@celilo/cli 0.16.2 → 0.18.0

package/src/cli/commands/storage-set-path.test.ts

@@ -0,0 +1,281 @@
+/**
+ * Tests for `storage set-path`.
+ *
+ * The motivating case (#566) is celilo-mgr: `local-backups` points at
+ * `/Users/pbanka/hobby/backups/celilo-backups/`, a macOS path that came
+ * across when the database was restored onto a Linux host. The directory
+ * does not exist there. Relocating must therefore succeed with nothing
+ * migrated — not error, and not claim files were moved — and must not
+ * carry the four-month-old `✓ Verified` stamp onto the new path.
+ *
+ * Isolation: CELILO_DB_PATH / CELILO_DATA_DIR are set before the SUT is
+ * imported, so nothing touches the production database.
+ */
+
+import { afterAll, describe, expect, test } from 'bun:test';
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  rmSync,
+  statSync,
+  utimesSync,
+  writeFileSync,
+} from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const testRoot = mkdtempSync(join(tmpdir(), 'celilo-setpath-'));
+process.env.CELILO_DB_PATH = join(testRoot, 'celilo.db');
+process.env.CELILO_DATA_DIR = join(testRoot, 'data');
+
+const {
+  addBackupStorage,
+  getBackupStorageByStorageId,
+  getStorageCredentials,
+  updateStorageCredentials,
+} = await import('../../services/backup-storage');
+const { handleStorageSetPath, inspectSourceDir, planRelocation, resolveTargetPath } = await import(
+  './storage-set-path'
+);
+
+afterAll(() => {
+  rmSync(testRoot, { recursive: true, force: true });
+});
+
+describe('planRelocation (pure)', () => {
+  const base = { sourceDir: '/old/celilo-backups', targetDir: '/new/celilo-backups' };
+
+  test('migrates when the source has files', () => {
+    const plan = planRelocation({ ...base, sourceState: 'populated', migrateRequested: true });
+    expect(plan.migrate).toBe(true);
+    expect(plan.note).toContain('Migrating archives');
+  });
+
+  test('PRODUCTION CASE: source missing — skips migration, says so, does not error', () => {
+    const plan = planRelocation({ ...base, sourceState: 'missing', migrateRequested: true });
+    expect(plan.migrate).toBe(false);
+    expect(plan.note).toContain('does not exist');
+    expect(plan.note).toContain('nothing to migrate');
+  });
+
+  test('source unreadable — skips migration and says nothing was moved', () => {
+    const plan = planRelocation({ ...base, sourceState: 'unreadable', migrateRequested: true });
+    expect(plan.migrate).toBe(false);
+    expect(plan.note).toContain('not readable');
+  });
+
+  test('source empty — skips migration', () => {
+    const plan = planRelocation({ ...base, sourceState: 'empty', migrateRequested: true });
+    expect(plan.migrate).toBe(false);
+    expect(plan.note).toContain('empty');
+  });
+
+  test('--no-migrate wins even over a populated source', () => {
+    const plan = planRelocation({ ...base, sourceState: 'populated', migrateRequested: false });
+    expect(plan.migrate).toBe(false);
+    expect(plan.note).toContain('--no-migrate');
+  });
+});
+
+describe('resolveTargetPath (pure)', () => {
+  test('rejects a path identical to the current one', () => {
+    const result = resolveTargetPath('/var/backups', '/var/backups/');
+    expect(result).toMatchObject({ success: false });
+  });
+
+  test('preserves a path containing a space', () => {
+    const result = resolveTargetPath('/tmp/back ups/celilo', '/somewhere/else');
+    expect(result).toEqual({ path: '/tmp/back ups/celilo' });
+  });
+
+  test('expands a leading tilde', () => {
+    const result = resolveTargetPath('~/backups', '/somewhere/else');
