I'd like to be able to tell when echo mode is turned off in xterm.js (for example, when entering a password). stty can report and change that information, but (obviously) can't be executed while waiting for a user to enter a password. What is the API for querying the echo state?
The terminal metrics as seen under linux, macos and other POSIX compatible operating systems is a POSIX feature specified under terminal interface section:
The interesting part for many settings around a terminal, like ECHO mode, is the termios API, which you can access with tcgetattr / tcsetattr in C on a compliant system. Furthermore many languages provide some sort of bindings to that API (e.g. the python module termios).
The documentation can be accessed on most POSIX systems by either calling man termios or man tcgetattr.
Example docs from the web:
Edit:
Re-reading your question - if you want to able to grab the ECHO state from xterm.js, well that is not possible that easy. The reason for this is cumbersome - xterm.js is an emulator behind a PTY. A PTY splits the terminal actions in a master and a slave part, where the master part acts as the terminal process (xterm.js here) and the slave part is a process attached to that terminal. While POSIX only guarantees, that the termios API works on the slave part (its whole writeup was meant for consuming processes), BSD-flavored systems also allow termios semantics on the master part.
TL;DR: On linux and macos you can use termios API on the master file descriptor held by your PTY-binding (e.g. node-pty), while this will only work on the slave file descriptor under solaris clones (or any other STREAMS based TTY implementations).