chore(deps): bump docker/setup-buildx-action from 3 to 4

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3 to 4.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+

.github/workflows/docker-images.yml

@@ -41,7 +41,7 @@ jobs:
           # henrygd/beszel-agent-nvidia
           - image: henrygd/beszel-agent-nvidia
             dockerfile: ./internal/dockerfile_agent_nvidia
-            platforms: linux/amd64
+            platforms: linux/amd64,linux/arm64
             registry: docker.io
             username_secret: DOCKERHUB_USERNAME
             password_secret: DOCKERHUB_TOKEN
@@ -96,7 +96,7 @@ jobs:
           # ghcr.io/henrygd/beszel-agent-nvidia
           - image: ghcr.io/${{ github.repository }}/beszel-agent-nvidia
             dockerfile: ./internal/dockerfile_agent_nvidia
-            platforms: linux/amd64
+            platforms: linux/amd64,linux/arm64
             registry: ghcr.io
             username: ${{ github.actor }}
             password_secret: GITHUB_TOKEN
@@ -152,7 +152,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up bun
         uses: oven-sh/setup-bun@v2
@@ -164,14 +164,14 @@ jobs:
         run: bun run --cwd ./internal/site build
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Docker metadata
         id: metadata
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ matrix.image }}
           tags: ${{ matrix.tags }}
@@ -181,7 +181,7 @@ jobs:
         env:
           password_secret_exists: ${{ secrets[matrix.password_secret] != '' && 'true' || 'false' }}
         if: github.event_name != 'pull_request' && env.password_secret_exists == 'true'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ matrix.username || secrets[matrix.username_secret] }}
           password: ${{ secrets[matrix.password_secret] }}
@@ -190,11 +190,13 @@ jobs:
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: ./
           file: ${{ matrix.dockerfile }}
           platforms: ${{ matrix.platforms || 'linux/amd64,linux/arm64,linux/arm/v7' }}
           push: ${{ github.ref_type == 'tag' && secrets[matrix.password_secret] != '' }}
+          provenance: mode=max
+          sbom: true
           tags: ${{ steps.metadata.outputs.tags }}
           labels: ${{ steps.metadata.outputs.labels }}

.github/workflows/inactivity-actions.yml

@@ -15,7 +15,7 @@ jobs:
     name: Lock Inactive Issues
     runs-on: ubuntu-24.04
     steps:
-      - uses: klaasnicolaas/action-inactivity-lock@v1.1.3
+      - uses: klaasnicolaas/action-inactivity-lock@v2.0.1
         id: lock
         with:
           days-inactive-issues: 14
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Close Stale Issues
-        uses: actions/stale@v10
+        uses: actions/stale@v11
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/release.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -27,12 +27,12 @@ jobs:
         run: bun run --cwd ./internal/site build
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: "^1.22.1"
 
       - name: Set up .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "9.0.x"
 
@@ -42,7 +42,7 @@ jobs:
         shell: bash
 
       - name: GoReleaser beszel
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@v7
         with:
           workdir: ./
           distribution: goreleaser

.github/workflows/vulncheck.yml

@@ -19,11 +19,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
-          go-version: 1.26.x
+          go-version: stable
           # cached: false
       - name: Get official govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest

Makefile

@@ -52,7 +52,7 @@ lint:
 	golangci-lint run
 
 test:
-	go test -tags=testing ./...
+	go test -tags='testing no_ui' ./...
 
 tidy:
 	go mod tidy

agent/agent.go

@@ -48,7 +48,6 @@ type Agent struct {
 	keys                      []gossh.PublicKey                                     // SSH public keys
 	smartManager              *SmartManager                                         // Manages SMART data
 	systemdManager            *systemdManager                                       // Manages systemd services
-	probeManager              *ProbeManager                                         // Manages network probes
 }
 
 // NewAgent creates a new agent with the given data directory for persisting data.
@@ -122,9 +121,6 @@ func NewAgent(dataDir ...string) (agent *Agent, err error) {
 	// initialize handler registry
 	agent.handlerRegistry = NewHandlerRegistry()
 
-	// initialize probe manager
-	agent.probeManager = newProbeManager()
-
 	// initialize disk info
 	agent.initializeDiskInfo()
 
@@ -182,11 +178,6 @@ func (a *Agent) gatherStats(options common.DataRequestOptions) *system.CombinedD
 		}
 	}
 
-	if a.probeManager != nil {
-		data.Probes = a.probeManager.GetResults(cacheTimeMs)
-		slog.Debug("Probes", "data", data.Probes)
-	}
-
 	// skip updating systemd services if cache time is not the default 60sec interval
 	if a.systemdManager != nil && cacheTimeMs == defaultDataCacheTimeMs {
 		totalCount := uint16(a.systemdManager.getServiceStatsCount())

agent/battery/battery_linux.go

@@ -102,6 +102,7 @@ func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
 		if parseErr != nil {
 			continue
 		}
+		cap = min(max(cap, 0), 100)
 		totalPercent += cap
 		count++
 

agent/battery/battery_linux_test.go

@@ -91,6 +91,16 @@ func TestGetBatteryStats_FullBattery(t *testing.T) {
 	assert.Equal(t, stateFull, state)
 }
 
+func TestGetBatteryStats_CapacityClamped(t *testing.T) {
+	_, addBattery := setupFakeSysfs(t)
+	addBattery("BAT0", "105", "Charging")
+
+	pct, state, err := GetBatteryStats()
+	assert.NoError(t, err)
+	assert.Equal(t, uint8(100), pct)
+	assert.Equal(t, stateCharging, state)
+}
+
 func TestGetBatteryStats_EmptyBattery(t *testing.T) {
 	_, addBattery := setupFakeSysfs(t)
 	addBattery("BAT0", "0", "Empty")

agent/client.go

@@ -53,8 +53,8 @@ func newWebSocketClient(agent *Agent) (client *WebSocketClient, err error) {
 	client = &WebSocketClient{}
 
 	client.hubURL, err = url.Parse(hubURLStr)
-	if err != nil {
-		return nil, errors.New("invalid hub URL")
+	if err != nil || client.hubURL.Host == "" {
+		return nil, fmt.Errorf("invalid HUB_URL %q: must include scheme and host (e.g. http://hub.example.com:8090)", hubURLStr)
 	}
 	// get registration token
 	client.token, err = getToken()

agent/client_test.go

@@ -51,11 +51,18 @@ func TestNewWebSocketClient(t *testing.T) {
 			errorMsg:    "HUB_URL environment variable not set",
 		},
 		{
-			name:        "invalid URL",
+			name:        "malformed URL",
 			hubURL:      "ht\ttp://invalid",
 			token:       "test-token",
 			expectError: true,
-			errorMsg:    "invalid hub URL",
+			errorMsg:    "invalid HUB_URL",
+		},
+		{
+			name:        "URL without host",
+			hubURL:      "http:/api",
+			token:       "test-token",
+			expectError: true,
+			errorMsg:    "invalid HUB_URL",
 		},
 		{
 			name:        "missing token",

agent/connection_manager.go

@@ -141,7 +141,6 @@ func (c *ConnectionManager) Start(serverOptions ServerOptions) error {
 //	}
 func (c *ConnectionManager) stop() error {
 	_ = c.agent.StopServer()
-	c.agent.probeManager.Stop()
 	c.closeWebSocket()
 	return health.CleanUp()
 }

agent/docker.go

@@ -65,7 +65,6 @@ type dockerManager struct {
 	dockerVersionChecked bool                        // Whether a version probe has completed successfully
 	isWindows            bool                        // Whether the Docker Engine API is running on Windows
 	buf                  *bytes.Buffer               // Buffer to store and read response bodies
-	decoder              *json.Decoder               // Reusable JSON decoder that reads from buf
 	apiStats             *container.ApiStats         // Reusable API stats object
 	excludeContainers    []string                    // Patterns to exclude containers by name
 	usingPodman          bool                        // Whether the Docker Engine API is running on Podman
@@ -374,16 +373,26 @@ func convertContainerPortsToString(ctr *container.ApiInfo) string {
 		return ""
 	}
 	sort.Slice(ctr.Ports, func(i, j int) bool {
-		return ctr.Ports[i].PublicPort < ctr.Ports[j].PublicPort
+		if ctr.Ports[i].PublicPort != ctr.Ports[j].PublicPort {
+			return ctr.Ports[i].PublicPort < ctr.Ports[j].PublicPort
+		}
+		return ctr.Ports[i].IP < ctr.Ports[j].IP
 	})
 	var builder strings.Builder
-	seenPorts := make(map[uint16]struct{})
+	seen := make(map[string]struct{})
 	for _, p := range ctr.Ports {
-		_, ok := seenPorts[p.PublicPort]
-		if p.PublicPort == 0 || ok {
+		if p.PublicPort == 0 {
 			continue
 		}
-		seenPorts[p.PublicPort] = struct{}{}
+		keyIP := p.IP
+		if keyIP == "0.0.0.0" || keyIP == "::" {
+			keyIP = ""
+		}
+		key := keyIP + ":" + strconv.Itoa(int(p.PublicPort))
+		if _, ok := seen[key]; ok {
+			continue
+		}
+		seen[key] = struct{}{}
 		if builder.Len() > 0 {
 			builder.WriteString(", ")
 		}
@@ -747,20 +756,18 @@ func (dm *dockerManager) applyDockerVersionInfo(serverHeader string, versionInfo
 	}
 }
 
-// Decodes Docker API JSON response using a reusable buffer and decoder. Not thread safe.
+// Decodes a Docker API JSON response using a reusable buffer. Not thread safe.
 func (dm *dockerManager) decode(resp *http.Response, d any) error {
 	if dm.buf == nil {
 		// initialize buffer with 256kb starting size
 		dm.buf = bytes.NewBuffer(make([]byte, 0, 1024*256))
-		dm.decoder = json.NewDecoder(dm.buf)
 	}
 	defer resp.Body.Close()
 	defer dm.buf.Reset()
-	_, err := dm.buf.ReadFrom(resp.Body)
-	if err != nil {
+	if _, err := dm.buf.ReadFrom(resp.Body); err != nil {
 		return err
 	}
-	return dm.decoder.Decode(d)
+	return json.Unmarshal(dm.buf.Bytes(), d)
 }
 
 // Test docker / podman sockets and return if one exists

agent/docker_test.go

@@ -804,6 +804,24 @@ func TestGetDockerStatsRetriesVersionCheckUntilSuccess(t *testing.T) {
 	assert.Equal(t, 2, requestCounts["/version"])
 }
 
+// A failed decode must not break later decodes. Previously the reused json.Decoder
+// stayed desynced after one truncated response, breaking decode until restart.
+func TestDecodeRecoversFromError(t *testing.T) {
+	dm := &dockerManager{}
+
+	// truncated JSON: body reads fine, decode fails
+	var bad []container.ApiInfo
+	err := dm.decode(&http.Response{Body: io.NopCloser(strings.NewReader(`[{"Id":"abc`))}, &bad)
+	require.Error(t, err)
+
+	// the next decode must still succeed
+	var good []container.ApiInfo
+	err = dm.decode(&http.Response{Body: io.NopCloser(strings.NewReader(`[{"Id":"abcdef012345","Names":["/ok"]}]`))}, &good)
+	require.NoError(t, err)
+	require.Len(t, good, 1)
+	assert.Equal(t, "abcdef012345", good[0].Id)
+}
+
 func TestCycleCpuDeltas(t *testing.T) {
 	dm := &dockerManager{
 		lastCpuContainer: map[uint16]map[string]uint64{
@@ -1003,6 +1021,44 @@ func TestCpuPercentageCalculationWithRealData(t *testing.T) {
 	assert.InDelta(t, expectedPct, actualPct, 0.01)
 }
 
+func TestCpuPercentageHandlesCounterRollback(t *testing.T) {
+	// If a stats response is processed after a newer one for the same container,
+	// or an accounting counter resets, the current total can be lower than the
+	// stored previous value. Unsigned subtraction wraps to ~2^64 instead of
+	// going negative, so the percentage explodes, validateCpuPercentage rejects
+	// the sample, and the whole collection is discarded - network stats too.
+	stats := &container.ApiStats{
+		CPUStats: container.CPUStats{
+			CPUUsage:    container.CPUUsage{TotalUsage: 1_000_000},
+			SystemUsage: 20_000_000,
+		},
+	}
+
+	// Container counter went backwards.
+	assert.Equal(t, 0.0, stats.CalculateCpuPercentLinux(2_000_000, 10_000_000))
+	// System counter went backwards.
+	assert.Equal(t, 0.0, stats.CalculateCpuPercentLinux(500_000, 30_000_000))
+	// A normal forward sample is unaffected: 500000 / 10000000 * 100 = 5%.
+	assert.InDelta(t, 5.0, stats.CalculateCpuPercentLinux(500_000, 10_000_000), 0.001)
+}
+
+func TestCpuPercentageWindowsHandlesCounterRollback(t *testing.T) {
+	now := time.Now()
+	stats := &container.ApiStats{
+		Read:     now,
+		NumProcs: 4,
+		CPUStats: container.CPUStats{
+			CPUUsage: container.CPUUsage{TotalUsage: 1_000_000},
+		},
+	}
+	prevRead := now.Add(-time.Second)
+
+	// Container counter went backwards.
+	assert.Equal(t, 0.0, stats.CalculateCpuPercentWindows(2_000_000, prevRead))
+	// A normal forward sample is unaffected.
+	assert.Greater(t, stats.CalculateCpuPercentWindows(500_000, prevRead), 0.0)
+}
+
 func TestNetworkStatsCalculationWithRealData(t *testing.T) {
 	// Create synthetic test data to avoid timing issues
 	apiStats1 := &container.ApiStats{
@@ -1864,6 +1920,14 @@ func TestConvertContainerPortsToString(t *testing.T) {
 			},
 			expected: "80, 443",
 		},
+		{
+			name: "ipv4 and ipv6 wildcard bindings are deduplicated",
+			ports: []port{
+				{PublicPort: 80, IP: "0.0.0.0"},
+				{PublicPort: 80, IP: "::"},
+			},
+			expected: "80",
+		},
 		{
 			name: "multiple ports with different IPs",
 			ports: []port{
@@ -1872,6 +1936,22 @@ func TestConvertContainerPortsToString(t *testing.T) {
 			},
 			expected: "80, 1.2.3.4:443",
 		},
+		{
+			name: "same port bound to multiple IPs shows all entries",
+			ports: []port{
+				{PublicPort: 65533, IP: "172.16.151.72"},
+				{PublicPort: 65533, IP: "172.16.156.25"},
+			},
+			expected: "172.16.151.72:65533, 172.16.156.25:65533",
+		},
+		{
+			name: "same port bound to IPv4 and IPv6",
+			ports: []port{
+				{PublicPort: 65534, IP: "172.16.151.72"},
+				{PublicPort: 65534, IP: "fd04:38e2:98c6:3fd::72"},
+			},
+			expected: "172.16.151.72:65534, fd04:38e2:98c6:3fd::72:65534",
+		},
 		{
 			name: "ports slice is nilled after call",
 			ports: []port{

agent/fans.go

@@ -0,0 +1,101 @@
+package agent
+
+import (
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"github.com/henrygd/beszel/agent/utils"
+	"github.com/henrygd/beszel/internal/entities/system"
+)
+
+type fanSensor struct {
+	key, path string
+}
+
+var getFanSensors = newFanSensorCache(hwmonRoot)
+
+func newFanSensorCache(root string) func() ([]fanSensor, error) {
+	return sync.OnceValues(func() ([]fanSensor, error) {
+		return discoverHwmonFans(root)
+	})
+}
+
+// updateFans populates systemStats.Fans from the host's hwmon sysfs tree.
+// No-op on platforms where hwmon isn't available (see fans_other.go).
+func (a *Agent) updateFans(systemStats *system.Stats) {
+	if hwmonRoot == "" {
+		return
+	}
+	sensors, err := getFanSensors()
+	if err != nil {
+		slog.Debug("Error reading fans", "err", err)
+		return
+	}
+	fans := readFanSensors(sensors)
+	if len(fans) == 0 {
+		return
+	}
+	systemStats.Fans = fans
+	// Note: Commented out because we don't currently use this value in the UI.
+	// Compute the single "dashboard" value used by the FanSpeed alert.
+	// Per-sensor RPMs live in Stats.Fans and drive the multi-line FanChart
+	// in the UI; the alert path only needs one number to compare against
+	// the user's threshold, so we use the highest RPM across all fans
+	// a.systemInfo.DashboardFan = 0
+	// for _, rpm := range fans {
+	// 	if rpm > a.systemInfo.DashboardFan {
+	// 		a.systemInfo.DashboardFan = rpm
+	// 	}
+	// }
+}
+
+// readHwmonFans walks the given hwmon root (typically /sys/class/hwmon) and
+// returns a map of "<chip>_<label-or-fan-idx>" → RPM for every fan*_input
+// file it finds. Zero RPM is retained because it can represent a real fan that
+// has stopped; negative and malformed readings are ignored.
+func readHwmonFans(root string) (map[string]uint16, error) {
+	sensors, err := discoverHwmonFans(root)
+	if err != nil {
+		return nil, err
+	}
+	return readFanSensors(sensors), nil
+}
+
+func discoverHwmonFans(root string) ([]fanSensor, error) {
+	entries, err := os.ReadDir(root)
+	if err != nil {
+		return nil, err
+	}
+	var sensors []fanSensor
+	for _, entry := range entries {
+		chipDir := filepath.Join(root, entry.Name())
+		chipName := utils.ReadStringFile(filepath.Join(chipDir, "name"))
+		if chipName == "" {
+			chipName = entry.Name()
+		}
+		inputs, _ := filepath.Glob(filepath.Join(chipDir, "fan*_input"))
+		for _, inputPath := range inputs {
+			base := strings.TrimSuffix(filepath.Base(inputPath), "_input")
+			label := utils.ReadStringFile(filepath.Join(chipDir, base+"_label"))
+			key := chipName + "_" + base
+			if label != "" {
+				key = chipName + "_" + label
+			}
+			sensors = append(sensors, fanSensor{key, inputPath})
+		}
+	}
+	return sensors, nil
+}
+
+func readFanSensors(sensors []fanSensor) map[string]uint16 {
+	fans := make(map[string]uint16, len(sensors))
+	for _, sensor := range sensors {
+		if rpm, ok := utils.ReadUintFile(sensor.path); ok {
+			fans[sensor.key] = uint16(rpm)
+		}
+	}
+	return fans
+}

agent/fans_linux.go

@@ -0,0 +1,8 @@
+//go:build linux
+
+package agent
+
+// hwmonRoot is the sysfs entry point for hardware monitor chips. Each
+// subdirectory (hwmon0, hwmon1, …) is one chip; fan*_input files inside it
+// expose RPM readings.
+const hwmonRoot = "/sys/class/hwmon"

agent/fans_other.go

@@ -0,0 +1,7 @@
+//go:build !linux
+
+package agent
+
+// hwmonRoot is empty on non-Linux platforms — fan RPM reporting via sysfs
+// hwmon is Linux-specific. updateFans() short-circuits when this is empty.
+const hwmonRoot = ""

agent/fans_test.go

@@ -0,0 +1,87 @@
+//go:build testing
+
+package agent
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// writeFile creates path with parents and writes contents.
+func writeFile(t *testing.T, path, contents string) {
+	t.Helper()
+	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
+	require.NoError(t, os.WriteFile(path, []byte(contents), 0o644))
+}
+
+// TestReadHwmonFans verifies the /sys/class/hwmon walker:
+//   - picks up fan*_input from every chip,
+//   - keys entries by chip name + sensor label (or fan idx if no label),
+//   - retains 0 RPM for stopped fans,
+//   - tolerates chips with no fan files at all.
+func TestReadHwmonFans(t *testing.T) {
+	root := t.TempDir()
+
+	// hwmon0: Raspberry Pi 5 active cooler — one fan, no label.
+	writeFile(t, filepath.Join(root, "hwmon0", "name"), "pwmfan\n")
+	writeFile(t, filepath.Join(root, "hwmon0", "fan1_input"), "6500\n")
+
+	// hwmon1: a thermal-only chip, no fan files. Must not error.
+	writeFile(t, filepath.Join(root, "hwmon1", "name"), "cpu_thermal\n")
+	writeFile(t, filepath.Join(root, "hwmon1", "temp1_input"), "55000\n")
+
+	// hwmon2: two fans — one stopped (0 RPM) and one labeled "chassis".
+	writeFile(t, filepath.Join(root, "hwmon2", "name"), "nct6798\n")
+	writeFile(t, filepath.Join(root, "hwmon2", "fan1_input"), "0\n")
+	writeFile(t, filepath.Join(root, "hwmon2", "fan2_input"), "1200\n")
+	writeFile(t, filepath.Join(root, "hwmon2", "fan2_label"), "chassis\n")
+
+	fans, err := readHwmonFans(root)
+	require.NoError(t, err)
+
+	assert.Equal(t, map[string]uint16{
+		"pwmfan_fan1":     6500,
+		"nct6798_fan1":    0,
+		"nct6798_chassis": 1200,
+	}, fans)
+}
+
+// TestReadHwmonFansMissingRoot returns an error rather than panicking when the
+// hwmon root doesn't exist (e.g. running on a kernel without hwmon support).
+func TestReadHwmonFansMissingRoot(t *testing.T) {
+	_, err := readHwmonFans(filepath.Join(t.TempDir(), "does-not-exist"))
+	assert.Error(t, err)
+}
+
+// TestReadHwmonFansEmpty returns an empty map (not nil error) when the root
+// exists but contains no chips at all.
+func TestReadHwmonFansEmpty(t *testing.T) {
+	root := t.TempDir()
+	fans, err := readHwmonFans(root)
+	require.NoError(t, err)
+	assert.Empty(t, fans)
+}
+
+func TestFanDiscoveryCache(t *testing.T) {
+	root := t.TempDir()
+	input := filepath.Join(root, "hwmon0", "fan1_input")
+	writeFile(t, filepath.Join(root, "hwmon0", "name"), "chip\n")
+	writeFile(t, input, "1000\n")
+
+	getSensors := newFanSensorCache(root)
+	sensors, err := getSensors()
+	require.NoError(t, err)
+	fans := readFanSensors(sensors)
+	assert.Equal(t, uint16(1000), fans["chip_fan1"])
+
+	writeFile(t, input, "1200\n")
+	writeFile(t, filepath.Join(root, "hwmon0", "fan1_label"), "case\n")
+	sensors, err = getSensors()
+	require.NoError(t, err)
+	fans = readFanSensors(sensors)
+	assert.Equal(t, map[string]uint16{"chip_fan1": 1200}, fans)
+}

agent/handlers.go

@@ -7,7 +7,6 @@ import (
 
 	"github.com/fxamacker/cbor/v2"
 	"github.com/henrygd/beszel/internal/common"
-	"github.com/henrygd/beszel/internal/entities/probe"
 	"github.com/henrygd/beszel/internal/entities/smart"
 
 	"log/slog"
@@ -52,7 +51,6 @@ func NewHandlerRegistry() *HandlerRegistry {
 	registry.Register(common.GetContainerInfo, &GetContainerInfoHandler{})
 	registry.Register(common.GetSmartData, &GetSmartDataHandler{})
 	registry.Register(common.GetSystemdInfo, &GetSystemdInfoHandler{})
-	registry.Register(common.SyncNetworkProbes, &SyncNetworkProbesHandler{})
 
 	return registry
 }
@@ -168,14 +166,16 @@ type GetSmartDataHandler struct{}
 
 func (h *GetSmartDataHandler) Handle(hctx *HandlerContext) error {
 	if hctx.Agent.smartManager == nil {
-		// return empty map to indicate no data
-		return hctx.SendResponse(map[string]smart.SmartData{}, hctx.RequestID)
+		return hctx.SendResponse(smart.SmartDataResponse{Data: map[string]smart.SmartData{}}, hctx.RequestID)
 	}
-	if err := hctx.Agent.smartManager.Refresh(false); err != nil {
+	complete, err := hctx.Agent.smartManager.Refresh(false)
+	if err != nil {
 		slog.Debug("smart refresh failed", "err", err)
 	}
-	data := hctx.Agent.smartManager.GetCurrentData()
-	return hctx.SendResponse(data, hctx.RequestID)
+	return hctx.SendResponse(smart.SmartDataResponse{
+		Data:     hctx.Agent.smartManager.GetCurrentData(),
+		Complete: complete,
+	}, hctx.RequestID)
 }
 
 ////////////////////////////////////////////////////////////////////////////
@@ -205,19 +205,3 @@ func (h *GetSystemdInfoHandler) Handle(hctx *HandlerContext) error {
 
 	return hctx.SendResponse(details, hctx.RequestID)
 }
-
-////////////////////////////////////////////////////////////////////////////
-////////////////////////////////////////////////////////////////////////////
-
-// SyncNetworkProbesHandler handles probe configuration sync from hub
-type SyncNetworkProbesHandler struct{}
-
-func (h *SyncNetworkProbesHandler) Handle(hctx *HandlerContext) error {
-	var configs []probe.Config
-	if err := cbor.Unmarshal(hctx.Request.Data, &configs); err != nil {
-		return err
-	}
-	hctx.Agent.probeManager.SyncProbes(configs)
-	slog.Info("network probes synced", "count", len(configs))
-	return hctx.SendResponse("ok", hctx.RequestID)
-}

agent/handlers_test.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/fxamacker/cbor/v2"
 	"github.com/henrygd/beszel/internal/common"
+	"github.com/henrygd/beszel/internal/entities/smart"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -17,6 +18,18 @@ type MockHandler struct {
 	handleFunc           func(ctx *HandlerContext) error
 }
 
+func TestNewAgentResponseSmartData(t *testing.T) {
+	response := newAgentResponse(smart.SmartDataResponse{
+		Data: map[string]smart.SmartData{
+			"AAA": {SerialNumber: "AAA"},
+		},
+		Complete: true,
+	}, nil)
+
+	assert.Equal(t, "AAA", response.SmartData["AAA"].SerialNumber)
+	assert.True(t, response.SmartComplete)
+}
+
 func (m *MockHandler) Handle(ctx *HandlerContext) error {
 	if m.handleFunc != nil {
 		return m.handleFunc(ctx)

agent/mdraid_linux.go

@@ -180,8 +180,13 @@ func mdraidSmartStatus(health mdraidHealth) string {
 	if health.degraded > 0 {
 		return "FAILED"
 	}
+	if health.mismatchCnt > 0 {
+		return "WARNING"
+	}
+	// "check" scans for consistency problems without repairing mismatches.
+	// With no mismatches, keep it green while reporting progress attributes.
 	switch syncAction {
-	case "check", "repair":
+	case "repair":
 		return "WARNING"
 	}
 	switch state {

agent/mdraid_linux_test.go

@@ -94,6 +94,18 @@ func TestMdraidSmartStatus(t *testing.T) {
 	if got := mdraidSmartStatus(mdraidHealth{arrayState: "active", syncAction: "recover"}); got != "WARNING" {
 		t.Fatalf("mdraidSmartStatus(recover) = %q, want WARNING", got)
 	}
+	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", syncAction: "check"}); got != "PASSED" {
+		t.Fatalf("mdraidSmartStatus(clean+check) = %q, want PASSED", got)
+	}
+	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", syncAction: "check", mismatchCnt: 1}); got != "WARNING" {
+		t.Fatalf("mdraidSmartStatus(clean+check+mismatch) = %q, want WARNING", got)
+	}
+	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", mismatchCnt: 1}); got != "WARNING" {
+		t.Fatalf("mdraidSmartStatus(clean+mismatch) = %q, want WARNING", got)
+	}
+	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", syncAction: "repair"}); got != "WARNING" {
+		t.Fatalf("mdraidSmartStatus(repair) = %q, want WARNING", got)
+	}
 	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean"}); got != "PASSED" {
 		t.Fatalf("mdraidSmartStatus(clean) = %q, want PASSED", got)
 	}

