@linxin666/dsh-ssh 0.3.4 → 0.3.6

package/lib/index.js

@@ -1408,7 +1408,8 @@ function buildConnectConfig(entry, sock, opts) {
 		username: entry.user,
 		readyTimeout: opts.connectTimeoutMs,
 		keepaliveInterval: opts.keepaliveIntervalMs,
-		keepaliveCountMax: 3
+		keepaliveCountMax: 3,
+		tryKeyboard: true
 	};
 	if (sock !== void 0) config.sock = sock;
 	if (entry.auth.kind === "password") config.password = entry.auth.password;
@@ -1433,7 +1434,7 @@ function resolveAgentPath(agentPath) {
 	if (process.platform === "win32") return "pageant";
 }
 /** Connect one ssh2 client (resolve on ready, reject on error/close). */
-function connectClient(config) {
+function connectClient(config, onKeyboardInteractive) {
 	return new Promise((resolve, reject) => {
 		const client = new Client();
 		let settled = false;
@@ -1450,6 +1451,20 @@ function connectClient(config) {
 			settled = true;
 			resolve(client);
 		});
+		client.on("keyboard-interactive", (name, instructions, instructionsLang, prompts, finish) => {
+			if (onKeyboardInteractive !== void 0) {
+				onKeyboardInteractive(name, instructions, instructionsLang, prompts.map((p) => ({
+					prompt: p.prompt,
+					echo: Boolean(p.echo)
+				})), finish);
+				return;
+			}
+			if (config.password !== void 0 && prompts.length > 0 && prompts.every((p) => /password/i.test(p.prompt))) {
+				finish(prompts.map(() => config.password));
+				return;
+			}
+			fail(/* @__PURE__ */ new Error("Authentication failed (keyboard-interactive): " + (prompts.map((p) => p.prompt.trim()).join(", ") || "unsupported interactive challenge")));
+		});
 		client.on("error", fail);
 		try {
 			client.connect(config);
@@ -1475,7 +1490,7 @@ function appendOutput(target, chunk, maxBytes) {
 * order, each forwarding a stream to the next destination, ending with the
 * target client. Shared by the pool and standalone shell sessions.
 */
-async function connectChain(engine, entry) {
+async function connectChain(engine, entry, onKeyboardInteractive) {
 	const hops = [];
 	let sock;
 	const chain = entry.proxyJump;
@@ -1484,7 +1499,7 @@ async function connectChain(engine, entry) {
 			const hopAlias = chain[index];
 			const hop = engine.store.find(hopAlias);
 			if (hop === void 0) throw new Error("proxyJump alias '" + hopAlias + "' not found — create it first");
-			const hopClient = await connectClient(buildConnectConfig(hop, sock, engine.opts));
+			const hopClient = await connectClient(buildConnectConfig(hop, sock, engine.opts), onKeyboardInteractive);
 			hops.push(hopClient);
 			const next = index + 1 < chain.length ? engine.store.find(chain[index + 1]) : void 0;
 			const nextHost = next !== void 0 ? next.host : entry.host;
@@ -1502,7 +1517,7 @@ async function connectChain(engine, entry) {
 	}
 	let target;
 	try {
-		target = await connectClient(buildConnectConfig(entry, sock, engine.opts));
+		target = await connectClient(buildConnectConfig(entry, sock, engine.opts), onKeyboardInteractive);
 		return {
 			client: target,
 			hops
@@ -1688,10 +1703,10 @@ async function execCommand(engine, alias, command, timeoutMs) {
 * The shell is a long-lived exclusive stream: it uses its own connection so
 * closing it can never tear down a pooled exec/tunnel sharing the alias.
 */
-async function openShell(engine, alias, size) {
+async function openShell(engine, alias, size, onKeyboardInteractive) {
 	const entry = engine.store.find(alias);
 	if (entry === void 0) throw new Error("alias '" + alias + "' not found — add it first");
-	const { client, hops } = await connectChain(engine, entry);
+	const { client, hops } = await connectChain(engine, entry, onKeyboardInteractive);
 	return await new Promise((resolve, reject) => {
 		client.shell({
 			term: "xterm-256color",
@@ -2161,8 +2176,8 @@ var SshEngine = class {
 		return cluster(this, options);
 	}
 	/** Open a PTY shell session for the web terminal (standalone connection). */
-	async openShell(alias, size) {
-		return openShell(this, alias, size);
+	async openShell(alias, size, onKeyboardInteractive) {
+		return openShell(this, alias, size, onKeyboardInteractive);
 	}
 	/** Upload one local file (or directory tree) to a remote path. */
 	async upload(alias, localPath, remotePath, recursive, onProgress) {
@@ -2796,6 +2811,7 @@ function makeRoutes(deps) {
 					let session;
 					let closed = false;
 					let paused = false;
+					let pendingAuthFinish;
 					const resume = () => {
 						if (paused && ws.bufferedAmount < BACKPRESSURE_LOW_WATER) {
 							paused = false;
@@ -2811,14 +2827,39 @@ function makeRoutes(deps) {
 						}
 					};
 					const closeSession = () => {
+						if (pendingAuthFinish !== void 0) {
+							const fn = pendingAuthFinish;
+							pendingAuthFinish = void 0;
+							try {
+								fn([]);
+							} catch {}
+						}
 						const opened = session;
 						session = void 0;
 						if (opened !== void 0) opened.close();
 					};
+					const onKeyboardInteractive = (name, instructions, _lang, prompts, finish) => {
+						const entry = store.find(alias);
+						if (entry?.auth.kind === "password" && entry.auth.password !== void 0 && prompts.length > 0 && prompts.every((p) => /password/i.test(p.prompt))) {
+							const password = entry.auth.password;
+							finish(prompts.map(() => password));
+							return;
+						}
+						pendingAuthFinish = finish;
+						sendFrame({
+							type: "auth_prompt",
+							name,
+							instructions,
+							prompts: prompts.map((p) => ({
+								prompt: p.prompt,
+								echo: p.echo
+							}))
+						});
+					};
 					engine.openShell(alias, {
 						cols: Number.isFinite(cols) ? cols : 80,
 						rows: Number.isFinite(rows) ? rows : 24
-					}).then((opened) => {
+					}, onKeyboardInteractive).then((opened) => {
 						if (ws.readyState !== WebSocket.OPEN) {
 							opened.close();
 							return;
@@ -2863,6 +2904,13 @@ function makeRoutes(deps) {
 						}
 						if (frame.type === "input") session?.send(frame.data);
 						else if (frame.type === "resize") session?.resize(Math.max(2, frame.cols), Math.max(1, frame.rows));
+						else if (frame.type === "auth_response") {
+							if (pendingAuthFinish !== void 0) {
+								const fn = pendingAuthFinish;
+								pendingAuthFinish = void 0;
+								fn(frame.responses);
+							}
+						}
 					});
 					ws.on("close", () => {
 						closed = true;

