feat: harden local shell, SFTP, and desktop session reliability

Finder-launched terminals now inherit a login PATH so tools like ollama resolve, destructive SFTP/editor actions require confirmation, and terminal search plus window dragging work again. SSH forwards and RDP sessions keep listeners and survive reconnect without FastPath crashes.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/helpers/patrol.ts

@@ -0,0 +1,73 @@
+/**
+ * Shared fixtures for root-level patrol / integration tests.
+ */
+
+import { vi } from 'vitest'
+import { mockDesktopApi } from '../setup'
+import { usePoolStore } from '../../src/stores/connection/poolStore'
+import { useSessionStore } from '../../src/stores/sessionStore'
+import { useTabStore } from '../../src/stores/tabStore'
+import { unlockProForTests } from './entitlement'
+import type { Session } from '../../shared/types/session.types'
+
+export const SSH_SESSION: Session = {
+  id: 'patrol-ssh',
+  name: 'Patrol SSH',
+  host: 'opsbase.cn',
+  port: 22,
+  username: 'root',
+  authType: 'password',
+  protocol: 'ssh',
+}
+
+export const RDP_SESSION: Session = {
+  id: 'patrol-rdp',
+  name: 'Patrol RDP',
+  host: 'win.example.com',
+  port: 3389,
+  username: 'Administrator',
+  authType: 'password',
+  protocol: 'rdp',
+  password: 'secret',
+}
+
+export const VNC_SESSION: Session = {
+  id: 'patrol-vnc',
+  name: 'Patrol VNC',
+  host: '192.168.1.50',
+  port: 5900,
+  username: 'vnc',
+  authType: 'password',
+  protocol: 'vnc',
+  password: 'vnc-pass',
+}
+
+export function resetPatrolStores(sessions: Session[] = []) {
+  unlockProForTests()
+  window.opsxApi = mockDesktopApi
+  usePoolStore.setState({ connections: new Map() })
+  useSessionStore.setState({ sessions })
+  useTabStore.setState({
+    tabs: [{ id: 'welcome', title: '欢迎', type: 'welcome', isActive: true }],
+    activeTabId: 'welcome',
+  })
+  vi.clearAllMocks()
+}
+
+export function createDataTransfer(): DataTransfer {
+  const values = new Map<string, string>()
+  const transfer = {
+    effectAllowed: 'all',
+    dropEffect: 'none',
+    files: [] as unknown as FileList,
+    types: [] as string[],
+    setData(type: string, value: string) {
+      values.set(type, value)
+      if (!this.types.includes(type)) this.types.push(type)
+    },
+    getData(type: string) {
+      return values.get(type) || ''
+    },
+  }
+  return transfer as unknown as DataTransfer
+}