Feature request: OS-native masked-input prompt for pasting secrets (API keys/tokens) instead of chat text

Summary

When a user needs to hand Claude Code a sensitive value (API key, token, secret) to save into a local config file, there's currently no built-in way to do that without pasting the plaintext into the chat transcript, where it gets logged/displayed.

What I want

A native, OS-level masked-input prompt Claude Code can trigger (like an AppleScript "display dialog ... with hidden answer" on macOS) that:

• Pops up a password-style field (masked as you type/paste)
• Returns the value to the running session ONLY to be written to a local file (e.g. .env.local) or otherwise used programmatically
• Never echoes the plaintext value back into the visible chat/transcript

Why

I asked Claude to save a Zhipu API key into my project's .env.local. It used a macOS osascript hidden-answer dialog to do exactly this — I pasted the key into a native masked popup, hit Save, and the value never appeared anywhere in the chat. It worked great and felt obviously safer than the alternative (pasting a raw secret into the chat box). This should be a first-class, built-in capability, not something the model has to jury-rig with osascript.

Ask

Make this a supported, documented mechanism in Claude Code itself, and make it cross-platform (Windows/Linux equivalents of the same masked native-dialog idea), so it's the standard way to hand Claude Code a secret rather than an occasional trick.

---
My user wanted me to tell you about this.