New translations en.po (Chinese Traditional, Hong Kong)

.github/dependabot.yml

@@ -1,12 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: gomod
-    directory: /
-    schedule:
-      interval: weekly
-
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-

.github/workflows/docker-images.yml

@@ -41,7 +41,7 @@ jobs:
           # henrygd/beszel-agent-nvidia
           - image: henrygd/beszel-agent-nvidia
             dockerfile: ./internal/dockerfile_agent_nvidia
-            platforms: linux/amd64,linux/arm64
+            platforms: linux/amd64
             registry: docker.io
             username_secret: DOCKERHUB_USERNAME
             password_secret: DOCKERHUB_TOKEN
@@ -96,7 +96,7 @@ jobs:
           # ghcr.io/henrygd/beszel-agent-nvidia
           - image: ghcr.io/${{ github.repository }}/beszel-agent-nvidia
             dockerfile: ./internal/dockerfile_agent_nvidia
-            platforms: linux/amd64,linux/arm64
+            platforms: linux/amd64
             registry: ghcr.io
             username: ${{ github.actor }}
             password_secret: GITHUB_TOKEN
@@ -152,7 +152,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
 
       - name: Set up bun
         uses: oven-sh/setup-bun@v2
@@ -164,14 +164,14 @@ jobs:
         run: bun run --cwd ./internal/site build
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
       - name: Docker metadata
         id: metadata
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v5
         with:
           images: ${{ matrix.image }}
           tags: ${{ matrix.tags }}
@@ -181,7 +181,7 @@ jobs:
         env:
           password_secret_exists: ${{ secrets[matrix.password_secret] != '' && 'true' || 'false' }}
         if: github.event_name != 'pull_request' && env.password_secret_exists == 'true'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ matrix.username || secrets[matrix.username_secret] }}
           password: ${{ secrets[matrix.password_secret] }}
@@ -190,13 +190,11 @@ jobs:
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
         with:
           context: ./
           file: ${{ matrix.dockerfile }}
           platforms: ${{ matrix.platforms || 'linux/amd64,linux/arm64,linux/arm/v7' }}
           push: ${{ github.ref_type == 'tag' && secrets[matrix.password_secret] != '' }}
-          provenance: mode=max
-          sbom: true
           tags: ${{ steps.metadata.outputs.tags }}
           labels: ${{ steps.metadata.outputs.labels }}

.github/workflows/inactivity-actions.yml

@@ -15,7 +15,7 @@ jobs:
     name: Lock Inactive Issues
     runs-on: ubuntu-24.04
     steps:
-      - uses: klaasnicolaas/action-inactivity-lock@v2.0.1
+      - uses: klaasnicolaas/action-inactivity-lock@v1.1.3
         id: lock
         with:
           days-inactive-issues: 14
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Close Stale Issues
-        uses: actions/stale@v11
+        uses: actions/stale@v10
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/release.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -27,12 +27,12 @@ jobs:
         run: bun run --cwd ./internal/site build
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v5
         with:
           go-version: "^1.22.1"
 
       - name: Set up .NET
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@v4
         with:
           dotnet-version: "9.0.x"
 
@@ -42,7 +42,7 @@ jobs:
         shell: bash
 
       - name: GoReleaser beszel
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@v6
         with:
           workdir: ./
           distribution: goreleaser

.github/workflows/vulncheck.yml

@@ -19,11 +19,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
-          go-version: stable
+          go-version: 1.26.x
           # cached: false
       - name: Get official govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest

Makefile

@@ -52,7 +52,7 @@ lint:
 	golangci-lint run
 
 test:
-	go test -tags='testing no_ui' ./...
+	go test -tags=testing ./...
 
 tidy:
 	go mod tidy

agent/agent.go

@@ -19,8 +19,6 @@ import (
 	gossh "golang.org/x/crypto/ssh"
 )
 
-const defaultDataCacheTimeMs uint16 = 60_000
-
 type Agent struct {
 	sync.Mutex                                                                      // Used to lock agent while collecting data
 	debug                     bool                                                  // true if LOG_LEVEL is set to debug
@@ -38,7 +36,6 @@ type Agent struct {
 	sensorConfig              *SensorConfig                                         // Sensors config
 	systemInfo                system.Info                                           // Host system info (dynamic)
 	systemDetails             system.Details                                        // Host system details (static, once-per-connection)
-	detailsDirty              bool                                                  // Whether system details have changed and need to be resent
 	gpuManager                *GPUManager                                           // Manages GPU data
 	cache                     *systemDataCache                                      // Cache for system stats based on cache time
 	connectionManager         *ConnectionManager                                    // Channel to signal connection events
@@ -100,7 +97,7 @@ func NewAgent(dataDir ...string) (agent *Agent, err error) {
 	slog.Debug(beszel.Version)
 
 	// initialize docker manager
-	agent.dockerManager = newDockerManager(agent)
+	agent.dockerManager = newDockerManager()
 
 	// initialize system info
 	agent.refreshSystemDetails()
@@ -145,7 +142,7 @@ func NewAgent(dataDir ...string) (agent *Agent, err error) {
 
 	// if debugging, print stats
 	if agent.debug {
-		slog.Debug("Stats", "data", agent.gatherStats(common.DataRequestOptions{CacheTimeMs: defaultDataCacheTimeMs, IncludeDetails: true}))
+		slog.Debug("Stats", "data", agent.gatherStats(common.DataRequestOptions{CacheTimeMs: 60_000, IncludeDetails: true}))
 	}
 
 	return agent, nil
@@ -167,6 +164,11 @@ func (a *Agent) gatherStats(options common.DataRequestOptions) *system.CombinedD
 		Info:  a.systemInfo,
 	}
 
+	// Include static system details only when requested
+	if options.IncludeDetails {
+		data.Details = &a.systemDetails
+	}
+
 	// slog.Info("System data", "data", data, "cacheTimeMs", cacheTimeMs)
 
 	if a.dockerManager != nil {
@@ -179,7 +181,7 @@ func (a *Agent) gatherStats(options common.DataRequestOptions) *system.CombinedD
 	}
 
 	// skip updating systemd services if cache time is not the default 60sec interval
-	if a.systemdManager != nil && cacheTimeMs == defaultDataCacheTimeMs {
+	if a.systemdManager != nil && cacheTimeMs == 60_000 {
 		totalCount := uint16(a.systemdManager.getServiceStatsCount())
 		if totalCount > 0 {
 			numFailed := a.systemdManager.getFailedServiceCount()
@@ -210,8 +212,7 @@ func (a *Agent) gatherStats(options common.DataRequestOptions) *system.CombinedD
 	slog.Debug("Extra FS", "data", data.Stats.ExtraFs)
 
 	a.cache.Set(data, cacheTimeMs)
-
-	return a.attachSystemDetails(data, cacheTimeMs, options.IncludeDetails)
+	return data
 }
 
 // Start initializes and starts the agent with optional WebSocket connection

agent/battery/battery.go

@@ -1,70 +1,84 @@
-// Package battery provides battery information for the host and connected devices.
+//go:build !freebsd
+
+// Package battery provides functions to check if the system has a battery and to get the battery stats.
 package battery
 
 import (
 	"errors"
-	"sort"
-	"strconv"
-	"strings"
+	"log/slog"
+	"math"
+
+	"github.com/distatus/battery"
 )
 
-const (
-	stateUnknown uint8 = iota
-	stateEmpty
-	stateFull
-	stateCharging
-	stateDischarging
-	stateIdle
+var (
+	systemHasBattery   = false
+	haveCheckedBattery = false
 )
 
-// Battery is a readable battery reported by the operating system.
-type Battery struct {
-	Name                  string
-	Percent               uint8
-	State                 uint8
-	FullChargeCapacity    uint64
-	HasFullChargeCapacity bool
-	System                bool
-}
-
-var errNoBatteries = errors.New("no readable batteries")
-
-// normalizeBatteries supplies stable fallback names and disambiguates duplicates.
-func normalizeBatteries(batteries []Battery) []Battery {
-	nameCounts := make(map[string]int, len(batteries))
-	for i := range batteries {
-		name := strings.TrimSpace(batteries[i].Name)
-		if name == "" {
-			name = "Battery " + strconv.Itoa(i+1)
-		}
-		nameCounts[name]++
-		if nameCounts[name] > 1 {
-			name += " (" + strconv.Itoa(nameCounts[name]) + ")"
-		}
-		batteries[i].Name = name
+// HasReadableBattery checks if the system has a battery and returns true if it does.
+func HasReadableBattery() bool {
+	if haveCheckedBattery {
+		return systemHasBattery
 	}
-	return batteries
+	haveCheckedBattery = true
+	batteries, err := battery.GetAll()
+	for _, bat := range batteries {
+		if bat != nil && (bat.Full > 0 || bat.Design > 0) {
+			systemHasBattery = true
+			break
+		}
+	}
+	if !systemHasBattery {
+		slog.Debug("No battery found", "err", err)
+	}
+	return systemHasBattery
 }
 
