feat(project): add project trust and restricted execution mode (#517)

Projects now open with a user-owned trust decision. The prompt offers Preview in Restricted Mode, Don't Open and Trust Project, with an optional trusted parent folder; preview is the default focus so Enter never grants trust.

Restricted projects keep browsing, editing, saving, search and highlighting. Project-controlled execution is denied by default in the backend: run, debug, build, tools, language servers, plugins and Git commands that could honour repository configuration. Trusting a project enables those paths without reopening it, and decisions can be revoked in Settings.

Terminals stay available when the user opens one, without project shell settings, environment or virtualenv activation. A shell prompt that runs git in the folder can still honour the repository's core.fsmonitor.

Fixes #462

src/features/remote-dev/ConnectDialog.tsx

@@ -2,7 +2,7 @@
 import { useState } from "react";
 import { executeAction } from "@/platform/actions";
 import { useTx } from "@/platform/i18n";
-import { call, commands, type RemoteEntry } from "@/platform/ipc";
+import { call, commands, isCancelled, type RemoteEntry } from "@/platform/ipc";
 import { useRemoteProgress } from "@/platform/remote";
 import { sshLabel } from "@/platform/remoteSettings";
 import { useWorkflowSettings } from "@/platform/workflowSettings";
@@ -57,7 +57,7 @@ function ConnectDialog() {
       if (await openRemoteProject(ssh, target)) closeConnectDialog();
       else setBusy(false);
     } catch (e) {
-      setError(e instanceof Error ? e.message : String(e));
+      if (!isCancelled(e)) setError(e instanceof Error ? e.message : String(e));
       setBusy(false);
     }
   };

src/features/remote-dev/remoteDev.test.ts

@@ -1,6 +1,14 @@
 import { describe, expect, it } from "vitest";
 import type { RemoteEntry } from "@/platform/ipc";
-import { forgetRemote, parseRemoteLocation, recentRemotes, rememberRemote, remoteLocation } from "@/platform/remote";
+import {
+  initializeRemoteTrustMigration,
+  takeLegacyRemoteTrust,
+  forgetRemote,
+  parseRemoteLocation,
+  recentRemotes,
+  rememberRemote,
+  remoteLocation,
+} from "@/platform/remote";
 import { browsableFolders, listedDirectory, remoteParent } from "./model";
 
 const entry = (path: string, isDir = true): RemoteEntry => ({
@@ -57,3 +65,15 @@ describe("remote project locations", () => {
     expect(recentRemotes().map((r) => r.path)).toEqual(["/q"]);
   });
 });
+
+it("migrates only the original remote recents once, scoped to the saved host", () => {
+  localStorage.clear();
+  rememberRemote({ sshConfig: "a", path: "/old", host: "me@old", name: "old", openedAtMs: 1 });
+  initializeRemoteTrustMigration();
+  rememberRemote({ sshConfig: "a", path: "/new", host: "me@old", name: "new", openedAtMs: 2 });
+  initializeRemoteTrustMigration();
+  expect(takeLegacyRemoteTrust("a", "/new", "me@old")).toBe(false);
+  expect(takeLegacyRemoteTrust("a", "/old", "me@other")).toBe(false);
+  expect(takeLegacyRemoteTrust("a", "/old", "me@old")).toBe(true);
+  expect(takeLegacyRemoteTrust("a", "/old", "me@old")).toBe(false);
+});