@celilo/cli 0.5.0-alpha.1 → 0.5.0-alpha.11

package/src/cli/commands/system-doctor.ts

@@ -30,10 +30,20 @@
  */
 
 import { spawnSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, statSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { dirname, join, resolve } from 'node:path';
+import { defineEvents, openBus } from '@celilo/event-bus';
 import cliPkg from '../../../package.json' with { type: 'json' };
+import { getDbPath, getEventBusPath } from '../../config/paths';
+import { getDb } from '../../db/client';
+import {
+  type FleetFinding,
+  type FleetFindingStatus,
+  checkSubscribers,
+  runFleetChecks,
+} from '../../services/fleet-checks';
+import { resyncAllSubscriptions } from '../../services/module-subscriptions';
 import { checkAllPrerequisites, failingPrerequisites } from '../../system/prereqs';
 import type { CommandResult } from '../types';
 
@@ -296,6 +306,93 @@ function renderPrereqSection(): { lines: string[]; failingCount: number } {
   return { lines, failingCount: failingPrerequisites(checks).length };
 }
 
+/**
+ * mtime (ms) of the installed dispatcher code (`@celilo/event-bus`
+ * package.json). The fleet dispatcher check compares this against the
+ * running dispatcher's start time to spot a process on stale code. Null
+ * when the package can't be located (the staleness aspect is then skipped).
+ */
+function installedEventBusMtime(): number | null {
+  try {
+    const require = createRequire(import.meta.url);
+    return statSync(require.resolve('@celilo/event-bus/package.json')).mtimeMs;
+  } catch {
+    return null;
+  }
+}
+
+const FLEET_GLYPH: Record<FleetFindingStatus, string> = {
+  ok: `${ANSI.green}✔${ANSI.reset}`,
+  warn: `${ANSI.yellow}⚠${ANSI.reset}`,
+  fail: `${ANSI.red}✗${ANSI.reset}`,
+};
+
+function renderFleetFinding(f: FleetFinding): string[] {
+  const lines = [`  ${FLEET_GLYPH[f.status]} ${f.title}  ${ANSI.dim}— ${f.summary}${ANSI.reset}`];
+  for (const d of f.detail) lines.push(`      ${ANSI.dim}${d}${ANSI.reset}`);
+  if (f.remediation && f.status !== 'ok')
+    lines.push(`    ${ANSI.dim}→ ${f.remediation}${ANSI.reset}`);
+  return lines;
+}
+
+/**
+ * The fleet-runtime section: dispatcher / subscribers / capability-chain
+ * drift, read from the celilo DB + event bus. State-aware, so it's skipped
+ * cleanly on a fresh dev box with no DB unless `--fleet` forces it. `--fix`
+ * runs only the auto-fixable checks (today: subscribers resync).
+ */
+async function renderFleetSection(opts: { forced: boolean; fix: boolean }): Promise<{
+  lines: string[];
+  failCount: number;
+  warnCount: number;
+}> {
+  const lines: string[] = ['Fleet runtime'];
+  const dbExists = existsSync(getDbPath());
+
+  if (!dbExists) {
+    if (opts.forced) {
+      lines.push(
+        `  ${ANSI.dim}skipped — no celilo database at ${getDbPath()} (not a management plane)${ANSI.reset}`,
+      );
+      return { lines, failCount: 0, warnCount: 0 };
+    }
+    // Dev box, no --fleet: don't render the section at all.
+    return { lines: [], failCount: 0, warnCount: 0 };
+  }
+
+  const bus = openBus({ dbPath: getEventBusPath(), events: defineEvents({}) });
+  try {
+    const db = getDb();
+    let findings = await runFleetChecks(bus, db, {
+      installedCodeMtimeMs: installedEventBusMtime(),
+    });
+
+    if (opts.fix) {
+      const subscribers = findings.find((f) => f.id === 'subscribers');
+      if (subscribers?.autoFixable && subscribers.status !== 'ok') {
+        const r = resyncAllSubscriptions();
+        lines.push(
+          `  ${ANSI.dim}--fix: re-registered ${r.registered} subscription(s) from ${r.modules} module(s).${ANSI.reset}`,
+        );
+        // Re-evaluate the subscribers finding so the section shows the healed state.
+        const healed = checkSubscribers(bus, db);
+        findings = findings.map((f) => (f.id === 'subscribers' ? healed : f));
+      }
+    }
+
+    let failCount = 0;
+    let warnCount = 0;
+    for (const f of findings) {
+      lines.push(...renderFleetFinding(f));
+      if (f.status === 'fail') failCount++;
+      else if (f.status === 'warn') warnCount++;
+    }
+    return { lines, failCount, warnCount };
+  } finally {
+    bus.close();
+  }
+}
+
 export async function handleSystemDoctor(
   _args: string[],
   flags: Record<string, string | boolean>,
@@ -397,61 +494,59 @@ export async function handleSystemDoctor(
 
