@vellumai/cli 0.10.11-dev.202607242127.a6bf2b2 → 0.10.11-staging.1

package/src/commands/pair.ts

@@ -11,21 +11,6 @@
  */
 
 import { nanoid } from "nanoid";
-// Call `qrcodeTerminal.generate` as a method — the library reads its default
-// error-correction level off `this`, so a destructured import renders nothing.
-import qrcodeTerminal from "qrcode-terminal";
-
-import {
-  buildRemoteWebPairingUrl,
-  normalizePublicBaseUrl,
-  resolvePublicBaseUrl,
-  tunnelProviderWebsiteName,
-  type PublicBaseUrlRejection,
-  type RemoteWebPairingChallengeRequest,
-  type RemoteWebPairingChallengeResponse,
-  type RemoteWebPairingVerificationRequest,
-  type RemoteWebPairingVerificationResponse,
-} from "@vellumai/service-contracts/remote-web-pairing";
 
 import { extractFlag } from "../lib/arg-utils.js";
 import { parseAssistantTargetArg } from "../lib/assistant-target-args.js";
@@ -46,35 +31,15 @@ import {
   WEB_REMOTE_INGRESS_FLAG,
 } from "../lib/feature-flags.js";
 import { getLocalLanIPv4 } from "../lib/local.js";
-import { isLoopbackUrl, loopbackSafeFetch } from "../lib/loopback-fetch.js";
-import { STALE_CLI_UPDATE_HINT } from "../lib/stale-cli-hint.js";
+import { loopbackSafeFetch } from "../lib/loopback-fetch.js";
 
-function assistantDisplayName(entry: AssistantEntry): string {
-  return entry.name || entry.assistantName || entry.assistantId;
-}
-
-/**
- * The tunnel-recorded ingress URL from this entry's own lockfile record, when
- * usable as a remote-web advertised default: https and non-loopback (the bar
- * `--qr`/`--web` URLs must clear). The lockfile is the CLI-owned contract —
- * `vellum tunnel` providers mirror the URL onto the entry when they save it.
- */
-function usableEntryIngressUrl(entry: AssistantEntry): string | null {
-  const saved = entry.ingressUrl?.trim();
-  if (!saved) {
-    return null;
-  }
+function isLoopbackHost(url: string): boolean {
   try {
-    if (new URL(saved).protocol !== "https:") {
-      return null;
-    }
+    const host = new URL(url).hostname.toLowerCase();
+    return host === "localhost" || host === "::1" || host.startsWith("127.");
   } catch {
-    return null;
-  }
-  if (isLoopbackUrl(saved)) {
-    return null;
+    return false;
   }
-  return saved;
 }
 
 function printUsage(): void {
@@ -93,21 +58,7 @@ OPTIONS:
     --web            Create a browser pairing URL for remote web access
     --web-approve <code>
                     Approve a browser pairing code shown by /assistant/pair
-    --qr             Render a QR code that pairs a device in one scan. Mints a
-                    remote-web pairing challenge and approves it locally, so the
-                    scan alone completes pairing. Needs a public https URL
-                    (--url, else the assistant's runtime URL); refuses
-                    loopback or non-https URLs.
-    --app            With --qr: encode the QR as a vellum-assistant://connect
-                    link that opens the Vellum iOS app directly (the plain
-                    https pairing URL is printed as a fallback). Requires an
-                    app build with the connect handler installed on the phone.
-    --app-scheme <scheme>
-                    URL scheme for --app links (default: vellum-assistant;
-                    dev/staging app builds use vellum-assistant-dev /
-                    vellum-assistant-staging).
-    --json           Output the result as JSON. With --qr: {pairUrl, deviceCode,
-                    expiresAt, expiresInSeconds} (+ appUrl with --app)
+    --json           Output the raw bundle as JSON
 
 EXAMPLES:
     vellum pair
@@ -115,9 +66,7 @@ EXAMPLES:
     vellum pair --url https://abc123.ngrok.app
     vellum pair --web --url https://abc123.ngrok.app
     vellum pair --web-approve ABCD-EFGH
-    vellum pair --qr --url https://your-assistant.ts.net
-    vellum pair --qr --app --url https://your-assistant.ts.net
-    vellum pair --qr --json
+    vellum pair --json
 `);
 }
 