package/lib/types/client/api.d.ts

@@ -15,10 +15,17 @@ export interface TerminalConnection {
     onOutput: ((data: string) => void) | undefined;
     /** Fired on the exit frame (or transport error). */
     onExit: ((code: number | null, error?: string) => void) | undefined;
+    /** Fired when the server requests keyboard-interactive 2FA. */
+    onAuthPrompt: ((name: string, instructions: string, prompts: Array<{
+        prompt: string;
+        echo: boolean;
+    }>) => void) | undefined;
     /** Send raw input to the remote shell. */
     send(data: string): void;
     /** Resize the remote PTY. */
     resize(cols: number, rows: number): void;
+    /** Send interactive 2FA response codes to the remote server. */
+    sendAuthResponse(responses: string[]): void;
     /** Close the socket and the remote session. */
     close(): void;
 }

package/lib/types/client/locales.d.ts

@@ -81,6 +81,11 @@ export declare const zh: {
     readonly 'terminal.ready': "终端已连接（{alias}）";
     readonly 'terminal.exited': "终端已退出（{alias}）";
     readonly 'terminal.error': "终端错误：{error}";
+    readonly 'terminal.auth.title': "二次身份验证 (2FA / 交互式认证)";
+    readonly 'terminal.auth.submit': "提交验证码";
+    readonly 'terminal.auth.cancel': "取消";
+    readonly 'terminal.auth.placeholder': "请输入验证码或口令";
+    readonly 'terminal.auth.hint': "服务器请求进行交互式二次验证（输入仅本次生效，不落盘）：";
     readonly 'transfer.selectHost': "选择主机";
     readonly 'transfer.remotePath': "远程路径";
     readonly 'transfer.remotePathHint': "如 /tmp/ 或 /home/user/app.tar.gz";

