feat: harden local shell, SFTP, and desktop session reliability

Finder-launched terminals now inherit a login PATH so tools like ollama resolve, destructive SFTP/editor actions require confirmation, and terminal search plus window dragging work again. SSH forwards and RDP sessions keep listeners and survive reconnect without FastPath crashes.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/stores/nativeConnectionClose.test.ts

@@ -32,4 +32,26 @@ describe('native connection close', () => {
     expect(clearIntervalSpy).toHaveBeenCalled()
     clearIntervalSpy.mockRestore()
   })
+
+  it('keeps tunnel listeners when the pooled SSH connection is reconnecting', async () => {
+    const disconnect = window.opsxApi?.sshDisconnect as ReturnType<typeof vi.fn>
+    disconnect.mockClear()
+    usePoolStore.setState({ connections: new Map([['conn-1', connection('conn-1')]]) })
+
+    await usePoolStore.getState().disconnectConnection('conn-1', 'auto reconnect cleanup', {
+      retainForwards: true,
+    })
+
+    expect(disconnect).toHaveBeenCalledWith('conn-1', { retainForwards: true })
+  })
+
+  it('stops tunnel listeners when the last tab releases the pooled SSH connection', async () => {
+    const disconnect = window.opsxApi?.sshDisconnect as ReturnType<typeof vi.fn>
+    disconnect.mockClear()
+    usePoolStore.setState({ connections: new Map([['conn-1', connection('conn-1')]]) })
+
+    await usePoolStore.getState().disconnectConnection('conn-1', 'no refs')
+
+    expect(disconnect).toHaveBeenCalledWith('conn-1', { retainForwards: false })
+  })
 })