@@ -133,93 +82,41 @@ interface PairResponse {
   refreshAfter?: string;
 }
 
-/** Default URL scheme registered by production builds of the iOS app. */
-const DEFAULT_APP_CONNECT_SCHEME = "vellum-assistant";
-
-/**
- * Compose the custom-scheme link the iOS app's connect handler accepts:
- * `<scheme>://connect?url=<base>&code=<device code>`. The app persists the
- * base as its self-hosted server and opens the pair page with the code.
- */
-export function buildAppConnectUrl(
-  scheme: string,
-  baseUrl: string,
-  deviceCode: string,
-): string {
-  const params = new URLSearchParams({ url: baseUrl, code: deviceCode });
-  return `${scheme}://connect?${params.toString()}`;
+interface RemoteWebPairingChallengeResponse {
+  deviceCode: string;
+  userCode: string;
+  verificationUri: string;
+  expiresAt: string;
+  expiresInSeconds: number;
 }
 
-/**
- * POST a JSON body to a loopback gateway route, exiting with a clear message
- * when the gateway is unreachable or answers non-2xx. Every pairing subcommand
- * talks to the gateway this way, so the reachability + HTTP-error handling has
- * a single home.
- */
-async function gatewayPostOrExit(
-  gatewayUrl: string,
-  path: string,
-  body: unknown,
-  headers?: Record<string, string>,
-): Promise<Response> {
-  let response: Response;
-  try {
-    response = await loopbackSafeFetch(`${gatewayUrl}${path}`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", ...headers },
-      body: JSON.stringify(body),
-    });
-  } catch (err) {
-    console.error(
-      `Error: could not reach the gateway at ${gatewayUrl} ` +
-        `(${err instanceof Error ? err.message : String(err)}).`,
-    );
-    console.error("Is the assistant running? Try `vellum wake`.");
-    process.exit(1);
-  }
-
-  if (!response.ok) {
-    const errorBody = await response.text().catch(() => "");
-    console.error(
-      `Error: HTTP ${response.status}: ${errorBody || response.statusText}`,
-    );
-    process.exit(1);
-  }
-
-  return response;
+interface RemoteWebPairingApprovalResponse {
+  status: "approved";
+  verificationUri: string;
+  expiresAt: string;
 }
 
-/**
- * Create a remote-web pairing challenge (RFC 8628 device-code flow). Shared by
- * `--web` and `--qr`, which differ only in how they present the same result.
- */
-async function createRemoteWebPairingChallenge(
-  gatewayUrl: string,
-  publicBaseUrl: string,
-): Promise<RemoteWebPairingChallengeResponse> {
-  const response = await gatewayPostOrExit(
-    gatewayUrl,
-    "/v1/remote-web/pairing-challenge",
-    { publicBaseUrl } satisfies RemoteWebPairingChallengeRequest,
-  );
-  return (await response.json()) as RemoteWebPairingChallengeResponse;
+function normalizePublicBaseUrl(value: string): string {
+  const url = new URL(value);
+  url.search = "";
+  url.hash = "";
+  const parts = url.pathname.split("/").filter(Boolean);
+  const assistantIndex = parts.indexOf("assistant");
+  if (assistantIndex >= 0) {
+    parts.splice(assistantIndex);
+  }
+  url.pathname = parts.length ? `/${parts.join("/")}` : "/";
+  return url.toString().replace(/\/+$/, "");
 }
 
-/**
- * Approve a pending pairing challenge by its user code — the local-presence
- * proof for the device-code flow. Shared by `--web-approve` and `--qr` (which
- * approves the challenge it just minted so one scan completes pairing).
- */
-async function approveRemoteWebPairing(
-  gatewayUrl: string,
-  userCode: string,
-): Promise<RemoteWebPairingVerificationResponse> {
-  const response = await gatewayPostOrExit(
-    gatewayUrl,
-    "/v1/remote-web/pairing-verification",
-    { userCode } satisfies RemoteWebPairingVerificationRequest,
-  );
-  return (await response.json()) as RemoteWebPairingVerificationResponse;
+function buildRemoteWebPairingUrl(
+  challenge: RemoteWebPairingChallengeResponse,
+): string {
+  const url = new URL(challenge.verificationUri);
+  url.hash = new URLSearchParams({
+    device_code: challenge.deviceCode,
+  }).toString();
+  return url.toString();
 }
 
