fix(shell,remote-ssh): allowlist the login flags, and keep only CRASHED remote panes

Follow-up to #209 and #210. Both land a real fix (a pane that is a login shell
picks up /etc/profile and the per-user PATH entries an ssh remote command never
sees, which is what was failing agent CLIs with exit 127). Three corrections:

1. `-i -l` is no longer hardcoded onto the resolved shell. That path ultimately
   comes from the passwd entry, which is user data and can name anything, and a
   shell that rejects an unknown flag exits on the spot: nushell, elvish and xonsh
   take neither flag, so a user with one of those in passwd would have gotten a
   dead pane on arrival, which is exactly the #208 failure #209 builds on top of.
   loginShellArgs() applies them only to the POSIX-family shells verified to
   accept both, and a test really launches every allowlisted shell present on the
   machine rather than trusting the set. csh/tcsh are excluded deliberately: tcsh
   honors -l only when it is the ONLY flag.

2. `remain-on-exit on` -> `failed`, moved LAST in the tmux command chain. `on`
   keeps the pane after a CLEAN exit too, so typing `exit` in a remote shell
   stranded a dead pane, the session outlived it, and the next launch's `-A`
   reattached to that corpse: "Pane is dead (status 0)" instead of a shell,
   permanently, on the DEFAULT path. Verified against a real tmux, as was the
   fix: `failed` tears the session down on status 0 and keeps the pane on 127
   with the "command not found" still on screen, which is the case #210 wanted.
   It is last because tmux aborts the remaining commands of a `\;` sequence once
   one errors (also verified) and `failed` needs tmux >= 3.2 on the REMOTE host;
   leading, a rejection there would have silently dropped status/mouse/prefix/
   escape-time/window-size along with it.

3. `$SHELL` -> `"${SHELL:-/bin/sh}"`, via one shared remoteLoginShellCommand()
   helper instead of the string being rebuilt in tmux-manager as well.

Also corrects the rationale both PRs carried: a tmux pane already hands the shell
a tty, so it was interactive all along ($- contains i for a bare /bin/bash in a
pane) and ~/.bashrc was always being sourced. `-l` is the flag doing the work.

End-to-end verified, not just unit-tested: the emitted remote pane command was
run through all three quoting layers under a minimal sshd-style PATH with the
CLI installed only on a login-shell PATH entry, and it resolved and launched the
CLI with its arguments intact and a space-containing remote path preserved.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

test/antigravity-mode.test.ts

@@ -120,6 +120,6 @@ describe('Antigravity mode gates', () => {
     expect(defaultDockerCommandForMode('antigravity')).toBe('exec agy');
     // Routed through an interactive login shell so per-user PATH entries resolve —
     // same fix as the other remote agent CLIs (see defaultRemoteCommandForMode).
-    expect(defaultRemoteCommandForMode('antigravity')).toBe("exec $SHELL -i -l -c 'agy'");
+    expect(defaultRemoteCommandForMode('antigravity')).toBe('exec "${SHELL:-/bin/sh}" -i -l -c \'agy\'');
   });
 });

test/remote-hosts.test.ts

@@ -55,13 +55,15 @@ describe('remote-hosts domain', () => {
   });
 
