diff --git a/tests/commands/capabilities.test.ts b/tests/commands/capabilities.test.ts
index d485e20..6117d5d 100644
--- a/tests/commands/capabilities.test.ts
+++ b/tests/commands/capabilities.test.ts
@@ -284,4 +284,33 @@ describe('capabilities B3/B4', () => {
     const keys = resources.keys as Array<{ keyType: string }>;
     expect(keys.map((k) => k.keyType).sort()).toEqual(['disposable', 'permanent', 'timeLimit', 'urgent']);
   });
+
+  it('--surface cli restricts surfaces block to cli only', async () => {
+    const out = await runCapabilitiesWith(['--surface', 'cli']);
+    const surfaces = out.surfaces as Record<string, unknown>;
+    expect(Object.keys(surfaces)).toEqual(['cli']);
+  });
+
+  it('--surface with invalid value throws CommanderError', async () => {
+    const program = makeProgram();
+    program.exitOverride();
+    registerCapabilitiesCommand(program);
+    await expect(
+      program.parseAsync(['node', 'test', 'capabilities', '--surface', 'bogus'])
+    ).rejects.toThrow(/must be one of/i);
+  });
+
+  it('commandMeta entries all carry required safety fields', async () => {
+    const out = await runCapabilities();
+    const meta = out.commandMeta as Record<string, Record<string, unknown>>;
+    const entries = Object.values(meta);
+    expect(entries.length).toBeGreaterThan(50);
+    for (const entry of entries) {
+      expect(['read', 'action', 'destructive']).toContain(entry.agentSafetyTier);
+      expect(typeof entry.mutating).toBe('boolean');
+      expect(typeof entry.consumesQuota).toBe('boolean');
+      expect(['low', 'medium', 'high']).toContain(entry.riskLevel);
+      expect(['direct', 'plan', 'review-before-execute']).toContain(entry.recommendedMode);
+    }
+  });
 });
diff --git a/tests/commands/daemon.test.ts b/tests/commands/daemon.test.ts
index 7137266..649b549 100644
--- a/tests/commands/daemon.test.ts
+++ b/tests/commands/daemon.test.ts
@@ -165,3 +165,119 @@ describe('daemon command', () => {
     );
   });
 });
+
+describe('daemon stop', () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    fsMock.unlinkSync.mockClear();
+    pidFileMock.readPidFile.mockReset().mockReturnValue(null);
+    pidFileMock.isPidAlive.mockReset().mockReturnValue(false);
+    daemonStateMock.readDaemonState.mockReset().mockReturnValue(null);
+    daemonStateMock.writeDaemonState.mockClear();
+  });
+
+  it('prints "No running daemon found" and persists stopped state when no daemon is running', async () => {
+    const res = await runCli(registerDaemonCommand, ['daemon', 'stop']);
+    expect(res.exitCode).toBeNull();
+    expect(res.stdout.join(' ')).toMatch(/no running daemon/i);
+    expect(daemonStateMock.writeDaemonState).toHaveBeenCalledWith(
+      expect.objectContaining({ status: 'stopped', pid: null }),
+    );
+  });
+
+  it('enters the running branch, unlinks pid files, and persists stopped state when daemon is alive', async () => {
+    pidFileMock.readPidFile.mockImplementation((file: string) =>
+      file === daemonStateMock.DAEMON_PID_FILE ? 12345 : null,
+    );
+    pidFileMock.isPidAlive.mockReturnValue(true);
+
+    // process.kill is called from killIfAlive; stub it so the test suite is
+    // not allowed to signal the test runner itself. The assertions below do
+    // not depend on the spy being hit — they check observable side effects
+    // (pid file unlink + persisted state + "stopped" message).
