak.berlin/go/keyfunc/internal/cli/options"
-	"sneak.berlin/go/keyfunc/internal/cli/signals"
 	"sneak.berlin/go/keyfunc/internal/derive"
+	"sneak.berlin/go/keyfunc/internal/signals"
 )
 
 // ErrInterrupted is returned when SIGINT, SIGTERM or SIGHUP has been
@@ -108,9 +109,9 @@ func decrypt() *cobra.Command {
 }
 
 // runEncrypt encrypts to the derived recipient and any others given.
-// The recipients are read and the input opened before the key is
-// derived, so that a run refused for either never asks for the
-// mnemonic.
+// The recipients are read, the -o path looked at and the input opened
+// before the key is derived, so that a run refused for any of them
+// never asks for the mnemonic.
 func runEncrypt(cmd *cobra.Command, args []string) error {
 	names, err := cmd.Flags().GetStringArray("to")
 	if err != nil {
@@ -127,6 +128,11 @@ func runEncrypt(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("reading the armor flag: %w", err)
 	}
 
+	err = checkOutput(cmd)
+	if err != nil {
+		return err
+	}
+
 	src, closeSrc, err := input(cmd, args)
 	if err != nil {
 		return err
@@ -144,9 +150,14 @@ func runEncrypt(cmd *cobra.Command, args []string) error {
 	})
 }
 
-// runDecrypt decrypts with the derived identity. The input is opened
-// before the key is derived, as for runEncrypt.
+// runDecrypt decrypts with the derived identity. The -o path is looked
+// at and the input opened before the key is derived, as for runEncrypt.
 func runDecrypt(cmd *cobra.Command, args []string) error {
+	err := checkOutput(cmd)
+	if err != nil {
+		return err
+	}
+
 	src, closeSrc, err := input(cmd, args)
 	if err != nil {
 		return err
@@ -225,6 +236,52 @@ func input(cmd *cobra.Command, args []string) (io.Reader, func(), error) {
 	return file, func() { _ = file.Close() }, nil
 }
 
+// checkOutput refuses an -o path that output could not write to,
+// before anything is written: a directory or a symlink to one, one
+// whose directory is missing or is not a directory, or a symlink that
+// points at nothing. It creates nothing; output looks at the path again
+// when it writes.
+func checkOutput(cmd *cobra.Command) error {
+	name, err := cmd.Flags().GetString("output")
+	if err != nil {
+		return fmt.Errorf("reading the output file: %w", err)
+	}
+
+	if name == "" {
+		return nil
+	}
+
+	info, err := os.Lstat(name)
+
+	switch {
+	case errors.Is(err, fs.ErrNotExist):
+		// replace makes its new file in this directory. When the
+		// directory is a file instead, os.Lstat has already failed with
+		// ENOTDIR, the case below.
+		directory := filepath.Dir(name)
+
+		_, err = os.Stat(directory)
+		if err != nil {
+			return fmt.Errorf("looking at %s: %w", directory, err)
+		}
+
+		return nil
+	case err != nil:
+		return fmt.Errorf("looking at %s: %w", name, err)
+	case info.Mode().Type() == fs.ModeSymlink:
+		info, err = os.Stat(name)
+		if err != nil {
+			return fmt.Errorf("following %s: %w", name, err)
+		}
+	}
+
+	if info.IsDir() {
+		return fmt.Errorf("writing to %s: %w", name, syscall.EISDIR)
+	}
+
+	return nil
+}
+
 // output has the work write to the named path, going by what is there
 // without following a final symlink:
 //

internal/cli/age_test.go

@@ -108,6 +108,44 @@ func TestAnInputFileThatCannotBeOpenedIsRefused(t *testing.T) {
 	}
 }
 
+// The mnemonic command fails in these runs, so the refusal of the -o
+// path shows that it was looked at before the mnemonic was looked for.
+func TestAnOutputPathThatCannotBeWrittenIsRefused(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, failingMnemonicCommand)
+
+	plain := written(t, "notes.txt", "the secret\n")
+	directory := t.TempDir()
+	missing := filepath.Join(directory, "missing")
+	dangling := filepath.Join(directory, "dangling")
+	require.NoError(t, os.Symlink(missing, dangling))
+
+	toDirectory := filepath.Join(directory, "to-directory")
+	require.NoError(t, os.Symlink(t.TempDir(), toDirectory))
+
+	refusals := map[string]error{
+		filepath.Join(missing, "notes.age"): fs.ErrNotExist,
+		filepath.Join(plain, "notes.age"):   syscall.ENOTDIR,
+		dangling:                            fs.ErrNotExist,
+		directory:                           syscall.EISDIR,
+		toDirectory:                         syscall.EISDIR,
+	}
+
+	for name, refusal := range refusals {
+		out, err := execute(t, "age", "encrypt", "-o", name, plain)
+		require.ErrorIs(t, err, refusal, name)
+		require.Empty(t, out, name)
+
+		out, err = execute(t, "age", "decrypt", "-o", name, plain)
+		require.ErrorIs(t, err, refusal, name)
+		require.Empty(t, out, name)
+	}
+
+	// Nothing was made beside the two symlinks.
+	left, err := os.ReadDir(directory)
+	require.NoError(t, err)
+	require.Len(t, left, 2)
+}
+
 func TestAFileForAnotherKeyIsRefused(t *testing.T) {
 	t.Setenv(mnemonic.Variable, example())
 

