Fix ss output parsing and add unit tests

[umakarem82]

Summary

Applies the changes from didactic_robot_fix.patch and verifies them with new unit tests.

Changes

net_watch_plus.py

• Drop unused field import from dataclasses.
• Add _is_unspecified_ip() helper that covers 0.0.0.0, ::, and the ss * wildcard via ipaddress.is_unspecified. Malformed strings return False so they don't get falsely flagged here (they're still filtered by _is_private_or_special() elsewhere).
• Fix _collect_via_ss() column indexing. ss -tunHp columns are Netid State Recv-Q Send-Q LocalAddr PeerAddr Process, so local/peer live at indexes 4 and 5 (not 3 and 4). Also require len(parts) >= 6 and join the trailing process columns with a space instead of concatenating them, so users:((...)) parses correctly.
• Switch classify_basic() to use the parsed remote IP with _is_unspecified_ip() instead of brittle startswith("0.0.0.0") / startswith("[::]") checks.

test_net_watch_plus.py (new)

• test_collect_via_ss_uses_peer_address_column mocks subprocess.run and asserts the parser correctly extracts local/peer/pid/proc and that classify flags port 3389 as rdp.
• test_unspecified_remote_detection_handles_wildcards verifies *:* is classified as unspecified-remote.

Test results

$ python3 -m unittest test_net_watch_plus -v
test_collect_via_ss_uses_peer_address_column ... ok
test_unspecified_remote_detection_handles_wildcards ... ok
----------------------------------------------------------------------
Ran 2 tests in 0.001s
OK

Note on the patch file

The original didactic_robot_fix.patch could not be fed to git apply directly — the first hunk header declared @@ -42,7 +42,7 @@ but only contained 6 context lines (off-by-one), so git apply rejected it as a corrupt patch. The intent was unambiguous, so the edits were re-applied by hand and the resulting tree exactly matches the patch's stated end state.

---

Note

Low Risk
Low risk: targeted fixes to ss output parsing and unspecified-remote classification, covered by new unit tests.

Overview
Fixes Linux ss -tunHp parsing by reading local/peer addresses from the correct columns and preserving the process blob spacing so PID/process extraction works reliably.

Improves unspecified-remote detection by adding _is_unspecified_ip() (handles 0.0.0.0, ::, and *) and wiring it into classify_basic(). Adds unittest coverage for both the ss parser and wildcard remote classification.

^{Reviewed by Cursor Bugbot for commit 99211d7. Bugbot is set up for automated code reviews on this repo. Configure here.}