feat(lock): main-window lock screen; harden env gating, sandbox and ssh teardown

Lock screen (main-window overlay, no second window):
- scrypt password verifier in <userData>/lock.json (per-write salt,
  timingSafeEqual); salt/hash/password never leave the main process
- lock now / idle auto-lock / lock at startup, growing failure cooldown,
  lock flags persisted so a quit-and-relaunch cannot bypass the lock
- locked shell and body portals go inert while sessions keep running;
  menu accelerators (reload, DevTools, zoom) are swallowed while locked
- settings gains a Lock tab; all copy in zh-CN/zh-TW/en/ja

Security and stability:
- packaged builds ignore ELECTRON_RENDERER_URL / OT_UPDATE_URL (devEnv)
- renderer preload runs with sandbox: true
- unreadable known_hosts store fails closed instead of being overwritten
- connect-time secrets gated by the bookmark's auth method (connectPromptFor)
- ssh stream teardown is idempotent: PTY_EXIT broadcasts exactly once
- sysinfo polling is refcounted for split panes (forceStopPolling on close)
- session-log index entries are path-contained; settings store writes
  atomically with EPERM/EBUSY retry
- sync-changelog tolerates CRLF checkouts (was a silent no-op)
- retry ssh2 host-key generation (flaky malformed key, ~1/500)

Tests: lock-store + lock-controller suites; transport-death PTY_EXIT e2e;
GitHub Actions CI (typecheck + 10 offline tests + build)

src/shared/i18n/dicts/en/main.ts

@@ -17,6 +17,7 @@ const main: Record<string, string> = {
 
   'main.ssh.connectTimeout': 'Connection timed out ({host}:{port})',
   'main.ssh.saveFingerprintFailed': 'Failed to save the host fingerprint: {detail}',
+  'main.ssh.knownHostsUnreadable': 'The known-hosts file (ssh_known_hosts.json) exists but could not be read. The connection was refused to protect the pinned fingerprints. Repair or delete the file and try again.',
   'main.ssh.hostKeyRejected': 'The user rejected the host key',
   'main.ssh.connectFailed': 'Connection failed {host}:{port}: {detail}',
   'main.ssh.shellOpenFailed': 'Could not open the SSH shell ({host}:{port}): {detail}',

src/shared/i18n/dicts/en/settings.ts

@@ -7,6 +7,7 @@ const settings: Record<string, string> = {
   'settings.tabs.highlight': 'Highlighting',
   'settings.tabs.theme': 'Themes',
   'settings.tabs.system': 'System',
+  'settings.tabs.lock': 'Lock',
   'settings.tabs.about': 'About',
   'settings.resizeHandle': 'Drag to resize',
   'settings.preview': 'Preview',
@@ -100,6 +101,52 @@ const settings: Record<string, string> = {
   'settings.system.shortcutPlaceholder': 'Click and press a shortcut, leave empty to disable',
   'settings.system.shortcutConflict':
     'This shortcut is already used by the app (Ctrl+= / Ctrl+- / Ctrl+0 / Ctrl+PgUp / Ctrl+PgDn). Please choose another.',
+  'settings.lock.password.title': 'Lock password',
+  'settings.lock.password.desc': 'A password is required before the lock can be enabled',
+  'settings.lock.password.configured': 'Set',