package/lib/types/engine/connection-pool.d.ts

@@ -50,8 +50,13 @@ export interface PoolEngine {
 export declare function buildConnectConfig(entry: SshHostEntry, sock: ConnectConfig['sock'] | undefined, opts: Required<EngineOptions>): ConnectConfig;
 /** Resolve the ssh2 agent path for 'agent' auth. */
 export declare function resolveAgentPath(agentPath?: string): string | undefined;
+/** Keyboard-interactive handler callback for 2FA / dynamic prompt flow. */
+export type KeyboardInteractiveHandler = (name: string, instructions: string, instructionsLang: string, prompts: Array<{
+    prompt: string;
+    echo: boolean;
+}>, finish: (responses: string[]) => void) => void;
 /** Connect one ssh2 client (resolve on ready, reject on error/close). */
-export declare function connectClient(config: ConnectConfig): Promise<Client>;
+export declare function connectClient(config: ConnectConfig, onKeyboardInteractive?: KeyboardInteractiveHandler): Promise<Client>;
 /** Cap captured output at the configured byte budget (marks truncation). */
 export declare function appendOutput(target: {
     text: string;
@@ -62,7 +67,7 @@ export declare function appendOutput(target: {
  * order, each forwarding a stream to the next destination, ending with the
  * target client. Shared by the pool and standalone shell sessions.
  */
-export declare function connectChain(engine: PoolEngine, entry: SshHostEntry): Promise<{
+export declare function connectChain(engine: PoolEngine, entry: SshHostEntry, onKeyboardInteractive?: KeyboardInteractiveHandler): Promise<{
     client: Client;
     hops: Client[];
 }>;

package/lib/types/engine/pty.d.ts

@@ -3,7 +3,7 @@
  * ssh2 connection with a long-lived shell channel, resize, and pausable
  * output delivery.
  */
-import { type PoolEngine } from './connection-pool.ts';
+import { type KeyboardInteractiveHandler, type PoolEngine } from './connection-pool.ts';
 /** A live PTY shell session. */
 export interface ShellSession {
     /** Assign to receive remote output. */
@@ -29,4 +29,4 @@ export interface ShellSession {
 export declare function openShell(engine: PoolEngine, alias: string, size: {
     cols: number;
     rows: number;
-}): Promise<ShellSession>;
+}, onKeyboardInteractive?: KeyboardInteractiveHandler): Promise<ShellSession>;

package/lib/types/engine.d.ts

@@ -7,10 +7,10 @@
  */
 import type { ClusterResult, ExecResult, SshHostSummary, TestResult, TransferProgress, TunnelInfo } from './protocol.ts';
 import type { HostStore } from './store.ts';
-import { type EngineOptions, type PoolRecord } from './engine/connection-pool.ts';
+import { type EngineOptions, type KeyboardInteractiveHandler, type PoolRecord } from './engine/connection-pool.ts';
 import { type ShellSession } from './engine/pty.ts';
 import { type TunnelRecord } from './engine/tunnel.ts';
-export type { EngineOptions } from './engine/connection-pool.ts';
+export type { EngineOptions, KeyboardInteractiveHandler } from './engine/connection-pool.ts';
 export type { ShellSession } from './engine/pty.ts';
 export type { PoolRecord } from './engine/connection-pool.ts';
 export type { TunnelRecord } from './engine/tunnel.ts';
@@ -50,7 +50,7 @@ export declare class SshEngine {
     openShell(alias: string, size: {
         cols: number;
         rows: number;
-    }): Promise<ShellSession>;
+    }, onKeyboardInteractive?: KeyboardInteractiveHandler): Promise<ShellSession>;
     /** Upload one local file (or directory tree) to a remote path. */
     upload(alias: string, localPath: string, remotePath: string, recursive: boolean, onProgress?: (progress: TransferProgress) => void): Promise<{
         bytes: number;

