Git worktree push: SSH key passphrase requested every time despite being saved

Problem

Pushing or pulling from a Git worktree requests the SSH key passphrase on every operation, even though the passphrase was saved earlier with the Remember option. The same operation in the original clone completes without a prompt, and every newly created worktree starts requesting the passphrase again. During a single push the dialog can appear more than once.

The behavior is not specific to worktrees. It has been reported since 2021 for repositories that use Git LFS, and the code path involved is shared by all IntelliJ-based IDEs on every operating system.

Cause

Two independent factors combine.

The first is that a single push can open more than one SSH connection. Besides the connection to the remote, a pre-push hook can contact the remote on its own: the Git LFS pre-push hook does exactly that. The IDE answers the first passphrase request from its saved credentials, then opens a dialog for each further request in the same command, because a repeated request for the same key is treated as a rejected passphrase. This part is an IDE defect, tracked as Git LFS: SSH - asking for passphrase even with "Remember" enabled.

The second is that Git hook setup belongs to the checkout rather than to the repository. Hook managers such as husky set core.hooksPath to a relative path (.husky/_), which resolves against each working tree separately, and that directory is generated by the project's install step instead of being tracked in Git. A working tree added with git worktree add therefore starts with a different hook state than the original clone until the install step runs inside it, so the two checkouts run different hooks and open a different number of SSH connections.

The number of prompts follows the number of SSH connections a command opens, not the checkout the command runs in. Comparing a worktree against the original clone is meaningful only when both run the same hooks.

Resolution

1. Initialize the project's Git hooks inside the new working tree by running the project's install step there (for example, npm install). To confirm the hook state, run git config --get core.hooksPath and check that the reported directory exists inside the working tree and holds the expected hooks. A relative path resolves per checkout, so the original clone can be fully set up while the worktree is not.

2. Load the SSH key into the SSH agent so that no passphrase is required for any connection. On macOS, run ssh-add --apple-use-keychain ~/.ssh/id_ed25519 and add AddKeysToAgent yes and UseKeychain yes to ~/.ssh/config. On Linux and Windows, run ssh-add ~/.ssh/id_ed25519 with AddKeysToAgent yes. Git calls the native ssh client, which takes the decrypted key from the agent, so nothing needs the passphrase and the dialog cannot appear.

3. For a single push, clear the Run Git hooks checkbox in the Push dialog. The push then runs with --no-verify and opens one SSH connection. The hooks are skipped for that push, which makes this a per-operation workaround rather than a fix.