+  'settings.lock.password.notConfigured': 'Not set',
+  'settings.lock.password.current': 'Current password',
+  'settings.lock.password.currentPlaceholder': 'Enter the current password',
+  'settings.lock.password.new': 'New password',
+  'settings.lock.password.newPlaceholder': 'Enter a new password',
+  'settings.lock.password.confirm': 'Confirm new password',
+  'settings.lock.password.confirmPlaceholder': 'Repeat the new password',
+  'settings.lock.password.set': 'Set password',
+  'settings.lock.password.change': 'Change password',
+  'settings.lock.password.clear': 'Remove password',
+  'settings.lock.password.clearTitle': 'Remove the lock password?',
+  'settings.lock.password.clearDesc':
+    'The lock is turned off along with it. The current password is required to confirm.',
+  'settings.lock.password.mismatch': 'The two new passwords do not match',
+  'settings.lock.password.empty': 'Enter a password',
+  'settings.lock.password.saved': 'Password saved',
+  'settings.lock.password.cleared': 'Lock password removed',
+  'settings.lock.password.forgot':
+    'A forgotten lock password cannot be recovered from any cloud or backdoor: the only way back in is deleting this machine\u2019s lock data and setting a new one.',
+  'settings.lock.enabled': 'Enable lock',
+  'settings.lock.enabledDesc':
+    'Lock the main window when idle or at startup; unlocking needs the password above',
+  'settings.lock.needPassword': 'Set a lock password first',
+  'settings.lock.autoLock': 'Lock when idle',
+  'settings.lock.autoLockDesc': 'Lock once the system has been idle this long (0 = never)',
+  'settings.lock.autoLockOff': 'Off',
+  'settings.lock.autoLockMinutes': '{n} min',
+  'settings.lock.lockAtStartup': 'Lock at startup',
+  'settings.lock.lockAtStartupDesc': 'Ask for the password right after every launch',
+  'settings.lock.lockNow': 'Lock now',
+  'settings.lock.lockNowDesc': 'Lock the main window immediately (sessions keep running)',
+  'settings.lock.title': 'Locked',
+  'settings.lock.screenDesc': 'Enter the lock password to unlock',
+  'settings.lock.passwordPlaceholder': 'Password',
+  'settings.lock.unlock': 'Unlock',
+  'settings.lock.unlocking': 'Unlocking…',
+  'settings.lock.screenForgot':
+    'Forgot it? The lock password cannot be recovered \u2014 the only way out is deleting this machine\u2019s lock data.',
+  'settings.lock.error.invalidPassword': 'Password is invalid (empty or too short)',
+  'settings.lock.error.wrongPassword': 'Wrong password',
+  'settings.lock.error.cooldown': 'Too many attempts \u2014 try again in {n}s',
+  'settings.lock.error.cooldownGeneric': 'Too many attempts \u2014 try again later',
+  'settings.lock.error.saveFailed': 'Save failed, please retry',
   'settings.resetTerminal': 'Reset terminal settings',
   'settings.resetTerminalTitle': 'Reset terminal settings?',
   'settings.resetTerminalDesc': 'All terminal settings — font, cursor, rendering and theme — will be restored to defaults.',

