If you are on Linux using the ask pass facility is probably best IMO. It would probably be good on Mac too, but I’m not sure if there is an askpass agent built in.

Mac solution, but not encouraging: https://apple.stackexchange.com/questions/23494/what-option-should-i-give-the-sudo-command-to-have-the-password-asked-through-a

seems like spam…