internal/cli/cli.go

@@ -87,6 +87,9 @@ func init() {
 // still runs, and "age encrypt -o" and "age decrypt -o" while they
 // write a new file to rename over the named one, so the unfinished file
 // is removed.
+//
+// At the mnemonic prompt the signal is caught only to put the terminal
+// back, and then ends the tool as above.
 func Main() int {
 	err := Root().Execute()
 	if err == nil {

internal/cli/prompt_test.go

@@ -0,0 +1,133 @@
+package cli_test
+
+import (
+	"bufio"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/creack/pty"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/term"
+	"sneak.berlin/go/keyfunc/internal/mnemonic"
+)
+
+// TestEndOfInputAtThePromptEndsTheTool starts "age pub" and, at the
+// prompt, types Ctrl-D. The tool has to end with status 1, say that the
+// mnemonic is empty, and leave the terminal set as it found it, so with
+// echo on again.
+//
+// pty.Open returns the two ends of a new terminal: tty is the end the
+// tool uses as its terminal, and ptmx the end the test reads what the
+// terminal shows from and types into.
+func TestEndOfInputAtThePromptEndsTheTool(t *testing.T) {
+	t.Setenv(mnemonic.Variable, "")
+	t.Setenv(mnemonic.CommandVariable, "")
+
+	ptmx, tty, err := pty.Open()
+	require.NoError(t, err)
+
+	defer func() { _ = ptmx.Close() }()
+	defer func() { _ = tty.Close() }()
+
+	before, err := term.GetState(int(tty.Fd()))
+	require.NoError(t, err)
+
+	command, terminal := prompted(t, ptmx, tty)
+
+	_, err = ptmx.WriteString("\x04") // Ctrl-D
+	require.NoError(t, err)
+
+	waitForTool(t, "Ctrl-D at the prompt", command)
+	require.Equal(t, failedStatus, command.ProcessState.ExitCode())
+
+	after, err := term.GetState(int(tty.Fd()))
+	require.NoError(t, err)
+	require.Equal(t, before, after, "the terminal settings were not restored")
+
+	// With the tool ended and this end closed too, ptmx gives what is
+	// left on the terminal and then an error.
+	require.NoError(t, tty.Close())
+
+	said, _ := io.ReadAll(terminal)
+	require.Contains(t, string(said), mnemonic.ErrEmpty.Error())
+}
+
+// TestASignalAtThePromptPutsTheTerminalBack starts "age pub" and, at
+// the prompt, once the tool has turned echo off, sends it SIGINT. The
+// tool has to be ended by SIGINT, which a shell reports as status 130,
+// and leave the terminal set as it found it, so with echo on again.
+func TestASignalAtThePromptPutsTheTerminalBack(t *testing.T) {
+	t.Setenv(mnemonic.Variable, "")
+	t.Setenv(mnemonic.CommandVariable, "")
+
+	ptmx, tty, err := pty.Open()
+	require.NoError(t, err)
+
+	defer func() { _ = ptmx.Close() }()
+	defer func() { _ = tty.Close() }()
+
+	before, err := term.GetState(int(tty.Fd()))
+	require.NoError(t, err)
+
+	command, _ := prompted(t, ptmx, tty)
+
+	// The prompt is shown just before echo is turned off, and the
+	// signal has to come while it is off.
+	require.Eventually(t, func() bool {
+		now, err := term.GetState(int(tty.Fd()))
+
+		return err == nil && !assert.ObjectsAreEqual(before, now)
+	}, 5*time.Second, 5*time.Millisecond, "the tool did not turn echo off")
+
+	require.NoError(t, command.Process.Signal(syscall.SIGINT))
+	waitForTool(t, "SIGINT at the prompt", command)
+
+	status, ok := command.ProcessState.Sys().(syscall.WaitStatus)
+	require.True(t, ok)
+	require.True(t, status.Signaled(), "the tool was not ended by the signal")
+	require.Equal(t, syscall.SIGINT, status.Signal())
+
+	after, err := term.GetState(int(tty.Fd()))
+	require.NoError(t, err)
+	require.Equal(t, before, after, "the terminal settings were not restored")
+}
+
+// prompted starts "age pub" as a subprocess, for a test that has set no
+// mnemonic, with the terminal's tty end on all three streams, and
+// returns once the tool has shown the prompt. The reader returned reads
+// what the terminal shows from its ptmx end. Reading ptmx stops at a
+// deadline, so a prompt that never comes fails the test instead of
+// hanging it.
+func prompted(t *testing.T, ptmx, tty *os.File) (*exec.Cmd, *bufio.Reader) {
+	t.Helper()
+
+	require.NoError(t, ptmx.SetReadDeadline(time.Now().Add(10*time.Second)))
+
+	//nolint:gosec // this test's own binary as the tool
+	command := exec.CommandContext(t.Context(), os.Args[0], "age", "pub")
+
+	command.Env = append(os.Environ(), runAsTool+"=1")
+	command.Stdin = tty
+	command.Stdout = tty
+	command.Stderr = tty
+
+	require.NoError(t, command.Start())
+
+	var shown string
+
+	terminal := bufio.NewReader(ptmx)
+	for !strings.HasSuffix(shown, "mnemonic: ") {
+		char, err := terminal.ReadByte()
+		require.NoError(t, err, "the tool did not prompt: %q", shown)
+
+		shown += string(char)
+	}
+
+	return command, terminal
+}