agent/probe.go

@@ -1,387 +0,0 @@
-package agent
-
-import (
-	"fmt"
-	"math"
-	"net"
-	"net/http"
-	"sync"
-	"time"
-
-	"log/slog"
-
-	"github.com/henrygd/beszel/internal/entities/probe"
-)
-
-// Probe functionality overview:
-// Probes run at user-defined intervals (e.g., every 10s).
-// To keep memory usage low and constant, data is stored in two layers:
-// 1. Raw samples: The most recent individual results (kept for probeRawRetention).
-// 2. Minute buckets: A fixed-size ring buffer of 61 buckets, each representing one
-//    wall-clock minute. Samples collected within the same minute are aggregated
-//    (sum, min, max, count) into a single bucket.
-//
-// Short-term requests (<= 2m) use raw samples for perfect accuracy.
-// Long-term requests (up to 1h) use the minute buckets to avoid storing thousands
-// of individual data points.
-
-const (
-	// probeRawRetention is the duration to keep individual samples for high-precision short-term requests
-	probeRawRetention = 80 * time.Second
-	// probeMinuteBucketLen is the number of 1-minute buckets to keep (1 hour + 1 for partials)
-	probeMinuteBucketLen int32 = 61
-)
-
-// ProbeManager manages network probe tasks.
-type ProbeManager struct {
-	mu         sync.RWMutex
-	probes     map[string]*probeTask // key = probe.Config.Key()
-	httpClient *http.Client
-}
-
-// probeTask owns retention buffers and cancellation for a single probe config.
-type probeTask struct {
-	config  probe.Config
-	cancel  chan struct{}
-	mu      sync.Mutex
-	samples []probeSample
-	buckets [probeMinuteBucketLen]probeBucket
-}
-
-// probeSample stores one probe attempt and its collection time.
-type probeSample struct {
-	responseMs float64 // -1 means loss
-	timestamp  time.Time
-}
-
-// probeBucket stores one minute of aggregated probe data.
-type probeBucket struct {
-	minute int32
-	filled bool
-	stats  probeAggregate
-}
-
-// probeAggregate accumulates successful response stats and total sample counts.
-type probeAggregate struct {
-	sumMs        float64
-	minMs        float64
-	maxMs        float64
-	totalCount   int
-	successCount int
-}
-
-func newProbeManager() *ProbeManager {
-	return &ProbeManager{
-		probes:     make(map[string]*probeTask),
-		httpClient: &http.Client{Timeout: 10 * time.Second},
-	}
-}
-
-// newProbeAggregate initializes an aggregate with an unset minimum value.
-func newProbeAggregate() probeAggregate {
-	return probeAggregate{minMs: math.MaxFloat64}
-}
-
-// addResponse folds a single probe sample into the aggregate.
-func (agg *probeAggregate) addResponse(responseMs float64) {
-	agg.totalCount++
-	if responseMs < 0 {
-		return
-	}
-	agg.successCount++
-	agg.sumMs += responseMs
-	if responseMs < agg.minMs {
-		agg.minMs = responseMs
-	}
-	if responseMs > agg.maxMs {
-		agg.maxMs = responseMs
-	}
-}
-
-// addAggregate merges another aggregate into this one.
-func (agg *probeAggregate) addAggregate(other probeAggregate) {
-	if other.totalCount == 0 {
-		return
-	}
-	agg.totalCount += other.totalCount
-	agg.successCount += other.successCount
-	agg.sumMs += other.sumMs
-	if other.successCount == 0 {
-		return
-	}
-	if agg.minMs == math.MaxFloat64 || other.minMs < agg.minMs {
-		agg.minMs = other.minMs
-	}
-	if other.maxMs > agg.maxMs {
-		agg.maxMs = other.maxMs
-	}
-}
-
-// hasData reports whether the aggregate contains any samples.
-func (agg probeAggregate) hasData() bool {
-	return agg.totalCount > 0
-}
-
-// result converts the aggregate into the probe result slice format.
-func (agg probeAggregate) result() probe.Result {
-	avg := agg.avgResponse()
-	minMs := 0.0
-	if agg.successCount > 0 {
-		minMs = math.Round(agg.minMs*100) / 100
-	}
-	return probe.Result{
-		avg,
-		minMs,
-		math.Round(agg.maxMs*100) / 100,
-		agg.lossPercentage(),
-	}
-}
-
-// avgResponse returns the rounded average of successful samples.
-func (agg probeAggregate) avgResponse() float64 {
-	if agg.successCount == 0 {
-		return 0
-	}
-	return math.Round(agg.sumMs/float64(agg.successCount)*100) / 100
-}
-
-// lossPercentage returns the rounded failure rate for the aggregate.
-func (agg probeAggregate) lossPercentage() float64 {
-	if agg.totalCount == 0 {
-		return 0
-	}
-	return math.Round(float64(agg.totalCount-agg.successCount)/float64(agg.totalCount)*10000) / 100
-}
-
-// SyncProbes replaces all probe tasks with the given configs.
-func (pm *ProbeManager) SyncProbes(configs []probe.Config) {
-	pm.mu.Lock()
-	defer pm.mu.Unlock()
-
-	// Build set of new keys
-	newKeys := make(map[string]probe.Config, len(configs))
-	for _, cfg := range configs {
-		if cfg.ID == "" {
-			continue
-		}
-		newKeys[cfg.ID] = cfg
-	}
-
-	// Stop removed probes
-	for key, task := range pm.probes {
-		if _, exists := newKeys[key]; !exists {
-			close(task.cancel)
-			delete(pm.probes, key)
-		}
-	}
-
-	// Start new probes (skip existing ones with same key)
-	for key, cfg := range newKeys {
-		if _, exists := pm.probes[key]; exists {
-			continue
-		}
-		task := &probeTask{
-			config:  cfg,
-			cancel:  make(chan struct{}),
-			samples: make([]probeSample, 0, 64),
-		}
-		pm.probes[key] = task
-		go pm.runProbe(task)
-	}
-}
-
-// GetResults returns aggregated results for all probes over the last supplied duration in ms.
-func (pm *ProbeManager) GetResults(durationMs uint16) map[string]probe.Result {
-	pm.mu.RLock()
-	defer pm.mu.RUnlock()
-
-	results := make(map[string]probe.Result, len(pm.probes))
-	now := time.Now()
-	duration := time.Duration(durationMs) * time.Millisecond
-
-	for _, task := range pm.probes {
-		task.mu.Lock()
-		agg := task.aggregateLocked(duration, now)
-		hourAgg := task.aggregateLocked(time.Hour, now)
-		task.mu.Unlock()
-
-		if !agg.hasData() {
-			continue
-		}
-
-		result := agg.result()
-		hourAvg := hourAgg.avgResponse()
-		hourLoss := hourAgg.lossPercentage()
-		if hourAgg.successCount > 0 {
-			result = probe.Result{
-				result[0],
-				hourAvg,
-				math.Round(hourAgg.minMs*100) / 100,
-				math.Round(hourAgg.maxMs*100) / 100,
-				hourLoss,
-			}
-		} else {
-			result = probe.Result{result[0], hourAvg, 0, 0, hourLoss}
-		}
-		results[task.config.ID] = result
-	}
-
-	return results
-}
-
-// Stop stops all probe tasks.
-func (pm *ProbeManager) Stop() {
-	pm.mu.Lock()
-	defer pm.mu.Unlock()
-	for key, task := range pm.probes {
-		close(task.cancel)
-		delete(pm.probes, key)
-	}
-}
-
-// runProbe executes a single probe task in a loop.
-func (pm *ProbeManager) runProbe(task *probeTask) {
-	interval := time.Duration(task.config.Interval) * time.Second
-	if interval < time.Second {
-		interval = 10 * time.Second
-	}
-	ticker := time.Tick(interval)
-
-	// Run immediately on start
-	pm.executeProbe(task)
-
-	for {
-		select {
-		case <-task.cancel:
-			return
-		case <-ticker:
-			pm.executeProbe(task)
-		}
-	}
-}
-
-// aggregateLocked collects probe data for the requested time window.
-func (task *probeTask) aggregateLocked(duration time.Duration, now time.Time) probeAggregate {
-	cutoff := now.Add(-duration)
-	// Keep short windows exact; longer windows read from minute buckets to avoid raw-sample retention.
-	if duration <= probeRawRetention {
-		return aggregateSamplesSince(task.samples, cutoff)
-	}
-	return aggregateBucketsSince(task.buckets[:], cutoff, now)
-}
-
-// aggregateSamplesSince aggregates raw samples newer than the cutoff.
-func aggregateSamplesSince(samples []probeSample, cutoff time.Time) probeAggregate {
-	agg := newProbeAggregate()
-	for _, sample := range samples {
-		if sample.timestamp.Before(cutoff) {
-			continue
-		}
-		agg.addResponse(sample.responseMs)
-	}
-	return agg
-}
-
-// aggregateBucketsSince aggregates minute buckets overlapping the requested window.
-func aggregateBucketsSince(buckets []probeBucket, cutoff, now time.Time) probeAggregate {
-	agg := newProbeAggregate()
-	startMinute := int32(cutoff.Unix() / 60)
-	endMinute := int32(now.Unix() / 60)
-	for _, bucket := range buckets {
-		if !bucket.filled || bucket.minute < startMinute || bucket.minute > endMinute {
-			continue
-		}
-		agg.addAggregate(bucket.stats)
-	}
-	return agg
-}
-
-// addSampleLocked stores a fresh sample in both raw and per-minute retention buffers.
-func (task *probeTask) addSampleLocked(sample probeSample) {
-	cutoff := sample.timestamp.Add(-probeRawRetention)
-	start := 0
-	for i := range task.samples {
-		if !task.samples[i].timestamp.Before(cutoff) {
-			start = i
-			break
-		}
-		if i == len(task.samples)-1 {
-			start = len(task.samples)
-		}
-	}
-	if start > 0 {
-		size := copy(task.samples, task.samples[start:])
-		task.samples = task.samples[:size]
-	}
-	task.samples = append(task.samples, sample)
-
-	minute := int32(sample.timestamp.Unix() / 60)
-	// Each slot stores one wall-clock minute, so the ring stays fixed-size at ~1h per probe.
-	bucket := &task.buckets[minute%probeMinuteBucketLen]
-	if !bucket.filled || bucket.minute != minute {
-		bucket.minute = minute
-		bucket.filled = true
-		bucket.stats = newProbeAggregate()
-	}
-	bucket.stats.addResponse(sample.responseMs)
-}
-
-// executeProbe runs the configured probe and records the sample.
-func (pm *ProbeManager) executeProbe(task *probeTask) {
-	var responseMs float64
-
-	switch task.config.Protocol {
-	case "icmp":
-		responseMs = probeICMP(task.config.Target)
-	case "tcp":
-		responseMs = probeTCP(task.config.Target, task.config.Port)
-	case "http":
-		responseMs = probeHTTP(pm.httpClient, task.config.Target)
-	default:
-		slog.Warn("unknown probe protocol", "protocol", task.config.Protocol)
-		return
-	}
-
-	sample := probeSample{
-		responseMs: responseMs,
-		timestamp:  time.Now(),
-	}
-
-	task.mu.Lock()
-	task.addSampleLocked(sample)
-	task.mu.Unlock()
-}
-
-// probeTCP measures pure TCP handshake response (excluding DNS resolution).
-// Returns -1 on failure.
-func probeTCP(target string, port uint16) float64 {
-	// Resolve DNS first, outside the timing window
-	ips, err := net.LookupHost(target)
-	if err != nil || len(ips) == 0 {
-		return -1
-	}
-	addr := net.JoinHostPort(ips[0], fmt.Sprintf("%d", port))
-
-	// Measure only the TCP handshake
-	start := time.Now()
-	conn, err := net.DialTimeout("tcp", addr, 3*time.Second)
-	if err != nil {
-		return -1
-	}
-	conn.Close()
-	return float64(time.Since(start).Microseconds()) / 1000.0
-}
-
-// probeHTTP measures HTTP GET request response. Returns -1 on failure.
-func probeHTTP(client *http.Client, url string) float64 {
-	start := time.Now()
-	resp, err := client.Get(url)
-	if err != nil {
-		return -1
-	}
-	resp.Body.Close()
-	if resp.StatusCode >= 400 {
-		return -1
-	}
-	return float64(time.Since(start).Microseconds()) / 1000.0
-}

agent/probe_ping.go

@@ -1,242 +0,0 @@
-package agent
-
-import (
-	"net"
-	"os"
-	"os/exec"
-	"regexp"
-	"runtime"
-	"strconv"
-	"sync"
-	"time"
-
-	"golang.org/x/net/icmp"
-	"golang.org/x/net/ipv4"
-	"golang.org/x/net/ipv6"
-
-	"log/slog"
-)
-
-var pingTimeRegex = regexp.MustCompile(`time[=<]([\d.]+)\s*ms`)
-
-type icmpPacketConn interface {
-	Close() error
-}
-
-// icmpMethod tracks which ICMP approach to use. Once a method succeeds or
-// all native methods fail, the choice is cached so subsequent probes skip
-// the trial-and-error overhead.
-type icmpMethod int
-
-const (
-	icmpUntried      icmpMethod = iota // haven't tried yet
-	icmpRaw                            // privileged raw socket
-	icmpDatagram                       // unprivileged datagram socket
-	icmpExecFallback                   // shell out to system ping command
-)
-
-// icmpFamily holds the network parameters and cached detection result for one address family.
-type icmpFamily struct {
-	rawNetwork   string    // e.g. "ip4:icmp" or "ip6:ipv6-icmp"
-	dgramNetwork string    // e.g. "udp4" or "udp6"
-	listenAddr   string    // "0.0.0.0" or "::"
-	echoType     icmp.Type // outgoing echo request type
-	replyType    icmp.Type // expected echo reply type
-	proto        int       // IANA protocol number for parsing replies
-	isIPv6       bool
-	mode         icmpMethod // cached detection result (guarded by icmpModeMu)
-}
-
-var (
-	icmpV4 = icmpFamily{
-		rawNetwork:   "ip4:icmp",
-		dgramNetwork: "udp4",
-		listenAddr:   "0.0.0.0",
-		echoType:     ipv4.ICMPTypeEcho,
-		replyType:    ipv4.ICMPTypeEchoReply,
-		proto:        1,
-	}
-	icmpV6 = icmpFamily{
-		rawNetwork:   "ip6:ipv6-icmp",
-		dgramNetwork: "udp6",
-		listenAddr:   "::",
-		echoType:     ipv6.ICMPTypeEchoRequest,
-		replyType:    ipv6.ICMPTypeEchoReply,
-		proto:        58,
-		isIPv6:       true,
-	}
-	icmpModeMu sync.Mutex
-	icmpListen = func(network, listenAddr string) (icmpPacketConn, error) {
-		return icmp.ListenPacket(network, listenAddr)
-	}
-)
-
-// probeICMP sends an ICMP echo request and measures round-trip response.
-// Supports both IPv4 and IPv6 targets. The ICMP method (raw socket,
-// unprivileged datagram, or exec fallback) is detected once per address
-// family and cached for subsequent probes.
-// Returns response in milliseconds, or -1 on failure.
-func probeICMP(target string) float64 {
-	family, ip := resolveICMPTarget(target)
-	if family == nil {
-		return -1
-	}
-
-	icmpModeMu.Lock()
-	if family.mode == icmpUntried {
-		family.mode = detectICMPMode(family, icmpListen)
-	}
-	mode := family.mode
-	icmpModeMu.Unlock()
-
-	switch mode {
-	case icmpRaw:
-		return probeICMPNative(family.rawNetwork, family, &net.IPAddr{IP: ip})
-	case icmpDatagram:
-		return probeICMPNative(family.dgramNetwork, family, &net.UDPAddr{IP: ip})
-	case icmpExecFallback:
-		return probeICMPExec(target, family.isIPv6)
-	default:
-		return -1
-	}
-}
-
-// resolveICMPTarget resolves a target hostname or IP to determine the address
-// family and concrete IP address. Prefers IPv4 for dual-stack hostnames.
-func resolveICMPTarget(target string) (*icmpFamily, net.IP) {
-	if ip := net.ParseIP(target); ip != nil {
-		if ip.To4() != nil {
-			return &icmpV4, ip.To4()
-		}
-		return &icmpV6, ip
-	}
-
-	ips, err := net.LookupIP(target)
-	if err != nil || len(ips) == 0 {
-		return nil, nil
-	}
-	for _, ip := range ips {
-		if v4 := ip.To4(); v4 != nil {
-			return &icmpV4, v4
-		}
-	}
-	return &icmpV6, ips[0]
-}
-
-func detectICMPMode(family *icmpFamily, listen func(network, listenAddr string) (icmpPacketConn, error)) icmpMethod {
-	label := "IPv4"
-	if family.isIPv6 {
-		label = "IPv6"
-	}
-
-	if conn, err := listen(family.rawNetwork, family.listenAddr); err == nil {
-		conn.Close()
-		slog.Info("ICMP probe using raw socket", "family", label)
-		return icmpRaw
-	} else {
-		slog.Debug("ICMP raw socket unavailable", "family", label, "err", err)
-	}
-
-	if conn, err := listen(family.dgramNetwork, family.listenAddr); err == nil {
-		conn.Close()
-		slog.Info("ICMP probe using unprivileged datagram socket", "family", label)
-		return icmpDatagram
-	} else {
-		slog.Debug("ICMP datagram socket unavailable", "family", label, "err", err)
-	}
-
-	slog.Info("ICMP probe falling back to system ping command", "family", label)
-	return icmpExecFallback
-}
-
-// probeICMPNative sends an ICMP echo request using Go's x/net/icmp package.
-func probeICMPNative(network string, family *icmpFamily, dst net.Addr) float64 {
-	conn, err := icmp.ListenPacket(network, family.listenAddr)
-	if err != nil {
-		return -1
-	}
-	defer conn.Close()
-
-	// Build ICMP echo request
-	msg := &icmp.Message{
-		Type: family.echoType,
-		Code: 0,
-		Body: &icmp.Echo{
-			ID:   os.Getpid() & 0xffff,
-			Seq:  1,
-			Data: []byte("beszel-probe"),
-		},
-	}
-	msgBytes, err := msg.Marshal(nil)
-	if err != nil {
-		return -1
-	}
-
-	// Set deadline before sending
-	conn.SetDeadline(time.Now().Add(3 * time.Second))
-
-	start := time.Now()
-	if _, err := conn.WriteTo(msgBytes, dst); err != nil {
-		return -1
-	}
-
-	// Read reply
-	buf := make([]byte, 1500)
-	for {
-		n, _, err := conn.ReadFrom(buf)
-		if err != nil {
-			return -1
-		}
-
-		reply, err := icmp.ParseMessage(family.proto, buf[:n])
-		if err != nil {
-			return -1
-		}
-
-		if reply.Type == family.replyType {
-			return float64(time.Since(start).Microseconds()) / 1000.0
-		}
-		// Ignore non-echo-reply messages (e.g. destination unreachable) and keep reading
-	}
-}
-
-// probeICMPExec falls back to the system ping command. Returns -1 on failure.
-func probeICMPExec(target string, isIPv6 bool) float64 {
-	var cmd *exec.Cmd
-	switch runtime.GOOS {
-	case "windows":
-		if isIPv6 {
-			cmd = exec.Command("ping", "-6", "-n", "1", "-w", "3000", target)
-		} else {
-			cmd = exec.Command("ping", "-n", "1", "-w", "3000", target)
-		}
-	default: // linux, darwin, freebsd
-		if isIPv6 {
-			cmd = exec.Command("ping", "-6", "-c", "1", "-W", "3", target)
-		} else {
-			cmd = exec.Command("ping", "-c", "1", "-W", "3", target)
-		}
-	}
-
-	start := time.Now()
-	output, err := cmd.Output()
-	if err != nil {
-		// If ping fails but we got output, still try to parse
-		if len(output) == 0 {
-			return -1
-		}
-	}
-
-	matches := pingTimeRegex.FindSubmatch(output)
-	if len(matches) >= 2 {
-		if ms, err := strconv.ParseFloat(string(matches[1]), 64); err == nil {
-			return ms
-		}
-	}
-
-	// Fallback: use wall clock time if ping succeeded but parsing failed
-	if err == nil {
-		return float64(time.Since(start).Microseconds()) / 1000.0
-	}
-	return -1
-}

agent/probe_ping_test.go

@@ -1,118 +0,0 @@
-//go:build testing
-
-package agent
-
-import (
-	"errors"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-type testICMPPacketConn struct{}
-
-func (testICMPPacketConn) Close() error { return nil }
-
-func TestDetectICMPMode(t *testing.T) {
-	tests := []struct {
-		name         string
-		family       *icmpFamily
-		rawErr       error
-		udpErr       error
-		want         icmpMethod
-		wantNetworks []string
-	}{
-		{
-			name:         "IPv4 prefers raw socket when available",
-			family:       &icmpV4,
-			want:         icmpRaw,
-			wantNetworks: []string{"ip4:icmp"},
-		},
-		{
-			name:         "IPv4 uses datagram when raw unavailable",
-			family:       &icmpV4,
-			rawErr:       errors.New("operation not permitted"),
-			want:         icmpDatagram,
-			wantNetworks: []string{"ip4:icmp", "udp4"},
-		},
-		{
-			name:         "IPv4 falls back to exec when both unavailable",
-			family:       &icmpV4,
-			rawErr:       errors.New("operation not permitted"),
-			udpErr:       errors.New("protocol not supported"),
-			want:         icmpExecFallback,
-			wantNetworks: []string{"ip4:icmp", "udp4"},
-		},
-		{
-			name:         "IPv6 prefers raw socket when available",
-			family:       &icmpV6,
-			want:         icmpRaw,
-			wantNetworks: []string{"ip6:ipv6-icmp"},
-		},
-		{
-			name:         "IPv6 uses datagram when raw unavailable",
-			family:       &icmpV6,
-			rawErr:       errors.New("operation not permitted"),
-			want:         icmpDatagram,
-			wantNetworks: []string{"ip6:ipv6-icmp", "udp6"},
-		},
-		{
-			name:         "IPv6 falls back to exec when both unavailable",
-			family:       &icmpV6,
-			rawErr:       errors.New("operation not permitted"),
-			udpErr:       errors.New("protocol not supported"),
-			want:         icmpExecFallback,
-			wantNetworks: []string{"ip6:ipv6-icmp", "udp6"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			calls := make([]string, 0, 2)
-			listen := func(network, listenAddr string) (icmpPacketConn, error) {
-				require.Equal(t, tt.family.listenAddr, listenAddr)
-				calls = append(calls, network)
-				switch network {
-				case tt.family.rawNetwork:
-					if tt.rawErr != nil {
-						return nil, tt.rawErr
-					}
-				case tt.family.dgramNetwork:
-					if tt.udpErr != nil {
-						return nil, tt.udpErr
-					}
-				default:
-					t.Fatalf("unexpected network %q", network)
-				}
-				return testICMPPacketConn{}, nil
-			}
-
-			assert.Equal(t, tt.want, detectICMPMode(tt.family, listen))
-			assert.Equal(t, tt.wantNetworks, calls)
-		})
-	}
-}
-
-func TestResolveICMPTarget(t *testing.T) {
-	t.Run("IPv4 literal", func(t *testing.T) {
-		family, ip := resolveICMPTarget("127.0.0.1")
-		require.NotNil(t, family)
-		assert.False(t, family.isIPv6)
-		assert.Equal(t, "127.0.0.1", ip.String())
-	})
-
-	t.Run("IPv6 literal", func(t *testing.T) {
-		family, ip := resolveICMPTarget("::1")
-		require.NotNil(t, family)
-		assert.True(t, family.isIPv6)
-		assert.Equal(t, "::1", ip.String())
-	})
-
-	t.Run("IPv4-mapped IPv6 resolves as IPv4", func(t *testing.T) {
-		family, ip := resolveICMPTarget("::ffff:127.0.0.1")
-		require.NotNil(t, family)
-		assert.False(t, family.isIPv6)
-		assert.Equal(t, "127.0.0.1", ip.String())
-	})
-}

agent/probe_test.go

@@ -1,216 +0,0 @@
-package agent
-
-import (
-	"net"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"github.com/henrygd/beszel/internal/entities/probe"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestProbeTaskAggregateLockedUsesRawSamplesForShortWindows(t *testing.T) {
-	now := time.Date(2026, time.April, 21, 12, 0, 0, 0, time.UTC)
-	task := &probeTask{}
-
-	task.addSampleLocked(probeSample{responseMs: 10, timestamp: now.Add(-90 * time.Second)})
-	task.addSampleLocked(probeSample{responseMs: 20, timestamp: now.Add(-30 * time.Second)})
-	task.addSampleLocked(probeSample{responseMs: -1, timestamp: now.Add(-10 * time.Second)})
-
-	agg := task.aggregateLocked(time.Minute, now)
-	require.True(t, agg.hasData())
-	assert.Equal(t, 2, agg.totalCount)
-	assert.Equal(t, 1, agg.successCount)
-	assert.Equal(t, 20.0, agg.result()[0])
-	assert.Equal(t, 20.0, agg.result()[1])
-	assert.Equal(t, 20.0, agg.result()[2])
-	assert.Equal(t, 50.0, agg.result()[3])
-}
-
-func TestProbeTaskAggregateLockedUsesMinuteBucketsForLongWindows(t *testing.T) {
-	now := time.Date(2026, time.April, 21, 12, 0, 30, 0, time.UTC)
-	task := &probeTask{}
-
-	task.addSampleLocked(probeSample{responseMs: 10, timestamp: now.Add(-11 * time.Minute)})
-	task.addSampleLocked(probeSample{responseMs: 20, timestamp: now.Add(-9 * time.Minute)})
-	task.addSampleLocked(probeSample{responseMs: 40, timestamp: now.Add(-5 * time.Minute)})
-	task.addSampleLocked(probeSample{responseMs: -1, timestamp: now.Add(-90 * time.Second)})
-	task.addSampleLocked(probeSample{responseMs: 30, timestamp: now.Add(-30 * time.Second)})
-
-	agg := task.aggregateLocked(10*time.Minute, now)
-	require.True(t, agg.hasData())
-	assert.Equal(t, 4, agg.totalCount)
-	assert.Equal(t, 3, agg.successCount)
-	assert.Equal(t, 30.0, agg.result()[0])
-	assert.Equal(t, 20.0, agg.result()[1])
-	assert.Equal(t, 40.0, agg.result()[2])
-	assert.Equal(t, 25.0, agg.result()[3])
-}
-
-func TestProbeTaskAddSampleLockedTrimsRawSamplesButKeepsBucketHistory(t *testing.T) {
-	now := time.Date(2026, time.April, 21, 12, 0, 0, 0, time.UTC)
-	task := &probeTask{}
-
-	task.addSampleLocked(probeSample{responseMs: 10, timestamp: now.Add(-10 * time.Minute)})
-	task.addSampleLocked(probeSample{responseMs: 20, timestamp: now})
-
-	require.Len(t, task.samples, 1)
-	assert.Equal(t, 20.0, task.samples[0].responseMs)
-
-	agg := task.aggregateLocked(10*time.Minute, now)
-	require.True(t, agg.hasData())
-	assert.Equal(t, 2, agg.totalCount)
-	assert.Equal(t, 2, agg.successCount)
-	assert.Equal(t, 15.0, agg.result()[0])
-	assert.Equal(t, 10.0, agg.result()[1])
-	assert.Equal(t, 20.0, agg.result()[2])
-	assert.Equal(t, 0.0, agg.result()[3])
-}
-
-func TestProbeManagerGetResultsIncludesHourResponseRange(t *testing.T) {
-	now := time.Now().UTC()
-	task := &probeTask{config: probe.Config{ID: "probe-1"}}
-	task.addSampleLocked(probeSample{responseMs: 10, timestamp: now.Add(-30 * time.Minute)})
-	task.addSampleLocked(probeSample{responseMs: 20, timestamp: now.Add(-9 * time.Minute)})
-	task.addSampleLocked(probeSample{responseMs: 40, timestamp: now.Add(-5 * time.Minute)})
-	task.addSampleLocked(probeSample{responseMs: -1, timestamp: now.Add(-90 * time.Second)})
-	task.addSampleLocked(probeSample{responseMs: 30, timestamp: now.Add(-30 * time.Second)})
-
-	pm := &ProbeManager{probes: map[string]*probeTask{"icmp:example.com": task}}
-
-	results := pm.GetResults(uint16(time.Minute / time.Millisecond))
-	result, ok := results["probe-1"]
-	require.True(t, ok)
-	require.Len(t, result, 5)
-	assert.Equal(t, 30.0, result[0])
-	assert.Equal(t, 25.0, result[1])
-	assert.Equal(t, 10.0, result[2])
-	assert.Equal(t, 40.0, result[3])
-	assert.Equal(t, 20.0, result[4])
-}
-
-func TestProbeManagerGetResultsIncludesLossOnlyHourData(t *testing.T) {
-	now := time.Now().UTC()
-	task := &probeTask{config: probe.Config{ID: "probe-1"}}
-	task.addSampleLocked(probeSample{responseMs: -1, timestamp: now.Add(-30 * time.Second)})
-	task.addSampleLocked(probeSample{responseMs: -1, timestamp: now.Add(-10 * time.Second)})
-
-	pm := &ProbeManager{probes: map[string]*probeTask{"icmp:example.com": task}}
-
-	results := pm.GetResults(uint16(time.Minute / time.Millisecond))
-	result, ok := results["probe-1"]
-	require.True(t, ok)
-	require.Len(t, result, 5)
-	assert.Equal(t, 0.0, result[0])
-	assert.Equal(t, 0.0, result[1])
-	assert.Equal(t, 0.0, result[2])
-	assert.Equal(t, 0.0, result[3])
-	assert.Equal(t, 100.0, result[4])
-}
-
-func TestProbeConfigResultKeyUsesSyncedID(t *testing.T) {
-	cfg := probe.Config{ID: "probe-1", Target: "1.1.1.1", Protocol: "icmp", Interval: 10}
-	assert.Equal(t, "probe-1", cfg.ID)
-}
-
-func TestProbeManagerSyncProbesSkipsConfigsWithoutStableID(t *testing.T) {
-	validCfg := probe.Config{ID: "probe-1", Target: "https://example.com", Protocol: "http", Interval: 10}
-	invalidCfg := probe.Config{Target: "1.1.1.1", Protocol: "icmp", Interval: 10}
-
-	pm := newProbeManager()
-	pm.SyncProbes([]probe.Config{validCfg, invalidCfg})
-	defer pm.Stop()
-
-	_, validExists := pm.probes[validCfg.ID]
-	_, invalidExists := pm.probes[invalidCfg.ID]
-	assert.True(t, validExists)
-	assert.False(t, invalidExists)
-}
-
-func TestProbeManagerSyncProbesStopsRemovedTasksButKeepsExisting(t *testing.T) {
-	keepCfg := probe.Config{ID: "probe-1", Target: "https://example.com", Protocol: "http", Interval: 10}
-	removeCfg := probe.Config{ID: "probe-2", Target: "1.1.1.1", Protocol: "icmp", Interval: 10}
-
-	keptTask := &probeTask{config: keepCfg, cancel: make(chan struct{})}
-	removedTask := &probeTask{config: removeCfg, cancel: make(chan struct{})}
-	pm := &ProbeManager{
-		probes: map[string]*probeTask{
-			keepCfg.ID:   keptTask,
-			removeCfg.ID: removedTask,
-		},
-	}
-
-	pm.SyncProbes([]probe.Config{keepCfg})
-
-	assert.Same(t, keptTask, pm.probes[keepCfg.ID])
-	_, exists := pm.probes[removeCfg.ID]
-	assert.False(t, exists)
-
-	select {
-	case <-removedTask.cancel:
-	default:
-		t.Fatal("expected removed probe task to be cancelled")
-	}
-
-	select {
-	case <-keptTask.cancel:
-		t.Fatal("expected existing probe task to remain active")
-	default:
-	}
-}
-
-func TestProbeHTTP(t *testing.T) {
-	t.Run("success", func(t *testing.T) {
-		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			w.WriteHeader(http.StatusNoContent)
-		}))
-		defer server.Close()
-
-		responseMs := probeHTTP(server.Client(), server.URL)
-		assert.GreaterOrEqual(t, responseMs, 0.0)
-	})
-
-	t.Run("server error", func(t *testing.T) {
-		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			http.Error(w, "boom", http.StatusInternalServerError)
-		}))
-		defer server.Close()
-
-		assert.Equal(t, -1.0, probeHTTP(server.Client(), server.URL))
-	})
-}
-
-func TestProbeTCP(t *testing.T) {
-	t.Run("success", func(t *testing.T) {
-		listener, err := net.Listen("tcp", "127.0.0.1:0")
-		require.NoError(t, err)
-		defer listener.Close()
-
-		accepted := make(chan struct{})
-		go func() {
-			defer close(accepted)
-			conn, err := listener.Accept()
-			if err == nil {
-				_ = conn.Close()
-			}
-		}()
-
-		port := uint16(listener.Addr().(*net.TCPAddr).Port)
-		responseMs := probeTCP("127.0.0.1", port)
-		assert.GreaterOrEqual(t, responseMs, 0.0)
-		<-accepted
-	})
-
-	t.Run("connection failure", func(t *testing.T) {
-		listener, err := net.Listen("tcp", "127.0.0.1:0")
-		require.NoError(t, err)
-
-		port := uint16(listener.Addr().(*net.TCPAddr).Port)
-		require.NoError(t, listener.Close())
-
-		assert.Equal(t, -1.0, probeTCP("127.0.0.1", port))
-	})
-}

agent/response.go

@@ -21,6 +21,9 @@ func newAgentResponse(data any, requestID *uint32) common.AgentResponse {
 		response.String = &v
 	case map[string]smart.SmartData:
 		response.SmartData = v
+	case smart.SmartDataResponse:
+		response.SmartData = v.Data
+		response.SmartComplete = v.Complete
 	case systemd.ServiceDetails:
 		response.ServiceInfo = v
 	default:

agent/server.go

@@ -29,9 +29,6 @@ type ServerOptions struct {
 	Keys    []gossh.PublicKey // SSH public keys for authentication
 }
 
-// hubVersions caches hub versions by session ID to avoid repeated parsing.
-var hubVersions map[string]semver.Version
-
 // StartServer starts the SSH server with the provided options.
 // It configures the server with secure defaults, sets up authentication,
 // and begins listening for connections. Returns an error if the server
@@ -99,24 +96,15 @@ func (a *Agent) StartServer(opts ServerOptions) error {
 	return a.server.Serve(ln)
 }
 
-// getHubVersion retrieves and caches the hub version for a given session.
-// It extracts the version from the SSH client version string and caches
-// it to avoid repeated parsing. Returns a zero version if parsing fails.
-func (a *Agent) getHubVersion(sessionId string, sessionCtx ssh.Context) semver.Version {
-	if hubVersions == nil {
-		hubVersions = make(map[string]semver.Version, 1)
-	}
-	hubVersion, ok := hubVersions[sessionId]
-	if ok {
-		return hubVersion
-	}
-	// Extract hub version from SSH client version
+// getHubVersion extracts the hub version from the SSH client version string
+// for a given session. Returns a zero version if parsing fails.
+func (a *Agent) getHubVersion(sessionCtx ssh.Context) semver.Version {
 	clientVersion := sessionCtx.Value(ssh.ContextKeyClientVersion)
 	if versionStr, ok := clientVersion.(string); ok {
-		hubVersion, _ = extractHubVersion(versionStr)
+		hubVersion, _ := extractHubVersion(versionStr)
+		return hubVersion
 	}
-	hubVersions[sessionId] = hubVersion
-	return hubVersion
+	return semver.Version{}
 }
 