-// Primary returns the representative battery. Reported full-charge capacity wins,
-// then system-scoped devices, then name for deterministic ties.
-func Primary(batteries []Battery) (Battery, bool) {
+// GetBatteryStats returns the current battery percent and charge state
+// percent = (current charge of all batteries) / (sum of designed/full capacity of all batteries)
+func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
+	if !HasReadableBattery() {
+		return batteryPercent, batteryState, errors.ErrUnsupported
+	}
+	batteries, err := battery.GetAll()
+	// we'll handle errors later by skipping batteries with errors, rather
+	// than skipping everything because of the presence of some errors.
 	if len(batteries) == 0 {
-		return Battery{}, false
+		return batteryPercent, batteryState, errors.New("no batteries")
 	}
-	ordered := append([]Battery(nil), batteries...)
-	sort.SliceStable(ordered, func(i, j int) bool {
-		a, b := ordered[i], ordered[j]
-		if a.HasFullChargeCapacity != b.HasFullChargeCapacity {
-			return a.HasFullChargeCapacity
+
+	totalCapacity := float64(0)
+	totalCharge := float64(0)
+	errs, partialErrs := err.(battery.Errors)
+
+	batteryState = math.MaxUint8
+
+	for i, bat := range batteries {
+		if partialErrs && errs[i] != nil {
+			// if there were some errors, like missing data, skip it
+			continue
 		}
-		if a.HasFullChargeCapacity && a.FullChargeCapacity != b.FullChargeCapacity {
-			return a.FullChargeCapacity > b.FullChargeCapacity
+		if bat == nil || bat.Full == 0 {
+			// skip batteries with no capacity. Charge is unlikely to ever be zero, but
+			// we can't guarantee that, so don't skip based on charge.
+			continue
 		}
-		if a.System != b.System {
-			return a.System
+		totalCapacity += bat.Full
+		totalCharge += min(bat.Current, bat.Full)
+		if bat.State.Raw >= 0 {
+			batteryState = uint8(bat.State.Raw)
 		}
-		return a.Name < b.Name
-	})
-	return ordered[0], true
+	}
+
+	if totalCapacity == 0 || batteryState == math.MaxUint8 {
+		// for macs there's sometimes a ghost battery with 0 capacity
+		// https://github.com/distatus/battery/issues/34
+		// Instead of skipping over those batteries, we'll check for total 0 capacity
+		// and return an error. This also prevents a divide by zero.
+		return batteryPercent, batteryState, errors.New("no battery capacity")
+	}
+
+	batteryPercent = uint8(totalCharge / totalCapacity * 100)
+	return batteryPercent, batteryState, nil
 }

agent/battery/battery_darwin.go

@@ -1,76 +0,0 @@
-//go:build darwin
-
-package battery
-
-import (
-	"os/exec"
-
-	"howett.net/plist"
-)
-
-type macBattery struct {
-	CurrentCapacity   int  `plist:"CurrentCapacity"`
-	MaxCapacity       int  `plist:"MaxCapacity"`
-	FullyCharged      bool `plist:"FullyCharged"`
-	IsCharging        bool `plist:"IsCharging"`
-	ExternalConnected bool `plist:"ExternalConnected"`
-}
-
-func readMacBatteries() ([]macBattery, error) {
-	out, err := exec.Command("ioreg", "-n", "AppleSmartBattery", "-r", "-a").Output()
-	if err != nil {
-		return nil, err
-	}
-	if len(out) == 0 {
-		return nil, nil
-	}
-	var batteries []macBattery
-	if _, err := plist.Unmarshal(out, &batteries); err != nil {
-		return nil, err
-	}
-	return batteries, nil
-}
-
-func HasReadableBattery() bool {
-	batteries, _ := GetBatteryStats()
-	return len(batteries) > 0
-}
-
-// GetBatteryStats returns every readable battery reported by macOS.
-func GetBatteryStats() ([]Battery, error) {
-	batteries, err := readMacBatteries()
-	if err != nil {
-		return nil, err
-	}
-	if len(batteries) == 0 {
-		return nil, errNoBatteries
-	}
-	result := make([]Battery, 0, len(batteries))
-	for _, bat := range batteries {
-		if bat.MaxCapacity <= 0 {
-			// skip ghost batteries with 0 capacity
-			// https://github.com/distatus/battery/issues/34
-			continue
-		}
-		percent := min(max(float64(bat.CurrentCapacity)/float64(bat.MaxCapacity)*100, 0), 100)
-		state := stateUnknown
-		switch {
-		case !bat.ExternalConnected:
-			state = stateDischarging
-		case bat.IsCharging:
-			state = stateCharging
-		case bat.CurrentCapacity == 0:
-			state = stateEmpty
-		case !bat.FullyCharged:
-			state = stateIdle
-		default:
-			state = stateFull
-		}
-		result = append(result, Battery{Name: "Primary", Percent: uint8(percent), State: state,
-			FullChargeCapacity: uint64(bat.MaxCapacity), HasFullChargeCapacity: true, System: true})
-	}
-	if len(result) == 0 {
-		return nil, errNoBatteries
-	}
-	return normalizeBatteries(result), nil
-}

agent/battery/battery_freebsd.go

@@ -0,0 +1,13 @@
+//go:build freebsd
+
+package battery
+
+import "errors"
+
+func HasReadableBattery() bool {
+	return false
+}
+
+func GetBatteryStats() (uint8, uint8, error) {
+	return 0, 0, errors.ErrUnsupported
+}

agent/battery/battery_linux.go

@@ -1,85 +0,0 @@
-//go:build linux
-
-package battery
-
-import (
-	"os"
-	"path/filepath"
-	"strconv"
-
-	"github.com/henrygd/beszel/agent/utils"
-)
-
-var batteryRoot = "/sys/class/power_supply"
-
-// HasReadableBattery reports whether collection currently finds a readable battery.
-func HasReadableBattery() bool {
-	batteries, _ := GetBatteryStats()
-	return len(batteries) > 0
-}
-
-func parseSysfsState(status string) uint8 {
-	switch status {
-	case "Empty":
-		return stateEmpty
-	case "Full":
-		return stateFull
-	case "Charging":
-		return stateCharging
-	case "Discharging":
-		return stateDischarging
-	case "Not charging":
-		return stateIdle
-	default:
-		return stateUnknown
-	}
-}
-
-// GetBatteryStats re-enumerates power supplies and returns every readable battery.
-func GetBatteryStats() ([]Battery, error) {
-	entries, err := os.ReadDir(batteryRoot)
-	if err != nil {
-		return nil, err
-	}
-	batteries := make([]Battery, 0, len(entries))
-	for _, entry := range entries {
-		path := filepath.Join(batteryRoot, entry.Name())
-		if utils.ReadStringFile(filepath.Join(path, "type")) != "Battery" {
-			continue
-		}
-		capStr, ok := utils.ReadStringFileOK(filepath.Join(path, "capacity"))
-		if !ok {
-			continue
-		}
-		cap, parseErr := strconv.Atoi(capStr)
-		if parseErr != nil {
-			continue
-		}
-		cap = min(max(cap, 0), 100)
-		name := utils.ReadStringFile(filepath.Join(path, "model_name"))
-		if name == "" {
-			name = utils.ReadStringFile(filepath.Join(path, "model"))
-		}
-		if name == "" {
-			name = entry.Name()
-		}
-		battery := Battery{
-			Name:    name,
-			Percent: uint8(cap),
-			State:   parseSysfsState(utils.ReadStringFile(filepath.Join(path, "status"))),
-			System:  utils.ReadStringFile(filepath.Join(path, "scope")) != "Device",
-		}
-		for _, fullName := range []string{"charge_full", "energy_full"} {
-			if parsed, ok := utils.ReadUintFile(filepath.Join(path, fullName)); ok && parsed > 0 {
-				battery.FullChargeCapacity = parsed
-				battery.HasFullChargeCapacity = true
-				break
-			}
-		}
-		batteries = append(batteries, battery)
-	}
-	if len(batteries) == 0 {
-		return nil, errNoBatteries
-	}
-	return normalizeBatteries(batteries), nil
-}

agent/battery/battery_linux_test.go

@@ -1,109 +0,0 @@
-//go:build testing && linux
-
-package battery
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-type fakeBattery struct{ id, name, capacity, status, full, scope string }
-
-func setupFakeSysfs(t *testing.T) (string, func(fakeBattery)) {
-	t.Helper()
-	root := t.TempDir()
-	previousRoot := batteryRoot
-	batteryRoot = root
-	t.Cleanup(func() { batteryRoot = previousRoot })
-	write := func(path, value string) {
-		t.Helper()
-		require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
-		require.NoError(t, os.WriteFile(path, []byte(value), 0o644))
-	}
-	add := func(b fakeBattery) {
-		t.Helper()
-		dir := filepath.Join(root, b.id)
-		write(filepath.Join(dir, "type"), "Battery")
-		if b.capacity != "" {
-			write(filepath.Join(dir, "capacity"), b.capacity)
-		}
-		write(filepath.Join(dir, "status"), b.status)
-		if b.name != "" {
-			write(filepath.Join(dir, "model_name"), b.name)
-		}
-		if b.full != "" {
-			write(filepath.Join(dir, "energy_full"), b.full)
-		}
-		if b.scope != "" {
-			write(filepath.Join(dir, "scope"), b.scope)
-		}
-	}
-	return root, add
-}
-
-func TestParseSysfsState(t *testing.T) {
-	assert.Equal(t, stateEmpty, parseSysfsState("Empty"))
-	assert.Equal(t, stateFull, parseSysfsState("Full"))
-	assert.Equal(t, stateCharging, parseSysfsState("Charging"))
-	assert.Equal(t, stateDischarging, parseSysfsState("Discharging"))
-	assert.Equal(t, stateIdle, parseSysfsState("Not charging"))
-	assert.Equal(t, stateUnknown, parseSysfsState("SomethingElse"))
-}
-
-func TestGetBatteryStatsMultipleNamedAndPrimary(t *testing.T) {
-	_, add := setupFakeSysfs(t)
-	add(fakeBattery{id: "BAT0", name: "Primary", capacity: "105", status: "Charging", full: "5000", scope: "System"})
-	add(fakeBattery{id: "hidpp_battery_0", name: "MX Keys S", capacity: "55", status: "Unknown", full: "900", scope: "Device"})
-	batteries, err := GetBatteryStats()
-	require.NoError(t, err)
-	require.Len(t, batteries, 2)
-	assert.Equal(t, "Primary", batteries[0].Name)
-	assert.Equal(t, uint8(100), batteries[0].Percent)
-	assert.Equal(t, stateUnknown, batteries[1].State)
-	primary, ok := Primary(batteries)
-	require.True(t, ok)
-	assert.Equal(t, "Primary", primary.Name)
-}
-
-func TestGetBatteryStatsFallbackDuplicatesAndUnreadable(t *testing.T) {
-	root, add := setupFakeSysfs(t)
-	add(fakeBattery{id: "BAT0", name: "Keyboard", capacity: "80", status: "Discharging"})
-	add(fakeBattery{id: "BAT1", name: "Keyboard", capacity: "-4", status: "SomethingWeird"})
-	add(fakeBattery{id: "BAT2", capacity: "not-a-number", status: "Charging"})
-	add(fakeBattery{id: "BAT3", capacity: "42", status: "Full"})
-	ac := filepath.Join(root, "AC0")
-	require.NoError(t, os.MkdirAll(ac, 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(ac, "type"), []byte("Mains"), 0o644))
-	batteries, err := GetBatteryStats()
-	require.NoError(t, err)
-	require.Len(t, batteries, 3)
-	assert.Equal(t, "Keyboard", batteries[0].Name)
-	assert.Equal(t, "Keyboard (2)", batteries[1].Name)
-	assert.Equal(t, uint8(0), batteries[1].Percent)
-	assert.Equal(t, "BAT3", batteries[2].Name)
-}
-
-func TestGetBatteryStatsHotPlugReenumerates(t *testing.T) {
-	_, add := setupFakeSysfs(t)
-	_, err := GetBatteryStats()
-	assert.Error(t, err)
-	assert.False(t, HasReadableBattery())
-	add(fakeBattery{id: "BAT0", capacity: "64", status: "Discharging"})
-	batteries, err := GetBatteryStats()
-	require.NoError(t, err)
-	assert.True(t, HasReadableBattery())
-	require.Len(t, batteries, 1)
-	assert.Equal(t, uint8(64), batteries[0].Percent)
-}
-
-func TestGetBatteryStatsNoReadableCapacity(t *testing.T) {
-	_, add := setupFakeSysfs(t)
-	add(fakeBattery{id: "BAT0", status: "Charging"})
-	_, err := GetBatteryStats()
-	assert.Error(t, err)
-	assert.False(t, HasReadableBattery())
-}