   const fix = flags.fix === true;
 
+  // Drift repair (bun link). Does NOT early-return — the fleet section
+  // still runs on a --fix invocation so a single `--fix` heals both.
   if (fix && drifted.length > 0) {
     lines.push(`Repairing ${drifted.length} drifted package(s) with \`bun link\`:`);
     lines.push(...applyFix(drifted, cliRoot));
+    lines.push(`${ANSI.dim}\`bun unlink\` from each workspace dir reverses.${ANSI.reset}`);
+    lines.push('');
+    // Linked from the workspace now — no longer drift for the summary.
+    driftCount = 0;
+    drifted.length = 0;
+  } else if (fix && drifted.length === 0) {
+    lines.push(`${ANSI.dim}--fix: no drifted packages to repair.${ANSI.reset}`);
     lines.push('');
+  } else if (drifted.length > 0) {
     lines.push(
-      `${ANSI.dim}Re-run \`celilo system doctor\` to verify; \`bun unlink\` from each workspace dir reverses.${ANSI.reset}`,
+      `${ANSI.dim}Run \`celilo system doctor --fix\` to bun-link drifted packages from the workspace.${ANSI.reset}`,
     );
-    // Note: --fix only addresses drift, not missing prereqs. If prereqs
-    // failed, surface that even on a successful --fix run.
-    if (prereqResult.failingCount > 0) {
-      return {
-        success: false,
-        error: `${prereqResult.failingCount} system prerequisite(s) missing or below minimum — install before running celilo`,
-        details: lines.join('\n'),
-      };
-    }
-    return {
-      success: true,
-      message: lines.join('\n'),
-      rawOutput: true,
-    };
+    lines.push('');
   }
 
-  if (fix && drifted.length === 0) {
-    lines.push(`${ANSI.dim}--fix: nothing to repair.${ANSI.reset}`);
+  // Fleet-runtime section (state-aware; only renders on a management
+  // plane with a celilo DB, or when --fleet forces it).
+  const fleet = await renderFleetSection({ forced: flags.fleet === true, fix });
+  if (fleet.lines.length > 0) {
+    lines.push(...fleet.lines);
+    lines.push('');
   }
 
