The line that tells you how to reach the terminal arrives as `[email protected]` #27

Verified on the live previews, not read from the source: the footer's ssh command is rewritten before it reaches a browser, on every environment.

$ curl -s https://drift--26--forge-trevato-apps.open-platform.sh/ | tail
Terminal: <code>ssh -p 2222 <a href="/cdn-cgi/l/email-protection"
  class="__cf_email__" data-cfemail="7e1a0c17...">[email&#160;protected]</a></code>

Production on main does the same. The CDN in front of the app runs email obfuscation, name@host looks like an address to it, so the value of FORGE_APP_SSH is replaced with the words [email protected] and a decoder script is injected into the document. The rule this breaks is not a style preference: the exact command in FORGE_APP_SSH is printed verbatim or not at all, and a person who copies what the page shows today gets a command that cannot work.

Done looks like

• [ ] The served page carries the exact string in FORGE_APP_SSH, character for character, and a

person can copy it in one gesture on a phone. A readonly <input> with a copy control is the suggestion — the CDN rewrites text nodes, not input values — but any approach passes if it meets the two tests below, and the pull says which was chosen and why.

• [ ] Nothing invents a form: when FORGE_APP_SSH is unset the page says the terminal is off, and no

you@host shape appears anywhere in the tree.

• [ ] No third-party script is injected into the document as a side effect; the page keeps the floor

from src/http.ts and adds nothing to it.

• [ ] A test renders the footer with a realistic FORGE_APP_SSH and asserts the exact value survives,

escaped, in the output — a test that fails against the current markup.

• [ ] Checked against the deployed preview, not only locally: the pull quotes the bytes the page

actually serves, since this defect exists only past the CDN and a local test can never see it.

Files src/page.ts, static/app.css, src/server.test.ts.

Risks The cause is outside the repository and the fix must therefore be defensive rather than a setting: assume the obfuscator is there and give it nothing to match. Do not defeat it by mangling the string with zero-width characters or a split @ — that breaks copy-paste, which is the whole point of printing the command. AGENTS.md and #15 both repeat the verbatim rule; this is the issue that makes it true on the page.

Waits on #7, which is rewriting src/page.ts right now — the same footer. Fits Quill's brief.

One concrete option this issue does not name: the obfuscator has an opt-out marker, <!--email_off--> around the region, and it is the only fix that leaves the command copy-pasteable as plain text rather than trapped in an input. It is a comment in the served HTML, costs nothing, ships no JavaScript and needs no CDN setting. Worth trying first; if the marker is ignored on this edge, fall back to the readonly input the body suggests. Either way the test that quotes the deployed bytes is what settles it.