fix: harden Windows trans helpers

Resolve #1691 by preserving argv boundaries, adding bounded native rg and wc/skill query support, surfacing WSL-to-Windows hints, and splitting the oversized SSH module and embedded remote scripts.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

scripts/src/remote-ssh.ts

@@ -23,6 +23,7 @@ import {
   sshRuntimeTimeoutHint,
   sshRuntimeTimeoutMs,
   sshRuntimeTimingHint,
+  sshWindowsPlaneHint,
   wrapSshRemoteCommand,
   type SshCaptureResult,
 } from "./ssh";
@@ -390,6 +391,7 @@ async function runRemoteSshWebSocket(
       transport: "frontend-websocket",
     });
     let timedOut = false;
+    let stderrTail = "";
     const openTimer = setTimeout(() => {
       if (sessionReady || settled) return;
       process.stderr.write("unidesk remote frontend ssh bridge timed out waiting for provider session\n");
@@ -428,8 +430,12 @@ async function runRemoteSshWebSocket(
       if (settled) return;
       settled = true;
       restore();
-      const hint = timedOut ? null : sshFailureHint(invocation.providerId, parsed, code, "");
+      const hint = timedOut ? null : sshFailureHint(invocation.providerId, parsed, code, stderrTail);
       if (hint !== null) process.stderr.write(formatSshFailureHint(hint));
+      if (!timedOut) {
+        const windowsPlaneHint = sshWindowsPlaneHint(invocation, code, stderrTail);
+        if (windowsPlaneHint) process.stderr.write(windowsPlaneHint);
+      }
       const timingHint = formatSshRuntimeTimingHint(sshRuntimeTimingHint({
         invocation,
         transport: "frontend-websocket",
@@ -472,6 +478,7 @@ async function runRemoteSshWebSocket(
       if (message.type === "ssh.data") {
         const chunk = Buffer.from(String(message.data ?? ""), message.encoding === "base64" ? "base64" : "utf8");
         if (message.stream === "stderr") {
+          stderrTail = (stderrTail + chunk.toString("utf8")).slice(-16_384);
           if (stderrForwarder === null) {
             process.stderr.write(chunk);
           } else {
@@ -487,7 +494,9 @@ async function runRemoteSshWebSocket(
         return;
       }
       if (message.type === "ssh.error") {
-        process.stderr.write(`${String(message.message || "ssh bridge error")}\n`);
+        const errorText = `${String(message.message || "ssh bridge error")}\n`;
+        stderrTail = (stderrTail + errorText).slice(-16_384);
+        process.stderr.write(errorText);
         exitCode = 255;
         ws.close();
         return;