agent/battery/battery_stub.go

@@ -1,13 +0,0 @@
-//go:build !darwin && !linux && !windows
-
-package battery
-
-import "errors"
-
-func HasReadableBattery() bool {
-	return false
-}
-
-func GetBatteryStats() ([]Battery, error) {
-	return nil, errors.ErrUnsupported
-}

agent/battery/battery_test.go

@@ -1,35 +0,0 @@
-package battery
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestPrimarySelection(t *testing.T) {
-	tests := []struct {
-		name string
-		bats []Battery
-		want string
-	}{
-		{"largest reported capacity", []Battery{{Name: "Small", FullChargeCapacity: 20, HasFullChargeCapacity: true, System: true}, {Name: "Large", FullChargeCapacity: 80, HasFullChargeCapacity: true}}, "Large"},
-		{"reported ranks over missing", []Battery{{Name: "Unknown", System: true}, {Name: "Known", FullChargeCapacity: 1, HasFullChargeCapacity: true}}, "Known"},
-		{"system wins capacity tie", []Battery{{Name: "Peripheral", FullChargeCapacity: 50, HasFullChargeCapacity: true}, {Name: "System", FullChargeCapacity: 50, HasFullChargeCapacity: true, System: true}}, "System"},
-		{"name resolves final tie", []Battery{{Name: "Zed"}, {Name: "Alpha"}}, "Alpha"},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, ok := Primary(tt.bats)
-			require.True(t, ok)
-			assert.Equal(t, tt.want, got.Name)
-		})
-	}
-	_, ok := Primary(nil)
-	assert.False(t, ok)
-}
-
-func TestNormalizeBatteriesFallbackNames(t *testing.T) {
-	bats := normalizeBatteries([]Battery{{}, {}, {Name: "Mouse"}, {Name: "Mouse"}})
-	assert.Equal(t, []string{"Battery 1", "Battery 2", "Mouse", "Mouse (2)"}, []string{bats[0].Name, bats[1].Name, bats[2].Name, bats[3].Name})
-}

agent/battery/battery_windows.go

@@ -1,291 +0,0 @@
-//go:build windows
-
-// Most of the Windows battery code is based on
-// distatus/battery by Karol 'Kenji Takahashi' Woźniak
-
-package battery
-
-import (
-	"errors"
-	"syscall"
-	"unsafe"
-
-	"golang.org/x/sys/windows"
-)
-
-type batteryQueryInformation struct {
-	BatteryTag       uint32
-	InformationLevel int32
-	AtRate           int32
-}
-
-type batteryInformation struct {
-	Capabilities        uint32
-	Technology          uint8
-	Reserved            [3]uint8
-	Chemistry           [4]uint8
-	DesignedCapacity    uint32
-	FullChargedCapacity uint32
-	DefaultAlert1       uint32
-	DefaultAlert2       uint32
-	CriticalBias        uint32
-	CycleCount          uint32
-}
-
-type batteryWaitStatus struct {
-	BatteryTag   uint32
-	Timeout      uint32
-	PowerState   uint32
-	LowCapacity  uint32
-	HighCapacity uint32
-}
-
-type batteryStatus struct {
-	PowerState uint32
-	Capacity   uint32
-	Voltage    uint32
-	Rate       int32
-}
-
-type winGUID struct {
-	Data1 uint32
-	Data2 uint16
-	Data3 uint16
-	Data4 [8]byte
-}
-
-type spDeviceInterfaceData struct {
-	cbSize             uint32
-	InterfaceClassGuid winGUID
-	Flags              uint32
-	Reserved           uint
-}
-
-var guidDeviceBattery = winGUID{
-	0x72631e54,
-	0x78A4,
-	0x11d0,
-	[8]byte{0xbc, 0xf7, 0x00, 0xaa, 0x00, 0xb7, 0xb3, 0x2a},
-}
-
-var (
-	setupapi                         = &windows.LazyDLL{Name: "setupapi.dll", System: true}
-	setupDiGetClassDevsW             = setupapi.NewProc("SetupDiGetClassDevsW")
-	setupDiEnumDeviceInterfaces      = setupapi.NewProc("SetupDiEnumDeviceInterfaces")
-	setupDiGetDeviceInterfaceDetailW = setupapi.NewProc("SetupDiGetDeviceInterfaceDetailW")
-	setupDiDestroyDeviceInfoList     = setupapi.NewProc("SetupDiDestroyDeviceInfoList")
-)
-
-// winBatteryGet reads one battery by index.
-// Returns error == errNotFound when there are no more batteries.
-var errNotFound = errors.New("no more batteries")
-
-func setupDiSetup(proc *windows.LazyProc, nargs, a1, a2, a3, a4, a5, a6 uintptr) (uintptr, error) {
-	_ = nargs
-	r1, _, errno := syscall.SyscallN(proc.Addr(), a1, a2, a3, a4, a5, a6)
-	if windows.Handle(r1) == windows.InvalidHandle {
-		if errno != 0 {
-			return 0, error(errno)
-		}
-		return 0, syscall.EINVAL
-	}
-	return r1, nil
-}
-
-func setupDiCall(proc *windows.LazyProc, nargs, a1, a2, a3, a4, a5, a6 uintptr) syscall.Errno {
-	_ = nargs
-	r1, _, errno := syscall.SyscallN(proc.Addr(), a1, a2, a3, a4, a5, a6)
-	if r1 == 0 {
-		if errno != 0 {
-			return errno
-		}
-		return syscall.EINVAL
-	}
-	return 0
-}
-
-func readWinBatteryState(powerState uint32) uint8 {
-	switch {
-	case powerState&0x00000004 != 0:
-		return stateCharging
-	case powerState&0x00000008 != 0:
-		return stateEmpty
-	case powerState&0x00000002 != 0:
-		return stateDischarging
-	case powerState&0x00000001 != 0:
-		return stateFull
-	default:
-		return stateUnknown
-	}
-}
-
-func winBatteryGet(idx int) (Battery, error) {
-	hdev, err := setupDiSetup(
-		setupDiGetClassDevsW,
-		4,
-		uintptr(unsafe.Pointer(&guidDeviceBattery)),
-		0, 0,
-		2|16, // DIGCF_PRESENT|DIGCF_DEVICEINTERFACE
-		0, 0,
-	)
-	if err != nil {
-		return Battery{}, err
-	}
-	defer syscall.SyscallN(setupDiDestroyDeviceInfoList.Addr(), hdev)
-
-	var did spDeviceInterfaceData
-	did.cbSize = uint32(unsafe.Sizeof(did))
-	errno := setupDiCall(
-		setupDiEnumDeviceInterfaces,
-		5,
-		hdev, 0,
-		uintptr(unsafe.Pointer(&guidDeviceBattery)),
-		uintptr(idx),
-		uintptr(unsafe.Pointer(&did)),
-		0,
-	)
-	if errno == 259 { // ERROR_NO_MORE_ITEMS
-		return Battery{}, errNotFound
-	}
-	if errno != 0 {
-		return Battery{}, errno
-	}
-
-	var cbRequired uint32
-	errno = setupDiCall(
-		setupDiGetDeviceInterfaceDetailW,
-		6,
-		hdev,
-		uintptr(unsafe.Pointer(&did)),
-		0, 0,
-		uintptr(unsafe.Pointer(&cbRequired)),
-		0,
-	)
-	if errno != 0 && errno != 122 { // ERROR_INSUFFICIENT_BUFFER
-		return Battery{}, errno
-	}
-	didd := make([]uint16, cbRequired/2)
-	cbSize := (*uint32)(unsafe.Pointer(&didd[0]))
-	if unsafe.Sizeof(uint(0)) == 8 {
-		*cbSize = 8
-	} else {
-		*cbSize = 6
-	}
-	errno = setupDiCall(
-		setupDiGetDeviceInterfaceDetailW,
-		6,
-		hdev,
-		uintptr(unsafe.Pointer(&did)),
-		uintptr(unsafe.Pointer(&didd[0])),
-		uintptr(cbRequired),
-		uintptr(unsafe.Pointer(&cbRequired)),
-		0,
-	)
-	if errno != 0 {
-		return Battery{}, errno
-	}
-	devicePath := &didd[2:][0]
-
-	handle, err := windows.CreateFile(
-		devicePath,
-		windows.GENERIC_READ|windows.GENERIC_WRITE,
-		windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE,
-		nil,
-		windows.OPEN_EXISTING,
-		windows.FILE_ATTRIBUTE_NORMAL,
-		0,
-	)
-	if err != nil {
-		return Battery{}, err
-	}
-	defer windows.CloseHandle(handle)
-
-	var dwOut uint32
-	var dwWait uint32
-	var bqi batteryQueryInformation
-	err = windows.DeviceIoControl(
-		handle,
-		2703424, // IOCTL_BATTERY_QUERY_TAG
-		(*byte)(unsafe.Pointer(&dwWait)),
-		uint32(unsafe.Sizeof(dwWait)),
-		(*byte)(unsafe.Pointer(&bqi.BatteryTag)),
-		uint32(unsafe.Sizeof(bqi.BatteryTag)),
-		&dwOut, nil,
-	)
-	if err != nil || bqi.BatteryTag == 0 {
-		return Battery{}, errors.New("battery tag not returned")
-	}
-
-	var bi batteryInformation
-	if err = windows.DeviceIoControl(
-		handle,
-		2703428, // IOCTL_BATTERY_QUERY_INFORMATION
-		(*byte)(unsafe.Pointer(&bqi)),
-		uint32(unsafe.Sizeof(bqi)),
-		(*byte)(unsafe.Pointer(&bi)),
-		uint32(unsafe.Sizeof(bi)),
-		&dwOut, nil,
-	); err != nil {
-		return Battery{}, err
-	}
-
-	// BatteryDeviceName is optional, so retain the deterministic fallback on error.
-	name := ""
-	nameQuery := bqi
-	nameQuery.InformationLevel = 4 // BatteryDeviceName
-	nameBuffer := make([]uint16, 128)
-	if err := windows.DeviceIoControl(
-		handle, 2703428,
-		(*byte)(unsafe.Pointer(&nameQuery)), uint32(unsafe.Sizeof(nameQuery)),
-		(*byte)(unsafe.Pointer(&nameBuffer[0])), uint32(len(nameBuffer)*2),
-		&dwOut, nil,
-	); err == nil {
-		name = windows.UTF16ToString(nameBuffer)
-	}
-
-	bws := batteryWaitStatus{BatteryTag: bqi.BatteryTag}
-	var bs batteryStatus
-	if err = windows.DeviceIoControl(
-		handle,
-		2703436, // IOCTL_BATTERY_QUERY_STATUS
-		(*byte)(unsafe.Pointer(&bws)),
-		uint32(unsafe.Sizeof(bws)),
-		(*byte)(unsafe.Pointer(&bs)),
-		uint32(unsafe.Sizeof(bs)),
-		&dwOut, nil,
-	); err != nil {
-		return Battery{}, err
-	}
-
-	if bs.Capacity == 0xffffffff || bi.FullChargedCapacity == 0 || bi.FullChargedCapacity == 0xffffffff {
-		return Battery{}, errors.New("battery capacity unknown")
-	}
-	percent := min(float64(bs.Capacity)/float64(bi.FullChargedCapacity)*100, 100)
-	return Battery{Name: name, Percent: uint8(percent), State: readWinBatteryState(bs.PowerState),
-		FullChargeCapacity: uint64(bi.FullChargedCapacity), HasFullChargeCapacity: true, System: true}, nil
-}
-
-// HasReadableBattery checks if the system has a battery and returns true if it does.
-func HasReadableBattery() bool {
-	batteries, _ := GetBatteryStats()
-	return len(batteries) > 0
-}
-
-// GetBatteryStats returns every readable battery reported by Windows.
-func GetBatteryStats() ([]Battery, error) {
-	batteries := make([]Battery, 0, 2)
-	for i := 0; ; i++ {
-		battery, bErr := winBatteryGet(i)
-		if errors.Is(bErr, errNotFound) {
-			break
-		}
-		if bErr != nil {
-			continue
-		}
-		batteries = append(batteries, battery)
-	}
-	if len(batteries) == 0 {
-		return nil, errNoBatteries
-	}
-	return normalizeBatteries(batteries), nil
-}

