SSH askpass shows yes/no host-fingerprint prompt instead of PIN input for FIDO2/security-key authentication
- Dominant language
- TypeScript
- Stars
- 193k
- Forks
- 42.4k
- PR merge metrics
- PR metrics pending
Description
Does this issue occur when all extensions are disabled?: Yes (this is a bug in the built-in `git` extension itself, which `--disable-extensions` does not disable)
- VS Code Version: 1.129.0 (commit 125df4672b8a6a34975303c6b0baa124e560a4f7, x64), built-in Git extension v10.0.0
- OS Version: Linux (CachyOS, kernel 7.1.3-2-cachyos)
Steps to Reproduce:
1. Configure an SSH remote authenticated with an `ed25519-sk`/`ecdsa-sk` (FIDO2 security key) registered with `verify-required` (PIN + touch), with `git.useIntegratedAskPass` left at its default (`true`).
2. Trigger a `git fetch`/`git push` in the Source Control panel that requires signing with that key.
3. OpenSSH's `ssh-sk-helper` prompts for the key's PIN with the text `Enter PIN for authenticator:`.
4. VS Code shows a yes/no "Are you sure you want to continue connecting?" quick pick instead of a PIN input box (there is no way to enter a PIN), and authentication fails.
Root cause: in `extensions/git/dist/main.js`, `handleSSHAskpass()` only renders a text input box when the prompt matches `/passphrase/i`; every other prompt falls through to the yes/no "continue connecting" quick pick meant for host-key confirmation. OpenSSH's FIDO2 PIN prompt text ("Enter PIN for authenticator:") does not contain "passphrase", so it is misclassified.
Expected: a password-style input box should be shown for the PIN prompt, the same way it already works for `Enter passphrase for key ...` prompts.
Workaround: set `"git.useIntegratedAskPass": false` so the OS-level `SSH_ASKPASS` helper (e.g. `x11-ssh-askpass`) handles the prompt instead of VS Code's own UI.
Contributor guide
Assessment
This issue has not been assessed yet.