feat: harden local shell, SFTP, and desktop session reliability

Finder-launched terminals now inherit a login PATH so tools like ollama resolve, destructive SFTP/editor actions require confirmation, and terminal search plus window dragging work again. SSH forwards and RDP sessions keep listeners and survive reconnect without FastPath crashes.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/components/connection/forwardRules.test.ts

@@ -2,9 +2,13 @@ import { describe, expect, it } from 'vitest'
 
 import {
   duplicateForwardRule,
+  formatHostPort,
   formatTransferBytes,
   parseForwardRules,
+  parseHostPort,
   portForwardStorageKey,
+  resolveForwardTargetHost,
+  resolveRemoteBindHost,
   runtimeMap,
 } from '../../../src/components/connection/forwardRules'
 
@@ -59,4 +63,35 @@ describe('forward rule persistence', () => {
     expect(second.name).toBe('SOCKS5 副本 2')
     expect(second).not.toHaveProperty('isActive')
   })
+
+  it('parses and formats host:port listen/target addresses', () => {
+    expect(parseHostPort('127.0.0.1:18080')).toEqual({ host: '127.0.0.1', port: 18080 })
+    expect(parseHostPort('0.0.0.0:8080')).toEqual({ host: '0.0.0.0', port: 8080 })
+    expect(parseHostPort('bad')).toBeNull()
+    expect(formatHostPort('0.0.0.0', 8080)).toBe('0.0.0.0:8080')
+    expect(resolveForwardTargetHost('0.0.0.0')).toBe('127.0.0.1')
+  })
+
+  it('keeps remote listen bind including 0.0.0.0 for GatewayPorts', () => {
+    const rules = parseForwardRules([
+      {
+        id: 'r1',
+        type: 'remote',
+        name: 'expose',
+        localPort: 8080,
+        remoteBindHost: '0.0.0.0',
+        remoteHost: '192.168.1.10',
+        remotePort: 18080,
+      },
+    ])
+    expect(rules[0]).toMatchObject({
+      type: 'remote',
+      remoteBindHost: '0.0.0.0',
+      remoteHost: '192.168.1.10',
+      remotePort: 18080,
+      localPort: 8080,
+    })
+    expect(resolveRemoteBindHost('localhost')).toBe('127.0.0.1')
+    expect(resolveRemoteBindHost('0.0.0.0')).toBe('0.0.0.0')
+  })
 })