fix(ssh): stop the askpass helper answering security-key prompts with a passphrase

[TsekaLuk]

Part of #80 (FIDO2/OpenSSH transport gating).

The bug

Pebble sets SSH_ASKPASS_REQUIRE=force (ssh_agent_hook_bootstrap.go:203) so an unattended probe can answer a key passphrase without a TTY. That setting routes every OpenSSH prompt through the helper — and the helper printed the secret unconditionally:

if os.Getenv("PEBBLE_SSH_ASKPASS_MODE") == "1" {
    fmt.Fprintln(os.Stdout, os.Getenv("PEBBLE_SSH_ASKPASS_SECRET"))
    return
}

It never looked at os.Args[1], which is where OpenSSH puts the prompt text.

So a FIDO2 target asked Enter PIN for ED25519-SK key ... received the cached passphrase. The wrong secret goes to a different authenticator, the attempt is burnt, and the user sees a passphrase error instead of a request to touch the key. Keyboard-interactive challenges (One-time password:, Verification code:) were answered the same way.

This branch of main.go had no test coverage at all — the existing askpass test reads PEBBLE_SSH_ASKPASS_SECRET from the environment inside a fake ssh script and never invokes the helper.

The fix

Classify the prompt; release the credential only for a passphrase or account-password prompt, and exit non-zero otherwise. Exiting zero with no output would instead offer OpenSSH an empty password.

The distinction is drawn on the wording, not the key type, which is the part that is easy to get wrong:

prompt	classification	why
Enter passphrase for ED25519-SK key ...	secret	decrypts the local key file — the cached credential is the right answer
Enter PIN for ED25519-SK key ...	security key	the FIDO2 PIN, held by the authenticator
Confirm user presence for key ...	security key	a touch request, not a secret
pebble@host's password:	secret	OpenSSH's account prompt
One-time password:	other	a challenge; contains "password" but must not be answered

Unrecognised prompts fail closed.

Host-key prompts are unaffected: both call sites already set StrictHostKeyChecking=accept-new (ssh_agent_hook_bootstrap.go:157, ssh_text_generation_relay.go:305), so the authenticity question never reaches askpass. I checked this before changing anything, since failing closed there would have broken first contact with a new host.

Verification

• Three table tests using OpenSSH's own prompt wording, so a future rewording surfaces here rather than as a hardware-key target silently getting the wrong secret.
• Mutation-tested with 6 mutants; 5 caught. The survivor — reordering the passphrase check ahead of the security-key check — is an equivalent mutant: no prompt OpenSSH actually emits contains both "passphrase" and the PIN/presence wording, so the order is defensive rather than load-bearing. I did not invent a prompt OpenSSH never sends in order to kill it.
• Full go test ./... -race green, matching the baseline on main.

Note on scope

This is one of the defects behind #80, not the whole issue. #80 also wants a capability probe (ssh -Q key for sk-* support) so FIDO2 is only offered when the local OpenSSH supports it, and actionable install guidance behind the eight bare system ssh binary not found errors. Those are separate changes.

🤖 Generated with Claude Code