ReadonlycredentialsWhere saved passwords and key passphrases are read, and new ones kept.
Optional ReadonlyinteractiveFalse when nobody can answer a question, as in an unattended run: new host keys are then refused.
Optional ReadonlyloggerWhere the engine logs, with secrets redacted.
OptionalconfirmAsks what to do about a certificate that did not verify. Absent: refused, as before.
Asks whether to trust a host key seen for the first time.
Asks for a secret; resolves undefined when nobody can be asked or the person cancels.
OptionalsecretCalled once after a sign-in succeeds with a secret a person typed; may offer to save it.
What the engine needs from the program it runs in: where secrets are kept, how a new SSH host key or an unverified certificate is decided on, and how a person is asked for a secret. The CLI and the VS Code extension each supply one.