+    expect(result).toMatchObject({ path: join(homedir(), 'backups') });
+  });
+});
+
+describe('inspectSourceDir', () => {
+  test('missing directory reports missing, not unreadable', () => {
+    expect(inspectSourceDir(join(testRoot, 'no-such-dir'))).toBe('missing');
+  });
+
+  test('empty directory reports empty', () => {
+    const dir = join(testRoot, 'empty-dir');
+    mkdirSync(dir, { recursive: true });
+    expect(inspectSourceDir(dir)).toBe('empty');
+  });
+
+  test('directory with files reports populated', () => {
+    const dir = join(testRoot, 'full-dir');
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, 'a.backup'), 'x');
+    expect(inspectSourceDir(dir)).toBe('populated');
+  });
+
+  test('unreadable directory reports unreadable, not missing', () => {
+    const parent = join(testRoot, 'locked');
+    const dir = join(parent, 'celilo-backups');
+    mkdirSync(dir, { recursive: true });
+    chmodSync(parent, 0o000);
+    try {
+      expect(inspectSourceDir(dir)).toBe('unreadable');
+    } finally {
+      chmodSync(parent, 0o700);
+    }
+  });
+});
+
+describe('updateStorageCredentials', () => {
+  test('clears the verification stamp, so a stale ✓ never survives a credential change (#566)', async () => {
+    const storage = await addBackupStorage({
+      name: 'Stamp Backups',
+      providerName: 'local',
+      credentials: { path: '/Users/nobody/old' },
+    });
+
+    const { getDb } = await import('../../db/client');
+    const { backupStorages } = await import('../../db/schema');
+    const { eq } = await import('drizzle-orm');
+    getDb()
+      .update(backupStorages)
+      .set({ verified: true, verifiedAt: new Date('2026-04-08T02:24:43.000Z') })
+      .where(eq(backupStorages.id, storage.id))
+      .run();
+
+    await updateStorageCredentials(storage.id, { path: '/var/lib/celilo/backups' });
+
+    // Asserted WITHOUT a follow-up verify: even if celilo dies between
+    // the path change and re-verification, the row must not still claim
+    // the destination was verified.
+    const after = getBackupStorageByStorageId(storage.storageId);
+    expect(after?.verified).toBe(false);
+    expect(after?.verifiedAt).toBeNull();
+  });
+});
+
+describe('handleStorageSetPath (end to end, isolated DB)', () => {
+  test('PRODUCTION CASE: current path does not exist — path changes, nothing migrated, re-verified against the new path', async () => {
+    const storage = await addBackupStorage({
+      name: 'Ghost Backups',
+      providerName: 'local',
+      credentials: { path: '/Users/nobody/hobby/backups' },
+    });
+
+    // Simulate the stale stamp: the row says Verified from a host that
+    // no longer exists.
+    const { getDb } = await import('../../db/client');
+    const { backupStorages } = await import('../../db/schema');
+    const { eq } = await import('drizzle-orm');
+    getDb()
+      .update(backupStorages)
+      .set({ verified: true, verifiedAt: new Date('2026-04-08T02:24:43.000Z') })
+      .where(eq(backupStorages.id, storage.id))
+      .run();
+
+    const newPath = join(testRoot, 'relocated');
+    const result = await handleStorageSetPath([storage.storageId, newPath]);
+
+    expect(result.success).toBe(true);
+
+    const creds = await getStorageCredentials(storage.id);
+    expect(creds).toMatchObject({ path: newPath });
+
+    // The stamp must describe the NEW path, not the dead one.
+    const after = getBackupStorageByStorageId(storage.storageId);
+    expect(after?.verified).toBe(true);
+    expect(after?.verifiedAt?.getTime()).toBeGreaterThan(
