From 14d16c2578f55f9643c307b991d5e2c5afcdd092 Mon Sep 17 00:00:00 2001
From: Jaime Marques <jaimemarques93@icloud.com>
Date: Mon, 24 Aug 2026 16:54:16 +0100
Subject: [PATCH] fix(desktop): clarify primary SSH reuse failures

---
 .../electron/connection-registry.test.ts      | 36 +++++++++++++++++++
 apps/desktop/electron/connection-registry.ts  | 24 ++++++++++---
 .../electron/primary-backend-startup.test.ts  |  1 +
 contributors/emails/jaimemarques93@icloud.com |  1 +
 4 files changed, 58 insertions(+), 4 deletions(-)
 create mode 100644 contributors/emails/jaimemarques93@icloud.com

diff --git a/apps/desktop/electron/connection-registry.test.ts b/apps/desktop/electron/connection-registry.test.ts
index 4204c936c8..a89fc52315 100644
--- a/apps/desktop/electron/connection-registry.test.ts
+++ b/apps/desktop/electron/connection-registry.test.ts
@@ -60,6 +60,42 @@ test('labelSlug kebab-cases and never returns empty for non-empty input', () =>
   assert.equal(labelSlug('!!!'), 'connection')
 })
 
+test('registry SSH fingerprint failures name the connection and ssh -G step', async () => {
+  const registry = migrateV1ToRegistry({
+    mode: 'ssh',
+    remote: { mode: 'ssh', host: 'build-host', user: 'alice' },
+    profiles: {}
+  })
+
+  const source = registry.connections.find(connection => connection.id === registry.primary)!
+
+  const cause = new Error('spawn ssh ENOENT')
+
+  source.label = 'Build box'
+
+  await assert.rejects(
+    reuseMatchingPrimarySshBackend({
+      connectionId: registry.primary,
+      effectiveFingerprint: async () => {
+        throw cause
+      },
+      ensurePrimary: async () => ({ mode: 'remote', remoteKind: 'ssh' }),
+      profile: 'default',
+      registry,
+      source
+    }),
+    error => {
+      assert.equal(
+        (error as Error).message,
+        `Could not resolve effective SSH config for connection "Build box" (${source.id}) via ssh -G: spawn ssh ENOENT`
+      )
+      assert.equal((error as Error).cause, cause)
+
+      return true
+    }
+  )
+})
+
 test('matching primary/default SSH route reuses the existing descriptor once', async () => {
   const registry = migrateV1ToRegistry({
     mode: 'ssh',
diff --git a/apps/desktop/electron/connection-registry.ts b/apps/desktop/electron/connection-registry.ts
index 92058749fe..919366ecaa 100644
--- a/apps/desktop/electron/connection-registry.ts
+++ b/apps/desktop/electron/connection-registry.ts
@@ -344,9 +344,13 @@ export interface ReuseMatchingPrimarySshBackendOptions {
 }
 
 /**
- * Reuse the already-booted v1 window SSH backend only when its actual dialing
- * identity matches the registry primary. Guards run before either async
- * dependency so secondary profiles and sources never bootstrap the primary.
+ * Reuse the v1 window SSH backend only when its actual dialing identity matches
+ * the registry primary. Resolving that descriptor may boot the primary; a
+ * mismatch returns null without reusing it so the caller continues with its
+ * separately scoped registry backend. A matching descriptor is returned
+ * unchanged and the caller may re-stamp routing fields such as profile and
+ * connectionId. Guards run before either async dependency so secondary
+ * profiles and sources never bootstrap the primary.
  */
 export async function reuseMatchingPrimarySshBackend({
   connectionId,
@@ -363,7 +367,19 @@ export async function reuseMatchingPrimarySshBackend({
     return null
   }
 
-  const sourceFingerprint = String(await effectiveFingerprint(source)).trim()
+  let sourceFingerprint
+
+  try {
+    sourceFingerprint = String(await effectiveFingerprint(source)).trim()
+  } catch (cause) {
+    const detail = cause instanceof Error ? cause.message : String(cause)
+
+    throw new Error(
+      `Could not resolve effective SSH config for connection "${source.label}" (${source.id}) via ssh -G: ${detail}`,
+      { cause }
+    )
+  }
+
   const descriptor = await ensurePrimary()
   const activeSsh = descriptor.mode === 'remote' && descriptor.remoteKind === 'ssh' ? descriptor.ssh : null
   const rootProfile = (value: unknown) => String(value || '').trim() || 'default'
diff --git a/apps/desktop/electron/primary-backend-startup.test.ts b/apps/desktop/electron/primary-backend-startup.test.ts
index fb3d488c5b..72cb072e60 100644
--- a/apps/desktop/electron/primary-backend-startup.test.ts
+++ b/apps/desktop/electron/primary-backend-startup.test.ts
@@ -70,6 +70,7 @@ test('primary remote descriptor preserves the effective SSH dialing identity', (
   )
 
   assert.equal(connection.ssh, ssh)
+  assert.equal(connection.ssh?.effectiveConfigFingerprint, 'effective-config')
 })
 
 test('primary remote descriptor keeps legacy unregistered routes unqualified', () => {
diff --git a/contributors/emails/jaimemarques93@icloud.com b/contributors/emails/jaimemarques93@icloud.com
new file mode 100644
index 0000000000..7eab3ad6d9
--- /dev/null
+++ b/contributors/emails/jaimemarques93@icloud.com
@@ -0,0 +1 @@
+MrTheSoulz