internal/cli/ssh/install.go

@@ -15,8 +15,8 @@ import (
 	"time"
 
 	"github.com/spf13/cobra"
-	"sneak.berlin/go/keyfunc/internal/cli/signals"
 	"sneak.berlin/go/keyfunc/internal/mnemonic"
+	"sneak.berlin/go/keyfunc/internal/signals"
 )
 
 // Where the key goes on the host and what the file it arrives in is

internal/cli/ssh/to.go

@@ -10,8 +10,8 @@ import (
 	"syscall"
 
 	"github.com/spf13/cobra"
-	"sneak.berlin/go/keyfunc/internal/cli/signals"
 	"sneak.berlin/go/keyfunc/internal/mnemonic"
+	"sneak.berlin/go/keyfunc/internal/signals"
 )
 
 // StatusError says the tool should end with the status ssh ended with.

internal/mnemonic/mnemonic.go

@@ -136,7 +136,7 @@ func ask() (string, error) {
 
 	fmt.Fprint(os.Stderr, "mnemonic: ")
 
-	typed, err := term.ReadPassword(fd)
+	typed, err := readWithoutEcho()
 
 	fmt.Fprintln(os.Stderr)
 
@@ -144,7 +144,7 @@ func ask() (string, error) {
 		return "", fmt.Errorf("reading the mnemonic: %w", err)
 	}
 
-	return checked(string(typed))
+	return checked(typed)
 }
 
 // checked joins the words with single spaces, whatever whitespace

internal/mnemonic/prompt_notunix.go

@@ -0,0 +1,18 @@
+//go:build !aix && !darwin && !dragonfly && !freebsd && !linux && !netbsd && !openbsd && !solaris && !zos
+
+package mnemonic
+
+import (
+	"os"
+
+	"golang.org/x/term"
+)
+
+// readWithoutEcho reads one line from the terminal on standard input
+// with echo turned off, through term.ReadPassword, on the systems
+// prompt_unix.go is not built for, such as Windows.
+func readWithoutEcho() (string, error) {
+	typed, err := term.ReadPassword(int(os.Stdin.Fd()))
+
+	return string(typed), err
+}