+      new Date('2026-04-08T02:24:43.000Z').getTime(),
+    );
+  });
+
+  test('moves existing archives to the new location', async () => {
+    const oldPath = join(testRoot, 'movable-old');
+    const newPath = join(testRoot, 'movable-new');
+    mkdirSync(join(oldPath, 'celilo-backups', '2026-08-01'), { recursive: true });
+    writeFileSync(join(oldPath, 'celilo-backups', '2026-08-01', 'x.backup'), 'payload');
+
+    const storage = await addBackupStorage({
+      name: 'Movable Backups',
+      providerName: 'local',
+      credentials: { path: oldPath },
+    });
+
+    const result = await handleStorageSetPath([storage.storageId, newPath]);
+
+    expect(result.success).toBe(true);
+    expect(existsSync(join(newPath, 'celilo-backups', '2026-08-01', 'x.backup'))).toBe(true);
+    expect(existsSync(join(oldPath, 'celilo-backups'))).toBe(false);
+  });
+
+  test('preserves archive mtimes — a move does not restamp backups', async () => {
+    const oldPath = join(testRoot, 'mtime-old');
+    const newPath = join(testRoot, 'mtime-new');
+    const archive = join(oldPath, 'celilo-backups', 'a.backup');
+    mkdirSync(join(oldPath, 'celilo-backups'), { recursive: true });
+    writeFileSync(archive, 'payload');
+    const stamp = new Date('2026-04-26T01:37:53.740Z');
+    utimesSync(archive, stamp, stamp);
+
+    const storage = await addBackupStorage({
+      name: 'Mtime Backups',
+      providerName: 'local',
+      credentials: { path: oldPath },
+    });
+
+    await handleStorageSetPath([storage.storageId, newPath]);
+
+    const moved = statSync(join(newPath, 'celilo-backups', 'a.backup'));
+    expect(Math.round(moved.mtimeMs)).toBe(stamp.getTime());
+  });
+
+  test('--no-migrate leaves the old archives where they are', async () => {
+    const oldPath = join(testRoot, 'kept-old');
+    const newPath = join(testRoot, 'kept-new');
+    mkdirSync(join(oldPath, 'celilo-backups'), { recursive: true });
+    writeFileSync(join(oldPath, 'celilo-backups', 'y.backup'), 'payload');
+
+    const storage = await addBackupStorage({
+      name: 'Kept Backups',
+      providerName: 'local',
+      credentials: { path: oldPath },
+    });
+
+    const result = await handleStorageSetPath([storage.storageId, newPath], {
+      'no-migrate': true,
+    });
+
+    expect(result.success).toBe(true);
+    expect(existsSync(join(oldPath, 'celilo-backups', 'y.backup'))).toBe(true);
+    expect(existsSync(join(newPath, 'celilo-backups', 'y.backup'))).toBe(false);
+  });
+
+  test('handles a new path containing a space', async () => {
+    const oldPath = join(testRoot, 'spacey-old');
+    const newPath = join(testRoot, 'back ups', "Bob's celilo");
+    mkdirSync(join(oldPath, 'celilo-backups'), { recursive: true });
+    writeFileSync(join(oldPath, 'celilo-backups', 'z.backup'), 'payload');
+
+    const storage = await addBackupStorage({
+      name: 'Spacey Backups',
+      providerName: 'local',
+      credentials: { path: oldPath },
+    });
+
+    const result = await handleStorageSetPath([storage.storageId, newPath]);
+
+    expect(result.success).toBe(true);
+    expect(existsSync(join(newPath, 'celilo-backups', 'z.backup'))).toBe(true);
+  });
+
+  test('rejects an unknown storage id', async () => {
+    const result = await handleStorageSetPath(['no-such-storage', join(testRoot, 'x')]);
+    expect(result).toMatchObject({ success: false });
+  });
+
+  test('requires both a storage id and a path', async () => {
+    const result = await handleStorageSetPath(['only-one-arg']);
+    expect(result).toMatchObject({ success: false });
+  });
+});