package/lib/types/protocol.d.ts

@@ -160,6 +160,14 @@ export type TerminalServerFrame = {
     type: 'exit';
     code: number | null;
     error?: string;
+} | {
+    type: 'auth_prompt';
+    name: string;
+    instructions: string;
+    prompts: Array<{
+        prompt: string;
+        echo: boolean;
+    }>;
 };
 export type TerminalClientFrame = {
     type: 'input';
@@ -168,6 +176,9 @@ export type TerminalClientFrame = {
     type: 'resize';
     cols: number;
     rows: number;
+} | {
+    type: 'auth_response';
+    responses: string[];
 };
 /** Route paths the client calls (shared literals). */
 export declare const SSH_API_BASE: "/api/dsh-ssh";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@linxin666/dsh-ssh",
   "description": "Remote SSH operations for the dsh web GUI: host config store (~/.dsh/dsh-ssh.json, import from ~/.ssh/config), a persistent ssh2 connection pool with jump-host support, exec / PTY web terminal / SFTP transfer / local port-forward tunnels / cluster execution, plus agent tools (ssh_list, ssh_exec, ssh_upload, ssh_download, ssh_tunnel, ssh_cluster). Hot-pluggable — mounted via ~/.dsh/cordis.patch.yml + a profile node_modules symlink, no dsh source changes.",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "type": "module",
   "engines": {
     "node": "^22.19.0 || >=24.0.0"

package/src/client/api.ts

@@ -80,10 +80,14 @@ export interface TerminalConnection {
   onOutput: ((data: string) => void) | undefined
   /** Fired on the exit frame (or transport error). */
   onExit: ((code: number | null, error?: string) => void) | undefined
+  /** Fired when the server requests keyboard-interactive 2FA. */
+  onAuthPrompt: ((name: string, instructions: string, prompts: Array<{ prompt: string; echo: boolean }>) => void) | undefined
   /** Send raw input to the remote shell. */
   send(data: string): void
   /** Resize the remote PTY. */
   resize(cols: number, rows: number): void
+  /** Send interactive 2FA response codes to the remote server. */
+  sendAuthResponse(responses: string[]): void
   /** Close the socket and the remote session. */
   close(): void
 }
@@ -345,6 +349,7 @@ export class SshApi {
       onReady: undefined,
       onOutput: undefined,
       onExit: undefined,
+      onAuthPrompt: undefined,
       send: (data) => {
         if (socket.readyState === WebSocket.OPEN) {
           socket.send(JSON.stringify({ type: 'input', data } satisfies TerminalClientFrame))
@@ -355,6 +360,11 @@ export class SshApi {
           socket.send(JSON.stringify({ type: 'resize', cols, rows } satisfies TerminalClientFrame))
         }
       },
+      sendAuthResponse: (responses) => {
+        if (socket.readyState === WebSocket.OPEN) {
+          socket.send(JSON.stringify({ type: 'auth_response', responses } satisfies TerminalClientFrame))
+        }
+      },
       close: () => {
         try { socket.close() } catch { /* already closed */ }
       },
@@ -369,6 +379,7 @@ export class SshApi {
       if (frame.type === 'ready') connection.onReady?.()
       else if (frame.type === 'output') connection.onOutput?.(frame.data)
       else if (frame.type === 'exit') connection.onExit?.(frame.code, frame.error)
+      else if (frame.type === 'auth_prompt') connection.onAuthPrompt?.(frame.name, frame.instructions, frame.prompts)
     }
     socket.onclose = () => { connection.onExit?.(null, 'connection closed') }
     socket.onerror = () => { connection.onExit?.(null, 'connection error') }

package/src/client/locales.ts

@@ -85,6 +85,11 @@ export const zh = {
   'terminal.ready': '终端已连接（{alias}）',
   'terminal.exited': '终端已退出（{alias}）',
   'terminal.error': '终端错误：{error}',
+  'terminal.auth.title': '二次身份验证 (2FA / 交互式认证)',
+  'terminal.auth.submit': '提交验证码',
+  'terminal.auth.cancel': '取消',
+  'terminal.auth.placeholder': '请输入验证码或口令',
+  'terminal.auth.hint': '服务器请求进行交互式二次验证（输入仅本次生效，不落盘）：',
   // transfer
   'transfer.selectHost': '选择主机',
   'transfer.remotePath': '远程路径',
@@ -231,6 +236,11 @@ export const en: Record<keyof typeof zh, string> = {
   'terminal.ready': 'Terminal connected ({alias})',
   'terminal.exited': 'Terminal exited ({alias})',
   'terminal.error': 'Terminal error: {error}',
+  'terminal.auth.title': 'Two-Factor Authentication (2FA)',
+  'terminal.auth.submit': 'Submit Code',
+  'terminal.auth.cancel': 'Cancel',
+  'terminal.auth.placeholder': 'Enter code or passphrase',
+  'terminal.auth.hint': 'The server requested interactive 2FA (session only, never saved):',
   'transfer.selectHost': 'Select host',
   'transfer.remotePath': 'Remote path',
   'transfer.remotePathHint': 'e.g. /tmp/ or /home/user/app.tar.gz',

package/src/client/panel/TerminalTab.tsx

@@ -36,6 +36,13 @@ type TerminalStatus =
   | { kind: 'exited'; alias: string; detail?: string }
   | { kind: 'error'; detail: string }
 
