fix: address PR review security and validation issues

- Add runtime type check for worktreePath in open-in-terminal handler
- Fix Windows Terminal detection using commandExists before spawn
- Fix xterm shell injection by using sh -c with escapeShellArg
- Use loose equality for null/undefined in useEffectiveDefaultTerminal
- Consolidate duplicate imports from open-in-terminal.js

apps/server/src/routes/worktree/index.ts

@@ -29,8 +29,8 @@ import {
   createGetAvailableEditorsHandler,
   createRefreshEditorsHandler,
 } from './routes/open-in-editor.js';
-import { createOpenInTerminalHandler } from './routes/open-in-terminal.js';
 import {
+  createOpenInTerminalHandler,
   createGetAvailableTerminalsHandler,
   createGetDefaultTerminalHandler,
   createRefreshTerminalsHandler,

apps/server/src/routes/worktree/routes/open-in-terminal.ts

@@ -32,10 +32,10 @@ export function createOpenInTerminalHandler() {
         worktreePath: string;
       };
 
-      if (!worktreePath) {
+      if (!worktreePath || typeof worktreePath !== 'string') {
         res.status(400).json({
           success: false,
-          error: 'worktreePath required',
+          error: 'worktreePath required and must be a string',
         });
         return;
       }