 // handleSession handles an incoming SSH session by gathering system statistics
@@ -127,9 +115,8 @@ func (a *Agent) handleSession(s ssh.Session) {
 	a.connectionManager.eventChan <- SSHConnect
 
 	sessionCtx := s.Context()
-	sessionID := sessionCtx.SessionID()
 
-	hubVersion := a.getHubVersion(sessionID, sessionCtx)
+	hubVersion := a.getHubVersion(sessionCtx)
 
 	// Legacy one-shot behavior for older hubs
 	if hubVersion.LT(beszel.MinVersionAgentResponse) {

agent/server_test.go

@@ -404,27 +404,23 @@ func TestGetHubVersion(t *testing.T) {
 		clientVersion: "SSH-2.0-beszel_0.12.0",
 	}
 
-	// Test first call - should extract and cache version
-	version := agent.getHubVersion("test-session-123", mockCtx)
+	// Test first call - should extract version
+	version := agent.getHubVersion(mockCtx)
 	assert.Equal(t, "0.12.0", version.String())
 
-	// Test second call - should return cached version
-	mockCtx.clientVersion = "SSH-2.0-beszel_0.11.0" // Change version but should still return cached
-	version = agent.getHubVersion("test-session-123", mockCtx)
-	assert.Equal(t, "0.12.0", version.String()) // Should still be cached version
-
-	// Test different session - should extract new version
-	version = agent.getHubVersion("different-session", mockCtx)
+	// Test that version reflects the current client version (no stale caching)
+	mockCtx.clientVersion = "SSH-2.0-beszel_0.11.0"
+	version = agent.getHubVersion(mockCtx)
 	assert.Equal(t, "0.11.0", version.String())
 
 	// Test with invalid version string (non-beszel client)
 	mockCtx.clientVersion = "SSH-2.0-OpenSSH_8.0"
-	version = agent.getHubVersion("invalid-session", mockCtx)
+	version = agent.getHubVersion(mockCtx)
 	assert.Equal(t, "0.0.0", version.String()) // Should be empty version for non-beszel clients
 
 	// Test with no client version
 	mockCtx.clientVersion = ""
-	version = agent.getHubVersion("no-version-session", mockCtx)
+	version = agent.getHubVersion(mockCtx)
 	assert.True(t, version.EQ(semver.Version{})) // Should be empty version
 }
 
@@ -501,9 +497,6 @@ func TestWriteToSessionEncoding(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			// Reset the global hubVersions map to ensure clean state for each test
-			hubVersions = nil
-
 			agent, err := NewAgent("")
 			require.NoError(t, err)
 
@@ -585,39 +578,28 @@ func createTestCombinedData() *system.CombinedData {
 	}
 }
 
-func TestHubVersionCaching(t *testing.T) {
-	// Reset the global hubVersions map to ensure clean state
-	hubVersions = nil
-
+// TestGetHubVersionConcurrent guards against a regression of the
+// "concurrent map writes" panic previously caused by a shared, unsynchronized
+// hubVersions cache (see https://github.com/henrygd/beszel/issues/2128).
+// getHubVersion no longer shares mutable state between sessions, so calling
+// it concurrently from many goroutines must be safe under `go test -race`.
+func TestGetHubVersionConcurrent(t *testing.T) {
 	agent, err := NewAgent("")
 	require.NoError(t, err)
 
-	ctx1 := &mockSSHContext{
-		sessionID:     "session1",
-		clientVersion: "SSH-2.0-beszel_0.12.0",
+	const goroutines = 50
+	var wg sync.WaitGroup
+	wg.Add(goroutines)
+	for i := 0; i < goroutines; i++ {
+		go func(i int) {
+			defer wg.Done()
+			ctx := &mockSSHContext{
+				sessionID:     fmt.Sprintf("session-%d", i),
+				clientVersion: "SSH-2.0-beszel_0.12.0",
+			}
+			version := agent.getHubVersion(ctx)
+			assert.Equal(t, "0.12.0", version.String())
+		}(i)
 	}
-	ctx2 := &mockSSHContext{
-		sessionID:     "session2",
-		clientVersion: "SSH-2.0-beszel_0.11.0",
-	}
-
-	// First calls should cache the versions
-	v1 := agent.getHubVersion("session1", ctx1)
-	v2 := agent.getHubVersion("session2", ctx2)
-
-	assert.Equal(t, "0.12.0", v1.String())
-	assert.Equal(t, "0.11.0", v2.String())
-
-	// Verify caching by changing context but keeping same session ID
-	ctx1.clientVersion = "SSH-2.0-beszel_0.10.0"
-	v1Cached := agent.getHubVersion("session1", ctx1)
-	assert.Equal(t, "0.12.0", v1Cached.String()) // Should still be cached version
-
-	// New session should get new version
-	ctx3 := &mockSSHContext{
-		sessionID:     "session3",
-		clientVersion: "SSH-2.0-beszel_0.13.0",
-	}
-	v3 := agent.getHubVersion("session3", ctx3)
-	assert.Equal(t, "0.13.0", v3.String())
+	wg.Wait()
 }

agent/smart.go

@@ -55,6 +55,11 @@ type DeviceInfo struct {
 	typeVerified bool
 	// parserType holds the parser type (nvme, sat, scsi) that last succeeded.
 	parserType string
+	// explicitType reports whether Type came from an explicit ":type" hint in
+	// SMART_DEVICES. Such a type is a deliberate user override and must always be
+	// passed to smartctl via -d, even for scsi/ata where a scan-detected type is
+	// otherwise left off (see smartctlArgs and issue #1345).
+	explicitType bool
 }
 
 // deviceKey is a composite key for a device, used to identify a device uniquely.
@@ -65,8 +70,9 @@ type deviceKey struct {
 
 var errNoValidSmartData = fmt.Errorf("no valid SMART data found") // Error for missing data
 
-// Refresh updates SMART data for all known devices
-func (sm *SmartManager) Refresh(forceScan bool) error {
+// Refresh updates SMART data for all known devices and reports whether every
+// discovered device was collected successfully.
+func (sm *SmartManager) Refresh(forceScan bool) (bool, error) {
 	sm.refreshMutex.Lock()
 	defer sm.refreshMutex.Unlock()
 
@@ -87,7 +93,7 @@ func (sm *SmartManager) Refresh(forceScan bool) error {
 		}
 	}
 
-	return sm.resolveRefreshError(scanErr, collectErr)
+	return scanErr == nil && collectErr == nil, sm.resolveRefreshError(scanErr, collectErr)
 }
 
 // devicesSnapshot returns a copy of the current device slice to avoid iterating
@@ -251,8 +257,9 @@ func (sm *SmartManager) parseConfiguredDevices(config string) ([]*DeviceInfo, er
 		}
 
 		devices = append(devices, &DeviceInfo{
-			Name: name,
-			Type: devType,
+			Name:         name,
+			Type:         devType,
+			explicitType: devType != "",
 		})
 	}
 
@@ -558,7 +565,9 @@ func (sm *SmartManager) smartctlArgs(deviceInfo *DeviceInfo, includeStandby bool
 		deviceType = strings.ToLower(deviceInfo.Type)
 		parserType = strings.ToLower(deviceInfo.parserType)
 		// types sometimes misidentified in scan; see github.com/henrygd/beszel/issues/1345
-		if deviceType != "" && deviceType != "scsi" && deviceType != "ata" {
+		// An explicit SMART_DEVICES ":type" hint is a deliberate override, so always
+		// pass it through; otherwise scsi/ata are left off so smartctl can auto-detect.
+		if deviceType != "" && (deviceInfo.explicitType || (deviceType != "scsi" && deviceType != "ata")) {
 			args = append(args, "-d", deviceInfo.Type)
 		}
 	}
@@ -663,6 +672,9 @@ func mergeDeviceLists(existing, scanned, configured []*DeviceInfo) []*DeviceInfo
 		target.Type = prev.Type
 		target.typeVerified = true
 		target.parserType = prev.parserType
+		if prev.explicitType {
+			target.explicitType = true
+		}
 	}
 
 	// applyConfiguredMetadata updates a matched device with any configured
@@ -676,6 +688,9 @@ func mergeDeviceLists(existing, scanned, configured []*DeviceInfo) []*DeviceInfo
 			existingDev.typeVerified = false
 			existingDev.parserType = normalizeParserType(newType)
 		}
+		if configuredDev.explicitType {
+			existingDev.explicitType = true
+		}
 		if configuredDev.InfoName != "" {
 			existingDev.InfoName = configuredDev.InfoName
 		}

agent/smart_test.go

@@ -392,6 +392,81 @@ func TestSmartctlArgs(t *testing.T) {
 	)
 }
 
+// TestSmartctlArgsExplicitType verifies that an explicit SMART_DEVICES type hint
+// is always passed to smartctl via -d, while a scan-detected scsi/ata type is
+// still left off so smartctl can auto-detect it (see issue #1345).
+func TestSmartctlArgsExplicitType(t *testing.T) {
+	sm := &SmartManager{}
+
+	// Scan-detected scsi: -d is intentionally omitted.
+	scanScsi := &DeviceInfo{Name: "/dev/sda", Type: "scsi"}
+	assert.Equal(t,
+		[]string{"-a", "--json=c", "/dev/sda"},
+		sm.smartctlArgs(scanScsi, false),
+	)
+
+	// Explicit scsi from SMART_DEVICES: -d scsi must be passed.
+	explicitScsi := &DeviceInfo{Name: "/dev/sda", Type: "scsi", explicitType: true}
+	assert.Equal(t,
+		[]string{"-d", "scsi", "-a", "--json=c", "/dev/sda"},
+		sm.smartctlArgs(explicitScsi, false),
+	)
+
+	// Explicit ata from SMART_DEVICES: -d ata must be passed (devstat still added).
+	explicitAta := &DeviceInfo{Name: "/dev/sdb", Type: "ata", explicitType: true}
+	assert.Equal(t,
+		[]string{"-d", "ata", "-a", "--json=c", "-l", "devstat", "/dev/sdb"},
+		sm.smartctlArgs(explicitAta, false),
+	)
+}
+
+// TestSmartDevicesExplicitTypeFlowsToSmartctlArgs is a regression test for
+// issue #2072: an explicit SMART_DEVICES type (e.g. /dev/sda:scsi) must win over
+// a wrong scan-detected type (sat) and be handed to smartctl as -d scsi.
+func TestSmartDevicesExplicitTypeFlowsToSmartctlArgs(t *testing.T) {
+	sm := &SmartManager{}
+
+	configured, err := sm.parseConfiguredDevices("/dev/sda:scsi")
+	require.NoError(t, err)
+	require.Len(t, configured, 1)
+	assert.True(t, configured[0].explicitType)
+
+	// smartctl --scan misreports this USB drive as sat, which fails on it.
+	scanned := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "sat", Protocol: "ATA"},
+	}
+
+	merged := mergeDeviceLists(nil, scanned, configured)
+	require.Len(t, merged, 1)
+
+	device := merged[0]
+	assert.Equal(t, "scsi", device.Type, "configured type should win over scan-detected sat")
+	assert.True(t, device.explicitType, "explicit hint must survive the merge")
+
+	assert.Equal(t,
+		[]string{"-d", "scsi", "-a", "--json=c", "/dev/sda"},
+		sm.smartctlArgs(device, false),
+		"explicit scsi type must be passed to smartctl, not dropped",
+	)
+}
+
+// TestMergeDeviceListsPreservesExplicitTypeAcrossRescan ensures a verified,
+// explicitly-typed device keeps its explicit flag when a later scan re-reports
+// it with a different auto-detected type.
+func TestMergeDeviceListsPreservesExplicitTypeAcrossRescan(t *testing.T) {
+	existing := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "scsi", parserType: "scsi", typeVerified: true, explicitType: true},
+	}
+	scanned := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "sat"},
+	}
+
+	merged := mergeDeviceLists(existing, scanned, nil)
+	require.Len(t, merged, 1)
+	assert.Equal(t, "scsi", merged[0].Type)
+	assert.True(t, merged[0].explicitType, "explicit type flag should survive a rescan")
+}
+
 func TestResolveRefreshError(t *testing.T) {
 	scanErr := errors.New("scan failed")
 	collectErr := errors.New("collect failed")

agent/system.go

@@ -169,21 +169,11 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 
 	// memory
 	if v, err := mem.VirtualMemory(); err == nil {
+		used, cacheBuff, swapUsed := calculateHostMemoryUsage(v, a.memCalc == "htop")
 		// swap
 		systemStats.Swap = utils.BytesToGigabytes(v.SwapTotal)
-		systemStats.SwapUsed = utils.BytesToGigabytes(v.SwapTotal - v.SwapFree - v.SwapCached)
-		// cache + buffers value for default mem calculation
-		// note: gopsutil automatically adds SReclaimable to v.Cached
-		cacheBuff := v.Cached + v.Buffers - v.Shared
-		if cacheBuff <= 0 {
-			cacheBuff = max(v.Total-v.Free-v.Used, 0)
-		}
-		// htop memory calculation overrides (likely outdated as of mid 2025)
-		if a.memCalc == "htop" {
-			// cacheBuff = v.Cached + v.Buffers - v.Shared
-			v.Used = v.Total - (v.Free + cacheBuff)
-			v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
-		}
+		systemStats.SwapUsed = utils.BytesToGigabytes(swapUsed)
+		v.Used = used
 		// if a.memCalc == "legacy" {
 		// 	v.Used = v.Total - v.Free - v.Buffers - v.Cached
 		// 	cacheBuff = v.Total - v.Free - v.Used
@@ -193,10 +183,14 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 		if a.zfs {
 			if arcSize, _ := zfs.ARCSize(); arcSize > 0 && arcSize < v.Used {
 				v.Used = v.Used - arcSize
-				v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
 				systemStats.MemZfsArc = utils.BytesToGigabytes(arcSize)
 			}
 		}
+		if v.Total > 0 {
+			v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
+		} else {
+			v.UsedPercent = 0
+		}
 		systemStats.Mem = utils.BytesToGigabytes(v.Total)
 		systemStats.MemBuffCache = utils.BytesToGigabytes(cacheBuff)
 		systemStats.MemUsed = utils.BytesToGigabytes(v.Used)
@@ -216,6 +210,9 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 	// TODO: maybe refactor to methods on systemStats
 	a.updateTemperatures(&systemStats)
 
+	// fan speeds (Linux-only; sysfs hwmon)
+	a.updateFans(&systemStats)
+
 	// GPU data
 	if a.gpuManager != nil {
 		// reset high gpu percent
@@ -263,6 +260,38 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 	return systemStats
 }
 
+// calculateHostMemoryUsage derives counters defensively because /proc/meminfo may
+// change while gopsutil reads it. Invalid unsigned subtractions saturate at zero.
+func calculateHostMemoryUsage(v *mem.VirtualMemoryStat, htop bool) (used, cacheBuff, swapUsed uint64) {
+	used = v.Used
+	if used > v.Total {
+		used = saturatingSub(v.Total, v.Available)
+	}
+
+	// gopsutil automatically adds SReclaimable to Cached.
+	cacheBuff = min(v.Cached, v.Total)
+	cacheBuff += min(v.Buffers, v.Total-cacheBuff)
+	cacheBuff = saturatingSub(cacheBuff, min(v.Shared, v.Total))
+	if v.Cached == 0 && v.Buffers == 0 {
+		cacheBuff = saturatingSub(v.Total, v.Free, used)
+	}
+	if htop {
+		used = saturatingSub(v.Total, v.Free, cacheBuff)
+	}
+	return used, cacheBuff, saturatingSub(v.SwapTotal, v.SwapFree, v.SwapCached)
+}
+
+// saturatingSub subtracts each value, returning zero on underflow.
+func saturatingSub(value uint64, subtrahends ...uint64) uint64 {
+	for _, subtrahend := range subtrahends {
+		if subtrahend > value {
+			return 0
+		}
+		value -= subtrahend
+	}
+	return value
+}
+
 // getOsPrettyName attempts to get the pretty OS name from /etc/os-release on Linux systems
 func getOsPrettyName() (string, error) {
 	file, err := os.Open("/etc/os-release")

agent/system_test.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/henrygd/beszel/internal/common"
 	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/shirou/gopsutil/v4/mem"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -33,6 +34,59 @@ func TestGatherStatsDoesNotAttachDetailsToCachedRequests(t *testing.T) {
 	assert.Nil(t, secondResponse.Details)
 }
 
+func TestCalculateHostMemoryUsage(t *testing.T) {
+	tests := []struct {
+		name                      string
+		memory                    mem.VirtualMemoryStat
+		htop                      bool
+		used, cacheBuff, swapUsed uint64
+	}{
+		{
+			name:      "normal",
+			memory:    mem.VirtualMemoryStat{Total: 100, Available: 40, Used: 60, Free: 20, Cached: 25, Buffers: 10, Shared: 5, SwapTotal: 20, SwapFree: 8, SwapCached: 2},
+			used:      60,
+			cacheBuff: 30,
+			swapUsed:  10,
+		},
+		{
+			name:      "inconsistent counters saturate",
+			memory:    mem.VirtualMemoryStat{Total: 100, Available: 110, Used: ^uint64(0) - 9, Free: 90, Cached: 5, Buffers: 10, Shared: 20, SwapTotal: 10, SwapFree: 9, SwapCached: 2},
+			used:      0,
+			cacheBuff: 0,
+			swapUsed:  0,
+		},
+		{
+			name:      "htop subtraction saturates",
+			memory:    mem.VirtualMemoryStat{Total: 100, Available: 20, Used: 80, Free: 90, Cached: 20, Buffers: 5, SwapTotal: 30, SwapFree: 10, SwapCached: 5},
+			htop:      true,
+			used:      0,
+			cacheBuff: 25,
+			swapUsed:  15,
+		},
+		{
+			name:      "zero cache from shared cancellation does not fall back",
+			memory:    mem.VirtualMemoryStat{Total: 100, Used: 60, Free: 10, Cached: 20, Buffers: 10, Shared: 30},
+			used:      60,
+			cacheBuff: 0,
+		},
+		{
+			name:      "absent cache counters use fallback",
+			memory:    mem.VirtualMemoryStat{Total: 100, Used: 60, Free: 10},
+			used:      60,
+			cacheBuff: 30,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			used, cacheBuff, swapUsed := calculateHostMemoryUsage(&tt.memory, tt.htop)
+			assert.Equal(t, tt.used, used)
+			assert.Equal(t, tt.cacheBuff, cacheBuff)
+			assert.Equal(t, tt.swapUsed, swapUsed)
+		})
+	}
+}
+
 func TestUpdateSystemDetailsMarksDetailsDirty(t *testing.T) {
 	agent := &Agent{}
 

go.mod

@@ -1,27 +1,27 @@
 module github.com/henrygd/beszel
 
-go 1.26.1
+go 1.26.6
 
 require (
 	github.com/blang/semver v3.5.1+incompatible
 	github.com/coreos/go-systemd/v22 v22.7.0
-	github.com/ebitengine/purego v0.10.0
-	github.com/fxamacker/cbor/v2 v2.9.0
+	github.com/ebitengine/purego v0.10.2
+	github.com/fxamacker/cbor/v2 v2.9.2
 	github.com/gliderlabs/ssh v0.3.8
 	github.com/google/uuid v1.6.0
-	github.com/lxzan/gws v1.9.1
-	github.com/nicholas-fedor/shoutrrr v0.14.3
+	github.com/lxzan/gws v1.10.1
+	github.com/nicholas-fedor/shoutrrr v0.17.0
 	github.com/pocketbase/dbx v1.12.0
-	github.com/pocketbase/pocketbase v0.36.8
-	github.com/shirou/gopsutil/v4 v4.26.3
+	github.com/pocketbase/pocketbase v0.39.10
+	github.com/shirou/gopsutil/v4 v4.26.7
 	github.com/spf13/cast v1.10.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
-	golang.org/x/crypto v0.49.0
-	golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90
-	golang.org/x/net v0.52.0
-	golang.org/x/sys v0.42.0
+	golang.org/x/crypto v0.55.0
+	golang.org/x/exp v0.0.0-20260811152304-ee035b5b010f
+	golang.org/x/net v0.57.0
+	golang.org/x/sys v0.47.0
 	gopkg.in/yaml.v3 v3.0.1
 	howett.net/plist v1.0.1
 )
@@ -35,34 +35,35 @@ require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/eclipse/paho.golang v0.23.0 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
-	github.com/ganigeorgiev/fexpr v0.5.0 // indirect
+	github.com/fsnotify/fsnotify v1.10.1 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.15 // indirect
+	github.com/ganigeorgiev/fexpr v0.6.0 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
-	github.com/go-ozzo/ozzo-validation/v4 v4.3.0 // indirect
 	github.com/go-sql-driver/mysql v1.9.1 // indirect
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/klauspost/compress v1.18.5 // indirect
-	github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749 // indirect
-	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/klauspost/compress v1.19.2 // indirect
+	github.com/lufia/plan9stats v0.0.0-20260802145828-341c2f0c90b5 // indirect
+	github.com/mattn/go-colorable v0.1.15 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
+	github.com/pocketbase/ozzo-validation/v4 v4.3.0 // indirect
+	github.com/power-devops/perfstat v0.0.0-20260805114148-88456608a4f6 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/tklauser/go-sysconf v0.3.16 // indirect
-	github.com/tklauser/numcpus v0.11.0 // indirect
+	github.com/tklauser/go-sysconf v0.4.0 // indirect
+	github.com/tklauser/numcpus v0.12.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	golang.org/x/image v0.38.0 // indirect
+	golang.org/x/image v0.45.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/term v0.41.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
-	modernc.org/libc v1.70.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	modernc.org/libc v1.74.1 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.11.0 // indirect
-	modernc.org/sqlite v1.48.0 // indirect
+	modernc.org/memory v1.12.0 // indirect
+	modernc.org/sqlite v1.55.0 // indirect
 )

go.sum

@@ -1,7 +1,7 @@
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
-github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
-github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
+github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/asaskevich/govalidator v0.0.0-20200108200545-475eaeb16496/go.mod h1:oGkLhpf+kjZl6xBf758TQhh5XrAeiJv/7FRz/2spLIg=
@@ -21,29 +21,29 @@ github.com/domodwyer/mailyak/v3 v3.6.2 h1:x3tGMsyFhTCaxp6ycgR0FE/bu5QiNp+hetUuCO
 github.com/domodwyer/mailyak/v3 v3.6.2/go.mod h1:lOm/u9CyCVWHeaAmHIdF4RiKVxKUT/H5XX10lIKAL6c=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/ebitengine/purego v0.10.0 h1:QIw4xfpWT6GWTzaW5XEKy3HXoqrJGx1ijYHzTF0/ISU=
-github.com/ebitengine/purego v0.10.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/ebitengine/purego v0.10.2 h1:W809HbnvzAxgdm+aOvlSekrM16wGCdT/e76+9tS7gzE=
+github.com/ebitengine/purego v0.10.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/eclipse/paho.golang v0.23.0 h1:KHgl2wz6EJo7cMBmkuhpt7C576vP+kpPv7jjvSyR6Mk=
 github.com/eclipse/paho.golang v0.23.0/go.mod h1:nQRhTkoZv8EAiNs5UU0/WdQIx2NrnWUpL9nsGJTQN04=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
-github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
-github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
-github.com/ganigeorgiev/fexpr v0.5.0 h1:XA9JxtTE/Xm+g/JFI6RfZEHSiQlk+1glLvRK1Lpv/Tk=
-github.com/ganigeorgiev/fexpr v0.5.0/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
+github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
+github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
+github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78=
+github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/gabriel-vasile/mimetype v1.4.15 h1:05iP/CYtZ/w455R/KZM6rZ5ieAdh99UPtd+d3YzLmaI=
+github.com/gabriel-vasile/mimetype v1.4.15/go.mod h1:azpTcoLcDZRNgFou5j+APrqQx9HqVPWa6ijYQIIVswQ=
+github.com/ganigeorgiev/fexpr v0.6.0 h1:Fza3O/QMBKEudUvxV862qe6GjxM60GJjjKytdp+VQus=
+github.com/ganigeorgiev/fexpr v0.6.0/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
 github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
-github.com/go-ozzo/ozzo-validation/v4 v4.3.0 h1:byhDUpfEwjsVQb1vBunvIjh2BHQ9ead57VkAEY4V+Es=
-github.com/go-ozzo/ozzo-validation/v4 v4.3.0/go.mod h1:2NKgrcHl3z6cJs+3Oo940FPRiTzuqKbvfrL2RxCj6Ew=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.9.1 h1:FrjNGn/BsJQjVRuSa8CBrM5BWA9BWoXXat3KrtSb/iI=
 github.com/go-sql-driver/mysql v1.9.1/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
@@ -56,8 +56,8 @@ github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArs
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc h1:VBbFa1lDYWEeV5FZKUiYKYT0VxCp9twUmmaq9eb8sXw=
-github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
@@ -66,47 +66,49 @@ github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/jarcoal/httpmock v1.4.1 h1:0Ju+VCFuARfFlhVXFc2HxlcQkfB+Xq12/EotHko+x2A=
-github.com/jarcoal/httpmock v1.4.1/go.mod h1:ftW1xULwo+j0R0JJkJIIi7UKigZUXCLLanykgjwBXL0=
+github.com/jarcoal/httpmock v1.4.2 h1:dKwiP/9zITCPfBLsDn3kchbSOu16JrnxtVEmL0fPRcI=
+github.com/jarcoal/httpmock v1.4.2/go.mod h1:ftW1xULwo+j0R0JJkJIIi7UKigZUXCLLanykgjwBXL0=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
-github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
-github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8=
+github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749 h1:Qj3hTcdWH8uMZDI41HNuTuJN525C7NBrbtH5kSO6fPk=
-github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
-github.com/lxzan/gws v1.9.1 h1:4lbIp4cW0hOLP3ejFHR/uWRy741AURx7oKkNNi2OT9o=
-github.com/lxzan/gws v1.9.1/go.mod h1:gXHSCPmTGryWJ4icuqy8Yho32E4YIMHH0fkDRYJRbdc=
-github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
-github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/lufia/plan9stats v0.0.0-20260802145828-341c2f0c90b5 h1:eveIIGn4BGM3qknO74omf6HYr30/exH+eVUTuAgwjZ0=
+github.com/lufia/plan9stats v0.0.0-20260802145828-341c2f0c90b5/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
+github.com/lxzan/gws v1.10.1 h1:1xG+tDOV0lgDeVPf0wNT74u3cn0K3LpcavRrTPTrMwQ=
+github.com/lxzan/gws v1.10.1/go.mod h1:gXHSCPmTGryWJ4icuqy8Yho32E4YIMHH0fkDRYJRbdc=
+github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
+github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/nicholas-fedor/shoutrrr v0.14.3 h1:aBX2iw9a7jl5wfHd3bi9LnS5ucoYIy6KcLH9XVF+gig=
-github.com/nicholas-fedor/shoutrrr v0.14.3/go.mod h1:U7IywBkLpBV7rgn8iLbQ9/LklJG1gm24bFv5cXXsDKs=
-github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
-github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
-github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
-github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
+github.com/nicholas-fedor/shoutrrr v0.17.0 h1:xfp3z5QbE8jXvUhUEwWDk47SJ/b912VoB8MJJDU+q4E=
+github.com/nicholas-fedor/shoutrrr v0.17.0/go.mod h1:s4ldyLs6uwBy9lIjYrY+8lyTqJtPvZSrILw0CyMLock=
+github.com/onsi/ginkgo/v2 v2.32.0 h1:Hw7s2pVrQo/8Yz5N77qdnpHaoc+c6cC9WIV1Jce+J6E=
+github.com/onsi/ginkgo/v2 v2.32.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
+github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
+github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pocketbase/dbx v1.12.0 h1:/oLErM+A0b4xI0PWTGPqSDVjzix48PqI/bng2l0PzoA=
 github.com/pocketbase/dbx v1.12.0/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
-github.com/pocketbase/pocketbase v0.36.8 h1:gCNqoesZ44saYOD3J7edhi5nDwUWKyQG7boM/kVwz2c=
-github.com/pocketbase/pocketbase v0.36.8/go.mod h1:OY4WaXbP0WnF/EXoBbboWJK+ZSZ1A85tiA0sjrTKxTA=
-github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
-github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
+github.com/pocketbase/ozzo-validation/v4 v4.3.0 h1:uKBDVma7bZqgR2a6AwE+k9hkuDFfiZMpBHQdZ1z3iQs=
+github.com/pocketbase/ozzo-validation/v4 v4.3.0/go.mod h1:6XNjSTw/Jb2F8LOkKO3oyzIWExbrGiYoS4uVxVwz90g=
+github.com/pocketbase/pocketbase v0.39.10 h1:2j8TDJRuo3aAC8Y8F9WFux0SwYcxeDCgEYQxxdWkwGE=
+github.com/pocketbase/pocketbase v0.39.10/go.mod h1:tSX3anHQ7Ul6dPV9WhlEc6No1DtklGF69iwnVNW3BEE=
+github.com/power-devops/perfstat v0.0.0-20260805114148-88456608a4f6 h1:jL3a8soXdzuTCcRnKhOmtcsVOObdDTFf4O2B403HPRU=
+github.com/power-devops/perfstat v0.0.0-20260805114148-88456608a4f6/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/shirou/gopsutil/v4 v4.26.3 h1:2ESdQt90yU3oXF/CdOlRCJxrP+Am1aBYubTMTfxJ1qc=
-github.com/shirou/gopsutil/v4 v4.26.3/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
+github.com/shirou/gopsutil/v4 v4.26.7 h1:IXzpHz/dkMRYAhKkOXr1HB6SuzWU3eoyyeWe7g3bNZc=
+github.com/shirou/gopsutil/v4 v4.26.7/go.mod h1:5O9FjBiXoTDFatIWjZZosqj4pV0DRtLx598xGbBehzM=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
 github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
@@ -120,51 +122,51 @@ github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+Q
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
-github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
-github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=
-github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ=
+github.com/tklauser/go-sysconf v0.4.0 h1:7H0uAN+7RkwWRaxhYXDLqa5V3LPrJeV8wmD9dRUgPQU=
+github.com/tklauser/go-sysconf v0.4.0/go.mod h1:8mTNWyog7H+MpKijp4VmKJAd2bbYQ2zuUwkYRbUArPI=
+github.com/tklauser/numcpus v0.12.0 h1:NR85qdvHA9pFse3x3weVZ0r0ST8R6l5RHbZrlRaqob4=
+github.com/tklauser/numcpus v0.12.0/go.mod h1:ABHeXzJnr/qqwguhClkZKT1/8VABcYrsyUiUGobwWJg=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
-golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
-golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 h1:jiDhWWeC7jfWqR9c/uplMOqJ0sbNlNWv0UkzE0vX1MA=
-golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90/go.mod h1:xE1HEv6b+1SCZ5/uscMRjUBKtIxworgEcEi+/n9NQDQ=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/exp v0.0.0-20260811152304-ee035b5b010f h1:iXpLj9sdDH/RLYsnOMpbETK6KWtrHwvegcc4psWJHV8=
+golang.org/x/exp v0.0.0-20260811152304-ee035b5b010f/go.mod h1:EdfpwwqSu+0Li0mzskwHU6FWDV3t9Q+RZDo3QMUtL3Q=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.38.0 h1:5l+q+Y9JDC7mBOMjo4/aPhMDcxEptsX+Tt3GgRQRPuE=
-golang.org/x/image v0.38.0/go.mod h1:/3f6vaXC+6CEanU4KJxbcUZyEePbyKbaLoDOe4ehFYY=
-golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
-golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/image v0.45.0 h1:FMb1nTbH5H9vF55SriQHgFw5GnNL9Jg6L25BwXKzhB0=
+golang.org/x/image v0.45.0/go.mod h1:n62x/7RqlwXDvGsSU4u6IUTUf6KghUZ9Bt7cG/T9Fx4=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
+golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -175,30 +177,30 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
 howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
-modernc.org/cc/v4 v4.27.1 h1:9W30zRlYrefrDV2JE2O8VDtJ1yPGownxciz5rrbQZis=
-modernc.org/cc/v4 v4.27.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
-modernc.org/ccgo/v4 v4.32.0 h1:hjG66bI/kqIPX1b2yT6fr/jt+QedtP2fqojG2VrFuVw=
-modernc.org/ccgo/v4 v4.32.0/go.mod h1:6F08EBCx5uQc38kMGl+0Nm0oWczoo1c7cgpzEry7Uc0=
+modernc.org/cc/v4 v4.29.0 h1:CXgwL8cvxmyzBQZzbSl/6xFtMCryb6u8IOqDci39cgc=
+modernc.org/cc/v4 v4.29.0/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.34.6 h1:sBgfIwyN0TQ9C5hwIeuqyeAKyMWnbvj2fvpF4L11uzU=
+modernc.org/ccgo/v4 v4.34.6/go.mod h1:SZ8YcN9NG7XVsQYdm6jYBvi8PQP1qi+kqB6OhjqI3Fk=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
-modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.4 h1:2g65LGVSmFQrXeITAw97x7hCRvZFcyE1uDP+7Vng7JI=
+modernc.org/gc/v3 v3.1.4/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.70.0 h1:U58NawXqXbgpZ/dcdS9kMshu08aiA6b7gusEusqzNkw=
-modernc.org/libc v1.70.0/go.mod h1:OVmxFGP1CI/Z4L3E0Q3Mf1PDE0BucwMkcXjjLntvHJo=
+modernc.org/libc v1.74.1 h1:bdR4VTKFMC4966QSNZ05XLGI/VwzVa2kTUX51Dm0riQ=
+modernc.org/libc v1.74.1/go.mod h1:uH4t5bOx3G3g9Xcmj10YKlTcVISlRDwv8VoQJG9n8Os=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
-modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
-modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
-modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/memory v1.12.0 h1:twkmYNkGXCvtYWzoux02jtK6eovjZbdI0uHFUYp6kuU=
+modernc.org/memory v1.12.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
+modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.48.0 h1:ElZyLop3Q2mHYk5IFPPXADejZrlHu7APbpB0sF78bq4=
-modernc.org/sqlite v1.48.0/go.mod h1:hWjRO6Tj/5Ik8ieqxQybiEOUXy0NJFNp2tpvVpKlvig=
+modernc.org/sqlite v1.55.0 h1:hIFh0MCH0rGinQ/4KYb5/UbCkRkb+UP+OkLCVWa5MTM=
+modernc.org/sqlite v1.55.0/go.mod h1:4ntCLuNmnH8+GNqjka1wNg7KJd5/Hi5FYp8K+XQ7GZw=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

