clonebox 1.1.13__py3-none-any.whl → 1.1.15__py3-none-any.whl

clonebox/cli.py

@@ -34,6 +34,10 @@ from clonebox.monitor import ResourceMonitor, format_bytes
 from clonebox.p2p import P2PManager
 from clonebox.snapshots import SnapshotManager, SnapshotType
 from clonebox.health import HealthCheckManager, ProbeConfig, ProbeType
+from clonebox.audit import get_audit_logger, AuditQuery, AuditEventType, AuditOutcome
+from clonebox.orchestrator import Orchestrator, OrchestrationResult
+from clonebox.plugins import get_plugin_manager, PluginHook, PluginContext
+from clonebox.remote import RemoteCloner, RemoteConnection
 
 # Custom questionary style
 custom_style = Style(
@@ -458,6 +462,9 @@ def run_vm_diagnostics(
         if health_status and "HEALTH_STATUS=OK" in health_status:
             result["health"]["status"] = "ok"
             console.print("[green]✅ Health: All checks passed[/]")
+        elif health_status and "HEALTH_STATUS=PENDING" in health_status:
+            result["health"]["status"] = "pending"
+            console.print("[yellow]⏳ Health: Setup in progress[/]")
         elif health_status and "HEALTH_STATUS=FAILED" in health_status:
             result["health"]["status"] = "failed"
             console.print("[red]❌ Health: Some checks failed[/]")
@@ -595,6 +602,78 @@ def cmd_repair(args):
         )
 
 
+def cmd_logs(args):
+    """View logs from VM."""
+    import subprocess
+    import sys
+    
+    name = args.name
+    user_session = getattr(args, "user", False)
+    show_all = getattr(args, "all", False)
+    
+    try:
+        vm_name, _ = _resolve_vm_name_and_config_file(name)
+    except FileNotFoundError as e:
+        console.print(f"[red]❌ {e}[/]")
+        return
+    
+    # Path to the logs script
+    script_dir = Path(__file__).parent.parent.parent / "scripts"
+    logs_script = script_dir / "clonebox-logs.sh"
+    
+    if not logs_script.exists():
+        console.print(f"[red]❌ Logs script not found: {logs_script}[/]")
+        return
+    
+    # Run the logs script
+    try:
+        console.print(f"[cyan]📋 Opening logs for VM: {vm_name}[/]")
+        subprocess.run(
+            [str(logs_script), vm_name, "true" if user_session else "false", "true" if show_all else "false"],
+            check=True
+        )
+    except subprocess.CalledProcessError as e:
+        console.print(f"[red]❌ Failed to view logs: {e}[/]")
+        sys.exit(1)
+    except KeyboardInterrupt:
+        console.print("\n[yellow]Interrupted.[/]")
+
+
+def cmd_set_password(args):
+    """Set password for VM user."""
+    import subprocess
+    import sys
+    
+    name = args.name
+    user_session = getattr(args, "user", False)
+    
+    try:
+        vm_name, _ = _resolve_vm_name_and_config_file(name)
+    except FileNotFoundError as e:
+        console.print(f"[red]❌ {e}[/]")
+        return
+    
+    # Path to the set-password script
+    script_dir = Path(__file__).parent.parent.parent / "scripts"
+    set_password_script = script_dir / "set-vm-password.sh"
+    
+    if not set_password_script.exists():
+        console.print(f"[red]❌ Set password script not found: {set_password_script}[/]")
+        return
+    
+    # Run the set-password script interactively
+    try:
+        console.print(f"[cyan]🔐 Setting password for VM: {vm_name}[/]")
+        subprocess.run(
+            [str(set_password_script), vm_name, "true" if user_session else "false"]
+        )
+    except subprocess.CalledProcessError as e:
+        console.print(f"[red]❌ Failed to set password: {e}[/]")
+        sys.exit(1)
+    except KeyboardInterrupt:
+        console.print("\n[yellow]Interrupted.[/]")
+
+
 def interactive_mode():
     """Run the interactive VM creation wizard."""
     print_banner()
@@ -1800,6 +1879,8 @@ def cmd_test(args):
     console.print()
 
     # Test 3: Check cloud-init status (if running)
+    cloud_init_complete: Optional[bool] = None
+    cloud_init_running: bool = False
     if not quick and state == "running":
         console.print("[bold]3. Cloud-init Status[/]")
         try:
@@ -1809,16 +1890,23 @@ def cmd_test(args):
                 status = _qga_exec(vm_name, conn_uri, "cloud-init status 2>/dev/null || true", timeout=15)
                 if status is None:
                     console.print("[yellow]⚠️  Could not check cloud-init (QGA command failed)[/]")
+                    cloud_init_complete = None
                 elif "done" in status.lower():
                     console.print("[green]✅ Cloud-init completed[/]")
+                    cloud_init_complete = True
                 elif "running" in status.lower():
                     console.print("[yellow]⚠️  Cloud-init still running[/]")
+                    cloud_init_complete = False
+                    cloud_init_running = True
                 elif status.strip():
                     console.print(f"[yellow]⚠️  Cloud-init status: {status.strip()}[/]")
+                    cloud_init_complete = None
                 else:
                     console.print("[yellow]⚠️  Cloud-init status: unknown[/]")
+                    cloud_init_complete = None
         except Exception:
             console.print("[yellow]⚠️  Could not check cloud-init (QEMU agent may not be running)[/]")
+            cloud_init_complete = None
 
     console.print()
 
