# Proof audit pass 1 — issue 5869

Scope: read-only source audit of 4eae8ae011..f472495255 in /home/ubuntu/wt/issue-5869. No browser, server, screenshot, recording, repository edit, commit, or test execution performed. Lead owns Electron and sshd. This document is a proposed matrix, not completed proof.

## Decision

Visual matrix is NOT empty. Only backend/test files change, but SshCommandError.message is displayed in Electron. Static captures prove the new guidance, command, diagnostic retention, and wrapping. No interaction implementation changes: no recording is necessary to prove copy alone. If proof claims submission behavior, absence of a password prompt, retry, or expand/collapse behavior, record that interaction; a final still cannot prove it. Do not multiply tests across unrelated themes or native mobile clients. The explicitly requested 1440/390 × light/dark coverage applies to each actual visual fixture below, not to every command/test variation.

| ID | Minimal fixture and actual renderer | Static coverage requested | Interaction recording disposition |
| --- | --- | --- | --- |
| D1 | Linux Electron Settings → Connections → Add environment → SSH; unknown host, ordinary username and explicit nondefault port; failure shown by AddEnvironmentDialog AlertDescription | 1440 light, 1440 dark, 390 light, 390 dark; compare old raw diagnostic with new terminal command/fingerprint guidance | Static for text-only claim. One submit → failure recording only if claiming prompt-free failure behavior; do not repeat recording per theme merely for unchanged interactions. |
| D2 | Same dialog, changed host key; use genuine OpenSSH changed-key warning including final Host key verification failed line | Same four static variants; necessary longer/different diagnostic, verify guidance does not imply blindly accepting changed keys | Static; no separate new interaction. Changed-key state is NOT proved by unknown-host diagnostic or by a renamed fixture. |
| S1 | Saved SSH environment fails reconnect; Settings → Connections saved environment row, expanded diagnosis Error detail (SavedEnvironmentRows → connection diagnosis details) | Same four static variants; reuse D2 host/error, no new daemon or host needed | Record open diagnostics → visible Error detail if presenting this as an interaction row. This is reachability evidence, not a changed expand behavior. |
| P1 | Same failed saved SSH environment selected in provider settings; ProviderSettingsPanel unavailable/error placeholder with ExpandableText containing connection.error | Same four static variants; reuse S1 state; expand as needed to expose full guidance | Record expansion if truncated text requires it to read guidance; otherwise static suffices. |

Four fixture rows × four variants = 16 after stills under the requested width/theme policy. Obtain corresponding before views for honest comparisons; the supplied single before image does not establish the missing variants. 390 is a narrow Electron renderer viewport, not native mobile or proof that mobile can create desktop SSH connections. Keep viewport height consistent and document it. A copy-only acceptance policy could reduce visual proof to D1/D2, but that would not fulfill an explicit every-affected-renderer policy for saved connections.

