@tonbo/cli 0.17.0 → 0.17.1

package/dist/bin/tonbo.js

@@ -2009,7 +2009,7 @@ var ManagementApi = class {
   apiOrigin;
   loginHint;
   pause;
-  constructor(fetcher, apiOrigin2 = DEFAULT_API_ORIGIN, loginHint = DEFAULT_LOGIN_HINT2, pause = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds))) {
+  constructor(fetcher, apiOrigin2 = DEFAULT_API_ORIGIN, loginHint = DEFAULT_LOGIN_HINT2, pause = (milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds))) {
     this.fetcher = fetcher;
     this.apiOrigin = apiOrigin2;
     this.loginHint = loginHint;
@@ -2732,16 +2732,16 @@ function personalLogin(login) {
   return accountLogins(login).find((entry) => entry.kind === "user") ?? null;
 }
 async function preparePrivateDirectory(directory) {
-  const stat2 = await lstat(directory);
-  if (stat2.isSymbolicLink() || !stat2.isDirectory())
+  const stat3 = await lstat(directory);
+  if (stat3.isSymbolicLink() || !stat3.isDirectory())
     throw new Error("Tonbo config directory must be a real directory.");
   if (process.platform !== "win32")
     await chmod(directory, DIRECTORY_MODE);
 }
 async function assertExistingDestinationIsSafe(filename) {
   try {
-    const stat2 = await lstat(filename);
-    if (stat2.isSymbolicLink() || !stat2.isFile())
+    const stat3 = await lstat(filename);
+    if (stat3.isSymbolicLink() || !stat3.isFile())
       throw new Error("Tonbo credential path must be a regular file.");
   } catch (error) {
     if (error.code !== "ENOENT")
@@ -2749,10 +2749,10 @@ async function assertExistingDestinationIsSafe(filename) {
   }
 }
 async function assertPrivateRegularFile(filename) {
-  const stat2 = await lstat(filename);
-  if (stat2.isSymbolicLink() || !stat2.isFile())
+  const stat3 = await lstat(filename);
+  if (stat3.isSymbolicLink() || !stat3.isFile())
     throw new Error("Tonbo credential path must be a regular file.");
-  if (process.platform !== "win32" && (stat2.mode & REFUSED_MODE_BITS) !== 0)
+  if (process.platform !== "win32" && (stat3.mode & REFUSED_MODE_BITS) !== 0)
     throw new Error(`Tonbo credential file must have mode ${credentialsContract.permissions.file_mode}.`);
 }
 
@@ -2903,7 +2903,7 @@ var DeviceStore = class {
         await rm2(lock, { recursive: true, force: true });
         waited = -CREATE_POLL_MS;
       } else
-        await new Promise((resolve) => setTimeout(resolve, CREATE_POLL_MS));
+        await new Promise((resolve2) => setTimeout(resolve2, CREATE_POLL_MS));
     }
     try {
       if (await exists(this.filename))
@@ -3556,7 +3556,7 @@ var AuthClient = class {
     const deadline = Date.now() + started.expires_in * 1e3;
     let interval = started.interval;
     for (; ; ) {
-      await new Promise((resolve) => setTimeout(resolve, interval * 1e3));
+      await new Promise((resolve2) => setTimeout(resolve2, interval * 1e3));
       try {
         const redeemed = await requestJson(this.fetcher, new URL("/api/cli/login/device/token", this.loginOrigin).toString(), {
           method: "POST",
@@ -3585,7 +3585,7 @@ var AuthClient = class {
     }
   }
   listenForCode(expectedState, authorizationUrl, progress, openBrowser2) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       let settled = false;
       const sockets = /* @__PURE__ */ new Set();
       let authorizationStarted = false;
@@ -3606,7 +3606,7 @@ var AuthClient = class {
             reject(closeError);
           else if ("code" in result) {
             progress({ status: "completed", step: "callback-close" });
-            resolve(result.code);
+            resolve2(result.code);
           } else
             reject(result.error);
         };
@@ -5289,6 +5289,8 @@ import { readFileSync } from "node:fs";
 // src/volume.ts
 import { randomUUID as randomUUID6 } from "node:crypto";
 var VOLUME_DURABILITY_LINK = "https://tonbo.dev/docs/machines/guarantees/data#volume";
+var VOLUMES_PREVIEW = true;
+var VOLUME_PREVIEW_TEXT = `Preview: Tonbo does not yet promise when a write to a Volume is durable; keep data you cannot lose in a database too (${VOLUME_DURABILITY_LINK}).`;
 var VOLUME_ERROR_HINTS = {
   payment_required: "Add credit at <billing>, then create the Volume again.",
   region_not_offered: "Volumes are not offered to this account in that region yet; nothing was created. Name a region where they are offered.",
@@ -5335,7 +5337,7 @@ function volumeFields(volume) {
       "Cold GETs",
       volume.cold ? `${volume.cold.demand_gets} demand, ${volume.cold.hydrate_gets} hydration` : "none"
     ],
-    ["Durability", VOLUME_DURABILITY_LINK],
+    ["Durability", VOLUMES_PREVIEW ? VOLUME_PREVIEW_TEXT : VOLUME_DURABILITY_LINK],
     ["Created", volume.created_at]
   ]);
 }
@@ -5363,6 +5365,7 @@ async function volumeListCommand(deps, options = {}) {
         ])
       ) : "No Volumes."