agent/client.go

@@ -20,7 +20,6 @@ import (
 	"github.com/fxamacker/cbor/v2"
 	"github.com/lxzan/gws"
 	"golang.org/x/crypto/ssh"
-	"golang.org/x/net/proxy"
 )
 
 const (
@@ -53,8 +52,8 @@ func newWebSocketClient(agent *Agent) (client *WebSocketClient, err error) {
 	client = &WebSocketClient{}
 
 	client.hubURL, err = url.Parse(hubURLStr)
-	if err != nil || client.hubURL.Host == "" {
-		return nil, fmt.Errorf("invalid HUB_URL %q: must include scheme and host (e.g. http://hub.example.com:8090)", hubURLStr)
+	if err != nil {
+		return nil, errors.New("invalid hub URL")
 	}
 	// get registration token
 	client.token, err = getToken()
@@ -105,11 +104,6 @@ func (client *WebSocketClient) getOptions() *gws.ClientOption {
 	}
 	client.hubURL.Path = path.Join(client.hubURL.Path, "api/beszel/agent-connect")
 
-	// make sure BESZEL_AGENT_ALL_PROXY works (GWS only checks ALL_PROXY)
-	if val := os.Getenv("BESZEL_AGENT_ALL_PROXY"); val != "" {
-		os.Setenv("ALL_PROXY", val)
-	}
-
 	client.options = &gws.ClientOption{
 		Addr:      client.hubURL.String(),
 		TlsConfig: &tls.Config{InsecureSkipVerify: true},
@@ -118,9 +112,6 @@ func (client *WebSocketClient) getOptions() *gws.ClientOption {
 			"X-Token":    []string{client.token},
 			"X-Beszel":   []string{beszel.Version},
 		},
-		NewDialer: func() (gws.Dialer, error) {
-			return proxy.FromEnvironment(), nil
-		},
 	}
 	return client.options
 }

agent/client_test.go

@@ -51,18 +51,11 @@ func TestNewWebSocketClient(t *testing.T) {
 			errorMsg:    "HUB_URL environment variable not set",
 		},
 		{
-			name:        "malformed URL",
+			name:        "invalid URL",
 			hubURL:      "ht\ttp://invalid",
 			token:       "test-token",
 			expectError: true,
-			errorMsg:    "invalid HUB_URL",
-		},
-		{
-			name:        "URL without host",
-			hubURL:      "http:/api",
-			token:       "test-token",
-			expectError: true,
-			errorMsg:    "invalid HUB_URL",
+			errorMsg:    "invalid hub URL",
 		},
 		{
 			name:        "missing token",

agent/connection_manager.go

@@ -4,15 +4,11 @@ import (
 	"context"
 	"errors"
 	"log/slog"
-	"net"
-	"os"
 	"os/signal"
-	"strings"
 	"syscall"
 	"time"
 
 	"github.com/henrygd/beszel/agent/health"
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/system"
 )
 
@@ -115,36 +111,13 @@ func (c *ConnectionManager) Start(serverOptions ServerOptions) error {
 			_ = health.Update()
 		case <-sigCtx.Done():
 			slog.Info("Shutting down", "cause", context.Cause(sigCtx))
-			return c.stop()
+			_ = c.agent.StopServer()
+			c.closeWebSocket()
+			return health.CleanUp()
 		}
 	}
 }
 
-// stop does not stop the connection manager itself, just any active connections. The manager will attempt to reconnect after stopping, so this should only be called immediately before shutting down the entire agent.
-//
-// If we need or want to expose a graceful Stop method in the future, do something like this to actually stop the manager:
-//
-//	func (c *ConnectionManager) Start(serverOptions ServerOptions) error {
-//		ctx, cancel := context.WithCancel(context.Background())
-//		c.cancel = cancel
-//
-//		for {
-//			select {
-//			case <-ctx.Done():
-//				return c.stop()
-//			}
-//		}
-//	}
-//
-//	func (c *ConnectionManager) Stop() {
-//		c.cancel()
-//	}
-func (c *ConnectionManager) stop() error {
-	_ = c.agent.StopServer()
-	c.closeWebSocket()
-	return health.CleanUp()
-}
-
 // handleEvent processes connection events and updates the connection state accordingly.
 func (c *ConnectionManager) handleEvent(event ConnectionEvent) {
 	switch event {
@@ -212,16 +185,9 @@ func (c *ConnectionManager) connect() {
 
 	// Try WebSocket first, if it fails, start SSH server
 	err := c.startWebSocketConnection()
-	if err != nil {
-		if shouldExitOnErr(err) {
-			time.Sleep(2 * time.Second) // prevent tight restart loop
-			_ = c.stop()
-			os.Exit(1)
-		}
-		if c.State == Disconnected {
-			c.startSSHServer()
-			c.startWsTicker()
-		}
+	if err != nil && c.State == Disconnected {
+		c.startSSHServer()
+		c.startWsTicker()
 	}
 }
 
@@ -258,14 +224,3 @@ func (c *ConnectionManager) closeWebSocket() {
 		c.wsClient.Close()
 	}
 }
-
-// shouldExitOnErr checks if the error is a DNS resolution failure and if the
-// EXIT_ON_DNS_ERROR env var is set. https://github.com/henrygd/beszel/issues/1924.
-func shouldExitOnErr(err error) bool {
-	if val, _ := utils.GetEnv("EXIT_ON_DNS_ERROR"); val == "true" {
-		if opErr, ok := errors.AsType[*net.OpError](err); ok {
-			return strings.Contains(opErr.Err.Error(), "lookup")
-		}
-	}
-	return false
-}

agent/connection_manager_test.go

@@ -4,7 +4,6 @@ package agent
 
 import (
 	"crypto/ed25519"
-	"errors"
 	"fmt"
 	"net"
 	"net/url"
@@ -299,65 +298,3 @@ func TestConnectionManager_ConnectFlow(t *testing.T) {
 		cm.connect()
 	}, "Connect should not panic without WebSocket client")
 }
-
-func TestShouldExitOnErr(t *testing.T) {
-	createDialErr := func(msg string) error {
-		return &net.OpError{
-			Op:  "dial",
-			Net: "tcp",
-			Err: errors.New(msg),
-		}
-	}
-
-	tests := []struct {
-		name     string
-		err      error
-		envValue string
-		expected bool
-	}{
-		{
-			name:     "no env var",
-			err:      createDialErr("lookup lkahsdfasdf: no such host"),
-			envValue: "",
-			expected: false,
-		},
-		{
-			name:     "env var false",
-			err:      createDialErr("lookup lkahsdfasdf: no such host"),
-			envValue: "false",
-			expected: false,
-		},
-		{
-			name:     "env var true, matching error",
-			err:      createDialErr("lookup lkahsdfasdf: no such host"),
-			envValue: "true",
-			expected: true,
-		},
-		{
-			name:     "env var true, matching error with extra context",
-			err:      createDialErr("lookup beszel.server.lan on [::1]:53: read udp [::1]:44557->[::1]:53: read: connection refused"),
-			envValue: "true",
-			expected: true,
-		},
-		{
-			name:     "env var true, non-matching error",
-			err:      errors.New("connection refused"),
-			envValue: "true",
-			expected: false,
-		},
-		{
-			name:     "env var true, dial but not lookup",
-			err:      createDialErr("connection timeout"),
-			envValue: "true",
-			expected: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Setenv("EXIT_ON_DNS_ERROR", tt.envValue)
-			result := shouldExitOnErr(tt.err)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}

agent/disk.go

@@ -1,7 +1,6 @@
 package agent
 
 import (
-	"context"
 	"log/slog"
 	"os"
 	"path/filepath"
@@ -34,34 +33,6 @@ type diskDiscovery struct {
 	ctx            fsRegistrationContext
 }
 