+    const origKill = process.kill;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    (process as any).kill = vi.fn(() => true);
+
+    const res = await runCli(registerDaemonCommand, ['daemon', 'stop']);
+
+    (process as any).kill = origKill;
+
+    expect(res.exitCode).toBeNull();
+    expect(fsMock.unlinkSync).toHaveBeenCalled();
+    expect(daemonStateMock.writeDaemonState).toHaveBeenLastCalledWith(
+      expect.objectContaining({ status: 'stopped', pid: null }),
+    );
+    expect(res.stdout.join(' ')).toMatch(/daemon stopped \(pid 12345\)/i);
+  });
+});
+
+describe('daemon status', () => {
+  beforeEach(() => {
+    pidFileMock.readPidFile.mockReset().mockReturnValue(null);
+    pidFileMock.isPidAlive.mockReset().mockReturnValue(false);
+    daemonStateMock.readDaemonState.mockReset().mockReturnValue(null);
+  });
+
+  it('--json reports status:stopped when no daemon is running', async () => {
+    const res = await runCli(registerDaemonCommand, ['--json', 'daemon', 'status']);
+    expect(res.exitCode).toBeNull();
+    const body = JSON.parse(res.stdout.join('')) as { data: { status: string; pid: unknown } };
+    expect(body.data.status).toBe('stopped');
+    expect(body.data.pid).toBeNull();
+  });
+
+  it('--json reports status:running with correct pid when daemon is alive', async () => {
+    pidFileMock.readPidFile.mockImplementation((file: string) =>
+      file === daemonStateMock.DAEMON_PID_FILE ? 9999 : null,
+    );
+    pidFileMock.isPidAlive.mockReturnValue(true);
+
+    const res = await runCli(registerDaemonCommand, ['--json', 'daemon', 'status']);
+    expect(res.exitCode).toBeNull();
+    const body = JSON.parse(res.stdout.join('')) as { data: { status: string; pid: number } };
+    expect(body.data.status).toBe('running');
+    expect(body.data.pid).toBe(9999);
+  });
+
+  it('human output prints "not running" when stopped', async () => {
+    const res = await runCli(registerDaemonCommand, ['daemon', 'status']);
+    expect(res.exitCode).toBeNull();
+    expect(res.stdout.join(' ')).toMatch(/not running/i);
+  });
+});
+
+describe('daemon reload', () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    pidFileMock.readPidFile.mockReset().mockReturnValue(null);
+    pidFileMock.isPidAlive.mockReset().mockReturnValue(false);
+    daemonStateMock.readDaemonState.mockReset().mockReturnValue(null);
+    daemonStateMock.writeDaemonState.mockClear();
+    pidFileMock.writeReloadSentinel.mockClear();
+    pidFileMock.sighupSupported.mockReturnValue(false);
+  });
+
+  it('exits 2 with usage error when no daemon is running', async () => {
+    const res = await runCli(registerDaemonCommand, ['daemon', 'reload']);
+    expect(res.exitCode).toBe(2);
+    expect(res.stderr.join(' ')).toMatch(/no running daemon/i);
+  });
+
+  it('succeeds via sentinel when daemon and rules engine are running', async () => {
+    pidFileMock.readPidFile.mockImplementation((file: string) => {
+      if (file === daemonStateMock.DAEMON_PID_FILE) return 8888;
+      if (file === '/mock/.switchbot/rules.pid') return 7777;
+      return null;
+    });
+    pidFileMock.isPidAlive.mockReturnValue(true);
+
+    const res = await runCli(registerDaemonCommand, ['daemon', 'reload']);
+    expect(res.exitCode).toBeNull();
+    expect(pidFileMock.writeReloadSentinel).toHaveBeenCalledWith('/mock/.switchbot/rules.reload');
+    expect(daemonStateMock.writeDaemonState).toHaveBeenCalledWith(
+      expect.objectContaining({ lastReloadStatus: 'ok' }),
+    );
+    expect(res.stdout.join(' ')).toMatch(/reload requested/i);
+  });
+});
diff --git a/tests/commands/health-check.test.ts b/tests/commands/health-check.test.ts
new file mode 100644
index 0000000..1da2681
--- /dev/null
+++ b/tests/commands/health-check.test.ts
@@ -0,0 +1,78 @@
+import { describe, it, expect, vi } from 'vitest';
+
+const healthMock = vi.hoisted(() => {
+  const okReport = {
+    generatedAt: '2026-04-25T00:00:00.000Z',
+    overall: 'ok' as const,
+    process: { pid: 1234, uptimeSeconds: 60, platform: 'linux', nodeVersion: 'v18.0.0', memoryMb: 50 },
+    quota: { used: 100, limit: 10000, percentUsed: 1, remaining: 9900, status: 'ok' as const },
+    audit: { present: false, recentErrors: 0, recentTotal: 0, errorRatePercent: 0, status: 'ok' as const },
+    circuit: { name: 'switchbot-api', state: 'closed' as const, failures: 0, status: 'ok' as const },
+  };
+  return {
+    getHealthReport: vi.fn(() => okReport),
+    toPrometheusText: vi.fn(() => 'switchbot_quota_used_total 100\nswitchbot_circuit_open 0\n'),
+    okReport,
+  };
+});
+
+vi.mock('../../src/utils/health.js', () => ({
+  getHealthReport: healthMock.getHealthReport,
+  toPrometheusText: healthMock.toPrometheusText,
+}));
+
+import { registerHealthCommand } from '../../src/commands/health.js';
+import { runCli } from '../helpers/cli.js';
+
+describe('health check CLI', () => {
