ssh-controlmaster: add --ssh-ask-pass flag for password auth

README.md

@@ -69,20 +69,29 @@ the plain `ssh.ts` example which opens a new connection per tool call.
 **Usage:**
 
 ```bash
-# Remote home dir resolved automatically via pwd
+# Key-based auth (normal)
 pi --ssh user@192.168.1.10
 
 # Explicit remote path (skips the initial pwd call)
 pi --ssh root@proxmox-node:/etc/pve
 
+# Password auth — prompts before connecting
+pi --ssh user@host --ssh-ask-pass
+
 # Try without modifying your global install
 pi -e ~/src/src_local/pi-extensions/extensions/ssh-controlmaster.ts --ssh user@host
 ```
 
 **Requirements:**
-- SSH key-based auth (no password prompts — ControlMaster won't work with interactive auth)
+- SSH key-based auth (preferred), or password auth via `--ssh-ask-pass` (see below)
 - `bash` available on the remote
 
+> **Note on `--ssh-ask-pass`:** The password is prompted via pi's input dialog
+> before the SSH connection is opened. Input is **not masked** — the password
+> is visible while typing. It is passed to SSH via a temporary `SSH_ASKPASS`
+> script (`/tmp/pi-askpass-<pid>.sh`, `chmod 700`) which is deleted
+> immediately after the master is established.
+
 **How it works:**
 
 1. On `session_start`, runs `ssh -G <host>` to read the effective config for that host