 async function assertWebRemoteIngressEnabled(
@@ -261,11 +158,7 @@ export async function pair(): Promise<void> {
   const jsonOutput = rawArgs.includes("--json");
   const webPairing = rawArgs.includes("--web");
   const webApproval = rawArgs.includes("--web-approve");
-  const qrPairing = rawArgs.includes("--qr");
-  const appVariant = rawArgs.includes("--app");
-  let args = rawArgs.filter(
-    (a) => a !== "--json" && a !== "--web" && a !== "--qr" && a !== "--app",
-  );
+  let args = rawArgs.filter((a) => a !== "--json" && a !== "--web");
 
   const [label, afterLabel] = extractFlag(args, "--label");
   const [webApproveCode, afterWebApprove] = extractFlag(
@@ -273,27 +166,7 @@ export async function pair(): Promise<void> {
     "--web-approve",
   );
   const [urlOverride, afterUrl] = extractFlag(afterWebApprove, "--url");
-  const [appSchemeOverride, afterAppScheme] = extractFlag(
-    afterUrl,
-    "--app-scheme",
-  );
-  args = afterAppScheme;
-
-  // Any `--`-prefixed token left after known-flag extraction is an option this
-  // CLI version doesn't support. Fail loud before any network call rather than
-  // letting it fall through: an unknown flag would otherwise be silently
-  // dropped and the command would run the wrong flow (e.g. `--qr` on an older
-  // CLI minting a copy-paste bundle instead of a QR). Positional names never
-  // start with `--`, so multi-word assistant targets are unaffected.
-  const unknownFlag = args.find((a) => a.startsWith("--"));
-  if (unknownFlag) {
-    console.error(`Error: unknown option '${unknownFlag}'.`);
-    console.error("Run `vellum pair --help` to see available options.");
-    console.error(
-      `If this option is from newer docs, ${STALE_CLI_UPDATE_HINT}`,
-    );
-    process.exit(1);
-  }
+  args = afterUrl;
 
   if (webPairing && webApproveCode) {
     console.error("Error: use either --web or --web-approve, not both.");
@@ -303,14 +176,6 @@ export async function pair(): Promise<void> {
     console.error("Error: --web-approve requires a pairing code.");
     process.exit(1);
   }
-  if (qrPairing && (webPairing || webApproveCode)) {
-    console.error("Error: --qr can't be combined with --web or --web-approve.");
-    process.exit(1);
-  }
-  if ((appVariant || appSchemeOverride) && !qrPairing) {
-    console.error("Error: --app and --app-scheme only apply to --qr pairing.");
-    process.exit(1);
-  }
 
   // Resolve the target. An explicit argument is matched by display name OR id
   // (with the standard ambiguity error); no argument falls back to the active
@@ -335,41 +200,23 @@ export async function pair(): Promise<void> {
 
   // Mint over loopback (localUrl avoids mDNS for same-machine calls), but
   // advertise a REACHABLE url in the bundle — the loopback url would point the
-  // other machine at its own localhost. Prefer an explicit --url, then (for
-  // the remote-web flows) the ingress URL a tunnel provider saved, then the
+  // other machine at its own localhost. Prefer an explicit --url, then the
   // runtime (LAN/tunnel) url.
   const mintUrl = (
     entry.localUrl ||
     entry.runtimeUrl ||
     `http://127.0.0.1:${GATEWAY_PORT}`
   ).replace(/\/+$/, "");
-  const savedIngressUrl =
-    !urlOverride && (qrPairing || webPairing)
-      ? usableEntryIngressUrl(entry)
-      : null;
-  const advertisedUrl = (
-    urlOverride ||
-    savedIngressUrl ||
-    entry.runtimeUrl ||
-    mintUrl
-  ).replace(/\/+$/, "");
-  if (savedIngressUrl && !jsonOutput) {
-    console.log(
-      `Using saved ingress URL ${savedIngressUrl} ` +
-        "(from vellum tunnel; override with --url).",
-    );
-  }
+  const advertisedUrl = (urlOverride || entry.runtimeUrl || mintUrl).replace(
+    /\/+$/,
+    "",
+  );
 