+  it('--json emits a structured health report with all components', async () => {
+    const res = await runCli(registerHealthCommand, ['--json', 'health', 'check']);
+    expect(res.exitCode).toBeNull();
+    const body = JSON.parse(res.stdout.join('')) as {
+      data: { overall: string; quota: unknown; audit: unknown; circuit: unknown; process: unknown };
+    };
+    expect(['ok', 'degraded', 'down']).toContain(body.data.overall);
+    expect(body.data.quota).toBeDefined();
+    expect(body.data.audit).toBeDefined();
+    expect(body.data.circuit).toBeDefined();
+    expect(body.data.process).toBeDefined();
+  });
+
+  it('exits 0 in human mode when overall is ok', async () => {
+    healthMock.getHealthReport.mockReturnValueOnce({ ...healthMock.okReport, overall: 'ok' });
+    const res = await runCli(registerHealthCommand, ['health', 'check']);
+    expect(res.exitCode).toBeNull();
+  });
+
+  it('exits 1 in human mode when overall is degraded', async () => {
+    healthMock.getHealthReport.mockReturnValueOnce({ ...healthMock.okReport, overall: 'degraded' });
+    const res = await runCli(registerHealthCommand, ['health', 'check']);
+    expect(res.exitCode).toBe(1);
+  });
+
+  it('exits 1 in human mode when overall is down', async () => {
+    healthMock.getHealthReport.mockReturnValueOnce({ ...healthMock.okReport, overall: 'down' });
+    const res = await runCli(registerHealthCommand, ['health', 'check']);
+    expect(res.exitCode).toBe(1);
+  });
+
+  it('--prometheus writes Prometheus text to process.stdout', async () => {
+    const written: string[] = [];
+    const spy = vi.spyOn(process.stdout, 'write').mockImplementation((chunk: unknown) => {
+      written.push(String(chunk));
+      return true;
+    });
+    const res = await runCli(registerHealthCommand, ['health', 'check', '--prometheus']);
+    spy.mockRestore();
+    expect(res.exitCode).toBeNull();
+    expect(written.join('')).toContain('switchbot_quota_used_total');
+    expect(written.join('')).toContain('switchbot_circuit_open');
+  });
+
+  it('human mode output lists quota and circuit component rows', async () => {
+    const res = await runCli(registerHealthCommand, ['health', 'check']);
+    const out = res.stdout.join('\n');
+    expect(out).toMatch(/quota/i);
+    expect(out).toMatch(/circuit/i);
+  });
+});
diff --git a/tests/commands/rules.test.ts b/tests/commands/rules.test.ts
index 91c8920..ad1fc00 100644
--- a/tests/commands/rules.test.ts
+++ b/tests/commands/rules.test.ts
@@ -542,4 +542,313 @@ describe('switchbot rules (commander surface)', () => {
       expect(body.data.lastFired).toBe('2026-04-25T08:00:00.000Z');
     });
   });
+
+  describe('rules conflicts', () => {
+    it('exits 0 and reports clean when no conflicts detected', async () => {
+      const p = path.join(tmpDir, 'clean.yaml');
+      fs.writeFileSync(p, v02Policy(sampleAutomation));
+      const { exitCode, stdout } = await runCli(['rules', 'conflicts', p]);
+      expect(exitCode).toBe(0);
+      expect(stdout.join(' ')).toMatch(/no conflicts detected/i);
+    });
+
+    it('exits 1 when opposing-action pair exists on the same device', async () => {
+      // Opposing actions produce warning-severity findings. Exit 1 requires an
+      // error-severity finding, which comes from destructive verbs or lint errors.
+      // Use a duplicate rule name (lint error) via the linter — wait, lint runs
+      // in doctor, not conflicts. Conflicts exits 1 only on error-severity findings.
+      // Simplest is just to assert findings > 0 and clean=false requires error.
+      // Since opposing-actions is a warning, `clean` remains true. So check
+      // findings > 0 instead of exit code.
+      const conflict = v02Policy([
+        'automation:',
+        '  enabled: true',
+        '  rules:',
+        '    - name: r-on',
+        '      when: { source: mqtt, event: motion.detected }',
+        '      then:',
+        '        - { command: "devices command DEVICE-X turnOn", device: DEVICE-X }',
+        '    - name: r-off',
+        '      when: { source: mqtt, event: motion.detected }',
+        '      then:',
+        '        - { command: "devices command DEVICE-X turnOff", device: DEVICE-X }',
+        '',
+      ].join('\n'));
+      const p = path.join(tmpDir, 'conflict.yaml');
+      fs.writeFileSync(p, conflict);
+      const { exitCode, stdout } = await runCli(['rules', 'conflicts', p]);
+      // Exit 0 because opposing-actions is warning-severity (not error).
+      expect(exitCode).toBe(0);
+      expect(stdout.join('\n')).toMatch(/opposing-actions/);
+    });
+
+    it('--json emits findings array when opposing actions exist', async () => {
+      const conflict = v02Policy([
+        'automation:',
+        '  enabled: true',
+        '  rules:',
+        '    - name: on',
+        '      when: { source: mqtt, event: motion.detected }',
+        '      then:',
