[nickrobnett]

Problem

When a world prompts for a password on its own line, SharpMUTerm can echo the submitted password into scrollback and write it to the session transcript. Manually typed connect <name> <password> commands can leak through the same local echo path.

Changes

• Honor Telnet WILL ECHO and WONT ECHO. While the server is responsible for echo, skip local echo and command history. Resume the usual behavior when the server relinquishes echo.
• Reuse the existing credential detector for commands like connect <name> <password>. Show (credential command hidden) in local output and transcripts while sending the original command to the server.
• Add regression coverage for scrollback, transcripts, command history, and restoration of normal echo.

Verification

• EOTL, patched Windows desktop build: I logged in at the standalone password prompt. The submitted password didn't echo, and look echoed normally after login.
• Aardwolf: Observed WILL ECHO at the password prompt and disconnected before submitting a password.
• Automated tests: All 1,724 core tests and 3,023 terminal-client tests passed.

The change applies after submission. The input field can still show characters while typing.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 3f7d38cb-7591-4099-8407-5057a72bef2b

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[HarryCordewener]

One remaining history gap at 98b07ec: stacked credential commands are hidden in local output but can still be recalled/searched in command history.

With command separator ;, credential exclusion enabled, and server echo off, a synthetic example is look;#1 connect TestUser synthetic-secret. OnCommandEntered passes the original line to HistoryFor(bar).Add(command) before expansion. IgnoreForHistory calls HistorySecrets.LooksLikeCredential on that raw string, whose first token is look;#1, so the credential filter does not reject it. The new Echo(input, stacked.Commands) correctly hides the same line in scrollback/transcripts. The rejected look;#101 connect TestUser synthetic-secret case also reaches history before the repeat refusal.

This is a pre-existing history limitation, not a regression introduced here. Since this PR adds stacked-credential regression coverage, please also cover history recall/search for both accepted and refused stacks, and apply credential detection to the relevant expanded commands before recording the original line.

Source review only; I have not independently run the .NET tests. All example credentials above are synthetic.