     );
+    if (VOLUMES_PREVIEW && list.data.length && !options.json) deps.notice(VOLUME_PREVIEW_TEXT);
     if (list.unavailable_regions.length)
       deps.notice(
         `Could not read the Volumes in ${list.unavailable_regions.join(", ")}; they are missing from this list.`
@@ -5394,6 +5397,7 @@ async function volumeCreateCommand(deps, name, options = {}) {
       [
         `Created Volume ${volume.name} in ${volume.region} (${volume.size_gib} GiB; billed by live bytes, not size).`,
         `Mount it on a Machine of ${volume.region} with \`tonbo machine update <machine> --volume ${volume.name}:/data\`; it attaches at the Machine's next boot.`,
+        ...VOLUMES_PREVIEW ? [VOLUME_PREVIEW_TEXT] : [],
         volumeFields(volume)
       ].join("\n")
     );
@@ -5781,7 +5785,7 @@ function waitTimeout(options) {
 var DEFAULT_WAIT_SECONDS = 300;
 async function waitForMachine(deps, key, name, firstWait, every, timeout, settled) {
   const now = deps.now ?? Date.now;
-  const pause = deps.pause ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
+  const pause = deps.pause ?? ((milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds)));
   const start = now();
   let wait = firstWait;
   let last = null;
@@ -7094,8 +7098,8 @@ function optionDescription(option) {
 }
 function applyHelp(program) {
   const named = /* @__PURE__ */ new Set();
-  const walk = (command, words) => {
-    const path5 = words.join(" ");
+  const walk = (command, words2) => {
+    const path5 = words2.join(" ");
     command.configureHelp({ ...command.configureHelp(), optionDescription });
     const help = COMMAND_HELP[path5];
     if (help) {
@@ -7112,7 +7116,7 @@ function applyHelp(program) {
       }
       command.addHelpText("after", commandHelpText(help));
     }
-    for (const child of command.commands) walk(child, [...words, child.name()]);
+    for (const child of command.commands) walk(child, [...words2, child.name()]);
   };
   walk(program, [program.name()]);
   for (const path5 of Object.keys(COMMAND_HELP))
@@ -7510,7 +7514,7 @@ async function machineFileStatCommand(deps, name, path5, options = {}) {
   try {
     const key = await deps.auth.apiKey();
     const region = await regionOf(deps, key, name);
-    const stat2 = await cellApi(deps).json(
+    const stat3 = await cellApi(deps).json(
       "statMachineFile",
       key,
       region,
@@ -7520,14 +7524,14 @@ async function machineFileStatCommand(deps, name, path5, options = {}) {
         headers: { "tonbo-expect-activation": options.expectActivation }
       }
     );
-    noticeWake(deps, stat2.machine, name);
+    noticeWake(deps, stat3.machine, name);
     print(
       deps,
       options.json,
-      stat2,
+      stat3,
       fields(
         ["path", "type", "size", "mode", "uid", "gid", "mtime", "etag", "target", "durability"].map(
-          (field) => [field, cellText(stat2[field])]
+          (field) => [field, cellText(stat3[field])]
         )
       )
     );
@@ -7681,12 +7685,167 @@ async function terminalAsk(question) {
 // src/ssh.ts
 import { spawn, spawnSync } from "node:child_process";
 import { existsSync as existsSync2 } from "node:fs";
-import { chmod as chmod2, mkdir as mkdir4, readFile as readFile5, readdir, rename as rename4, writeFile as writeFile2 } from "node:fs/promises";
+import { chmod as chmod3, mkdir as mkdir4, readFile as readFile6, readdir as readdir2, rename as rename5, writeFile as writeFile3 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { join as join2 } from "node:path";
+
+// src/ssh-legacy.ts
+import { chmod as chmod2, readdir, readFile as readFile5, realpath, rename as rename4, rm as rm4, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
+var LEGACY_BEGIN = "# >>> tonbo project ssh >>>";
+var LEGACY_END = "# <<< tonbo project ssh <<<";
+var PROXY_COMMAND = /^\s*proxycommand(\s|=)/i;
