…dler

- Display prompt via stdout before stty -echo to stop the spinner
  immediately (system() fork+exec is slow, spinner was running until then)
- Use stdout instead of stderr to avoid red error formatting on prompt
- Wrap file("/dev/tty") in suppressWarnings() to suppress the
  "not a regular file" warning

Co-Authored-By: Claude Opus 4.6 <[email protected]>

cat() to stdout does not reliably trigger r_write_console_ex in
embedded R, so the spinner keeps running. Switch back to stderr
which reliably triggers r_write_console_ex and stops the spinner.

To avoid the red error formatting that arf applies to stderr output,
prepend ANSI reset (\033[0m) to cancel the red color immediately.

The prompt is now displayed BEFORE stty -echo (not after), so the
spinner stops as soon as the prompt appears.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Previous approach used R's cat() to display prompts and readLines() to
read passwords from /dev/tty. This failed because R's cat() bypasses
the WriteConsoleEx callback in embedded R, so the spinner was never
stopped.

New approach:
- R side: sets ARF_ASKPASS_MODE env var, then calls readline(msg)
- readline() triggers R's ReadConsole callback (r_read_console)
- r_read_console calls stop_spinner() at the top (spinner stops!)
- r_read_console detects ARF_ASKPASS_MODE env var
- Instead of calling reedline callback, reads from /dev/tty directly
- Echo disabled via termios (no subprocess fork like stty)
- Password returned to R via ReadConsole buffer

This is analogous to radian's approach (Python getpass.getpass reads
from /dev/tty with echo disabled, bypassing prompt_toolkit).

Co-Authored-By: Claude Opus 4.6 <[email protected]>

…_tty

Clear the environment variable at the start of read_password_from_tty
rather than relying solely on R's on.exit() cleanup. This prevents the
env var from leaking if the function returns early or encounters an
error, which would cause all subsequent readline() calls to be
intercepted as password prompts.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

When a password exceeds R's buffer capacity, return an empty line
("\n\0") with rc=1 instead of rc=0. This makes the R askpass handler
treat it as cancellation (nchar == 0 → NULL) rather than triggering
the reedline fallback path which would echo input in plaintext.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Guard against buflen < 2 at the top of read_password_from_tty to
prevent out-of-bounds writes when writing "\n\0" in error/empty
password paths. In practice R's buffer is always large, but this
makes the safety invariant explicit.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Use TCSAFLUSH instead of TCSANOW when disabling echo for password
input. This discards any pending (type-ahead) input before applying
the termios change, preventing stray characters from leaking into
the password buffer.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

- Add askpass to r-deps/DESCRIPTION so the package is available in CI
- Remove #[ignore] from test_pty_askpass so it runs with cargo test
- Move prompt display AFTER tcsetattr(TCSAFLUSH) so the prompt
  appearance guarantees the terminal is ready to accept input
- Use paste0() in test to construct prompt, preventing the test's
  expect() from matching the command echo instead of the real prompt

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Use write_volatile to overwrite the Vec<u8> holding the password,
preventing the compiler from eliding the zeroing. Applied on both the
success path and the overlong-rejection path. R itself keeps the value
in a CHARSXP, so this is defense-in-depth rather than a full guarantee.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

If R's SIGINT handler longjmps out of read_password_from_tty, the
TermiosGuard destructor is skipped and the terminal is left with echo
disabled. Add a global PENDING_TERMIOS_RESTORE that records (fd,
old_termios) before disabling echo. TermiosGuard::drop clears it on
success. r_read_console checks it on every entry and recovers if a
stale entry is found, restoring echo and closing the leaked fd.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Add a comment explaining the SIGINT → EINTR → error → TermiosGuard →
cancellation flow, and how the PENDING_TERMIOS_RESTORE safety net
covers the longjmp case.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Add has_askpass() helper (same pattern as has_dplyr()) and early-return
in test_pty_askpass when the package is unavailable. Prevents unexpected
hard failures in local environments without the package.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

- Handle poisoned mutex in recover_pending_termios with into_inner()
  to ensure terminal recovery even in edge cases (233 #1)
- Add comment explaining double-close safety: longjmp skips File
  destructor so fd is still open and cannot be reused (233 #2)
- Add comment explaining the intentional if guard in
  write_empty_password as release-build safety net (231 #2)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

- Fix fd leak when PENDING_TERMIOS_RESTORE mutex is poisoned after
  successful tcgetattr (finding #2)
- Restore comment explaining intentional if guard in write_empty_password
  for release builds where debug_assert is stripped (finding #3)
- Document that rpassword's internal fd leaks on longjmp as a known
  minor limitation (finding #1)
- Note UTF-8 restriction from rpassword vs previous raw bytes (finding #4)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

When tcsetattr fails with a non-transient error, retrying on the
next r_read_console call won't help. Clear the snapshot to avoid
a permanent fd leak. Skip close on fatal errors since the fd may
already be invalid.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

EBADF means the fd is already invalid, so close() is skipped.
EIO/ENOTTY may leave a valid fd, so close() is still called to
avoid a leak. Also restructured to eliminate clippy collapsible_if
warnings.

Co-Authored-By: Claude Opus 4.6 <[email protected]>