As a frequent internal tool writer, I’d say it’s a fact of life but an undesirable one. I’m always trying to avoid pausing for credentials in the middle of a run, either by doing them right at the beginning or by using some sort of durable credentials system like ssh keys.

There’s always two people at every company who refuse to set up auth automation though, so you end up handling it. They are very stubborn. Even when it trips them up in front of observers while executing an urgent task, I’ve only occasionally convinced them to agree to set up trust instead of typing a password every single time.

Which is to say, I have to support password prompts even though they drive me up the wall.

Yes, but a CLI can ask for literally anything. We'll end up adding things there and with a zoo of hard-to-support implementation of that _protocol_.

CLI can also _blank_, do we want to support it as well?