internal/alerts/alerts_quiet_hours_test.go

@@ -322,8 +322,9 @@ func TestAlertSilencedMultiUser(t *testing.T) {
 }
 
 func TestAlertSilencedWithActualAlert(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+
 	synctest.Test(t, func(t *testing.T) {
-		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		// Create a system

internal/alerts/alerts_status_test.go

@@ -29,8 +29,9 @@ func setStatusAlertEmail(t *testing.T, hub core.App, userID, email string) {
 }
 
 func TestStatusAlerts(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+
 	synctest.Test(t, func(t *testing.T) {
-		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		systems, err := beszelTests.CreateSystems(hub, 4, user.Id, "paused")
@@ -234,8 +235,9 @@ func TestHandleStatusAlertsDoesNotSendRecoveryWhileDownIsOnlyPending(t *testing.
 }
 
 func TestStatusAlertTimerCancellationPreventsBoundaryDelivery(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+
 	synctest.Test(t, func(t *testing.T) {
-		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		userSettings, err := hub.FindFirstRecordByFilter("user_settings", "user={:user}", map[string]any{"user": user.Id})
@@ -336,8 +338,9 @@ func TestStatusAlertDownFiresAfterDelayExpires(t *testing.T) {
 }
 
 func TestStatusAlertMultipleUsersRespectDifferentMinutes(t *testing.T) {
+	hub, user1 := beszelTests.GetHubWithUser(t)
+
 	synctest.Test(t, func(t *testing.T) {
-		hub, user1 := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		setStatusAlertEmail(t, hub, user1.Id, "user1@example.com")
@@ -423,8 +426,9 @@ func TestStatusAlertMultipleUsersRespectDifferentMinutes(t *testing.T) {
 }
 
 func TestStatusAlertMultipleUsersRecoveryBetweenMinutesOnlyAlertsEarlierUser(t *testing.T) {
+	hub, user1 := beszelTests.GetHubWithUser(t)
+
 	synctest.Test(t, func(t *testing.T) {
-		hub, user1 := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		setStatusAlertEmail(t, hub, user1.Id, "user1@example.com")
@@ -816,8 +820,9 @@ func TestResolveStatusAlerts(t *testing.T) {
 }
 
 func TestAlertsHistoryStatus(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+
 	synctest.Test(t, func(t *testing.T) {
-		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		// Create a system
@@ -882,8 +887,9 @@ func TestAlertsHistoryStatus(t *testing.T) {
 }
 
 func TestStatusAlertClearedBeforeSend(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+
 	synctest.Test(t, func(t *testing.T) {
-		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		// Create a system

internal/alerts/alerts_system_test.go

@@ -95,11 +95,10 @@ func waitForSystemAlert(d time.Duration) {
 
 func testOneMinuteSystemAlert[T any](t *testing.T, alertName string, threshold float64, setValue systemAlertValueSetter[T], triggerValue, resolveValue T) {
 	t.Helper()
+	fixture := newSystemAlertTestFixture(t, alertName, 1, threshold)
+	defer fixture.cleanup()
 
 	synctest.Test(t, func(t *testing.T) {
-		fixture := newSystemAlertTestFixture(t, alertName, 1, threshold)
-		defer fixture.cleanup()
-
 		submitValue(fixture, t, triggerValue, setValue)
 		waitForSystemAlert(time.Second)
 
@@ -118,11 +117,10 @@ func testOneMinuteSystemAlert[T any](t *testing.T, alertName string, threshold f
 
 func testMultiMinuteSystemAlert[T any](t *testing.T, alertName string, threshold float64, min int, setValue systemAlertValueSetter[T], baselineValue, triggerValue, resolveValue T) {
 	t.Helper()
+	fixture := newSystemAlertTestFixture(t, alertName, min, threshold)
+	defer fixture.cleanup()
 
 	synctest.Test(t, func(t *testing.T) {
-		fixture := newSystemAlertTestFixture(t, alertName, min, threshold)
-		defer fixture.cleanup()
-
 		submitValue(fixture, t, baselineValue, setValue)
 		waitForSystemAlert(time.Minute + time.Second)
 		fixture.assertTriggered(t, false, "Alert should not be triggered yet")

internal/alerts/alerts_test.go

@@ -15,8 +15,9 @@ import (
 )
 
 func TestAlertsHistory(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+
 	synctest.Test(t, func(t *testing.T) {
-		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		// Create systems and alerts

internal/common/common-ws.go

@@ -22,8 +22,6 @@ const (
 	GetSmartData
 	// Request detailed systemd service info from agent
 	GetSystemdInfo
-	// Sync network probe configuration to agent
-	SyncNetworkProbes
 	// Add new actions here...
 )
 
@@ -44,7 +42,8 @@ type AgentResponse struct {
 	SmartData   map[string]smart.SmartData `cbor:"5,keyasint,omitempty,omitzero"` // Legacy (<= 0.17)
 	ServiceInfo systemd.ServiceDetails     `cbor:"6,keyasint,omitempty,omitzero"` // Legacy (<= 0.17)
 	// Data is the generic response payload for new endpoints (0.18+)
-	Data cbor.RawMessage `cbor:"7,keyasint,omitempty,omitzero"`
+	Data          cbor.RawMessage `cbor:"7,keyasint,omitempty,omitzero"`
+	SmartComplete bool            `cbor:"8,keyasint,omitempty,omitzero"`
 }
 
 type FingerprintRequest struct {

internal/entities/container/container.go

@@ -52,6 +52,17 @@ type HostInfo struct {
 }
 
 func (s *ApiStats) CalculateCpuPercentLinux(prevCpuContainer uint64, prevCpuSystem uint64) float64 {
+	// A counter can read lower than the stored previous value when a stats
+	// response is processed after a newer one for the same container, or when an
+	// accounting counter resets. Unsigned subtraction wraps to ~2^64 instead of
+	// going negative: on the container counter that surfaces as an absurd
+	// percentage the caller rejects, discarding the whole sample; on the system
+	// counter it inflates the divisor and silently reports near-zero CPU.
+	// Treat either direction as a new baseline.
+	if s.CPUStats.CPUUsage.TotalUsage < prevCpuContainer || s.CPUStats.SystemUsage < prevCpuSystem {
+		return 0.0
+	}
+
 	cpuDelta := s.CPUStats.CPUUsage.TotalUsage - prevCpuContainer
 	systemDelta := s.CPUStats.SystemUsage - prevCpuSystem
 
@@ -70,7 +81,11 @@ func (s *ApiStats) CalculateCpuPercentWindows(prevCpuUsage uint64, prevRead time
 	possIntervals /= 100                // Convert to number of 100ns intervals
 	possIntervals *= uint64(s.NumProcs) // Multiple by the number of processors
 
-	// Intervals used
+	// Intervals used. Same rollback guard as the Linux path: an out-of-order or
+	// reset counter would wrap the subtraction to ~2^64.
+	if s.CPUStats.CPUUsage.TotalUsage < prevCpuUsage {
+		return 0.0
+	}
 	intervalsUsed := s.CPUStats.CPUUsage.TotalUsage - prevCpuUsage
 
 	// Percentage avoiding divide-by-zero

internal/entities/probe/probe.go

@@ -1,24 +0,0 @@
-package probe
-
-// Config defines a network probe task sent from hub to agent.
-type Config struct {
-	// ID is the stable network_probes record ID generated by the hub.
-	ID       string `cbor:"0,keyasint"`
-	Target   string `cbor:"1,keyasint"`
-	Protocol string `cbor:"2,keyasint"` // "icmp", "tcp", or "http"
-	Port     uint16 `cbor:"3,keyasint,omitempty"`
-	Interval uint16 `cbor:"4,keyasint"` // seconds
-}
-
-// Result holds aggregated probe results for a single target.
-//
-// 0: avg response in ms
-//
-// 1: average response over the last hour in ms
-//
-// 2: min response over the last hour in ms
-//
-// 3: max response over the last hour in ms
-//
-// 4: packet loss percentage over the last hour (0-100)
-type Result []float64

internal/entities/smart/smart.go

@@ -494,7 +494,7 @@ type SmartInfoForNvme struct {
 	FirmwareVersion string           `json:"firmware_version"`
 	// NVMePCIVendor                 NVMePCIVendor                 `json:"nvme_pci_vendor"`
 	// NVMeIEEEOUIIdentifier         uint32                        `json:"nvme_ieee_oui_identifier"`
-	NVMeTotalCapacity             uint64                        `json:"nvme_total_capacity"`
+	NVMeTotalCapacity uint64 `json:"nvme_total_capacity"`
 	// NVMeUnallocatedCapacity       uint64                        `json:"nvme_unallocated_capacity"`
 	// NVMeControllerID              uint16                        `json:"nvme_controller_id"`
 	// NVMeVersion                   VersionStringInfo             `json:"nvme_version"`
@@ -531,6 +531,13 @@ type SmartData struct {
 	Attributes      []*SmartAttribute `json:"a,omitempty" cbor:"9,keyasint,omitempty"`
 }
 
+// SmartDataResponse contains the collected data and whether every discovered
+// device was collected. Older agents omit Complete, so hubs must not prune from it.
+type SmartDataResponse struct {
+	Data     map[string]SmartData `json:"data" cbor:"0,keyasint"`
+	Complete bool                 `json:"complete" cbor:"1,keyasint,omitempty"` // Whether every discovered device was collected
+}
+
 type SmartAttribute struct {
 	ID         uint16 `json:"id,omitempty" cbor:"0,keyasint,omitempty"`
 	Name       string `json:"n" cbor:"1,keyasint"`

internal/entities/system/system.go

@@ -7,7 +7,6 @@ import (
 	"time"
 
 	"github.com/henrygd/beszel/internal/entities/container"
-	"github.com/henrygd/beszel/internal/entities/probe"
 	"github.com/henrygd/beszel/internal/entities/systemd"
 )
 
@@ -34,6 +33,7 @@ type Stats struct {
 	MaxNetworkSent float64             `json:"nsm,omitempty" cbor:"-"`
 	MaxNetworkRecv float64             `json:"nrm,omitempty" cbor:"-"`
 	Temperatures   map[string]float64  `json:"t,omitempty" cbor:"20,keyasint,omitempty"`
+	Fans           map[string]uint16   `json:"f,omitempty" cbor:"36,keyasint,omitempty"`
 	ExtraFs        map[string]*FsStats `json:"efs,omitempty" cbor:"21,keyasint,omitempty"`
 	GPUData        map[string]GPUData  `json:"g,omitempty" cbor:"22,keyasint,omitempty"`
 	// LoadAvg1       float64             `json:"l1,omitempty" cbor:"23,keyasint,omitempty"`
@@ -175,10 +175,9 @@ type Details struct {
 
 // Final data structure to return to the hub
 type CombinedData struct {
-	Stats           Stats                   `json:"stats" cbor:"0,keyasint"`
-	Info            Info                    `json:"info" cbor:"1,keyasint"`
-	Containers      []*container.Stats      `json:"container" cbor:"2,keyasint"`
-	SystemdServices []*systemd.Service      `json:"systemd,omitempty" cbor:"3,keyasint,omitempty"`
-	Details         *Details                `cbor:"4,keyasint,omitempty"`
-	Probes          map[string]probe.Result `cbor:"5,keyasint,omitempty"`
+	Stats           Stats              `json:"stats" cbor:"0,keyasint"`
+	Info            Info               `json:"info" cbor:"1,keyasint"`
+	Containers      []*container.Stats `json:"container" cbor:"2,keyasint"`
+	SystemdServices []*systemd.Service `json:"systemd,omitempty" cbor:"3,keyasint,omitempty"`
+	Details         *Details           `cbor:"4,keyasint,omitempty"`
 }

internal/ghupdate/checksum.go

@@ -0,0 +1,43 @@
+package ghupdate
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+)
+
+func verifyAssetChecksum(path, digest string) error {
+	algorithm, expectedHex, ok := strings.Cut(digest, ":")
+	if !ok || algorithm == "" || expectedHex == "" {
+		return fmt.Errorf("invalid release digest %q", digest)
+	}
+	if !strings.EqualFold(algorithm, "sha256") {
+		return fmt.Errorf("unsupported release digest algorithm %q", algorithm)
+	}
+
+	expected, err := hex.DecodeString(expectedHex)
+	if err != nil || len(expected) != sha256.Size {
+		return fmt.Errorf("invalid SHA-256 release digest %q", digest)
+	}
+
+	file, err := os.Open(path)
+	if err != nil {
+		return fmt.Errorf("failed to open release for checksum verification: %w", err)
+	}
+	defer file.Close()
+
+	hash := sha256.New()
+	if _, err := io.Copy(hash, file); err != nil {
+		return fmt.Errorf("failed to calculate release checksum: %w", err)
+	}
+	actual := hash.Sum(nil)
+	if !bytes.Equal(actual, expected) {
+		return fmt.Errorf("release checksum mismatch: expected %s, got %s", expectedHex, hex.EncodeToString(actual))
+	}
+
+	return nil
+}

internal/ghupdate/checksum_test.go

@@ -0,0 +1,57 @@
+package ghupdate
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestVerifyAssetChecksum(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "asset")
+	if err := os.WriteFile(path, []byte("beszel release asset"), 0600); err != nil {
+		t.Fatal(err)
+	}
+
+	tests := []struct {
+		name    string
+		digest  string
+		wantErr string
+	}{
+		{
+			name:   "valid",
+			digest: "sha256:2316f86af2c3af2f0ef595ad5359cdd19b329d4829a5425460ca9ffbf92671ab",
+		},
+		{
+			name:    "mismatch",
+			digest:  "sha256:0316f86af2c3af2f0ef595ad5359cdd19b329d4829a5425460ca9ffbf92671ab",
+			wantErr: "checksum mismatch",
+		},
+		{
+			name:    "malformed",
+			digest:  "sha256:not-a-checksum",
+			wantErr: "invalid SHA-256",
+		},
+		{
+			name:    "missing",
+			wantErr: "invalid release digest",
+		},
+		{
+			name:    "unsupported algorithm",
+			digest:  "sha512:2316f86af2c3af2f0ef595ad5359cdd19b329d4829a5425460ca9ffbf92671ab",
+			wantErr: "unsupported",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := verifyAssetChecksum(path, tt.digest)
+			if tt.wantErr == "" && err != nil {
+				t.Fatalf("expected checksum to verify, got %v", err)
+			}
+			if tt.wantErr != "" && (err == nil || !strings.Contains(err.Error(), tt.wantErr)) {
+				t.Fatalf("expected error containing %q, got %v", tt.wantErr, err)
+			}
+		})
+	}
+}

internal/ghupdate/extract.go

@@ -46,18 +46,23 @@ func extractTarGz(srcPath, destDir string) error {
 			return err
 		}
 
+		path, err := archivePath(destDir, header.Name)
+		if err != nil {
+			return err
+		}
+
 		if header.Typeflag == tar.TypeDir {
-			if err := os.MkdirAll(filepath.Join(destDir, header.Name), 0755); err != nil {
+			if err := os.MkdirAll(path, 0755); err != nil {
 				return err
 			}
 			continue
 		}
 
-		if err := os.MkdirAll(filepath.Dir(filepath.Join(destDir, header.Name)), 0755); err != nil {
+		if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
 			return err
 		}
 
-		outFile, err := os.Create(filepath.Join(destDir, header.Name))
+		outFile, err := os.Create(path)
 		if err != nil {
 			return err
 		}
@@ -72,6 +77,14 @@ func extractTarGz(srcPath, destDir string) error {
 	return nil
 }
 
+// archivePath returns a path within destDir, rejecting path traversal entries.
+func archivePath(destDir, name string) (string, error) {
+	if !filepath.IsLocal(name) {
+		return "", fmt.Errorf("invalid file path: %q", name)
+	}
+	return filepath.Join(destDir, name), nil
+}
+
 // extractZip extracts the zip archive at "src" to "dest".
 //
 // Note that only dirs and regular files will be extracted.
@@ -84,9 +97,6 @@ func extractZip(src, dest string) error {
 	}
 	defer zr.Close()
 
-	// normalize dest path to check later for Zip Slip
-	dest = filepath.Clean(dest) + string(os.PathSeparator)
-
 	for _, f := range zr.File {
 		err := extractFile(f, dest)
 		if err != nil {
@@ -100,11 +110,9 @@ func extractZip(src, dest string) error {
 // extractFile extracts the provided zipFile into "basePath/zipFileName" path,
 // creating all the necessary path directories.
 func extractFile(zipFile *zip.File, basePath string) error {
-	path := filepath.Join(basePath, zipFile.Name)
-
-	// check for Zip Slip
-	if !strings.HasPrefix(path, basePath) {
-		return fmt.Errorf("invalid file path: %s", path)
+	path, err := archivePath(basePath, zipFile.Name)
+	if err != nil {
+		return err
 	}
 
 	r, err := zipFile.Open()

internal/ghupdate/ghupdate.go

@@ -135,21 +135,33 @@ func (p *updater) update() (updated bool, err error) {
 		return false, err
 	}
 
-	releaseDir := filepath.Join(p.config.DataDir, ".beszel_update")
+	if err := os.MkdirAll(p.config.DataDir, 0755); err != nil {
+		return false, fmt.Errorf("failed to create update data directory: %w", err)
+	}
+	releaseDir, err := os.MkdirTemp(p.config.DataDir, ".beszel_update-")
+	if err != nil {
+		return false, fmt.Errorf("failed to create update directory: %w", err)
+	}
 	defer os.RemoveAll(releaseDir)
 
 	ColorPrintf(ColorYellow, "Downloading %s...", asset.Name)
 
 	// download the release asset
-	assetPath := filepath.Join(releaseDir, asset.Name)
+	assetPath, err := archivePath(releaseDir, asset.Name)
+	if err != nil {
+		return false, err
+	}
 	if err := downloadFile(p.config.Context, p.config.HttpClient, asset.DownloadUrl, assetPath, p.config.UseMirror); err != nil {
 		return false, err
 	}
+	ColorPrint(ColorYellow, "Verifying checksum...")
+	if err := verifyAssetChecksum(assetPath, asset.Digest); err != nil {
+		return false, err
+	}
 
 	ColorPrintf(ColorYellow, "Extracting %s...", asset.Name)
 
-	extractDir := filepath.Join(releaseDir, "extracted_"+asset.Name)
-	defer os.RemoveAll(extractDir)
+	extractDir := filepath.Join(releaseDir, "extracted")
 
 	// Extract the archive (automatically detects format)
 	if err := extract(assetPath, extractDir); err != nil {

internal/ghupdate/ghupdate_test.go

@@ -1,6 +1,9 @@
 package ghupdate
 
 import (
+	"archive/tar"
+	"compress/gzip"
+	"os"
 	"path/filepath"
 	"testing"
 )
@@ -43,3 +46,59 @@ func TestExtractFailure(t *testing.T) {
 		t.Fatal("Expected Extract to fail due to missing tar.gz file")
 	}
 }
+
+func TestArchivePath(t *testing.T) {
+	destDir := t.TempDir()
+	for _, name := range []string{
+		"",
+		"..",
+		filepath.Join("..", "file"),
+		filepath.Join("dir", "..", "..", "file"),
+		string(os.PathSeparator) + filepath.Join("tmp", "file"),
+	} {
+		if _, err := archivePath(destDir, name); err == nil {
+			t.Errorf("expected %q to be rejected", name)
+		}
+	}
+
+	name := filepath.Join("dir", "file")
+	if path, err := archivePath(destDir, name); err != nil || path != filepath.Join(destDir, name) {
+		t.Errorf("archivePath(%q) = %q, %v", name, path, err)
+	}
+}
+
+func TestExtractTarGzRejectsPathTraversal(t *testing.T) {
+	testDir := t.TempDir()
+	archivePath := filepath.Join(testDir, "malicious.tar.gz")
+	destDir := filepath.Join(testDir, "extract")
+	escapedPath := filepath.Join(testDir, "escaped")
+
+	archive, err := os.Create(archivePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	gz := gzip.NewWriter(archive)
+	tw := tar.NewWriter(gz)
+	if err := tw.WriteHeader(&tar.Header{Name: "../escaped", Mode: 0600, Size: 1}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := tw.Write([]byte("x")); err != nil {
+		t.Fatal(err)
+	}
+	if err := tw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := gz.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := archive.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := extract(archivePath, destDir); err == nil {
+		t.Fatal("expected path traversal archive to be rejected")
+	}
+	if _, err := os.Stat(escapedPath); !os.IsNotExist(err) {
+		t.Fatalf("path traversal wrote %s", escapedPath)
+	}
+}

internal/ghupdate/release.go

@@ -8,6 +8,7 @@ import (
 type releaseAsset struct {
 	Name        string `json:"name"`
 	DownloadUrl string `json:"browser_download_url"`
+	Digest      string `json:"digest"`
 	Id          int    `json:"id"`
 	Size        int    `json:"size"`
 }

internal/hub/agent_connect.go

@@ -317,6 +317,9 @@ func getRealIP(r *http.Request) string {
 	if ip := r.Header.Get("CF-Connecting-IP"); ip != "" {
 		return ip
 	}
+	if ip := r.Header.Get("X-Real-IP"); ip != "" {
+		return ip
+	}
 	if ip := r.Header.Get("X-Forwarded-For"); ip != "" {
 		// X-Forwarded-For can contain a comma-separated list: "client_ip, proxy1, proxy2"
 		// Take the first one

internal/hub/agent_connect_test.go

@@ -1796,6 +1796,24 @@ func TestGetRealIP(t *testing.T) {
 			remoteAddr: "127.0.0.1:12345",
 			expectedIP: "192.168.1.8",
 		},
+		{
+			name:       "X-Real-IP header",
+			headers:    map[string]string{"X-Real-IP": "10.8.0.4"},
+			remoteAddr: "172.21.0.1:12345",
+			expectedIP: "10.8.0.4",
+		},
+		{
+			name:       "X-Real-IP takes precedence over X-Forwarded-For",
+			headers:    map[string]string{"X-Real-IP": "10.8.0.4", "X-Forwarded-For": "10.8.0.5"},
+			remoteAddr: "172.21.0.1:12345",
+			expectedIP: "10.8.0.4",
+		},
+		{
+			name:       "CF-Connecting-IP takes precedence over X-Real-IP",
+			headers:    map[string]string{"CF-Connecting-IP": "1.2.3.4", "X-Real-IP": "10.8.0.4"},
+			remoteAddr: "172.21.0.1:12345",
+			expectedIP: "1.2.3.4",
+		},
 	}
 
 	for _, tc := range testCases {

internal/hub/collections.go

@@ -78,7 +78,7 @@ func setCollectionAuthSettings(app core.App) error {
 		return err
 	}
 
-	if err := applyCollectionRules(app, []string{"containers", "container_stats", "system_stats", "systemd_services", "network_probe_stats"}, collectionRules{
+	if err := applyCollectionRules(app, []string{"containers", "container_stats", "system_stats", "systemd_services"}, collectionRules{
 		list: &systemScopedReadRule,
 	}); err != nil {
 		return err
@@ -92,7 +92,7 @@ func setCollectionAuthSettings(app core.App) error {
 		return err
 	}
 
-	if err := applyCollectionRules(app, []string{"fingerprints", "network_probes"}, collectionRules{
+	if err := applyCollectionRules(app, []string{"fingerprints"}, collectionRules{
 		list:   &systemScopedReadRule,
 		view:   &systemScopedReadRule,
 		create: &systemScopedWriteRule,

internal/hub/config/config_test.go

@@ -64,7 +64,7 @@ func createConfigTestFingerprint(app core.App, systemID, token, fingerprint stri
 
 // TestConfigSyncWithTokens tests the config.SyncSystems function with various token scenarios
 func TestConfigSyncWithTokens(t *testing.T) {
-	testHub, err := tests.NewTestHub()
+	testHub, err := tests.NewTestHub(t.TempDir())
 	require.NoError(t, err)
 	defer testHub.Cleanup()
 

internal/hub/hub.go

@@ -81,7 +81,6 @@ func (h *Hub) StartHub() error {
 		}
 		// register middlewares
 		h.registerMiddlewares(e)
-		// bind events that aren't set up in different
 		// register api routes
 		if err := h.registerApiRoutes(e); err != nil {
 			return err
@@ -110,8 +109,6 @@ func (h *Hub) StartHub() error {
 	h.App.OnRecordCreate("users").BindFunc(h.um.InitializeUserRole)
 	h.App.OnRecordCreate("user_settings").BindFunc(h.um.InitializeUserSettings)
 
-	bindNetworkProbesEvents(h)
-
 	pb, ok := h.App.(*pocketbase.PocketBase)
 	if !ok {
 		return errors.New("not a pocketbase app")

internal/hub/probes.go

@@ -1,62 +0,0 @@
-package hub
-
-import (
-	"strconv"
-
-	"github.com/henrygd/beszel/internal/entities/probe"
-	"github.com/henrygd/beszel/internal/hub/systems"
-	"github.com/pocketbase/pocketbase/core"
-)
-
-// generateProbeID creates a stable hash ID for a probe based on its configuration and the system it belongs to.
-func generateProbeID(systemId string, config probe.Config) string {
-	intervalStr := strconv.FormatUint(uint64(config.Interval), 10)
-	portStr := strconv.FormatUint(uint64(config.Port), 10)
-	return systems.MakeStableHashId(systemId, config.Protocol, config.Target, portStr, intervalStr)
-}
-
-func bindNetworkProbesEvents(h *Hub) {
-	// on create, make sure the id is set to a stable hash
-	h.OnRecordCreate("network_probes").BindFunc(func(e *core.RecordEvent) error {
-		systemID := e.Record.GetString("system")
-		config := &probe.Config{
-			Target:   e.Record.GetString("target"),
-			Protocol: e.Record.GetString("protocol"),
-			Port:     uint16(e.Record.GetInt("port")),
-			Interval: uint16(e.Record.GetInt("interval")),
-		}
-		id := generateProbeID(systemID, *config)
-		e.Record.Set("id", id)
-		return e.Next()
-	})
-
-	// sync probe to agent on creation
-	h.OnRecordAfterCreateSuccess("network_probes").BindFunc(func(e *core.RecordEvent) error {
-		systemID := e.Record.GetString("system")
-		h.syncProbesToAgent(systemID)
-		return e.Next()
-	})
-	// sync probe to agent on delete
-	h.OnRecordAfterDeleteSuccess("network_probes").BindFunc(func(e *core.RecordEvent) error {
-		systemID := e.Record.GetString("system")
-		h.syncProbesToAgent(systemID)
-		return e.Next()
-	})
-	// TODO: if enabled changes, sync to agent
-}
-
-// syncProbesToAgent fetches enabled probes for a system and sends them to the agent.
-func (h *Hub) syncProbesToAgent(systemID string) {
-	system, err := h.sm.GetSystem(systemID)
-	if err != nil {
-		return
-	}
-
-	configs := h.sm.GetProbeConfigsForSystem(systemID)
-
-	go func() {
-		if err := system.SyncNetworkProbes(configs); err != nil {
-			h.Logger().Warn("failed to sync probes to agent", "system", systemID, "err", err)
-		}
-	}()
-}

internal/hub/probes_test.go

@@ -1,79 +0,0 @@
-package hub
-
-import (
-	"testing"
-
-	"github.com/henrygd/beszel/internal/entities/probe"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGenerateProbeID(t *testing.T) {
-	tests := []struct {
-		name     string
-		systemID string
-		config   probe.Config
-		expected string
-	}{
-		{
-			name:     "HTTP probe on example.com",
-			systemID: "sys123",
-			config: probe.Config{
-				Protocol: "http",
-				Target:   "example.com",
-				Port:     80,
-				Interval: 60,
-			},
-			expected: "d5f27931",
-		},
-		{
-			name:     "HTTP probe on example.com with different system ID",
-			systemID: "sys1234",
-			config: probe.Config{
-				Protocol: "http",
-				Target:   "example.com",
-				Port:     80,
-				Interval: 60,
-			},
-			expected: "6f8b17f1",
-		},
-		{
-			name:     "Same probe, different interval",
-			systemID: "sys1234",
-			config: probe.Config{
-				Protocol: "http",
-				Target:   "example.com",
-				Port:     80,
-				Interval: 120,
-			},
-			expected: "6d4baf8",
-		},
-		{
-			name:     "ICMP probe on 1.1.1.1",
-			systemID: "sys456",
-			config: probe.Config{
-				Protocol: "icmp",
-				Target:   "1.1.1.1",
-				Port:     0,
-				Interval: 10,
-			},
-			expected: "80b5836b",
-		}, {
-			name:     "ICMP probe on 1.1.1.1 with different system ID",
-			systemID: "sys4567",
-			config: probe.Config{
-				Protocol: "icmp",
-				Target:   "1.1.1.1",
-				Port:     0,
-				Interval: 10,
-			},
-			expected: "a6652680",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := generateProbeID(tt.systemID, tt.config)
-			assert.Equal(t, tt.expected, got, "generateProbeID() = %v, want %v", got, tt.expected)
-		})
-	}
-}

internal/hub/systems/ssh_timeout_test.go

@@ -0,0 +1,56 @@
+//go:build testing
+
+package systems
+
+import (
+	"errors"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestRunWithTimeout covers the guard added for issue #2041: the per-system SSH
+// data exchange must never block the updater indefinitely on a dead connection.
+func TestRunWithTimeout(t *testing.T) {
+	t.Run("returns the operation result when it completes before the timeout", func(t *testing.T) {
+		synctest.Test(t, func(t *testing.T) {
+			wantErr := errors.New("boom")
+			onTimeoutCalled := false
+
+			retry, err := runWithTimeout(10*time.Second, func() (bool, error) {
+				return true, wantErr
+			}, func() { onTimeoutCalled = true })
+
+			assert.True(t, retry, "should return the operation's retry value")
+			assert.Equal(t, wantErr, err, "should return the operation's error")
+			assert.False(t, onTimeoutCalled, "onTimeout must not fire when the op completes")
+		})
+	})
+
+	t.Run("times out and tears down the connection when the op blocks", func(t *testing.T) {
+		synctest.Test(t, func(t *testing.T) {
+			// unblock simulates a half-open connection: the op is stuck reading a
+			// response that never arrives until the connection is torn down.
+			unblock := make(chan struct{})
+			onTimeoutCalled := false
+			start := time.Now()
+
+			retry, err := runWithTimeout(5*time.Second, func() (bool, error) {
+				<-unblock
+				return false, nil
+			}, func() {
+				onTimeoutCalled = true
+				close(unblock) // tearing down the connection releases the blocked read
+			})
+
+			assert.Equal(t, 5*time.Second, time.Since(start), "should return exactly at the timeout")
+			assert.True(t, retry, "a timeout should be retryable so the next tick re-dials")
+			assert.Error(t, err, "a timeout must surface an error so the system is set down")
+			assert.True(t, onTimeoutCalled, "onTimeout must fire so the dead connection is closed")
+
+			synctest.Wait() // ensure the released op goroutine exits cleanly
+		})
+	})
+}

internal/hub/systems/system.go

@@ -6,7 +6,6 @@ import (
 	"errors"
 	"fmt"
 	"hash/fnv"
-	"log/slog"
 	"math/rand"
 	"net"
 	"strings"
@@ -19,7 +18,6 @@ import (
 	"github.com/henrygd/beszel/internal/hub/ws"
 
