Add ask_masked for masked input prompts

Add `CLI::UI::Prompt.ask_masked` (and `CLI::UI.ask_masked`) which
displays `*` for each character typed, giving visual feedback that
input is being received. This is useful for token/secret prompts
where completely invisible input (ask_password) is disorienting.

Builds on the shared `read_secret` infrastructure from the previous
commit.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sambostock

lib/cli/ui.rb

@@ -132,6 +132,17 @@ def ask_password(question)
         CLI::UI::Prompt.ask_password(question)
       end
 
+      # Convenience Method for +CLI::UI::Prompt.ask_masked+
+      #
+      # ==== Attributes
+      #
+      # * +question+ - question to ask
+      #
+      #: (String question) -> String
+      def ask_masked(question)
+        CLI::UI::Prompt.ask_masked(question)
+      end
+
       # Convenience Method to resolve text using +CLI::UI::Formatter.format+
       # Check +CLI::UI::Formatter::SGR_MAP+ for available formatting options
       #

lib/cli/ui/prompt.rb

@@ -161,6 +161,20 @@ def ask_password(question)
           read_secret(question, mask: false)
         end
 
+        # Asks the user for a single-line answer, masking each character with '*' as they type.
+        # Unlike +ask_password+ which shows no feedback, this method provides visual feedback
+        # by printing a '*' for each character entered.
+        # Supports backspace to delete characters and Ctrl-C to abort.
+        #
+        # ==== Return Value
+        #
+        # The input string.
+        # If the user simply presses "Enter" without typing anything, this will return an empty string.
+        #: (String question) -> String
+        def ask_masked(question)
+          read_secret(question, mask: true)
+        end
+
         # Asks the user a yes/no question.
         # Can use arrows, y/n, numbers (1/2), and vim bindings to control
         #

test/cli/ui/prompt_test.rb

@@ -416,6 +416,8 @@ def test_read_char_returns_only_the_next_read_char
         assert_output_includes('c'.inspect)
       end
 
+      # ask_password tests
+
       def test_ask_password_happy_path
         run_in_process('puts "--#{CLI::UI::Prompt.ask_password("Password: ")}--"')
         write("secret\n")
@@ -473,6 +475,78 @@ def test_ask_password_sigint
         assert_output_includes('sentinel')
       end
 
+      # ask_masked tests
+
+      def test_ask_masked_shows_stars
+        run_in_process('puts "--#{CLI::UI::Prompt.ask_masked("Token: ")}--"')
+        write("secret\n")
+        clean_up do
+          output = @stdout.read
+          assert_includes(output, '******')
+          assert_includes(output, '--secret--')
+        end
+      end
+
+      def test_ask_masked_supports_backspace
+        run_in_process('puts "--#{CLI::UI::Prompt.ask_masked("Token: ")}--"')
+        write("abc\u007Fd\n")
+        assert_output_includes('--abd--')
+      end
+
+      def test_ask_masked_supports_backspace_0x08
+        run_in_process('puts "--#{CLI::UI::Prompt.ask_masked("Token: ")}--"')
+        write("abc\bd\n")
+        assert_output_includes('--abd--')
+      end
+
+      def test_ask_masked_backspace_on_empty_input
+        run_in_process('puts "--#{CLI::UI::Prompt.ask_masked("Token: ")}--"')
+        write("\u007Fabc\n")
+        assert_output_includes('--abc--')
+      end
+
+      def test_ask_masked_multiple_backspaces
+        run_in_process('puts "--#{CLI::UI::Prompt.ask_masked("Token: ")}--"')
+        write("abcd\u007F\u007F\u007Fe\n")
+        assert_output_includes('--ae--')
+      end
+
+      def test_ask_masked_empty_input
+        run_in_process('puts "--#{CLI::UI::Prompt.ask_masked("Token: ")}--"')
+        write("\n")
+        assert_output_includes('----')
+      end
+
+      def test_ask_masked_carriage_return
+        run_in_process('puts "--#{CLI::UI::Prompt.ask_masked("Token: ")}--"')
+        write("secret\r")
+        assert_output_includes('--secret--')
+      end
+
+      def test_ask_masked_sigint
+        jruby_skip('SIGINT shuts down the JVM instead of raising Interrupt')
+
+        run_in_process(<<~RUBY)
+          begin
+            CLI::UI::Prompt.ask_masked("Token: ")
+          rescue Interrupt
+            puts 'sentinel'
+          end
+        RUBY
+
+        wait_for_output_to_include('Token:')
+        write("\u0003")
+
+        assert_output_includes('sentinel')
+      end
+
+      def test_ask_masked_eof_returns_input_so_far
+        run_in_process('puts "--#{CLI::UI::Prompt.ask_masked("Token: ")}--"')
+        # Close stdin immediately — EOF with no input
+        @stdin.close
+        assert_output_includes('----')
+      end
+
       def test_spinner_inside_prompt
         run_in_process(<<~RUBY)
           CLI::UI::Prompt.ask('question') do |handler|