@celilo/cli 1.12.0 → 1.14.0

package/src/cli/commands/backup-list.ts

@@ -10,6 +10,7 @@ import {
   listBackups,
   loadBackupHistory,
 } from '../../services/backup-metadata';
+import type { BackupHistory } from '../../services/backup-schedule';
 import { getBackupStorage } from '../../services/backup-storage';
 import { celiloIntro } from '../prompts';
 import type { CommandResult } from '../types';
@@ -136,28 +137,136 @@ export function lastSuccessSummaryLines(
   });
 }
 
+/**
+ * The listing as data, for anything that is not a person reading a terminal.
+ *
+ * This exists because the human output cannot be parsed back into facts. Ages
+ * are rendered relative and BUCKETED — everything past six days collapses to
+ * "last week", then "2 weeks ago", then "last month" — so a caller reading the
+ * text can place a backup on a day for six days and not one day further.
+ *
+ * That is fine for a person, who is asking "is this recent". It is not fine for
+ * the web console, which draws one square per module per day: a row it cannot
+ * place is a row it must leave out, and a missing row renders as a day on which
+ * no backup ran. The one thing a coverage grid must never do is invent a gap.
+ *
+ * So the timestamps go out as epoch ms, exactly as stored, and the caller
+ * decides how to say them. Everything else here is what the human path already
+ * shows — the same rows and the same per-module summary — because a second
+ * source of truth for "what backups exist" is worth less than no second source.
+ */
+/**
+ * The two database reads this needs, injectable so the shape can be tested
+ * without one (Rule 2.3). The defaults are the real thing.
+ */
+export interface BackupListJsonDeps {
+  storageNameOf: (storageId: string) => string;
+  historyOf: (moduleId: string) => BackupHistory;
+}
+
+const LIVE_LOOKUPS: BackupListJsonDeps = {
+  storageNameOf: (storageId) => getBackupStorage(storageId)?.storageId ?? 'unknown',
+  historyOf: loadBackupHistory,
+};
+
+export function backupListJson(
+  backupList: Backup[],
+  windowDays: number | null,
+  deps: BackupListJsonDeps = LIVE_LOOKUPS,
+): CommandResult {
+  // One lookup per distinct destination rather than one per row: a month of a
+  // failing module is hundreds of rows and two or three storages.
+  const storageNames = new Map<string, string>();
+  for (const backup of backupList) {
+    if (storageNames.has(backup.storageId)) continue;
+    storageNames.set(backup.storageId, deps.storageNameOf(backup.storageId));
+  }
+
+  const payload = {
+    asOf: Date.now(),
+    /**
+     * How far back the rows are COMPLETE for, or null when unbounded.
+     *
+     * The caller needs this to tell "nothing ran that day" from "you did not
+     * ask about that day". They look identical in the data and only one of them
+     * is somebody's missing backup.
+     */
+    windowDays,
+    backups: backupList.map((backup) => ({
+      id: backup.id,
+      shortId: backup.id.substring(0, 8),
+      moduleId: backup.moduleId,
+      backupType: backup.backupType,
+      status: backup.status,
+      sizeBytes: backup.sizeBytes,
+      // Epoch ms, both of them. `startedAt` is when the attempt began and
+      // `completedAt` is when it finished; a failed attempt has no second one.
+      startedAt: backup.startedAt.getTime(),
+      completedAt: backup.completedAt ? backup.completedAt.getTime() : null,
+      storage: storageNames.get(backup.storageId) ?? 'unknown',
+      storagePath: backup.storagePath,
+      moduleVersion: backup.moduleVersion,
+      schemaVersion: backup.schemaVersion,
+      name: backup.name,
+      error: backup.errorMessage,
+    })),
+    modules: backedUpModuleIds(backupList).map((moduleId) => {
+      const history = deps.historyOf(moduleId);
+      return {
+        moduleId,
+        lastSuccessAt: history.lastSuccessAt ? history.lastSuccessAt.getTime() : null,
+        lastAttemptAt: history.lastAttemptAt ? history.lastAttemptAt.getTime() : null,
+        consecutiveFailures: history.consecutiveFailures,
+      };
+    }),
+  };
+
+  // `rawOutput` keeps the payload out of the decorating renderer, which would
+  // wrap it and stop it parsing (celilo#698).
+  return { success: true, message: JSON.stringify(payload, null, 2), rawOutput: true };
+}
+
 export async function handleBackupList(
   args: string[],
   flags: Record<string, boolean | string> = {},
 ): Promise<CommandResult> {
   try {
     const moduleIdOrBackupId = args[0];
-    const limit = typeof flags.limit === 'string' ? Number.parseInt(flags.limit, 10) : 20;
+    // A JSON caller is a program with a window in mind, not a person skimming a
+    // screen, so 20 is the wrong ceiling for it. It still takes --limit.
+    const defaultLimit = flags.json ? 5000 : 20;
+    const limit = typeof flags.limit === 'string' ? Number.parseInt(flags.limit, 10) : defaultLimit;
+    const windowDays = typeof flags.since === 'string' ? Number.parseInt(flags.since, 10) : null;
+    if (windowDays !== null && (!Number.isFinite(windowDays) || windowDays <= 0)) {
+      return {
+        success: false,
+        error: `--since takes a positive number of days, got: ${flags.since}`,
+      };
+    }
+    const since = windowDays === null ? undefined : Date.now() - windowDays * 86_400_000;
 