@@ -1877,17 +1965,33 @@ def cmd_test(args):
                     timeout=10,
                 )
                 if exists and exists.strip() == "yes":
-                    out = _qga_exec(
+                    _qga_exec(
                         vm_name,
                         conn_uri,
-                        "/usr/local/bin/clonebox-health >/dev/null 2>&1 && echo yes || echo no",
+                        "/usr/local/bin/clonebox-health >/dev/null 2>&1 || true",
                         timeout=60,
                     )
-                    if out and out.strip() == "yes":
-                        console.print("[green]✅ Health check ran successfully[/]")
+                    health_status = _qga_exec(
+                        vm_name,
+                        conn_uri,
+                        "cat /var/log/clonebox-health-status 2>/dev/null || true",
+                        timeout=10,
+                    )
+                    if health_status and "HEALTH_STATUS=OK" in health_status:
+                        console.print("[green]✅ Health check passed[/]")
                         console.print("   View results in VM: cat /var/log/clonebox-health.log")
+                    elif health_status and "HEALTH_STATUS=PENDING" in health_status:
+                        console.print("[yellow]⚠️  Health check pending (setup in progress)[/]")
+                        if cloud_init_running:
+                            console.print("   Cloud-init is still running; re-check after it completes")
+                        console.print("   View logs in VM: cat /var/log/clonebox-health.log")
+                    elif health_status and "HEALTH_STATUS=FAILED" in health_status:
+                        console.print("[yellow]⚠️  Health check reports failures[/]")
+                        if cloud_init_running:
+                            console.print("   Cloud-init is still running; some failures may be transient")
+                        console.print("   View logs in VM: cat /var/log/clonebox-health.log")
                     else:
-                        console.print("[yellow]⚠️  Health check did not report success[/]")
+                        console.print("[yellow]⚠️  Health check status not available yet[/]")
                         console.print("   View logs in VM: cat /var/log/clonebox-health.log")
                 else:
                     console.print("[yellow]⚠️  Health check script not found[/]")
@@ -1941,7 +2045,7 @@ def load_env_file(env_path: Path) -> dict:
                 continue
             if "=" in line:
                 key, value = line.split("=", 1)
-                env_vars[key.strip()] = value.strip()
+                env_vars[key.strip()] = value.strip().strip("'\"")
 
     return env_vars
 
@@ -1962,6 +2066,22 @@ def expand_env_vars(value, env_vars: dict):
     return value
 
 
+def _find_unexpanded_env_placeholders(value) -> set:
+    if isinstance(value, str):
+        return set(re.findall(r"\$\{([^}]+)\}", value))
+    if isinstance(value, dict):
+        found = set()
+        for v in value.values():
+            found |= _find_unexpanded_env_placeholders(v)
+        return found
+    if isinstance(value, list):
+        found = set()
+        for item in value:
+            found |= _find_unexpanded_env_placeholders(item)
+        return found
+    return set()
+
+
 def deduplicate_list(items: list, key=None) -> list:
     """Remove duplicates from list, preserving order."""
     seen = set()
@@ -2218,6 +2338,14 @@ def load_clonebox_config(path: Path) -> dict:
     # Expand environment variables in config
     config = expand_env_vars(config, env_vars)
 
+    unresolved = _find_unexpanded_env_placeholders(config)
+    if unresolved:
+        unresolved_sorted = ", ".join(sorted(unresolved))
+        raise ValueError(
+            f"Unresolved environment variables in config: {unresolved_sorted}. "
+            f"Set them in {env_file} or in the process environment."
+        )
+
     return config
 
 
@@ -2327,9 +2455,32 @@ def create_vm_from_config(
     replace: bool = False,
 ) -> str:
     """Create VM from YAML config dict."""
-    # Merge paths and app_data_paths
-    all_paths = config.get("paths", {}).copy()
-    all_paths.update(config.get("app_data_paths", {}))
+    paths = config.get("paths", {})
+    # Backwards compatible: v1 uses app_data_paths, newer configs may use copy_paths
+    copy_paths = config.get("copy_paths", None)
+    if not isinstance(copy_paths, dict) or not copy_paths:
+        copy_paths = config.get("app_data_paths", {})
+
+    vm_section = config.get("vm") or {}
+    
+    # Support both v1 (auth_method) and v2 (auth.method) config formats
+    auth_section = vm_section.get("auth") or {}
+    auth_method = auth_section.get("method") or vm_section.get("auth_method") or "ssh_key"
+    
+    # v2 config: secrets provider
+    secrets_section = config.get("secrets") or {}
+    secrets_provider = secrets_section.get("provider", "auto")
+    
+    # v2 config: resource limits
+    limits_section = config.get("limits") or {}
+    resources = {
+        "memory_limit": limits_section.get("memory_limit"),
+        "cpu_shares": limits_section.get("cpu_shares"),
+        "disk_limit": limits_section.get("disk_limit"),
+        "network_limit": limits_section.get("network_limit"),
+    }
+    # Remove None values
+    resources = {k: v for k, v in resources.items() if v is not None}
 
