Initial terminal geometry and behaviour flags for an opt-in pseudo-terminal (PTY) run — see `Command.Pty`. A PTY gives the child a real controlling terminal (`isatty` true) on a single merged stdout+stderr stream, for tools that demand a tty (an interactive `ssh`/`sudo` prompt, a credential helper, a TUI, a progress bar that switches to "dumb" line-buffered output when it detects a pipe). The default (no PTY) is byte-identical to a plain pipe run. **Secret-safety (echo footgun).** A terminal echoes typed input back into its *output* by default (cooked-mode `ECHO`), so bytes written to the child's stdin through the PTY — including an interactively typed password — are echoed into the captured merged output. This is standard terminal behaviour, not a bug, but it means a credential can appear in captured output (or a recorded cassette). Set `Echo = false` to disable the terminal echo: on **POSIX** ProcessKit clears the pty slave's cooked-mode `ECHO` bit (`termios`) before the child adopts it, so a password typed to the child through the PTY is not echoed into the captured merged stream (proven by test). On **Windows** the echo of a ConPTY is governed by the child's own console mode (`ENABLE_ECHO_INPUT`/`ENABLE_LINE_INPUT` on `CONIN$`), which has no supported parent-side pre-spawn override; ProcessKit therefore does not force echo off there — a documented platform divergence, not a silent claim (an interactive prompt on Windows should suppress its own echo, as `ssh`/credential helpers do). As everywhere else in the library, argv and environment **values** — and any PTY credentials — are never logged or traced; the record/replay redaction hook still governs what a cassette persists.