Address PR review feedback (#5360)

- FileExplorerError.sshCommandFailed: surface only the first non-empty
  line of the SSH stderr in the user-visible message so multi-line SSH
  banners (host-key warnings, connection notices) don't appear verbatim
  in the Files panel error label. Full stderr is still passed in via
  the associated value for log/telemetry callers.

- restoreSessionSnapshot: never trust a persisted .remoteReport. The
  semantic of .remoteReport is "confirmed by a live remote shell", but a
  relaunched workspace has not re-confirmed anything yet — the remote
  shell may have started in a different cwd, or the persisted path may
  no longer exist. Coerce restored .remoteReport to .localSeed so the
  SSH file explorer falls back to remote $HOME via resolveRemoteHome on
  reconnect; the first .liveReport from the reconnected shell flips the
  origin back to .remoteReport.

- bash/zsh integration: cache _CMUX_PWD_LAST_PWD only after the relay
  dispatch succeeds. The previous unconditional cache suppressed retries
  when the relay CLI path or remote-relay socket detection transiently
  fails on the first prompt of a new shell.

- FileExplorerSSHRootSeedingTests: rename
  testLegacySnapshotMissingOriginDecodesAsLocalSeed to
  ...DecodesAsNil to accurately describe what's asserted (the decoder
  contract — Workspace.restoreSessionSnapshot's nil → .localSeed
  coercion is exercised end-to-end via the manual restore path).

Author: FunJim

Resources/shell-integration/cmux-bash-integration.bash

@@ -1476,10 +1476,14 @@ _cmux_prompt_command() {
         fi
         # CWD report — relay path only sends via JSON-RPC (issue #5360);
         # the rest of _cmux_prompt_command is gated on a Unix socket.
+        # Cache _CMUX_PWD_LAST_PWD only after the dispatch succeeds so a
+        # transient failure (relay CLI missing, socket not ready, etc.) is
+        # retried on the next prompt instead of being silently suppressed.
         local relay_pwd="$PWD"
         if [[ "$relay_pwd" != "$_CMUX_PWD_LAST_PWD" ]]; then
-            _CMUX_PWD_LAST_PWD="$relay_pwd"
-            _cmux_report_pwd_via_relay "$relay_pwd" || true
+            if _cmux_report_pwd_via_relay "$relay_pwd"; then
+                _CMUX_PWD_LAST_PWD="$relay_pwd"
+            fi
         fi
         return 0
     fi

Resources/shell-integration/cmux-zsh-integration.zsh

@@ -1668,10 +1668,14 @@ _cmux_precmd() {
         fi
         # CWD report — relay path only sends via JSON-RPC (issue #5360);
         # the rest of _cmux_prompt_command is gated on a Unix socket.
+        # Cache _CMUX_PWD_LAST_PWD only after the dispatch succeeds so a
+        # transient failure (relay CLI missing, socket not ready, etc.) is
+        # retried on the next prompt instead of being silently suppressed.
         local relay_pwd="$PWD"
         if [[ "$relay_pwd" != "$_CMUX_PWD_LAST_PWD" ]]; then
-            _CMUX_PWD_LAST_PWD="$relay_pwd"
-            _cmux_report_pwd_via_relay "$relay_pwd" || true
+            if _cmux_report_pwd_via_relay "$relay_pwd"; then
+                _CMUX_PWD_LAST_PWD="$relay_pwd"
+            fi
         fi
         return 0
     fi

Sources/FileExplorerStore.swift

@@ -718,8 +718,16 @@ enum FileExplorerError: LocalizedError {
         case .providerUnavailable:
             return String(localized: "fileExplorer.error.unavailable", defaultValue: "File explorer is not available")
         case .sshCommandFailed(let detail):
-            let trimmed = detail.trimmingCharacters(in: .whitespacesAndNewlines)
-            if trimmed.isEmpty {
+            // Surface only the first non-empty line so multi-line SSH banners
+            // (host-key notices, connection warnings) don't appear verbatim in
+            // the Files panel; the full stderr is still passed in via the
+            // associated value for log/telemetry callers.
+            let firstLine = detail
+                .components(separatedBy: .newlines)
+                .lazy
+                .map { $0.trimmingCharacters(in: .whitespaces) }
+                .first(where: { !$0.isEmpty }) ?? ""
+            if firstLine.isEmpty {
                 return String(
                     localized: "fileExplorer.error.sshFailed",
                     defaultValue: "SSH command failed"
@@ -729,7 +737,7 @@ enum FileExplorerError: LocalizedError {
                 localized: "fileExplorer.error.sshFailedWithDetail",
                 defaultValue: "SSH command failed: %@"
             )
-            return String(format: format, trimmed)
+            return String(format: format, firstLine)
         }
     }
 }

Sources/Workspace.swift

@@ -295,7 +295,19 @@ extension Workspace {
         if !normalizedCurrentDirectory.isEmpty {
             currentDirectory = normalizedCurrentDirectory
         }
-        currentDirectoryOrigin = snapshot.currentDirectoryOrigin ?? .localSeed
+        // Restored origin: never trust a persisted .remoteReport. The semantic of
+        // .remoteReport is "confirmed by a live remote shell", but a relaunched
+        // workspace has not re-confirmed anything yet — the remote shell may have
+        // started in a different cwd, or the persisted path may no longer exist.
+        // Treat .remoteReport as .localSeed so the SSH file explorer falls back
+        // to remote $HOME via resolveRemoteHome; the first .liveReport from the
+        // reconnected shell will flip the origin back to .remoteReport.
+        switch snapshot.currentDirectoryOrigin {
+        case nil, .remoteReport:
+            currentDirectoryOrigin = .localSeed
+        case .localSeed?, .localKnown?:
+            currentDirectoryOrigin = snapshot.currentDirectoryOrigin ?? .localSeed
+        }
 
         let panelSnapshotsById = Dictionary(uniqueKeysWithValues: snapshot.panels.map { ($0.id, $0) })
         let leafEntries: [SessionPaneRestoreEntry] = {

cmuxTests/FileExplorerSSHRootSeedingTests.swift

@@ -59,9 +59,11 @@ final class FileExplorerSSHRootSeedingTests: XCTestCase {
         XCTAssertEqual(workspace.fileExplorerRemoteRootPath, "/home/dev/proj")
     }
 
-    func testLegacySnapshotMissingOriginDecodesAsLocalSeed() throws {
+    func testLegacySnapshotMissingOriginDecodesAsNil() throws {
         // Old session-com.cmuxterm.app.json files do not carry currentDirectoryOrigin.
-        // They must decode to .localSeed for back-compat.
+        // The decode contract is: missing field → nil; restoreSessionSnapshot then
+        // coerces nil → .localSeed via `?? .localSeed` so the SSH file explorer
+        // falls back to remote $HOME on legacy snapshots.
         let json = """
         {
             "processTitle": "Terminal",