+var SSH_PROXY = /(^|[\s'"/])ssh-proxy(\s|['"]|$)/;
+function shown(path5, home) {
+  return path5.startsWith(home + sep) ? `~${path5.slice(home.length)}` : path5;
+}
+function words(text) {
+  const found = [];
+  for (const match of text.matchAll(/"([^"]*)"|(\S+)/g)) found.push(match[1] ?? match[2]);
+  return found;
+}
+function wildcard(segment) {
+  const pattern = segment.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+  return new RegExp(`^${pattern}$`);
+}
+async function expand(pattern) {
+  const parts = pattern.split(sep).filter((part) => part !== "");
+  let paths = [sep];
+  for (const part of parts) {
+    if (!/[*?]/.test(part)) {
+      paths = paths.map((path5) => join(path5, part));
+      continue;
+    }
+    const matcher = wildcard(part);
+    const next = [];
+    for (const path5 of paths) {
+      const names = await readdir(path5).catch(() => []);
+      for (const name of names.sort())
+        if (matcher.test(name) && !name.startsWith(".")) next.push(join(path5, name));
+    }
+    paths = next;
+  }
+  return paths;
+}
+async function scan(home) {
+  const sshDir = join(home, ".ssh");
+  const files = [];
+  const seen = /* @__PURE__ */ new Set();
+  const visit = async (path5, depth) => {
+    if (depth > 16 || seen.has(path5) || !path5.startsWith(sshDir + sep)) return;
+    seen.add(path5);
+    let text;
+    try {
+      if (!(await stat2(path5)).isFile()) return;
+      text = await readFile5(path5, "utf8");
+    } catch {
+      return;
+    }
+    const lines = text.split("\n");
+    const file = { path: path5, lines, blocks: [], handEdited: [] };
+    const includes = [];
+    for (let index = 0; index < lines.length; index++) {
+      if (lines[index].trim() === LEGACY_BEGIN) {
+        const end = lines.findIndex((line2, at) => at > index && line2.trim() === LEGACY_END);
+        if (end !== -1) {
+          file.blocks.push([index, end]);
+          index = end;
+          continue;
+        }
+      }
+      const line = lines[index];
+      if (PROXY_COMMAND.test(line) && SSH_PROXY.test(line)) file.handEdited.push(index + 1);
+      const include = /^\s*include(?:\s+|\s*=\s*)(.*)$/i.exec(line);
+      if (include) includes.push(...words(include[1].replace(/\s#.*$/, "")));
+    }
+    if (file.blocks.length || file.handEdited.length) files.push(file);
+    for (const name of includes) {
+      const expanded = name.startsWith("~/") ? join(home, name.slice(2)) : name;
+      const absolute = isAbsolute(expanded) ? resolve(expanded) : resolve(sshDir, expanded);
+      for (const match of await expand(absolute)) await visit(match, depth + 1);
+    }
+  };
+  await visit(join(sshDir, "config"), 0);
+  return files;
+}
+function stamp(now) {
+  return new Date(now).toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+}
+function blockLines(file, home) {
+  const out = [`${shown(file.path, home)}: delete these lines, the outdated Tonbo block:`];
+  for (const [start, end] of file.blocks)
+    for (let index = start; index <= end; index++)
+      out.push(`  ${index + 1}: ${file.lines[index].replace(/\r$/, "")}`);
+  return out.join("\n");
+}
+async function legacySshGuidance(home = homedir()) {
+  const files = await scan(home);
+  const found = [
+    ...files.filter((file) => file.blocks.length).map((file) => blockLines(file, home)),
+    ...files.flatMap(
+      (file) => file.handEdited.map(
+        (line) => `${shown(file.path, home)}:${line}: this ProxyCommand runs \`tonbo ssh-proxy\`; delete the line.`
+      )
+    )
+  ];
+  return [
+    "tonbo ssh-proxy is gone: an outdated Tonbo block in your SSH config still runs it.",
+    ...found.length ? found : [`Delete the lines from "${LEGACY_BEGIN}" to "${LEGACY_END}" in ~/.ssh/config.`],
+    "Running `tonbo ssh <machine>` or `tonbo ssh config` removes the block for you, with a backup."
