fix(review): harden + wire remote-host SSH cases end-to-end (PR #145)

- UI: add the missing data-tab="case-remote" tab button; dispatch it through
  submitCaseModal()/switchCaseModalTab() to linkRemoteCase() (was dead code).
- Restore: restoreMuxSessions() now passes remote (muxSession.remote ??
  savedState.remote) into the Session constructor, so remote metadata round-trips
  on restart instead of reattaching from a local cwd / respawning LOCAL / being
  erased from state.json. Recovery tests added.
- Run flows: runClaude()/runShell() route remote cases through /api/quick-start
  (POST /api/sessions stat-validates workingDir locally); run*() skip the
  /api/*/status pre-check and omit inert config/env for remote cases.
- Quick-start: resolve the remote case BEFORE the local CLI availability gates and
  skip isCodex/Gemini/OpenCodeAvailable() when remote; REJECT
  envOverrides/effort/codex/gemini/openCode config for remote (they don't cross
  ssh) instead of silently dropping them.
- Injection: reject $, backtick, $( in remotePath + identityFile at the schema
  layer (they survive shellescape into the bash -c launch double-quote layer).
  Regression tests for $(...) and backtick payloads added.
- Remote socket/name: launch on a DEDICATED -L codeman-remote socket under a
  codeman-ssh-<id> name that fails a remote Codeman's SAFE_MUX_NAME_PATTERN, so a
  remote instance can't adopt the session; scope tmux set-options per-session
  (never -g) so they don't mutate other sessions.
- Kill: best-effort ssh 'tmux -L codeman-remote kill-session' on remote session
  kill (fire-and-forget, never blocks/throws the local kill) so the remote agent
  isn't orphaned forever.
- Probe: wire checkRemoteTmuxAvailable() into POST /api/quick-start (structured
  OPERATION_FAILED) and as courtesy validation in remote-link; add a default
  -o ConnectTimeout=10 to buildSshConnectionArgs (overridable via extraSshOptions).
- Command default: remote claude default is now
  'exec claude --dangerously-skip-permissions' (per-host override stays the escape
  hatch), mirroring local non-interactive semantics.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/tmux-restart-recovery.test.ts

@@ -66,7 +66,14 @@ describe('TmuxManager restart recovery (test mode safety)', () => {
       mode: 'claude',
       attached: false,
       name: 'Recovery Test',
-      respawnConfig: { enabled: true, idleTimeoutMs: 10000, updatePrompt: 'continue', interStepDelayMs: 2000, sendClear: false, sendInit: true },
+      respawnConfig: {
+        enabled: true,
+        idleTimeoutMs: 10000,
+        updatePrompt: 'continue',
+        interStepDelayMs: 2000,
+        sendClear: false,
+        sendInit: true,
+      },
     });
 
     const result = await manager.reconcileSessions();
@@ -86,6 +93,34 @@ describe('TmuxManager restart recovery (test mode safety)', () => {
     expect(result.discovered).toHaveLength(0);
   });
 
+  it('preserves remote SSH metadata across reconcile (mux-sessions.json round-trip source)', async () => {
+    manager.registerSession({
+      sessionId: 'remote-recovery-1',
+      muxName: 'codeman-de51ecaf',
+      pid: 1,
+      createdAt: Date.now(),
+      workingDir: '/home/ubuntu/work',
+      mode: 'claude',
+      attached: false,
+      name: 'Remote Recovery',
+      remote: {
+        hostId: 'gpu-box',
+        label: 'GPU Box',
+        host: '10.0.0.42',
+        username: 'ubuntu',
+        remotePath: '/home/ubuntu/work',
+      },
+    });
+
+    const result = await manager.reconcileSessions();
+    expect(result.alive).toContain('remote-recovery-1');
+
+    // restoreMuxSessions() reads MuxSession.remote off exactly this map to rebuild
+    // the recovered Session — if it were dropped here the session would respawn LOCAL.
+    const recovered = manager.getSession('remote-recovery-1');
+    expect(recovered?.remote).toMatchObject({ hostId: 'gpu-box', host: '10.0.0.42', remotePath: '/home/ubuntu/work' });
+  });
+
   it('should not execute any tmux commands in test mode', async () => {
     manager.registerSession({
       sessionId: 'alive-session',
@@ -101,9 +136,7 @@ describe('TmuxManager restart recovery (test mode safety)', () => {
     await manager.reconcileSessions();
 
     // Verify no tmux commands were executed
-    const tmuxCalls = mockedExecSync.mock.calls.filter(
-      ([cmd]) => typeof cmd === 'string' && cmd.includes('tmux')
-    );
+    const tmuxCalls = mockedExecSync.mock.calls.filter(([cmd]) => typeof cmd === 'string' && cmd.includes('tmux'));
     expect(tmuxCalls).toHaveLength(0);
   });
 
@@ -155,9 +188,7 @@ describe('TmuxManager restart recovery (test mode safety)', () => {
     expect(manager.getSession('kill-me')).toBeUndefined();
 
     // Verify no real kill commands were executed
-    const killCalls = mockedExecSync.mock.calls.filter(
-      ([cmd]) => typeof cmd === 'string' && cmd.includes('kill')
-    );
+    const killCalls = mockedExecSync.mock.calls.filter(([cmd]) => typeof cmd === 'string' && cmd.includes('kill'));
     expect(killCalls).toHaveLength(0);
   });
 });