 	"github.com/henrygd/beszel/internal/entities/container"
-	"github.com/henrygd/beszel/internal/entities/probe"
 	"github.com/henrygd/beszel/internal/entities/smart"
 	"github.com/henrygd/beszel/internal/entities/system"
 	"github.com/henrygd/beszel/internal/entities/systemd"
@@ -31,7 +29,6 @@ import (
 	"github.com/lxzan/gws"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/types"
 	"golang.org/x/crypto/ssh"
 )
 
@@ -241,12 +238,6 @@ func (sys *System) createRecords(data *system.CombinedData) (*core.Record, error
 			}
 		}
 
-		if data.Probes != nil {
-			if err := updateNetworkProbesRecords(txApp, data.Probes, sys.Id); err != nil {
-				return err
-			}
-		}
-
 		// update system record (do this last because it triggers alerts and we need above records to be inserted first)
 		systemRecord.Set("status", up)
 		systemRecord.Set("info", data.Info)
@@ -298,7 +289,7 @@ func createSystemdStatsRecords(app core.App, data []*systemd.Service, systemId s
 	for i, service := range data {
 		suffix := fmt.Sprintf("%d", i)
 		valueStrings = append(valueStrings, fmt.Sprintf("({:id%[1]s}, {:system}, {:name%[1]s}, {:state%[1]s}, {:sub%[1]s}, {:cpu%[1]s}, {:cpuPeak%[1]s}, {:memory%[1]s}, {:memPeak%[1]s}, {:updated})", suffix))
-		params["id"+suffix] = MakeStableHashId(systemId, service.Name)
+		params["id"+suffix] = makeStableHashId(systemId, service.Name)
 		params["name"+suffix] = service.Name
 		params["state"+suffix] = service.State
 		params["sub"+suffix] = service.Sub
@@ -315,95 +306,6 @@ func createSystemdStatsRecords(app core.App, data []*systemd.Service, systemId s
 	return err
 }
 
-func updateNetworkProbesRecords(app core.App, data map[string]probe.Result, systemId string) error {
-	if len(data) == 0 {
-		return nil
-	}
-	var err error
-	collectionName := "network_probes"
-
-	// If realtime updates are active, we save via PocketBase records to trigger realtime events.
-	// Otherwise we can do a more efficient direct update via SQL
-	realtimeActive := utils.RealtimeActiveForCollection(app, collectionName, func(filterQuery string) bool {
-		slog.Info("Checking realtime subscription filter for network probes", "filterQuery", filterQuery)
-		return !strings.Contains(filterQuery, "system") || strings.Contains(filterQuery, systemId)
-	})
-
-	var db dbx.Builder
-	var nowString string
-	var updateQuery *dbx.Query
-	if !realtimeActive {
-		db = app.DB()
-		nowString = time.Now().UTC().Format(types.DefaultDateLayout)
-		sql := fmt.Sprintf("UPDATE %s SET resAvg={:res}, resMin1h={:resMin1h}, resMax1h={:resMax1h}, resAvg1h={:resAvg1h}, loss1h={:loss1h}, updated={:updated} WHERE id={:id}", collectionName)
-		updateQuery = db.NewQuery(sql)
-	}
-
-	// insert network probe stats records
-	switch realtimeActive {
-	case true:
-		collection, _ := app.FindCachedCollectionByNameOrId("network_probe_stats")
-		record := core.NewRecord(collection)
-		record.Set("system", systemId)
-		record.Set("stats", data)
-		record.Set("type", "1m")
-		err = app.SaveNoValidate(record)
-	default:
-		if dataJSON, marshalErr := json.Marshal(data); marshalErr == nil {
-			sql := "INSERT INTO network_probe_stats (system, stats, type, created) VALUES ({:system}, {:stats}, {:type}, {:created})"
-			insertQuery := db.NewQuery(sql)
-			_, err = insertQuery.Bind(dbx.Params{
-				"system":  systemId,
-				"stats":   dataJSON,
-				"type":    "1m",
-				"created": nowString,
-			}).Execute()
-		}
-	}
-	if err != nil {
-		app.Logger().Error("Failed to update probe stats", "system", systemId, "err", err)
-	}
-
-	// update network_probes records
-	for id, values := range data {
-		switch realtimeActive {
-		case true:
-			var record *core.Record
-			record, err = app.FindRecordById(collectionName, id)
-			if err == nil {
-				record.Set("res", probeMetric(values, 0))
-				record.Set("resAvg1h", probeMetric(values, 1))
-				record.Set("resMin1h", probeMetric(values, 2))
-				record.Set("resMax1h", probeMetric(values, 3))
-				record.Set("loss1h", probeMetric(values, 4))
-				err = app.SaveNoValidate(record)
-			}
-		default:
-			_, err = updateQuery.Bind(dbx.Params{
-				"id":       id,
-				"res":      probeMetric(values, 0),
-				"resAvg1h": probeMetric(values, 1),
-				"resMin1h": probeMetric(values, 2),
-				"resMax1h": probeMetric(values, 3),
-				"loss1h":   probeMetric(values, 4),
-				"updated":  nowString,
-			}).Execute()
-		}
-		if err != nil {
-			app.Logger().Warn("Failed to update probe", "system", systemId, "probe", id, "err", err)
-		}
-	}
-
-	return nil
-}
-
-func probeMetric(values probe.Result, index int) float64 {
-	if index < len(values) {
-		return values[index]
-	}
-	return 0
-}
-
 // createContainerRecords creates container records
 func createContainerRecords(app core.App, data []*container.Stats, systemId string) error {
 	if len(data) == 0 {
@@ -486,6 +388,7 @@ func (sys *System) setDown(originalError error) error {
 	if originalError != nil {
 		sys.manager.hub.Logger().Error("System down", "system", record.GetString("name"), "err", originalError)
 	}
+	sys.detailsFetched.Store(false)
 	record.Set("status", down)
 	return sys.manager.hub.SaveNoValidate(record)
 }
@@ -629,16 +532,21 @@ func (sys *System) FetchSystemdInfoFromAgent(serviceName string) (systemd.Servic
 	return result, err
 }
 
-// FetchSmartDataFromAgent fetches SMART data from the agent
-func (sys *System) FetchSmartDataFromAgent() (map[string]smart.SmartData, error) {
+// FetchSmartDataFromAgent fetches SMART data from the agent.
+func (sys *System) FetchSmartDataFromAgent() (smart.SmartDataResponse, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
 	defer cancel()
-	var result map[string]smart.SmartData
+	if sys.agentVersion.LT(beszel.MinVersionAgentResponse) {
+		var data map[string]smart.SmartData
+		err := sys.request(ctx, common.GetSmartData, nil, &data)
+		return smart.SmartDataResponse{Data: data}, err
+	}
+	var result smart.SmartDataResponse
 	err := sys.request(ctx, common.GetSmartData, nil, &result)
 	return result, err
 }
 
-func MakeStableHashId(strings ...string) string {
+func makeStableHashId(strings ...string) string {
 	hash := fnv.New32a()
 	for _, str := range strings {
 		hash.Write([]byte(str))
@@ -721,10 +629,17 @@ func (sys *System) runSSHOperation(timeout time.Duration, retries int, operation
 			continue
 		}
 
-		retry, opErr := func() (bool, error) {
+		// Bound the whole operation. A half-open TCP connection (a dead peer that
+		// never sends RST/FIN) or a wedged agent that accepts the session but
+		// never writes a response would otherwise block the read forever. Because
+		// StartUpdater runs update() synchronously on its ticker, that stalls the
+		// per-system updater indefinitely with no error and no re-dial until the
+		// hub is restarted (issue #2041). On timeout we tear down the connection
+		// so the blocked read unwinds and the system is re-dialed on the next tick.
+		retry, opErr := runWithTimeout(sshOperationTimeout, func() (bool, error) {
 			defer session.Close()
 			return operation(session)
-		}()
+		}, sys.closeSSHConnection)
 
 		if opErr == nil {
 			return nil
@@ -743,6 +658,43 @@ func (sys *System) runSSHOperation(timeout time.Duration, retries int, operation
 	return fmt.Errorf("ssh operation failed")
 }
 
+// sshOperationTimeout bounds a single SSH data exchange (send request, read
+// response, wait for the remote command to exit). It is more generous than the
+// session-creation timeout to tolerate briefly slow agents, but is kept well
+// under the collection interval so a stalled connection is detected and
+// re-dialed within one cycle (see issue #2041).
+const sshOperationTimeout = 20 * time.Second
+
+// runWithTimeout runs op in a goroutine and returns its result, or, if op does
+// not finish within timeout, calls onTimeout (used to tear down the connection
+// so a blocked op can unwind) and returns a retryable timeout error. This
+// guarantees the caller can never block indefinitely on a dead SSH connection.
+func runWithTimeout(timeout time.Duration, op func() (bool, error), onTimeout func()) (retry bool, err error) {
+	type opResult struct {
+		retry bool
+		err   error
+	}
+	// Buffered so the op goroutine never leaks even when we return on timeout.
+	done := make(chan opResult, 1)
+	go func() {
+		r, e := op()
+		done <- opResult{retry: r, err: e}
+	}()
+
+	timer := time.NewTimer(timeout)
+	defer timer.Stop()
+
+	select {
+	case res := <-done:
+		return res.retry, res.err
+	case <-timer.C:
+		if onTimeout != nil {
+			onTimeout()
+		}
+		return true, fmt.Errorf("ssh operation timed out after %s", timeout)
+	}
+}
+
 // createSSHClient creates a new SSH client for the system
 func (s *System) createSSHClient() error {
 	if s.manager.sshConfig == nil {
@@ -758,7 +710,7 @@ func (s *System) createSSHClient() error {
 		host = net.JoinHostPort(host, s.Port)
 	}
 	var err error
-	s.client, err = ssh.Dial(network, host, s.manager.sshConfig)
+	s.client, err = dialSSHWithKeepAlive(network, host, s.manager.sshConfig)
 	if err != nil {
 		return err
 	}
@@ -767,6 +719,34 @@ func (s *System) createSSHClient() error {
 	return nil
 }
 
+// sshKeepAliveInterval is the TCP keep-alive idle interval for SSH connections
+// to agents. Enabling OS-level keep-alives lets the hub eventually detect a
+// dead peer on an otherwise idle connection instead of trusting it forever.
+// This is a backstop for genuine network death; an application-level wedge
+// (agent process hung while its kernel keeps ACKing) is caught by the
+// per-operation timeout in runSSHOperation instead (see issue #2041).
+const sshKeepAliveInterval = 30 * time.Second
+
+// dialSSHWithKeepAlive dials an SSH connection like ssh.Dial, but enables TCP
+// keep-alive on the underlying connection so half-open connections are
+// eventually detected by the operating system.
+func dialSSHWithKeepAlive(network, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
+	dialer := net.Dialer{
+		Timeout:   config.Timeout,
+		KeepAlive: sshKeepAliveInterval,
+	}
+	conn, err := dialer.Dial(network, addr)
+	if err != nil {
+		return nil, err
+	}
+	sshConn, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
+	if err != nil {
+		_ = conn.Close()
+		return nil, err
+	}
+	return ssh.NewClient(sshConn, chans, reqs), nil
+}
+
 // createSessionWithTimeout creates a new SSH session with a timeout to avoid hanging
 // in case of network issues
 func (sys *System) createSessionWithTimeout(timeout time.Duration) (*ssh.Session, error) {

internal/hub/systems/system_manager.go

@@ -7,7 +7,6 @@ import (
 
 	"github.com/henrygd/beszel/internal/hub/ws"
 
-	"github.com/henrygd/beszel/internal/entities/probe"
 	"github.com/henrygd/beszel/internal/entities/system"
 	"github.com/henrygd/beszel/internal/hub/expirymap"
 
@@ -16,7 +15,6 @@ import (
 	"github.com/henrygd/beszel"
 
 	"github.com/blang/semver"
-	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/store"
 	"golang.org/x/crypto/ssh"
@@ -319,17 +317,6 @@ func (sm *SystemManager) AddWebSocketSystem(systemId string, agentVersion semver
 	if err := sm.AddRecord(systemRecord, system); err != nil {
 		return err
 	}
-
-	// Sync network probes to the newly connected agent
-	go func() {
-		configs := sm.GetProbeConfigsForSystem(systemId)
-		if len(configs) > 0 {
-			if err := system.SyncNetworkProbes(configs); err != nil {
-				sm.hub.Logger().Warn("failed to sync probes to agent", "system", systemId, "err", err)
-			}
-		}
-	}()
-
 	return nil
 }
 
@@ -342,16 +329,6 @@ func (sm *SystemManager) resetFailedSmartFetchState(systemID string) {
 	}
 }
 
-// GetProbeConfigsForSystem returns all enabled probe configs for a system.
-func (sm *SystemManager) GetProbeConfigsForSystem(systemID string) []probe.Config {
-	var configs []probe.Config
-	_ = sm.hub.DB().
-		NewQuery("SELECT id, target, protocol, port, interval FROM network_probes WHERE system = {:system} AND enabled = true").
-		Bind(dbx.Params{"system": systemID}).
-		All(&configs)
-	return configs
-}
-
 // createSSHClientConfig initializes the SSH client configuration for connecting to an agent's server
 func (sm *SystemManager) createSSHClientConfig() error {
 	privateKey, err := sm.hub.GetSSHKey("")

internal/hub/systems/system_probes.go

@@ -1,57 +0,0 @@
-package systems
-
-import (
-	"context"
-	"time"
-
-	"github.com/henrygd/beszel/internal/common"
-	"github.com/henrygd/beszel/internal/entities/probe"
-)
-
-// SyncNetworkProbes sends probe configurations to the agent.
-func (sys *System) SyncNetworkProbes(configs []probe.Config) error {
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	var result string
-	return sys.request(ctx, common.SyncNetworkProbes, configs, &result)
-}
-
-// FetchNetworkProbeResults fetches probe results from the agent.
-// func (sys *System) FetchNetworkProbeResults() (map[string]probe.Result, error) {
-// 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-// 	defer cancel()
-// 	var results map[string]probe.Result
-// 	err := sys.request(ctx, common.GetNetworkProbeResults, nil, &results)
-// 	return results, err
-// }
-
-// hasEnabledProbes returns true if this system has any enabled network probes.
-// func (sys *System) hasEnabledProbes() bool {
-// 	count, err := sys.manager.hub.CountRecords("network_probes",
-// 		dbx.NewExp("system = {:system} AND enabled = true", dbx.Params{"system": sys.Id}))
-// 	return err == nil && count > 0
-// }
-
-// fetchAndSaveProbeResults fetches probe results and saves them to the database.
-// func (sys *System) fetchAndSaveProbeResults() {
-// 	hub := sys.manager.hub
-
-// 	results, err := sys.FetchNetworkProbeResults()
-// 	if err != nil || len(results) == 0 {
-// 		return
-// 	}
-
-// 	collection, err := hub.FindCachedCollectionByNameOrId("network_probe_stats")
-// 	if err != nil {
-// 		return
-// 	}
-
-// 	record := core.NewRecord(collection)
-// 	record.Set("system", sys.Id)
-// 	record.Set("stats", results)
-// 	record.Set("type", "1m")
-
-// 	if err := hub.SaveNoValidate(record); err != nil {
-// 		hub.Logger().Warn("failed to save probe stats", "system", sys.Id, "err", err)
-// 	}
-// }

internal/hub/systems/system_smart.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/henrygd/beszel/internal/entities/smart"
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 )
 
@@ -17,13 +18,13 @@ type smartFetchState struct {
 
 // FetchAndSaveSmartDevices fetches SMART data from the agent and saves it to the database
 func (sys *System) FetchAndSaveSmartDevices() error {
-	smartData, err := sys.FetchSmartDataFromAgent()
+	response, err := sys.FetchSmartDataFromAgent()
 	if err != nil {
 		sys.recordSmartFetchResult(err, 0)
 		return err
 	}
-	err = sys.saveSmartDevices(smartData)
-	sys.recordSmartFetchResult(err, len(smartData))
+	err = sys.saveSmartDevices(response.Data, response.Complete)
+	sys.recordSmartFetchResult(err, len(response.Data))
 	return err
 }
 
@@ -61,8 +62,9 @@ func (sys *System) smartFetchInterval() time.Duration {
 	return time.Hour
 }
 
-// saveSmartDevices saves SMART device data to the smart_devices collection
-func (sys *System) saveSmartDevices(smartData map[string]smart.SmartData) error {
+// saveSmartDevices saves SMART device data and, after a complete refresh,
+// removes rows for devices that are no longer reported.
+func (sys *System) saveSmartDevices(smartData map[string]smart.SmartData, complete bool) error {
 	if len(smartData) == 0 {
 		return nil
 	}
@@ -73,20 +75,49 @@ func (sys *System) saveSmartDevices(smartData map[string]smart.SmartData) error
 		return err
 	}
 
-	for deviceKey, device := range smartData {
-		if err := sys.upsertSmartDeviceRecord(collection, deviceKey, device); err != nil {
-			return err
-		}
+	currentIDs := make(map[string]struct{}, len(smartData))
+	for deviceKey := range smartData {
+		currentIDs[makeStableHashId(sys.Id, deviceKey)] = struct{}{}
 	}
 
-	return nil
+	err = hub.RunInTransaction(func(txApp core.App) error {
+		if complete {
+			existing, err := txApp.FindRecordsByFilter(
+				collection,
+				"system = {:system}",
+				"",
+				0,
+				0,
+				dbx.Params{"system": sys.Id},
+			)
+			if err != nil {
+				return err
+			}
+			for _, record := range existing {
+				if _, ok := currentIDs[record.Id]; ok {
+					continue
+				}
+				if err := txApp.Delete(record); err != nil {
+					return err
+				}
+			}
+		}
+
+		for deviceKey, device := range smartData {
+			if err := sys.upsertSmartDeviceRecord(txApp, collection, deviceKey, device); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+	return err
 }
 
-func (sys *System) upsertSmartDeviceRecord(collection *core.Collection, deviceKey string, device smart.SmartData) error {
-	hub := sys.manager.hub
-	recordID := MakeStableHashId(sys.Id, deviceKey)
+func (sys *System) upsertSmartDeviceRecord(app core.App, collection *core.Collection, deviceKey string, device smart.SmartData) error {
+	recordID := makeStableHashId(sys.Id, deviceKey)
 
-	record, err := hub.FindRecordById(collection, recordID)
+	record, err := app.FindRecordById(collection, recordID)
 	if err != nil {
 		if !errors.Is(err, sql.ErrNoRows) {
 			return err
@@ -114,7 +145,7 @@ func (sys *System) upsertSmartDeviceRecord(collection *core.Collection, deviceKe
 	record.Set("cycles", powerCycles)
 	record.Set("attributes", device.Attributes)
 
-	return hub.SaveNoValidate(record)
+	return app.SaveNoValidate(record)
 }
 
 // extractPowerMetrics extracts power on hours and power cycles from SMART attributes

internal/hub/systems/system_smart_test.go

@@ -7,10 +7,53 @@ import (
 	"testing"
 	"time"
 
+	"github.com/henrygd/beszel/internal/entities/smart"
+	esystem "github.com/henrygd/beszel/internal/entities/system"
 	"github.com/henrygd/beszel/internal/hub/expirymap"
+	_ "github.com/henrygd/beszel/internal/migrations"
+
+	"github.com/pocketbase/pocketbase/core"
+	pbtests "github.com/pocketbase/pocketbase/tests"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/ssh"
 )
 
+// stubHub implements hubLike using a plain pocketbase test app, so
+// smart-device DB tests can run in-package without an import cycle to
+// internal/hub (which imports this package).
+type stubHub struct{ core.App }
+
+func (stubHub) GetSSHKey(dataDir string) (ssh.Signer, error) { return nil, nil }
+func (stubHub) HandleSystemAlerts(systemRecord *core.Record, data *esystem.CombinedData) error {
+	return nil
+}
+func (stubHub) HandleStatusAlerts(status string, systemRecord *core.Record) error { return nil }
+func (stubHub) CancelPendingStatusAlerts(systemID string)                         {}
+
+// newTestSystemWithHub creates a System backed by a real (temp) database, along
+// with a matching "systems" record, for tests that need to exercise DB reads/writes.
+func newTestSystemWithHub(t *testing.T) (*System, *pbtests.TestApp) {
+	t.Helper()
+	testApp, err := pbtests.NewTestApp(t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(testApp.Cleanup)
+
+	sm := &SystemManager{hub: stubHub{testApp}, smartFetchMap: expirymap.New[smartFetchState](time.Hour)}
+	t.Cleanup(sm.smartFetchMap.StopCleaner)
+
+	col, err := testApp.FindCachedCollectionByNameOrId("systems")
+	require.NoError(t, err)
+	systemRecord := core.NewRecord(col)
+	systemRecord.Set("name", "test-system")
+	systemRecord.Set("host", "127.0.0.1")
+	systemRecord.Set("port", "45876")
+	require.NoError(t, testApp.SaveNoValidate(systemRecord))
+
+	sys := &System{Id: systemRecord.Id, manager: sm}
+	return sys, testApp
+}
+
 func TestRecordSmartFetchResult(t *testing.T) {
 	sm := &SystemManager{smartFetchMap: expirymap.New[smartFetchState](time.Hour)}
 	t.Cleanup(sm.smartFetchMap.StopCleaner)
@@ -92,3 +135,95 @@ func TestResetFailedSmartFetchState(t *testing.T) {
 	_, ok = sm.smartFetchMap.GetOk("system-1")
 	assert.True(t, ok, "expected successful smart fetch state to be preserved")
 }
+
+// countSmartDeviceRecords returns the number of smart_devices rows for the given system.
+func countSmartDeviceRecords(t *testing.T, app core.App, systemID string) []*core.Record {
+	t.Helper()
+	records, err := app.FindAllRecords("smart_devices", nil)
+	require.NoError(t, err)
+	var forSystem []*core.Record
+	for _, r := range records {
+		if r.GetString("system") == systemID {
+			forSystem = append(forSystem, r)
+		}
+	}
+	return forSystem
+}
+
+func TestSaveSmartDevices_RemovesStaleDevices(t *testing.T) {
+	sys, testApp := newTestSystemWithHub(t)
+
+	// first fetch reports two devices: sda (serial AAA) and sdb (serial BBB)
+	err := sys.saveSmartDevices(map[string]smart.SmartData{
+		"AAA": {SerialNumber: "AAA", DiskName: "sda", ModelName: "Disk A"},
+		"BBB": {SerialNumber: "BBB", DiskName: "sdb", ModelName: "Disk B"},
+	}, true)
+	require.NoError(t, err)
+
+	records := countSmartDeviceRecords(t, testApp, sys.Id)
+	require.Len(t, records, 2, "expected both devices to be saved")
+
+	var recordA *core.Record
+	for _, r := range records {
+		if r.GetString("serial") == "AAA" {
+			recordA = r
+		}
+	}
+	require.NotNil(t, recordA, "expected to find device AAA")
+	originalID := recordA.Id
+
+	deleteEvents := 0
+	testApp.OnRecordAfterDeleteSuccess("smart_devices").BindFunc(func(e *core.RecordEvent) error {
+		deleteEvents++
+		return e.Next()
+	})
+
+	// A complete refresh confirms that BBB is gone, so remove it through
+	// PocketBase and notify realtime subscribers.
+	err = sys.saveSmartDevices(map[string]smart.SmartData{
+		"AAA": {SerialNumber: "AAA", DiskName: "sda", ModelName: "Disk A", Temperature: 42},
+	}, true)
+	require.NoError(t, err)
+
+	records = countSmartDeviceRecords(t, testApp, sys.Id)
+	require.Len(t, records, 1, "expected stale device BBB to be removed")
+	assert.Equal(t, "AAA", records[0].GetString("serial"))
+	assert.Equal(t, originalID, records[0].Id, "expected existing device to be updated in place, not recreated")
+	assert.EqualValues(t, 42, records[0].GetInt("temp"))
+	assert.Equal(t, 1, deleteEvents, "expected PocketBase delete hooks to run")
+}
+
+func TestSaveSmartDevices_IncompleteDataDoesNotRemoveDevices(t *testing.T) {
+	sys, testApp := newTestSystemWithHub(t)
+
+	require.NoError(t, sys.saveSmartDevices(map[string]smart.SmartData{
+		"AAA": {SerialNumber: "AAA", DiskName: "sda"},
+		"BBB": {SerialNumber: "BBB", DiskName: "sdb"},
+	}, true))
+
+	// AAA was collected but BBB failed. The response is useful for updating AAA,
+	// but it is not authoritative enough to remove BBB.
+	require.NoError(t, sys.saveSmartDevices(map[string]smart.SmartData{
+		"AAA": {SerialNumber: "AAA", DiskName: "sda", Temperature: 42},
+	}, false))
+
+	assert.Len(t, countSmartDeviceRecords(t, testApp, sys.Id), 2)
+	recordA, err := testApp.FindRecordById("smart_devices", makeStableHashId(sys.Id, "AAA"))
+	require.NoError(t, err)
+	assert.EqualValues(t, 42, recordA.GetInt("temp"))
+}
+
+func TestSaveSmartDevices_EmptyDataIsNoop(t *testing.T) {
+	sys, testApp := newTestSystemWithHub(t)
+
+	err := sys.saveSmartDevices(map[string]smart.SmartData{
+		"AAA": {SerialNumber: "AAA", DiskName: "sda"},
+	}, true)
+	require.NoError(t, err)
+
+	err = sys.saveSmartDevices(map[string]smart.SmartData{}, true)
+	require.NoError(t, err)
+
+	records := countSmartDeviceRecords(t, testApp, sys.Id)
+	assert.Len(t, records, 1, "empty fetch result should not delete existing devices")
+}

internal/hub/systems/system_systemd_test.go

@@ -14,9 +14,9 @@ func TestGetSystemdServiceId(t *testing.T) {
 		serviceName := "nginx.service"
 
 		// Call multiple times and ensure same result
-		id1 := MakeStableHashId(systemId, serviceName)
-		id2 := MakeStableHashId(systemId, serviceName)
-		id3 := MakeStableHashId(systemId, serviceName)
+		id1 := makeStableHashId(systemId, serviceName)
+		id2 := makeStableHashId(systemId, serviceName)
+		id3 := makeStableHashId(systemId, serviceName)
 
 		assert.Equal(t, id1, id2)
 		assert.Equal(t, id2, id3)
@@ -29,10 +29,10 @@ func TestGetSystemdServiceId(t *testing.T) {
 		serviceName1 := "nginx.service"
 		serviceName2 := "apache.service"
 
-		id1 := MakeStableHashId(systemId1, serviceName1)
-		id2 := MakeStableHashId(systemId2, serviceName1)
-		id3 := MakeStableHashId(systemId1, serviceName2)
-		id4 := MakeStableHashId(systemId2, serviceName2)
+		id1 := makeStableHashId(systemId1, serviceName1)
+		id2 := makeStableHashId(systemId2, serviceName1)
+		id3 := makeStableHashId(systemId1, serviceName2)
+		id4 := makeStableHashId(systemId2, serviceName2)
 
 		// All IDs should be different
 		assert.NotEqual(t, id1, id2)
@@ -56,14 +56,14 @@ func TestGetSystemdServiceId(t *testing.T) {
 		}
 
 		for _, tc := range testCases {
-			id := MakeStableHashId(tc.systemId, tc.serviceName)
+			id := makeStableHashId(tc.systemId, tc.serviceName)
 			// FNV-32 produces 8 hex characters
 			assert.Len(t, id, 8, "ID should be 8 characters for systemId='%s', serviceName='%s'", tc.systemId, tc.serviceName)
 		}
 	})
 
 	t.Run("hexadecimal output", func(t *testing.T) {
-		id := MakeStableHashId("test-system", "test-service")
+		id := makeStableHashId("test-system", "test-service")
 		assert.NotEmpty(t, id)
 