src/shared/i18n/dicts/ja/main.ts

@@ -17,6 +17,7 @@ const main: Record<string, string> = {
 
   'main.ssh.connectTimeout': '接続がタイムアウトしました ({host}:{port})',
   'main.ssh.saveFingerprintFailed': 'ホスト鍵のフィンガープリントを保存できませんでした: {detail}',
+  'main.ssh.knownHostsUnreadable': '既知ホストファイル (ssh_known_hosts.json) が存在しますが読み取れないため、保存済みフィンガープリントを保護するために接続を拒否しました。ファイルを修復または削除してから再試行してください。',
   'main.ssh.hostKeyRejected': 'ユーザーがホスト鍵を拒否しました',
   'main.ssh.connectFailed': '接続に失敗しました {host}:{port}: {detail}',
   'main.ssh.shellOpenFailed': 'SSH シェルを開けません ({host}:{port}): {detail}',

src/shared/i18n/dicts/ja/settings.ts

@@ -7,6 +7,7 @@ const settings: Record<string, string> = {
   'settings.tabs.highlight': 'ハイライト',
   'settings.tabs.theme': 'テーマ',
   'settings.tabs.system': 'システム',
+  'settings.tabs.lock': 'ロック',
   'settings.tabs.about': 'このアプリについて',
   'settings.resizeHandle': 'ドラッグしてサイズ変更',
   'settings.preview': 'プレビュー',
@@ -97,6 +98,52 @@ const settings: Record<string, string> = {
   'settings.system.shortcutPlaceholder': 'クリックしてショートカットを押す。空欄で無効',
   'settings.system.shortcutConflict':
     'このショートカットはアプリ内で既に使用されています（Ctrl+= / Ctrl+- / Ctrl+0 / Ctrl+PgUp / Ctrl+PgDn）。別のものを選んでください。',
+  'settings.lock.password.title': 'ロックパスワード',
+  'settings.lock.password.desc': 'パスワードを設定するとロックを有効にできます',
+  'settings.lock.password.configured': '設定済み',
+  'settings.lock.password.notConfigured': '未設定',
+  'settings.lock.password.current': '現在のパスワード',
+  'settings.lock.password.currentPlaceholder': '現在のパスワードを入力',
+  'settings.lock.password.new': '新しいパスワード',
+  'settings.lock.password.newPlaceholder': '新しいパスワードを入力',
+  'settings.lock.password.confirm': '新しいパスワード（確認）',
+  'settings.lock.password.confirmPlaceholder': 'もう一度入力してください',
+  'settings.lock.password.set': 'パスワードを設定',
+  'settings.lock.password.change': 'パスワードを変更',
+  'settings.lock.password.clear': 'パスワードを削除',
+  'settings.lock.password.clearTitle': 'ロックパスワードを削除しますか？',
+  'settings.lock.password.clearDesc':
+    '削除するとロックも無効になります。確認のため現在のパスワードが必要です。',
+  'settings.lock.password.mismatch': '新しいパスワードが一致しません',
+  'settings.lock.password.empty': 'パスワードを入力してください',
+  'settings.lock.password.saved': 'パスワードを保存しました',
+  'settings.lock.password.cleared': 'ロックパスワードを削除しました',
+  'settings.lock.password.forgot':
+    'パスワードを忘れてもクラウドから復元する方法はなく、回避手段もありません。本機のロックデータを削除して設定し直すしかありません。',
+  'settings.lock.enabled': 'ロックを有効にする',
+  'settings.lock.enabledDesc':
+    'アイドル時と起動時にメインウィンドウをロックします。解除には上のパスワードが必要です',
+  'settings.lock.needPassword': '先にロックパスワードを設定してください',
+  'settings.lock.autoLock': 'アイドル時に自動ロック',
+  'settings.lock.autoLockDesc': 'システムがこの時間アイドル状態になったらロックします（0 は無効）',
+  'settings.lock.autoLockOff': '無効',
+  'settings.lock.autoLockMinutes': '{n} 分',
+  'settings.lock.lockAtStartup': '起動時にロック',
+  'settings.lock.lockAtStartupDesc': '起動直後にパスワードの入力を求めます',
+  'settings.lock.lockNow': '今すぐロック',
+  'settings.lock.lockNowDesc': 'メインウィンドウをすぐにロックします（セッションは動作を続けます）',
+  'settings.lock.title': 'ロック中',
+  'settings.lock.screenDesc': 'ロックパスワードを入力して解除します',
+  'settings.lock.passwordPlaceholder': 'パスワード',
+  'settings.lock.unlock': '解除',
+  'settings.lock.unlocking': '解除中…',
+  'settings.lock.screenForgot':
+    'パスワードを忘れた場合、復元する方法はありません。本機のロックデータを削除するしかありません。',
+  'settings.lock.error.invalidPassword': 'パスワードが無効です（空または短すぎます）',
+  'settings.lock.error.wrongPassword': 'パスワードが違います',
+  'settings.lock.error.cooldown': '試行回数が多すぎます。{n} 秒後にもう一度お試しください',
+  'settings.lock.error.cooldownGeneric': '試行回数が多すぎます。しばらくしてからお試しください',
+  'settings.lock.error.saveFailed': '保存に失敗しました。もう一度お試しください',
   'settings.resetTerminal': 'ターミナル設定をリセット',
   'settings.resetTerminalTitle': 'ターミナル設定をリセットしますか？',
   'settings.resetTerminalDesc': 'フォント、カーソル、レンダリング、テーマなどすべてのターミナル設定がデフォルトに戻ります。',

src/shared/i18n/dicts/zh-CN/main.ts

@@ -17,6 +17,7 @@ const main: Record<string, string> = {
 
   'main.ssh.connectTimeout': '连接超时 ({host}:{port})',
   'main.ssh.saveFingerprintFailed': '保存主机指纹失败: {detail}',
+  'main.ssh.knownHostsUnreadable': '已知主机文件 (ssh_known_hosts.json) 存在但无法读取，为避免覆盖已保存的指纹，本次连接被拒绝。请修复或删除该文件后重试。',
   'main.ssh.hostKeyRejected': '用户拒绝了主机指纹',
   'main.ssh.connectFailed': '连接失败 {host}:{port}: {detail}',
   'main.ssh.shellOpenFailed': '无法打开 SSH shell ({host}:{port}): {detail}',