     vm_config = VMConfig(
         name=config["vm"]["name"],
@@ -2338,7 +2489,8 @@ def create_vm_from_config(
         disk_size_gb=config["vm"].get("disk_size_gb", 10),
         gui=config["vm"].get("gui", True),
         base_image=config["vm"].get("base_image"),
-        paths=all_paths,
+        paths=paths,
+        copy_paths=copy_paths,
         packages=config.get("packages", []),
         snap_packages=config.get("snap_packages", []),
         services=config.get("services", []),
@@ -2347,6 +2499,9 @@ def create_vm_from_config(
         network_mode=config["vm"].get("network_mode", "auto"),
         username=config["vm"].get("username", "ubuntu"),
         password=config["vm"].get("password", "ubuntu"),
+        auth_method=auth_method,
+        ssh_public_key=vm_section.get("ssh_public_key") or auth_section.get("ssh_public_key"),
+        resources=resources if resources else config["vm"].get("resources", {}),
     )
 
     cloner = SelectiveVMCloner(user_session=user_session)
@@ -3098,6 +3253,634 @@ def cmd_list_remote(args) -> None:
         console.print("[yellow]No VMs found on remote host.[/]")
 
 
+# === Audit Commands ===
+
+
+def cmd_audit_list(args) -> None:
+    """List audit events."""
+    query = AuditQuery()
+
+    # Build filters
+    event_type = None
+    if hasattr(args, "type") and args.type:
+        try:
+            event_type = AuditEventType(args.type)
+        except ValueError:
+            console.print(f"[red]Unknown event type: {args.type}[/]")
+            return
+
+    outcome = None
+    if hasattr(args, "outcome") and args.outcome:
+        try:
+            outcome = AuditOutcome(args.outcome)
+        except ValueError:
+            console.print(f"[red]Unknown outcome: {args.outcome}[/]")
+            return
+
+    limit = getattr(args, "limit", 50)
+    target = getattr(args, "target", None)
+
+    events = query.query(
+        event_type=event_type,
+        target_name=target,
+        outcome=outcome,
+        limit=limit,
+    )
+
+    if not events:
+        console.print("[yellow]No audit events found.[/]")
+        return
+
+    if getattr(args, "json", False):
+        console.print_json(json.dumps([e.to_dict() for e in events], default=str))
+        return
+
+    table = Table(title="Audit Events", border_style="cyan")
+    table.add_column("Time", style="dim")
+    table.add_column("Event")
+    table.add_column("Target")
+    table.add_column("Outcome")
+    table.add_column("User")
+
+    for event in reversed(events[-limit:]):
+        outcome_style = {
+            "success": "green",
+            "failure": "red",
+            "partial": "yellow",
+            "denied": "red bold",
+            "skipped": "dim",
+        }.get(event.outcome.value, "white")
+
+        target_str = event.target_name or "-"
+        table.add_row(
+            event.timestamp.strftime("%Y-%m-%d %H:%M:%S"),
+            event.event_type.value,
+            target_str,
+            f"[{outcome_style}]{event.outcome.value}[/]",
+            event.user,
+        )
+
+    console.print(table)
+
+
+def cmd_audit_show(args) -> None:
+    """Show audit event details."""
+    query = AuditQuery()
+    events = query.query(limit=1000)
+
+    for event in events:
+        if event.event_id == args.event_id:
+            console.print_json(json.dumps(event.to_dict(), indent=2, default=str))
+            return
+
+    console.print(f"[red]Event not found: {args.event_id}[/]")
+
+
+def cmd_audit_failures(args) -> None:
+    """Show recent failures."""
+    query = AuditQuery()
+    events = query.get_failures(limit=getattr(args, "limit", 20))
+
+    if not events:
+        console.print("[green]No failures recorded.[/]")
+        return
+
+    table = Table(title="Recent Failures", border_style="red")
+    table.add_column("Time", style="dim")
+    table.add_column("Event")
+    table.add_column("Target")
+    table.add_column("Error")
+
+    for event in reversed(events):
+        table.add_row(
+            event.timestamp.strftime("%Y-%m-%d %H:%M:%S"),
+            event.event_type.value,
+            event.target_name or "-",
+            (event.error_message or "-")[:50],
+        )
+
+    console.print(table)
+
+
+def cmd_audit_search(args) -> None:
+    """Search audit events."""
+    from datetime import datetime, timedelta
+
+    query = AuditQuery()
+
+    # Parse event type
+    event_type = None
+    if hasattr(args, "event") and args.event:
+        try:
+            event_type = AuditEventType(args.event)
+        except ValueError:
+            console.print(f"[red]Unknown event type: {args.event}[/]")
+            return
+
+    # Parse time range
+    start_time = None
+    if hasattr(args, "since") and args.since:
+        since = args.since.lower()
+        now = datetime.now()
+        if "hour" in since:
+            hours = int(since.split()[0]) if since[0].isdigit() else 1
+            start_time = now - timedelta(hours=hours)
+        elif "day" in since:
+            days = int(since.split()[0]) if since[0].isdigit() else 1
+            start_time = now - timedelta(days=days)
+        elif "week" in since:
+            weeks = int(since.split()[0]) if since[0].isdigit() else 1
+            start_time = now - timedelta(weeks=weeks)
