Support password-based SSH login in Connections without requiring a private key

What variant of Codex are you using?

Codex desktop app (Connections / SSH remote hosts)

What feature would you like to see?

I’d like Codex App’s Connections → SSH flow to support connecting to a host without first configuring a private key.

Please support standard SSH password authentication and keyboard-interactive/PAM authentication in addition to public-key authentication.

Expected behavior

• Let the user choose an authentication method, or follow the host’s normal SSH negotiation.
• Prompt securely for a password or keyboard-interactive challenge at connection time.
• Honor relevant ~/.ssh/config options such as PreferredAuthentications and allow BatchMode=no.
• Do not require the password to be stored in plaintext.

Why this matters

Some internal, temporary, or legacy hosts use password/PAM authentication and do not allow users to provision a public key. Requiring a configured key makes those hosts unavailable from Connections even though the system SSH client can connect to them.

Additional information

Related to #34448, which requests disabling BatchMode for keyboard-interactive challenges. This request explicitly includes the simpler case of password-only SSH hosts where no private key is configured.

Start with the Codex desktop app's Connections → SSH flow and its existing public-key authentication path. Review the related request in #34448 and compare behavior with the system SSH client. Done means password and keyboard-interactive/PAM authentication work securely, honor the relevant SSH config options, and never store passwords in plaintext.