+        '        - { command: "devices command DD turnOn", device: DD }',
+        '    - name: off',
+        '      when: { source: mqtt, event: motion.detected }',
+        '      then:',
+        '        - { command: "devices command DD turnOff", device: DD }',
+        '',
+      ].join('\n'));
+      const p = path.join(tmpDir, 'conflict2.yaml');
+      fs.writeFileSync(p, conflict);
+      const { stdout } = await runCli(['--json', 'rules', 'conflicts', p]);
+      const body = JSON.parse(stdout[0]) as { data: { clean: boolean; findings: Array<{ code: string; severity: string }> } };
+      expect(body.data.findings.length).toBeGreaterThan(0);
+      expect(body.data.findings.some((f) => f.code === 'opposing-actions')).toBe(true);
+    });
+  });
+
+  describe('rules doctor', () => {
+    it('--json exits 0 with overall:true for a valid policy', async () => {
+      const p = path.join(tmpDir, 'ok.yaml');
+      fs.writeFileSync(p, v02Policy(sampleAutomation));
+      const { exitCode, stdout } = await runCli(['--json', 'rules', 'doctor', p]);
+      expect(exitCode).toBe(0);
+      const body = JSON.parse(stdout[0]) as { data: { overall: boolean } };
+      expect(body.data.overall).toBe(true);
+    });
+
+    it('--json exits 1 with overall:false when policy has duplicate rule names (lint error)', async () => {
+      const bad = v02Policy([
+        'automation:',
+        '  enabled: true',
+        '  rules:',
+        '    - name: same-name',
+        '      when: { source: mqtt, event: motion.detected }',
+        '      then:',
+        '        - { command: "devices command EE turnOn", device: EE }',
+        '    - name: same-name',
+        '      when: { source: mqtt, event: motion.detected }',
+        '      then:',
+        '        - { command: "devices command EE turnOff", device: EE }',
+        '',
+      ].join('\n'));
+      const p = path.join(tmpDir, 'doctor-bad.yaml');
+      fs.writeFileSync(p, bad);
+      const { exitCode, stdout } = await runCli(['--json', 'rules', 'doctor', p]);
+      expect(exitCode).toBe(1);
+      const body = JSON.parse(stdout[0]) as { data: { overall: boolean } };
+      expect(body.data.overall).toBe(false);
+    });
+  });
+
+  describe('rules summary', () => {
+    function writeAudit(file: string, rows: unknown[]): void {
+      fs.writeFileSync(file, rows.map((r) => JSON.stringify(r)).join('\n') + '\n');
+    }
+
+    it('prints "(no rule activity)" when the audit log is empty', async () => {
+      const f = path.join(tmpDir, 'audit-empty.log');
+      fs.writeFileSync(f, '');
+      const { stdout } = await runCli(['rules', 'summary', '--file', f]);
+      expect(stdout.join(' ')).toMatch(/no rule activity/i);
+    });
+
+    it('--json reports total count and summaries when entries exist', async () => {
+      const f = path.join(tmpDir, 'audit-sum.log');
+      const now = new Date().toISOString();
+      writeAudit(f, [
+        { t: now, kind: 'rule-fire', rule: { name: 'lights on', triggerSource: 'mqtt', fireId: 'f1' }, result: 'ok', deviceId: 'D1', command: 'turnOn', parameter: null, commandType: 'command', dryRun: false },
+        { t: now, kind: 'rule-fire', rule: { name: 'lights on', triggerSource: 'mqtt', fireId: 'f2' }, result: 'ok', deviceId: 'D1', command: 'turnOn', parameter: null, commandType: 'command', dryRun: false },
+        { t: now, kind: 'rule-fire', rule: { name: 'lights on', triggerSource: 'mqtt', fireId: 'f3' }, result: 'error', deviceId: 'D1', command: 'turnOn', parameter: null, commandType: 'command', dryRun: false },
+      ]);
+      const { exitCode, stdout } = await runCli(['--json', 'rules', 'summary', '--file', f]);
+      expect(exitCode).toBe(0);
+      const body = JSON.parse(stdout[0]) as { data: { total: number; summaries: Array<{ rule: string; fires: number; errors: number }> } };
+      expect(body.data.total).toBe(3);
+      const s = body.data.summaries.find((x) => x.rule === 'lights on');
+      expect(s).toBeDefined();
+      expect(s!.fires).toBe(3);
+      expect(s!.errors).toBe(1);
+    });
+
+    it('--rule filters to a single rule name', async () => {
+      const f = path.join(tmpDir, 'audit-filter.log');
+      const now = new Date().toISOString();
+      writeAudit(f, [
+        { t: now, kind: 'rule-fire', rule: { name: 'rule-A', triggerSource: 'mqtt', fireId: 'x1' }, result: 'ok', deviceId: 'D', command: 'turnOn', parameter: null, commandType: 'command', dryRun: false },
+        { t: now, kind: 'rule-fire', rule: { name: 'rule-B', triggerSource: 'mqtt', fireId: 'x2' }, result: 'ok', deviceId: 'D', command: 'turnOn', parameter: null, commandType: 'command', dryRun: false },
+      ]);
+      const { stdout } = await runCli(['--json', 'rules', 'summary', '--file', f, '--rule', 'rule-A']);
+      const body = JSON.parse(stdout[0]) as { data: { summaries: Array<{ rule: string }> } };