+
+    user = getattr(args, "user_filter", None)
+    target = getattr(args, "target", None)
+    limit = getattr(args, "limit", 100)
+
+    events = query.query(
+        event_type=event_type,
+        target_name=target,
+        user=user,
+        start_time=start_time,
+        limit=limit,
+    )
+
+    if not events:
+        console.print("[yellow]No matching audit events found.[/]")
+        return
+
+    console.print(f"[bold]Found {len(events)} events:[/]")
+
+    for event in events:
+        outcome_color = "green" if event.outcome.value == "success" else "red"
+        console.print(
+            f"  [{outcome_color}]{event.outcome.value}[/] "
+            f"{event.timestamp.strftime('%Y-%m-%d %H:%M')} "
+            f"[cyan]{event.event_type.value}[/] "
+            f"{event.target_name or '-'}"
+        )
+
+
+def cmd_audit_export(args) -> None:
+    """Export audit events to file."""
+    query = AuditQuery()
+    events = query.query(limit=getattr(args, "limit", 10000))
+
+    if not events:
+        console.print("[yellow]No audit events to export.[/]")
+        return
+
+    output_format = getattr(args, "format", "json")
+    output_file = getattr(args, "output", None)
+
+    if output_format == "json":
+        data = [e.to_dict() for e in events]
+        content = json.dumps(data, indent=2, default=str)
+    else:
+        # CSV format
+        import csv
+        import io
+        output = io.StringIO()
+        writer = csv.writer(output)
+        writer.writerow(["timestamp", "event_type", "outcome", "target", "user", "error"])
+        for e in events:
+            writer.writerow([
+                e.timestamp.isoformat(),
+                e.event_type.value,
+                e.outcome.value,
+                e.target_name or "",
+                e.user,
+                e.error_message or "",
+            ])
+        content = output.getvalue()
+
+    if output_file:
+        Path(output_file).write_text(content)
+        console.print(f"[green]✅ Exported {len(events)} events to {output_file}[/]")
+    else:
+        console.print(content)
+
+
+# === Orchestration Commands ===
+
+
+def cmd_compose_up(args) -> None:
+    """Start VMs from compose file."""
+    compose_file = Path(args.file) if hasattr(args, "file") and args.file else Path("clonebox-compose.yaml")
+
+    if not compose_file.exists():
+        console.print(f"[red]Compose file not found: {compose_file}[/]")
+        return
+
+    user_session = getattr(args, "user", False)
+    services = args.services if hasattr(args, "services") and args.services else None
+
+    console.print(f"[cyan]🚀 Starting VMs from: {compose_file}[/]")
+
+    try:
+        orch = Orchestrator.from_file(compose_file, user_session=user_session)
+        result = orch.up(services=services, console=console)
+
+        if result.success:
+            console.print("[green]✅ All VMs started successfully[/]")
+        else:
+            console.print("[yellow]⚠️ Some VMs failed to start:[/]")
+            for name, error in result.errors.items():
+                console.print(f"  [red]{name}:[/] {error}")
+
+        console.print(f"[dim]Duration: {result.duration_seconds:.1f}s[/]")
+
+    except Exception as e:
+        console.print(f"[red]❌ Orchestration failed: {e}[/]")
+
+
+def cmd_compose_down(args) -> None:
+    """Stop VMs from compose file."""
+    compose_file = Path(args.file) if hasattr(args, "file") and args.file else Path("clonebox-compose.yaml")
+
+    if not compose_file.exists():
+        console.print(f"[red]Compose file not found: {compose_file}[/]")
+        return
+
+    user_session = getattr(args, "user", False)
+    services = args.services if hasattr(args, "services") and args.services else None
+    force = getattr(args, "force", False)
+
+    console.print(f"[cyan]🛑 Stopping VMs from: {compose_file}[/]")
+
+    try:
+        orch = Orchestrator.from_file(compose_file, user_session=user_session)
+        result = orch.down(services=services, force=force, console=console)
+
+        if result.success:
+            console.print("[green]✅ All VMs stopped successfully[/]")
+        else:
+            console.print("[yellow]⚠️ Some VMs failed to stop:[/]")
+            for name, error in result.errors.items():
+                console.print(f"  [red]{name}:[/] {error}")
+
+    except Exception as e:
+        console.print(f"[red]❌ Stop failed: {e}[/]")
+
+
+def cmd_compose_status(args) -> None:
+    """Show status of VMs from compose file."""
+    compose_file = Path(args.file) if hasattr(args, "file") and args.file else Path("clonebox-compose.yaml")
+
+    if not compose_file.exists():
+        console.print(f"[red]Compose file not found: {compose_file}[/]")
+        return
+
+    user_session = getattr(args, "user", False)
+
+    try:
+        orch = Orchestrator.from_file(compose_file, user_session=user_session)
+        status = orch.status()
+
+        if getattr(args, "json", False):
+            console.print_json(json.dumps(status, default=str))
+            return
+
+        table = Table(title=f"Compose Status: {compose_file.name}", border_style="cyan")
+        table.add_column("VM")
+        table.add_column("State")
+        table.add_column("Actual")