-  if (driftCount > 0 || unresolvedCount > 0 || prereqResult.failingCount > 0) {
-    const summary: string[] = [];
-    if (prereqResult.failingCount > 0) {
-      summary.push(`${prereqResult.failingCount} prerequisite(s) missing/below-minimum`);
-    }
-    if (driftCount > 0) summary.push(`${driftCount} package(s) behind workspace`);
-    if (unresolvedCount > 0) summary.push(`${unresolvedCount} unresolved`);
-    if (drifted.length > 0) {
-      lines.push(
-        `${ANSI.dim}Run \`celilo system doctor --fix\` to bun-link drifted packages from the workspace.${ANSI.reset}`,
-      );
-    }
-    // Distinguish prereq-only from drift-only from both — the
-    // operator's next move is different.
-    const errorPrefix =
-      driftCount === 0 && unresolvedCount === 0
-        ? 'System prerequisites missing'
-        : prereqResult.failingCount === 0
-          ? 'Drift detected'
-          : 'Issues detected';
+  // Unified summary: anything that fails the run, with a per-cause count.
+  const problems: string[] = [];
+  if (prereqResult.failingCount > 0) {
+    problems.push(`${prereqResult.failingCount} prerequisite(s) missing/below-minimum`);
+  }
+  if (driftCount > 0) problems.push(`${driftCount} package(s) behind workspace`);
+  if (unresolvedCount > 0) problems.push(`${unresolvedCount} unresolved`);
+  if (fleet.failCount > 0) problems.push(`${fleet.failCount} fleet check(s) failing`);
+
+  if (problems.length > 0) {
     return {
       success: false,
-      error: `${errorPrefix}: ${summary.join(', ')}`,
+      error: `Issues detected: ${problems.join(', ')}`,
       details: lines.join('\n'),
     };
   }
 
-  lines.push(`${ANSI.green}OK${ANSI.reset} — no issues detected`);
+  // Fleet warnings don't fail the run, but they shouldn't read as a clean bill.
+  if (fleet.warnCount > 0) {
+    lines.push(
+      `${ANSI.yellow}OK with warnings${ANSI.reset} — ${fleet.warnCount} fleet warning(s); see above`,
+    );
+  } else {
+    lines.push(`${ANSI.green}OK${ANSI.reset} — no issues detected`);
+  }
   return {
     success: true,
     message: lines.join('\n'),

package/src/cli/commands/system-init.ts

@@ -5,8 +5,8 @@
  * or applies defaults for non-interactive use.
  */
 
-import * as p from '@clack/prompts';
 import { getDb } from '../../db/client';
+import { askConfirm, askSelect, askText, withInterviewSession } from '../../services/bus-interview';
 import {
   autoDetectSSHKeys,
   getDefaultConfiguration,
@@ -14,9 +14,8 @@ import {
   isSystemInitialized,
   loadExistingConfiguration,
 } from '../../services/system-init';
-import { celiloIntro, celiloOutro, promptConfirm, promptText } from '../prompts';
+import { celiloIntro, celiloOutro } from '../prompts';
 import type { CommandResult } from '../types';
-import { validateRequired } from '../validators';
 
 /**
  * Parse key=value pairs from positional arguments
@@ -163,139 +162,131 @@ async function initInteractive(cliOverrides: Record<string, string> = {}): Promi
   // Helper: skip prompt if value already provided via CLI
   const has = (key: string) => key in cliOverrides;
 
