Add optional passphrase prompt to SSH key generation

src/steps/ssh.js

@@ -29,9 +29,21 @@ export async function setupSsh({ home } = {}) {
 
   if (p.isCancel(email)) return;
 
+  const passphrase = await p.password({
+    message: "Enter a passphrase for the SSH key (leave blank for no passphrase):",
+    validate(value) {
+      if (value.length > 0 && value.length < 8) {
+        return "Passphrase must be at least 8 characters, or leave blank";
+      }
+    },
+  });
+
+  if (p.isCancel(passphrase)) return;
+
   p.log.step("Generating SSH key...");
   await runStream(
-    `ssh-keygen -t rsa -b 4096 -C "${email}" -f "${keyFile}" -N ""`
+    `ssh-keygen -t rsa -b 4096 -C "${email}" -f "${keyFile}" -N "$SSH_KEYGEN_PASSPHRASE"`,
+    { env: { ...process.env, SSH_KEYGEN_PASSPHRASE: passphrase } }
   );
 
   // Copy public key to clipboard

src/utils/shell.js

@@ -52,10 +52,14 @@ export function brewInstall(name, { cask = false } = {}) {
 /**
  * Run a shell command and stream output to stdout/stderr in real-time.
  * Returns a promise that resolves with the exit code.
+ * @param {string} cmd
+ * @param {{ env?: Record<string,string> }} [opts]
  */
-export function runStream(cmd) {
+export function runStream(cmd, opts = {}) {
   return new Promise((resolve, reject) => {
-    const child = spawn("bash", ["-c", cmd], { stdio: "inherit" });
+    const spawnOpts = { stdio: "inherit" };
+    if (opts.env) spawnOpts.env = opts.env;
+    const child = spawn("bash", ["-c", cmd], spawnOpts);
     child.on("close", (code) => resolve(code));
     child.on("error", reject);
   });

tests/ssh.test.js

@@ -3,15 +3,17 @@ import { mkdirSync, existsSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { createSandbox } from "./helpers.js";
 
-const { mockText } = vi.hoisted(() => ({
+const { mockText, mockPassword } = vi.hoisted(() => ({
   mockText: vi.fn(),
+  mockPassword: vi.fn(),
 }));
 
 vi.mock("@clack/prompts", () => ({
   log: { success: vi.fn(), step: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() },
   spinner: vi.fn(() => ({ start: vi.fn(), stop: vi.fn() })),
   confirm: vi.fn(),
   text: mockText,
+  password: mockPassword,
   isCancel: vi.fn(() => false),
 }));
 
@@ -33,6 +35,7 @@ describe("ssh step", () => {
     vi.clearAllMocks();
     sandbox = createSandbox();
     mockText.mockResolvedValue("test@example.com");
+    mockPassword.mockResolvedValue("");
   });
 
   afterEach(() => {
@@ -54,12 +57,9 @@ describe("ssh step", () => {
     await setupSsh({ home: sandbox.path });
 
     expect(mockText).toHaveBeenCalled();
-    expect(runStream).toHaveBeenCalledWith(
-      expect.stringContaining("ssh-keygen")
-    );
-    expect(runStream).toHaveBeenCalledWith(
-      expect.stringContaining("test@example.com")
-    );
+    const sshKeygenCall = runStream.mock.calls.find((c) => c[0].includes("ssh-keygen"));
+    expect(sshKeygenCall).toBeDefined();
+    expect(sshKeygenCall[0]).toContain("test@example.com");
   });
 
   test("uses sandbox path for key file location", async () => {
@@ -69,4 +69,45 @@ describe("ssh step", () => {
     expect(sshKeygenCall).toBeDefined();
     expect(sshKeygenCall[0]).toContain(sandbox.path);
   });
+
+  test("generates key without passphrase when left blank", async () => {
+    mockPassword.mockResolvedValue("");
+
+    await setupSsh({ home: sandbox.path });
+
+    const sshKeygenCall = runStream.mock.calls.find((c) => c[0].includes("ssh-keygen"));
+    expect(sshKeygenCall).toBeDefined();
+    expect(sshKeygenCall[0]).toContain('-N "$SSH_KEYGEN_PASSPHRASE"');
+    expect(sshKeygenCall[1]).toEqual({ env: expect.objectContaining({ SSH_KEYGEN_PASSPHRASE: "" }) });
+  });
+
+  test("generates key with passphrase when provided", async () => {
+    mockPassword.mockResolvedValue("s3cr3tPass");
+
+    await setupSsh({ home: sandbox.path });
+
+    const sshKeygenCall = runStream.mock.calls.find((c) => c[0].includes("ssh-keygen"));
+    expect(sshKeygenCall).toBeDefined();
+    expect(sshKeygenCall[0]).toContain('-N "$SSH_KEYGEN_PASSPHRASE"');
+    expect(sshKeygenCall[1]).toEqual({ env: expect.objectContaining({ SSH_KEYGEN_PASSPHRASE: "s3cr3tPass" }) });
+  });
+
+  test("aborts when passphrase prompt is cancelled", async () => {
+    const { isCancel } = await import("@clack/prompts");
+    isCancel.mockImplementationOnce(() => false); // email not cancelled
+    isCancel.mockImplementationOnce(() => true);  // passphrase is cancelled
+    mockPassword.mockResolvedValue("s3cr3tPass");
+
+    await setupSsh({ home: sandbox.path });
+
+    expect(runStream).not.toHaveBeenCalled();
+  });
+
+  test("prompts for passphrase after email", async () => {
+    await setupSsh({ home: sandbox.path });
+
+    expect(mockPassword).toHaveBeenCalledWith(
+      expect.objectContaining({ message: expect.stringContaining("passphrase") })
+    );
+  });
 });