fix: Prevent hanging in non-interactive environments - Add terminal detection to readPassphrase, readSecurePassphrase, and readLineFromStdin - Return clear error messages when stderr is not a terminal instead of hanging - Improves automation and CI/CD reliability

internal/secret/crypto.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"fmt"
 	"io"
+	"os"
 	"syscall"
 
 	"filippo.io/age"
@@ -12,21 +13,34 @@ import (
 
 // encryptToRecipient encrypts data to a recipient using age
 func encryptToRecipient(data []byte, recipient age.Recipient) ([]byte, error) {
+	Debug("encryptToRecipient starting", "data_length", len(data))
+
 	var buf bytes.Buffer
+	Debug("Creating age encryptor")
 	w, err := age.Encrypt(&buf, recipient)
 	if err != nil {
+		Debug("Failed to create encryptor", "error", err)
 		return nil, fmt.Errorf("failed to create encryptor: %w", err)
 	}
+	Debug("Created age encryptor successfully")
 
+	Debug("Writing data to encryptor")
 	if _, err := w.Write(data); err != nil {
+		Debug("Failed to write data to encryptor", "error", err)
 		return nil, fmt.Errorf("failed to write data: %w", err)
 	}
+	Debug("Wrote data to encryptor successfully")
 
+	Debug("Closing encryptor")
 	if err := w.Close(); err != nil {
+		Debug("Failed to close encryptor", "error", err)
 		return nil, fmt.Errorf("failed to close encryptor: %w", err)
 	}
+	Debug("Closed encryptor successfully")
 
-	return buf.Bytes(), nil
+	result := buf.Bytes()
+	Debug("encryptToRecipient completed successfully", "result_length", len(result))
+	return result, nil
 }
 
 // decryptWithIdentity decrypts data with an identity using age
@@ -67,25 +81,24 @@ func decryptWithPassphrase(encryptedData []byte, passphrase string) ([]byte, err
 // readPassphrase reads a passphrase securely from the terminal without echoing
 // This version is for unlocking and doesn't require confirmation
 func readPassphrase(prompt string) (string, error) {
+	// Check if stderr is a terminal - if not, we can't prompt interactively
+	if !term.IsTerminal(int(syscall.Stderr)) {
+		return "", fmt.Errorf("cannot prompt for passphrase: stderr is not a terminal (running in non-interactive mode)")
+	}
+
 	// Check if stdin is a terminal
 	if !term.IsTerminal(int(syscall.Stdin)) {
-		// Not a terminal - fall back to regular input
-		fmt.Print(prompt)
-		var passphrase string
-		_, err := fmt.Scanln(&passphrase)
-		if err != nil {
-			return "", fmt.Errorf("failed to read passphrase: %w", err)
-		}
-		return passphrase, nil
+		// Not a terminal - use shared line reader to avoid buffering conflicts
+		return readLineFromStdin(prompt)
 	}
 
 	// Terminal input - use secure password reading
-	fmt.Print(prompt)
+	fmt.Fprint(os.Stderr, prompt) // Write prompt to stderr, not stdout
 	passphrase, err := term.ReadPassword(int(syscall.Stdin))
 	if err != nil {
 		return "", fmt.Errorf("failed to read passphrase: %w", err)
 	}
-	fmt.Println() // Print newline since ReadPassword doesn't echo
+	fmt.Fprintln(os.Stderr) // Print newline to stderr since ReadPassword doesn't echo
 
 	if len(passphrase) == 0 {
 		return "", fmt.Errorf("passphrase cannot be empty")