[BUG] SSH connection feature falls back to password prompt when only FIDO2/hardware-backed keys are configured

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Title: SSH connection feature falls back to password prompt when only FIDO2/hardware-backed keys are configured

Summary

When connecting to a host whose effective SSH config only offers FIDO2 security keys (sk-ed25519, e.g. YubiKey-backed identities), the Claude Code SSH connection UI prompts for a password instead of triggering the security-key touch confirmation. The same host connects flawlessly from a terminal via ssh <host>.

Expected behavior

Claude Code surfaces the "Confirm user presence for key …" prompt (or equivalent UI), waits for the YubiKey touch, and authenticates — matching ssh CLI behavior.

Actual behavior

No touch prompt appears. The SK key offer appears to fail silently and SSH falls back to keyboard-interactive/password auth, which the UI then surfaces as a password prompt. Entering nothing / cancelling aborts the connection.

Environment

• OS: macOS (Darwin 25.4.0)
• Claude Code: 2.1.86
• OpenSSH: OpenSSH_10.2p1, OpenSSL 3.6.1 27 Jan 2026
• Key type: sk-ssh-ed25519@openssh.com (resident YubiKey 5)
• SecurityKeyProvider: internal (libsk built into OpenSSH)

Workaround

Adding a non-SK IdentityFile (e.g. ~/.ssh/id_ed25519) to the host block and authorizing that key on the server lets the Claude Code UI connect without falling back to password. This trades hardware-key protection for usability.

What Should Happen?

• Would be great if the SSH integration could either (a) route the FIDO2 touch confirmation through the UI, or (b) shell out to the system ssh binary so the existing PIN/touch flows just work.
• A clearer error ("security key touch required, not supported in this UI") would also be a big improvement over the silent fall-through to password.

Error Messages/Logs

Steps to Reproduce

1. Configure ~/.ssh/config so the target host inherits IdentityFile entries that are FIDO2-resident keys, e.g.:

```
Host *
IdentityFile ~/.ssh/id_ed25519_sk_yubi_1
IdentityFile ~/.ssh/id_ed25519_sk_yubi_2
SecurityKeyProvider internal

Host dev
HostName 192.0.2.10
User martin
IdentitiesOnly yes
```

1. From a terminal, run ssh dev — works after a YubiKey touch.
2. In Claude Code, create a new remote SSH connection to dev.
3. The UI prompts for a password.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.138

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

_No response_