+      expect(body.data.summaries.every((s) => s.rule === 'rule-A')).toBe(true);
+    });
+  });
+
+  describe('rules last-fired', () => {
+    function writeAudit(file: string, rows: unknown[]): void {
+      fs.writeFileSync(file, rows.map((r) => JSON.stringify(r)).join('\n') + '\n');
+    }
+
+    it('prints hint when no rule-fire entries exist', async () => {
+      const f = path.join(tmpDir, 'audit-empty2.log');
+      fs.writeFileSync(f, '');
+      const { stdout } = await runCli(['rules', 'last-fired', '--file', f]);
+      expect(stdout.join(' ')).toMatch(/no rule-fire entries/i);
+    });
+
+    it('--json returns entries with count matching input size', async () => {
+      const f = path.join(tmpDir, 'audit-lf.log');
+      const base = new Date('2026-04-25T10:00:00.000Z');
+      writeAudit(f, [1, 2, 3].map((i) => ({
+        t: new Date(base.getTime() + i * 1000).toISOString(),
+        kind: 'rule-fire',
+        rule: { name: 'night-light', triggerSource: 'mqtt', fireId: `f${i}` },
+        result: 'ok', deviceId: 'D1', command: 'turnOn', parameter: null, commandType: 'command', dryRun: false,
+      })));
+      const { exitCode, stdout } = await runCli(['--json', 'rules', 'last-fired', '--file', f]);
+      expect(exitCode).toBe(0);
+      const body = JSON.parse(stdout[0]) as { data: { count: number; entries: Array<{ kind: string }> } };
+      expect(body.data.count).toBe(3);
+      expect(body.data.entries[0].kind).toBe('rule-fire');
+    });
+
+    it('-n limits the number of results returned', async () => {
+      const f = path.join(tmpDir, 'audit-n.log');
+      const base = new Date('2026-04-25T12:00:00.000Z');
+      writeAudit(f, Array.from({ length: 15 }, (_, i) => ({
+        t: new Date(base.getTime() + i * 1000).toISOString(),
+        kind: 'rule-fire',
+        rule: { name: 'flood-rule', triggerSource: 'mqtt', fireId: `id${i}` },
+        result: 'ok', deviceId: 'D', command: 'turnOn', parameter: null, commandType: 'command', dryRun: false,
+      })));
+      const { stdout } = await runCli(['--json', 'rules', 'last-fired', '--file', f, '-n', '5']);
+      const body = JSON.parse(stdout[0]) as { data: { count: number } };
+      expect(body.data.count).toBe(5);
+    });
+  });
+
+  describe('rules webhook-rotate-token', () => {
+    let tokenDir: string;
+    let prevEnv: string | undefined;
+
+    beforeEach(() => {
+      tokenDir = fs.mkdtempSync(path.join(os.tmpdir(), 'sbwh-'));
+      vi.spyOn(os, 'homedir').mockReturnValue(tokenDir);
+      prevEnv = process.env.SWITCHBOT_WEBHOOK_TOKEN;
+      delete process.env.SWITCHBOT_WEBHOOK_TOKEN;
+    });
+
+    afterEach(() => {
+      vi.restoreAllMocks();
+      if (prevEnv !== undefined) process.env.SWITCHBOT_WEBHOOK_TOKEN = prevEnv;
+      fs.rmSync(tokenDir, { recursive: true, force: true });
+    });
+
+    it('creates a token file and prints the token', async () => {
+      const { exitCode, stdout } = await runCli(['rules', 'webhook-rotate-token']);
+      expect(exitCode).toBe(0);
+      const tokenFile = path.join(tokenDir, '.switchbot', 'webhook-token');
+      expect(fs.existsSync(tokenFile)).toBe(true);
+      const persisted = fs.readFileSync(tokenFile, 'utf-8').trim();
+      expect(persisted.length).toBeGreaterThan(20);
+      expect(stdout.join(' ')).toContain(persisted);
+    });
+
+    it('--json reports status:rotated with filePath and tokenLength', async () => {
+      const { exitCode, stdout } = await runCli(['--json', 'rules', 'webhook-rotate-token']);
+      expect(exitCode).toBe(0);
+      const body = JSON.parse(stdout[0]) as { data: { status: string; filePath: string; tokenLength: number } };
+      expect(body.data.status).toBe('rotated');
+      expect(body.data.tokenLength).toBeGreaterThan(20);
+      expect(body.data.filePath).toContain('webhook-token');
+    });
+
+    it('produces a different token on each rotation', async () => {
+      await runCli(['rules', 'webhook-rotate-token']);
+      const file = path.join(tokenDir, '.switchbot', 'webhook-token');
+      const first = fs.readFileSync(file, 'utf-8').trim();
+      await runCli(['rules', 'webhook-rotate-token']);
+      const second = fs.readFileSync(file, 'utf-8').trim();
+      expect(first).not.toBe(second);
+    });
+  });
+
+  describe('rules webhook-show-token', () => {
+    let tokenDir: string;
+    let prevEnv: string | undefined;
+
+    beforeEach(() => {
+      tokenDir = fs.mkdtempSync(path.join(os.tmpdir(), 'sbwh2-'));
+      vi.spyOn(os, 'homedir').mockReturnValue(tokenDir);
+      prevEnv = process.env.SWITCHBOT_WEBHOOK_TOKEN;
+      delete process.env.SWITCHBOT_WEBHOOK_TOKEN;
+    });
+
+    afterEach(() => {
+      vi.restoreAllMocks();
+      if (prevEnv !== undefined) process.env.SWITCHBOT_WEBHOOK_TOKEN = prevEnv;
+      fs.rmSync(tokenDir, { recursive: true, force: true });
+    });
+
+    it('creates and prints a token on first call', async () => {