-  await celiloIntro('🎛️  Welcome to Celilo System Setup');
-
-  // Network and DNS addressing are intentionally NOT prompted here.
-  // Network topology is no longer owned by `system init`
-  // (v2/NETWORK_CONFIG_TO_FIREWALL.md): the `internal` zone and DNS are
-  // discovered when celilo-mgmt is deployed, and `dmz`/`app`/`secure`
-  // come from a firewall module. The only thing left to capture
-  // interactively is the SSH key celilo uses to reach managed machines.
-
-  // SSH Key — skip if provided via CLI
-  if (!has('ssh.public_key')) {
-    const detectedKeys = autoDetectSSHKeys();
-    const existingSshKey = defaults['ssh.public_key'];
-
-    // Fresh box, no key in ~/.ssh and no previously-saved key — point the
-    // user at ssh-keygen rather than making them paste at a blank prompt.
-    // They can also skip this branch by passing ssh.public_key=... on the CLI.
-    if (detectedKeys.length === 0 && !existingSshKey) {
-      p.cancel('No SSH key found in ~/.ssh/');
-      console.log();
-      console.log('Celilo uses an SSH key to reach managed machines');
-      console.log('(Proxmox hosts, VPS, Raspberry Pi, etc.). Generate one:');
-      console.log();
-      console.log('    ssh-keygen -t ed25519 -C "<your-email>"');
-      console.log();
-      console.log('Then re-run:  celilo system init');
-      console.log();
-      console.log('Or, to paste a key from elsewhere without generating one:');
-      console.log('    celilo system init ssh.public_key="ssh-ed25519 AAAA..."');
-      return { success: false, error: 'No SSH key available — run ssh-keygen first' };
-    }
-
-    let keySelected = false;
-
-    if (detectedKeys.length === 1) {
-      // Single key: confirm
-      const key = detectedKeys[0];
-      const keyPreview = `${key.keyType} ...${key.content.slice(-20)}`;
-      const useDetected = await promptConfirm({
-        message: `Auto-detected SSH key (${key.filename}: ${keyPreview}) - Use it?`,
-        initialValue: true,
-      });
-
-      if (useDetected) {
-        overrides['ssh.public_key'] = key.content;
-        keySelected = true;
-      }
-    } else if (detectedKeys.length > 1) {
-      // Multiple keys: selection menu
-      const PASTE_OPTION = '__paste__';
-      const selected = await p.select({
-        message: `Found ${detectedKeys.length} SSH keys in ~/.ssh/`,
-        options: [
-          ...detectedKeys.map((key) => ({
-            value: key.content,
-            label: key.filename,
-            hint: `${key.keyType} ...${key.content.slice(-20)}`,
-          })),
-          { value: PASTE_OPTION, label: 'Paste a different key' },
-        ],
-      });
-
-      if (p.isCancel(selected)) {
-        p.cancel('Operation cancelled');
-        return { success: false, error: 'Cancelled by user' };
+  // Every prompt below is a bus interview (ISS-0127), so `system init` is
+  // drivable headlessly via `celilo events respond --values` / `events reply`.
+  // `withInterviewSession` renders bus questions locally when stdin is a TTY.
+  const scope = 'system-init';
+
+  return withInterviewSession(async () => {
+    await celiloIntro('🎛️  Welcome to Celilo System Setup');
+
+    // Network and DNS addressing are intentionally NOT prompted here.
+    // Network topology is no longer owned by `system init`
+    // (v2/NETWORK_CONFIG_TO_FIREWALL.md): the `internal` zone and DNS are
+    // discovered when celilo-mgmt is deployed, and `dmz`/`app`/`secure`
+    // come from a firewall module. The only thing left to capture
+    // interactively is the SSH key celilo uses to reach managed machines.
+
+    // SSH Key — skip if provided via CLI
+    if (!has('ssh.public_key')) {
+      const detectedKeys = autoDetectSSHKeys();
+      const existingSshKey = defaults['ssh.public_key'];
+
+      // Fresh box, no key in ~/.ssh and no previously-saved key — point the
+      // user at ssh-keygen rather than making them paste at a blank prompt.
+      // They can also skip this branch by passing ssh.public_key=... on the CLI.
+      if (detectedKeys.length === 0 && !existingSshKey) {
+        console.log('No SSH key found in ~/.ssh/');
+        console.log();
+        console.log('Celilo uses an SSH key to reach managed machines');
+        console.log('(Proxmox hosts, VPS, Raspberry Pi, etc.). Generate one:');
+        console.log();
+        console.log('    ssh-keygen -t ed25519 -C "<your-email>"');
+        console.log();
+        console.log('Then re-run:  celilo system init');
+        console.log();
+        console.log('Or, to paste a key from elsewhere without generating one:');
+        console.log('    celilo system init ssh.public_key="ssh-ed25519 AAAA..."');
+        return { success: false, error: 'No SSH key available — run ssh-keygen first' };
       }
 