+        table.add_column("Health")
+        table.add_column("Depends On")
+
+        for name, info in status.items():
+            state = info["orchestration_state"]
+            actual = info["actual_state"]
+            health = "✅" if info["health_check_passed"] else "⏳"
+            deps = ", ".join(info["depends_on"]) or "-"
+
+            state_style = {
+                "running": "green",
+                "healthy": "green bold",
+                "stopped": "dim",
+                "failed": "red",
+                "pending": "yellow",
+            }.get(state, "white")
+
+            table.add_row(
+                name,
+                f"[{state_style}]{state}[/]",
+                actual,
+                health,
+                deps,
+            )
+
+        console.print(table)
+
+    except Exception as e:
+        console.print(f"[red]❌ Failed to get status: {e}[/]")
+
+
+def cmd_compose_logs(args) -> None:
+    """Show aggregated logs from VMs."""
+    compose_file = Path(args.file) if hasattr(args, "file") and args.file else Path("clonebox-compose.yaml")
+
+    if not compose_file.exists():
+        console.print(f"[red]Compose file not found: {compose_file}[/]")
+        return
+
+    user_session = getattr(args, "user", False)
+    follow = getattr(args, "follow", False)
+    lines = getattr(args, "lines", 50)
+    service = getattr(args, "service", None)
+
+    try:
+        orch = Orchestrator.from_file(compose_file, user_session=user_session)
+
+        if service:
+            # Logs for specific service
+            logs = orch.logs(service, follow=follow, lines=lines)
+            if logs:
+                console.print(f"[bold]Logs for {service}:[/]")
+                console.print(logs)
+            else:
+                console.print(f"[yellow]No logs available for {service}[/]")
+        else:
+            # Logs for all services
+            for name in orch.plan.vms.keys():
+                logs = orch.logs(name, follow=False, lines=lines)
+                if logs:
+                    console.print(f"\n[bold cyan]━━━ {name} ━━━[/]")
+                    console.print(logs)
+
+    except Exception as e:
+        console.print(f"[red]❌ Failed to get logs: {e}[/]")
+
+
+# === Plugin Commands ===
+
+
+def cmd_plugin_list(args) -> None:
+    """List installed plugins."""
+    manager = get_plugin_manager()
+
+    # Load plugins if not already loaded
+    if not manager.list_plugins():
+        manager.load_all()
+
+    plugins = manager.list_plugins()
+
+    if not plugins:
+        console.print("[yellow]No plugins installed.[/]")
+        console.print("[dim]Plugin directories:[/]")
+        for d in manager.plugin_dirs:
+            console.print(f"  {d}")
+        return
+
+    table = Table(title="Installed Plugins", border_style="cyan")
+    table.add_column("Name")
+    table.add_column("Version")
+    table.add_column("Enabled")
+    table.add_column("Description")
+
+    for plugin in plugins:
+        enabled = "[green]✅[/]" if plugin["enabled"] else "[red]❌[/]"
+        table.add_row(
+            plugin["name"],
+            plugin["version"],
+            enabled,
+            (plugin.get("description", "") or "")[:40],
+        )
+
+    console.print(table)
+
+
+def cmd_plugin_enable(args) -> None:
+    """Enable a plugin."""
+    manager = get_plugin_manager()
+    manager.load_all()
+
+    if manager.enable(args.name):
+        console.print(f"[green]✅ Plugin '{args.name}' enabled[/]")
+    else:
+        console.print(f"[red]Plugin '{args.name}' not found[/]")
+
+
+def cmd_plugin_disable(args) -> None:
+    """Disable a plugin."""
+    manager = get_plugin_manager()
+    manager.load_all()
+
+    if manager.disable(args.name):
+        console.print(f"[yellow]⚠️ Plugin '{args.name}' disabled[/]")
+    else:
+        console.print(f"[red]Plugin '{args.name}' not found[/]")
+
+
+def cmd_plugin_discover(args) -> None:
+    """Discover available plugins."""
+    manager = get_plugin_manager()
+    discovered = manager.discover()
+
+    if not discovered:
+        console.print("[yellow]No plugins discovered.[/]")
+        console.print("[dim]Plugin directories:[/]")
+        for d in manager.plugin_dirs:
+            console.print(f"  {d}")
+        return
+
+    console.print("[bold]Discovered plugins:[/]")
+    for name in discovered:
+        console.print(f"  • {name}")
+
+
+def cmd_plugin_install(args) -> None:
+    """Install a plugin."""
+    manager = get_plugin_manager()
+    source = args.source
+
+    console.print(f"[cyan]📦 Installing plugin from: {source}[/]")
+
+    if manager.install(source):
+        console.print("[green]✅ Plugin installed successfully[/]")
+        console.print("[dim]Run 'clonebox plugin discover' to see available plugins[/]")
+    else:
+        console.print(f"[red]❌ Failed to install plugin from: {source}[/]")
+
+
+def cmd_plugin_uninstall(args) -> None:
+    """Uninstall a plugin."""
+    manager = get_plugin_manager()
+    name = args.name
+
+    console.print(f"[cyan]🗑️  Uninstalling plugin: {name}[/]")
+
+    if manager.uninstall(name):
+        console.print(f"[green]✅ Plugin '{name}' uninstalled successfully[/]")
+    else:
+        console.print(f"[red]❌ Failed to uninstall plugin: {name}[/]")
+