+  ].join("\n");
+}
+async function removeLegacySshConfig(options) {
+  const home = options.home ?? homedir();
+  const now = options.now ?? Date.now;
+  const files = await scan(home);
+  const unwritable = [];
+  for (const file of files) {
+    if (!file.blocks.length) continue;
+    const original = file.lines.join("\n");
+    const kept = file.lines.filter(
+      (_, index) => !file.blocks.some(([start, end]) => index >= start && index <= end)
+    );
+    const sshDir = join(home, ".ssh");
+    const name = file.path.slice(sshDir.length + 1).split(sep).join("-");
+    const backup = join(sshDir, `${name}.tonbo-${stamp(now())}.bak`);
+    let temporary;
+    try {
+      const target = await realpath(file.path);
+      const mode = (await stat2(target)).mode & 4095;
+      await writeFile2(backup, original, { mode, flag: "wx" });
+      await chmod2(backup, mode);
+      temporary = join(dirname(target), `.${process.pid}.tonbo-ssh-config.tmp`);
+      await writeFile2(temporary, kept.join("\n"), { mode, flag: "wx" });
+      await chmod2(temporary, mode);
+      await rename4(temporary, target);
+      temporary = void 0;
+    } catch (error) {
+      if (temporary) await rm4(temporary, { force: true }).catch(() => {
+      });
+      unwritable.push(
+        `${blockLines(file, home)}
+(could not rewrite it: ${error instanceof Error ? error.message : String(error)})`
+      );
+      continue;
+    }
+    options.notice(
+      `Removed an outdated Tonbo block from ${shown(file.path, home)} (backup: ${shown(backup, home)})`
+    );
+  }
+  const handEdited = files.flatMap(
+    (file) => file.handEdited.map(
+      (line) => `${shown(file.path, home)}:${line}: a ProxyCommand runs \`tonbo ssh-proxy\`, which this CLI no longer has; delete or change that line, then run the command again`
+    )
+  );
+  if (unwritable.length || handEdited.length)
+    throw new Error([...unwritable, ...handEdited].join("\n"));
+}
+
+// src/ssh.ts
 function sshDirectory(env = process.env) {
-  const config = env.XDG_CONFIG_HOME?.trim() || join(homedir(), ".config");
-  return join(config, "tonbo", "ssh");
+  const config = env.XDG_CONFIG_HOME?.trim() || join2(homedir2(), ".config");
+  return join2(config, "tonbo", "ssh");
 }
 var RENEW_BEFORE_MS = 12e4;
 var REQUESTED_TTL_SECONDS = 3600;
@@ -7704,9 +7863,9 @@ function cellOrigin2(host) {
   return `https://api.${host}`;
 }
 async function ensureKey(directory) {
-  const key = join(directory, "id_ed25519");
+  const key = join2(directory, "id_ed25519");
   await mkdir4(directory, { recursive: true, mode: 448 });
-  await chmod2(directory, 448);
+  await chmod3(directory, 448);
   if (!existsSync2(key)) {
     const made = spawnSync(
       "ssh-keygen",
@@ -7725,41 +7884,41 @@ async function ensureKey(directory) {
 }
 async function writeAtomic(path5, data) {
   const temporary = `${path5}.${process.pid}.tmp`;
-  await writeFile2(temporary, data, { mode: 384 });
-  await rename4(temporary, path5);
+  await writeFile3(temporary, data, { mode: 384 });
+  await rename5(temporary, path5);
 }
 function certificatePath(directory, user) {
-  return join(directory, `${user}-cert.pub`);
+  return join2(directory, `${user}-cert.pub`);
 }
 function hostCAPath(directory, host) {
   if (!/^[a-z0-9][a-z0-9.-]*$/.test(host)) {
     throw new Error(`${host} is not a Machine's SSH host`);
   }
-  return join(directory, "host-ca", host);
+  return join2(directory, "host-ca", host);
 }
 async function trustHostCA(directory, host, lines) {
-  const cells = join(directory, "host-ca");
+  const cells = join2(directory, "host-ca");
   await mkdir4(cells, { recursive: true, mode: 448 });
   await writeAtomic(hostCAPath(directory, host), `${lines.join("\n")}
