fix(ssh): clarify password and verification code prompts

[hiimchinh]

What Changed

The SSH dialog and generated prompt now ask for a password or verification code. The hint explains that SSH keys do not remove a server's second-factor requirement.

Why

Fixes #10784. The previous password-only wording misled users whose SSH key was already accepted and whose server was waiting for a TOTP code. Authentication behavior is unchanged.

Validation: TDD red → green; 59 affected tests pass; web/SSH typechecks and focused lint pass.

UI Changes

Real dialog rendered in the web client with a simulated desktop IPC prompt; no live SSH connection was used.

Before	After

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes

Model: GPT-6. Harness: Codex.

Summary by CodeRabbit

• User Experience

  • Updated SSH authentication prompts to refer to verification rather than only passwords.
  • Prompts now clearly accept either a password or verification code.
  • Added guidance that SSH keys may replace password entry, while verification codes may still be required for two-factor authentication.
  • Expired verification requests are now identified as expired instead of being presented as password prompts.

• Bug Fixes

  • Improved SSH authentication messaging when remote login fails, helping users understand what information is needed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 2c968ef6-36f6-4d00-9c14-be70ebd674c8

📥 Commits

Reviewing files that changed from the base of the PR and between d0ada22 and 1ba0fff.

📒 Files selected for processing (2)

• packages/ssh/src/tunnel.test.ts
• packages/ssh/src/tunnel.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/ssh/src/tunnel.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The SSH backend prompt and desktop dialog now describe password or verification-code authentication. Expired prompts use verification-focused wording. Tests cover backend prompt text, dialog copy, key and 2FA wording, and expiration handling.

Changes

SSH verification prompt

Layer / File(s)	Summary
Update SSH authentication prompt packages/ssh/src/tunnel.ts, packages/ssh/src/tunnel.test.ts	SSH authentication requests now ask for a password or verification code. The test verifies the prompt after authentication failure.
Update desktop verification dialog apps/web/src/components/desktop/SshPasswordPromptDialog.tsx, apps/web/src/components/desktop/SshPasswordPromptDialog.test.tsx	The dialog uses verification-focused titles, descriptions, helper text, and expiration messages. Tests validate password and verification-code copy and expired-request behavior.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Low

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to 1ba0f

The SSH dialog now accurately explains that a server may request either a password or a verification code after key authentication. No actionable merge risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: clarifying SSH password and verification code prompts.
Description check	✅ Passed	The description explains what changed, why it changed, validation results, and UI changes with before-and-after screenshots. It does not include the template's video checklist item, but the described …
Linked Issues check	✅ Passed	Issue #10784 requires wording that accepts a password or verification code and does not imply that SSH keys remove a server-required second factor. SshPasswordPromptDialog.tsx now uses `SSH verifica…
Out of Scope Changes check	✅ Passed	The changes stay within issue #10784. They update SSH prompt copy, add the matching prompt string, and add focused automated tests for the dialog and SSH prompt behavior. No unrelated feature, API, or…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[kridaydave]

This should be merged as soon as a core maintainer has time. Clear improvement with solid tests around the expiry wording, thanks for the contribution.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This is a focused clarification of SSH password and verification-code prompt copy, with no change to authentication mechanics or data contracts. Because it modifies production code in the SSH authentication path and its credential prompt UI, it warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[maria-rcks]

Note

Written by claude-opus-5-5 on behalf of Maria

Hi! We are cleaning up open PRs, and this one appears to have been created with an older model (gpt-6). If this change is really important, we recommend rebuilding the PR with a newer model if possible.