+
+# === Remote Management Commands ===
+
+
+def cmd_remote_list(args) -> None:
+    """List VMs on remote host."""
+    host = args.host
+    user_session = getattr(args, "user", False)
+
+    console.print(f"[cyan]🔍 Connecting to: {host}[/]")
+
+    try:
+        remote = RemoteCloner(host, verify=True)
+
+        if not remote.is_clonebox_installed():
+            console.print("[red]❌ CloneBox is not installed on remote host[/]")
+            return
+
+        vms = remote.list_vms(user_session=user_session)
+
+        if not vms:
+            console.print("[yellow]No VMs found on remote host.[/]")
+            return
+
+        table = Table(title=f"VMs on {host}", border_style="cyan")
+        table.add_column("Name")
+        table.add_column("Status")
+
+        for vm in vms:
+            name = vm.get("name", str(vm))
+            status = vm.get("state", vm.get("status", "-"))
+            table.add_row(name, status)
+
+        console.print(table)
+
+    except ConnectionError as e:
+        console.print(f"[red]❌ Connection failed: {e}[/]")
+    except Exception as e:
+        console.print(f"[red]❌ Error: {e}[/]")
+
+
+def cmd_remote_status(args) -> None:
+    """Get VM status on remote host."""
+    host = args.host
+    vm_name = args.vm_name
+    user_session = getattr(args, "user", False)
+
+    console.print(f"[cyan]🔍 Getting status of {vm_name} on {host}[/]")
+
+    try:
+        remote = RemoteCloner(host, verify=True)
+        status = remote.get_status(vm_name, user_session=user_session)
+
+        if getattr(args, "json", False):
+            console.print_json(json.dumps(status, default=str))
+        else:
+            for key, value in status.items():
+                console.print(f"  [bold]{key}:[/] {value}")
+
+    except Exception as e:
+        console.print(f"[red]❌ Error: {e}[/]")
+
+
+def cmd_remote_start(args) -> None:
+    """Start VM on remote host."""
+    host = args.host
+    vm_name = args.vm_name
+    user_session = getattr(args, "user", False)
+
+    console.print(f"[cyan]🚀 Starting {vm_name} on {host}[/]")
+
+    try:
+        remote = RemoteCloner(host, verify=True)
+        remote.start_vm(vm_name, user_session=user_session)
+        console.print(f"[green]✅ VM {vm_name} started[/]")
+
+    except Exception as e:
+        console.print(f"[red]❌ Error: {e}[/]")
+
+
+def cmd_remote_stop(args) -> None:
+    """Stop VM on remote host."""
+    host = args.host
+    vm_name = args.vm_name
+    user_session = getattr(args, "user", False)
+    force = getattr(args, "force", False)
+
+    console.print(f"[cyan]🛑 Stopping {vm_name} on {host}[/]")
+
+    try:
+        remote = RemoteCloner(host, verify=True)
+        remote.stop_vm(vm_name, force=force, user_session=user_session)
+        console.print(f"[green]✅ VM {vm_name} stopped[/]")
+
+    except Exception as e:
+        console.print(f"[red]❌ Error: {e}[/]")
+
+
+def cmd_remote_delete(args) -> None:
+    """Delete VM on remote host."""
+    host = args.host
+    vm_name = args.vm_name
+    user_session = getattr(args, "user", False)
+    keep_storage = getattr(args, "keep_storage", False)
+
+    if not getattr(args, "yes", False):
+        confirm = questionary.confirm(
+            f"Delete VM '{vm_name}' on {host}?",
+            default=False,
+            style=custom_style,
+        ).ask()
+        if not confirm:
+            console.print("[yellow]Aborted.[/]")
+            return
+
+    console.print(f"[cyan]🗑️ Deleting {vm_name} on {host}[/]")
+
+    try:
+        remote = RemoteCloner(host, verify=True)
+        remote.delete_vm(vm_name, keep_storage=keep_storage, user_session=user_session)
+        console.print(f"[green]✅ VM {vm_name} deleted[/]")
+
+    except Exception as e:
+        console.print(f"[red]❌ Error: {e}[/]")
+
+
+def cmd_remote_exec(args) -> None:
+    """Execute command in VM on remote host."""
+    host = args.host
+    vm_name = args.vm_name
+    command = " ".join(args.command) if args.command else "echo ok"
+    user_session = getattr(args, "user", False)
+    timeout = getattr(args, "timeout", 30)
+
+    try:
+        remote = RemoteCloner(host, verify=True)
+        output = remote.exec_in_vm(vm_name, command, timeout=timeout, user_session=user_session)
+        console.print(output)
+
+    except Exception as e:
+        console.print(f"[red]❌ Error: {e}[/]")
+
+
+def cmd_remote_health(args) -> None:
+    """Run health check on remote VM."""
+    host = args.host
+    vm_name = args.vm_name
+    user_session = getattr(args, "user", False)
+
+    console.print(f"[cyan]🏥 Running health check on {vm_name}@{host}[/]")
+
+    try:
+        remote = RemoteCloner(host, verify=True)
+        result = remote.health_check(vm_name, user_session=user_session)
+
+        if result["success"]:
+            console.print("[green]✅ Health check passed[/]")
+        else:
+            console.print("[red]❌ Health check failed[/]")
+
+        if result.get("output"):
+            console.print(result["output"])
+
+    except Exception as e:
+        console.print(f"[red]❌ Error: {e}[/]")
+
+
 def main():
     """Main entry point."""
     parser = argparse.ArgumentParser(
@@ -3480,6 +4263,37 @@ def main():
     )
     repair_parser.set_defaults(func=cmd_repair)
 