 `);
   const trusted = /* @__PURE__ */ new Set();
-  for (const name of (await readdir(cells)).sort()) {
+  for (const name of (await readdir2(cells)).sort()) {
     if (name.endsWith(".tmp")) {
       continue;
     }
-    for (const line of (await readFile5(join(cells, name), "utf8")).split("\n")) {
+    for (const line of (await readFile6(join2(cells, name), "utf8")).split("\n")) {
       if (line.trim() !== "") {
         trusted.add(line.trim());
       }
     }
   }
-  await writeAtomic(join(directory, "known_hosts"), `${[...trusted].join("\n")}
+  await writeAtomic(join2(directory, "known_hosts"), `${[...trusted].join("\n")}
 `);
 }
 async function heldUntil(directory, user) {
   try {
     const sidecar = JSON.parse(
-      await readFile5(`${certificatePath(directory, user)}.json`, "utf8")
+      await readFile6(`${certificatePath(directory, user)}.json`, "utf8")
     );
     return sidecar.valid_before ? Date.parse(sidecar.valid_before) : 0;
   } catch {
@@ -7792,12 +7951,12 @@ async function cellRequest(bearer, method, url, body) {
 async function refreshCertificate(bearer, destination, now = Date.now, directory = sshDirectory()) {
   const key = await ensureKey(directory);
   const certificate = certificatePath(directory, destination.user);
-  const knownHosts = join(directory, "known_hosts");
+  const knownHosts = join2(directory, "known_hosts");
   if (await heldUntil(directory, destination.user) - now() > RENEW_BEFORE_MS && existsSync2(hostCAPath(directory, destination.host)) && existsSync2(knownHosts)) {
     return { key, certificate, knownHosts };
   }
   const origin = cellOrigin2(destination.host);
-  const publicKey = (await readFile5(`${key}.pub`, "utf8")).trim();
+  const publicKey = (await readFile6(`${key}.pub`, "utf8")).trim();
   const issued = await cellRequest(bearer, "POST", `${origin}/v1/ssh/certificates`, {
     public_key: publicKey,
     ttl_seconds: REQUESTED_TTL_SECONDS
@@ -7834,6 +7993,7 @@ function sshOptions(paths) {
   ];
 }
 async function sshCommand(deps, name, command) {
+  await removeLegacySshConfig({ notice: deps.notice });
   let destination;
   let paths;
   try {
@@ -7848,32 +8008,54 @@ async function sshCommand(deps, name, command) {
     throw explainMachineError(error);
   }
   const target = `${destination.user}@${destination.host}`;
-  const status = await new Promise((resolve, reject) => {
+  const status = await new Promise((resolve2, reject) => {
     const child = spawn("ssh", [...sshOptions(paths), target, ...command], { stdio: "inherit" });
     child.on(
       "error",
       (error) => reject(new Error(`could not run ssh (${error.message}); install an OpenSSH client`))
     );
-    child.on("exit", (code, signal) => resolve(code ?? (signal ? 255 : 0)));
+    child.on("exit", (code, signal) => resolve2(code ?? (signal ? 255 : 0)));
   });
   process.exitCode = status;
 }
+var REGIONLESS_HOST = "tonbo.sh";
+async function regionlessHint(deps, destination) {
+  const name = destination.user.slice(0, destination.user.lastIndexOf("."));
+  try {
+    const { machine } = await deps.api.getMachineWithEtag(await deps.auth.apiKey(), name);
+    if (machine.kind !== "managed")
+      return new Error(`${name} is one of your computers; SSH reaches only Tonbo-run Machines`);
+    return new Error(
+      `Use <name>.<account>@<region>.tonbo.sh (region-less SSH isn't available yet), e.g. ssh ${machine.hostnames.ssh}`
+    );
+  } catch (error) {
+    if (error instanceof HttpError && error.status === 404)
+      return new Error(`The account ${destination.account} has no Machine named ${name}`);
+    throw explainMachineError(error);
+  }
+}
 async function sshRefreshCommand(makeDeps, target) {
