The terminal command on the page is the real one: the CDN is rewriting it #19

Production's footer renders ssh -p 2222 <a class="__cf_email__" …>[email&#160;protected]</a> — the CDN in front of the app reads quorum@<forge> as an email address, obfuscates it, and injects /cdn-cgi/scripts/…/email-decode.min.js into the page. The one command a person must copy verbatim is wrong without JavaScript, wrong to copy with it, and the page now runs a script this repository did not write.

Fetch it yourself: curl -s https://quorum--forge-trevato-apps.open-platform.sh/ | grep cf_email.

What done looks like

• [ ] The footer wraps the connect line in the CDN's documented opt-out markers (<!--email_off--> … <!--email_on-->) so the text passes through untouched; the served page contains no __cf_email__ element and no /cdn-cgi/ script tag.
• [ ] The command is still exactly FORGE_APP_SSH, escaped and printed verbatim — no reformatting, no splitting it across elements, no invented user@host. When the variable is unset the footer says the terminal is off, in a sentence, with no empty <code>.
• [ ] It is copyable on a phone: the <code> holds one line that does not break mid-token, and at 360px the page still has no horizontal scroll (overflow-wrap, never a body scrollbar).
• [ ] Tests: the rendered layout contains the exact value of FORGE_APP_SSH between the markers; an unset value renders the "off" sentence and no <code>; neither case contains __cf_email__.
• [ ] Verified on the deployed preview, not only in a test: the pull quotes the line fetched from the preview showing the real command.
• [ ] README.md notes in one line why the markers are there, so nobody removes them as noise.

Files I expect to change: src/pages/layout.ts, src/server.test.ts, static/app.css, README.md.

Risks: the markers are HTML comments — write them as literals in the template, never built from anything a person typed, and keep the escaped value between them untouched. If the CDN ignores the markers, do not leave a half-fix: say so in the pull and fall back to printing the command on its own line with the login and host as plain text the CDN will not match, with the exact command still in the README.

Fit: Hearth — the terminal is its home turf, and being honest about how to reach it is the whole point. A person assigns; I do not.

You've hit your weekly limit · resets Sep 20, 2am (UTC)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: You've hit your weekly limit · resets Sep 20, 2am (UTC) (api_error)

API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN) (api_error)

Amendment from the planner: still reproducing, verified just now.

$ curl -s https://quorum--forge-trevato-apps.open-platform.sh/ | grep -c cf_email 2

The rendered footer is Terminal: ssh -p 2222 [email protected], and the page still pulls /cdn-cgi/scripts/.../email-decode.min.js — a script this repository did not write, on a page whose CSP is default-src 'self'. The one command a person must copy verbatim is wrong on the page today.

Added criterion, because it is the part that will be forgotten: the served page must contain no /cdn-cgi/ script tag at all after the fix, not merely no __cf_email__ span — assert both against the preview in the pull, quoting the fetched line.

Added fallback, so this cannot end half-done: if the <!--email_off--> markers do not survive the CDN, print the command with the login and the host in separate elements that the CDN's matcher cannot read as an address, keep the whole exact value of FORGE_APP_SSH in a title-less <code> on one line, and say in the pull that the markers were ignored. Never invent a you@host form, and never leave the page telling someone a command that does not work.