     // If the argument looks like a backup ID (hex chars), show detail view
     if (moduleIdOrBackupId && /^[0-9a-f]{8,}$/i.test(moduleIdOrBackupId)) {
       const backup = getBackup(moduleIdOrBackupId);
       if (backup) {
+        // The same envelope as the listing, holding one row. A caller that can
+        // parse `backup list --json` can parse this without a second shape, and
+        // asking about one backup is the commonest scripted case there is.
+        if (flags.json) return backupListJson([backup], null);
         celiloIntro('Backup Detail');
         return showBackupDetail(moduleIdOrBackupId);
       }
       // Fall through to module filter if not a backup ID
     }
 
-    celiloIntro('Available Backups');
-
     const moduleId = moduleIdOrBackupId;
-    const backupList = listBackups({ moduleId, limit });
+    const backupList = listBackups({ moduleId, limit, since });
+
+    // Before the banner: --json must emit JSON and nothing else, or the first
+    // thing a parser meets is a celilo logo.
+    if (flags.json) return backupListJson(backupList, windowDays);
+
+    celiloIntro('Available Backups');
 
     if (backupList.length === 0) {
       console.log('No backups found.\n');

package/src/cli/commands/console-get-chain.test.ts

@@ -0,0 +1,96 @@
+/**
+ * The wiring, end to end: does `celilo console get` actually carry the chain?
+ *
+ * `orderFirewallChain` is unit-tested, `computeClosure` is unit-tested, and
+ * `loadClosureInputs` is unit-tested against real rows. None of that says the
+ * command joins them up. A dropped argument at this one call site returns a
+ * perfectly well-formed answer with an empty `chains` — which reads as a fleet
+ * with no delegation, and is the failure mode CLAUDE.md names.
+ *
+ * So this drives the REAL command against a REAL database and asserts on what
+ * it emits.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+let testDir: string;
+
+beforeEach(() => {
+  testDir = mkdtempSync(join(tmpdir(), 'celilo-console-chain-'));
+  process.env.CELILO_DB_PATH = join(testDir, 'test.db');
+  process.env.CELILO_DATA_DIR = testDir;
+});
+
+afterEach(() => {
+  rmSync(testDir, { recursive: true, force: true });
+  process.env.CELILO_DB_PATH = undefined;
+});
+
+/** The live fleet's firewall shape: caddy on iptables, iptables on the router. */
+async function seedFleet() {
+  const { getDb } = await import('../../db/client');
+  const db = getDb();
+  const consumer = JSON.stringify({ requires: { capabilities: [{ name: 'firewall' }] } });
+
+  db.$client.run(
+    `INSERT INTO modules (id, name, version, source_path, manifest_data, state)
+     VALUES ('caddy', 'Caddy', '1.0.0', '/p', '${consumer}', 'VERIFIED')`,
+  );
+  for (const id of ['iptables', 'axon']) {
+    db.$client.run(
+      `INSERT INTO modules (id, name, version, source_path, manifest_data, state)
+       VALUES ('${id}', '${id}', '1.0.0', '/p', '{}', 'VERIFIED')`,
+    );
+  }
+  db.$client.run(
+    `INSERT INTO capabilities (module_id, capability_name, version, data)
+     VALUES ('iptables', 'firewall', '1.0.0', '{"nat_ip":"192.168.0.253"}')`,
+  );
+  db.$client.run(
+    `INSERT INTO capabilities (module_id, capability_name, version, data)
+     VALUES ('axon', 'firewall', '1.0.0', '{"has_external":true}')`,
+  );
+}
+
+describe('celilo console get, and the delegation chain', () => {
+  test('--json carries the chain, in order', async () => {
+    await seedFleet();
+    const { handleConsoleGet } = await import('./console');
+    const result = handleConsoleGet(['caddy'], { json: true });
+
+    expect(result.success).toBe(true);
+    const payload = JSON.parse(result.success ? result.message : '{}');
+    expect(payload.chains).toEqual([{ capability: 'firewall', moduleIds: ['iptables', 'axon'] }]);
+  });
+
+  test('the router is in the closure, though no manifest mentions it', async () => {
+    // caddy requires `firewall` and nothing else. Walking manifests alone stops
+    // at the two registered providers and has no way to know one stands on the
+    // other — which is the whole reason the chain is derived.
+    await seedFleet();
+    const { handleConsoleGet } = await import('./console');
+    const payload = JSON.parse(
+      (() => {
+        const r = handleConsoleGet(['caddy'], { json: true });
+        return r.success ? r.message : '{}';
+      })(),
+    );
+
+    const axon = payload.nodes.find((n: { moduleId: string }) => n.moduleId === 'axon');
+    expect(axon).toBeDefined();
+  });
+
+  test('the human output prints it as a path, not as more rows', async () => {
+    // A list of two firewalls is exactly the claim being corrected. The arrow is
+    // the information.
+    await seedFleet();
+    const { handleConsoleGet } = await import('./console');
+    const result = handleConsoleGet(['caddy'], {});
+
+    expect(result.success).toBe(true);
+    expect(result.success ? result.message : '').toContain('iptables -> axon');
+  });
+});

