feat: harden local shell, SFTP, and desktop session reliability

Finder-launched terminals now inherit a login PATH so tools like ollama resolve, destructive SFTP/editor actions require confirmation, and terminal search plus window dragging work again. SSH forwards and RDP sessions keep listeners and survive reconnect without FastPath crashes.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/components/layout/tabbar/TabContextMenu.tsx

@@ -22,6 +22,7 @@ interface TabContextMenuProps {
   onCloseLeft: () => void
   onCloseAll: () => void
   onClone?: () => void
+  onOpenSftp?: () => void
 }
 
 export function TabContextMenu({
@@ -34,19 +35,30 @@ export function TabContextMenu({
   onCloseLeft,
   onCloseAll,
   onClone,
+  onOpenSftp,
 }: TabContextMenuProps) {
   const { t } = useTranslation('common')
   const menuRef = useRef<HTMLDivElement>(null)
+  const onCloseRef = useRef(onClose)
+  onCloseRef.current = onClose
 
   useEffect(() => {
-    const handleClickOutside = (e: MouseEvent) => {
+    if (!isOpen) return
+    const handlePointerDown = (e: PointerEvent) => {
       if (menuRef.current && !menuRef.current.contains(e.target as Node)) {
-        onClose()
+        onCloseRef.current()
       }
     }
-    document.addEventListener('mousedown', handleClickOutside)
-    return () => document.removeEventListener('mousedown', handleClickOutside)
-  }, [onClose])
+    const handleKeydown = (e: KeyboardEvent) => {
+      if (e.key === 'Escape') onCloseRef.current()
+    }
+    document.addEventListener('pointerdown', handlePointerDown, true)
+    document.addEventListener('keydown', handleKeydown)
+    return () => {
+      document.removeEventListener('pointerdown', handlePointerDown, true)
+      document.removeEventListener('keydown', handleKeydown)
+    }
+  }, [isOpen])
 
   if (!isOpen) return null
 
@@ -61,16 +73,21 @@ export function TabContextMenu({
   if (onClone) {
     items.unshift({ label: t('tab.menu.clone'), action: onClone })
   }
+  if (onOpenSftp) {
+    items.unshift({ label: t('tab.menu.openSftp'), action: onOpenSftp })
+  }
 
   return (
     <div
       ref={menuRef}
       style={{ left: position.x, top: position.y }}
       className="fixed z-50 bg-dark-800 border border-dark-700 rounded-lg shadow-xl py-1 min-w-[160px]"
+      onPointerDown={(e) => e.stopPropagation()}
     >
       {items.map((item, index) => (
         <button
           key={index}
+          type="button"
           onClick={() => {
             item.action()
             onClose()