From 293bbfabf461a195d345bb32abfc19497b986b87 Mon Sep 17 00:00:00 2001
From: RaresKeY <158580472+RaresKeY@users.noreply.github.com>
Date: Tue, 16 Jun 2026 06:18:21 +0300
Subject: [PATCH] test(hwfit): cover SSH target validation regressions (#4279)

---
 tests/test_hwfit_remote_validation.py | 51 +++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/tests/test_hwfit_remote_validation.py b/tests/test_hwfit_remote_validation.py
index aee2aaadb..78b434544 100644
--- a/tests/test_hwfit_remote_validation.py
+++ b/tests/test_hwfit_remote_validation.py
@@ -31,6 +31,24 @@ def test_hwfit_routes_reject_ssh_option_host(path, kwargs):
     assert exc.value.status_code == 400
 
 
+@pytest.mark.parametrize(
+    "path,kwargs",
+    [
+        ("/api/hwfit/system", {}),
+        ("/api/hwfit/models", {"limit": 1}),
+        ("/api/hwfit/profiles", {"model": "demo"}),
+        ("/api/hwfit/image-models", {}),
+    ],
+)
+def test_hwfit_routes_reject_invalid_ssh_port(path, kwargs):
+    endpoint = _endpoint(path)
+
+    with pytest.raises(HTTPException) as exc:
+        endpoint(host="alice@gpu-box", ssh_port="-oProxyCommand=sh", **kwargs)
+
+    assert exc.value.status_code == 400
+
+
 def test_hwfit_routes_reject_port_without_host():
     endpoint = _endpoint("/api/hwfit/system")
 
@@ -45,3 +63,36 @@ def test_ssh_argv_rejects_option_shaped_remote():
         _ssh_exec_argv("-oProxyCommand=sh", "22", remote_cmd="true")
     with pytest.raises(ValueError):
         _ssh_exec_argv("alice@-oProxyCommand=sh", "22", remote_cmd="true")
+
+
+def test_detect_system_option_host_never_starts_ssh(monkeypatch):
+    from core import platform_compat
+    from services.hwfit import hardware
+
+    calls = []
+
+    def _record_subprocess_run(*args, **kwargs):
+        calls.append((args, kwargs))
+        raise AssertionError("ssh subprocess should not start")
+
+    monkeypatch.setattr(platform_compat.subprocess, "run", _record_subprocess_run)
+    hardware._cache_by_host.clear()
+
+    try:
+        result = hardware.detect_system(
+            host="-oProxyCommand=sh",
+            ssh_port="22",
+            platform="linux",
+            fresh=True,
+        )
+    finally:
+        hardware._cache_by_host.clear()
+        hardware._remote_host = None
+        hardware._remote_port = None
+        hardware._remote_platform = None
+
+    assert result == {
+        "error": "Cannot connect to -oProxyCommand=sh",
+        "host": "-oProxyCommand=sh",
+    }
+    assert calls == []