+      const { exitCode, stdout } = await runCli(['rules', 'webhook-show-token']);
+      expect(exitCode).toBe(0);
+      expect(stdout.join('').trim().length).toBeGreaterThan(20);
+    });
+
+    it('returns the same token on repeated calls', async () => {
+      await runCli(['rules', 'webhook-show-token']);
+      const file = path.join(tokenDir, '.switchbot', 'webhook-token');
+      const first = fs.readFileSync(file, 'utf-8').trim();
+      await runCli(['rules', 'webhook-show-token']);
+      const second = fs.readFileSync(file, 'utf-8').trim();
+      expect(first).toBe(second);
+    });
+
+    it('--json reports filePath and tokenLength without exposing the raw token', async () => {
+      const { exitCode, stdout } = await runCli(['--json', 'rules', 'webhook-show-token']);
+      expect(exitCode).toBe(0);
+      const body = JSON.parse(stdout[0]) as { data: { filePath: string; tokenLength: number } };
+      expect(body.data.tokenLength).toBeGreaterThan(20);
+      // The raw 64-hex-char token must NOT appear in the JSON payload
+      expect(JSON.stringify(body.data)).not.toMatch(/\b[0-9a-f]{64}\b/);
+    });
+  });
+
+  describe('rules suggest', () => {
+    it('--json generates a cron-trigger rule for "every morning" intent', async () => {
+      const { exitCode, stdout } = await runCli([
+        '--json', 'rules', 'suggest', '--intent', 'turn on lights every morning',
+      ]);
+      expect(exitCode).toBe(0);
+      const body = JSON.parse(stdout[0]) as { data: { rule: Record<string, unknown>; rule_yaml: string; warnings: string[] } };
+      expect(body.data.rule_yaml).toContain('name:');
+      expect(body.data.rule_yaml).toMatch(/cron/i);
+      expect(Array.isArray(body.data.warnings)).toBe(true);
+    });
+
+    it('--json generates an mqtt-trigger rule for "motion detected" intent', async () => {
+      const { exitCode, stdout } = await runCli([
+        '--json', 'rules', 'suggest', '--intent', 'when motion detected turn on hallway light',
+      ]);
+      expect(exitCode).toBe(0);
+      const body = JSON.parse(stdout[0]) as { data: { rule_yaml: string } };
+      expect(body.data.rule_yaml).toMatch(/mqtt/i);
+      expect(body.data.rule_yaml).toMatch(/motion\.detected/i);
+    });
+
+    it('--json includes the device ID when --device is specified', async () => {
+      const { exitCode, stdout } = await runCli([
+        '--json', 'rules', 'suggest',
+        '--intent', 'when button pressed turn on light',
+        '--device', 'AA:BB:CC:DD:EE:FF',
+      ]);
+      expect(exitCode).toBe(0);
+      const body = JSON.parse(stdout[0]) as { data: { rule_yaml: string } };
+      expect(body.data.rule_yaml).toContain('AA:BB:CC:DD:EE:FF');
+    });
+
+    it('throws when --intent is missing (commander required option)', async () => {
+      await expect(runCli(['rules', 'suggest'])).rejects.toThrow();
+    });
+  });
 });
diff --git a/tests/commands/scenes.test.ts b/tests/commands/scenes.test.ts
index aa1a672..8f03a68 100644
--- a/tests/commands/scenes.test.ts
+++ b/tests/commands/scenes.test.ts
@@ -298,4 +298,95 @@ describe('scenes command', () => {
       expect((out.error as Record<string, unknown>).message).toMatch(/scene not found/i);
     });
   });
+
+  describe('validate', () => {
+    function mockScenes() {
+      apiMock.__instance.get.mockResolvedValue({
+        data: {
+          body: [
+            { sceneId: 'S1', sceneName: 'Good Morning' },
+            { sceneId: 'S2', sceneName: 'Movie Time' },
+          ],
+        },
+      });
+    }
+
+    it('exits 0 when all specified sceneIds are valid', async () => {
+      mockScenes();
+      const res = await runCli(registerScenesCommand, ['scenes', 'validate', 'S1']);
+      expect(res.exitCode).toBeNull();
+      expect(res.stdout.join(' ')).toMatch(/✓/);
+    });
+
+    it('exits 1 when a specified sceneId does not exist', async () => {
+      mockScenes();
+      const res = await runCli(registerScenesCommand, ['scenes', 'validate', 'MISSING-SCENE']);
+      expect(res.exitCode).toBe(1);
+      expect(res.stdout.join(' ')).toMatch(/✗/);
+    });
+
+    it('--json emits ok:true when all IDs valid', async () => {
+      mockScenes();
+      const res = await runCli(registerScenesCommand, ['--json', 'scenes', 'validate', 'S1']);
+      expect(res.exitCode).toBeNull();
+      const body = JSON.parse(res.stdout.join('')) as { data: { ok: boolean; results: Array<{ sceneId: string; valid: boolean }> } };
+      expect(body.data.ok).toBe(true);
+      expect(body.data.results[0].valid).toBe(true);
+    });
+
+    it('--json emits ok:false and exits 1 when an ID is not found', async () => {
+      mockScenes();
+      const res = await runCli(registerScenesCommand, ['--json', 'scenes', 'validate', 'MISSING-SCENE']);
+      expect(res.exitCode).toBe(1);
+      const body = JSON.parse(res.stdout.find((l) => l.trim().startsWith('{'))!) as { data: { ok: boolean; results: Array<{ valid: boolean }> } };
