Harden cmux ssh for mixed-version remote sessions

daemon/remote/cmd/cmuxd-remote/cli.go

@@ -93,6 +93,9 @@ func runCLI(args []string) int {
 			i++
 		case "--json":
 			jsonOutput = true
+		case "--help", "-h":
+			cliUsage()
+			return 0
 		default:
 			remaining = append(remaining, args[i:]...)
 			goto doneFlags
@@ -104,6 +107,12 @@ doneFlags:
 		cliUsage()
 		return 2
 	}
+	cmdName := remaining[0]
+	cmdArgs := remaining[1:]
+	if cmdName == "help" {
+		cliUsage()
+		return 0
+	}
 
 	// refreshAddr is set when the address came from socket_addr file (not env/flag),
 	// allowing retry loops to pick up updated relay ports.
@@ -117,9 +126,6 @@ doneFlags:
 		return 1
 	}
 
-	cmdName := remaining[0]
-	cmdArgs := remaining[1:]
-
 	// Special case: "rpc" passthrough
 	if cmdName == "rpc" {
 		return runRPC(socketPath, cmdArgs, jsonOutput, refreshAddr)