-// prevDisk stores previous per-device disk counters for a given cache interval
-type prevDisk struct {
-	readBytes  uint64
-	writeBytes uint64
-	readTime   uint64 // cumulative ms spent on reads (from ReadTime)
-	writeTime  uint64 // cumulative ms spent on writes (from WriteTime)
-	ioTime     uint64 // cumulative ms spent doing I/O (from IoTime)
-	weightedIO uint64 // cumulative weighted ms (queue-depth × ms, from WeightedIO)
-	readCount  uint64 // cumulative read operation count
-	writeCount uint64 // cumulative write operation count
-	at         time.Time
-}
-
-// prevDiskFromCounter creates a prevDisk snapshot from a disk.IOCountersStat at time t.
-func prevDiskFromCounter(d disk.IOCountersStat, t time.Time) prevDisk {
-	return prevDisk{
-		readBytes:  d.ReadBytes,
-		writeBytes: d.WriteBytes,
-		readTime:   d.ReadTime,
-		writeTime:  d.WriteTime,
-		ioTime:     d.IoTime,
-		weightedIO: d.WeightedIO,
-		readCount:  d.ReadCount,
-		writeCount: d.WriteCount,
-		at:         t,
-	}
-}
-
 // parseFilesystemEntry parses a filesystem entry in the format "device__customname"
 // Returns the device/filesystem part and the custom name part
 func parseFilesystemEntry(entry string) (device, customName string) {
@@ -267,11 +238,9 @@ func (d *diskDiscovery) addConfiguredExtraFilesystems(extraFilesystems string) {
 
 // addPartitionExtraFs registers partitions mounted under /extra-filesystems so
 // their display names can come from the folder name while their I/O keys still
-// prefer the underlying partition device. Only direct children are matched to
-// avoid registering nested virtual mounts (e.g. /proc, /sys) that are returned by
-// disk.Partitions(true) when the host root is bind-mounted in /extra-filesystems.
+// prefer the underlying partition device.
 func (d *diskDiscovery) addPartitionExtraFs(p disk.PartitionStat) {
-	if filepath.Dir(p.Mountpoint) != d.ctx.efPath {
+	if !strings.HasPrefix(p.Mountpoint, d.ctx.efPath) {
 		return
 	}
 	device, customName := extraFilesystemPartitionInfo(p)
@@ -304,7 +273,7 @@ func (a *Agent) initializeDiskInfo() {
 	hasRoot := false
 	isWindows := runtime.GOOS == "windows"
 
-	partitions, err := disk.PartitionsWithContext(context.Background(), true)
+	partitions, err := disk.Partitions(false)
 	if err != nil {
 		slog.Error("Error getting disk partitions", "err", err)
 	}
@@ -609,29 +578,16 @@ func (a *Agent) updateDiskIo(cacheTimeMs uint16, systemStats *system.Stats) {
 			prev, hasPrev := a.diskPrev[cacheTimeMs][name]
 			if !hasPrev {
 				// Seed from agent-level fsStats if present, else seed from current
-				prev = prevDisk{
-					readBytes:  stats.TotalRead,
-					writeBytes: stats.TotalWrite,
-					readTime:   d.ReadTime,
-					writeTime:  d.WriteTime,
-					ioTime:     d.IoTime,
-					weightedIO: d.WeightedIO,
-					readCount:  d.ReadCount,
-					writeCount: d.WriteCount,
-					at:         stats.Time,
-				}
+				prev = prevDisk{readBytes: stats.TotalRead, writeBytes: stats.TotalWrite, at: stats.Time}
 				if prev.at.IsZero() {
-					prev = prevDiskFromCounter(d, now)
+					prev = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
 				}
 			}
 
 			msElapsed := uint64(now.Sub(prev.at).Milliseconds())
-
-			// Update per-interval snapshot
-			a.diskPrev[cacheTimeMs][name] = prevDiskFromCounter(d, now)
-
-			// Avoid division by zero or clock issues
 			if msElapsed < 100 {
+				// Avoid division by zero or clock issues; update snapshot and continue
+				a.diskPrev[cacheTimeMs][name] = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
 				continue
 			}
 
@@ -643,38 +599,15 @@ func (a *Agent) updateDiskIo(cacheTimeMs uint16, systemStats *system.Stats) {
 			// validate values
 			if readMbPerSecond > 50_000 || writeMbPerSecond > 50_000 {
 				slog.Warn("Invalid disk I/O. Resetting.", "name", d.Name, "read", readMbPerSecond, "write", writeMbPerSecond)
+				// Reset interval snapshot and seed from current
+				a.diskPrev[cacheTimeMs][name] = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
 				// also refresh agent baseline to avoid future negatives
 				a.initializeDiskIoStats(ioCounters)
 				continue
 			}
 
-			// These properties are calculated differently on different platforms,
-			// but generally represent cumulative time spent doing reads/writes on the device.
-			// This can surpass 100% if there are multiple concurrent I/O operations.
-			// Linux kernel docs:
-			// This is the total number of milliseconds spent by all reads (as
-			// measured from __make_request() to end_that_request_last()).
-			// https://www.kernel.org/doc/Documentation/iostats.txt (fields 4, 8)
-			diskReadTime := utils.TwoDecimals(float64(d.ReadTime-prev.readTime) / float64(msElapsed) * 100)
-			diskWriteTime := utils.TwoDecimals(float64(d.WriteTime-prev.writeTime) / float64(msElapsed) * 100)
-
-			// I/O utilization %: fraction of wall time the device had any I/O in progress (0-100).
-			diskIoUtilPct := utils.TwoDecimals(float64(d.IoTime-prev.ioTime) / float64(msElapsed) * 100)
-
-			// Weighted I/O: queue-depth weighted I/O time, normalized to interval (can exceed 100%).
-			// Linux kernel field 11: incremented by iops_in_progress × ms_since_last_update.
-			// Used to display queue depth. Multipled by 100 to increase accuracy of digit truncation (divided by 100 in UI).
-			diskWeightedIO := utils.TwoDecimals(float64(d.WeightedIO-prev.weightedIO) / float64(msElapsed) * 100)
-
-			// r_await / w_await: average time per read/write operation in milliseconds.
-			// Equivalent to r_await and w_await in iostat.
-			var rAwait, wAwait float64
-			if deltaReadCount := d.ReadCount - prev.readCount; deltaReadCount > 0 {
-				rAwait = utils.TwoDecimals(float64(d.ReadTime-prev.readTime) / float64(deltaReadCount))
-			}
-			if deltaWriteCount := d.WriteCount - prev.writeCount; deltaWriteCount > 0 {
-				wAwait = utils.TwoDecimals(float64(d.WriteTime-prev.writeTime) / float64(deltaWriteCount))
-			}
+			// Update per-interval snapshot
+			a.diskPrev[cacheTimeMs][name] = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
 
 			// Update global fsStats baseline for cross-interval correctness
 			stats.Time = now
@@ -684,40 +617,20 @@ func (a *Agent) updateDiskIo(cacheTimeMs uint16, systemStats *system.Stats) {
 			stats.DiskWritePs = writeMbPerSecond
 			stats.DiskReadBytes = diskIORead
 			stats.DiskWriteBytes = diskIOWrite
-			stats.DiskIoStats[0] = diskReadTime
-			stats.DiskIoStats[1] = diskWriteTime
-			stats.DiskIoStats[2] = diskIoUtilPct
-			stats.DiskIoStats[3] = rAwait
-			stats.DiskIoStats[4] = wAwait
-			stats.DiskIoStats[5] = diskWeightedIO
 
 			if stats.Root {
 				systemStats.DiskReadPs = stats.DiskReadPs
 				systemStats.DiskWritePs = stats.DiskWritePs
 				systemStats.DiskIO[0] = diskIORead
 				systemStats.DiskIO[1] = diskIOWrite
-				systemStats.DiskIoStats[0] = diskReadTime
-				systemStats.DiskIoStats[1] = diskWriteTime
-				systemStats.DiskIoStats[2] = diskIoUtilPct
-				systemStats.DiskIoStats[3] = rAwait
-				systemStats.DiskIoStats[4] = wAwait
-				systemStats.DiskIoStats[5] = diskWeightedIO
 			}
 		}
 	}
 }
 