## Callers, propagation, and exclusions

- packages/ssh/src/command.ts: runSshCommandInScope adds the guidance only on nonzero exit and stderr containing the case-sensitive substring Host key verification failed. It preserves SshCommandError.stderr. hostSpec uses username plus alias (hostname fallback); port is explicit when present; shell quoting and leading-dash protection affect the displayed command. shellSingleQuote moved from tunnel.ts without algorithm change.
- resolveSshTarget uses runSshCommand with -G: configuration inspection ordinarily does not negotiate a host key; resolution failures fall back to the target. No independent normal visual host-key fixture.
- packages/ssh/src/tunnel.ts: runSshCommand used by remote launch, pairing, shutdown, and related bootstrap operations. Persistent forwarding has additional direct process/error construction paths; do not claim all SSH errors changed. ensureEnvironment propagates the applicable bootstrap error.
- apps/desktop/src/ssh/DesktopSshEnvironment.ts → ipc/methods/sshEnvironment.ts → preload bridge → apps/web/src/connection/platform.ts. Initial provisioning and saved connection preparation both use ensureSshEnvironment. sshPreparationError adds Could not prepare the SSH environment. AddEnvironmentDialog formats and displays the error (SSH AlertDescription, line 579). Add route shares this component, so it is not another distinct visual fixture.
- packages/client-runtime/src/connection/presentation.ts exposes lastFailure.message as connection.error. diagnosis.ts includes failure.detail in the Error diagnostic. SavedEnvironmentRows contains the status tooltip and expandable diagnosis; S1 covers the full diagnostic, and the tooltip is a secondary presentation of that same error, not a new host fixture. ProviderSettingsPanel's unavailable state displays connection.error through ExpandableText (P1).
- CloudEnvironmentConnectList references saved connection.error too, but represents cloud machines; no demonstrated direct SSH host-key fixture through that flow. Do not add cloud/relay fixture rows solely from a textual reference. WelcomeWizard displays the error only for unsupported phase, unlike this remote-unavailable transient error. LegacySidebar's inspected LocalSecondaryStatus filters desktop-local targets; exclude SSH fixtures there.
- apps/server/src/device/SshDeviceHost.ts uses runSshCommand for remote device operations, wraps it in DeviceHostError; its message is generic. DeviceService.sshProbeFailureMessage returns generic SSH connection failure for exit 255, not the new guidance. localSshDeviceHost uses -G and converts failure to false. No demonstrated changed device-host UI text, so no device-host screenshot row or native simulator matrix.
- Browser web has no desktop SSH bridge; native mobile does not invoke this desktop SSH preparation path. Remote/relay/tunnel transport UI is unchanged. Desktop Linux/macOS/Windows share the bridge/renderers; actual OpenSSH executable is ssh.exe on Windows, while displayed advice says ssh and quoting is POSIX-style. macOS and Windows runtime/shell compatibility remain UNVERIFIED; Linux UI evidence must not be labeled cross-platform proof.

## Minimal test/runtime matrix

| Fixture | Existing diff coverage / remaining proof |
| --- | --- |
| Unknown key, username + port 22269 | New tunnel test fakes ssh -G then exit 255 + Host key verification failed; asserts no password request and terminal command. Not a real sshd run. |
| Changed key, actual warning text | NOT explicitly covered by new tests. Need a focused synthetic changed-key stderr test or lead-owned isolated runtime fixture; assert retained warning plus same guidance. Unknown/changed branch equivalence is source-derived, not observed. |
| Space-containing alias + apostrophe username | New command test asserts POSIX single quoting and unchanged stderr. Test-only variation; no screenshot/theme expansion. |
| Leading-dash alias, null username, no port | New command test asserts ssh -- -oProxyCommand=false. Test-only variation. |
| Normal failure not matching host-key substring | Existing normalization path remains; run existing command tests as regression. No extra visual fixture. |
| Retry after deliberate trust / resolving changed key | Optional end-to-end interaction proof. Lead must use its existing isolated setup and independently verify fingerprint. Do not remove real known_hosts entries or trust keys merely to make a test pass. |

Suggested focused command for lead: vp test run packages/ssh/src/command.test.ts packages/ssh/src/tunnel.test.ts. No test results claimed by this audit.

## Supplied before evidence

[Supplied before image](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dd44c50627212346/result.png). Not opened or inspected, per no-browser/no-capture audit scope. Its dimensions, theme, precise failure fixture, and correspondence to the audited base are unverified.

## FRICTION

- No captures or runtime checks made by this reviewer; all proposed proof is pending the lead's existing Electron/sshd session.
- Changed-key test and Windows/macOS runtime proof are missing from the inspected diff.
- A single supplied before image cannot substantiate all width/theme/state comparisons.
- No new interaction implementation means recordings are conditional on behavioral/reachability claims, not mandatory duplicates of static copy proof. If the requested evidence contract treats S1/P1 as interaction rows, supply their recordings as stated above.