PR #24733 real-environment verification, 2026-10-30
main: 6575ce3250 (github/main fetched this turn)
PR head: 3feb7dd1788261d2e265af2b0294c0e10c4e33a8
No source changes, mocks, fake tokens, fixtures, or demo data used.

MAIN
$ git worktree add ../main github/main
$ vp i
$ T3CODE_DEV_SEED=0 setsid nohup vp run dev > /tmp/main-dev.log 2>&1 &
[dev-runner] serverPort=16733 webPort=8693 baseDir=/home/user/main/.t3
$ (export public values from .env.example; timeout 25 node apps/server/src/bin.ts connect login --headless --base-dir /home/user/main/.t3)
T3 Connect
Headless authorization
Open this URL on a device with a browser:
  https://accounts.t3.codes/device?user_code=[one-time code omitted]
Waiting for approval (expires in 10 min). Press Ctrl+C to cancel.
Stopped by timeout without authorizing. Chrome reached production Clerk sign-in.
No signed-in browser account or stored cloud-cli-oauth-token exists on this VM.
The original email-printing bug could therefore not be reproduced without fabricated credentials.
Stopped main by its captured process-group PID 20030 before starting PR.

PR
$ git fetch https://github.com/Iweisc/t3code.git fix/connect-hide-email
$ git switch -c maria/takeover-pr-24733-verify FETCH_HEAD
$ git rev-parse HEAD
3feb7dd1788261d2e265af2b0294c0e10c4e33a8
$ vp i
$ (export public values from .env.example; timeout 20 node apps/server/src/bin.ts connect login --headless --base-dir /home/user/t3code/.t3)
T3 Connect
Headless authorization
Open this URL on a device with a browser:
  https://accounts.t3.codes/device?user_code=[one-time code omitted]
Waiting for approval (expires in 10 min). Press Ctrl+C to cancel.
Stopped by timeout without authorizing.

Initial root dev launch defaulted to ~/.t3; stopped immediately after detecting it.
Restarted with explicit --home-dir /home/user/t3code/.t3.
[dev-runner] serverPort=13773 webPort=5733 baseDir=/home/user/t3code/.t3

Playwright from repository dependencies, executable /usr/bin/google-chrome:
- paired to dev web app
- Add project > Local folder > /home/user/t3code (real repository)
- selected GPT-6.1-Sol in composer
- submitted two real prompts without tools or file edits
- provider app-server thread/start: model=gpt-6.1-sol, modelProvider=cliproxyapi
- first final agentMessage: CONNECT-24733-OK; turn/completed status=completed, error=null
- first response became visible after reload; second response streamed live
- second final agentMessage: CONNECT-24733-SECOND-OK
- reloaded thread and confirmed both responses persisted

Neighboring CLI behavior with public configuration and a separate empty data home:
$ node apps/server/src/bin.ts connect status --base-dir /tmp/pr24733-neighbor
T3 Connect
  Exposure: disabled
  Authorization: missing
  Environment link: not provisioned
  Relay: not provisioned
  Publish agent activity: disabled
  Relay client: not installed
Next: Run `t3 connect link` to authorize and enable T3 Connect.
exit=0
$ node apps/server/src/bin.ts connect logout --base-dir /tmp/pr24733-neighbor
T3 Connect is disabled locally.
The relay-side environment record was not revoked.
Deregister it from the T3 Connect page of your T3 account, or run `t3 connect login` and retry.
Signed out of T3 Connect locally.
The background service is managed separately with `t3 service`.
exit=0

Blacksmith, exact PR head:
$ vp i && vp test run apps/server/src/cloud/CliTokenManager.test.ts apps/server/src/cli/connect.test.ts
Test Files  2 passed (2)
Tests       9 passed (9)

LIMITS
Authorized success output for connect/login/link, live refresh of legacy tokens,
managed tunnel provisioning and cross-device access remain unverified.
The nine passing tests exercise these with simulated services; they are not live OAuth proof.
Native desktop/mobile clients were not exercised on this Linux VM.