package/src/cli/commands/console.ts

@@ -0,0 +1,130 @@
+/**
+ * `celilo console …` — the narrow reads the web console polls.
+ *
+ * A NOTE ON THE VERB NAMES, because they read oddly on purpose. celilo's remote
+ * API authorises at two levels (`command:subcommand`), and a leaf is classified
+ * read-only by its subcommand token against `READ_VERBS` in `@celilo/core`. So
+ * these are named from that vocabulary — `status`, `list`, `get` — rather than
+ * for prose. `console roster` would be a nicer name and would classify as a
+ * WRITE, which would either deny the console its own data or require widening
+ * the read-verb set for every principal in the fleet.
+ *
+ * All three are reads. The console's principal is granted read ops only, so a
+ * mutating verb added to this file would be refused at the API boundary rather
+ * than running.
+ */
+
+import {
+  DEFAULT_CLOSURE_DEPTH,
+  UNBOUNDED_CLOSURE_DEPTH,
+  computeClosure,
+} from '../../console/closure';
+import {
+  consoleStatus,
+  loadBindings,
+  loadClosureInputs,
+  moduleExists,
+} from '../../console/projection';
+import { getDb } from '../../db/client';
+import { loadCapabilityProviderRows } from '../../services/consumer-cleanup';
+import { hasFlag } from '../parser';
+import type { CommandResult } from '../types';
+
+/** `celilo console status [--json]` — the dashboard's single poll. */
+export function handleConsoleStatus(flags: Record<string, string | boolean> = {}): CommandResult {
+  const payload = consoleStatus(getDb());
+
+  if (hasFlag(flags, 'json')) {
+    return { success: true, message: JSON.stringify(payload), rawOutput: true, data: payload };
+  }
+
+  const lines = payload.modules.map(
+    (m) =>
+      `${m.id.padEnd(24)} ${m.state.padEnd(12)} ${m.health.cell.padEnd(14)} ${
+        m.systems.map((s) => `${s.hostname}@${s.zone}`).join(', ') || '(no system)'
+      }`,
+  );
+  return {
+    success: true,
+    message: [`zones: ${payload.zones.join(' > ')}`, '', ...lines].join('\n'),
+  };
+}
+
+/**
+ * `celilo console get <module-id> [--depth N] [--json]` — one module's bounded
+ * capability closure.
+ *
+ * `--depth 0` walks the whole graph. The walk terminates on cycles either way.
+ */
+export function handleConsoleGet(
+  args: string[],
+  flags: Record<string, string | boolean> = {},
+): CommandResult {
+  const moduleId = args[0];
+  if (!moduleId) {
+    return { success: false, error: 'Module ID required\n\nUsage: celilo console get <module-id>' };
+  }
+
+  const db = getDb();
+  if (!moduleExists(db, moduleId)) {
+    return { success: false, error: `Module not found: ${moduleId}` };
+  }
+
+  const depth = parseDepth(flags.depth);
+  if (depth instanceof Error) return { success: false, error: depth.message };
+
+  const { manifests, providerStates, chains } = loadClosureInputs(db);
+
+  // Real bindings, for every module the walk might reach. The console draws what
+  // the fleet IS doing, not what its manifests permit.
+  const bindings = new Map([...manifests.keys()].map((id) => [id, loadBindings(db, id)] as const));
+
+  const result = computeClosure({
+    rootModuleId: moduleId,
+    manifests,
+    providerRows: loadCapabilityProviderRows(db),
+    providerStates,
+    depth,
+    bindings,
+    chains,
+  });
+
+  if (hasFlag(flags, 'json')) {
