fix(ssh): ask for a password or verification code, not only a password

apps/web/src/components/desktop/SshPasswordPromptDialog.tsx

@@ -22,9 +22,9 @@ function formatRemainingSeconds(seconds: number): string {
 }
 
 function getPromptErrorMessage(error: unknown): string {
-  const message = error instanceof Error ? error.message : "SSH password prompt failed.";
+  const message = error instanceof Error ? error.message : "SSH verification prompt failed.";
   return message.includes("expired") || message.includes("no longer pending")
-    ? "This SSH password prompt expired. Try connecting again."
+    ? "This SSH verification prompt expired. Try connecting again."
     : message;
 }
 
@@ -101,7 +101,7 @@ function ActiveSshPasswordPrompt({
   const remainingLabel =
     remainingSeconds === null ? null : formatRemainingSeconds(remainingSeconds);
   const visibleResponseError = isExpired
-    ? "This SSH password prompt expired. Try connecting again."
+    ? "This SSH verification prompt expired. Try connecting again."
     : responseError;
 
   const respond = async (nextPassword: string | null) => {
@@ -111,7 +111,7 @@ function ActiveSshPasswordPrompt({
 
     const requestId = request.requestId;
     if (nextPassword !== null && isExpired) {
-      setResponseError("This SSH password prompt expired. Try connecting again.");
+      setResponseError("This SSH verification prompt expired. Try connecting again.");
       return;
     }
 
@@ -158,10 +158,11 @@ function ActiveSshPasswordPrompt({
     >
       <DialogPopup className="max-w-md" showCloseButton={false}>
         <DialogHeader>
-          <DialogTitle>SSH Password Required</DialogTitle>
+          <DialogTitle>SSH verification required</DialogTitle>
           <DialogDescription>
-            T3 needs your SSH password to connect to <code>{target}</code>. The password is passed
-            to the local SSH process for this connection attempt and is not saved by T3 Code.
+            Enter the password or verification code required by <code>{target}</code>. Your response
+            is passed to the local SSH process for this connection attempt and is not saved by T3
+            Code.
           </DialogDescription>
         </DialogHeader>
         <DialogPanel scrollFade={false}>
@@ -202,7 +203,8 @@ function ActiveSshPasswordPrompt({
               <p className="text-sm text-destructive">{visibleResponseError}</p>
             ) : (
               <p className="text-sm text-muted-foreground">
-                Use SSH keys to avoid repeated password prompts on new SSH sessions.
+                SSH keys may replace a password, but your server can still require a verification
+                code.
               </p>
             )}
           </form>

packages/ssh/src/tunnel.test.ts

@@ -549,6 +549,41 @@ describe("ssh tunnel scripts", () => {
     }),
   );
 
+  it.effect("asks for a password or verification code when SSH auth fails", () =>
+    Effect.gen(function* () {
+      const prompts: Array<string> = [];
+      const spawner = ChildProcessSpawner.make(() =>
+        Effect.succeed({
+          ...makeSuccessfulProcess(""),
+          exitCode: Effect.succeed(ChildProcessSpawner.ExitCode(255)),
+          stderr: Stream.make(
+            new TextEncoder().encode("user@devbox: Permission denied (keyboard-interactive).\n"),
+          ),
+        }),
+      );
+      const layer = Layer.mergeAll(
+        NodeServices.layer,
+        Layer.succeed(ChildProcessSpawner.ChildProcessSpawner, spawner),
+        Layer.succeed(HttpClient.HttpClient, testHttpClient),
+        Layer.succeed(NetService.NetService, testNetService),
+        Layer.succeed(SshAuth.SshPasswordPrompt, {
+          isAvailable: true,
+          request: (request) =>
+            Effect.sync(() => prompts.push(request.prompt)).pipe(Effect.as(null)),
+        }),
+        SshTunnel.SshEnvironmentManager.layer({ resolveCliRunner: Effect.succeed(ARCHIVE) }),
+      );
+      yield* Effect.gen(function* () {
+        const manager = yield* SshTunnel.SshEnvironmentManager;
+        const target = { alias: "devbox", hostname: "devbox", username: "user", port: null };
+        yield* Effect.result(manager.ensureEnvironment(target));
+        assert.deepStrictEqual(prompts, [
+          "Enter the SSH password or verification code for user@devbox.",
+        ]);
+      }).pipe(Effect.provide(layer), Effect.scoped);
+    }),
+  );
+
   it.effect.each(["successful stop", "failed stop"] as const)(
     "closes the tunnel scope and starts fresh after a %s",
     (mode) => {

packages/ssh/src/tunnel.ts

@@ -1436,7 +1436,7 @@ const makeSshEnvironmentManager = Effect.fn("ssh/tunnel.SshEnvironmentManager.ma
       attempt,
       destination: target.alias.trim() || target.hostname.trim(),
       username: target.username,
-      prompt: `Enter the SSH password for ${hostSpec}.`,
+      prompt: `Enter the SSH password or verification code for ${hostSpec}.`,
     });
     if (password === null) {
       yield* Effect.logWarning("ssh.auth.passwordPrompt.cancelled", {