   const destination = parseDestination(target);
   const deps = makeDeps(destination.account);
+  if (destination.host === REGIONLESS_HOST) throw await regionlessHint(deps, destination);
+  await removeLegacySshConfig({ notice: deps.notice });
   await refreshCertificate(await deps.auth.apiKey(), destination, deps.now);
 }
+async function sshConfigCommand(deps) {
+  await removeLegacySshConfig({ notice: deps.notice });
+  deps.output(sshConfigText());
+}
 function sshConfigText(directory = sshDirectory()) {
-  const home = homedir();
-  const shown = directory.startsWith(home) ? `~${directory.slice(home.length)}` : directory;
+  const home = homedir2();
+  const shown2 = directory.startsWith(home) ? `~${directory.slice(home.length)}` : directory;
   return [
     "# Tonbo Machines: append to ~/.ssh/config (tonbo ssh config >> ~/.ssh/config).",
     "# Then: ssh <name>.<account>@<region>.tonbo.sh, scp, sftp and Remote-SSH work as usual.",
     `Match host "*.tonbo.sh,tonbo.sh" exec "tonbo ssh refresh %r@%h"`,
-    `  IdentityFile ${shown}/id_ed25519`,
-    `  CertificateFile ${shown}/%r-cert.pub`,
+    `  IdentityFile ${shown2}/id_ed25519`,
+    `  CertificateFile ${shown2}/%r-cert.pub`,
     "  IdentitiesOnly yes",
-    `  UserKnownHostsFile ${shown}/known_hosts`,
+    `  UserKnownHostsFile ${shown2}/known_hosts`,
     "  StrictHostKeyChecking yes",
     "  ServerAliveInterval 30"
   ].join("\n");
@@ -7889,7 +8071,7 @@ async function sshHostCaCommand(deps, options) {
   print(deps, options.json, data, data.known_hosts.join("\n"));
 }
 async function sshCertificateIssueCommand(deps, options) {
-  const publicKey = (await readFile5(options.publicKey, "utf8")).trim();
+  const publicKey = (await readFile6(options.publicKey, "utf8")).trim();
   const key = await deps.auth.apiKey();
   const data = await (deps.cell ?? new CellApi(fetch)).json(
     "issueSshCertificate",
@@ -8556,12 +8738,17 @@ function createProgram(makeDependencies = createDependencies) {
   const ssh = program.command("ssh").description("open a terminal on a Machine, or run a command there, over SSH").argument("<machine>", "the Machine's name").argument("[command...]", "a command to run instead of a shell, after --").action(async (name, command) => sshCommand(dependencies(), name, command));
   ssh.command("config").description(
     "print the ssh_config block that lets ssh, scp, sftp and Remote-SSH reach every Machine"
-  ).action(() => dependencies().output(sshConfigText()));
+  ).action(async () => sshConfigCommand(dependencies()));
   ssh.command("refresh").argument("<destination>", "a Machine's SSH destination, <name>.<account>@<host>").description(
     "renew the SSH certificate of <name>.<account>@<host> when it is about to expire (ssh_config's Match exec runs it)"
   ).action(
     async (destination) => sshRefreshCommand((account2) => makeDependencies({ account: account2 }), destination)
   );
+  program.command("ssh-proxy", { hidden: true }).argument("[arguments...]").allowUnknownOption().helpOption(false).action(async () => {
+    process.stderr.write(`${await legacySshGuidance()}
+`);
+    process.exitCode = 1;
+  });
   operationOptions(
     ssh.command("host-ca").description("print the known_hosts lines that trust Tonbo's SSH hosts").requiredOption("--region <region>", "the region whose cell origin to ask"),
     "getSshHostCa"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tonbo/cli",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "The Tonbo CLI. Compute, disks, databases and streams for AI agents: your agent picks what it needs, sets it up, and knows what it costs, from the command line.",
   "homepage": "https://tonbo.dev",
   "bugs": {