package/src/cli/commands/storage-set-path.ts

@@ -0,0 +1,190 @@
+/**
+ * Storage Set Path Command
+ * Relocate a local storage destination to a new directory, migrating
+ * any archives that are actually there.
+ *
+ * Motivating case (#566): celilo-mgr's `local-backups` points at
+ * `/Users/pbanka/...`, a macOS path carried across when the database was
+ * restored onto a Linux host. The directory does not exist there, so the
+ * relocation must complete cleanly with nothing to migrate rather than
+ * erroring — and must not carry the old `✓ Verified` stamp onto the new
+ * path.
+ */
+
+import { cpSync, readdirSync, rmSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import {
+  getBackupStorageByStorageId,
+  getStorageCredentials,
+  updateStorageCredentials,
+  verifyBackupStorage,
+} from '../../services/backup-storage';
+import { BACKUP_PREFIX } from '../../services/storage-providers/local';
+import { celiloIntro, celiloOutro } from '../prompts';
+import type { CommandResult } from '../types';
+import { probePathWriteable } from './storage-add-local';
+
+/** What the current archive directory turned out to be, on disk. */
+export type SourceState = 'missing' | 'unreadable' | 'empty' | 'populated';
+
+export interface RelocationPlan {
+  /** Whether to copy the source tree to the target. */
+  migrate: boolean;
+  /** One line for the operator explaining what will (not) happen. */
+  note: string;
+}
+
+/**
+ * Decide whether to migrate. Pure — takes an already-observed source
+ * state so it is testable without a filesystem (Rule 10.4).
+ */
+export function planRelocation(input: {
+  sourceState: SourceState;
+  sourceDir: string;
+  targetDir: string;
+  migrateRequested: boolean;
+}): RelocationPlan {
+  const { sourceState, sourceDir, targetDir, migrateRequested } = input;
+
+  if (!migrateRequested) {
+    return { migrate: false, note: `Migration skipped (--no-migrate). ${sourceDir} left as-is.` };
+  }
+
+  switch (sourceState) {
+    case 'missing':
+      return { migrate: false, note: `${sourceDir} does not exist — nothing to migrate.` };
+    case 'unreadable':
+      return { migrate: false, note: `${sourceDir} is not readable — nothing migrated.` };
+    case 'empty':
+      return { migrate: false, note: `${sourceDir} is empty — nothing to migrate.` };
+    case 'populated':
+      return { migrate: true, note: `Migrating archives from ${sourceDir} to ${targetDir}.` };
+  }
+}
+
+/**
+ * Validate and normalise the requested path. Pure apart from `~`
+ * expansion, which reads the environment but touches no filesystem.
+ */
+export function resolveTargetPath(
+  raw: string,
+  currentPath: string,
+): CommandResult | { path: string } {
+  const expanded = raw.startsWith('~/') || raw === '~' ? raw.replace('~', homedir()) : raw;
+  const resolved = resolve(expanded);
+
+  if (resolved === resolve(currentPath)) {
+    return { success: false, error: `Storage path is already '${resolved}' — nothing to do.` };
+  }
+
+  return { path: resolved };
+}
+
+/** Observe the archive directory. Distinguishes absent from unreadable. */
+export function inspectSourceDir(dir: string): SourceState {
+  try {
+    return readdirSync(dir).length === 0 ? 'empty' : 'populated';
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === 'ENOENT' ? 'missing' : 'unreadable';
+  }
+}
+
+export async function handleStorageSetPath(
+  args: string[],
+  flags: Record<string, boolean | string> = {},
+): Promise<CommandResult> {
+  try {
+    celiloIntro('Relocate Backup Storage');
+
+    const storageId = args[0];
+    const newPathArg = args[1];
+    if (!storageId || !newPathArg) {
+      return {
+        success: false,
+        error:
+          'Storage ID and new path are required\n\nUsage: celilo storage set-path <storage-id> <new-path> [--no-migrate]',
+      };
+    }
+
+    const storage = getBackupStorageByStorageId(storageId);
+    if (!storage) {
+      return { success: false, error: `Storage not found: ${storageId}` };
+    }
+    if (storage.providerName !== 'local') {
+      return {
+        success: false,
+        error: `'${storage.storageId}' is a ${storage.providerName} destination — set-path only applies to local storage.`,
+      };
+    }
+
+    const credentials = await getStorageCredentials(storage.id);
+    if (!('path' in credentials)) {
+      return { success: false, error: `Storage '${storage.storageId}' has no path configured.` };
+    }
+    const currentPath = credentials.path;
+
+    const resolved = resolveTargetPath(newPathArg, currentPath);
+    if ('success' in resolved) return resolved;
+    const newPath = resolved.path;
+
+    const writeError = probePathWriteable(newPath);
+    if (writeError !== null) {
+      return { success: false, error: `Path '${newPath}' is not writeable: ${writeError}` };
+    }
+
+    const sourceDir = join(currentPath, BACKUP_PREFIX);
+    const targetDir = join(newPath, BACKUP_PREFIX);
+    const plan = planRelocation({
+      sourceState: inspectSourceDir(sourceDir),
+      sourceDir,
+      targetDir,
+      migrateRequested: flags['no-migrate'] !== true,
+    });
+
+    console.log(`\n${plan.note}`);
+
+    if (plan.migrate) {
+      // A backup archive's mtime is part of what it is; a move must not
+      // restamp it. Bun's cpSync already preserves timestamps, so the
+      // flag is a no-op today — it is here for Node semantics, where the
+      // default is the other way. The mtime test guards the behavior,
+      // not this flag.
+      cpSync(sourceDir, targetDir, { recursive: true, force: true, preserveTimestamps: true });
+    }
+
+    await updateStorageCredentials(storage.id, { ...credentials, path: newPath });
+    console.log(`✓ Path updated: ${currentPath} → ${newPath}`);
+
+    if (plan.migrate) {
+      // Only after the DB points at the copy, so a failure here leaves
+      // archives duplicated rather than orphaned.
+      try {
+        rmSync(sourceDir, { recursive: true, force: true });
+      } catch (error) {
+        console.log(
+          `⚠ Copied, but could not remove ${sourceDir}: ${error instanceof Error ? error.message : String(error)}`,
+        );
+      }
+    }
+
+    const { result } = await verifyBackupStorage(storage.id);
+    if (!result.success) {
+      console.log(`✗ ${result.message}`);
+      celiloOutro(
+        `Path changed but verification failed.\n\nFix the path and re-verify: celilo storage verify ${storage.storageId}`,
+      );
+      return { success: false, error: result.message };
+    }
+
+    console.log(`✓ ${result.message}`);
+    celiloOutro(`'${storage.storageId}' now stores backups at ${targetDir}/`);
+
+    return { success: true, message: `Relocated ${storage.storageId} to ${newPath}` };
+  } catch (error) {
+    return {
+      success: false,
+      error: `Failed to set storage path: ${error instanceof Error ? error.message : String(error)}`,
+    };
+  }
+}

