feat: harden local shell, SFTP, and desktop session reliability

Finder-launched terminals now inherit a login PATH so tools like ollama resolve, destructive SFTP/editor actions require confirmation, and terminal search plus window dragging work again. SSH forwards and RDP sessions keep listeners and survive reconnect without FastPath crashes.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/utils/fileLanguage.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { guessLanguageFromPath } from '../../src/utils/fileLanguage'
+import { guessLanguageFromPath, isEditableRemoteTextFile } from '../../src/utils/fileLanguage'
 
 describe('guessLanguageFromPath', () => {
   it('detects common file extensions for the SFTP editor', () => {
@@ -7,5 +7,44 @@ describe('guessLanguageFromPath', () => {
     expect(guessLanguageFromPath('Dockerfile')).toBe('dockerfile')
     expect(guessLanguageFromPath('app.py')).toBe('python')
     expect(guessLanguageFromPath('readme.md')).toBe('markdown')
+    expect(guessLanguageFromPath('index.html.bak')).toBe('html')
+  })
+})
+
+describe('isEditableRemoteTextFile (denylist)', () => {
+  it('allows text, code, config, backups, and unknown extensions', () => {
+    expect(isEditableRemoteTextFile('notes.txt')).toBe(true)
+    expect(isEditableRemoteTextFile('app.yaml')).toBe(true)
+    expect(isEditableRemoteTextFile('index.html')).toBe(true)
+    expect(isEditableRemoteTextFile('app.css')).toBe(true)
+    expect(isEditableRemoteTextFile('main.go')).toBe(true)
+    expect(isEditableRemoteTextFile('weird.xyz')).toBe(true)
+    expect(isEditableRemoteTextFile('Makefile')).toBe(true)
+    expect(isEditableRemoteTextFile('.env')).toBe(true)
+    expect(isEditableRemoteTextFile('nginx.conf.bak')).toBe(true)
+    expect(isEditableRemoteTextFile('app.py.old')).toBe(true)
+    expect(isEditableRemoteTextFile('mystery.bak')).toBe(true)
+    expect(isEditableRemoteTextFile('noext')).toBe(true)
+  })
+
+  it('rejects archives, binaries, media, and office files', () => {
+    expect(isEditableRemoteTextFile('pkg.tar')).toBe(false)
+    expect(isEditableRemoteTextFile('pkg.tar.gz')).toBe(false)
+    expect(isEditableRemoteTextFile('data.gz')).toBe(false)
+    expect(isEditableRemoteTextFile('archive.zip')).toBe(false)
+    expect(isEditableRemoteTextFile('setup.exe')).toBe(false)
+    expect(isEditableRemoteTextFile('lib.so')).toBe(false)
+    expect(isEditableRemoteTextFile('image.png')).toBe(false)
+    expect(isEditableRemoteTextFile('photo.jpg')).toBe(false)
+    expect(isEditableRemoteTextFile('video.mp4')).toBe(false)
+    expect(isEditableRemoteTextFile('font.woff2')).toBe(false)
+    expect(isEditableRemoteTextFile('blob.bin')).toBe(false)
+    expect(isEditableRemoteTextFile('doc.pdf')).toBe(false)
+    expect(isEditableRemoteTextFile('sheet.xlsx')).toBe(false)
+    expect(isEditableRemoteTextFile('archive.zip.bak')).toBe(false)
+  })
+
+  it('rejects directories', () => {
+    expect(isEditableRemoteTextFile('/home/u/src', 'directory')).toBe(false)
   })
 })