+    # Logs command - view VM logs
+    logs_parser = subparsers.add_parser("logs", help="View logs from VM")
+    logs_parser.add_argument(
+        "name", nargs="?", default=None, help="VM name or '.' to use .clonebox.yaml"
+    )
+    logs_parser.add_argument(
+        "-u",
+        "--user",
+        action="store_true",
+        help="Use user session (qemu:///session)",
+    )
+    logs_parser.add_argument(
+        "--all",
+        action="store_true",
+        help="Show all logs at once without interactive menu",
+    )
+    logs_parser.set_defaults(func=cmd_logs)
+
+    # Set-password command - set password for VM user
+    set_password_parser = subparsers.add_parser("set-password", help="Set password for VM user")
+    set_password_parser.add_argument(
+        "name", nargs="?", default=None, help="VM name or '.' to use .clonebox.yaml"
+    )
+    set_password_parser.add_argument(
+        "-u",
+        "--user",
+        action="store_true",
+        help="Use user session (qemu:///session)",
+    )
+    set_password_parser.set_defaults(func=cmd_set_password)
+
     # Export command - package VM for migration
     export_parser = subparsers.add_parser("export", help="Export VM and data for migration")
     export_parser.add_argument(
@@ -3684,6 +4498,148 @@ def main():
     list_remote_parser.add_argument("host", help="Remote host (user@hostname)")
     list_remote_parser.set_defaults(func=cmd_list_remote)
 