src/shared/i18n/dicts/zh-CN/settings.ts

@@ -7,6 +7,7 @@ const settings: Record<string, string> = {
   'settings.tabs.highlight': '高亮',
   'settings.tabs.theme': '主题',
   'settings.tabs.system': '系统',
+  'settings.tabs.lock': '锁屏',
   'settings.tabs.about': '关于',
   'settings.resizeHandle': '拖拽调整大小',
   'settings.preview': '预览',
@@ -94,6 +95,49 @@ const settings: Record<string, string> = {
   'settings.system.shortcutPlaceholder': '点击后按下快捷键，留空禁用',
   'settings.system.shortcutConflict':
     '该组合键已被应用内快捷键占用（Ctrl+= / Ctrl+- / Ctrl+0 / Ctrl+PgUp / Ctrl+PgDn），请换一个。',
+  'settings.lock.password.title': '锁屏密码',
+  'settings.lock.password.desc': '设置密码后才能启用锁屏',
+  'settings.lock.password.configured': '已配置',
+  'settings.lock.password.notConfigured': '未配置',
+  'settings.lock.password.current': '当前密码',
+  'settings.lock.password.currentPlaceholder': '请输入当前密码',
+  'settings.lock.password.new': '新密码',
+  'settings.lock.password.newPlaceholder': '请输入新密码',
+  'settings.lock.password.confirm': '确认新密码',
+  'settings.lock.password.confirmPlaceholder': '再次输入新密码',
+  'settings.lock.password.set': '设置密码',
+  'settings.lock.password.change': '修改密码',
+  'settings.lock.password.clear': '清除密码',
+  'settings.lock.password.clearTitle': '清除锁屏密码？',
+  'settings.lock.password.clearDesc': '清除后锁屏会一并关闭，需要当前密码确认。',
+  'settings.lock.password.mismatch': '两次输入的新密码不一致',
+  'settings.lock.password.empty': '请填写密码',
+  'settings.lock.password.saved': '密码已保存',
+  'settings.lock.password.cleared': '锁屏密码已清除',
+  'settings.lock.password.forgot':
+    '忘记锁屏密码无法通过云端找回，也没有后门：只能删除本机锁屏数据后重新设置。',
+  'settings.lock.enabled': '启用锁屏',
+  'settings.lock.enabledDesc': '闲置或启动时锁定主窗口，解锁需要上面的密码',
+  'settings.lock.needPassword': '请先设置锁屏密码',
+  'settings.lock.autoLock': '闲置自动锁屏',
+  'settings.lock.autoLockDesc': '系统闲置超过该时长后自动锁定（0 表示从不）',
+  'settings.lock.autoLockOff': '关闭',
+  'settings.lock.autoLockMinutes': '{n} 分钟',
+  'settings.lock.lockAtStartup': '启动时锁屏',
+  'settings.lock.lockAtStartupDesc': '每次启动后先要求输入密码',
+  'settings.lock.lockNow': '立即锁屏',
+  'settings.lock.lockNowDesc': '马上锁定主窗口（会话保持运行）',
+  'settings.lock.title': '已锁定',
+  'settings.lock.screenDesc': '输入锁屏密码解锁',
+  'settings.lock.passwordPlaceholder': '密码',
+  'settings.lock.unlock': '解锁',
+  'settings.lock.unlocking': '解锁中…',
+  'settings.lock.screenForgot': '忘记密码？锁屏密码无法找回，只能删除本机锁屏数据。',
+  'settings.lock.error.invalidPassword': '密码无效（不能为空或过短）',
+  'settings.lock.error.wrongPassword': '密码错误',
+  'settings.lock.error.cooldown': '尝试次数过多，请等待 {n} 秒后重试',
+  'settings.lock.error.cooldownGeneric': '尝试次数过多，请稍后再试',
+  'settings.lock.error.saveFailed': '保存失败，请重试',
   'settings.resetTerminal': '恢复默认终端设置',
   'settings.resetTerminalTitle': '恢复默认终端设置？',
   'settings.resetTerminalDesc': '字体、光标、渲染与主题等全部终端设置将恢复为默认值。',

src/shared/i18n/dicts/zh-TW/main.ts

@@ -17,6 +17,7 @@ const main: Record<string, string> = {
 
   'main.ssh.connectTimeout': '連線逾時 ({host}:{port})',
   'main.ssh.saveFingerprintFailed': '儲存主機指紋失敗: {detail}',
+  'main.ssh.knownHostsUnreadable': '已知主機檔案 (ssh_known_hosts.json) 存在但無法讀取，為避免覆寫已儲存的指紋，本次連線被拒絕。請修復或刪除該檔案後重試。',
   'main.ssh.hostKeyRejected': '使用者拒絕了主機指紋',
   'main.ssh.connectFailed': '連線失敗 {host}:{port}: {detail}',
   'main.ssh.shellOpenFailed': '無法開啟 SSH shell ({host}:{port}): {detail}',