+/** In-flight 2FA challenge prompts. */
+interface AuthPromptState {
+  name: string
+  instructions: string
+  prompts: Array<{ prompt: string; echo: boolean }>
+}
+
 /** Injected-once guard for the xterm stylesheet (one tag per page load). */
 let xtermCssInjected = false
 
@@ -60,6 +67,8 @@ export function TerminalTab({ api, presetAlias, requestId, terminalFont }: Termi
   const [hosts, setHosts] = useState<SshHostSummary[]>([])
   const [alias, setAlias] = useState(presetAlias ?? '')
   const [status, setStatus] = useState<TerminalStatus>({ kind: 'idle' })
+  const [authPrompt, setAuthPrompt] = useState<AuthPromptState | undefined>(undefined)
+  const [authInputs, setAuthInputs] = useState<string[]>([])
   const containerRef = useRef<HTMLDivElement | null>(null)
   const termRef = useRef<Terminal | null>(null)
   const fitRef = useRef<FitAddon | null>(null)
@@ -103,12 +112,15 @@ export function TerminalTab({ api, presetAlias, requestId, terminalFont }: Termi
   }, [presetAlias, requestId])
 
   const teardown = (): void => {
+    setAuthPrompt(undefined)
+    setAuthInputs([])
     const connection = connRef.current
     connRef.current = null
     if (connection !== null) {
       connection.onReady = undefined
       connection.onOutput = undefined
       connection.onExit = undefined
+      connection.onAuthPrompt = undefined
       connection.close()
     }
     // Release the xterm input subscription explicitly and dispose the
@@ -182,11 +194,21 @@ export function TerminalTab({ api, presetAlias, requestId, terminalFont }: Termi
     connRef.current = connection
     let settled = false
     dataSubRef.current = term.onData(data => { connection.send(data) })
-    connection.onReady = () => { setStatus({ kind: 'connected', alias: target }) }
+    connection.onAuthPrompt = (name, instructions, prompts) => {
+      setAuthPrompt({ name, instructions, prompts })
+      setAuthInputs(prompts.map(() => ''))
+    }
+    connection.onReady = () => {
+      setAuthPrompt(undefined)
+      setAuthInputs([])
+      setStatus({ kind: 'connected', alias: target })
+    }
     connection.onOutput = data => { term.write(data) }
     connection.onExit = (_code, error) => {
       if (settled) return
       settled = true
+      setAuthPrompt(undefined)
+      setAuthInputs([])
       dataSubRef.current?.dispose()
       dataSubRef.current = null
       term.options.disableStdin = true
@@ -201,6 +223,13 @@ export function TerminalTab({ api, presetAlias, requestId, terminalFont }: Termi
     setStatus({ kind: 'idle' })
   }
 
+  const submitAuth = (e?: React.FormEvent): void => {
+    e?.preventDefault()
+    if (connRef.current === null || authPrompt === undefined) return
+    connRef.current.sendAuthResponse(authInputs)
+    setAuthPrompt(undefined)
+  }
+
   const active = status.kind === 'connecting' || status.kind === 'connected'
 
   return (
@@ -224,6 +253,37 @@ export function TerminalTab({ api, presetAlias, requestId, terminalFont }: Termi
         {status.kind === 'idle' && (
           <div className={css.termPlaceholder}>{hosts.length === 0 ? tt('hosts.empty') : tt('terminal.placeholder')}</div>
         )}
+        {authPrompt !== undefined && (
+          <div className={css.modalBackdrop} style={{ position: 'absolute', zIndex: 10 }}>
+            <form className={css.modalCard} style={{ maxWidth: 420 }} onSubmit={submitAuth}>
+              <div className={css.modalHeader}>
+                <h3 className={css.modalTitle}>{authPrompt.name || tt('terminal.auth.title')}</h3>
+              </div>
+              <p className={css.hint}>{authPrompt.instructions || tt('terminal.auth.hint')}</p>
+              {authPrompt.prompts.map((p, idx) => (
+                <label key={idx} className={css.field}>
+                  <span className={css.fieldLabel}>{p.prompt.trim() || tt('terminal.auth.title')}</span>
+                  <input
+                    autoFocus={idx === 0}
+                    className={css.input}
+                    type={p.echo ? 'text' : 'password'}
+                    placeholder={tt('terminal.auth.placeholder')}
+                    value={authInputs[idx] ?? ''}
+                    onChange={event => {
+                      const next = [...authInputs]
+                      next[idx] = event.target.value
+                      setAuthInputs(next)
+                    }}
+                  />
+                </label>
+              ))}
+              <div className={css.modalFooter}>
+                <button type="button" className={css.ghostButton} onClick={disconnect}>{tt('terminal.auth.cancel')}</button>
+                <button type="submit" className={css.primaryButton}>{tt('terminal.auth.submit')}</button>
+              </div>
+            </form>
+          </div>
+        )}
       </div>
     </div>
   )

