test(ssh): reject half-open stats probes on the SSH port

Stats latency already pings the authenticated session. Lock that in with
a unit test that fails if getServerStats dials the session host, which
is what produced kex_exchange_identification every ~30s (#3630).

Co-authored-by: 陈大猫 <binaricat@users.noreply.github.com>

electron/bridges/sshBridge/sessionOps.cjs

@@ -1734,7 +1734,7 @@ function createSessionOpsApi(ctx) {
                 disks,         // Array of all mounted disks
                 netRxSpeed,    // Total network receive speed (bytes/sec)
                 netTxSpeed,    // Total network transmit speed (bytes/sec)
-                latencyMs,      // TCP connection establishment latency to the SSH endpoint (ms)
+                latencyMs,      // SSH transport ping on the existing session (ms); never a second TCP dial (#3630)
                 netInterfaces, // Per-interface network stats
                 hostname,
                 osName,

electron/bridges/sshBridge/sessionOps.serverStats.test.cjs

@@ -746,6 +746,46 @@ test("getServerStats measures latency by pinging the stats connection", async ()
   assert.deepEqual(pingedConns, [session.moshStatsConn]);
 });
 
+test("getServerStats does not open an unauthenticated SSH handshake (#3630)", async (t) => {
+  const net = require("node:net");
+  const { createSshPingLatencyProbe } = require("./sshPingLatency.cjs");
+  let accepted = 0;
+  const server = net.createServer((socket) => {
+    accepted += 1;
+    socket.destroy();
+  });
+  t.after(() => new Promise((resolve) => server.close(() => resolve())));
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const port = server.address().port;
+
+  const conn = Object.assign(fakeConn(LINUX_STATS), {
+    config: { keepaliveInterval: 30000 },
+  });
+  const sessions = new Map([["sid", {
+    type: "ssh",
+    conn,
+    hostname: "127.0.0.1",
+    port,
+    _reuseEndpoint: { hostname: "127.0.0.1", port },
+  }]]);
+  let pingTarget = null;
+  const measureSshPingLatency = createSshPingLatencyProbe();
+  const api = makeSessionOps(sessions, {
+    measureSshPingLatency: (target, timeoutMs) => {
+      pingTarget = target;
+      return measureSshPingLatency(target, timeoutMs);
+    },
+  });
+
+  const result = await api.getServerStats({ sender: {} }, { sessionId: "sid" });
+  await new Promise((resolve) => setTimeout(resolve, 50));
+
+  assert.equal(result.success, true);
+  assert.equal(pingTarget, conn);
+  assert.equal(result.stats.latencyMs, null);
+  assert.equal(accepted, 0);
+});
+
 test("getServerStats pings the companion connection for jump-host sessions", async () => {
   const sessions = new Map([["sid", {
     type: "mosh",

types/global/netcatty-bridge-session.d.ts

@@ -318,7 +318,7 @@ declare global {
         }>;
         netRxSpeed: number;           // Total network receive speed (bytes/sec)
         netTxSpeed: number;           // Total network transmit speed (bytes/sec)
-        latencyMs: number | null;     // TCP connection establishment latency to the SSH endpoint
+        latencyMs: number | null;     // SSH transport ping on the existing session, not a second TCP dial
         netInterfaces: Array<{        // Per-interface network stats
           name: string;               // Interface name (e.g., eth0, ens33)
           rxBytes: number;            // Total received bytes