internal/mnemonic/prompt_unix.go

@@ -0,0 +1,111 @@
+//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris || zos
+
+package mnemonic
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/signal"
+
+	"golang.org/x/sys/unix"
+	"sneak.berlin/go/keyfunc/internal/signals"
+)
+
+// readWithoutEcho reads one line from the terminal on standard input
+// with echo turned off. The line ends at a newline or at the end of
+// input (Ctrl-D). The terminal is set as term.ReadPassword sets it;
+// ReadPassword itself is not used here because it never sees the end
+// of input and goes on waiting.
+//
+// Meanwhile SIGINT, SIGTERM and SIGHUP are caught, as signals.Notify
+// catches them. One that has arrived by the time the line is read puts
+// the terminal back as it was and then ends the tool, as it would have
+// ended it if it were not caught.
+func readWithoutEcho() (string, error) {
+	fd := int(os.Stdin.Fd())
+
+	settings, err := unix.IoctlGetTermios(fd, ioctlReadTermios)
+	if err != nil {
+		return "", fmt.Errorf("reading the terminal settings: %w", err)
+	}
+
+	// Caught from before echo is turned off, so that no signal can end
+	// the tool with echo off.
+	received := make(chan os.Signal, 1)
+	signals.Notify(received)
+
+	defer signal.Stop(received)
+
+	hidden := *settings
+	hidden.Lflag &^= unix.ECHO
+	hidden.Lflag |= unix.ICANON | unix.ISIG
+	hidden.Iflag |= unix.ICRNL
+
+	err = unix.IoctlSetTermios(fd, ioctlWriteTermios, &hidden)
+	if err != nil {
+		return "", fmt.Errorf("turning echo off: %w", err)
+	}
+
+	var (
+		typed  string
+		failed error
+	)
+
+	read := make(chan struct{})
+
+	go func() {
+		// With ICANON set, a read from the terminal returns at most one
+		// line, so the buffer takes nothing past the newline.
+		typed, failed = bufio.NewReader(os.Stdin).ReadString('\n')
+
+		close(read)
+	}()
+
+	var ending os.Signal
+
+	select {
+	case <-read:
+	case ending = <-received:
+	}
+
+	// The terminal is put back while the signals are still caught, so
+	// that none can end the tool with echo off. Stop returns only once
+	// every signal the tool has received has been handed over, so one
+	// that came as the line was read is in received by then.
+	_ = unix.IoctlSetTermios(fd, ioctlWriteTermios, settings)
+
+	signal.Stop(received)
+
+	if len(received) > 0 {
+		ending = <-received
+	}
+
+	if ending != nil {
+		return "", endBy(ending)
+	}
+
+	if errors.Is(failed, io.EOF) {
+		return typed, nil
+	}
+
+	return typed, failed
+}
+
+// endBy sends the tool the signal again, now that nothing catches it,
+// so that it ends the tool, and waits for that. It returns only if the
+// signal could not be sent.
+func endBy(ending os.Signal) error {
+	tool, err := os.FindProcess(os.Getpid())
+	if err == nil {
+		err = tool.Signal(ending)
+	}
+
+	if err != nil {
+		return fmt.Errorf("ending the tool by %s: %w", ending, err)
+	}
+
+	select {}
+}

internal/mnemonic/termios_bsd.go

@@ -0,0 +1,12 @@
+//go:build darwin || dragonfly || freebsd || netbsd || openbsd
+
+package mnemonic
+
+import "golang.org/x/sys/unix"
+
+// The requests that read and set the terminal settings, as
+// golang.org/x/term names them.
+const (
+	ioctlReadTermios  = unix.TIOCGETA
+	ioctlWriteTermios = unix.TIOCSETA
+)

internal/mnemonic/termios_other.go

@@ -0,0 +1,12 @@
+//go:build aix || linux || solaris || zos
+
+package mnemonic
+
+import "golang.org/x/sys/unix"
+
+// The requests that read and set the terminal settings, as
+// golang.org/x/term names them.
+const (
+	ioctlReadTermios  = unix.TCGETS
+	ioctlWriteTermios = unix.TCSETS
+)

internal/signals/signals.go

@@ -1,5 +1,9 @@
-// Package signals catches the signals that end the tool, for the
-// commands that clean up before they end.
+// Package signals catches SIGINT, SIGTERM and SIGHUP, the signals that
+// end the tool, for the commands that clean up before they end and for
+// the mnemonic prompt, which puts the terminal back before the signal
+// ends the tool. Go keeps an inherited ignore only for SIGHUP and
+// SIGINT, so a SIGTERM the tool was started with set to be ignored is
+// not left ignored.
 package signals
 
 import (
@@ -11,8 +15,8 @@ import (
 
 // Context is signal.NotifyContext for SIGINT, SIGTERM and SIGHUP: the
 // context it returns is cancelled when one of them arrives, and stop
-// stops catching them. It leaves out any of the three the tool was
-// started with set to be ignored, as nohup does with SIGHUP, because
+// stops catching them. It leaves out SIGHUP or SIGINT if the tool was
+// started with it set to be ignored, as nohup does with SIGHUP, because
 // catching a signal turns an ignored one back on and would end a run
 // that was meant to survive it.
 func Context(parent context.Context) (context.Context, context.CancelFunc) {
@@ -37,8 +41,8 @@ func Notify(c chan<- os.Signal) {
 	}
 }
 
-// caught returns those of SIGINT, SIGTERM and SIGHUP that the tool was
-// not started with set to be ignored.
+// caught returns SIGINT, SIGTERM and SIGHUP, less any that
+// signal.Ignored reports as ignored.
 func caught() []os.Signal {
 	endings := []os.Signal{syscall.SIGINT, syscall.SIGTERM, syscall.SIGHUP}
 	kept := make([]os.Signal, 0, len(endings))