Priority: next. The cascade only tries none/publickey/password, so servers advertising only keyboard-interactive report "Authentication failed" with correct credentials; and encrypted private keys load with None and silently fail.
Proposal: add an authenticate_keyboard_interactive fallback, allow a couple of password retries before dropping, and either prompt for key passphrases or query SSH_AUTH_SOCK (agent).
Filed from the 2026-07-09 full-repo review (findings adversarially verified before filing).
Priority: next. The cascade only tries none/publickey/password, so servers advertising only keyboard-interactive report "Authentication failed" with correct credentials; and encrypted private keys load with
Noneand silently fail.Proposal: add an
authenticate_keyboard_interactivefallback, allow a couple of password retries before dropping, and either prompt for key passphrases or querySSH_AUTH_SOCK(agent).Filed from the 2026-07-09 full-repo review (findings adversarially verified before filing).