fix: prompt for passphrase on encrypted SSH keys

ParsePrivateKey failures were silently skipped, so a passphrase-protected
~/.ssh/id_ed25519 was reported as 'no key files found' on hosts without
an SSH agent. Detect PassphraseMissingError and ask for the passphrase
interactively (up to 3 attempts) before the TUI starts; make the final
error distinguish missing files from unloadable ones.

go.mod

@@ -7,6 +7,7 @@ require (
 	github.com/charmbracelet/lipgloss v1.1.0
 	github.com/spf13/cobra v1.10.2
 	golang.org/x/crypto v0.53.0
+	golang.org/x/term v0.47.0
 )
 
 require (
@@ -27,6 +28,6 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 	golang.org/x/text v0.38.0 // indirect
 )

go.sum

@@ -48,10 +48,10 @@ golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561 h1:MDc5xs78ZrZr3HMQugiXOAkSZ
 golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
-golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
 golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
 golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

internal/sshclient/client.go

@@ -2,6 +2,7 @@ package sshclient
 
 import (
 	"bufio"
+	"errors"
 	"fmt"
 	"net"
 	"os"
@@ -11,6 +12,7 @@ import (
 	"github.com/janvete/caddyview/internal/parser"
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/crypto/ssh/agent"
+	"golang.org/x/term"
 )
 
 type Client struct {
@@ -149,6 +151,7 @@ func buildAuthMethods(keyPath string) ([]ssh.AuthMethod, error) {
 			candidates = append(candidates, filepath.Join(home, ".ssh", name))
 		}
 	}
+	var problems []string
 	for _, p := range candidates {
 		data, err := os.ReadFile(p)
 		if err != nil {
@@ -156,17 +159,49 @@ func buildAuthMethods(keyPath string) ([]ssh.AuthMethod, error) {
 		}
 		signer, err := ssh.ParsePrivateKey(data)
 		if err != nil {
-			continue
+			var passErr *ssh.PassphraseMissingError
+			if errors.As(err, &passErr) {
+				signer, err = unlockWithPassphrase(p, data)
+			}
+			if err != nil {
+				problems = append(problems, fmt.Sprintf("%s (%v)", p, err))
+				continue
+			}
 		}
 		methods = append(methods, ssh.PublicKeys(signer))
 	}
 
 	if len(methods) == 0 {
+		if len(problems) > 0 {
+			return nil, fmt.Errorf("key files found but could not be loaded: %s", strings.Join(problems, "; "))
+		}
 		return nil, fmt.Errorf("no SSH auth method available — no agent (SSH_AUTH_SOCK) and no key files found in %v", candidates)
 	}
 	return methods, nil
 }
 
+// unlockWithPassphrase prompts for the passphrase of an encrypted private key.
+// It runs before the TUI starts, so stdin is still a normal terminal.
+func unlockWithPassphrase(path string, data []byte) (ssh.Signer, error) {
+	if !term.IsTerminal(int(os.Stdin.Fd())) {
+		return nil, fmt.Errorf("key is passphrase-protected and stdin is not a terminal")
+	}
+	for attempt := 0; attempt < 3; attempt++ {
+		fmt.Fprintf(os.Stderr, "Enter passphrase for %s: ", path)
+		pass, err := term.ReadPassword(int(os.Stdin.Fd()))
+		fmt.Fprintln(os.Stderr)
+		if err != nil {
+			return nil, err
+		}
+		signer, err := ssh.ParsePrivateKeyWithPassphrase(data, pass)
+		if err == nil {
+			return signer, nil
+		}
+		fmt.Fprintf(os.Stderr, "caddyview: cannot decrypt key: %v\n", err)
+	}
+	return nil, fmt.Errorf("could not decrypt key in 3 attempts")
+}
+
 // agentAuth returns an auth method backed by the SSH agent if SSH_AUTH_SOCK is set.
 func agentAuth() ssh.AuthMethod {
 	sock := os.Getenv("SSH_AUTH_SOCK")