+    return { success: true, message: JSON.stringify(result), rawOutput: true, data: result };
+  }
+
+  if (result.nodes.length === 0) {
+    // An answer, not a failure. The console says the same thing in words rather
+    // than rendering an empty picture that reads as still loading.
+    return { success: true, message: `${moduleId} depends on nothing.` };
+  }
+
+  // The chain is printed as a path rather than as more rows, because that is the
+  // whole claim: these providers are ordered, and a list of them is not.
+  const chainLines = result.chains.map(
+    (chain) => `${chain.capability}: ${chain.moduleIds.join(' -> ')}`,
+  );
+
+  return {
+    success: true,
+    message: [
+      ...result.nodes.map(
+        (n) =>
+          `hop ${n.hop}  ${n.moduleId.padEnd(24)} ${n.optional ? '(optional)' : '          '} via ${n.via.join(', ')}`,
+      ),
+      ...(chainLines.length > 0 ? ['', 'delegates upstream:', ...chainLines] : []),
+    ].join('\n'),
+  };
+}
+
+/** Depth flag, or an Error explaining what was wrong with it. */
+function parseDepth(raw: string | boolean | undefined): number | Error {
+  if (raw === undefined || raw === true) return DEFAULT_CLOSURE_DEPTH;
+  const parsed = Number(raw);
+  if (!Number.isInteger(parsed) || parsed < 0) {
+    return new Error(
+      `Invalid --depth: ${raw}\n\nExpected a non-negative integer (${UNBOUNDED_CLOSURE_DEPTH} walks the whole graph).`,
+    );
+  }
+  return parsed;
+}

package/src/cli/commands/module-list.ts

@@ -1,8 +1,6 @@
-import { eq } from 'drizzle-orm';
-import { type DbClient, getDb } from '../../db/client';
-import { modules, modules as modulesTable, monitors } from '../../db/schema';
-import { moduleHealthCell } from '../../services/alerting/format';
-import { loadAllLiveAlerts, summariseByModule } from '../../services/alerting/store';
+import { getDb } from '../../db/client';
+import { modules } from '../../db/schema';
+import { loadObservedHealth } from '../../services/alerting/observed-health';
 import { formatPausedDuration } from '../../services/module-pause';
 import { hasFlag } from '../parser';
 import type { CommandResult } from '../types';
@@ -77,39 +75,3 @@ export async function handleModuleList(
     data: moduleRows,
   };
 }
-
-/**
- * Observed health per module: `ok`, `N firing`, `suppressed`, or
- * `not observed`.
- *
- * Only computed for DEPLOYED modules — a module still being imported has
- * nothing to observe, and reporting it as unwatched would be noise rather
- * than a finding.
- */
-function loadObservedHealth(db: DbClient): Map<string, string> {
-  const monitored = new Set(
-    db
-      .select({ target: monitors.target })
-      .from(monitors)
-      .where(eq(monitors.enabled, true))
-      .all()
-      .map((m) => m.target),
-  );
-  const byModule = summariseByModule(loadAllLiveAlerts(db));
-
-  const result = new Map<string, string>();
-  for (const module of db.select().from(modulesTable).all()) {
-    if (module.state !== 'INSTALLED' && module.state !== 'VERIFIED') continue;
-
-    const summary = byModule.get(module.id) ?? [];
-    result.set(
-      module.id,
-      moduleHealthCell({
-        monitored: monitored.has(module.id),
-        firingCount: summary.filter((s) => !s.suppressed).length,
-        suppressed: summary.length > 0 && summary.every((s) => s.suppressed),
-      }),
-    );
-  }
-  return result;
-}