   it('returns safe mode defaults and remote display values', () => {
-    expect(defaultRemoteCommandForMode('shell')).toBe('exec $SHELL -i -l');
+    expect(defaultRemoteCommandForMode('shell')).toBe('exec "${SHELL:-/bin/sh}" -i -l');
     // Routed through an interactive login shell so per-user PATH entries (e.g.
     // ~/.local/bin, ~/.opencode/bin) resolve — a bare `exec codex` sees only
     // sshd's minimal default PATH and fails with "command not found".
-    expect(defaultRemoteCommandForMode('codex')).toBe("exec $SHELL -i -l -c 'codex'");
+    expect(defaultRemoteCommandForMode('codex')).toBe('exec "${SHELL:-/bin/sh}" -i -l -c \'codex\'');
     // Mirrors the local claude default so the remote agent runs non-interactively.
-    expect(defaultRemoteCommandForMode('claude')).toBe("exec $SHELL -i -l -c 'claude --dangerously-skip-permissions'");
+    expect(defaultRemoteCommandForMode('claude')).toBe(
+      'exec "${SHELL:-/bin/sh}" -i -l -c \'claude --dangerously-skip-permissions\''
+    );
     expect(remoteSshTarget({ id: 'h1', label: 'H1', host: 'box.local', username: 'aamer' })).toBe('aamer@box.local');
     expect(remoteDisplayPath({ username: 'aamer', host: 'box.local', path: '/opt/work' })).toBe(
       'aamer@box.local:/opt/work'

test/remote-ssh-options.test.ts

@@ -150,16 +150,19 @@ describe('COD-107 buildRemoteLaunchCommand — threads connection args', () => {
     const sh = (s: string) => "'" + s.replace(/'/g, "'\\''") + "'";
     const remoteName = `codeman-ssh-${SESSION_ID.slice(0, 8)}`;
     const path = sh('/home/ubuntu/work');
-    const paneCommand = `cd ${path} && exec $SHELL -i -l`;
+    const paneCommand = `cd ${path} && exec "\${SHELL:-/bin/sh}" -i -l`;
     const tmuxInvocation = [
       `tmux -L codeman-remote new-session -A -s ${remoteName} -c ${path} ${sh(paneCommand)}`,
-      `set -t ${remoteName} remain-on-exit on`,
       `set -t ${remoteName} status off`,
       `set -t ${remoteName} mouse off`,
       `set -t ${remoteName} prefix C-q`,
       'set -s escape-time 0',
       // COD-106 — shared/collaborative sizing, per-session scoped (never -g).
       `set -t ${remoteName} window-size latest`,
+      // #210 — keep a CRASHED pane for diagnosis. `failed` (not `on`, which would
+      // also strand a pane after a clean `exit`), and LAST because tmux aborts the
+      // remaining commands of a `\;` chain on error and `failed` needs tmux >= 3.2.
+      `set -t ${remoteName} remain-on-exit failed`,
     ].join(' \\; ');
     // Connection args (with the default -o ConnectTimeout=10) sit after -t.
     const expected = `ssh -o BatchMode=yes -t -o ConnectTimeout=10 ${remoteSshTarget(baseRemote)} ${sh(tmuxInvocation)}`;

test/shell-session-launch.test.ts

@@ -17,7 +17,7 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import { execFileSync } from 'node:child_process';
 import { buildSpawnCommand } from '../src/tmux-manager.js';
-import { resolveLocalShell } from '../src/utils/shell-resolver.js';
+import { loginShellArgs, resolveLocalShell } from '../src/utils/shell-resolver.js';
 
 describe('resolveLocalShell', () => {
   const originalShell = process.env.SHELL;
@@ -70,6 +70,40 @@ describe('resolveLocalShell', () => {
   });
 });
 
