fix(status): skip TCP probes while host sessions are active (#1538)

src/backend/hosts/host-session-status.ts

@@ -11,6 +11,10 @@ export class HostSessionStatus {
   private counts = new Map<number, number>();
   private listeners = new Set<HostSessionStatusListener>();
 
+  hasActiveSession(hostId: number): boolean {
+    return (this.counts.get(hostId) ?? 0) > 0;
+  }
+
   register(hostId: number): () => void {
     const count = this.counts.get(hostId) ?? 0;
     this.counts.set(hostId, count + 1);

src/backend/hosts/status/host-status-service.ts

@@ -78,6 +78,7 @@ export interface HostStatusDeps {
     target: StatusTarget,
     port: number,
   ) => Promise<boolean>;
+  hasActiveSession?: (hostId: number) => boolean;
   globalInterval: () => number;
   emit: (payload: HostStatusPayload) => void;
 }
@@ -126,6 +127,7 @@ const defaultDeps: HostStatusDeps = {
       );
     return [...new Set(entries.map((entry) => entry.hostId))];
   },
+  hasActiveSession: (hostId) => hostSessionStatus.hasActiveSession(hostId),
   ping: (host, port) => tcpPing(host, port, 5000),
   pingThroughJumpHosts: async (target, port) => {
     const { createJumpHostChain } = await import("../jump-host-chain.js");
@@ -429,11 +431,15 @@ export class HostStatusService {
     this.owners.set(target.id, target.userId);
     let reachable = false;
     try {
-      const port = await this.portFor(target);
-      reachable =
-        target.jumpHosts.length > 0
-          ? await this.deps.pingThroughJumpHosts(target, port)
-          : await this.deps.ping(target.ip, port);
+      if (this.deps.hasActiveSession?.(target.id)) {
+        reachable = true;
+      } else {
+        const port = await this.portFor(target);
+        reachable =
+          target.jumpHosts.length > 0
+            ? await this.deps.pingThroughJumpHosts(target, port)
+            : await this.deps.ping(target.ip, port);
+      }
     } catch {
       reachable = false;
     }

src/backend/hosts/status/tcp-ping.ts

@@ -2,8 +2,8 @@ import net from "net";
 import type { Client } from "ssh2";
 
 /**
- * Opens a TCP connection and closes it again. An SSH server gets a polite
- * banner back so it does not log a failed handshake.
+ * Opens a TCP connection and closes it again. SSH probes exchange banners,
+ * but still close before authentication and may trigger aggressive Fail2Ban rules.
  */
 export function tcpPing(
   host: string,