PR: https://git.cafe/pingdotgg/t3code/pulls/19173
Main: 575579d68a (github/main)
Head: ffc50a96d12e7cb9bffbc0f998fcca11308c5728

main: vp i; vp run dev (background, captured PID)
serverPort=16733 webPort=8693, empty isolated /home/user/main/.t3
Playwright + /usr/bin/google-chrome, real Settings > Devices > Add source.
Saved privacy-box with loopback SSH target and closed port 1.
Observed: destination visible in the saved row.
Test connection reached ssh: connect to host 127.0.0.1 port 1: Connection refused.
Stopped main by captured process group before starting PR.

PR: vp i; vp run dev --home-dir /home/user/main/.t3 (background)
serverPort=13773 webPort=5733, same app-created data.
Saved target: concealed -> revealed original destination -> concealed.
Edit: original SSH target retained. Test connection still executes real SSH.
Added /home/user/ssh-privacy-project through app Local folder flow.
Selected Codex gpt-6.1-sol and requested README.md using tools.
Turn completed in 7.9s: ssh privacy verification project / provider-path-ok.
Repository remained clean.

Stopped PR web/server stack before desktop test.
vp run dev:web --home-dir /home/user/main/.t3 (background)
Real Electron 44.10.0 under Xvfb, real preload bridge and owned backend13773.
Isolated Electron profile; basic password store after libsecret startup stalled.
Add environment > SSH > loopback, user, port1:
concealed: ssh: connect to host ••• port 1: Connection refused
revealed:  ssh: connect to host 127.0.0.1 port 1: Connection refused
reconcealed; Remote link mode clears previous SSH error.
Configured real SSH alias privacy-box -> 127.0.0.1 port1:
concealed: ssh: connect to host privacy-box port 1: Connection refused
revealed:  ssh: connect to host 127.0.0.1 port 1: Connection refused
Port22 real SSH authentication path opens SSH verification required.
Both destination and prompt concealed; reveal/conceal controls work.
Cancel returns to Add Environment with concealed authentication-cancelled error.

Blacksmith: vp test run packages/client-runtime/src/connection/routes.test.ts packages/client-runtime/src/connection/presentation.test.ts apps/web/src/components/settings/sshTarget.test.ts apps/web/src/components/settings/deviceHostConnectionChecks.test.ts apps/web/src/connection/platform.test.ts
5 files passed; 98 tests passed.
CI: 34 successful, 0 failing, 0 pending at inspected head.
No source changes, commits, pushes, labels, merge, close, rebase, or force-push.

Not verified: successful SSH authentication/tunnel/remote bootstrap or a provider turn over SSH; saved SSH environment route rows; native macOS/Windows and iOS/Android; external relay/tunnel services. VM sshd disables password authentication, so the authentication dialog was cancelled. Local provider turn used the real web/server Codex path.