package/src/cli/commands/system-audit.ts

@@ -35,8 +35,10 @@ import type { ModuleManifest } from '../../manifest/schema';
 import { RegistryClient } from '../../registry/client';
 import { decryptSecret } from '../../secrets/encryption';
 import { getOrCreateMasterKey } from '../../secrets/master-key';
+import { readAllTransportStatuses } from '../../services/alerting/read-records';
 import { runAudit } from '../../services/audit';
 import type { DriftFinding, SystemAuditReport } from '../../services/audit';
+import { loadAbandonedOperations } from '../../services/audit/abandoned-operations';
 import { loadBackupAuditInfo } from '../../services/audit/backup-source';
 import {
   type LatestCliVersionFetcher,
@@ -362,6 +364,7 @@ async function buildAuditDeps(onProgress?: (msg: string) => void) {
     moduleConfigs: { modules: installedConfigs },
     health: { results: healthResults },
     backups: { modules: installedBackupInfo },
+    abandonedOperations: { records: loadAbandonedOperations(db) },
     undeployedModules: {
       modules: installed.map((m) => ({ id: m.id, state: m.state })),
     },
@@ -378,6 +381,17 @@ async function buildAuditDeps(onProgress?: (msg: string) => void) {
     secretsDecryptable: { results: secretResults },
     servicesReachable: { results: serviceReachableResults },
     machinesReachable: { results: machineReachableResults },
+    // Reads the record the poller already writes — this check never performs a
+    // read of its own. One that did would drain the queue and eat the
+    // acknowledgement it exists to protect (#541).
+    transportReads: {
+      statuses: readAllTransportStatuses(db),
+      now: new Date(),
+      // Six missed polls. The poller runs every five minutes, so this absorbs a
+      // slow sweep, a restart, and a missed tick without crying wolf — while
+      // still catching a transport that has genuinely stopped being readable.
+      staleAfterMs: 30 * 60_000,
+    },
     trustedSources: { firewalls: collectFirewallReach(db) },
   };
 }