 		// Should only contain hexadecimal characters

internal/hub/transport/transport.go

@@ -88,15 +88,23 @@ func unmarshalLegacyResponse(resp common.AgentResponse, action common.WebSocketA
 		*d = *resp.String
 		return nil
 	case common.GetSmartData:
-		d, ok := dest.(*map[string]smart.SmartData)
-		if !ok {
+		switch d := dest.(type) {
+		case *map[string]smart.SmartData:
+			if resp.SmartData == nil {
+				return errors.New("no SMART data in response")
+			}
+			*d = resp.SmartData
+			return nil
+		case *smart.SmartDataResponse:
+			if resp.SmartData == nil {
+				return errors.New("no SMART data in response")
+			}
+			d.Data = resp.SmartData
+			d.Complete = resp.SmartComplete
+			return nil
+		default:
 			return fmt.Errorf("unexpected dest type for GetSmartData: %T", dest)
 		}
-		if resp.SmartData == nil {
-			return errors.New("no SMART data in response")
-		}
-		*d = resp.SmartData
-		return nil
 	case common.GetSystemdInfo:
 		d, ok := dest.(*systemd.ServiceDetails)
 		if !ok {

internal/hub/transport/transport_test.go

@@ -0,0 +1,33 @@
+package transport
+
+import (
+	"testing"
+
+	"github.com/henrygd/beszel/internal/common"
+	"github.com/henrygd/beszel/internal/entities/smart"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUnmarshalSmartDataResponse(t *testing.T) {
+	for _, test := range []struct {
+		name     string
+		complete bool
+	}{
+		{name: "complete response", complete: true},
+		{name: "older agent defaults to incomplete", complete: false},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			response := common.AgentResponse{
+				SmartData: map[string]smart.SmartData{
+					"AAA": {SerialNumber: "AAA"},
+				},
+				SmartComplete: test.complete,
+			}
+			var result smart.SmartDataResponse
+			require.NoError(t, UnmarshalResponse(response, common.GetSmartData, &result))
+			assert.Equal(t, test.complete, result.Complete)
+			assert.Equal(t, "AAA", result.Data["AAA"].SerialNumber)
+		})
+	}
+}

internal/hub/utils/utils.go

@@ -1,11 +1,7 @@
 // Package utils provides utility functions for the hub.
 package utils
 
-import (
-	"os"
-
-	"github.com/pocketbase/pocketbase/core"
-)
+import "os"
 
 // GetEnv retrieves an environment variable with a "BESZEL_HUB_" prefix, or falls back to the unprefixed key.
 func GetEnv(key string) (value string, exists bool) {
@@ -14,26 +10,3 @@ func GetEnv(key string) (value string, exists bool) {
 	}
 	return os.LookupEnv(key)
 }
-
-// realtimeActiveForCollection checks if there are active WebSocket subscriptions for the given collection.
-func RealtimeActiveForCollection(app core.App, collectionName string, validateFn func(filterQuery string) bool) bool {
-	broker := app.SubscriptionsBroker()
-	if broker.TotalClients() == 0 {
-		return false
-	}
-	for _, client := range broker.Clients() {
-		subs := client.Subscriptions(collectionName)
-		if len(subs) > 0 {
-			if validateFn == nil {
-				return true
-			}
-			for k := range subs {
-				filter := subs[k].Query["filter"]
-				if validateFn(filter) {
-					return true
-				}
-			}
-		}
-	}
-	return false
-}

internal/migrations/0_collections_snapshot_0_19_0_dev_1.go

@@ -1699,223 +1699,6 @@ func init() {
 		"type": "base",
 		"updateRule": null,
 		"viewRule": null
-	},
-	{
-		"id": "np_probes_001",
-		"listRule": null,
-		"viewRule": null,
-		"createRule": null,
-		"updateRule": null,
-		"deleteRule": null,
-		"name": "network_probes",
-		"type": "base",
-		"fields": [
-			{
-				"autogeneratePattern": "[a-z0-9]{15}",
-				"hidden": false,
-				"id": "text3208210256",
-				"max": 15,
-				"min": 15,
-				"name": "id",
-				"pattern": "^[a-z0-9]+$",
-				"presentable": false,
-				"primaryKey": true,
-				"required": true,
-				"system": true,
-				"type": "text"
-			},
-			{
-				"cascadeDelete": true,
-				"collectionId": "2hz5ncl8tizk5nx",
-				"hidden": false,
-				"id": "np_system",
-				"maxSelect": 1,
-				"minSelect": 0,
-				"name": "system",
-				"presentable": false,
-				"required": true,
-				"system": false,
-				"type": "relation"
-			},
-			{
-				"hidden": false,
-				"id": "np_name",
-				"max": 200,
-				"min": 0,
-				"name": "name",
-				"pattern": "",
-				"presentable": false,
-				"primaryKey": false,
-				"required": false,
-				"system": false,
-				"type": "text"
-			},
-			{
-				"hidden": false,
-				"id": "np_target",
-				"max": 500,
-				"min": 1,
-				"name": "target",
-				"pattern": "",
-				"presentable": false,
-				"primaryKey": false,
-				"required": true,
-				"system": false,
-				"type": "text"
-			},
-			{
-				"hidden": false,
-				"id": "np_protocol",
-				"maxSelect": 1,
-				"name": "protocol",
-				"presentable": false,
-				"required": true,
-				"system": false,
-				"type": "select",
-				"values": ["icmp", "tcp", "http"]
-			},
-			{
-				"hidden": false,
-				"id": "np_port",
-				"max": 65535,
-				"min": 0,
-				"name": "port",
-				"onlyInt": true,
-				"presentable": false,
-				"required": false,
-				"system": false,
-				"type": "number"
-			},
-			{
-				"hidden": false,
-				"id": "np_interval",
-				"max": 3600,
-				"min": 1,
-				"name": "interval",
-				"onlyInt": true,
-				"presentable": false,
-				"required": true,
-				"system": false,
-				"type": "number"
-			},
-			{
-				"hidden": false,
-				"id": "np_enabled",
-				"name": "enabled",
-				"presentable": false,
-				"required": false,
-				"system": false,
-				"type": "bool"
-			},
-			{
-				"hidden": false,
-				"id": "autodate2990389176",
-				"name": "created",
-				"onCreate": true,
-				"onUpdate": false,
-				"presentable": false,
-				"system": false,
-				"type": "autodate"
-			},
-			{
-				"hidden": false,
-				"id": "autodate3332085495",
-				"name": "updated",
-				"onCreate": true,
-				"onUpdate": true,
-				"presentable": false,
-				"system": false,
-				"type": "autodate"
-			}
-		],
-		"indexes": [
-			"CREATE INDEX ` + "`" + `idx_np_system_enabled` + "`" + ` ON ` + "`" + `network_probes` + "`" + ` (\n  ` + "`" + `system` + "`" + `,\n  ` + "`" + `enabled` + "`" + `\n)"
-		],
-		"system": false
-	},
-	{
-		"id": "np_stats_001",
-		"listRule": null,
-		"viewRule": null,
-		"createRule": null,
-		"updateRule": null,
-		"deleteRule": null,
-		"name": "network_probe_stats",
-		"type": "base",
-		"fields": [
-			{
-				"autogeneratePattern": "[a-z0-9]{15}",
-				"hidden": false,
-				"id": "text3208210256",
-				"max": 15,
-				"min": 15,
-				"name": "id",
-				"pattern": "^[a-z0-9]+$",
-				"presentable": false,
-				"primaryKey": true,
-				"required": true,
-				"system": true,
-				"type": "text"
-			},
-			{
-				"cascadeDelete": true,
-				"collectionId": "2hz5ncl8tizk5nx",
-				"hidden": false,
-				"id": "nps_system",
-				"maxSelect": 1,
-				"minSelect": 0,
-				"name": "system",
-				"presentable": false,
-				"required": true,
-				"system": false,
-				"type": "relation"
-			},
-			{
-				"hidden": false,
-				"id": "nps_stats",
-				"maxSize": 2000000,
-				"name": "stats",
-				"presentable": false,
-				"required": true,
-				"system": false,
-				"type": "json"
-			},
-			{
-				"hidden": false,
-				"id": "nps_type",
-				"maxSelect": 1,
-				"name": "type",
-				"presentable": false,
-				"required": true,
-				"system": false,
-				"type": "select",
-				"values": ["1m", "10m", "20m", "120m", "480m"]
-			},
-			{
-				"hidden": false,
-				"id": "autodate2990389176",
-				"name": "created",
-				"onCreate": true,
-				"onUpdate": false,
-				"presentable": false,
-				"system": false,
-				"type": "autodate"
-			},
-			{
-				"hidden": false,
-				"id": "autodate3332085495",
-				"name": "updated",
-				"onCreate": true,
-				"onUpdate": true,
-				"presentable": false,
-				"system": false,
-				"type": "autodate"
-			}
-		],
-		"indexes": [
-			"CREATE INDEX ` + "`" + `idx_nps_system_type_created` + "`" + ` ON ` + "`" + `network_probe_stats` + "`" + ` (\n  ` + "`" + `system` + "`" + `,\n  ` + "`" + `type` + "`" + `,\n  ` + "`" + `created` + "`" + `\n)"
-		],
-		"system": false
 	}
 ]`
 

internal/records/probe_averaging_test.go

@@ -1,58 +0,0 @@
-//go:build testing
-
-package records_test
-
-import (
-	"testing"
-
-	"github.com/henrygd/beszel/internal/records"
-	"github.com/henrygd/beszel/internal/tests"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestAverageProbeStats(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	rm := records.NewRecordManager(hub)
-	user, err := tests.CreateUser(hub, "probe-avg@example.com", "testtesttest")
-	require.NoError(t, err)
-	system, err := tests.CreateRecord(hub, "systems", map[string]any{
-		"name":   "probe-avg-system",
-		"host":   "localhost",
-		"port":   "45876",
-		"status": "up",
-		"users":  []string{user.Id},
-	})
-	require.NoError(t, err)
-
-	recordA, err := tests.CreateRecord(hub, "network_probe_stats", map[string]any{
-		"system": system.Id,
-		"type":   "1m",
-		"stats":  `{"icmp:1.1.1.1":[10,80,8,14,1]}`,
-	})
-	require.NoError(t, err)
-	recordB, err := tests.CreateRecord(hub, "network_probe_stats", map[string]any{
-		"system": system.Id,
-		"type":   "1m",
-		"stats":  `{"icmp:1.1.1.1":[40,100,9,50,5]}`,
-	})
-	require.NoError(t, err)
-
-	result := rm.AverageProbeStats(hub.DB(), records.RecordIds{
-		{Id: recordA.Id},
-		{Id: recordB.Id},
-	})
-
-	stats, ok := result["icmp:1.1.1.1"]
-	require.True(t, ok)
-	require.Len(t, stats, 5)
-	assert.Equal(t, 25.0, stats[0])
-	assert.Equal(t, 90.0, stats[1])
-	assert.Equal(t, 8.0, stats[2])
-	assert.Equal(t, 50.0, stats[3])
-	assert.Equal(t, 3.0, stats[4])
-}

internal/records/records.go

@@ -3,12 +3,11 @@ package records
 
 import (
 	"encoding/json"
-	"log"
+	"log/slog"
 	"math"
 	"time"
 
 	"github.com/henrygd/beszel/internal/entities/container"
-	"github.com/henrygd/beszel/internal/entities/probe"
 	"github.com/henrygd/beszel/internal/entities/system"
 
 	"github.com/pocketbase/dbx"
@@ -69,19 +68,18 @@ func (rm *RecordManager) CreateLongerRecords() {
 		},
 	}
 	// wrap the operations in a transaction
+	// Pocketbase cron does not handle errors, log them here.
 	rm.app.RunInTransaction(func(txApp core.App) error {
 		var err error
-		collections := [3]*core.Collection{}
+		collections := [2]*core.Collection{}
 		collections[0], err = txApp.FindCachedCollectionByNameOrId("system_stats")
 		if err != nil {
+			slog.Error("Error finding cached collection using system stats:", "err", err)
 			return err
 		}
 		collections[1], err = txApp.FindCachedCollectionByNameOrId("container_stats")
 		if err != nil {
-			return err
-		}
-		collections[2], err = txApp.FindCachedCollectionByNameOrId("network_probe_stats")
-		if err != nil {
+			slog.Error("Error finding cached collection using container stats:", "err", err)
 			return err
 		}
 		var systems RecordIds
@@ -143,12 +141,11 @@ func (rm *RecordManager) CreateLongerRecords() {
 					case "system_stats":
 						longerRecord.Set("stats", rm.AverageSystemStats(db, recordIds))
 					case "container_stats":
+
 						longerRecord.Set("stats", rm.AverageContainerStats(db, recordIds))
-					case "network_probe_stats":
-						longerRecord.Set("stats", rm.AverageProbeStats(db, recordIds))
 					}
 					if err := txApp.SaveNoValidate(longerRecord); err != nil {
-						log.Println("failed to save longer record", "err", err)
+						slog.Error("failed to save longer record", "err", err)
 					}
 				}
 			}
@@ -194,6 +191,8 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 	// accumulate cpu breakdown [user, system, iowait, steal, idle]
 	var cpuBreakdownSums []float64
 	tempCount := float64(0)
+	var fanSums map[string]uint64
+	fanCount := uint64(0)
 
 	// Accumulate totals
 	for i := range records {
@@ -285,6 +284,17 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 			}
 		}
 
+		// Accumulate fan speeds
+		if stats.Fans != nil {
+			if fanSums == nil {
+				fanSums = make(map[string]uint64, len(stats.Fans))
+			}
+			fanCount++
+			for key, value := range stats.Fans {
+				fanSums[key] += uint64(value)
+			}
+		}
+
 		// Accumulate extra filesystem stats
 		if stats.ExtraFs != nil {
 			if sum.ExtraFs == nil {
@@ -390,6 +400,14 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 		}
 	}
 
+	// Average fan speeds
+	if fanSums != nil && fanCount > 0 {
+		sum.Fans = make(map[string]uint16, len(fanSums))
+		for key, value := range fanSums {
+			sum.Fans[key] = uint16(value / fanCount)
+		}
+	}
+
 	// Average extra filesystem stats
 	if sum.ExtraFs != nil {
 		for key := range sum.ExtraFs {
@@ -506,80 +524,6 @@ func AverageContainerStatsSlice(records [][]container.Stats) []container.Stats {
 	return result
 }
 
-// AverageProbeStats averages probe stats across multiple records.
-// For each probe key: avg of average fields, min of mins, and max of maxes.
-func (rm *RecordManager) AverageProbeStats(db dbx.Builder, records RecordIds) map[string]probe.Result {
-	type probeValues struct {
-		sums   probe.Result
-		counts []int
-	}
-
-	query := db.NewQuery("SELECT stats FROM network_probe_stats WHERE id = {:id}")
-
-	// accumulate sums for each probe key across records
-	sums := make(map[string]*probeValues)
-	var row StatsRecord
-	for _, rec := range records {
-		row.Stats = row.Stats[:0]
-		query.Bind(dbx.Params{"id": rec.Id}).One(&row)
-		var rawStats map[string]probe.Result
-		if err := json.Unmarshal(row.Stats, &rawStats); err != nil {
-			continue
-		}
-		for key, vals := range rawStats {
-			s, ok := sums[key]
-			if !ok {
-				s = &probeValues{sums: make(probe.Result, len(vals)), counts: make([]int, len(vals))}
-				sums[key] = s
-			}
-			if len(vals) > len(s.sums) {
-				expandedSums := make(probe.Result, len(vals))
-				copy(expandedSums, s.sums)
-				s.sums = expandedSums
-
-				expandedCounts := make([]int, len(vals))
-				copy(expandedCounts, s.counts)
-				s.counts = expandedCounts
-			}
-			for i := range vals {
-				switch i {
-				case 2: // min fields
-					if s.counts[i] == 0 || vals[i] < s.sums[i] {
-						s.sums[i] = vals[i]
-					}
-				case 3: // max fields
-					if s.counts[i] == 0 || vals[i] > s.sums[i] {
-						s.sums[i] = vals[i]
-					}
-				default: // average fields
-					s.sums[i] += vals[i]
-				}
-				s.counts[i]++
-			}
-		}
-	}
-
-	// compute final averages
-	result := make(map[string]probe.Result, len(sums))
-	for key, s := range sums {
-		if len(s.counts) == 0 {
-			continue
-		}
-		for i := range s.sums {
-			switch i {
-			case 2, 3: // min and max fields should not be averaged
-				continue
-			default:
-				if s.counts[i] > 0 {
-					s.sums[i] = twoDecimals(s.sums[i] / float64(s.counts[i]))
-				}
-			}
-		}
-		result[key] = s.sums
-	}
-	return result
-}
-
 /* Round float to two decimals */
 func twoDecimals(value float64) float64 {
 	return math.Round(value*100) / 100

internal/records/records_averaging_test.go

@@ -291,6 +291,28 @@ func TestAverageSystemStatsSlice_Temperatures(t *testing.T) {
 	assert.Equal(t, 80.0, result.Temperatures["gpu"])
 }
 
+// Tests that fan speeds are averaged and records without fan data are excluded.
+func TestAverageSystemStatsSlice_Fans(t *testing.T) {
+	input := []system.Stats{
+		{
+			Fans: map[string]uint16{"cpu": 60_000, "case": 1_000},
+		},
+		{
+			Fans: map[string]uint16{"cpu": 50_000, "case": 2_000},
+		},
+		{
+			// No fan data - should not affect fan averaging
+			Cpu: 30.0,
+		},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	require.NotNil(t, result.Fans)
+	assert.Equal(t, uint16(55_000), result.Fans["cpu"])
+	assert.Equal(t, uint16(1_500), result.Fans["case"])
+}
+
 func TestAverageSystemStatsSlice_NetworkInterfaces(t *testing.T) {
 	input := []system.Stats{
 		{

internal/records/records_deletion.go

@@ -12,6 +12,7 @@ import (
 
 // Delete old records
 func (rm *RecordManager) DeleteOldRecords() {
+	// Pocketbase cron does not handle errors, log them here.
 	rm.app.RunInTransaction(func(txApp core.App) error {
 		err := deleteOldSystemStats(txApp)
 		if err != nil {
@@ -59,7 +60,7 @@ func deleteOldAlertsHistory(app core.App, countToKeep, countBeforeDeletion int)
 // Deletes system_stats records older than what is displayed in the UI
 func deleteOldSystemStats(app core.App) error {
 	// Collections to process
-	collections := [3]string{"system_stats", "container_stats", "network_probe_stats"}
+	collections := [2]string{"system_stats", "container_stats"}
 
 	// Record types and their retention periods
 	type RecordDeletionData struct {

internal/site/src/components/charts/area-chart.tsx

@@ -146,7 +146,7 @@ export default function AreaChartDefault({
 							axisLine={false}
 						/>
 					)}
-					{xAxis(chartData.chartTime, displayData.at(-1)?.created as number)}
+					{xAxis(chartData)}
 					<ChartTooltip
 						animationEasing="ease-out"
 						animationDuration={150}

internal/site/src/components/charts/line-chart.tsx

@@ -41,7 +41,6 @@ export default function LineChartDefault({
 	filter,
 	truncate = false,
 	chartProps,
-	connectNulls,
 }: {
 	chartData: ChartData
 	// biome-ignore lint/suspicious/noExplicitAny: accepts different data source types (systemStats or containerData)
@@ -63,7 +62,6 @@ export default function LineChartDefault({
 	filter?: string
 	truncate?: boolean
 	chartProps?: Omit<React.ComponentProps<typeof LineChart>, "data" | "margin">
-	connectNulls?: boolean
 }) {
 	const { yAxisWidth, updateYAxisWidth } = useYAxisWidth()
 	const { isIntersecting, ref } = useIntersectionObserver({ freeze: false })
@@ -107,7 +105,6 @@ export default function LineChartDefault({
 					// stackId={dataPoint.stackId}
 					order={dataPoint.order || i}
 					activeDot={dataPoint.activeDot ?? true}
-					connectNulls={connectNulls}
 				/>
 			)
 		})
@@ -148,7 +145,7 @@ export default function LineChartDefault({
 							axisLine={false}
 						/>
 					)}
-					{xAxis(chartData.chartTime, displayData.at(-1)?.created as number)}
+					{xAxis(chartData)}
 					<ChartTooltip
 						animationEasing="ease-out"
 						animationDuration={150}

internal/site/src/components/login/auth-form.tsx

@@ -17,7 +17,7 @@ import { toast } from "../ui/use-toast"
 import { OtpInputForm } from "./otp-forms"
 
 const honeypot = v.literal("")
-const emailSchema = v.pipe(v.string(), v.email(t`Invalid email address.`))
+const emailSchema = v.pipe(v.string(), v.rfcEmail(t`Invalid email address.`))
 const passwordSchema = v.pipe(
 	v.string(),
 	v.minLength(8, t`Password must be at least 8 characters.`),
@@ -175,8 +175,8 @@ export function UserAuthForm({
 	 */
 	function redirectToOauthProvider(provider: AuthProviderInfo) {
 		const url = new URL(provider.authURL)
-		// url.searchParams.set("redirect_uri", `${window.location.origin}${basePath}`)
-		sessionStorage.setItem("provider", JSON.stringify(provider))
+		url.searchParams.set("redirect_uri", `${window.location.origin}${basePath}`)
+		localStorage.setItem("provider", JSON.stringify(provider))
 		window.location.href = url.toString()
 	}
 
@@ -186,12 +186,13 @@ export function UserAuthForm({
 		const code = params.get("code")
 		if (code) {
 			const state = params.get("state")
-			const provider: AuthProviderInfo = JSON.parse(sessionStorage.getItem("provider") ?? "{}")
+			const provider: AuthProviderInfo = JSON.parse(localStorage.getItem("provider") ?? "{}")
+		    localStorage.removeItem("provider")
+			window.history.replaceState({}, "", window.location.pathname)
 			if (!state || provider.state !== state) {
 				showLoginFaliedToast()
 			} else {
 				setIsOauthLoading(true)
-				window.history.replaceState({}, "", window.location.pathname)
 				pb.collection("users")
 					.authWithOAuth2Code(provider.name, code, provider.codeVerifier, `${window.location.origin}${basePath}`)
 					.then(() => $authenticated.set(pb.authStore.isValid))
@@ -285,7 +286,7 @@ export function UserAuthForm({
 									{errors?.passwordConfirm && <p className="px-1 text-xs text-red-600">{errors.passwordConfirm}</p>}
 								</div>
 							)}
-							<div className="sr-only">
+							<div className="sr-only" aria-hidden="true">
 								{/* honeypot */}
 								<label htmlFor="website">Website</label>
 								<input
@@ -293,6 +294,7 @@ export function UserAuthForm({
 									type="text"
 									name="website"
 									tabIndex={-1}
+									readOnly
 									autoComplete="off"
 									data-1p-ignore
 									data-lpignore="true"

internal/site/src/components/navbar.tsx

@@ -8,7 +8,6 @@ import {
 	LogOutIcon,
 	LogsIcon,
 	MenuIcon,
-	NetworkIcon,
 	PlusIcon,
 	SearchIcon,
 	ServerIcon,
@@ -110,10 +109,6 @@ export default function Navbar() {
 								<HardDriveIcon className="h-4 w-4 me-2.5" strokeWidth={1.5} />
 								<span>S.M.A.R.T.</span>
 							</DropdownMenuItem>
-							<DropdownMenuItem onClick={() => navigate(getPagePath($router, "probes"))} className="flex items-center">
-								<NetworkIcon className="h-4 w-4 me-2.5" strokeWidth={1.5} />
-								<Trans>Network Probes</Trans>
-							</DropdownMenuItem>
 							<DropdownMenuItem
 								onClick={() => navigate(getPagePath($router, "settings", { name: "general" }))}
 								className="flex items-center"
@@ -185,21 +180,6 @@ export default function Navbar() {
 					</TooltipTrigger>
 					<TooltipContent>S.M.A.R.T.</TooltipContent>
 				</Tooltip>
-				<Tooltip>
-					<TooltipTrigger asChild>
-						<Link
-							href={getPagePath($router, "probes")}
-							className={cn("hidden md:grid", buttonVariants({ variant: "ghost", size: "icon" }))}
-							aria-label="Network Probes"
-							onMouseEnter={() => import("@/components/routes/probes")}
-						>
-							<NetworkIcon className="h-[1.2rem] w-[1.2rem]" strokeWidth={1.5} />
-						</Link>
-					</TooltipTrigger>
-					<TooltipContent>
-						<Trans>Network Probes</Trans>
-					</TooltipContent>
-				</Tooltip>
 				<LangToggle />
 				<ModeToggle />
 				<Tooltip>

internal/site/src/components/network-probes-table/network-probes-columns.tsx

@@ -1,237 +0,0 @@
-import type { CellContext, Column, ColumnDef } from "@tanstack/react-table"
-import { Button } from "@/components/ui/button"
-import { cn, decimalString, hourWithSeconds } from "@/lib/utils"
-import {
-	GlobeIcon,
-	TimerIcon,
-	WifiOffIcon,
-	Trash2Icon,
-	ArrowLeftRightIcon,
-	MoreHorizontalIcon,
-	ServerIcon,
-	ClockIcon,
-	NetworkIcon,
-	RefreshCwIcon,
-} from "lucide-react"
-import { t } from "@lingui/core/macro"
-import type { NetworkProbeRecord } from "@/types"
-import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigger } from "@/components/ui/dropdown-menu"
-import { Trans } from "@lingui/react/macro"
-import { pb } from "@/lib/api"
-import { toast } from "../ui/use-toast"
-import { $allSystemsById } from "@/lib/stores"
-import { useStore } from "@nanostores/react"
-
-const protocolColors: Record<string, string> = {
-	icmp: "bg-blue-500/15 text-blue-400",
-	tcp: "bg-purple-500/15 text-purple-400",
-	http: "bg-green-500/15 text-green-400",
-}
-
-async function deleteProbe(id: string) {
-	try {
-		await pb.collection("network_probes").delete(id)
-	} catch (err: unknown) {
-		toast({ variant: "destructive", title: t`Error`, description: (err as Error)?.message })
-	}
-}
-
-export function getProbeColumns(longestName = 0, longestTarget = 0): ColumnDef<NetworkProbeRecord>[] {
-	return [
-		{
-			id: "name",
-			sortingFn: (a, b) => (a.original.name || a.original.target).localeCompare(b.original.name || b.original.target),
-			accessorFn: (record) => record.name || record.target,
-			header: ({ column }) => <HeaderButton column={column} name={t`Name`} Icon={NetworkIcon} />,
-			cell: ({ getValue }) => (
-				<div className="ms-1.5 max-w-40 block truncate tabular-nums" style={{ width: `${longestName / 1.05}ch` }}>
-					{getValue() as string}
-				</div>
-			),
-		},
-		{
-			id: "system",
-			accessorFn: (record) => record.system,
-			sortingFn: (a, b) => {
-				const allSystems = $allSystemsById.get()
-				const systemNameA = allSystems[a.original.system]?.name ?? ""
-				const systemNameB = allSystems[b.original.system]?.name ?? ""
-				return systemNameA.localeCompare(systemNameB)
-			},
-			header: ({ column }) => <HeaderButton column={column} name={t`System`} Icon={ServerIcon} />,
-			cell: ({ getValue }) => {
-				const allSystems = useStore($allSystemsById)
-				return <span className="ms-1.5 xl:w-20 block truncate">{allSystems[getValue() as string]?.name ?? ""}</span>
-			},
-		},
-		{
-			id: "target",
-			sortingFn: (a, b) => a.original.target.localeCompare(b.original.target),
-			accessorFn: (record) => record.target,
-			header: ({ column }) => <HeaderButton column={column} name={t`Target`} Icon={GlobeIcon} />,
-			cell: ({ getValue }) => (
-				<div className="ms-1.5 tabular-nums block truncate max-w-44" style={{ width: `${longestTarget / 1.05}ch` }}>
-					{getValue() as string}
-				</div>
-			),
-		},
-		{
-			id: "protocol",
-			accessorFn: (record) => record.protocol,
-			header: ({ column }) => <HeaderButton column={column} name={t`Protocol`} Icon={ArrowLeftRightIcon} />,
-			cell: ({ getValue }) => {
-				const protocol = getValue() as string
-				return (
-					<span className={cn("ms-1.5 px-2 py-0.5 rounded text-xs font-medium uppercase", protocolColors[protocol])}>
-						{protocol}
-					</span>
-				)
-			},
-		},
-		{
-			id: "interval",
-			accessorFn: (record) => record.interval,
-			header: ({ column }) => <HeaderButton column={column} name={t`Interval`} Icon={RefreshCwIcon} />,
-			cell: ({ getValue }) => <span className="ms-1.5 tabular-nums">{getValue() as number}s</span>,
-		},
-		{
-			id: "res",
-			accessorFn: (record) => record.res,
-			invertSorting: true,
-			header: ({ column }) => <HeaderButton column={column} name={t`Response`} Icon={TimerIcon} />,
-			cell: responseTimeCell,
-		},
-		{
-			id: "res1h",
-			accessorFn: (record) => record.resAvg1h,
-			invertSorting: true,
-			header: ({ column }) => <HeaderButton column={column} name={t`Avg 1h`} Icon={TimerIcon} />,
-			cell: responseTimeCell,
-		},
-		{
-			id: "max1h",
-			accessorFn: (record) => record.resMax1h,
-			invertSorting: true,
-			header: ({ column }) => <HeaderButton column={column} name={t`Max 1h`} Icon={TimerIcon} />,
-			cell: responseTimeCell,
-		},
-		{
-			id: "min1h",
-			accessorFn: (record) => record.resMin1h,
-			invertSorting: true,
-			header: ({ column }) => <HeaderButton column={column} name={t`Min 1h`} Icon={TimerIcon} />,
-			cell: responseTimeCell,
-		},
-		{
-			id: "loss",
-			accessorFn: (record) => record.loss1h,
-			invertSorting: true,
-			header: ({ column }) => <HeaderButton column={column} name={t`Loss 1h`} Icon={WifiOffIcon} />,
-			cell: ({ row }) => {
-				const { loss1h, res } = row.original
-				if (loss1h === undefined || (!res && !loss1h)) {
-					return <span className="ms-1.5 text-muted-foreground">-</span>
-				}
-				let color = "bg-green-500"
-				if (loss1h) {
-					color = loss1h > 20 ? "bg-red-500" : "bg-yellow-500"
-				}
-				return (
-					<span className="ms-1.5 tabular-nums flex gap-2 items-center">
-						<span className={cn("shrink-0 size-2 rounded-full", color)} />
-						{loss1h}%
-					</span>
-				)
-			},
-		},
-		{
-			id: "updated",
-			invertSorting: true,
-			accessorFn: (record) => record.updated,
-			header: ({ column }) => <HeaderButton column={column} name={t`Updated`} Icon={ClockIcon} />,
-			cell: ({ getValue }) => {
-				const timestamp = getValue() as number
-				return <span className="ms-1.5 tabular-nums">{hourWithSeconds(new Date(timestamp).toISOString())}</span>
-			},
-		},
-		{
-			id: "actions",
-			enableSorting: false,
-			header: () => null,
-			size: 40,
-			cell: ({ row }) => (
-				<DropdownMenu>
-					<DropdownMenuTrigger asChild>
-						<Button
-							variant="ghost"
-							size="icon"
-							className="size-10"
-							onClick={(event) => event.stopPropagation()}
-							onMouseDown={(event) => event.stopPropagation()}
-						>
-							<span className="sr-only">
-								<Trans>Open menu</Trans>
-							</span>
-							<MoreHorizontalIcon className="w-5" />
-						</Button>
-					</DropdownMenuTrigger>
-					<DropdownMenuContent align="end" onClick={(event) => event.stopPropagation()}>
-						<DropdownMenuItem
-							onClick={(event) => {
-								event.stopPropagation()
-								deleteProbe(row.original.id)
-							}}
-						>
-							<Trash2Icon className="me-2.5 size-4" />
-							<Trans>Delete</Trans>
-						</DropdownMenuItem>
-					</DropdownMenuContent>
-				</DropdownMenu>
-			),
-		},
-	]
-}
-function responseTimeCell(cell: CellContext<NetworkProbeRecord, unknown>) {
-	const val = cell.getValue() as number | undefined
-	if (!val) {
-		return <span className="ms-1.5 text-muted-foreground">-</span>
-	}
-	let color = "bg-green-500"
-	if (val > 200) {
-		color = "bg-yellow-500"
-	}
-	if (val > 2000) {
-		color = "bg-red-500"
-	}
-	return (
-		<span className="ms-1.5 tabular-nums flex gap-2 items-center">
-			<span className={cn("shrink-0 size-2 rounded-full", color)} />
-			{decimalString(val, val < 100 ? 2 : 1).toLocaleString()}ms
-		</span>
-	)
-}
-
-function HeaderButton({
-	column,
-	name,
-	Icon,
-}: {
-	column: Column<NetworkProbeRecord>
-	name: string
-	Icon: React.ElementType
-}) {
-	const isSorted = column.getIsSorted()
-	return (
-		<Button
-			className={cn(
-				"h-9 px-3 flex items-center gap-2 duration-50",
-				isSorted && "bg-accent/70 light:bg-accent text-accent-foreground/90"
-			)}
-			variant="ghost"
-			onClick={() => column.toggleSorting(column.getIsSorted() === "asc")}
-		>
-			{Icon && <Icon className="size-4" />}
-			{name}
-		</Button>
-	)
-}

