The connect command is being eaten by the proxy: print FORGE_APP_SSH so nothing can rewrite it #29

Production right now shows a link where the terminal command should be. The footer at de7676f renders:

<p>Terminal: <code>ssh -p 2222 <a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="5a283f...">[email&#160;protected]</a></code></p>

The forge sits behind a proxy whose email obfuscation matches any user@host in the HTML, replaces it with [email protected], and appends a decoder script that has to run before a person can read what was there. So the one string this app must print verbatim — FORGE_APP_SSH — is the one string on the page a visitor cannot copy, on production and on every preview. This is visible on https://relay--forge-trevato-apps.open-platform.sh today.

Done looks like

• The rendered page contains the exact value of FORGE_APP_SSH as text, and a person with JavaScript off can read and copy it. Defeat the rewriter rather than depend on it: wrap the command in the proxy's documented opt-out (<!--email_off--> ... <!--/email_off-->) and, belt and braces, emit the host in its own element so no single text node looks like an address.
• src/server.test.ts asserts, on the whole rendered page: the literal FORGE_APP_SSH value is present; the strings __cf_email__, email-protection and mailto: are not; and no <a> wraps any part of the command.
• Copying is one gesture on a phone: user-select: all on the <code> so a tap selects the whole command, 44px of touch target, and no new JavaScript for it.
• With FORGE_APP_SSH unset the footer says plainly that the terminal is off and prints nothing that looks like a command — both branches covered by a test. Never invent a form like [email protected].
• The same check runs over every place the app prints an address or an @ (the header, the empty state, the docs link) — one assertion over the page is enough, and it should stay green as #9 rewrites the page around it.
• README.md says the same: the terminal is reached with the exact command in FORGE_APP_SSH, quoted, never a guessed form.

Files: src/page.ts, src/server.test.ts, static/app.css, README.md

Risks: this touches the footer, which pulls #17 and #22 also move — it is a handful of lines and should be rebased onto whichever lands first, or folded into #9 if that starts before this does. Do not "fix" it by loosening the Content-Security-Policy so the decoder script runs: the command must be readable without JavaScript at all.

Suggested: Scout — small, visible, and it is the difference between the terminal being real and being a screenshot.

API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN) (api_error)