package/src/cli/commands/notify-config.test.ts

@@ -0,0 +1,79 @@
+/**
+ * `celilo person list --json` — the shape the web console maps an identity
+ * against.
+ *
+ * Worth its own test for a reason that is not obvious from the three lines it
+ * covers. The console server decides whether an authenticated browser subject
+ * corresponds to a real person, and it decides it by reading THIS. Its own
+ * tests answer that question against a fake celilo, so they prove the console
+ * parses what it was told to expect and say nothing about what celilo emits.
+ * This is the end that closes.
+ *
+ * If the payload ever stops being `[{ name, timezone }]`, the console does not
+ * error: it maps nobody, draws no acknowledge control, and reports every
+ * operator as unknown to the fleet. That reads as a configuration problem for
+ * as long as anyone is willing to believe it.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { closeDb, getDb } from '../../db/client';
+import { createPerson } from '../../services/alerting/people';
+import { setupTestDatabaseAt } from '../../test-utils/database';
+import { handlePerson } from './notify-config';
+
+let dir: string;
+const previousDbPath = process.env.CELILO_DB_PATH;
+
+beforeEach(async () => {
+  dir = mkdtempSync(join(tmpdir(), 'celilo-person-'));
+  const dbPath = join(dir, 'test.db');
+  const db = await setupTestDatabaseAt(dbPath);
+  createPerson(db, { name: 'peter', timezone: 'America/Los_Angeles' });
+  createPerson(db, { name: 'ada', timezone: 'Europe/London' });
+  db.$client.close();
+  process.env.CELILO_DB_PATH = dbPath;
+});
+
+afterEach(() => {
+  closeDb();
+  if (previousDbPath === undefined) delete process.env.CELILO_DB_PATH;
+  else process.env.CELILO_DB_PATH = previousDbPath;
+  rmSync(dir, { recursive: true, force: true });
+});
+
+/** Run `person list`, insisting it succeeded before reading what it said. */
+async function personList(flags: Record<string, boolean | string>): Promise<string> {
+  const result = await handlePerson('list', [], flags);
+  if (!result.success) throw new Error(`person list failed: ${result.error}`);
+  return result.message;
+}
+
+async function listJson(): Promise<{ name: string; timezone: string }[]> {
+  return JSON.parse(await personList({ json: true }));
+}
+
+describe('celilo person list --json', () => {
+  test('names every person, sorted the way listPeople sorts them', async () => {
+    expect((await listJson()).map((p) => p.name)).toEqual(['ada', 'peter']);
+  });
+
+  test('carries the timezone, which is the only other thing a person IS', async () => {
+    const ada = (await listJson()).find((p) => p.name === 'ada');
+    expect(ada?.timezone).toBe('Europe/London');
+  });
+
+  test('an empty fleet is an empty array, not a sentence about it', async () => {
+    // The human listing prints "Nobody configured." and a hint. A caller that
+    // parsed that would throw, which is a better failure than the one this
+    // avoids — but the console polls this, so it gets JSON either way.
+    getDb().$client.run('DELETE FROM people');
+    expect(await listJson()).toEqual([]);
+  });
+
+  test('without --json it stays the human table, and says how many', async () => {
+    expect(await personList({})).toContain('2 person');
+  });
+});

package/src/cli/commands/notify-config.ts

@@ -33,6 +33,7 @@ import {
   listRoutes,
 } from '../../services/alerting/people';
 import { parseClockTime } from '../../services/alerting/quiet-hours';
+import { hasFlag } from '../parser';
 import type { CommandResult } from '../types';
 
 const NO_SCHEMAS = defineEvents({});
@@ -109,8 +110,18 @@ function personAdd(args: string[], flags: Record<string, boolean | string>): Com
   return { success: true, message: `Added ${name} (${timezone}${quietNote})` };
 }
 