-      if (selected !== PASTE_OPTION) {
-        overrides['ssh.public_key'] = selected as string;
-        keySelected = true;
+      let keySelected = false;
+
+      if (detectedKeys.length === 1) {
+        // Single key: confirm
+        const key = detectedKeys[0];
+        const keyPreview = `${key.keyType} ...${key.content.slice(-20)}`;
+        const useDetected = await askConfirm({
+          scope,
+          key: 'ssh_use_detected',
+          message: `Auto-detected SSH key (${key.filename}: ${keyPreview}) - Use it?`,
+          defaultValue: true,
+        });
+
+        if (useDetected) {
+          overrides['ssh.public_key'] = key.content;
+          keySelected = true;
+        }
+      } else if (detectedKeys.length > 1) {
+        // Multiple keys: selection menu
+        const PASTE_OPTION = '__paste__';
+        const selected = await askSelect({
+          scope,
+          key: 'ssh_key_choice',
+          message: `Found ${detectedKeys.length} SSH keys in ~/.ssh/`,
+          options: [
+            ...detectedKeys.map((key) => ({
+              value: key.content,
+              label: key.filename,
+              hint: `${key.keyType} ...${key.content.slice(-20)}`,
+            })),
+            { value: PASTE_OPTION, label: 'Paste a different key' },
+          ],
+        });
+
+        if (selected !== PASTE_OPTION) {
+          overrides['ssh.public_key'] = selected;
+          keySelected = true;
+        }
       }
-    }
 
-    // Manual prompt if no key selected from detection
-    if (!keySelected) {
-      overrides['ssh.public_key'] = await promptText({
-        message: existingSshKey
-          ? 'SSH public key (press Enter to keep existing)'
-          : 'SSH public key',
-        defaultValue: String(existingSshKey || ''),
-        // String(undefined) === 'undefined' (truthy), so guard explicitly —
-        // otherwise the prompt shows "undefined" as the placeholder text.
-        placeholder: existingSshKey ? String(existingSshKey) : 'ssh-ed25519 AAAA...',
-        validate: (value) => {
-          if (existingSshKey && !value) {
-            return;
-          }
-          if (!value) {
-            return 'SSH public key is required';
-          }
-        },
-      });
-      if (!overrides['ssh.public_key'] && existingSshKey) {
-        overrides['ssh.public_key'] = existingSshKey;
-      }
-    } else if (existingSshKey) {
-      overrides['ssh.public_key'] = await promptText({
-        message: 'SSH public key (press Enter to keep existing)',
-        defaultValue: String(existingSshKey),
-        placeholder: String(existingSshKey),
-        validate: () => undefined,
-      });
-      if (!overrides['ssh.public_key']) {
-        overrides['ssh.public_key'] = existingSshKey;
+      // Manual prompt if no key selected from detection
+      if (!keySelected) {
+        const entered = await askText({
+          scope,
+          key: 'ssh_public_key',
+          message: existingSshKey
+            ? 'SSH public key (press Enter to keep existing)'
+            : 'SSH public key',
+          defaultValue: existingSshKey ? String(existingSshKey) : undefined,
+          // String(undefined) === 'undefined' (truthy), so guard explicitly —
+          // otherwise the prompt shows "undefined" as the placeholder text.
+          placeholder: existingSshKey ? String(existingSshKey) : 'ssh-ed25519 AAAA...',
+          required: !existingSshKey,
+        });
+        overrides['ssh.public_key'] = entered || existingSshKey;
+      } else if (existingSshKey) {
+        const entered = await askText({
+          scope,
+          key: 'ssh_public_key',
+          message: 'SSH public key (press Enter to keep existing)',
+          defaultValue: String(existingSshKey),
+          placeholder: String(existingSshKey),
+        });
+        overrides['ssh.public_key'] = entered || existingSshKey;
       }
-    } else {
-      overrides['ssh.public_key'] = await promptText({
-        message: 'SSH public key',
-        placeholder: 'ssh-ed25519 AAAA...',
-        validate: validateRequired('SSH public key'),
-      });
     }
-  }
 
