feat: session profiles (shell, cwd, env, startup command)

[attson]

Roadmap item 22. Stacked on #348 → #346 → #345. Bases retarget as each merges; merge in order.

What

Named launch configurations, picked when opening a tab or split, one settable as default. Closes three Backlog entries at once — 默认 shell 设置改进 / 启动目录设置 / 环境变量设置 — because those were three fields of the same thing.

Precedence: explicitly picked profile > default profile > default_shell + HOME. default_shell (synced since #348) is not replaced; it is what runs when no profile applies. The Settings copy says this, because it is the question this feature will otherwise generate.

Environment variables do not sync unless you opt in, per profile

Env can hold tokens, so sync_env defaults off and sealProfiles strips unsynced env internally — no caller can bypass it. That turned out to matter: the original plan had stripping as a separate step a caller must remember, and its own test asserted that unsynced env survived a seal. The test was asserting the bug.

The merge rule on pull is the other half. A payload with env stripped is indistinguishable from a profile that never had env, so replacing wholesale would destroy this machine's local env. Merge is per-ID: incoming env wins when present; when incoming has none and local has some, local's survives. Env is only ever overwritten by an explicitly synced env, never cleared by the absence of one.

Machine-specific fields, handled asymmetrically on purpose

A profile carrying /opt/homebrew/bin/fish and /Users/alice/work syncs verbatim to a machine where neither exists.

• Shell falls back. A shell that cannot start means no session at all, so it degrades to the normally-resolved default — the same treatment feat: sync the L1 preference layer across desktop machines #348 established for a synced absolute default_shell.
• Cwd does not. A wrong cwd opens a working session in the wrong directory; the user may not notice and may run commands somewhere they did not intend. Failing loudly beats silently landing elsewhere.
• Both name the offending profile in the error.

Infrastructure this item added first

AAD discriminator bytes lived in two places and were documented in a third with nothing connecting them. Since this item adds the second synthetic tag, internal/e2eecrypto/aadtags.go is now the single registry, pinned to docs/spec/protocol.md by a test — a missing row is a replay risk, not a documentation nit (redline #22).

That guard earned its keep the day it was written: protocol.md was already missing 0x37 PASTE_FILE, redline #22's own list was missing three entries, and the registry's first draft omitted 0x02 and 0x33 — two bytes that are live and tested, missed because their call site passes byte(f.Type) as a variable rather than a literal. All pre-existing, none findable by reading the redline, since the redline was the incomplete list.

Testing

go vet ./... clean and the full Go tree passing; frontend 166 files / 2088 tests; web 232; web-dist rebuilt and verified drift-free.

Every task got its own review, plus a whole-branch review and a scoped re-review of the fix wave. Behavioral claims are proved by observing real child processes — the startup-command and env tests spawn /bin/sh and read a marker file it writes, rather than asserting on the arguments handed to spawn.

⚠️ Two things worth knowing before relying on this

Never run against a real GUI. The four manual checks (profile takes effect, default applies, TERM not overridable, sync_env off keeps env local) were not performed — headless agents, and this app cannot screenshot its own window.

One unreproduced test failure. During final verification a single frontend run reported one failing test file; five subsequent runs passed and the failing test's name was not captured. It may have been a one-off, or an intermittent flake in the new tests that spawn real child processes and poll for marker files. Recording it rather than assuming the passing runs are the truth.