+      expect(body.data.ok).toBe(false);
+      expect(body.data.results.some((r) => !r.valid)).toBe(true);
+    });
+  });
+
+  describe('simulate', () => {
+    function mockScenes() {
+      apiMock.__instance.get.mockResolvedValue({
+        data: {
+          body: [
+            { sceneId: 'S1', sceneName: 'Good Morning' },
+            { sceneId: 'S2', sceneName: 'Movie Time' },
+          ],
+        },
+      });
+    }
+
+    it('--json emits simulation envelope with wouldSend and simulated:true', async () => {
+      mockScenes();
+      const res = await runCli(registerScenesCommand, ['--json', 'scenes', 'simulate', 'S1']);
+      expect(res.exitCode).toBeNull();
+      const body = JSON.parse(res.stdout.join('')) as {
+        data: { simulated: boolean; sceneId: string; wouldSend: { method: string; url: string } };
+      };
+      expect(body.data.simulated).toBe(true);
+      expect(body.data.sceneId).toBe('S1');
+      expect(body.data.wouldSend.method).toBe('POST');
+      expect(body.data.wouldSend.url).toContain('S1');
+    });
+
+    it('human output prints sceneId, sceneName, and wouldSend', async () => {
+      mockScenes();
+      const res = await runCli(registerScenesCommand, ['scenes', 'simulate', 'S1']);
+      expect(res.exitCode).toBeNull();
+      const out = res.stdout.join('\n');
+      expect(out).toMatch(/sceneId/i);
+      expect(out).toMatch(/wouldSend/i);
+    });
+
+    it('exits 2 with scene_not_found envelope for unknown sceneId', async () => {
+      mockScenes();
+      const res = await runCli(registerScenesCommand, ['--json', 'scenes', 'simulate', 'MISSING']);
+      expect(res.exitCode).toBe(2);
+      const body = JSON.parse(res.stdout.find((l) => l.trim().startsWith('{'))!) as {
+        error: { message?: string; context?: { error?: string } };
+      };
+      const sig = body.error.context?.error ?? body.error.message ?? '';
+      expect(sig).toMatch(/scene.?not.?found/i);
+    });
+  });
 });
diff --git a/tests/commands/status-sync.test.ts b/tests/commands/status-sync.test.ts
new file mode 100644
index 0000000..fccb6cf
--- /dev/null
+++ b/tests/commands/status-sync.test.ts
@@ -0,0 +1,95 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const notRunningStatus = {
+  running: false, pid: null, startedAt: null,
+  stateDir: '/mock/.switchbot/status-sync',
+  stateFile: '/mock/.switchbot/status-sync/state.json',
+  stdoutLog: '/mock/.switchbot/status-sync/stdout.log',
+  stderrLog: '/mock/.switchbot/status-sync/stderr.log',
+  command: null, openclawUrl: null, openclawModel: null,
+  topic: null, configPath: null, profile: null,
+};
+
+const runningStatus = {
+  ...notRunningStatus,
+  running: true,
+  pid: 12345,
+  startedAt: '2026-04-25T00:00:00.000Z',
+  openclawUrl: 'http://localhost:18789',
+  openclawModel: 'home-agent',
+};
+
+const managerMock = vi.hoisted(() => ({
+  getStatusSyncStatus: vi.fn(),
+  startStatusSync: vi.fn(),
+  stopStatusSync: vi.fn(),
+  runStatusSyncForeground: vi.fn(async () => 0),
+}));
+
+vi.mock('../../src/status-sync/manager.js', () => managerMock);
+
+import { registerStatusSyncCommand } from '../../src/commands/status-sync.js';
+import { runCli } from '../helpers/cli.js';
+
+describe('status-sync start', () => {
+  beforeEach(() => {
+    managerMock.startStatusSync.mockReset().mockReturnValue(runningStatus);
+    managerMock.getStatusSyncStatus.mockReset().mockReturnValue(notRunningStatus);
+  });
+
+  it('prints "Started status-sync (PID …)" on success', async () => {
+    const res = await runCli(registerStatusSyncCommand, [
+      'status-sync', 'start', '--openclaw-model', 'home-agent',
+    ]);
+    expect(res.exitCode).toBeNull();
+    expect(res.stdout.join(' ')).toMatch(/started status-sync/i);
+    expect(res.stdout.join(' ')).toContain('12345');
+  });
+
+  it('--json emits the StatusSyncStatus object on success', async () => {
+    const res = await runCli(registerStatusSyncCommand, [
+      '--json', 'status-sync', 'start', '--openclaw-model', 'home-agent',
+    ]);
+    expect(res.exitCode).toBeNull();
+    const body = JSON.parse(res.stdout.join('')) as { data: { running: boolean; pid: number } };
+    expect(body.data.running).toBe(true);
+    expect(body.data.pid).toBe(12345);
+  });
+
+  it('exits non-zero and calls handleError when startStatusSync throws', async () => {
+    managerMock.startStatusSync.mockImplementation(() => {
+      throw Object.assign(new Error('already running (PID 9000). Run stop first.'), { exitCode: 2 });
+    });
+    const res = await runCli(registerStatusSyncCommand, ['status-sync', 'start']);
+    expect(res.exitCode).not.toBe(0);
+    expect(res.exitCode).not.toBeNull();
+  });
+});
+
+describe('status-sync stop', () => {
+  beforeEach(() => {
+    managerMock.stopStatusSync.mockReset()
+      .mockReturnValue({ stopped: false, stale: false, pid: null, status: notRunningStatus });