-  // Apply configuration (called for its DB side effects).
-  initializeSystem(db, overrides);
+    // Apply configuration (called for its DB side effects).
+    initializeSystem(db, overrides);
 
-  await celiloOutro('✅ System initialization complete!');
+    await celiloOutro('✅ System initialization complete!');
 
-  console.log('\nNext steps:');
-  console.log('  1. Configure infrastructure:');
-  console.log('     Container services:');
-  console.log('       - celilo service add proxmox');
-  console.log('       - celilo service add digitalocean');
-  console.log('     Existing hardware:');
-  console.log('       - celilo machine add');
-  console.log('');
-  console.log('  2. Import a module:    celilo module import <path>');
-  console.log('  3. Configure module:   celilo module config set <module-id> <key> <value>');
-  console.log('  4. Generate infra:     celilo module generate <module-id>');
+    console.log('\nNext steps:');
+    console.log('  1. Configure infrastructure:');
+    console.log('     Container services:');
+    console.log('       - celilo service add proxmox');
+    console.log('       - celilo service add digitalocean');
+    console.log('     Existing hardware:');
+    console.log('       - celilo machine add');
+    console.log('');
+    console.log('  2. Import a module:    celilo module import <path>');
+    console.log('  3. Configure module:   celilo module config set <module-id> <key> <value>');
+    console.log('  4. Generate infra:     celilo module generate <module-id>');
 
-  return {
-    success: true,
-    message: 'System initialized successfully',
-  };
+    return {
+      success: true,
+      message: 'System initialized successfully',
+    };
+  });
 }

package/src/cli/commands/system-migrate.test.ts

@@ -0,0 +1,40 @@
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { closeDb } from '../../db/client';
+import { handleSystemMigrate } from './system-migrate';
+
+describe('handleSystemMigrate', () => {
+  let dir: string;
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'sysmig-'));
+    process.env.CELILO_DB_PATH = join(dir, 'celilo.db');
+  });
+  afterEach(() => {
+    closeDb();
+    process.env.CELILO_DB_PATH = undefined;
+    try {
+      rmSync(dir, { recursive: true, force: true });
+    } catch {
+      /* ignore */
+    }
+  });
+
+  it('reports a fresh/current DB as up to date with the full schema', async () => {
+    const result = await handleSystemMigrate();
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.message).toContain('up to date');
+      expect(result.message).toContain('tables');
+    }
+  });
+
+  it('is idempotent — a second run is also clean', async () => {
+    (await handleSystemMigrate()).success;
+    closeDb();
+    const second = await handleSystemMigrate();
+    expect(second.success).toBe(true);
+  });
+});