-// getRootMountPoint returns the appropriate root mount point for the system.
-// On Windows it returns the system drive (e.g. "C:").
+// getRootMountPoint returns the appropriate root mount point for the system
 // For immutable systems like Fedora Silverblue, it returns /sysroot instead of /
 func (a *Agent) getRootMountPoint() string {
-	if runtime.GOOS == "windows" {
-		if sd := os.Getenv("SystemDrive"); sd != "" {
-			return sd
-		}
-		return "C:"
-	}
-
 	// 1. Check if /etc/os-release contains indicators of an immutable system
 	if osReleaseContent, err := os.ReadFile("/etc/os-release"); err == nil {
 		content := string(osReleaseContent)

agent/disk_test.go

@@ -530,87 +530,6 @@ func TestAddExtraFilesystemFolders(t *testing.T) {
 	})
 }
 
-func TestAddPartitionExtraFs(t *testing.T) {
-	makeDiscovery := func(agent *Agent) diskDiscovery {
-		return diskDiscovery{
-			agent: agent,
-			ctx: fsRegistrationContext{
-				isWindows: false,
-				efPath:    "/extra-filesystems",
-				diskIoCounters: map[string]disk.IOCountersStat{
-					"nvme0n1p1": {Name: "nvme0n1p1"},
-					"nvme1n1":   {Name: "nvme1n1"},
-				},
-			},
-		}
-	}
-
-	t.Run("registers direct child of extra-filesystems", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		d := makeDiscovery(agent)
-
-		d.addPartitionExtraFs(disk.PartitionStat{
-			Device:     "/dev/nvme0n1p1",
-			Mountpoint: "/extra-filesystems/nvme0n1p1__caddy1-root",
-		})
-
-		stats, exists := agent.fsStats["nvme0n1p1"]
-		assert.True(t, exists)
-		assert.Equal(t, "/extra-filesystems/nvme0n1p1__caddy1-root", stats.Mountpoint)
-		assert.Equal(t, "caddy1-root", stats.Name)
-	})
-
-	t.Run("skips nested mount under extra-filesystem bind mount", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		d := makeDiscovery(agent)
-
-		// These simulate the virtual mounts that appear when host / is bind-mounted
-		// with disk.Partitions(all=true) — e.g. /proc, /sys, /dev visible under the mount.
-		for _, nested := range []string{
-			"/extra-filesystems/nvme0n1p1__caddy1-root/proc",
-			"/extra-filesystems/nvme0n1p1__caddy1-root/sys",
-			"/extra-filesystems/nvme0n1p1__caddy1-root/dev",
-			"/extra-filesystems/nvme0n1p1__caddy1-root/run",
-		} {
-			d.addPartitionExtraFs(disk.PartitionStat{Device: "tmpfs", Mountpoint: nested})
-		}
-
-		assert.Empty(t, agent.fsStats)
-	})
-
-	t.Run("registers both direct children, skips their nested mounts", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		d := makeDiscovery(agent)
-
-		partitions := []disk.PartitionStat{
-			{Device: "/dev/nvme0n1p1", Mountpoint: "/extra-filesystems/nvme0n1p1__caddy1-root"},
-			{Device: "/dev/nvme1n1", Mountpoint: "/extra-filesystems/nvme1n1__caddy1-docker"},
-			{Device: "proc", Mountpoint: "/extra-filesystems/nvme0n1p1__caddy1-root/proc"},
-			{Device: "sysfs", Mountpoint: "/extra-filesystems/nvme0n1p1__caddy1-root/sys"},
-			{Device: "overlay", Mountpoint: "/extra-filesystems/nvme0n1p1__caddy1-root/var/lib/docker"},
-		}
-		for _, p := range partitions {
-			d.addPartitionExtraFs(p)
-		}
-
-		assert.Len(t, agent.fsStats, 2)
-		assert.Equal(t, "caddy1-root", agent.fsStats["nvme0n1p1"].Name)
-		assert.Equal(t, "caddy1-docker", agent.fsStats["nvme1n1"].Name)
-	})
-
-	t.Run("skips partition not under extra-filesystems", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		d := makeDiscovery(agent)
-
-		d.addPartitionExtraFs(disk.PartitionStat{
-			Device:     "/dev/nvme0n1p1",
-			Mountpoint: "/",
-		})
-
-		assert.Empty(t, agent.fsStats)
-	})
-}
-
 func TestFindIoDevice(t *testing.T) {
 	t.Run("matches by device name", func(t *testing.T) {
 		ioCounters := map[string]disk.IOCountersStat{

agent/docker.go

@@ -25,7 +25,6 @@ import (
 	"github.com/henrygd/beszel/agent/deltatracker"
 	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/container"
-	"github.com/henrygd/beszel/internal/entities/system"
 
 	"github.com/blang/semver"
 )
@@ -53,21 +52,20 @@ const (
 )
 
 type dockerManager struct {
-	agent                *Agent                      // Used to propagate system detail changes back to the agent
-	client               *http.Client                // Client to query Docker API
-	wg                   sync.WaitGroup              // WaitGroup to wait for all goroutines to finish
-	sem                  chan struct{}               // Semaphore to limit concurrent container requests
-	containerStatsMutex  sync.RWMutex                // Mutex to prevent concurrent access to containerStatsMap
-	apiContainerList     []*container.ApiInfo        // List of containers from Docker API
-	containerStatsMap    map[string]*container.Stats // Keeps track of container stats
-	validIds             map[string]struct{}         // Map of valid container ids, used to prune invalid containers from containerStatsMap
-	goodDockerVersion    bool                        // Whether docker version is at least 25.0.0 (one-shot works correctly)
-	dockerVersionChecked bool                        // Whether a version probe has completed successfully
-	isWindows            bool                        // Whether the Docker Engine API is running on Windows
-	buf                  *bytes.Buffer               // Buffer to store and read response bodies
-	apiStats             *container.ApiStats         // Reusable API stats object
-	excludeContainers    []string                    // Patterns to exclude containers by name
-	usingPodman          bool                        // Whether the Docker Engine API is running on Podman
+	client              *http.Client                // Client to query Docker API
+	wg                  sync.WaitGroup              // WaitGroup to wait for all goroutines to finish
+	sem                 chan struct{}               // Semaphore to limit concurrent container requests
+	containerStatsMutex sync.RWMutex                // Mutex to prevent concurrent access to containerStatsMap
+	apiContainerList    []*container.ApiInfo        // List of containers from Docker API
+	containerStatsMap   map[string]*container.Stats // Keeps track of container stats
+	validIds            map[string]struct{}         // Map of valid container ids, used to prune invalid containers from containerStatsMap
+	goodDockerVersion   bool                        // Whether docker version is at least 25.0.0 (one-shot works correctly)
+	isWindows           bool                        // Whether the Docker Engine API is running on Windows
+	buf                 *bytes.Buffer               // Buffer to store and read response bodies
+	decoder             *json.Decoder               // Reusable JSON decoder that reads from buf
+	apiStats            *container.ApiStats         // Reusable API stats object
+	excludeContainers   []string                    // Patterns to exclude containers by name
+	usingPodman         bool                        // Whether the Docker Engine API is running on Podman
 
 	// Cache-time-aware tracking for CPU stats (similar to cpu.go)
 	// Maps cache time intervals to container-specific CPU usage tracking
@@ -80,6 +78,7 @@ type dockerManager struct {
 	networkSentTrackers map[uint16]*deltatracker.DeltaTracker[string, uint64]
 	networkRecvTrackers map[uint16]*deltatracker.DeltaTracker[string, uint64]
 	lastNetworkReadTime map[uint16]map[string]time.Time // cacheTimeMs -> containerId -> last network read time
+	retrySleep          func(time.Duration)
 }
 
 // userAgentRoundTripper is a custom http.RoundTripper that adds a User-Agent header to all requests
@@ -88,14 +87,6 @@ type userAgentRoundTripper struct {
 	userAgent string
 }
 
-// dockerVersionResponse contains the /version fields used for engine checks.
-type dockerVersionResponse struct {
-	Version    string `json:"Version"`
-	Components []struct {
-		Name string `json:"Name"`
-	} `json:"Components"`
-}
-
 // RoundTrip implements the http.RoundTripper interface
 func (u *userAgentRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 	req.Header.Set("User-Agent", u.userAgent)
@@ -143,14 +134,7 @@ func (dm *dockerManager) getDockerStats(cacheTimeMs uint16) ([]*container.Stats,
 		return nil, err
 	}
 
-	// Detect Podman and Windows from Server header
-	serverHeader := resp.Header.Get("Server")
-	if !dm.usingPodman && detectPodmanFromHeader(serverHeader) {
-		dm.setIsPodman()
-	}
-	dm.isWindows = strings.Contains(serverHeader, "windows")
-
-	dm.ensureDockerVersionChecked()
+	dm.isWindows = strings.Contains(resp.Header.Get("Server"), "windows")
 
 	containersLength := len(dm.apiContainerList)
 
@@ -373,26 +357,16 @@ func convertContainerPortsToString(ctr *container.ApiInfo) string {
 		return ""
 	}
 	sort.Slice(ctr.Ports, func(i, j int) bool {
-		if ctr.Ports[i].PublicPort != ctr.Ports[j].PublicPort {
-			return ctr.Ports[i].PublicPort < ctr.Ports[j].PublicPort
-		}
-		return ctr.Ports[i].IP < ctr.Ports[j].IP
+		return ctr.Ports[i].PublicPort < ctr.Ports[j].PublicPort
 	})
 	var builder strings.Builder
-	seen := make(map[string]struct{})
+	seenPorts := make(map[uint16]struct{})
 	for _, p := range ctr.Ports {
-		if p.PublicPort == 0 {
+		_, ok := seenPorts[p.PublicPort]
+		if p.PublicPort == 0 || ok {
 			continue
 		}
-		keyIP := p.IP
-		if keyIP == "0.0.0.0" || keyIP == "::" {
-			keyIP = ""
-		}
-		key := keyIP + ":" + strconv.Itoa(int(p.PublicPort))
-		if _, ok := seen[key]; ok {
-			continue
-		}
-		seen[key] = struct{}{}
+		seenPorts[p.PublicPort] = struct{}{}
 		if builder.Len() > 0 {
 			builder.WriteString(", ")
 		}
@@ -614,7 +588,7 @@ func (dm *dockerManager) deleteContainerStatsSync(id string) {
 }
 
 // Creates a new http client for Docker or Podman API
-func newDockerManager(agent *Agent) *dockerManager {
+func newDockerManager() *dockerManager {
 	dockerHost, exists := utils.GetEnv("DOCKER_HOST")
 	if exists {
 		// return nil if set to empty string
@@ -680,7 +654,6 @@ func newDockerManager(agent *Agent) *dockerManager {
 	}
 
 	manager := &dockerManager{
-		agent: agent,
 		client: &http.Client{
 			Timeout:   timeout,
 			Transport: userAgentTransport,
@@ -698,54 +671,51 @@ func newDockerManager(agent *Agent) *dockerManager {
 		networkSentTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
 		networkRecvTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
 		lastNetworkReadTime: make(map[uint16]map[string]time.Time),
+		retrySleep:          time.Sleep,
 	}
 