+describe('loginShellArgs (#209 login flags, allowlisted)', () => {
+  it('asks for a login shell on the POSIX-family shells that accept the flags', () => {
+    for (const shell of ['/bin/sh', '/bin/bash', '/bin/dash', '/usr/bin/zsh', '/usr/local/bin/fish', '/bin/ksh']) {
+      expect(loginShellArgs(shell)).toBe(' -i -l');
+    }
+  });
+
+  it('adds nothing for shells that take neither flag, so the pane cannot die on arrival', () => {
+    // The shell path can come from the passwd entry, which is user data and can
+    // name anything. A shell that rejects an unknown flag exits immediately —
+    // indistinguishable from the #208 dead-pane-on-arrival this module prevents.
+    // csh/tcsh are here too: tcsh honors -l only when it is the ONLY flag.
+    for (const shell of ['/usr/bin/nu', '/usr/bin/elvish', '/usr/bin/xonsh', '/bin/tcsh', '/bin/csh']) {
+      expect(loginShellArgs(shell)).toBe('');
+    }
+  });
+
+  it('really launches for every allowlisted shell present on this machine', () => {
+    // The whole point of the allowlist is that the flags are ACCEPTED, so prove it
+    // against the real binaries rather than trusting the set.
+    for (const shell of ['/bin/sh', '/bin/bash', '/bin/dash', '/usr/bin/zsh', '/bin/ksh']) {
+      let exists = true;
+      try {
+        execFileSync('/bin/sh', ['-c', `test -x ${shell}`]);
+      } catch {
+        exists = false;
+      }
+      if (!exists) continue;
+      const out = execFileSync('/bin/sh', ['-c', `${shell} -i -l -c 'echo ok' 2>/dev/null`], { encoding: 'utf8' });
+      expect(out).toContain('ok');
+    }
+  });
+});
+
 describe('shell-mode spawn command (issue #208)', () => {
   const originalShell = process.env.SHELL;
 
@@ -88,10 +122,12 @@ describe('shell-mode spawn command (issue #208)', () => {
     expect(cmd.trim()).not.toBe('');
   });
 
-  it('launches an interactive login shell, so rc files (~/.zshrc, ~/.bashrc, etc.) are sourced', () => {
-    // Without -i -l, the resolved shell runs as a bare non-interactive child of
-    // the non-interactive `bash -c` that launches the pane, silently dropping
-    // aliases, PATH additions, and tool init (zoxide, nvm, etc.).
+  it('launches a LOGIN shell, matching what tmux does for a pane with no default-command', () => {
+    // A tmux pane already hands the shell a tty, so it is interactive either way
+    // (`$-` contains `i` for a bare /bin/bash in a pane, which is why ~/.bashrc has
+    // always been sourced). `-l` is the flag that changes anything: it is what
+    // picks up /etc/profile and /etc/profile.d/*, which a systemd --user service
+    // never sourced, so its minimal PATH is what every pane used to inherit.
     const cmd = buildSpawnCommand({ mode: 'shell', sessionId: 'abc123de-0000-0000-0000-000000000000' });
     expect(cmd.trim().endsWith('-i -l')).toBe(true);
   });

test/tmux-manager.test.ts

@@ -146,8 +146,16 @@ describe('TmuxManager (unit)', () => {
         sessionId: 'abc123def456',
       });
 
-      expect(command).toContain('exec $SHELL -i -l');
-      expect(command).toContain('remain-on-exit on');
+      expect(command).toContain('exec "${SHELL:-/bin/sh}" -i -l');
+      // `failed`, not `on`: `on` also keeps the pane after a CLEAN exit, so typing
+      // `exit` in a remote shell strands a dead pane that the next launch's `-A`
+      // reattaches to instead of starting a shell.
+      expect(command).toContain('remain-on-exit failed');
+      expect(command).not.toContain('remain-on-exit on');
+      // Last in the chain: tmux aborts the rest of a `\;` sequence after an error,
+      // and `failed` needs tmux >= 3.2 on the REMOTE host. Trailing, a rejection
+      // costs only this option instead of every setting after it.
+      expect(command.trimEnd().endsWith("remain-on-exit failed'")).toBe(true);
     });
 
     it('defaults claude to a non-interactive launch (--dangerously-skip-permissions)', () => {
@@ -161,7 +169,7 @@ describe('TmuxManager (unit)', () => {
       // interactive nor login, so a bare `exec claude` fails with "command not found".
       // The inner quoting is escaped twice over (once per shellescape() layer), so
       // assert on the unescaped substrings rather than the literal quoted form.
-      expect(command).toContain('exec $SHELL -i -l -c');
+      expect(command).toContain('exec "${SHELL:-/bin/sh}" -i -l -c');
       expect(command).toContain('claude --dangerously-skip-permissions');
     });
   });