package/src/cli/commands/system-migrate.ts

@@ -8,11 +8,49 @@
  */
 
 import type { Database } from 'bun:sqlite';
+import { defineEvents, openBus } from '@celilo/event-bus';
+import { getEventBusPath } from '../../config/paths';
 import { getDb } from '../../db/client';
 import { runMigrationsOn } from '../../db/migrate';
 import { findSchemaDrift } from '../../db/schema-introspection';
+import { ensureBackupSweepSubscriber } from '../../services/backup-sweep';
+import { ensureOperationsSweepSubscriber } from '../../services/module-operations';
 import type { CommandResult } from '../types';
 
+/**
+ * Arm celilo's own housekeeping subscribers.
+ *
+ * Here because this command is what the .deb postinst runs on every apt
+ * upgrade — the one moment guaranteed to happen after new CLI code lands.
+ * A subscriber registered only from module install/update would not appear
+ * until some module happened to be touched next, which can be weeks and
+ * looks exactly like a feature that shipped and silently does nothing.
+ *
+ * Best-effort: a bus that can't be opened must not fail a schema migration.
+ */
+function ensureCoreSubscribers(): void {
+  try {
+    const bus = openBus({ dbPath: getEventBusPath(), events: defineEvents({}) });
+    try {
+      ensureOperationsSweepSubscriber(bus);
+      // The backup sweep is armed here for the same reason, plus a sharper one:
+      // its row already exists on every deployed fleet, carrying the 60s bus
+      // default that made scheduled backups impossible. Correcting the default
+      // in code does nothing until something re-registers, and module
+      // install/update can be weeks away. This is the upgrade path.
+      //
+      // This also re-arms a sweep an operator paused by hand. Deliberate: the
+      // pause exists only because staging leaked, and the reaper that stops it
+      // leaking ships in this same binary.
+      ensureBackupSweepSubscriber(bus);
+    } finally {
+      bus.close();
+    }
+  } catch {
+    // Nothing to do — the next module install/update arms it.
+  }
+}
+
 function countApplied(sqlite: Database): number {
   try {
     const row = sqlite
@@ -57,6 +95,8 @@ export async function handleSystemMigrate(): Promise<CommandResult> {
     };
   }
 
+  ensureCoreSubscribers();
+
   const lines = [
     applied > 0 ? `Applied ${applied} migration(s).` : 'Schema already up to date.',
     `Schema current: ${drift.tableCount} tables.`,

package/src/cli/commands/system-update.ts

@@ -26,6 +26,7 @@ import { backups, moduleConfigs as moduleConfigsTbl, modules } from '../../db/sc
 import type { ModuleManifest } from '../../manifest/schema';
 import { RegistryClient } from '../../registry/client';
 import { runAudit } from '../../services/audit';
+import { loadAbandonedOperations } from '../../services/audit/abandoned-operations';
 import { fetchLatestCliVersion } from '../../services/audit/cli-version';
 import { makeJournalReader, readAppliedMigrations } from '../../services/audit/schema';
 import { createModuleBackup, createSystemStateBackup } from '../../services/backup-create';
@@ -567,6 +568,7 @@ export async function handleSystemUpdate(
         lastSuccessfulBackupAt: latestBackupByModule.get(m.id) ?? null,
       })),
     },
+    abandonedOperations: { records: loadAbandonedOperations(db) },
     undeployedModules: {
       modules: installed.map((m) => ({ id: m.id, state: m.state })),
     },
@@ -585,6 +587,7 @@ export async function handleSystemUpdate(
     secretsDecryptable: { results: [] },
     servicesReachable: { results: [] },
     machinesReachable: { results: [] },
+    transportReads: { statuses: [], now: new Date(), staleAfterMs: 30 * 60_000 },
     trustedSources: { firewalls: [] },
   };
 
