VFS: enter password on demand / use an env variable?

[iandol]

What system are you running Yazi on?

Linux X11

What terminal are you running Yazi in?

kitty V0.48.1

ya env output

Yazi
    Version: 26.8.15 (5f31edf 2026-08-31)
    Debug  : false
    Triple : x86_64-unknown-linux-gnu (linux-x86_64)
    Rustc  : 1.98.0 (88d9e12a 2026-08-18)
    Backtrace: None

Ya
    Version: 26.8.15 (5f31edf 2026-08-31)
    Debug  : false
    Triple : x86_64-unknown-linux-gnu (linux-x86_64)
    Rustc  : 1.98.0 (88d9e12a 2026-08-18)

Config
    Init             : /home/cog5/.config/yazi/init.lua (601 chars)
    Yazi             : /home/cog5/.config/yazi/yazi.toml (3888 chars)
    Keymap           : /home/cog5/.config/yazi/keymap.toml (3784 chars)
    Theme            : /home/cog5/.config/yazi/theme.toml (545 chars)
    VFS              : /home/cog5/.config/yazi/vfs.toml (585 chars)
    Package          : /home/cog5/.config/yazi/package.toml (1475 chars)
    Dark/light flavor: ArcSwapAny("catppuccin-frappe") / ArcSwapAny("catppuccin-latte")

Emulator
    TERM                : Some("xterm-kitty")
    TERM_PROGRAM        : None
    TERM_PROGRAM_VERSION: None
    Brand.from_env      : Some(Kitty)
    Emulator.probe      : Emulator { brand: Kitty, version: ArcSwapAny("kitty(0.48.1)"), csi_u: Some(0), kgp: true, kgp_shm: true, sixel: false, background: Some([12336, 13364, 17990]), color_scheme: Some(false), csi_16t: (15, 30), force_16t: false, osc_5522: true, cursor_blink: false, cursor_shape: Some(1), mux: None, probe: Probe { id: Id(0), completed: false }, started: false }

Adapter
    Drivers.matches: Kgp
    TERM.dimension : Dimension { cols: 254, rows: 70, width: 3810, height: 2100 }

Desktop
    XDG_SESSION_TYPE           : Some("x11")
    WAYLAND_DISPLAY            : None
    DISPLAY                    : Some(":1")
    NIRI_SOCKET                : None
    SWAYSOCK                   : None
    HYPRLAND_INSTANCE_SIGNATURE: None
    WAYFIRE_SOCKET             : None

SSH
    shared.in_ssh_connection: false

WSL
    WSL: false

Variables
    SHELL              : Some("/usr/bin/zsh")
    EDITOR             : Some("/home/cog5/.pixi/bin/nvim")
    VISUAL             : Some("/home/cog5/.pixi/bin/nvim")
    YAZI_FILE_ONE      : None
    YAZI_CONFIG_HOME   : None
    YAZI_ZOXIDE_OPTS   : None
    SSH_AUTH_SOCK      : Some("/run/user/1000/gnupg/S.gpg-agent.ssh")
    FZF_DEFAULT_OPTS   : Some("--ansi")
    FZF_DEFAULT_COMMAND: Some("fd --type file --color=always --follow --hidden --exclude .git")

Text Opener
    default     : Some(OpenerRuleArc(OpenerRule { id: Id(24), run: "nvim %s", block: true, orphan: false, desc: "Edit with Neovim", for: Unix, spread: true }))
    block-create: Some(OpenerRuleArc(OpenerRule { id: Id(24), run: "nvim %s", block: true, orphan: false, desc: "Edit with Neovim", for: Unix, spread: true }))
    block-rename: Some(OpenerRuleArc(OpenerRule { id: Id(24), run: "nvim %s", block: true, orphan: false, desc: "Edit with Neovim", for: Unix, spread: true }))

Multiplexers
    tmux version       : tmux 3.7c
    tmux build flags   : enable-sixel=Supported
    ZELLIJ_SESSION_NAME: None
    Zellij version     : No such file or directory (os error 2)

Dependencies
    file          : 5.45
    ueberzugpp    : No such file or directory (os error 2)
    ffmpeg/ffprobe: ffmpeg version N-126314-g3386acd2f9-https://www.martin-riedl.de Copyright (c) 2000-2026 the FFmpeg developers / ffprobe version N-126314-g3386acd2f9-https://www.martin-riedl.de Copyright (c) 2007-2026 the FFmpeg developers
    pdftoppm      : 26.07.0
    magick        : No such file or directory (os error 2)
    fzf           : 0.74
    fd/fdfind     : 10.5.0 / No such file or directory (os error 2)
    rg            : 15.2.0
    chafa         : No such file or directory (os error 2)
    zoxide        : 0.10.0
    7zz/7z        : No such file or directory (os error 2) / 16.02
    resvg         : 0.47.0
    jq            : 1.8.2

Clipboard
    wl-copy/paste: No such file or directory (os error 2) / No such file or directory (os error 2)
    xclip        : 0.13
    xsel         : 1.2.1

Routine
    `file -bL --mime-type`: text/plain

Describe the question

In the Yazi VFS docs, we can specify SSH keys or manually add a password for each server. I want to keep vfs.toml in git, and so cannot add passwords manually with password = "my_password" in vfs.toml. Is there some way to have either a TUI requester, or be able to use a shell ENV for this?

https://yazi-rs.github.io/docs/next/configuration/vfs

Anything else?

It would be even better if we could first choose the SFTP server from a list, so we don't need to hard-code each remote to a different key binding...

Checklist

• I have read all the documentation
• I have searched the existing discussions/issues

[sxyazi]

With #4338 (nightly required atm), you can now register SFTP services in your init.lua where you can use os.getenv() to access an environment variable like this:

vf.sftp = {
  home = {
    host = "1.2.3.4",
    user = "root",
    port = 22,
    password = os.getenv("MY_PWD"),
  },
}

then start Yazi with:

yazi sftp://home

[iandol]

Thanks @sxyazi — this can solve my problem, though it would be nicer if we could keep configuration in vfs.toml rather than split across two files. Or a way to have GUI requestor to allow us to enter a password at connect time?

[sxyazi]

You don't need to scatter your VFS configs across 2 different TOML and Lua files, instead, just register everything in Lua alone if you need some advanced features like environment variables.

They are equivalent, and thanks to Lua you may use some scripting e.g. wrapping identical fields into a function that can make configuring and managing even easier.

[iandol]

OK thanks, that makes sense, I can just delete vfs.toml. Would an interactive password requestor be feasible?

[sxyazi]

Not currently possible: Yazi concurrently creates multiple SSH connections for chunked file upload/download to improve performance, and currently the input is globally unique, which means if multiple connections need to request user password input, the input requests initiated by earlier connections will be canceled by the last connection, causing the connections to fail. To properly support this, it might be necessary to add multi-input support and have later-initiated connections wait serially for the password input of earlier connections to complete, which could require a fairly large refactor. It's also not that user-friendly, since the user would need to enter the password frequently. Using environment variables would be easier in your case.