[OrcaWin]

	Files	Added	Deleted	Net
Test	13	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​357	$\color{#cf222e}{\Huge{\mathbf{−}}}$​29	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​328
Prod	9	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​174	$\color{#cf222e}{\Huge{\mathbf{−}}}$​62	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​112

ELI5

When Orca connects to an SSH host it asks the host a few small questions, such as "where is your home folder?". The host answers by printing text. On many machines the user's shell startup file also prints something (a greeting, echo hi, or an invisible "set the window title" code), and that extra text got glued onto the answer. Orca then read hi\n/home/me as the home folder, decided it was not a valid path and refused to connect.

Now every answer Orca reads is wrapped between two unique markers, and Orca keeps only what is between them. Startup chatter before the answer is ignored. The same chatter also breaks the host's file-transfer (SFTP) server, so when that happens Orca now copies its install files over a plain command channel instead.

What Changed

Before: any startup file that writes to standard output made ssh:connect fail within about a second with Remote home is not a valid path: <banner>\n/home/<user>. This covered fish config.fish, tcsh .tcshrc, zsh .zshenv, a bash .bashrc echo, and even a bare terminal-title escape. The relay fallback failed on the same check. The "Add remote project" folder browser had the same problem and showed the banner as the folder path.

After: those hosts get past the home probe and every other captured probe, including the login-shell lookup for Node. When the startup output also corrupts the host's external SFTP server, the managed-server and relay uploads stream over exec-channel stdin instead of failing. With internal-sftp, fish, tcsh, zsh, a noisy bash and a title-only bash all connect to a managed server on a real host.

Mechanism:

• execCommand (src/main/ssh/ssh-relay-exec-command.ts) runs every captured POSIX command over SSH. It now wraps the command so the host prints __ORCA_SSH_CAPTURE_BEGIN_<nonce>__, then the command's output, then an end marker, and it returns only what sits between the markers.
  • The exit code is preserved. Error messages and SshCommandExitError.stdout carry the fenced output and the caller's original command text.
  • The wrapping happens after sshd's login shell has read the startup files, inside the /bin/sh that wrapRemoteCommandForPosixShell already starts, so it works under fish, tcsh and nushell login shells.
  • Commands sent with wrapCommand: false (Windows PowerShell and the login-shell probe below) are not changed here.
• The login-shell Node lookup (buildSshLoginShellCommand, used by tryResolveViaLoginShell) runs $SHELL -lc 'command -v node' directly, without the /bin/sh wrapper. It now prints its own fence inside that login shell, as one line that sh, bash, zsh, fish and csh all parse (buildAnyShellStdoutFence). Output from sshd's shell and from the nested login profile both land before the begin marker. That fence cannot carry the exit status (fish and csh have no $?); a miss already reads as an empty answer.
• SFTP: OpenSSH starts an external sftp-server through the user's shell, so startup output lands where the SFTP version reply belongs and ssh2 fails with Packet length 1111577416 exceeds max length (the "length" is the bytes BASH). ssh2 reports such parse failures through the client.sftp callback only before the session is ready, and destroys the channel itself, so no request beyond the handshake was ever sent. SshConnection.sftp tags exactly those errors (src/main/ssh/sftp-handshake-corruption.ts), and classifySftpFailureForExecFallback treats a tagged error as "SFTP unavailable": relay and managed-server install transfers then use the existing exec-stdin upload, and later transfers on the same connection skip SFTP. A lost transport, a timeout, an abort, or a protocol error after the session was ready are still not a verdict and surface as before.
• The SSH folder browser (src/main/ipc/ssh-browse.ts) reads stdout from its own channel, so it gets the same fence.
• The fence itself (src/shared/posix-stdout-fence.ts) is the existing WSL captured-login-shell fence, moved out of wsl-login-shell-command.ts so both transports share it. WSL's command text and behavior are byte-for-byte unchanged.

Why

The root cause was not the home probe itself. Every captured SSH command shared one output stream with the user's startup files. The home probe was simply the first one to validate its answer strictly. Fixing it once in execCommand covers all three home-probe call sites named in the finding (orcad-remote-context.ts, ssh-relay-deploy.ts, ssh-host-relay-terminals-on-connect.ts) and every other probe that parses tokens (OK/MISSING, LOCKED/OPEN, liveness, the $SHELL read for node lookup).