package/src/engine/connection-pool.ts

@@ -70,6 +70,7 @@ export function buildConnectConfig(entry: SshHostEntry, sock: ConnectConfig['soc
     readyTimeout: opts.connectTimeoutMs,
     keepaliveInterval: opts.keepaliveIntervalMs,
     keepaliveCountMax: 3,
+    tryKeyboard: true,
   }
   if (sock !== undefined) config.sock = sock
   if (entry.auth.kind === 'password') {
@@ -103,8 +104,17 @@ export function resolveAgentPath(agentPath?: string): string | undefined {
   return undefined
 }
 
+/** Keyboard-interactive handler callback for 2FA / dynamic prompt flow. */
+export type KeyboardInteractiveHandler = (
+  name: string,
+  instructions: string,
+  instructionsLang: string,
+  prompts: Array<{ prompt: string; echo: boolean }>,
+  finish: (responses: string[]) => void,
+) => void
+
 /** Connect one ssh2 client (resolve on ready, reject on error/close). */
-export function connectClient(config: ConnectConfig): Promise<Client> {
+export function connectClient(config: ConnectConfig, onKeyboardInteractive?: KeyboardInteractiveHandler): Promise<Client> {
   return new Promise((resolve, reject) => {
     const client = new Client()
     let settled = false
@@ -119,6 +129,18 @@ export function connectClient(config: ConnectConfig): Promise<Client> {
       settled = true
       resolve(client)
     })
+    client.on('keyboard-interactive', (name, instructions, instructionsLang, prompts, finish) => {
+      if (onKeyboardInteractive !== undefined) {
+        onKeyboardInteractive(name, instructions, instructionsLang, prompts.map(p => ({ prompt: p.prompt, echo: Boolean(p.echo) })), finish)
+        return
+      }
+      // Step 1: Automatic PAM password fallback: if a password is configured and all prompts ask for password
+      if (config.password !== undefined && prompts.length > 0 && prompts.every(p => /password/i.test(p.prompt))) {
+        finish(prompts.map(() => config.password as string))
+        return
+      }
+      fail(new Error('Authentication failed (keyboard-interactive): ' + (prompts.map(p => p.prompt.trim()).join(', ') || 'unsupported interactive challenge')))
+    })
     // Keep an error listener attached after the handshake: when TCP connects
     // but the handshake drops, ssh2 can emit a second 'error' after a single
     // once-listener is gone, which would surface as an unhandled 'error' event.
@@ -152,7 +174,11 @@ export function appendOutput(target: { text: string; truncated: boolean }, chunk
  * order, each forwarding a stream to the next destination, ending with the
  * target client. Shared by the pool and standalone shell sessions.
  */
-export async function connectChain(engine: PoolEngine, entry: SshHostEntry): Promise<{ client: Client; hops: Client[] }> {
+export async function connectChain(
+  engine: PoolEngine,
+  entry: SshHostEntry,
+  onKeyboardInteractive?: KeyboardInteractiveHandler,
+): Promise<{ client: Client; hops: Client[] }> {
   const hops: Client[] = []
   let sock: ConnectConfig['sock']
   const chain = entry.proxyJump
@@ -163,7 +189,7 @@ export async function connectChain(engine: PoolEngine, entry: SshHostEntry): Pro
       if (hop === undefined) {
         throw new Error('proxyJump alias \'' + hopAlias + '\' not found — create it first')
       }
-      const hopClient = await connectClient(buildConnectConfig(hop, sock, engine.opts))
+      const hopClient = await connectClient(buildConnectConfig(hop, sock, engine.opts), onKeyboardInteractive)
       hops.push(hopClient)
       const next = index + 1 < chain.length ? engine.store.find(chain[index + 1]) : undefined
       const nextHost = next !== undefined ? next.host : entry.host
@@ -187,7 +213,7 @@ export async function connectChain(engine: PoolEngine, entry: SshHostEntry): Pro
   }
   let target: Client | undefined
   try {
-    target = await connectClient(buildConnectConfig(entry, sock, engine.opts))
+    target = await connectClient(buildConnectConfig(entry, sock, engine.opts), onKeyboardInteractive)
     return { client: target, hops }
   } catch (error) {
     for (const client of hops) client.end()

package/src/engine/pty.ts

@@ -4,7 +4,7 @@
  * output delivery.
  */
 
-import { connectChain, type PoolEngine } from './connection-pool.ts'
+import { connectChain, type KeyboardInteractiveHandler, type PoolEngine } from './connection-pool.ts'
 
 /** A live PTY shell session. */
 export interface ShellSession {
@@ -29,10 +29,15 @@ export interface ShellSession {
  * The shell is a long-lived exclusive stream: it uses its own connection so
  * closing it can never tear down a pooled exec/tunnel sharing the alias.
  */
-export async function openShell(engine: PoolEngine, alias: string, size: { cols: number; rows: number }): Promise<ShellSession> {
+export async function openShell(
+  engine: PoolEngine,
+  alias: string,
+  size: { cols: number; rows: number },
+  onKeyboardInteractive?: KeyboardInteractiveHandler,
+): Promise<ShellSession> {
   const entry = engine.store.find(alias)
   if (entry === undefined) throw new Error('alias \'' + alias + '\' not found — add it first')
-  const { client, hops } = await connectChain(engine, entry)
+  const { client, hops } = await connectChain(engine, entry, onKeyboardInteractive)
   return await new Promise<ShellSession>((resolve, reject) => {
     client.shell({ term: 'xterm-256color', cols: size.cols, rows: size.rows }, (error, stream) => {
       if (error !== undefined) {

package/src/engine.ts

@@ -14,6 +14,7 @@ import {
   disposeRecord,
   sweepPool,
   type EngineOptions,
+  type KeyboardInteractiveHandler,
   type PoolRecord,
 } from './engine/connection-pool.ts'
 import { openShell, type ShellSession } from './engine/pty.ts'
@@ -21,7 +22,7 @@ import { download, ls, upload } from './engine/sftp.ts'
 import { listTunnels, startTunnel, stopAllTunnels, stopTunnel, type TunnelRecord } from './engine/tunnel.ts'
 import { cluster } from './engine/cluster.ts'
 
-export type { EngineOptions } from './engine/connection-pool.ts'
+export type { EngineOptions, KeyboardInteractiveHandler } from './engine/connection-pool.ts'
 export type { ShellSession } from './engine/pty.ts'
 export type { PoolRecord } from './engine/connection-pool.ts'
 export type { TunnelRecord } from './engine/tunnel.ts'
@@ -92,8 +93,12 @@ export class SshEngine {
   // -------------------------------------------------------------- shell
 
   /** Open a PTY shell session for the web terminal (standalone connection). */
-  async openShell(alias: string, size: { cols: number; rows: number }): Promise<ShellSession> {
-    return openShell(this, alias, size)
+  async openShell(
+    alias: string,
+    size: { cols: number; rows: number },
+    onKeyboardInteractive?: KeyboardInteractiveHandler,
+  ): Promise<ShellSession> {
+    return openShell(this, alias, size, onKeyboardInteractive)
   }
 
   // -------------------------------------------------------------- sftp

package/src/protocol.ts

@@ -167,10 +167,17 @@ export type TerminalServerFrame =
   | { type: 'ready'; alias: string }
   | { type: 'output'; data: string }
   | { type: 'exit'; code: number | null; error?: string }
+  | {
+      type: 'auth_prompt'
+      name: string
+      instructions: string
+      prompts: Array<{ prompt: string; echo: boolean }>
+    }
 
 export type TerminalClientFrame =
   | { type: 'input'; data: string }
   | { type: 'resize'; cols: number; rows: number }
+  | { type: 'auth_response'; responses: string[] }
 
 /** Route paths the client calls (shared literals). */
 export const SSH_API_BASE = '/api/dsh-ssh' as const