-function personList(): CommandResult {
+function personList(flags: Record<string, boolean | string> = {}): CommandResult {
   const people = listPeople(getDb());
+
+  // The web console's subject-to-person mapping reads this. It never invents a
+  // person and never lets celilo fall back to `people[0]`, so it has to be able
+  // to ASK who exists. `person:list` is already in the read-only grant set, so
+  // the flag adds a shape rather than an authority.
+  if (hasFlag(flags, 'json')) {
+    const payload = people.map((p) => ({ name: p.name, timezone: p.timezone }));
+    return { success: true, message: JSON.stringify(payload), rawOutput: true, data: payload };
+  }
+
   if (people.length === 0) {
     console.log('\nNobody configured.\n');
     console.log(
@@ -158,7 +169,7 @@ export async function handlePerson(
   switch (subcommand) {
     case undefined:
     case 'list':
-      return personList();
+      return personList(flags);
     case 'add':
       return personAdd(args, flags);
     case 'remove':

package/src/cli/commands/system-ensure-fleet-key.ts

@@ -0,0 +1,52 @@
+/**
+ * `celilo system ensure-fleet-key` — mint celilo's fleet SSH keypair if it
+ * is absent, record its public half, and print it.
+ *
+ * The celilo-side half of "minting the fleet key is not the module's job"
+ * (openspec/changes/hook-process-boundary, design D9b). celilo-mgmt's
+ * `on_install` used to generate the keypair itself, writing into celilo's
+ * data directory from inside a hook — the one directory the hook jail
+ * exists to keep out of the mount set. The hook now asks for the key
+ * through this command and receives the public half, rather than producing
+ * it.
+ *
+ * Idempotent: an existing key is reused. Re-keying would strand every
+ * machine whose authorized_keys holds the old public half.
+ */
+
+import { getDb } from '../../db/client';
+import { ensureFleetKey, getFleetSshDir } from '../../services/fleet-key';
+import { initializeSystem } from '../../services/system-init';
+import type { CommandResult } from '../types';
+
+export async function handleSystemEnsureFleetKey(): Promise<CommandResult> {
+  let key: ReturnType<typeof ensureFleetKey>;
+  try {
+    key = ensureFleetKey();
+  } catch (err) {
+    return {
+      success: false,
+      error: `Could not create the fleet SSH key in ${getFleetSshDir()}: ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    };
+  }
+
+  try {
+    initializeSystem(getDb(), { 'ssh.public_key': key.publicKey });
+  } catch (err) {
+    return {
+      success: false,
+      error: `Fleet key is on disk but recording ssh.public_key failed: ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    };
+  }
+
+  // The public key alone, and `rawOutput` to say so on the record: this
+  // command exists to be read by celilo-mgmt's on_install as much as by an
+  // operator, and the key IS the answer either way (an operator pastes it into
+  // a machine's authorized_keys). Wrapping it in prose would make the caller
+  // parse for it, which is how a hook ends up depending on a sentence.
+  return { success: true, message: key.publicKey, rawOutput: true };
+}

package/src/cli/completion.ts

@@ -37,6 +37,7 @@ export async function getCompletions(words: string[], current: number): Promise<
       'backup',
       'capability',
       'commands',
+      'console',
       'dns',
       'completion',
       'alerts',
@@ -658,6 +659,10 @@ export async function getCompletions(words: string[], current: number): Promise<
   }
 
   // Completion subcommands
+  if (command === 'console' && currentIndex === 1) {
+    return filterSuggestions(['status', 'get'], args[1] || '');
+  }
+
   if (command === 'completion' && currentIndex === 1) {
     const subcommands = ['bash', 'zsh'];
     return filterSuggestions(subcommands, args[1] || '');
@@ -669,6 +674,7 @@ export async function getCompletions(words: string[], current: number): Promise<
       'init',
       'apply-config',
       'discover-network',
+      'ensure-fleet-key',
       'config',
       'secret',
       'vault-password',