   // A local hatch's runtimeUrl is itself loopback (http://localhost:<port>),
   // so without an explicit --url the bundle would point the other machine at
   // its own localhost. Refuse to advertise a loopback URL unless the user
   // explicitly passed one. (An explicit --url is trusted as-is.)
-  if (
-    !urlOverride &&
-    !webApproveCode &&
-    !qrPairing &&
-    isLoopbackUrl(advertisedUrl)
-  ) {
+  if (!urlOverride && !webApproveCode && isLoopbackHost(advertisedUrl)) {
     const lan = getLocalLanIPv4();
     // Use THIS assistant's gateway port (not the global default) — second
     // local instances listen on a different port.
@@ -389,17 +236,40 @@ export async function pair(): Promise<void> {
     console.error(
       `Re-run with a reachable URL, e.g.:\n  vellum pair --url ${suggestion}`,
     );
-    console.error(
-      "Pairing a phone by QR instead? Use: vellum pair --qr " +
-        "(needs an https URL — run `vellum tunnel --provider tailscale` first).",
-    );
     process.exit(1);
   }
 
   if (webApproveCode) {
     await assertWebRemoteIngressEnabled(entry.assistantId, mintUrl);
 
-    const result = await approveRemoteWebPairing(mintUrl, webApproveCode);
+    let response: Response;
+    try {
+      response = await loopbackSafeFetch(
+        `${mintUrl}/v1/remote-web/pairing-verification`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ userCode: webApproveCode }),
+        },
+      );
+    } catch (err) {
+      console.error(
+        `Error: could not reach the gateway at ${mintUrl} ` +
+          `(${err instanceof Error ? err.message : String(err)}).`,
+      );
+      console.error("Is the assistant running? Try `vellum wake`.");
+      process.exit(1);
+    }
+
+    if (!response.ok) {
+      const body = await response.text().catch(() => "");
+      console.error(
+        `Error: HTTP ${response.status}: ${body || response.statusText}`,
+      );
+      process.exit(1);
+    }
+
+    const result = (await response.json()) as RemoteWebPairingApprovalResponse;
     if (jsonOutput) {
       console.log(JSON.stringify(result, null, 2));
       return;
@@ -420,10 +290,35 @@ export async function pair(): Promise<void> {
       process.exit(1);
     }
 
-    const challenge = await createRemoteWebPairingChallenge(
-      mintUrl,
-      publicBaseUrl,
-    );
+    let response: Response;
+    try {
+      response = await loopbackSafeFetch(
+        `${mintUrl}/v1/remote-web/pairing-challenge`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ publicBaseUrl }),
+        },
+      );
+    } catch (err) {
+      console.error(
+        `Error: could not reach the gateway at ${mintUrl} ` +
+          `(${err instanceof Error ? err.message : String(err)}).`,
+      );
+      console.error("Is the assistant running? Try `vellum wake`.");
+      process.exit(1);
+    }
+
+    if (!response.ok) {
+      const body = await response.text().catch(() => "");
+      console.error(
+        `Error: HTTP ${response.status}: ${body || response.statusText}`,
+      );
+      process.exit(1);
+    }
+
+    const challenge =
+      (await response.json()) as RemoteWebPairingChallengeResponse;
     const pairUrl = buildRemoteWebPairingUrl(challenge);
 
     if (jsonOutput) {
@@ -443,7 +338,7 @@ export async function pair(): Promise<void> {
       return;
     }
 
-    const displayName = assistantDisplayName(entry);
+    const displayName = entry.name || entry.assistantName || entry.assistantId;
     console.log(`Created remote web pairing for ${displayName}.`);
     console.log("");
     console.log("Open this URL in the browser:");
@@ -464,99 +359,36 @@ export async function pair(): Promise<void> {
     return;
   }
 
-  if (qrPairing) {
-    // Validate the public URL before any network call — a QR that encodes a
-    // loopback or plain-http link is unscannable from another device.
-    const qrResult = resolvePublicBaseUrl(advertisedUrl);
-    if (!qrResult.ok) {
-      const detailByReason: Record<PublicBaseUrlRejection, string> = {
-        unparseable: `${advertisedUrl} isn't a valid URL`,
-        loopback: `${advertisedUrl} is a loopback address`,
-        "non-https": `${advertisedUrl} is not https`,
-        "service-website": `${advertisedUrl} is ${
-          tunnelProviderWebsiteName(advertisedUrl) ?? "a tunnel provider"
-        }'s website, not your assistant's address`,
-      };
-      console.error(
-        "Error: --qr needs a public https URL the phone can open — " +
-          `${detailByReason[qrResult.reason]}.`,
-      );
-      console.error(
-        "Re-run with your assistant's public URL, e.g.:\n" +
-          "  vellum pair --qr --url https://your-assistant.ts.net",
-      );
-      process.exit(1);
-    }
-    const qrBaseUrl = qrResult.url;
-
-    await assertWebRemoteIngressEnabled(entry.assistantId, mintUrl);
-
-    // Mint a challenge and immediately approve it: running this CLI on the host
-    // IS the local-presence proof, so the scanning device completes pairing in
-    // one step. Reuses the `--web` + `--web-approve` code paths.
-    const challenge = await createRemoteWebPairingChallenge(mintUrl, qrBaseUrl);
-    await approveRemoteWebPairing(mintUrl, challenge.userCode);
-    const pairUrl = buildRemoteWebPairingUrl(challenge);
-    const appUrl = appVariant
-      ? buildAppConnectUrl(
-          appSchemeOverride ?? DEFAULT_APP_CONNECT_SCHEME,
-          qrBaseUrl,
-          challenge.deviceCode,
-        )
-      : null;
-
-    if (jsonOutput) {
-      console.log(
-        JSON.stringify(
-          {
-            pairUrl,
-            ...(appUrl ? { appUrl } : {}),
-            deviceCode: challenge.deviceCode,
-            expiresAt: challenge.expiresAt,
-            expiresInSeconds: challenge.expiresInSeconds,
-          },
-          null,
-          2,
-        ),
-      );
-      return;
-    }
-
-    const displayName = assistantDisplayName(entry);
-    console.log(`Scan to pair a device with ${displayName}:`);
-    console.log("");
-    qrcodeTerminal.generate(appUrl ?? pairUrl, { small: true }, (qr) => {
-      console.log(qr);
-    });
-    console.log("");
-    if (appUrl) {
-      console.log("The QR opens the Vellum app. App link:");
-      console.log("");
-      console.log(`  ${appUrl}`);
-      console.log("");
-      console.log(
-        "No app on the device? Open this URL in its browser instead:",
-      );
-    } else {
-      console.log("Or open this URL on the device:");
-    }
-    console.log("");
-    console.log(`  ${pairUrl}`);
-    console.log("");
-    console.log(`Expires: ${challenge.expiresAt}`);
-    return;
-  }
-
   // Fresh per-pairing device identity — each `vellum pair` is independently
   // revocable.
   const deviceId = nanoid();
 
-  const response = await gatewayPostOrExit(
-    mintUrl,
-    "/v1/pair",
-    { deviceId, platform: "cli" },
-    getClientRegistrationHeaders(CLI_INTERFACE_ID),
-  );
+  let response: Response;
+  try {
+    response = await loopbackSafeFetch(`${mintUrl}/v1/pair`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...getClientRegistrationHeaders(CLI_INTERFACE_ID),
+      },
+      body: JSON.stringify({ deviceId, platform: "cli" }),
+    });
+  } catch (err) {
+    console.error(
+      `Error: could not reach the gateway at ${mintUrl} ` +
+        `(${err instanceof Error ? err.message : String(err)}).`,
+    );
+    console.error("Is the assistant running? Try `vellum wake`.");
+    process.exit(1);
+  }
+
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    console.error(
+      `Error: HTTP ${response.status}: ${body || response.statusText}`,
+    );
+    process.exit(1);
+  }
 
   const result = (await response.json()) as PairResponse;
 
@@ -587,7 +419,7 @@ export async function pair(): Promise<void> {
     return;
   }
 
-  const displayName = assistantDisplayName(entry);
+  const displayName = entry.name || entry.assistantName || entry.assistantId;
   console.log(`Paired ${label ? `"${label}" ` : ""}with ${displayName}.`);
   console.log("");
   console.log(`  Gateway:   ${advertisedUrl}`);

package/src/commands/rollback.ts

@@ -326,8 +326,7 @@ export async function rollback(): Promise<void> {
     }
 
     // Recover the assistant host port from the entry, fall back to default.
-    const assistantPort =
-      entry.containerInfo?.assistantPort ?? ASSISTANT_INTERNAL_PORT;
+    const assistantPort = entry.containerInfo?.assistantPort ?? ASSISTANT_INTERNAL_PORT;
 
     // Notify connected clients that a rollback is about to begin (best-effort)
     console.log("📢 Notifying connected clients...");

package/src/commands/ssh.ts

@@ -1,6 +1,9 @@
 import { spawn } from "child_process";
 
-import { extractHostFromUrl, resolveAssistant } from "../lib/assistant-config";
+import {
+  extractHostFromUrl,
+  resolveAssistant,
+} from "../lib/assistant-config";
 import { dockerResourceNames } from "../lib/docker";
 import { getPlatformUrl, readPlatformToken } from "../lib/platform-client";
 import { sshAppleContainer } from "../lib/ssh-apple-container";

package/src/commands/tunnel.ts

@@ -8,8 +8,6 @@ import {
   WEB_REMOTE_INGRESS_FLAG,
 } from "../lib/feature-flags.js";
 import { runNgrokTunnel } from "../lib/ngrok";
-import { STALE_CLI_UPDATE_HINT } from "../lib/stale-cli-hint.js";
-import { runTailscaleTunnel } from "../lib/tailscale-tunnel.js";
 
 const VALID_PROVIDERS = ["vellum", "ngrok", "cloudflare", "tailscale"] as const;
 type TunnelProvider = (typeof VALID_PROVIDERS)[number];
@@ -64,36 +62,21 @@ function parseArgs(): TunnelArgs {
       console.log(
         "               No Cloudflare account required for quick tunnels.",
       );
-      console.log(
-        "  tailscale    Tailscale serve — install: brew install tailscale, then `tailscale up`",
-      );
-      console.log(
-        "               Reachable only from your own tailnet (private; LetsEncrypt cert).",
-      );
       console.log("");
       console.log("Examples:");
       console.log("  $ vellum tunnel");
       console.log("  $ vellum tunnel --provider ngrok");
       console.log("  $ vellum tunnel --provider cloudflare");
-      console.log("  $ vellum tunnel my-assistant --provider tailscale");
+      console.log("  $ vellum tunnel my-assistant --provider cloudflare");
       process.exit(0);
     } else if (arg === "--provider") {
       const next = args[i + 1];
-      if (!next || next.startsWith("-")) {
+      if (!next || !VALID_PROVIDERS.includes(next as TunnelProvider)) {
         console.error(
           `Error: --provider requires one of: ${VALID_PROVIDERS.join(", ")}`,
         );
         process.exit(1);
       }
-      if (!VALID_PROVIDERS.includes(next as TunnelProvider)) {
-        console.error(
-          `Error: unknown tunnel provider '${next}'. Valid providers: ${VALID_PROVIDERS.join(", ")}.`,
-        );
-        console.error(
-          `If this provider is documented, ${STALE_CLI_UPDATE_HINT}`,
-        );
-        process.exit(1);
-      }
       provider = next as TunnelProvider;
       i++;
     } else if (arg.startsWith("-")) {
@@ -170,7 +153,6 @@ export async function tunnel(): Promise<void> {
   const gatewayPort = resolveEntryGatewayPort(entry);
   const baseTunnelOpts = {
     port: gatewayPort,
-    assistantId: entry.assistantId,
     ...(resources
       ? { workspaceDir: join(resources.instanceDir, ".vellum", "workspace") }
       : {}),
@@ -198,19 +180,5 @@ export async function tunnel(): Promise<void> {
     return;
   }
 
-  if (provider === "tailscale") {
-    await runTailscaleTunnel({
-      ...baseTunnelOpts,
-      preferNginxIngress: await shouldPreferNginxIngress(
-        entry.assistantId,
-        gatewayPort,
-      ),
-    });
-    return;
-  }
-
-  throw new Error(
-    `Tunnel provider '${provider}' is not yet implemented. ` +
-      `If this provider is documented, ${STALE_CLI_UPDATE_HINT}`,
-  );
+  throw new Error(`Tunnel provider '${provider}' is not yet implemented.`);
 }