internal/site/src/components/network-probes-table/network-probes-table.tsx

@@ -1,225 +0,0 @@
-import { t } from "@lingui/core/macro"
-import { Trans } from "@lingui/react/macro"
-import {
-	type ColumnFiltersState,
-	flexRender,
-	getCoreRowModel,
-	getFilteredRowModel,
-	getSortedRowModel,
-	type Row,
-	type SortingState,
-	type Table as TableType,
-	useReactTable,
-	type VisibilityState,
-} from "@tanstack/react-table"
-import { useVirtualizer, type VirtualItem } from "@tanstack/react-virtual"
-import { memo, useMemo, useRef, useState } from "react"
-import { getProbeColumns } from "@/components/network-probes-table/network-probes-columns"
-import { Card, CardHeader, CardTitle } from "@/components/ui/card"
-import { Input } from "@/components/ui/input"
-import { TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table"
-import { isReadOnlyUser } from "@/lib/api"
-import { $allSystemsById } from "@/lib/stores"
-import { cn, getVisualStringWidth, useBrowserStorage } from "@/lib/utils"
-import type { NetworkProbeRecord } from "@/types"
-import { AddProbeDialog } from "./probe-dialog"
-
-export default function NetworkProbesTableNew({
-	systemId,
-	probes,
-}: {
-	systemId?: string
-	probes: NetworkProbeRecord[]
-}) {
-	const [sorting, setSorting] = useBrowserStorage<SortingState>(
-		`sort-np-${systemId ? 1 : 0}`,
-		[{ id: systemId ? "name" : "system", desc: false }],
-		sessionStorage
-	)
-	const [columnFilters, setColumnFilters] = useState<ColumnFiltersState>([])
-	const [columnVisibility, setColumnVisibility] = useState<VisibilityState>({})
-	const [globalFilter, setGlobalFilter] = useState("")
-
-	const { longestName, longestTarget } = useMemo(() => {
-		let longestName = 0
-		let longestTarget = 0
-		for (const p of probes) {
-			longestName = Math.max(longestName, getVisualStringWidth(p.name || p.target))
-			longestTarget = Math.max(longestTarget, getVisualStringWidth(p.target))
-		}
-		return { longestName, longestTarget }
-	}, [probes])
-
-	// Filter columns based on whether systemId is provided
-	const columns = useMemo(() => {
-		let columns = getProbeColumns(longestName, longestTarget)
-		columns = systemId ? columns.filter((col) => col.id !== "system") : columns
-		columns = isReadOnlyUser() ? columns.filter((col) => col.id !== "actions") : columns
-		return columns
-	}, [systemId, longestName, longestTarget])
-
-	const table = useReactTable({
-		data: probes,
-		columns,
-		getCoreRowModel: getCoreRowModel(),
-		getSortedRowModel: getSortedRowModel(),
-		getFilteredRowModel: getFilteredRowModel(),
-		onSortingChange: setSorting,
-		onColumnFiltersChange: setColumnFilters,
-		onColumnVisibilityChange: setColumnVisibility,
-		defaultColumn: {
-			sortUndefined: "last",
-			size: 900,
-			minSize: 0,
-		},
-		state: {
-			sorting,
-			columnFilters,
-			columnVisibility,
-			globalFilter,
-		},
-		onGlobalFilterChange: setGlobalFilter,
-		globalFilterFn: (row, _columnId, filterValue) => {
-			const probe = row.original
-			const systemName = $allSystemsById.get()[probe.system]?.name ?? ""
-			const searchString = `${probe.name}${probe.target}${probe.protocol}${systemName}`.toLocaleLowerCase()
-			return (filterValue as string)
-				.toLowerCase()
-				.split(" ")
-				.every((term) => searchString.includes(term))
-		},
-	})
-
-	const rows = table.getRowModel().rows
-	const visibleColumns = table.getVisibleLeafColumns()
-
-	return (
-		<Card className="@container w-full px-3 py-5 sm:py-6 sm:px-6">
-			<CardHeader className="p-0 mb-3 sm:mb-4">
-				<div className="grid md:flex gap-x-5 gap-y-3 w-full items-end">
-					<div className="px-2 sm:px-1">
-						<CardTitle className="mb-2">
-							<Trans>Network Probes</Trans>
-						</CardTitle>
-						<div className="text-sm text-muted-foreground flex items-center flex-wrap">
-							<Trans>Response time monitoring from agents.</Trans>
-						</div>
-					</div>
-					<div className="md:ms-auto flex items-center gap-2">
-						{probes.length > 0 && (
-							<Input
-								placeholder={t`Filter...`}
-								value={globalFilter}
-								onChange={(e) => setGlobalFilter(e.target.value)}
-								className="ms-auto px-4 w-full max-w-full md:w-64"
-							/>
-						)}
-						{!isReadOnlyUser() ? <AddProbeDialog systemId={systemId} /> : null}
-					</div>
-				</div>
-			</CardHeader>
-			<div className="rounded-md">
-				<NetworkProbesTable table={table} rows={rows} colLength={visibleColumns.length} />
-			</div>
-		</Card>
-	)
-}
-
-const NetworkProbesTable = memo(function NetworkProbeTable({
-	table,
-	rows,
-	colLength,
-}: {
-	table: TableType<NetworkProbeRecord>
-	rows: Row<NetworkProbeRecord>[]
-	colLength: number
-}) {
-	// The virtualizer will need a reference to the scrollable container element
-	const scrollRef = useRef<HTMLDivElement>(null)
-
-	const virtualizer = useVirtualizer<HTMLDivElement, HTMLTableRowElement>({
-		count: rows.length,
-		estimateSize: () => 54,
-		getScrollElement: () => scrollRef.current,
-		overscan: 5,
-	})
-	const virtualRows = virtualizer.getVirtualItems()
-
-	const paddingTop = Math.max(0, virtualRows[0]?.start ?? 0 - virtualizer.options.scrollMargin)
-	const paddingBottom = Math.max(0, virtualizer.getTotalSize() - (virtualRows[virtualRows.length - 1]?.end ?? 0))
-
-	return (
-		<div
-			className={cn(
-				"h-min max-h-[calc(100dvh-17rem)] max-w-full relative overflow-auto border rounded-md",
-				// don't set min height if there are less than 2 rows, do set if we need to display the empty state
-				(!rows.length || rows.length > 2) && "min-h-50"
-			)}
-			ref={scrollRef}
-		>
-			{/* add header height to table size */}
-			<div style={{ height: `${virtualizer.getTotalSize() + 48}px`, paddingTop, paddingBottom }}>
-				<table className="text-sm w-full h-full text-nowrap">
-					<NetworkProbeTableHead table={table} />
-					<TableBody>
-						{rows.length ? (
-							virtualRows.map((virtualRow) => {
-								const row = rows[virtualRow.index]
-								return <NetworkProbeTableRow key={row.id} row={row} virtualRow={virtualRow} />
-							})
-						) : (
-							<TableRow>
-								<TableCell colSpan={colLength} className="h-37 text-center pointer-events-none">
-									<Trans>No results.</Trans>
-								</TableCell>
-							</TableRow>
-						)}
-					</TableBody>
-				</table>
-			</div>
-		</div>
-	)
-})
-
-function NetworkProbeTableHead({ table }: { table: TableType<NetworkProbeRecord> }) {
-	return (
-		<TableHeader className="sticky top-0 z-50 w-full border-b-2">
-			{table.getHeaderGroups().map((headerGroup) => (
-				<tr key={headerGroup.id}>
-					{headerGroup.headers.map((header) => {
-						return (
-							<TableHead className="px-2" key={header.id}>
-								{header.isPlaceholder ? null : flexRender(header.column.columnDef.header, header.getContext())}
-							</TableHead>
-						)
-					})}
-				</tr>
-			))}
-		</TableHeader>
-	)
-}
-
-const NetworkProbeTableRow = memo(function NetworkProbeTableRow({
-	row,
-	virtualRow,
-}: {
-	row: Row<NetworkProbeRecord>
-	virtualRow: VirtualItem
-}) {
-	return (
-		<TableRow data-state={row.getIsSelected() && "selected"} className="transition-opacity">
-			{row.getVisibleCells().map((cell) => (
-				<TableCell
-					key={cell.id}
-					className="py-0"
-					style={{
-						width: `${cell.column.getSize()}px`,
-						height: virtualRow.size,
-					}}
-				>
-					{flexRender(cell.column.columnDef.cell, cell.getContext())}
-				</TableCell>
-			))}
-		</TableRow>
-	)
-})

internal/site/src/components/network-probes-table/probe-dialog.tsx

@@ -1,194 +0,0 @@
-import { useState } from "react"
-import { Trans, useLingui } from "@lingui/react/macro"
-import { useStore } from "@nanostores/react"
-import { pb } from "@/lib/api"
-import {
-	Dialog,
-	DialogContent,
-	DialogDescription,
-	DialogFooter,
-	DialogHeader,
-	DialogTitle,
-	DialogTrigger,
-} from "@/components/ui/dialog"
-import { Button } from "@/components/ui/button"
-import { Input } from "@/components/ui/input"
-import { Label } from "@/components/ui/label"
-import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select"
-import { PlusIcon } from "lucide-react"
-import { useToast } from "@/components/ui/use-toast"
-import { $systems } from "@/lib/stores"
-import * as v from "valibot"
-
-const Schema = v.object({
-	system: v.string(),
-	target: v.string(),
-	protocol: v.picklist(["icmp", "tcp", "http"]),
-	port: v.number(),
-	interval: v.pipe(v.string(), v.toNumber(), v.minValue(1), v.maxValue(3600)),
-	enabled: v.boolean(),
-	name: v.optional(v.string()),
-})
-
-export function AddProbeDialog({ systemId }: { systemId?: string }) {
-	const [open, setOpen] = useState(false)
-	const [protocol, setProtocol] = useState<string>("icmp")
-	const [target, setTarget] = useState("")
-	const [port, setPort] = useState("")
-	const [probeInterval, setProbeInterval] = useState("30")
-	const [name, setName] = useState("")
-	const [loading, setLoading] = useState(false)
-	const [selectedSystemId, setSelectedSystemId] = useState("")
-	const systems = useStore($systems)
-	const { toast } = useToast()
-	const { t } = useLingui()
-	const targetName = target.replace(/^https?:\/\//, "")
-
-	const resetForm = () => {
-		setProtocol("icmp")
-		setTarget("")
-		setPort("")
-		setProbeInterval("30")
-		setName("")
-		setSelectedSystemId("")
-	}
-
-	const handleSubmit = async (e: React.FormEvent) => {
-		e.preventDefault()
-		setLoading(true)
-
-		try {
-			const payload = v.parse(Schema, {
-				system: systemId ?? selectedSystemId,
-				target,
-				protocol,
-				port: protocol === "tcp" ? Number(port) : 0,
-				interval: probeInterval,
-				enabled: true,
-			})
-			if (name && name !== target) {
-				payload.name = name
-			}
-			await pb.collection("network_probes").create(payload)
-			resetForm()
-			setOpen(false)
-		} catch (err: unknown) {
-			toast({ variant: "destructive", title: t`Error`, description: (err as Error)?.message })
-		} finally {
-			setLoading(false)
-		}
-	}
-
-	return (
-		<Dialog open={open} onOpenChange={setOpen}>
-			<DialogTrigger asChild>
-				<Button variant="outline">
-					<PlusIcon className="size-4 me-1" />
-					<Trans>Add {{ foo: t`Probe` }}</Trans>
-				</Button>
-			</DialogTrigger>
-			<DialogContent className="max-w-md">
-				<DialogHeader>
-					<DialogTitle>
-						<Trans>Add {{ foo: t`Network Probe` }}</Trans>
-					</DialogTitle>
-					<DialogDescription>
-						<Trans>Configure response monitoring from this agent.</Trans>
-					</DialogDescription>
-				</DialogHeader>
-				<form onSubmit={handleSubmit} className="grid gap-4 tabular-nums">
-					{!systemId && (
-						<div className="grid gap-2">
-							<Label>
-								<Trans>System</Trans>
-							</Label>
-							<Select value={selectedSystemId} onValueChange={setSelectedSystemId} required>
-								<SelectTrigger>
-									<SelectValue placeholder={t`Select a system`} />
-								</SelectTrigger>
-								<SelectContent>
-									{systems.map((sys) => (
-										<SelectItem key={sys.id} value={sys.id}>
-											{sys.name}
-										</SelectItem>
-									))}
-								</SelectContent>
-							</Select>
-						</div>
-					)}
-					<div className="grid gap-2">
-						<Label>
-							<Trans>Target</Trans>
-						</Label>
-						<Input
-							value={target}
-							onChange={(e) => setTarget(e.target.value)}
-							placeholder={protocol === "http" ? "https://example.com" : "1.1.1.1"}
-							required
-						/>
-					</div>
-					<div className="grid gap-2">
-						<Label>
-							<Trans>Protocol</Trans>
-						</Label>
-
-						<Select value={protocol} onValueChange={setProtocol}>
-							<SelectTrigger>
-								<SelectValue />
-							</SelectTrigger>
-							<SelectContent>
-								<SelectItem value="icmp">ICMP</SelectItem>
-								<SelectItem value="tcp">TCP</SelectItem>
-								<SelectItem value="http">HTTP</SelectItem>
-							</SelectContent>
-						</Select>
-					</div>
-					{protocol === "tcp" && (
-						<div className="grid gap-2">
-							<Label>
-								<Trans>Port</Trans>
-							</Label>
-							<Input
-								type="number"
-								value={port}
-								onChange={(e) => setPort(e.target.value)}
-								placeholder="443"
-								min={1}
-								max={65535}
-								required
-							/>
-						</div>
-					)}
-					<div className="grid gap-2">
-						<Label>
-							<Trans>Interval (seconds)</Trans>
-						</Label>
-						<Input
-							type="number"
-							value={probeInterval}
-							onChange={(e) => setProbeInterval(e.target.value)}
-							min={1}
-							max={3600}
-							required
-						/>
-					</div>
-					<div className="grid gap-2">
-						<Label>
-							<Trans>Name (optional)</Trans>
-						</Label>
-						<Input
-							value={name}
-							onChange={(e) => setName(e.target.value)}
-							placeholder={targetName || t`e.g. Cloudflare DNS`}
-						/>
-					</div>
-					<DialogFooter>
-						<Button type="submit" disabled={loading || (!systemId && !selectedSystemId)}>
-							{loading ? <Trans>Creating...</Trans> : <Trans>Add {{ foo: t`Probe` }}</Trans>}
-						</Button>
-					</DialogFooter>
-				</form>
-			</DialogContent>
-		</Dialog>
-	)
-}

internal/site/src/components/router.tsx

@@ -4,7 +4,6 @@ const routes = {
 	home: "/",
 	containers: "/containers",
 	smart: "/smart",
-	probes: "/probes",
 	system: `/system/:id`,
 	settings: `/settings/:name?`,
 	forgot_password: `/forgot-password`,

internal/site/src/components/routes/probes.tsx

@@ -1,25 +0,0 @@
-import { useLingui } from "@lingui/react/macro"
-import { memo, useEffect } from "react"
-import NetworkProbesTableNew from "@/components/network-probes-table/network-probes-table"
-import { ActiveAlerts } from "@/components/active-alerts"
-import { FooterRepoLink } from "@/components/footer-repo-link"
-import { useNetworkProbesData } from "@/lib/use-network-probes"
-
-export default memo(() => {
-	const { t } = useLingui()
-	const { probes } = useNetworkProbesData({})
-
-	useEffect(() => {
-		document.title = `${t`Network Probes`} / Beszel`
-	}, [t])
-
-	return (
-		<>
-			<div className="grid gap-4">
-				<ActiveAlerts />
-				<NetworkProbesTableNew probes={probes} />
-			</div>
-			<FooterRepoLink />
-		</>
-	)
-})

internal/site/src/components/routes/settings/notifications.tsx

@@ -24,7 +24,7 @@ interface ShoutrrrUrlCardProps {
 }
 
 const NotificationSchema = v.object({
-	emails: v.array(v.pipe(v.string(), v.email())),
+	emails: v.array(v.pipe(v.string(), v.rfcEmail())),
 	webhooks: v.array(v.pipe(v.string(), v.url())),
 })
 

internal/site/src/components/routes/settings/tokens-fingerprints.tsx

@@ -139,6 +139,7 @@ const SectionUniversalToken = memo(() => {
 	const [isLoading, setIsLoading] = useState(true)
 	const [checked, setChecked] = useState(false)
 	const [isPermanent, setIsPermanent] = useState(false)
+	const publicKey = $publicKey.get()
 
 	async function updateToken(enable: number = -1, permanent: number = -1) {
 		// enable: 0 for disable, 1 for enable, -1 (unset) for get current state
@@ -191,6 +192,25 @@ const SectionUniversalToken = memo(() => {
 							<ActionsButtonUniversalToken token={token} checked={checked} />
 						</div>
 
+						{checked && (
+							<div className="flex items-center gap-4 min-w-0 border-t pt-3">
+								<span className="text-sm text-muted-foreground whitespace-nowrap">
+									<Trans>Public key</Trans>
+								</span>
+								<div className="min-w-0 flex-1 truncate">
+									<span className="text-sm text-primary font-mono">{publicKey}</span>
+								</div>
+								<Button
+									variant="ghost"
+									size="icon"
+									onClick={() => copyToClipboard(publicKey)}
+									title={t`Copy public key`}
+								>
+									<CopyIcon className="w-4" />
+								</Button>
+							</div>
+						)}
+
 						{checked && (
 							<div className="border-t pt-3">
 								<div className="text-sm font-medium">

internal/site/src/components/routes/system.tsx

@@ -9,11 +9,11 @@ import { CpuChart, ContainerCpuChart } from "./system/charts/cpu-charts"
 import { MemoryChart, ContainerMemoryChart, SwapChart } from "./system/charts/memory-charts"
 import { RootDiskCharts, ExtraFsCharts } from "./system/charts/disk-charts"
 import { BandwidthChart, ContainerNetworkChart } from "./system/charts/network-charts"
-import { TemperatureChart, BatteryChart } from "./system/charts/sensor-charts"
+import { TemperatureChart, FanChart, BatteryChart } from "./system/charts/sensor-charts"
 import { GpuPowerChart, GpuDetailCharts } from "./system/charts/gpu-charts"
-import { LazyContainersTable, LazySmartTable, LazySystemdTable, LazyNetworkProbesTable } from "./system/lazy-tables"
+import { LazyContainersTable, LazySmartTable, LazySystemdTable } from "./system/lazy-tables"
 import { LoadAverageChart } from "./system/charts/load-average-chart"
-import { ContainerIcon, CpuIcon, HardDriveIcon, NetworkIcon, TerminalSquareIcon } from "lucide-react"
+import { ContainerIcon, CpuIcon, HardDriveIcon, TerminalSquareIcon } from "lucide-react"
 import { GpuIcon } from "../ui/icons"
 import SystemdTable from "../systemd-table/systemd-table"
 import ContainersTable from "../containers-table/containers-table"
@@ -65,7 +65,7 @@ export default memo(function SystemDetail({ id }: { id: string }) {
 	const hasGpu = hasGpuData || hasGpuPowerData
 
 	// keep tabsRef in sync for keyboard navigation
-	const tabs = ["core", "network", "disk"]
+	const tabs = ["core", "disk"]
 	if (hasGpu) tabs.push("gpu")
 	if (hasContainers) tabs.push("containers")
 	if (hasSystemd) tabs.push("services")
@@ -123,6 +123,8 @@ export default memo(function SystemDetail({ id }: { id: string }) {
 
 					<TemperatureChart {...coreProps} />
 
+					<FanChart {...coreProps} />
+
 					<BatteryChart {...coreProps} />
 
 					{hasGpuPowerData && <GpuPowerChart chartData={chartData} grid={grid} dataEmpty={dataEmpty} />}
@@ -145,8 +147,6 @@ export default memo(function SystemDetail({ id }: { id: string }) {
 				{hasContainersTable && <LazyContainersTable systemId={system.id} />}
 
 				{hasSystemd && <LazySystemdTable systemId={system.id} />}
-
-				<LazyNetworkProbesTable systemId={system.id} systemData={systemData} />
 			</>
 		)
 	}
@@ -159,10 +159,6 @@ export default memo(function SystemDetail({ id }: { id: string }) {
 						<CpuIcon className="size-3.5" />
 						<Trans context="Core system metrics">Core</Trans>
 					</TabsTrigger>
-					<TabsTrigger value="network" className="w-full flex items-center gap-1.5">
-						<NetworkIcon className="size-3.5" />
-						<Trans>Network</Trans>
-					</TabsTrigger>
 					<TabsTrigger value="disk" className="w-full flex items-center gap-1.5">
 						<HardDriveIcon className="size-3.5" />
 						<Trans>Disk</Trans>
@@ -190,26 +186,17 @@ export default memo(function SystemDetail({ id }: { id: string }) {
 				<TabsContent value="core" forceMount className={activeTab === "core" ? "contents" : "hidden"}>
 					<div className="grid xl:grid-cols-2 gap-4">
 						<CpuChart {...coreProps} />
-						<LoadAverageChart chartData={chartData} grid={grid} dataEmpty={dataEmpty} />
 						<MemoryChart {...coreProps} />
-						<SwapChart chartData={chartData} grid={grid} dataEmpty={dataEmpty} systemStats={systemStats} />
+						<LoadAverageChart chartData={chartData} grid={grid} dataEmpty={dataEmpty} />
+						<BandwidthChart {...coreProps} systemStats={systemStats} />
 						<TemperatureChart {...coreProps} setPageBottomExtraMargin={setPageBottomExtraMargin} />
+						<FanChart {...coreProps} />
 						<BatteryChart {...coreProps} />
+						<SwapChart chartData={chartData} grid={grid} dataEmpty={dataEmpty} systemStats={systemStats} />
 						{pageBottomExtraMargin > 0 && <div style={{ marginBottom: pageBottomExtraMargin }}></div>}
 					</div>
 				</TabsContent>
 
-				<TabsContent value="network" forceMount className={activeTab === "network" ? "contents" : "hidden"}>
-					{mountedTabs.has("network") && (
-						<>
-							<div className="grid xl:grid-cols-2 gap-4">
-								<BandwidthChart {...coreProps} systemStats={systemStats} />
-							</div>
-							<LazyNetworkProbesTable systemId={system.id} systemData={systemData} />
-						</>
-					)}
-				</TabsContent>
-
 				<TabsContent value="disk" forceMount className={activeTab === "disk" ? "contents" : "hidden"}>
 					{mountedTabs.has("disk") && (
 						<>

internal/site/src/components/routes/system/chart-data.ts

@@ -1,6 +1,7 @@
+import { timeTicks } from "d3-time"
 import { getPbTimestamp, pb } from "@/lib/api"
 import { chartTimeData } from "@/lib/utils"
-import type { ChartData, ChartTimes, ContainerStatsRecord, NetworkProbeStatsRecord, SystemStatsRecord } from "@/types"
+import type { ChartData, ChartTimes, ContainerStatsRecord, SystemStatsRecord } from "@/types"
 
 type ChartTimeData = {
 	time: number
@@ -16,6 +17,27 @@ export const cache = new Map<
 	ChartTimeData | SystemStatsRecord[] | ContainerStatsRecord[] | ChartData["containerData"]
 >()
 
+// create ticks and domain for charts
+export function getTimeData(chartTime: ChartTimes, lastCreated: number) {
+	const cached = cache.get("td") as ChartTimeData | undefined
+	if (cached && cached.chartTime === chartTime) {
+		if (!lastCreated || cached.time >= lastCreated) {
+			return cached.data
+		}
+	}
+
+	// const buffer = chartTime === "1m" ? 400 : 20_000
+	const now = new Date(Date.now())
+	const startTime = chartTimeData[chartTime].getOffset(now)
+	const ticks = timeTicks(startTime, now, chartTimeData[chartTime].ticks ?? 12).map((date) => date.getTime())
+	const data = {
+		ticks,
+		domain: [chartTimeData[chartTime].getOffset(now).getTime(), now.getTime()],
+	}
+	cache.set("td", { time: now.getTime(), data, chartTime })
+	return data
+}
+
 /** Append new records onto prev with gap detection. Converts string `created` values to ms timestamps in place.
  * Pass `maxLen` to cap the result length in one copy instead of slicing again after the call. */
 export function appendData<T extends { created: string | number | null }>(
@@ -44,12 +66,12 @@ export function appendData<T extends { created: string | number | null }>(
 	return result
 }
 
-export async function getStats<T extends SystemStatsRecord | ContainerStatsRecord | NetworkProbeStatsRecord>(
+export async function getStats<T extends SystemStatsRecord | ContainerStatsRecord>(
 	collection: string,
 	systemId: string,
-	chartTime: ChartTimes,
-	cachedStats?: { created: string | number | null }[]
+	chartTime: ChartTimes
 ): Promise<T[]> {
+	const cachedStats = cache.get(`${systemId}_${chartTime}_${collection}`) as T[] | undefined
 	const lastCached = cachedStats?.at(-1)?.created as number
 	return await pb.collection<T>(collection).getFullList({
 		filter: pb.filter("system={:id} && created > {:created} && type={:type}", {

internal/site/src/components/routes/system/charts/memory-charts.tsx

@@ -108,7 +108,7 @@ export function ContainerMemoryChart({
 				dataPoints={dataPoints}
 				tickFormatter={(val) => {
 					const { value, unit } = formatBytes(val, false, Unit.Bytes, true)
-					return `${toFixedFloat(value, val >= 10 ? 0 : 1)} ${unit}`
+					return `${toFixedFloat(value, value >= 10 ? 0 : 1)} ${unit}`
 				}}
 				contentFormatter={(item) => {
 					const { value, unit } = formatBytes(item.value, false, Unit.Bytes, true)

internal/site/src/components/routes/system/charts/probes-charts.tsx

@@ -1,152 +0,0 @@
-import LineChartDefault from "@/components/charts/line-chart"
-import type { DataPoint } from "@/components/charts/line-chart"
-import { toFixedFloat, decimalString } from "@/lib/utils"
-import { useLingui } from "@lingui/react/macro"
-import { ChartCard, FilterBar } from "../chart-card"
-import type { ChartData, NetworkProbeRecord, NetworkProbeStatsRecord } from "@/types"
-import { useMemo } from "react"
-import { atom } from "nanostores"
-import { useStore } from "@nanostores/react"
-
-const $filter = atom("")
-
-type ProbeChartProps = {
-	probeStats: NetworkProbeStatsRecord[]
-	grid?: boolean
-	probes: NetworkProbeRecord[]
-	chartData: ChartData
-	empty: boolean
-}
-
-type ProbeChartBaseProps = ProbeChartProps & {
-	valueIndex: number
-	title: string
-	description: string
-	tickFormatter: (value: number) => string
-	contentFormatter: ({ value }: { value: number | string }) => string | number
-	domain?: [number | "auto", number | "auto"]
-}
-
-function ProbeChart({
-	probeStats,
-	grid,
-	probes,
-	chartData,
-	empty,
-	valueIndex,
-	title,
-	description,
-	tickFormatter,
-	contentFormatter,
-	domain,
-}: ProbeChartBaseProps) {
-	const filter = useStore($filter)
-
-	const { dataPoints, visibleKeys } = useMemo(() => {
-		const sortedProbes = [...probes].sort((a, b) => b.resAvg1h - a.resAvg1h)
-		const count = sortedProbes.length
-		const points: DataPoint<NetworkProbeStatsRecord>[] = []
-		const visibleIDs: string[] = []
-		const filterTerms = filter
-			? filter
-					.toLowerCase()
-					.split(" ")
-					.filter((term) => term.length > 0)
-			: []
-		for (let i = 0; i < count; i++) {
-			const p = sortedProbes[i]
-			const label = p.name || p.target
-			const filtered = filterTerms.length > 0 && !filterTerms.some((term) => label.toLowerCase().includes(term))
-			if (filtered) {
-				continue
-			}
-			visibleIDs.push(p.id)
-			points.push({
-				order: i,
-				label,
-				dataKey: (record: NetworkProbeStatsRecord) => record.stats?.[p.id]?.[valueIndex] ?? "-",
-				color: count <= 5 ? i + 1 : `hsl(${(i * 360) / count}, var(--chart-saturation), var(--chart-lightness))`,
-			})
-		}
-		return { dataPoints: points, visibleKeys: visibleIDs }
-	}, [probes, filter, valueIndex])
-
-	const filteredProbeStats = useMemo(() => {
-		if (!visibleKeys.length) return probeStats
-		return probeStats.filter((record) => visibleKeys.some((id) => record.stats?.[id] != null))
-	}, [probeStats, visibleKeys])
-
-	const legend = dataPoints.length < 10
-
-	return (
-		<ChartCard
-			legend={legend}
-			cornerEl={<FilterBar store={$filter} />}
-			empty={empty}
-			title={title}
-			description={description}
-			grid={grid}
-		>
-			<LineChartDefault
-				chartData={chartData}
-				customData={filteredProbeStats}
-				dataPoints={dataPoints}
-				domain={domain ?? ["auto", "auto"]}
-				connectNulls
-				tickFormatter={tickFormatter}
-				contentFormatter={contentFormatter}
-				legend={legend}
-				filter={filter}
-			/>
-		</ChartCard>
-	)
-}
-
-export function ResponseChart({ probeStats, grid, probes, chartData, empty }: ProbeChartProps) {
-	const { t } = useLingui()
-
-	return (
-		<ProbeChart
-			probeStats={probeStats}
-			grid={grid}
-			probes={probes}
-			chartData={chartData}
-			empty={empty}
-			valueIndex={0}
-			title={t`Response`}
-			description={t`Average response time (ms)`}
-			tickFormatter={(value) => `${toFixedFloat(value, value >= 10 ? 0 : 1)} ms`}
-			contentFormatter={({ value }) => {
-				if (typeof value !== "number") {
-					return value
-				}
-				return `${decimalString(value, 2)} ms`
-			}}
-		/>
-	)
-}
-
-export function LossChart({ probeStats, grid, probes, chartData, empty }: ProbeChartProps) {
-	const { t } = useLingui()
-
-	return (
-		<ProbeChart
-			probeStats={probeStats}
-			grid={grid}
-			probes={probes}
-			chartData={chartData}
-			empty={empty}
-			valueIndex={4}
-			title={t`Loss`}
-			description={t`Packet loss (%)`}
-			domain={[0, 100]}
-			tickFormatter={(value) => `${toFixedFloat(value, value >= 10 ? 0 : 1)}%`}
-			contentFormatter={({ value }) => {
-				if (typeof value !== "number") {
-					return value
-				}
-				return `${decimalString(value, 2)}%`
-			}}
-		/>
-	)
-}