-	// Best-effort startup probe. If the engine is not ready yet, getDockerStats will
-	// retry after the first successful /containers/json request.
-	_, _ = manager.checkDockerVersion()
+	// If using podman, return client
+	if strings.Contains(dockerHost, "podman") {
+		manager.usingPodman = true
+		manager.goodDockerVersion = true
+		return manager
+	}
+
+	// run version check in goroutine to avoid blocking (server may not be ready and requires retries)
+	go manager.checkDockerVersion()
+
+	// give version check a chance to complete before returning
+	time.Sleep(50 * time.Millisecond)
 
 	return manager
 }
 
 // checkDockerVersion checks Docker version and sets goodDockerVersion if at least 25.0.0.
 // Versions before 25.0.0 have a bug with one-shot which requires all requests to be made in one batch.
-func (dm *dockerManager) checkDockerVersion() (bool, error) {
-	resp, err := dm.client.Get("http://localhost/version")
-	if err != nil {
-		return false, err
+func (dm *dockerManager) checkDockerVersion() {
+	var err error
+	var resp *http.Response
+	var versionInfo struct {
+		Version string `json:"Version"`
 	}
-	if resp.StatusCode != http.StatusOK {
-		status := resp.Status
-		resp.Body.Close()
-		return false, fmt.Errorf("docker version request failed: %s", status)
+	const versionMaxTries = 2
+	for i := 1; i <= versionMaxTries; i++ {
+		resp, err = dm.client.Get("http://localhost/version")
+		if err == nil && resp.StatusCode == http.StatusOK {
+			break
+		}
+		if resp != nil {
+			resp.Body.Close()
+		}
+		if i < versionMaxTries {
+			slog.Debug("Failed to get Docker version; retrying", "attempt", i, "err", err, "response", resp)
+			dm.retrySleep(5 * time.Second)
+		}
 	}
-
-	var versionInfo dockerVersionResponse
-	serverHeader := resp.Header.Get("Server")
-	if err := dm.decode(resp, &versionInfo); err != nil {
-		return false, err
-	}
-
-	dm.applyDockerVersionInfo(serverHeader, &versionInfo)
-	dm.dockerVersionChecked = true
-	return true, nil
-}
-
-// ensureDockerVersionChecked retries the version probe after a successful
-// container list request.
-func (dm *dockerManager) ensureDockerVersionChecked() {
-	if dm.dockerVersionChecked {
+	if err != nil || resp.StatusCode != http.StatusOK {
 		return
 	}
-	if _, err := dm.checkDockerVersion(); err != nil {
-		slog.Debug("Failed to get Docker version", "err", err)
-	}
-}
-
-// applyDockerVersionInfo updates version-dependent behavior from engine metadata.
-func (dm *dockerManager) applyDockerVersionInfo(serverHeader string, versionInfo *dockerVersionResponse) {
-	if detectPodmanEngine(serverHeader, versionInfo) {
-		dm.setIsPodman()
+	if err := dm.decode(resp, &versionInfo); err != nil {
 		return
 	}
 	// if version > 24, one-shot works correctly and we can limit concurrent operations
@@ -756,18 +726,20 @@ func (dm *dockerManager) applyDockerVersionInfo(serverHeader string, versionInfo
 	}
 }
 
-// Decodes a Docker API JSON response using a reusable buffer. Not thread safe.
+// Decodes Docker API JSON response using a reusable buffer and decoder. Not thread safe.
 func (dm *dockerManager) decode(resp *http.Response, d any) error {
 	if dm.buf == nil {
 		// initialize buffer with 256kb starting size
 		dm.buf = bytes.NewBuffer(make([]byte, 0, 1024*256))
+		dm.decoder = json.NewDecoder(dm.buf)
 	}
 	defer resp.Body.Close()
 	defer dm.buf.Reset()
-	if _, err := dm.buf.ReadFrom(resp.Body); err != nil {
+	_, err := dm.buf.ReadFrom(resp.Body)
+	if err != nil {
 		return err
 	}
-	return json.Unmarshal(dm.buf.Bytes(), d)
+	return dm.decoder.Decode(d)
 }
 
 // Test docker / podman sockets and return if one exists
@@ -969,46 +941,3 @@ func (dm *dockerManager) GetHostInfo() (info container.HostInfo, err error) {
 func (dm *dockerManager) IsPodman() bool {
 	return dm.usingPodman
 }
-
-// setIsPodman sets the manager to Podman mode and updates system details accordingly.
-func (dm *dockerManager) setIsPodman() {
-	if dm.usingPodman {
-		return
-	}
-	dm.usingPodman = true
-	dm.goodDockerVersion = true
-	dm.dockerVersionChecked = true
-	// keep system details updated - this may be detected late if server isn't ready when
-	// agent starts, so make sure we notify the hub if this happens later.
-	if dm.agent != nil {
-		dm.agent.updateSystemDetails(func(details *system.Details) {
-			details.Podman = true
-		})
-	}
-}
-
-// detectPodmanFromHeader identifies Podman from the Docker API server header.
-func detectPodmanFromHeader(server string) bool {
-	return strings.HasPrefix(server, "Libpod")
-}
-
-// detectPodmanFromVersion identifies Podman from the version payload.
-func detectPodmanFromVersion(versionInfo *dockerVersionResponse) bool {
-	if versionInfo == nil {
-		return false
-	}
-	for _, component := range versionInfo.Components {
-		if strings.HasPrefix(component.Name, "Podman") {
-			return true
-		}
-	}
-	return false
-}
-
-// detectPodmanEngine checks both header and version metadata for Podman.
-func detectPodmanEngine(serverHeader string, versionInfo *dockerVersionResponse) bool {
-	if detectPodmanFromHeader(serverHeader) {
-		return true
-	}
-	return detectPodmanFromVersion(versionInfo)
-}

agent/docker_test.go

@@ -539,53 +539,59 @@ func TestDockerManagerCreation(t *testing.T) {
 
 func TestCheckDockerVersion(t *testing.T) {
 	tests := []struct {
-		name            string
-		statusCode      int
-		body            string
-		server          string
-		expectSuccess   bool
-		expectedGood    bool
-		expectedPodman  bool
-		expectError     bool
-		expectedRequest string
+		name      string
+		responses []struct {
+			statusCode int
+			body       string
+		}
+		expectedGood     bool
+		expectedRequests int
 	}{
 		{
-			name:            "good docker version",
-			statusCode:      http.StatusOK,
-			body:            `{"Version":"25.0.1"}`,
-			expectSuccess:   true,
-			expectedGood:    true,
-			expectedPodman:  false,
-			expectedRequest: "/version",
+			name: "200 with good version on first try",
+			responses: []struct {
+				statusCode int
+				body       string
+			}{
+				{http.StatusOK, `{"Version":"25.0.1"}`},
+			},
+			expectedGood:     true,
+			expectedRequests: 1,
 		},
 		{
-			name:            "old docker version",
-			statusCode:      http.StatusOK,
-			body:            `{"Version":"24.0.7"}`,
-			expectSuccess:   true,
-			expectedGood:    false,
-			expectedPodman:  false,
-			expectedRequest: "/version",
+			name: "200 with old version on first try",
+			responses: []struct {
+				statusCode int
+				body       string
+			}{
+				{http.StatusOK, `{"Version":"24.0.7"}`},
+			},
+			expectedGood:     false,
+			expectedRequests: 1,
 		},
 		{
-			name:            "podman from server header",
-			statusCode:      http.StatusOK,
-			body:            `{"Version":"5.5.0"}`,
-			server:          "Libpod/5.5.0",
-			expectSuccess:   true,
-			expectedGood:    true,
-			expectedPodman:  true,
-			expectedRequest: "/version",
+			name: "non-200 then 200 with good version",
+			responses: []struct {
+				statusCode int
+				body       string
+			}{
+				{http.StatusServiceUnavailable, `"not ready"`},
+				{http.StatusOK, `{"Version":"25.1.0"}`},
+			},
+			expectedGood:     true,
+			expectedRequests: 2,
 		},
 		{
-			name:            "non-200 response",
-			statusCode:      http.StatusServiceUnavailable,
-			body:            `"not ready"`,
-			expectSuccess:   false,
-			expectedGood:    false,
-			expectedPodman:  false,
-			expectError:     true,
-			expectedRequest: "/version",
+			name: "non-200 on all retries",
+			responses: []struct {
+				statusCode int
+				body       string
+			}{
+				{http.StatusInternalServerError, `"error"`},
+				{http.StatusUnauthorized, `"error"`},
+			},
+			expectedGood:     false,
+			expectedRequests: 2,
 		},
 	}
 
@@ -593,13 +599,13 @@ func TestCheckDockerVersion(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			requestCount := 0
 			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				idx := requestCount
 				requestCount++
-				assert.Equal(t, tt.expectedRequest, r.URL.EscapedPath())
-				if tt.server != "" {
-					w.Header().Set("Server", tt.server)
+				if idx >= len(tt.responses) {
+					idx = len(tt.responses) - 1
 				}
-				w.WriteHeader(tt.statusCode)
-				fmt.Fprint(w, tt.body)
+				w.WriteHeader(tt.responses[idx].statusCode)
+				fmt.Fprint(w, tt.responses[idx].body)
 			}))
 			defer server.Close()
 
@@ -611,24 +617,17 @@ func TestCheckDockerVersion(t *testing.T) {
 						},
 					},
 				},
+				retrySleep: func(time.Duration) {},
 			}
 
-			success, err := dm.checkDockerVersion()
+			dm.checkDockerVersion()
 
-			assert.Equal(t, tt.expectSuccess, success)
-			assert.Equal(t, tt.expectSuccess, dm.dockerVersionChecked)
 			assert.Equal(t, tt.expectedGood, dm.goodDockerVersion)
-			assert.Equal(t, tt.expectedPodman, dm.usingPodman)
-			assert.Equal(t, 1, requestCount)
-			if tt.expectError {
-				require.Error(t, err)
-			} else {
-				require.NoError(t, err)
-			}
+			assert.Equal(t, tt.expectedRequests, requestCount)
 		})
 	}
 