Alternatives considered:

• Fence only the home probe, or call SFTP realpath('.'). This leaves the other probes misreading their answers on the same hosts. SFTP is also broken by the same startup output (see below).
• Strip "noise" heuristically, for example by taking the last line. This is fragile with banners that have no trailing newline and with escape sequences. A per-call nonce marker cannot collide.

No wire or protocol change: this only changes the shell text sent to the host, so mixed client and host versions are unaffected.

Why fall back instead of failing with a "your startup files print to stdout" error: the exec-stdin upload already exists for hosts that refuse or chroot SFTP, it checks the byte count of every file before renaming it into place, and the handshake failure guarantees SFTP wrote nothing. The fallback is limited to that handshake failure so a mid-transfer error never races a second upload route.

Still SFTP-only: user-initiated file uploads and downloads after connect (drag-and-drop import, download to local) use SFTP directly and will still fail on such hosts. The command-line sftp and scp tools fail the same way there.

Linked Issue

Refs #8324 (the Remote home is not a valid path: .bashrc loaded /home/xxx report). Finding: HH-1 (Phase 3.7 hostile-host).

Visual Proof

N/A. No UI change. The connect result is below.

Testing

Real host: a Debian bookworm Docker sshd fixture with users noisyb (bash: echo plus title escape), titleb (title escape only), fishu, tcshu, zshu (.zshenv echo) and a quiet control user. Both apps were launched with ORCA_BACKGROUND_LAUNCH=1, an isolated profile, their own CDP and inspect ports, and token and API key variables unset. Each target was added and ssh.connect was called over CDP.

Build	Host SFTP subsystem	noisy users result
base (phase35 build, identical code for these files)	sftp-server	all 5 fail in about 1 s: Remote home is not a valid path: <banner>\n/home/<user>
base	internal-sftp	all 5 fail the same way
this PR (first commit)	sftp-server	all 5 pass the home probe, then fail in the SFTP upload (Packet length … exceeds max length). Fixed by the exec-stdin fallback; covered by the ssh2 wire fixture below, not yet re-run on the Docker host.
this PR	internal-sftp	all 5 connect, managed server (17–28 s)
this PR	either	quiet control user connects, managed

Automated:

• src/main/ssh/ssh-exec-rc-stdout-noise.test.ts runs the real wrapRemoteCommandForPosixShell wrapper under a real /bin/sh that prints startup noise first: an echo, a bare OSC title, and a banner with no newline. It checks that the home probe validates, that token answers stay exact, that the exit code and error text are kept, and that unwrapped commands are untouched. 4 of 5 cases fail without the fix.

• src/main/ipc/ssh-browse.test.ts: the path-escaping case now delivers its listing after rc noise and a title escape, split across two chunks. It fails without the fix. Exact-command assertions now match the fenced command.

• src/main/ssh/ssh-exec-rc-stdout-noise.test.ts also runs tryResolveViaLoginShell against a real /bin/bash -l whose .bash_profile prints a banner, a title escape, or a banner with no newline and adds a custom Node directory to PATH. All three fail without the fix (the candidate was BASHRC-NOISE or the escape-prefixed path).

• src/main/ssh/ssh-relay-install-noisy-sftp-wire.test.ts runs the real uploadRelayDirectory and writeRelayFile through a real SshConnection against a loopback ssh2 server whose external SFTP subsystem prints a banner or a title escape, and whose exec channels run /bin/sh after the same output. Files land byte-exact over exec stdin, and the second write skips SFTP. Both cases fail without the fix with Packet length … exceeds max length.

• ssh-relay-install-transfers-exec-fallback.test.ts: an untagged protocol error (one that could come mid-transfer) still does not fall back.

• The existing WSL fence suites pass unchanged.

• pnpm tc, oxlint and check:code-quality:changed pass. The src/main/ssh suite plus the WSL suites pass, except for timeouts on a heavily loaded machine. Those timeouts happen on the base too, and the affected files pass when run alone.

• I manually tested these changes locally

• Automated tests added/updated, or explained why not below

Review

Agent skill upstream boundary

• Not applicable, or this change copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

• Windows remote hosts: unchanged. The PowerShell paths use wrapCommand: false.
• System-ssh transport: covered, because it goes through the same execCommand.
• Folder workspaces: not affected. This change is below the workspace layer.
• Output over 1 MiB: if the output cap trims the begin marker, the old raw-output behavior applies.

Checklist

• This PR is small and focused
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred)