[k223kim]

Why

The control plane reports whether Studio SSH is available through a new boolean flag in /v1/config, apiLockdownStudioSSH. Until now the CLI listed lightning studio ssh and lightning ssh configure in UNAVAILABLE_COMMANDS, so they were refused whenever the other gated commands were, and would have stayed refused even once the server enables Studio SSH.

What

• STUDIO_SSH_FLAG = "apiLockdownStudioSSH" is added next to the other flag constants in lockdown_status.py.
• studio ssh and ssh configure move from UNAVAILABLE_COMMANDS to GATED_COMMANDS, gated on STUDIO_SSH_FLAG only. job ssh, mmt ssh, vm ssh, sandbox connect and every other command are unchanged.

Nothing changes for users until a server reports the flag as true. A server that doesn't send the flag at all keeps both commands closed, because a missing flag counts as closed. So this can ship before or after the server change. The CLI caches the flags for 5 minutes, so turning Studio SSH on or off reaches CLIs within minutes.

If /v1/config can't be read, gated commands are allowed to run, and while Studio SSH is off the server refuses POST /v1/ssh-keys; the CLI turns that refusal into the same "temporarily unavailable" notice. This is the same behaviour studio start has today.

#231 (local SSH key creation) shipped in v2026.11.04.post0. That release still lists both commands as unavailable, so this change needs to be released before the server enables Studio SSH.

Legacy forwards

The hidden legacy forwards lightning configure ssh and lightning connect studio follow the same gate, and no separate change was needed. In cli/entrypoint.py they are built after the gates are applied to main_cli, from ssh.commands["configure"] and studio.commands["ssh"], so they hold the marked copies. DeprecatedForwardCommand copies the target's callback, which on a marked copy is the gated callback that re-checks the flag on every run. The new tests run both forwards through the real CLI to confirm this.

The older configure ssh and connect studio commands in cli/legacy/configure.py and cli/legacy/connect.py are only registered by cli/legacy/entrypoint.py. That entrypoint is not the lightning console script and nothing else imports it, so users can't reach those commands and they were never gated.

Tests

• New tests in python/tests/cli/test_temporarily_unavailable.py run studio ssh, ssh configure, connect studio and configure ssh through main_cli:
  • With the gates closed and apiLockdownStudioSSH missing, false, or missing while the other Studio flags are open, all four print the notice and never reach the command's code.
  • With apiLockdownStudioSSH true, all four run past the gate.
• The existing parametrized tests over GATED_COMMANDS now cover the two commands as well.
• pytest tests/cli/test_temporarily_unavailable.py tests/cli/ssh tests/cli/studio/test_ssh.py tests/cli/test_legacy_redirects.py tests/cli/test_entrypoint.py: 266 passed. With the gating change reverted, the four "runs once open" cases fail, as expected.
• pre-commit run --files on the changed files passes, including ruff, ruff-format and mypy.

No docs, help text or changelog list these commands as unavailable, so there was nothing else to update.

_{— Claude Opus 5.5, on direct instruction; text not reviewed}