SFTP: stop waiting for ever on a host whose login prints text, and draw the file panes' icons whole

SSH.NET 2026.0.0 runs the SFTP handshake synchronously inside ConnectAsync, with an infinite
operation timeout and without reading the cancellation token. A host whose login script prints
anything (an echo in .bashrc) puts text where the first SFTP packet belongs; SSH.NET reads its first
four bytes as a length of about a gigabyte and waits for the rest, so the file browser said
"Connecting…" for ever. The SFTP client now uses the connect timeout as its operation timeout for
the handshake and resets it to infinite once connected, so transfers on slow links are unchanged. A
timeout after authentication becomes a TimeoutException naming the likely cause.

The SSH test server gains a second port whose sessions print a banner before sftp-server, and
SftpSessionTests proves the open fails within a 3 s connect timeout with that message. Without the
fix the test runs into its 30 s guard.

Button.paneicon is a fixed 26x26 but kept Fluent's 8,5,8,6 padding, which left a 10px-wide content
box, so every 15-16px Material icon on the SFTP panes was drawn with its sides cut off. Its padding
is now 0. Rename on the host pane used U+E9AD, an italic T (text formatting); it now uses U+E9A2,
the rename glyph the phone's files screen already uses. The host pane's "Up one directory" drew the
design's arrow_downward; both panes now use arrow_upward.

SSH tests 123/123, layout tests 203/203, app tests 744/749 with the 5 Linux TPM skips.

tests/DodoSSH.Client.Ssh.Tests/SftpSessionTests.cs

@@ -211,6 +211,31 @@ public sealed class SftpSessionTests(SshServerFixture fixture)
         refusal.Presentation.Fingerprint.ShouldStartWith("SHA256:");
     }
 
+    [Fact]
+    public async Task AHostWhoseLoginPrintsText_FailsWithinTheConnectTimeout_AndSaysWhy()
+    {
+        var knownHosts = new InMemoryKnownHostStore();
+        var factory = new SshNetConnectionFactory(knownHosts);
+
+        var request = Request() with { Port = fixture.ChattyPort, ConnectTimeout = TimeSpan.FromSeconds(3) };
+
+        var unknown = await Should.ThrowAsync<SshHostKeyUnknownException>(async () =>
+            await factory.OpenSftpAsync(request, Token));
+        await knownHosts.TrustAsync(unknown.Presentation, Token);
+
+        // The banner's first four bytes read as the length of a packet about a gigabyte long, and SSH.NET's
+        // own default is to wait for the rest of it for ever — which the file browser drew as "Connecting…"
+        // with no end. The outer bound is only there so that regression fails this test rather than hangs it,
+        // and it is a cancellation rather than a timeout so that it cannot be mistaken for the answer.
+        using var bound = CancellationTokenSource.CreateLinkedTokenSource(Token);
+        bound.CancelAfter(TimeSpan.FromSeconds(30));
+
+        var failure = await Should.ThrowAsync<TimeoutException>(async () =>
+            await factory.OpenSftpAsync(request, Token).WaitAsync(bound.Token));
+
+        failure.Message.ShouldContain("SFTP service did not answer within 3 seconds");
+    }
+
     private SshConnectionRequest Request() => new(
         fixture.Host,
         fixture.Port,

tests/DodoSSH.Client.Ssh.Tests/SshServerFixture.cs

@@ -42,6 +42,17 @@ public sealed class SshServerFixture : IAsyncLifetime
 
     private const int SshPort = 2222;
 
+    /// <summary>
+    /// A second port on the same sshd, where every session starts with a line of text before SFTP.
+    /// </summary>
+    /// <remarks>
+    /// What a host with an <c>echo</c> in its login script looks like to a file-transfer client: the text
+    /// arrives where the server's first SFTP packet should be. A port rather than an account because this
+    /// image's sshd runs unprivileged and cannot log in as anybody but <see cref="Username"/>, and a port
+    /// rather than a change to the main one so the shell and SFTP suites keep a server that behaves.
+    /// </remarks>
+    private const int ChattySshPort = 2223;
+
     /// <summary>
     /// How many connections in a row the server has to answer before this fixture calls it ready.
     /// </summary>
@@ -65,6 +76,9 @@ public sealed class SshServerFixture : IAsyncLifetime
     /// <summary>Host port the container's sshd is published on.</summary>
     public ushort Port => container!.GetMappedPublicPort(SshPort);
 
+    /// <summary>Host port of the same sshd whose sessions print a banner first; see <see cref="ChattySshPort"/>.</summary>
+    public ushort ChattyPort => container!.GetMappedPublicPort(ChattySshPort);
+
     /// <summary>Host the container is reachable at.</summary>
     public string Host => container!.Hostname;
 
@@ -83,6 +97,7 @@ public sealed class SshServerFixture : IAsyncLifetime
             .WithEnvironment("SUDO_ACCESS", "false")
             .WithEnvironment("PUBLIC_KEY", ExportOpenSshPublicKey(ClientKey))
             .WithPortBinding(SshPort, assignRandomHostPort: true)
+            .WithPortBinding(ChattySshPort, assignRandomHostPort: true)
 
             // The entrypoint generates host keys, rewrites sshd_config and installs the authorized
             // key before sshd is usable, so a published port is not readiness. Both conditions are
@@ -176,6 +191,10 @@ public sealed class SshServerFixture : IAsyncLifetime
     /// been touched — the same trap as the wrong file, one layer up. Measured from the log, after a version
     /// of this fixture did exactly that and failed twenty-eight tests.
     /// </para>
+    /// <para>
+    /// The <see cref="ChattySshPort"/> block goes last because a <c>Match</c> runs to the end of the file:
+    /// anything appended after it would apply only to that port.
+    /// </para>
     /// </remarks>
     private async Task ReconfigureAsync()
     {
@@ -185,6 +204,10 @@ public sealed class SshServerFixture : IAsyncLifetime
             "sed -i 's/^AllowTcpForwarding no/AllowTcpForwarding yes/' /config/sshd/sshd_config"
                 + " && sed -i 's/^#*MaxStartups .*/MaxStartups 200/' /config/sshd/sshd_config"
                 + " && printf '\\nPerSourcePenalties no\\n' >> /config/sshd/sshd_config"
+                + $" && sed -i 's/^Port {SshPort}$/Port {SshPort}\\nPort {ChattySshPort}/' /config/sshd/sshd_config"
+                + $" && printf '\\nMatch LocalPort {ChattySshPort}\\n"
+                + "    ForceCommand /bin/sh -c \"echo Welcome to the test server; exec /usr/lib/ssh/sftp-server\"\\n'"
+                + " >> /config/sshd/sshd_config"
                 + " && pkill -HUP sshd",
         ]);