package/src/cli/commands/system-migrate.ts

@@ -0,0 +1,65 @@
+/**
+ * `celilo system migrate` — apply pending DB migrations (ISS-0100).
+ *
+ * Drizzle's migrator is the single migration mechanism; createDbClient already
+ * auto-migrates on open, so this command is the explicit, operator-visible
+ * entrypoint the .deb postinst and celilo-mgmt deploy call. Idempotent: a
+ * current DB reports "up to date".
+ */
+
+import type { Database } from 'bun:sqlite';
+import { getDb } from '../../db/client';
+import { runMigrationsOn } from '../../db/migrate';
+import { findSchemaDrift } from '../../db/schema-introspection';
+import type { CommandResult } from '../types';
+
+function countApplied(sqlite: Database): number {
+  try {
+    const row = sqlite
+      .query<{ c: number }, []>('SELECT COUNT(*) AS c FROM `__drizzle_migrations`')
+      .get();
+    return row?.c ?? 0;
+  } catch {
+    return 0;
+  }
+}
+
+export async function handleSystemMigrate(): Promise<CommandResult> {
+  // getDb() auto-migrates on open; do it inside try so an existing DB that
+  // predates the drizzle-authoritative change fails with an actionable message
+  // instead of a raw migrator error.
+  let db: ReturnType<typeof getDb>;
+  try {
+    db = getDb();
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error);
+    return {
+      success: false,
+      error: `Migration failed: ${msg}\n\nIf this DB predates the drizzle-authoritative migration change, it needs a one-time remediation (stamp \`__drizzle_migrations\` to the latest migration + create any missing table) before the migrator can run cleanly — see ISS-0100.`,
+    };
+  }
+
+  const sqlite = db.$client;
+  const before = countApplied(sqlite);
+  try {
+    runMigrationsOn(db); // idempotent re-assert
+  } catch (error) {
+    return { success: false, error: error instanceof Error ? error.message : String(error) };
+  }
+  const applied = countApplied(sqlite) - before;
+
+  const drift = findSchemaDrift(sqlite);
+  if (drift.missingTables.length > 0 || drift.missingColumns.length > 0) {
+    const missing = [...drift.missingTables, ...drift.missingColumns].join(', ');
+    return {
+      success: false,
+      error: `Schema still behind after migrate — missing: ${missing}. This DB likely needs one-time remediation — see ISS-0100.`,
+    };
+  }
+
+  const lines = [
+    applied > 0 ? `Applied ${applied} migration(s).` : 'Schema already up to date.',
+    `Schema current: ${drift.tableCount} tables.`,
+  ];
+  return { success: true, message: lines.join('\n') };
+}

package/src/cli/completion.ts

@@ -31,6 +31,7 @@ export async function getCompletions(words: string[], current: number): Promise<
       'audit',
       'backup',
       'capability',
+      'dns',
       'completion',
       'events',
       'help',
@@ -39,6 +40,7 @@ export async function getCompletions(words: string[], current: number): Promise<
       'machine',
       'module',
       'package',
+      'proxmox',
       'publish',
       'restore',
       'service',
@@ -53,6 +55,11 @@ export async function getCompletions(words: string[], current: number): Promise<
 
   const command = args[0];
 
+  // DNS subcommands
+  if (command === 'dns' && currentIndex === 1) {
+    return filterSuggestions(['registrations'], args[1] || '');
+  }
+
   // Capability subcommands
   if (command === 'capability' && currentIndex === 1) {
     const subcommands = ['list', 'info'];
@@ -76,6 +83,7 @@ export async function getCompletions(words: string[], current: number): Promise<
       'status',
       'tail',
       'list-subscribers',
+      'resync-subscriptions',
       'list-pending',
       'drain',
       'run',
@@ -237,6 +245,20 @@ export async function getCompletions(words: string[], current: number): Promise<
   }
 
   // Service subcommands
+  // Proxmox subcommands
+  if (command === 'proxmox' && currentIndex === 1) {
+    return filterSuggestions(['node'], args[1] || '');
+  }
+  if (command === 'proxmox' && args[1] === 'node' && currentIndex === 2) {
+    return filterSuggestions(['list'], args[2] || '');
+  }
+  // proxmox node list <service-id> — proxmox services only
+  if (command === 'proxmox' && args[1] === 'node' && args[2] === 'list' && currentIndex === 3) {
+    const services = await listContainerServices();
+    const serviceIds = services.filter((s) => s.providerName === 'proxmox').map((s) => s.serviceId);
+    return filterSuggestions(serviceIds, args[3] || '');
+  }
+
   if (command === 'service' && currentIndex === 1) {
     const subcommands = ['add', 'list', 'verify', 'reconfigure', 'remove', 'config'];
     return filterSuggestions(subcommands, args[1] || '');
@@ -453,6 +475,7 @@ export async function getCompletions(words: string[], current: number): Promise<
       'audit',
       'update',
       'doctor',
+      'migrate',
     ];
     return filterSuggestions(subcommands, args[1] || '');
   }