+  });
+
+  it('prints "not running" when nothing is running', async () => {
+    const res = await runCli(registerStatusSyncCommand, ['status-sync', 'stop']);
+    expect(res.exitCode).toBeNull();
+    expect(res.stdout.join(' ')).toMatch(/not running/i);
+  });
+
+  it('prints "Stopped status-sync (PID …)" when process was killed', async () => {
+    managerMock.stopStatusSync.mockReturnValue({ stopped: true, stale: false, pid: 7777, status: notRunningStatus });
+    const res = await runCli(registerStatusSyncCommand, ['status-sync', 'stop']);
+    expect(res.exitCode).toBeNull();
+    expect(res.stdout.join(' ')).toMatch(/stopped status-sync/i);
+    expect(res.stdout.join(' ')).toContain('7777');
+  });
+
+  it('prints "Removed stale" when process is gone but state file existed', async () => {
+    managerMock.stopStatusSync.mockReturnValue({ stopped: false, stale: true, pid: 6666, status: notRunningStatus });
+    const res = await runCli(registerStatusSyncCommand, ['status-sync', 'stop']);
+    expect(res.exitCode).toBeNull();
+    expect(res.stdout.join(' ')).toMatch(/stale/i);
+  });
+});
diff --git a/tests/commands/upgrade-check.test.ts b/tests/commands/upgrade-check.test.ts
index 97f40fb..e109f65 100644
--- a/tests/commands/upgrade-check.test.ts
+++ b/tests/commands/upgrade-check.test.ts
@@ -1,5 +1,6 @@
 import { describe, it, expect, vi, afterEach } from 'vitest';
 import { EventEmitter } from 'node:events';
+import fs from 'node:fs';
 
 // ── https mock (for action-level tests) ─────────────────────────────────────
 const httpsMock = vi.hoisted(() => {
@@ -113,3 +114,66 @@ describe('upgrade-check action — prerelease guard', () => {
     expect(out).not.toMatch(/Update available/i);
   });
 });
+
+// ── action-level tests (happy path / up-to-date / network error) ─────────────
+describe('upgrade-check action — available update', () => {
+  afterEach(() => {
+    httpsMock.get.mockReset();
+  });
+
+  it('--json: updateAvailable:true and installCommand present when newer patch is available', async () => {
+    // Force a clearly-newer version that is definitely greater than current
+    makeHttpsGet('99.99.99');
+    const { registerUpgradeCheckCommand } = await import('../../src/commands/upgrade-check.js');
+    const { runCli } = await import('../helpers/cli.js');
+
+    const res = await runCli(registerUpgradeCheckCommand, ['--json', 'upgrade-check']);
+    const line = res.stdout.find((l) => l.trim().startsWith('{'));
+    expect(line).toBeDefined();
+    const out = JSON.parse(line!) as Record<string, unknown>;
+    const data = (out.data ?? out) as Record<string, unknown>;
+    expect(data.updateAvailable).toBe(true);
+    expect(data.upToDate).toBe(false);
+    expect(typeof data.installCommand).toBe('string');
+    expect(String(data.installCommand)).toContain('npm install');
+    expect(String(data.installCommand)).toContain('99.99.99');
+  });
+
+  it('--json: upToDate:true and updateAvailable:false when version matches current', async () => {
+    const currentVersion = JSON.parse(fs.readFileSync('package.json', 'utf-8')).version as string;
+    makeHttpsGet(currentVersion);
+    const { registerUpgradeCheckCommand } = await import('../../src/commands/upgrade-check.js');
+    const { runCli } = await import('../helpers/cli.js');
+
+    const res = await runCli(registerUpgradeCheckCommand, ['--json', 'upgrade-check']);
+    const line = res.stdout.find((l) => l.trim().startsWith('{'));
+    const out = JSON.parse(line!) as Record<string, unknown>;
+    const data = (out.data ?? out) as Record<string, unknown>;
+    expect(data.upToDate).toBe(true);
+    expect(data.updateAvailable).toBe(false);
+  });
+
+  it('exits non-zero and reports an error when the registry request times out', async () => {
+    httpsMock.get.mockImplementation((_url: unknown, _opts: unknown, _cb: unknown) => {
+      const req = Object.assign(new EventEmitter(), { destroy: vi.fn() });
+      process.nextTick(() => req.emit('error', new Error('registry request timed out after 8000ms')));
+      return req;
+    });
+    const { registerUpgradeCheckCommand } = await import('../../src/commands/upgrade-check.js');
+    const { runCli } = await import('../helpers/cli.js');
+
+    const res = await runCli(registerUpgradeCheckCommand, ['upgrade-check']);
+    expect(res.exitCode).not.toBe(0);
+    expect(res.exitCode).not.toBeNull();
+  });
+
+  it('human: prints "Update available" message with the new version', async () => {
+    makeHttpsGet('99.99.99');
+    const { registerUpgradeCheckCommand } = await import('../../src/commands/upgrade-check.js');
+    const { runCli } = await import('../helpers/cli.js');
+
+    const res = await runCli(registerUpgradeCheckCommand, ['upgrade-check']);
+    const out = res.stdout.join('\n');
+    expect(out).toMatch(/Update available|newer version/i);
+  });
+});