feat: harden local shell, SFTP, and desktop session reliability

Finder-launched terminals now inherit a login PATH so tools like ollama resolve, destructive SFTP/editor actions require confirmation, and terminal search plus window dragging work again. SSH forwards and RDP sessions keep listeners and survive reconnect without FastPath crashes.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/utils/remoteTextLimits.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest'
+import {
+  isWithinRemoteTextEditLimit,
+  MAX_REMOTE_TEXT_EDIT_BYTES,
+} from '../../src/utils/remoteTextLimits'
+
+describe('remoteTextLimits', () => {
+  it('caps at 2 MiB', () => {
+    expect(MAX_REMOTE_TEXT_EDIT_BYTES).toBe(2 * 1024 * 1024)
+  })
+
+  it('allows missing or zero size', () => {
+    expect(isWithinRemoteTextEditLimit(undefined)).toBe(true)
+    expect(isWithinRemoteTextEditLimit(0)).toBe(true)
+  })
+
+  it('rejects over the soft cap', () => {
+    expect(isWithinRemoteTextEditLimit(MAX_REMOTE_TEXT_EDIT_BYTES)).toBe(true)
+    expect(isWithinRemoteTextEditLimit(MAX_REMOTE_TEXT_EDIT_BYTES + 1)).toBe(false)
+  })
+})