internal/site/src/components/routes/system/charts/sensor-charts.tsx

@@ -1,7 +1,7 @@
 import { t } from "@lingui/core/macro"
 import AreaChartDefault from "@/components/charts/area-chart"
 import { batteryStateTranslations } from "@/lib/i18n"
-import { $temperatureFilter, $userSettings } from "@/lib/stores"
+import { $fanFilter, $temperatureFilter, $userSettings } from "@/lib/stores"
 import { cn, decimalString, formatTemperature, toFixedFloat } from "@/lib/utils"
 import type { ChartData, SystemStatsRecord } from "@/types"
 import { ChartCard, FilterBar } from "../chart-card"
@@ -120,7 +120,8 @@ export function TemperatureChart({
 				label: key,
 				dataKey: dataKeys[key],
 				color: colorMap[key],
-				opacity: strokeOpacity,
+				strokeOpacity,
+				activeDot: !filtered,
 			}
 		})
 	}, [sortedKeys, filter, dataKeys, colorMap])
@@ -134,7 +135,7 @@ export function TemperatureChart({
 	// 			label: `Test ${++i}`,
 	// 			dataKey: () => 0,
 	// 			color: "red",
-	// 			opacity: 1,
+	// 			strokeOpacity: 1,
 	// 		})
 	// 	}
 	// }
@@ -202,6 +203,106 @@ export function TemperatureChart({
 						return `${decimalString(value)} ${unit}`
 					}}
 					dataPoints={dataPoints}
+					filter={filter}
+				></LineChartDefault>
+			</ChartCard>
+		</div>
+	)
+}
+
+export function FanChart({
+	chartData,
+	grid,
+	dataEmpty,
+}: {
+	chartData: ChartData
+	grid: boolean
+	dataEmpty: boolean
+}) {
+	const showFanChart = chartData.systemStats.at(-1)?.stats.f
+
+	const filter = useStore($fanFilter)
+
+	const statsRef = useRef(chartData.systemStats)
+	statsRef.current = chartData.systemStats
+
+	// Stable key derived from current sensor names (sorted) so the memo only
+	// recomputes when the set of fans changes — not on every data point.
+	let sensorNamesKey = ""
+	for (let i = chartData.systemStats.length - 1; i >= 0; i--) {
+		const f = chartData.systemStats[i].stats?.f
+		if (f) {
+			sensorNamesKey = Object.keys(f).sort().join("\0")
+			break
+		}
+	}
+
+	const { colorMap, dataKeys, sortedKeys } = useMemo(() => {
+		const stats = statsRef.current
+		const sums = {} as Record<string, number>
+		for (const data of stats) {
+			const f = data.stats?.f
+			if (!f) continue
+			for (const key of Object.keys(f)) {
+				sums[key] = (sums[key] ?? 0) + f[key]
+			}
+		}
+		const sorted = Object.keys(sums).sort((a, b) => sums[b] - sums[a])
+		const colorMap = {} as Record<string, string>
+		const dataKeys = {} as Record<string, (d: SystemStatsRecord) => number | undefined>
+		for (let i = 0; i < sorted.length; i++) {
+			const key = sorted[i]
+			colorMap[key] = `hsl(${((i * 360) / sorted.length) % 360}, 60%, 55%)`
+			dataKeys[key] = (d: SystemStatsRecord) => d.stats?.f?.[key]
+		}
+		return { colorMap, dataKeys, sortedKeys: sorted }
+	}, [sensorNamesKey])
+
+	const dataPoints = useMemo(() => {
+		return sortedKeys.map((key) => {
+			const filterTerms = filter
+				? filter
+						.toLowerCase()
+						.split(" ")
+						.filter((term) => term.length > 0)
+				: []
+			const filtered = filterTerms.length > 0 && !filterTerms.some((term) => key.toLowerCase().includes(term))
+			const strokeOpacity = filtered ? 0.1 : 1
+			return {
+				label: key,
+				dataKey: dataKeys[key],
+				color: colorMap[key],
+				strokeOpacity,
+				activeDot: !filtered,
+			}
+		})
+	}, [sortedKeys, filter, dataKeys, colorMap])
+
+	if (!showFanChart) {
+		return null
+	}
+
+	const legend = dataPoints.length < 12
+
+	return (
+		<div className={cn("odd:last-of-type:col-span-full", { "col-span-full": !grid })}>
+			<ChartCard
+				empty={dataEmpty}
+				grid={grid}
+				title={t`Fans`}
+				description={t`System fan speeds (RPM)`}
+				cornerEl={<FilterBar store={$fanFilter} />}
+				legend={legend}
+			>
+				<LineChartDefault
+					chartData={chartData}
+					itemSorter={(a, b) => b.value - a.value}
+					domain={["auto", "auto"]}
+					legend={legend}
+					tickFormatter={(val) => `${toFixedFloat(val, 0)}`}
+					contentFormatter={(item) => `${decimalString(item.value, 0)} RPM`}
+					dataPoints={dataPoints}
+					filter={filter}
 				></LineChartDefault>
 			</ChartCard>
 		</div>

internal/site/src/components/routes/system/lazy-tables.tsx

@@ -1,11 +1,6 @@
 import { lazy } from "react"
 import { useIntersectionObserver } from "@/lib/use-intersection-observer"
 import { cn } from "@/lib/utils"
-import { ResponseChart, LossChart } from "./charts/probes-charts"
-import type { SystemData } from "./use-system-data"
-import { $chartTime } from "@/lib/stores"
-import { useStore } from "@nanostores/react"
-import { useNetworkProbesData } from "@/lib/use-network-probes"
 
 const ContainersTable = lazy(() => import("../../containers-table/containers-table"))
 
@@ -39,46 +34,3 @@ export function LazySystemdTable({ systemId }: { systemId: string }) {
 		</div>
 	)
 }
-
-const NetworkProbesTable = lazy(() => import("@/components/network-probes-table/network-probes-table"))
-
-export function LazyNetworkProbesTable({ systemId, systemData }: { systemId: string; systemData: SystemData }) {
-	const { isIntersecting, ref } = useIntersectionObserver()
-
-	return (
-		<div ref={ref} className={cn(isIntersecting && "contents")}>
-			{isIntersecting && <ProbesTable systemId={systemId} systemData={systemData} />}
-		</div>
-	)
-}
-
-function ProbesTable({ systemId, systemData }: { systemId: string; systemData: SystemData }) {
-	const { grid, chartData } = systemData ?? {}
-	const chartTime = useStore($chartTime)
-
-	const { probes, probeStats } = useNetworkProbesData({ systemId, loadStats: !!chartData, chartTime })
-
-	return (
-		<>
-			<NetworkProbesTable systemId={systemId} probes={probes} />
-			{!!chartData && !!probes.length && (
-				<div className="grid xl:grid-cols-2 gap-4">
-					<ResponseChart
-						probeStats={probeStats}
-						grid={grid}
-						probes={probes}
-						chartData={chartData}
-						empty={!probeStats.length}
-					/>
-					<LossChart
-						probeStats={probeStats}
-						grid={grid}
-						probes={probes}
-						chartData={chartData}
-						empty={!probeStats.length}
-					/>
-				</div>
-			)}
-		</>
-	)
-}

internal/site/src/components/routes/system/use-system-data.ts

@@ -26,7 +26,7 @@ import type {
 	SystemStatsRecord,
 } from "@/types"
 import { $router, navigate } from "../../router"
-import { appendData, cache, getStats, makeContainerData, makeContainerPoint } from "./chart-data"
+import { appendData, cache, getStats, getTimeData, makeContainerData, makeContainerPoint } from "./chart-data"
 
 export type SystemData = ReturnType<typeof useSystemData>
 
@@ -151,11 +151,16 @@ export function useSystemData(id: string) {
 	const agentVersion = useMemo(() => parseSemVer(system?.info?.v), [system?.info?.v])
 
 	const chartData: ChartData = useMemo(() => {
+		const lastCreated = Math.max(
+			(systemStats.at(-1)?.created as number) ?? 0,
+			(containerData.at(-1)?.created as number) ?? 0
+		)
 		return {
 			systemStats,
 			containerData,
 			chartTime,
 			orientation: direction === "rtl" ? "right" : "left",
+			...getTimeData(chartTime, lastCreated),
 			agentVersion,
 		}
 	}, [systemStats, containerData, direction])
@@ -195,8 +200,8 @@ export function useSystemData(id: string) {
 		}
 
 		Promise.allSettled([
-			getStats<SystemStatsRecord>("system_stats", systemId, chartTime, cachedSystemStats),
-			getStats<ContainerStatsRecord>("container_stats", systemId, chartTime, cachedContainerData),
+			getStats<SystemStatsRecord>("system_stats", systemId, chartTime),
+			getStats<ContainerStatsRecord>("container_stats", systemId, chartTime),
 		]).then(([systemStats, containerStats]) => {
 			// If another request has been made since this one, ignore the results
 			if (requestId !== statsRequestId.current) {

internal/site/src/components/systems-table/systems-table-columns.tsx

@@ -470,7 +470,7 @@ function TableCellWithMeter(info: CellContext<SystemRecord, unknown>) {
 			STATUS_COLORS.down
 	)
 	return (
-		<div className="flex gap-2 items-center tabular-nums tracking-tight w-full">
+		<div className="flex gap-2 items-center tabular-nums tracking-tight w-full min-w-0">
 			<span className="min-w-8 shrink-0">{decimalString(val, val >= 10 ? 1 : 2)}%</span>
 			<span className="flex-1 min-w-8 grid bg-muted h-[1em] rounded-sm overflow-hidden">
 				<span className={meterClass} style={{ width: `${val}%` }}></span>

internal/site/src/components/systems-table/systems-table.tsx

@@ -477,7 +477,7 @@ const SystemCard = memo(
 						</div>
 					</CardHeader>
 					<CardContent className="text-sm px-5 pt-3.5 pb-4">
-						<div className="grid gap-2.5" style={{ gridTemplateColumns: "24px minmax(80px, max-content) 1fr" }}>
+						<div className="grid gap-2.5" style={{ gridTemplateColumns: "24px minmax(80px, max-content) minmax(0, 1fr)" }}>
 							{table.getAllColumns().map((column) => {
 								if (!column.getIsVisible() || column.id === "system" || column.id === "actions") return null
 								const cell = row.getAllCells().find((cell) => cell.column.id === column.id)
@@ -496,7 +496,7 @@ const SystemCard = memo(
 										<div key={`${column.id}-label`} className="flex items-center text-muted-foreground pr-3">
 											{name()}:
 										</div>
-										<div key={`${column.id}-value`} className="flex items-center">
+										<div key={`${column.id}-value`} className="flex items-center min-w-0">
 											{flexRender(cell.column.columnDef.cell, cell.getContext())}
 										</div>
 									</>

internal/site/src/components/ui/chart.tsx

@@ -3,10 +3,9 @@ import { useLingui } from "@lingui/react/macro"
 import * as React from "react"
 import * as RechartsPrimitive from "recharts"
 import { chartTimeData, cn } from "@/lib/utils"
-import type { ChartTimes } from "@/types"
+import type { ChartData } from "@/types"
 import { Separator } from "./separator"
 import { AxisDomain } from "recharts/types/util/types"
-import { timeTicks } from "d3-time"
 
 // Format: { THEME_NAME: CSS_SELECTOR }
 const THEMES = { light: "", dark: ".dark" } as const
@@ -401,37 +400,26 @@ function getPayloadConfigFromPayload(config: ChartConfig, payload: unknown, key:
 	return configLabelKey in config ? config[configLabelKey] : config[key as keyof typeof config]
 }
 
-let cachedAxis: {
-	time: number
-	el: JSX.Element
-}
-
-const xAxis = (chartTime: ChartTimes, lastCreationTime: number) => {
-	if (Math.abs(lastCreationTime - cachedAxis?.time) < 1000) {
-		return cachedAxis.el
+let cachedAxis: JSX.Element
+const xAxis = ({ domain, ticks, chartTime }: ChartData) => {
+	if (cachedAxis && domain[0] === cachedAxis.props.domain[0]) {
+		return cachedAxis
 	}
-	const now = new Date(lastCreationTime + 1000)
-	const startTime = chartTimeData[chartTime].getOffset(now)
-	const ticks = timeTicks(startTime, now, chartTimeData[chartTime].ticks ?? 12).map((date) => date.getTime())
-	const domain = [chartTimeData[chartTime].getOffset(now).getTime(), now.getTime()]
-	cachedAxis = {
-		time: lastCreationTime,
-		el: (
-			<RechartsPrimitive.XAxis
-				dataKey="created"
-				domain={domain}
-				ticks={ticks}
-				allowDataOverflow
-				type="number"
-				scale="time"
-				minTickGap={12}
-				tickMargin={8}
-				axisLine={false}
-				tickFormatter={chartTimeData[chartTime].format}
-			/>
-		),
-	}
-	return cachedAxis.el
+	cachedAxis = (
+		<RechartsPrimitive.XAxis
+			dataKey="created"
+			domain={domain}
+			ticks={ticks}
+			allowDataOverflow
+			type="number"
+			scale="time"
+			minTickGap={12}
+			tickMargin={8}
+			axisLine={false}
+			tickFormatter={chartTimeData[chartTime].format}
+		/>
+	)
+	return cachedAxis
 }
 
 export {

internal/site/src/lib/stores.ts

@@ -64,6 +64,9 @@ export const $containerFilter = atom("")
 /** Temperature chart filter */
 export const $temperatureFilter = atom("")
 
+/** Fan-speed chart filter */
+export const $fanFilter = atom("")
+
 /** Fallback copy to clipboard dialog content */
 export const $copyContent = atom("")
 

internal/site/src/lib/use-network-probes.ts

@@ -1,314 +0,0 @@
-import { chartTimeData } from "@/lib/utils"
-import type { ChartTimes, NetworkProbeRecord, NetworkProbeStatsRecord } from "@/types"
-import { useEffect, useRef, useState } from "react"
-import { getStats, appendData } from "@/components/routes/system/chart-data"
-import { pb } from "@/lib/api"
-import { toast } from "@/components/ui/use-toast"
-import type { RecordListOptions, RecordSubscription } from "pocketbase"
-
-const cache = new Map<string, NetworkProbeStatsRecord[]>()
-
-function getCacheValue(systemId: string, chartTime: ChartTimes | "rt") {
-	return cache.get(`${systemId}${chartTime}`) || []
-}
-
-function appendCacheValue(
-	systemId: string,
-	chartTime: ChartTimes | "rt",
-	newStats: NetworkProbeStatsRecord[],
-	maxPoints = 100
-) {
-	const cache_key = `${systemId}${chartTime}`
-	const existingStats = getCacheValue(systemId, chartTime)
-	if (existingStats) {
-		const { expectedInterval } = chartTimeData[chartTime]
-		const updatedStats = appendData(existingStats, newStats, expectedInterval, maxPoints)
-		cache.set(cache_key, updatedStats)
-		return updatedStats
-	} else {
-		cache.set(cache_key, newStats)
-		return newStats
-	}
-}
-
-const NETWORK_PROBE_FIELDS =
-	"id,name,system,target,protocol,port,interval,res,resMin1h,resMax1h,resAvg1h,loss1h,enabled,updated"
-
-interface UseNetworkProbesProps {
-	systemId?: string
-	loadStats?: boolean
-	chartTime?: ChartTimes
-	existingProbes?: NetworkProbeRecord[]
-}
-
-export function useNetworkProbesData(props: UseNetworkProbesProps) {
-	const { systemId, loadStats, chartTime, existingProbes } = props
-
-	const [p, setProbes] = useState<NetworkProbeRecord[]>([])
-	const [probeStats, setProbeStats] = useState<NetworkProbeStatsRecord[]>([])
-	const statsRequestId = useRef(0)
-	const pendingProbeEvents = useRef(new Map<string, RecordSubscription<NetworkProbeRecord>>())
-	const probeBatchTimeout = useRef<ReturnType<typeof setTimeout> | null>(null)
-
-	const probes = existingProbes ?? p
-
-	// clear old data when systemId changes
-	// useEffect(() => {
-	// 	return setProbes([])
-	// }, [systemId])
-
-	// initial load - fetch probes if not provided by caller
-	useEffect(() => {
-		if (!existingProbes) {
-			fetchProbes(systemId).then((probes) => setProbes(probes))
-		}
-	}, [systemId])
-
-	// Subscribe to updates if probes not provided by caller
-	useEffect(() => {
-		if (existingProbes) {
-			return
-		}
-		let unsubscribe: (() => void) | undefined
-
-		function flushPendingProbeEvents() {
-			probeBatchTimeout.current = null
-			if (!pendingProbeEvents.current.size) {
-				return
-			}
-			const events = pendingProbeEvents.current
-			pendingProbeEvents.current = new Map()
-			setProbes((currentProbes) => {
-				return applyProbeEvents(currentProbes ?? [], events.values(), systemId)
-			})
-		}
-
-		const pbOptions: RecordListOptions = { fields: NETWORK_PROBE_FIELDS }
-		if (systemId) {
-			pbOptions.filter = pb.filter("system = {:system}", { system: systemId })
-		}
-
-		;(async () => {
-			try {
-				unsubscribe = await pb.collection<NetworkProbeRecord>("network_probes").subscribe(
-					"*",
-					(event) => {
-						pendingProbeEvents.current.set(event.record.id, event)
-						if (!probeBatchTimeout.current) {
-							probeBatchTimeout.current = setTimeout(flushPendingProbeEvents, 50)
-						}
-					},
-					pbOptions
-				)
-			} catch (error) {
-				console.error("Failed to subscribe to probes", error)
-			}
-		})()
-
-		return () => {
-			if (probeBatchTimeout.current !== null) {
-				clearTimeout(probeBatchTimeout.current)
-				probeBatchTimeout.current = null
-			}
-			pendingProbeEvents.current.clear()
-			unsubscribe?.()
-		}
-	}, [systemId])
-
-	// Subscribe to new probe stats
-	useEffect(() => {
-		if (!loadStats || !systemId) {
-			return
-		}
-		let unsubscribe: (() => void) | undefined
-		const pbOptions = {
-			fields: "stats,created,type",
-			filter: pb.filter("system = {:system}", { system: systemId }),
-		}
-
-		;(async () => {
-			try {
-				unsubscribe = await pb.collection<NetworkProbeStatsRecord>("network_probe_stats").subscribe(
-					"*",
-					(event) => {
-						if (!chartTime || event.action !== "create") {
-							return
-						}
-						// if (typeof event.record.created === "string") {
-						// 	event.record.created = new Date(event.record.created).getTime()
-						// }
-						// return if not current chart time
-						// we could append to other chart times, but we would need to check the timestamps
-						// to make sure they fit in correctly, so for simplicity just ignore non-chart-time updates
-						// and fetch them via API when the user switches to that chart time
-						const chartTimeRecordType = chartTimeData[chartTime].type as ChartTimes
-						if (event.record.type !== chartTimeRecordType) {
-							// const lastCreated = getCacheValue(systemId, chartTime)?.at(-1)?.created ?? 0
-							// if (lastCreated) {
-							// 	// if the new record is close enough to the last cached record, append it to the cache so it's available immediately if the user switches to that chart time
-							// 	const { expectedInterval } = chartTimeData[chartTime]
-							// 	if (event.record.created - lastCreated < expectedInterval * 1.5) {
-							// 		console.log(
-							// 			`Caching out-of-chart-time probe stats record for chart time ${chartTime} (record type: ${event.record.type})`
-							// 		)
-							// 		const newStats = appendCacheValue(systemId, chartTime, [event.record])
-							// 		cache.set(`${systemId}${chartTime}`, newStats)
-							// 	}
-							// }
-							// console.log(`Received probe stats for non-current chart time (${event.record.type}), ignoring for now`)
-							return
-						}
-
-						// console.log("Appending new probe stats to chart:", event.record)
-						const newStats = appendCacheValue(systemId, chartTime, [event.record])
-						setProbeStats(newStats)
-					},
-					pbOptions
-				)
-			} catch (error) {
-				console.error("Failed to subscribe to probe stats:", error)
-			}
-		})()
-
-		return () => unsubscribe?.()
-	}, [systemId])
-
-	// fetch missing probe stats on load and when chart time changes
-	useEffect(() => {
-		if (!loadStats || !systemId || !chartTime || chartTime === "1m") {
-			return
-		}
-
-		const { expectedInterval } = chartTimeData[chartTime]
-		const requestId = ++statsRequestId.current
-
-		const cachedProbeStats = getCacheValue(systemId, chartTime)
-
-		// Render from cache immediately if available
-		if (cachedProbeStats.length) {
-			setProbeStats(cachedProbeStats)
-
-			// Skip the fetch if the latest cached point is recent enough that no new point is expected yet
-			const lastCreated = cachedProbeStats.at(-1)?.created
-			if (lastCreated && Date.now() - lastCreated < expectedInterval * 0.9) {
-				console.log("Using cached probe stats, skipping fetch")
-				return
-			}
-		}
-
-		getStats<NetworkProbeStatsRecord>("network_probe_stats", systemId, chartTime, cachedProbeStats).then(
-			(probeStats) => {
-				// If another request has been made since this one, ignore the results
-				if (requestId !== statsRequestId.current) {
-					return
-				}
-				const newStats = appendCacheValue(systemId, chartTime, probeStats)
-				setProbeStats(newStats)
-			}
-		)
-	}, [chartTime])
-
-	// subscribe to realtime metrics if chart time is 1m
-	useEffect(() => {
-		if (!loadStats || !systemId || chartTime !== "1m") {
-			return
-		}
-		let unsubscribe: (() => void) | undefined
-		const cache_key = `${systemId}rt`
-		pb.realtime
-			.subscribe(
-				`rt_metrics`,
-				(data: { Probes: NetworkProbeStatsRecord["stats"] }) => {
-					let prev = getCacheValue(systemId, "rt")
-					const now = Date.now()
-					// if no previous data or the last data point is older than 1min,
-					// create a new data set starting with a point 1 second ago to seed the chart data
-					if (!prev || (prev.at(-1)?.created ?? 0) < now - 60_000) {
-						prev = [{ created: now - 1000, stats: probesToStats(probes) }]
-					}
-					const stats = { created: now, stats: data.Probes } as NetworkProbeStatsRecord
-					const newStats = appendData(prev, [stats], 1000, 120)
-					setProbeStats(() => newStats)
-					cache.set(cache_key, newStats)
-				},
-				{ query: { system: systemId } }
-			)
-			.then((us) => {
-				unsubscribe = us
-			})
-		return () => unsubscribe?.()
-	}, [chartTime, systemId])
-
-	return {
-		probes,
-		probeStats,
-	}
-}
-
-function probesToStats(probes: NetworkProbeRecord[]): NetworkProbeStatsRecord["stats"] {
-	const stats: NetworkProbeStatsRecord["stats"] = {}
-	for (const probe of probes) {
-		stats[probe.id] = [probe.res, probe.resAvg1h, probe.resMin1h, probe.resMax1h, probe.loss1h]
-	}
-	return stats
-}
-
-async function fetchProbes(systemId?: string) {
-	try {
-		const res = await pb.collection<NetworkProbeRecord>("network_probes").getList(0, 2000, {
-			fields: NETWORK_PROBE_FIELDS,
-			filter: systemId ? pb.filter("system={:system}", { system: systemId }) : undefined,
-		})
-		return res.items
-	} catch (error) {
-		toast({
-			title: "Error",
-			description: (error as Error)?.message,
-			variant: "destructive",
-		})
-		return []
-	}
-}
-
-function applyProbeEvents(
-	probes: NetworkProbeRecord[],
-	events: Iterable<RecordSubscription<NetworkProbeRecord>>,
-	systemId?: string
-) {
-	// Use a map to handle updates/deletes in constant time
-	const probeById = new Map(probes.map((probe) => [probe.id, probe]))
-	const createdProbes: NetworkProbeRecord[] = []
-
-	for (const { action, record } of events) {
-		const matchesSystemScope = !systemId || record.system === systemId
-
-		if (action === "delete" || !matchesSystemScope) {
-			probeById.delete(record.id)
-			continue
-		}
-
-		if (!probeById.has(record.id)) {
-			createdProbes.push(record)
-		}
-
-		probeById.set(record.id, record)
-	}
-
-	const nextProbes: NetworkProbeRecord[] = []
-	// Prepend brand new probes (matching previous behavior)
-	for (let index = createdProbes.length - 1; index >= 0; index -= 1) {
-		nextProbes.push(createdProbes[index])
-	}
-
-	// Rebuild the final list while preserving original order for existing probes
-	for (const probe of probes) {
-		const nextProbe = probeById.get(probe.id)
-		if (!nextProbe) {
-			continue
-		}
-		nextProbes.push(nextProbe)
-		probeById.delete(probe.id)
-	}
-
-	return nextProbes
-}

internal/site/src/main.tsx

@@ -30,7 +30,6 @@ const LoginPage = lazy(() => import("@/components/login/login.tsx"))
 const Home = lazy(() => import("@/components/routes/home.tsx"))
 const Containers = lazy(() => import("@/components/routes/containers.tsx"))
 const Smart = lazy(() => import("@/components/routes/smart.tsx"))
-const Probes = lazy(() => import("@/components/routes/probes.tsx"))
 const SystemDetail = lazy(() => import("@/components/routes/system.tsx"))
 const CopyToClipboardDialog = lazy(() => import("@/components/copy-to-clipboard.tsx"))
 
@@ -80,8 +79,6 @@ const App = memo(() => {
 		return <Containers />
 	} else if (page.route === "smart") {
 		return <Smart />
-	} else if (page.route === "probes") {
-		return <Probes />
 	} else if (page.route === "settings") {
 		return <Settings />
 	}

internal/site/src/types.d.ts

@@ -143,6 +143,8 @@ export interface SystemStats {
 	bm?: [number, number]
 	/** temperatures */
 	t?: Record<string, number>
+	/** fan speeds (RPM) — keyed by `<chip>_<label-or-fan-idx>` */
+	f?: Record<string, number>
 	/** extra filesystems */
 	efs?: Record<string, ExtraFsStats>
 	/** GPU data */
@@ -208,7 +210,7 @@ interface ContainerStats {
 	n: string
 	/** cpu percent */
 	c: number
-	/** memory used (gb) */
+	/** memory used (mb) */
 	m: number
 	// network sent (mb)
 	ns?: number
@@ -316,6 +318,8 @@ export interface ChartData {
 	systemStats: SystemStatsRecord[]
 	containerData: ChartDataContainer[]
 	orientation: "right" | "left"
+	ticks: number[]
+	domain: number[]
 	chartTime: ChartTimes
 }
 
@@ -544,40 +548,3 @@ export interface UpdateInfo {
 	v: string // new version
 	url: string // url to new version
 }
-
-export interface NetworkProbeRecord {
-	id: string
-	system: string
-	name: string
-	target: string
-	protocol: "icmp" | "tcp" | "http"
-	port: number
-	res: number
-	resMin1h: number
-	resMax1h: number
-	resAvg1h: number
-	loss1h: number
-	interval: number
-	enabled: boolean
-	updated: string
-}
-
-/**
- * 0: avg 1 minute response in ms
- *
- * 1: avg response over 1 hour in ms
- *
- * 2: min response over the last hour in ms
- *
- * 3: max response over the last hour in ms
- *
- * 4: packet loss in %
- */
-type ProbeResult = number[]
-
-export interface NetworkProbeStatsRecord {
-	id?: string
-	type?: string
-	stats: Record<string, ProbeResult>
-	created: number // unix timestamp (ms) for Recharts xAxis
-}

readme.md

@@ -16,7 +16,7 @@ It has a friendly web interface, simple configuration, and is ready to use out o
 - **Lightweight**: Smaller and less resource-intensive than leading solutions.
 - **Simple**: Easy setup with little manual configuration required.
 - **Docker stats**: Tracks CPU, memory, and network usage history for each container.
-- **Alerts**: Configurable alerts for CPU, memory, disk, bandwidth, temperature, load average, and status.
+- **Alerts**: Configurable alerts for CPU, memory, disk, bandwidth, temperature, fan speed, load average, and status.
 - **Multi-user**: Users manage their own systems. Admins can share systems across users.
 - **OAuth / OIDC**: Supports many OAuth2 providers. Password auth can be disabled.
 - **Automatic backups**: Save to and restore from disk or S3-compatible storage.
@@ -48,6 +48,7 @@ The [quick start guide](https://beszel.dev/guide/getting-started) and other docu
 - **Network usage** - Host system and containers.
 - **Load average** - Host system.
 - **Temperature** - Host system sensors.
+- **Fan speed** - Host system sensors (Linux, via `/sys/class/hwmon`).
 - **GPU usage / power draw** - Nvidia, AMD, and Intel.
 - **Battery** - Host system battery charge.
 - **Containers** - Status and metrics of all running Docker / Podman containers.

supplemental/docker/agent/docker-compose.yml

@@ -1,18 +1,24 @@
+# Specialized images available for Nvidia / Intel GPUs
+#
+# Docs: https://beszel.dev/guide/agent-installation
+# Env vars: https://beszel.dev/guide/environment-variables
+
 services:
   beszel-agent:
-    image: 'henrygd/beszel-agent' #Or henrygd/beszel-agent-nvidia
-    container_name: 'beszel-agent'
+    image: henrygd/beszel-agent
+    container_name: beszel-agent
     restart: unless-stopped
     network_mode: host
-    # Only when using henrygd/beszel-agent-nvidia
-    # runtime: nvidia
     volumes:
+      - ./beszel_agent_data:/var/lib/beszel-agent
       - /var/run/docker.sock:/var/run/docker.sock:ro
       # monitor other disks / partitions by mounting a folder in /extra-filesystems
-      # - /mnt/disk/.beszel:/extra-filesystems/sda1:ro
+      # - /mnt/disk1/.beszel:/extra-filesystems/disk1:ro
     environment:
-      PORT: 45876
-      KEY: 'ssh-ed25519 YOUR_PUBLIC_KEY'
-      # Only when using henrygd/beszel-agent-nvidia
-      # NVIDIA_VISIBLE_DEVICES: all 
-      # NVIDIA_DRIVER_CAPABILITIES: compute,video,utility
+      LISTEN: 45876
+      KEY: "<public key>"
+      HUB_URL: "<hub url>"
+      TOKEN: "<token>"
+    # healthcheck:
+    #   test: ['CMD', '/agent', 'health']
+    #   interval: 120s

supplemental/docker/hub/docker-compose.yml

@@ -1,9 +1,17 @@
+# Docs: https://beszel.dev/guide/hub-installation
+# Env vars: https://beszel.dev/guide/environment-variables
+
 services:
   beszel:
-    image: 'henrygd/beszel'
-    container_name: 'beszel'
+    image: "henrygd/beszel"
+    container_name: "beszel"
     restart: unless-stopped
     ports:
-      - '8090:8090'
+      - "8090:8090"
     volumes:
       - ./beszel_data:/beszel_data
+    # healthcheck:
+    #   test: ['CMD', '/beszel', 'health', '--url', 'http://localhost:8090']
+    #   interval: 120s
+    #   start_period: 10s
+    #   timeout: 5s