+    # === Audit Commands ===
+    audit_parser = subparsers.add_parser("audit", help="View audit logs")
+    audit_sub = audit_parser.add_subparsers(dest="audit_command", help="Audit commands")
+
+    audit_list = audit_sub.add_parser("list", aliases=["ls"], help="List audit events")
+    audit_list.add_argument("--type", "-t", help="Filter by event type (e.g., vm.create)")
+    audit_list.add_argument("--target", help="Filter by target name")
+    audit_list.add_argument("--outcome", "-o", choices=["success", "failure", "partial"], help="Filter by outcome")
+    audit_list.add_argument("--limit", "-n", type=int, default=50, help="Max events to show")
+    audit_list.add_argument("--json", action="store_true", help="Output as JSON")
+    audit_list.set_defaults(func=cmd_audit_list)
+
+    audit_show = audit_sub.add_parser("show", help="Show audit event details")
+    audit_show.add_argument("event_id", help="Event ID to show")
+    audit_show.set_defaults(func=cmd_audit_show)
+
+    audit_failures = audit_sub.add_parser("failures", help="Show recent failures")
+    audit_failures.add_argument("--limit", "-n", type=int, default=20, help="Max events to show")
+    audit_failures.set_defaults(func=cmd_audit_failures)
+
+    audit_search = audit_sub.add_parser("search", help="Search audit events")
+    audit_search.add_argument("--event", "-e", help="Event type (e.g., vm.create)")
+    audit_search.add_argument("--since", "-s", help="Time range (e.g., '1 hour ago', '7 days')")
+    audit_search.add_argument("--user-filter", help="Filter by user")
+    audit_search.add_argument("--target", help="Filter by target name")
+    audit_search.add_argument("--limit", "-n", type=int, default=100, help="Max events to show")
+    audit_search.set_defaults(func=cmd_audit_search)
+
+    audit_export = audit_sub.add_parser("export", help="Export audit events to file")
+    audit_export.add_argument("--format", "-f", choices=["json", "csv"], default="json", help="Output format")
+    audit_export.add_argument("--output", "-o", help="Output file (stdout if not specified)")
+    audit_export.add_argument("--limit", "-n", type=int, default=10000, help="Max events to export")
+    audit_export.set_defaults(func=cmd_audit_export)
+
+    # === Compose/Orchestration Commands ===
+    compose_parser = subparsers.add_parser("compose", help="Multi-VM orchestration")
+    compose_sub = compose_parser.add_subparsers(dest="compose_command", help="Compose commands")
+
+    compose_up = compose_sub.add_parser("up", help="Start VMs from compose file")
+    compose_up.add_argument("-f", "--file", default="clonebox-compose.yaml", help="Compose file")
+    compose_up.add_argument("-u", "--user", action="store_true", help="Use user session")
+    compose_up.add_argument("services", nargs="*", help="Specific services to start")
+    compose_up.set_defaults(func=cmd_compose_up)
+
+    compose_down = compose_sub.add_parser("down", help="Stop VMs from compose file")
+    compose_down.add_argument("-f", "--file", default="clonebox-compose.yaml", help="Compose file")
+    compose_down.add_argument("-u", "--user", action="store_true", help="Use user session")
+    compose_down.add_argument("--force", action="store_true", help="Force stop")
+    compose_down.add_argument("services", nargs="*", help="Specific services to stop")
+    compose_down.set_defaults(func=cmd_compose_down)
+
+    compose_status = compose_sub.add_parser("status", aliases=["ps"], help="Show compose status")
+    compose_status.add_argument("-f", "--file", default="clonebox-compose.yaml", help="Compose file")
+    compose_status.add_argument("-u", "--user", action="store_true", help="Use user session")
+    compose_status.add_argument("--json", action="store_true", help="Output as JSON")
+    compose_status.set_defaults(func=cmd_compose_status)
+
+    compose_logs = compose_sub.add_parser("logs", help="Show aggregated logs from VMs")
+    compose_logs.add_argument("-f", "--file", default="clonebox-compose.yaml", help="Compose file")
+    compose_logs.add_argument("-u", "--user", action="store_true", help="Use user session")
+    compose_logs.add_argument("--follow", action="store_true", help="Follow log output")
+    compose_logs.add_argument("--lines", "-n", type=int, default=50, help="Number of lines to show")
+    compose_logs.add_argument("service", nargs="?", help="Specific service to show logs for")
+    compose_logs.set_defaults(func=cmd_compose_logs)
+
+    # === Plugin Commands ===
+    plugin_parser = subparsers.add_parser("plugin", help="Manage plugins")
+    plugin_sub = plugin_parser.add_subparsers(dest="plugin_command", help="Plugin commands")
+
+    plugin_list = plugin_sub.add_parser("list", aliases=["ls"], help="List plugins")
+    plugin_list.set_defaults(func=cmd_plugin_list)
+
+    plugin_enable = plugin_sub.add_parser("enable", help="Enable a plugin")
+    plugin_enable.add_argument("name", help="Plugin name")
+    plugin_enable.set_defaults(func=cmd_plugin_enable)
+
+    plugin_disable = plugin_sub.add_parser("disable", help="Disable a plugin")
+    plugin_disable.add_argument("name", help="Plugin name")
+    plugin_disable.set_defaults(func=cmd_plugin_disable)
+
+    plugin_discover = plugin_sub.add_parser("discover", help="Discover available plugins")
+    plugin_discover.set_defaults(func=cmd_plugin_discover)
+
+    plugin_install = plugin_sub.add_parser("install", help="Install a plugin")
+    plugin_install.add_argument("source", help="Plugin source (PyPI package, git URL, or local path)")
+    plugin_install.set_defaults(func=cmd_plugin_install)
+
+    plugin_uninstall = plugin_sub.add_parser("uninstall", aliases=["remove"], help="Uninstall a plugin")
+    plugin_uninstall.add_argument("name", help="Plugin name")
+    plugin_uninstall.set_defaults(func=cmd_plugin_uninstall)
+
+    # === Remote Management Commands ===
+    remote_parser = subparsers.add_parser("remote", help="Manage VMs on remote hosts")
+    remote_sub = remote_parser.add_subparsers(dest="remote_command", help="Remote commands")
+
+    remote_list = remote_sub.add_parser("list", aliases=["ls"], help="List VMs on remote host")
+    remote_list.add_argument("host", help="Remote host (user@hostname)")
+    remote_list.add_argument("-u", "--user", action="store_true", help="Use user session on remote")
+    remote_list.set_defaults(func=cmd_remote_list)
+
+    remote_status = remote_sub.add_parser("status", help="Get VM status on remote host")
+    remote_status.add_argument("host", help="Remote host (user@hostname)")
+    remote_status.add_argument("vm_name", help="VM name")
+    remote_status.add_argument("-u", "--user", action="store_true", help="Use user session on remote")
+    remote_status.add_argument("--json", action="store_true", help="Output as JSON")
+    remote_status.set_defaults(func=cmd_remote_status)
+
+    remote_start = remote_sub.add_parser("start", help="Start VM on remote host")
+    remote_start.add_argument("host", help="Remote host (user@hostname)")
+    remote_start.add_argument("vm_name", help="VM name")
+    remote_start.add_argument("-u", "--user", action="store_true", help="Use user session on remote")
+    remote_start.set_defaults(func=cmd_remote_start)
+
+    remote_stop = remote_sub.add_parser("stop", help="Stop VM on remote host")
+    remote_stop.add_argument("host", help="Remote host (user@hostname)")
+    remote_stop.add_argument("vm_name", help="VM name")
+    remote_stop.add_argument("-u", "--user", action="store_true", help="Use user session on remote")
+    remote_stop.add_argument("-f", "--force", action="store_true", help="Force stop")
+    remote_stop.set_defaults(func=cmd_remote_stop)
+
+    remote_delete = remote_sub.add_parser("delete", aliases=["rm"], help="Delete VM on remote host")
+    remote_delete.add_argument("host", help="Remote host (user@hostname)")
+    remote_delete.add_argument("vm_name", help="VM name")
+    remote_delete.add_argument("-u", "--user", action="store_true", help="Use user session on remote")
+    remote_delete.add_argument("-y", "--yes", action="store_true", help="Skip confirmation")
+    remote_delete.add_argument("--keep-storage", action="store_true", help="Keep disk images")
+    remote_delete.set_defaults(func=cmd_remote_delete)
+
+    remote_exec = remote_sub.add_parser("exec", help="Execute command in VM on remote host")
+    remote_exec.add_argument("host", help="Remote host (user@hostname)")
+    remote_exec.add_argument("vm_name", help="VM name")
+    remote_exec.add_argument("command", nargs=argparse.REMAINDER, help="Command to execute")
+    remote_exec.add_argument("-u", "--user", action="store_true", help="Use user session on remote")
+    remote_exec.add_argument("-t", "--timeout", type=int, default=30, help="Command timeout")
+    remote_exec.set_defaults(func=cmd_remote_exec)
+
+    remote_health = remote_sub.add_parser("health", help="Run health check on remote VM")
+    remote_health.add_argument("host", help="Remote host (user@hostname)")
+    remote_health.add_argument("vm_name", help="VM name")
+    remote_health.add_argument("-u", "--user", action="store_true", help="Use user session on remote")
+    remote_health.set_defaults(func=cmd_remote_health)
+
     args = parser.parse_args()
 
     if hasattr(args, "func"):