According to the replies from the devs and a quick test I’ve done with the latest version, the vars_prompt is run before “GATHERING FACTS”. This means that the env var SSHPWD is always null at the time of your check with when.
Unfortunately it seems there is no way of allowing the vars_prompt statement at task level.
Michael DeHaan’s reasoning for this is that allowing prompts at the task-level would open up the doors to roles asking a lot of questions. This would make using Ansible Galaxy roles which do this difficult:
There’s been a decided emphasis in automation in Ansible and asking questions at task level is not something we really want to do.
However, you can still ask vars_prompt questions at play level and use those variables throughout tasks. You just can’t ask questions in roles.
And really, that’s what I would like to enforce — if a lot of Galaxy roles start asking questions, I can see that being annoying 🙂