@@ -777,6 +780,9 @@ export function rebuildAuditDepsForRerun(
         configs: configsByModule.get(m.id) ?? {},
       })),
     },
+    // Unchanged across an orchestrator run — an upgrade does not reclaim
+    // abandoned operations, so re-reading them would be the same rows.
+    abandonedOperations: original.abandonedOperations,
     backups: {
       ...original.backups,
       modules: upgradable.map((m) => ({

package/src/cli/completion.ts

@@ -7,6 +7,7 @@ import { eq } from 'drizzle-orm';
 import { getDb } from '../db/client';
 import { capabilities, modules } from '../db/schema';
 import type { ModuleManifest } from '../manifest/schema';
+import { SCHEDULABLE_BUILTIN_CHECKS } from '../services/alerting/builtin-source';
 import { listPrincipals } from '../services/api-access';
 import { listBackups } from '../services/backup-metadata';
 import { listBackupStorages } from '../services/backup-storage';
@@ -479,6 +480,23 @@ export async function getCompletions(words: string[], current: number): Promise<
     return filterSuggestions(['list', 'add', 'run', 'enable', 'disable'], args[1] || '');
   }
 
+  // Monitor targets - a module ID or one of celilo's own schedulable checks.
+  // Sourced from SCHEDULABLE_BUILTIN_CHECKS rather than a hand-copied list, so
+  // a new built-in check is completable the moment it is schedulable.
+  if (
+    command === 'monitor' &&
+    (args[1] === 'add' || args[1] === 'run' || args[1] === 'enable' || args[1] === 'disable') &&
+    currentIndex === 2
+  ) {
+    const db = getDb();
+    const moduleIds = db
+      .select({ id: modules.id })
+      .from(modules)
+      .all()
+      .map((m) => m.id);
+    return filterSuggestions([...SCHEDULABLE_BUILTIN_CHECKS, ...moduleIds], args[2] || '');
+  }
+
   // Alerts subcommands
   if (command === 'alerts' && currentIndex === 1) {
     return filterSuggestions(['list', 'ack', 'silence', 'resolve', 'sweep', 'poll'], args[1] || '');
@@ -486,7 +504,7 @@ export async function getCompletions(words: string[], current: number): Promise<
 
   // Storage subcommands
   if (command === 'storage' && currentIndex === 1) {
-    const subcommands = ['add', 'list', 'remove', 'verify', 'set-default'];
+    const subcommands = ['add', 'list', 'remove', 'verify', 'set-default', 'set-path'];
     return filterSuggestions(subcommands, args[1] || '');
   }
 
@@ -496,10 +514,13 @@ export async function getCompletions(words: string[], current: number): Promise<
     return filterSuggestions(providers, args[2] || '');
   }
 
-  // Storage remove/verify/set-default - complete with storage IDs
+  // Storage remove/verify/set-default/set-path - complete with storage IDs
   if (
     command === 'storage' &&
-    (args[1] === 'remove' || args[1] === 'verify' || args[1] === 'set-default') &&
+    (args[1] === 'remove' ||
+      args[1] === 'verify' ||
+      args[1] === 'set-default' ||
+      args[1] === 'set-path') &&
     currentIndex === 2
   ) {
     const storages = listBackupStorages();

package/src/cli/fuel-gauge.ts

@@ -334,7 +334,6 @@ export class FuelGauge {
    * Strip ANSI codes from text
    */
   private stripAnsi(text: string): string {
-    // biome-ignore lint/suspicious/noControlCharactersInRegex: ESC character needed for ANSI code matching
     return text.replace(/\u001b\[[0-9;]*m/g, '');
   }
 

package/src/cli/generate-zsh-completion.ts

@@ -361,7 +361,7 @@ _celilo_system_config_keys() {
     'network.internal.gateway:Internal gateway IP'
     'network.secure-mgmt.subnet:Control-plane subnet (celilo-mgr own network)'
     'network.secure-mgmt.gateway:Control-plane gateway IP'
-    'network.vpn.subnet:VPN client subnet (WireGuard remote access)'
+    'network.control-plane-vpn.subnet:Administrative VPN client subnet (WireGuard remote access)'
     'firewall.trusted_subnets:Extra subnets that reach every managed zone (comma-separated CIDRs)'
     'dns.primary:Primary DNS server'
     'dns.fallback:Fallback DNS servers'