src/shared/i18n/dicts/zh-TW/settings.ts

@@ -7,6 +7,7 @@ const settings: Record<string, string> = {
   'settings.tabs.highlight': '高亮',
   'settings.tabs.theme': '主題',
   'settings.tabs.system': '系統',
+  'settings.tabs.lock': '鎖定畫面',
   'settings.tabs.about': '關於',
   'settings.resizeHandle': '拖曳調整大小',
   'settings.preview': '預覽',
@@ -94,6 +95,49 @@ const settings: Record<string, string> = {
   'settings.system.shortcutPlaceholder': '點擊後按下快速鍵，留空為停用',
   'settings.system.shortcutConflict':
     '此組合鍵已被應用內快捷鍵佔用（Ctrl+= / Ctrl+- / Ctrl+0 / Ctrl+PgUp / Ctrl+PgDn），請換一個。',
+  'settings.lock.password.title': '鎖定密碼',
+  'settings.lock.password.desc': '設定密碼後才能啟用鎖定',
+  'settings.lock.password.configured': '已設定',
+  'settings.lock.password.notConfigured': '未設定',
+  'settings.lock.password.current': '目前密碼',
+  'settings.lock.password.currentPlaceholder': '請輸入目前密碼',
+  'settings.lock.password.new': '新密碼',
+  'settings.lock.password.newPlaceholder': '請輸入新密碼',
+  'settings.lock.password.confirm': '確認新密碼',
+  'settings.lock.password.confirmPlaceholder': '再次輸入新密碼',
+  'settings.lock.password.set': '設定密碼',
+  'settings.lock.password.change': '變更密碼',
+  'settings.lock.password.clear': '清除密碼',
+  'settings.lock.password.clearTitle': '清除鎖定密碼？',
+  'settings.lock.password.clearDesc': '清除後鎖定會一併關閉，需要目前密碼確認。',
+  'settings.lock.password.mismatch': '兩次輸入的新密碼不一致',
+  'settings.lock.password.empty': '請填寫密碼',
+  'settings.lock.password.saved': '密碼已儲存',
+  'settings.lock.password.cleared': '鎖定密碼已清除',
+  'settings.lock.password.forgot':
+    '忘記鎖定密碼無法透過雲端找回，也沒有後門：只能刪除本機鎖定資料後重新設定。',
+  'settings.lock.enabled': '啟用鎖定',
+  'settings.lock.enabledDesc': '閒置或啟動時鎖定主視窗，解鎖需要上面的密碼',
+  'settings.lock.needPassword': '請先設定鎖定密碼',
+  'settings.lock.autoLock': '閒置自動鎖定',
+  'settings.lock.autoLockDesc': '系統閒置超過該時間後自動鎖定（0 表示從不）',
+  'settings.lock.autoLockOff': '關閉',
+  'settings.lock.autoLockMinutes': '{n} 分鐘',
+  'settings.lock.lockAtStartup': '啟動時鎖定',
+  'settings.lock.lockAtStartupDesc': '每次啟動後先要求輸入密碼',
+  'settings.lock.lockNow': '立即鎖定',
+  'settings.lock.lockNowDesc': '馬上鎖定主視窗（工作階段保持運作）',
+  'settings.lock.title': '已鎖定',
+  'settings.lock.screenDesc': '輸入鎖定密碼以解鎖',
+  'settings.lock.passwordPlaceholder': '密碼',
+  'settings.lock.unlock': '解鎖',
+  'settings.lock.unlocking': '解鎖中…',
+  'settings.lock.screenForgot': '忘記密碼？鎖定密碼無法找回，只能刪除本機鎖定資料。',
+  'settings.lock.error.invalidPassword': '密碼無效（不能為空或過短）',
+  'settings.lock.error.wrongPassword': '密碼錯誤',
+  'settings.lock.error.cooldown': '嘗試次數過多，請等待 {n} 秒後重試',
+  'settings.lock.error.cooldownGeneric': '嘗試次數過多，請稍後再試',
+  'settings.lock.error.saveFailed': '儲存失敗，請重試',
   'settings.resetTerminal': '恢復預設終端設定',
   'settings.resetTerminalTitle': '恢復預設終端設定？',
   'settings.resetTerminalDesc': '字體、游標、渲染與主題等全部終端設定將恢復為預設值。',