-	t.Run("request error", func(t *testing.T) {
+	t.Run("request error on all retries", func(t *testing.T) {
 		requestCount := 0
 		dm := &dockerManager{
 			client: &http.Client{
@@ -639,189 +638,16 @@ func TestCheckDockerVersion(t *testing.T) {
 					},
 				},
 			},
+			retrySleep: func(time.Duration) {},
 		}
 
-		success, err := dm.checkDockerVersion()
+		dm.checkDockerVersion()
 
-		assert.False(t, success)
-		require.Error(t, err)
-		assert.False(t, dm.dockerVersionChecked)
 		assert.False(t, dm.goodDockerVersion)
-		assert.False(t, dm.usingPodman)
-		assert.Equal(t, 1, requestCount)
+		assert.Equal(t, 2, requestCount)
 	})
 }
 
-// newDockerManagerForVersionTest creates a dockerManager wired to a test server.
-func newDockerManagerForVersionTest(server *httptest.Server) *dockerManager {
-	return &dockerManager{
-		client: &http.Client{
-			Transport: &http.Transport{
-				DialContext: func(_ context.Context, network, _ string) (net.Conn, error) {
-					return net.Dial(network, server.Listener.Addr().String())
-				},
-			},
-		},
-		containerStatsMap:   make(map[string]*container.Stats),
-		lastCpuContainer:    make(map[uint16]map[string]uint64),
-		lastCpuSystem:       make(map[uint16]map[string]uint64),
-		lastCpuReadTime:     make(map[uint16]map[string]time.Time),
-		networkSentTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
-		networkRecvTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
-		lastNetworkReadTime: make(map[uint16]map[string]time.Time),
-	}
-}
-
-func TestGetDockerStatsChecksDockerVersionAfterContainerList(t *testing.T) {
-	tests := []struct {
-		name            string
-		containerServer string
-		versionServer   string
-		versionBody     string
-		expectedGood    bool
-		expectedPodman  bool
-	}{
-		{
-			name:           "200 with good version on first try",
-			versionBody:    `{"Version":"25.0.1"}`,
-			expectedGood:   true,
-			expectedPodman: false,
-		},
-		{
-			name:           "200 with old version on first try",
-			versionBody:    `{"Version":"24.0.7"}`,
-			expectedGood:   false,
-			expectedPodman: false,
-		},
-		{
-			name:            "podman detected from server header",
-			containerServer: "Libpod/5.5.0",
-			expectedGood:    true,
-			expectedPodman:  true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			requestCounts := map[string]int{}
-			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				requestCounts[r.URL.EscapedPath()]++
-				switch r.URL.EscapedPath() {
-				case "/containers/json":
-					if tt.containerServer != "" {
-						w.Header().Set("Server", tt.containerServer)
-					}
-					w.WriteHeader(http.StatusOK)
-					fmt.Fprint(w, `[]`)
-				case "/version":
-					if tt.versionServer != "" {
-						w.Header().Set("Server", tt.versionServer)
-					}
-					w.WriteHeader(http.StatusOK)
-					fmt.Fprint(w, tt.versionBody)
-				default:
-					t.Fatalf("unexpected path: %s", r.URL.EscapedPath())
-				}
-			}))
-			defer server.Close()
-
-			dm := newDockerManagerForVersionTest(server)
-
-			stats, err := dm.getDockerStats(defaultCacheTimeMs)
-			require.NoError(t, err)
-			assert.Empty(t, stats)
-			assert.True(t, dm.dockerVersionChecked)
-			assert.Equal(t, tt.expectedGood, dm.goodDockerVersion)
-			assert.Equal(t, tt.expectedPodman, dm.usingPodman)
-			assert.Equal(t, 1, requestCounts["/containers/json"])
-			if tt.expectedPodman {
-				assert.Equal(t, 0, requestCounts["/version"])
-			} else {
-				assert.Equal(t, 1, requestCounts["/version"])
-			}
-
-			stats, err = dm.getDockerStats(defaultCacheTimeMs)
-			require.NoError(t, err)
-			assert.Empty(t, stats)
-			assert.Equal(t, tt.expectedGood, dm.goodDockerVersion)
-			assert.Equal(t, tt.expectedPodman, dm.usingPodman)
-			assert.Equal(t, 2, requestCounts["/containers/json"])
-			if tt.expectedPodman {
-				assert.Equal(t, 0, requestCounts["/version"])
-			} else {
-				assert.Equal(t, 1, requestCounts["/version"])
-			}
-		})
-	}
-
-}
-
-func TestGetDockerStatsRetriesVersionCheckUntilSuccess(t *testing.T) {
-	requestCounts := map[string]int{}
-	versionStatuses := []int{http.StatusServiceUnavailable, http.StatusOK}
-	versionBodies := []string{`"not ready"`, `{"Version":"25.1.0"}`}
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		requestCounts[r.URL.EscapedPath()]++
-		switch r.URL.EscapedPath() {
-		case "/containers/json":
-			w.WriteHeader(http.StatusOK)
-			fmt.Fprint(w, `[]`)
-		case "/version":
-			idx := requestCounts["/version"] - 1
-			if idx >= len(versionStatuses) {
-				idx = len(versionStatuses) - 1
-			}
-			w.WriteHeader(versionStatuses[idx])
-			fmt.Fprint(w, versionBodies[idx])
-		default:
-			t.Fatalf("unexpected path: %s", r.URL.EscapedPath())
-		}
-	}))
-	defer server.Close()
-
-	dm := newDockerManagerForVersionTest(server)
-
-	stats, err := dm.getDockerStats(defaultCacheTimeMs)
-	require.NoError(t, err)
-	assert.Empty(t, stats)
-	assert.False(t, dm.dockerVersionChecked)
-	assert.False(t, dm.goodDockerVersion)
-	assert.Equal(t, 1, requestCounts["/version"])
-
-	stats, err = dm.getDockerStats(defaultCacheTimeMs)
-	require.NoError(t, err)
-	assert.Empty(t, stats)
-	assert.True(t, dm.dockerVersionChecked)
-	assert.True(t, dm.goodDockerVersion)
-	assert.Equal(t, 2, requestCounts["/containers/json"])
-	assert.Equal(t, 2, requestCounts["/version"])
-
-	stats, err = dm.getDockerStats(defaultCacheTimeMs)
-	require.NoError(t, err)
-	assert.Empty(t, stats)
-	assert.Equal(t, 3, requestCounts["/containers/json"])
-	assert.Equal(t, 2, requestCounts["/version"])
-}
-
-// A failed decode must not break later decodes. Previously the reused json.Decoder
-// stayed desynced after one truncated response, breaking decode until restart.
-func TestDecodeRecoversFromError(t *testing.T) {
-	dm := &dockerManager{}
-
-	// truncated JSON: body reads fine, decode fails
-	var bad []container.ApiInfo
-	err := dm.decode(&http.Response{Body: io.NopCloser(strings.NewReader(`[{"Id":"abc`))}, &bad)
-	require.Error(t, err)
-
-	// the next decode must still succeed
-	var good []container.ApiInfo
-	err = dm.decode(&http.Response{Body: io.NopCloser(strings.NewReader(`[{"Id":"abcdef012345","Names":["/ok"]}]`))}, &good)
-	require.NoError(t, err)
-	require.Len(t, good, 1)
-	assert.Equal(t, "abcdef012345", good[0].Id)
-}
-
 func TestCycleCpuDeltas(t *testing.T) {
 	dm := &dockerManager{
 		lastCpuContainer: map[uint16]map[string]uint64{
@@ -1021,44 +847,6 @@ func TestCpuPercentageCalculationWithRealData(t *testing.T) {
 	assert.InDelta(t, expectedPct, actualPct, 0.01)
 }
 
-func TestCpuPercentageHandlesCounterRollback(t *testing.T) {
-	// If a stats response is processed after a newer one for the same container,
-	// or an accounting counter resets, the current total can be lower than the
-	// stored previous value. Unsigned subtraction wraps to ~2^64 instead of
-	// going negative, so the percentage explodes, validateCpuPercentage rejects
-	// the sample, and the whole collection is discarded - network stats too.
-	stats := &container.ApiStats{
-		CPUStats: container.CPUStats{
-			CPUUsage:    container.CPUUsage{TotalUsage: 1_000_000},
-			SystemUsage: 20_000_000,
-		},
-	}
-
-	// Container counter went backwards.
-	assert.Equal(t, 0.0, stats.CalculateCpuPercentLinux(2_000_000, 10_000_000))
-	// System counter went backwards.
-	assert.Equal(t, 0.0, stats.CalculateCpuPercentLinux(500_000, 30_000_000))
-	// A normal forward sample is unaffected: 500000 / 10000000 * 100 = 5%.
-	assert.InDelta(t, 5.0, stats.CalculateCpuPercentLinux(500_000, 10_000_000), 0.001)
-}
-
-func TestCpuPercentageWindowsHandlesCounterRollback(t *testing.T) {
-	now := time.Now()
-	stats := &container.ApiStats{
-		Read:     now,
-		NumProcs: 4,
-		CPUStats: container.CPUStats{
-			CPUUsage: container.CPUUsage{TotalUsage: 1_000_000},
-		},
-	}
-	prevRead := now.Add(-time.Second)
-
-	// Container counter went backwards.
-	assert.Equal(t, 0.0, stats.CalculateCpuPercentWindows(2_000_000, prevRead))
-	// A normal forward sample is unaffected.
-	assert.Greater(t, stats.CalculateCpuPercentWindows(500_000, prevRead), 0.0)
-}
-
 func TestNetworkStatsCalculationWithRealData(t *testing.T) {
 	// Create synthetic test data to avoid timing issues
 	apiStats1 := &container.ApiStats{
@@ -1920,14 +1708,6 @@ func TestConvertContainerPortsToString(t *testing.T) {
 			},
 			expected: "80, 443",
 		},
-		{
-			name: "ipv4 and ipv6 wildcard bindings are deduplicated",
-			ports: []port{
-				{PublicPort: 80, IP: "0.0.0.0"},
-				{PublicPort: 80, IP: "::"},
-			},
-			expected: "80",
-		},
 		{
 			name: "multiple ports with different IPs",
 			ports: []port{
@@ -1936,22 +1716,6 @@ func TestConvertContainerPortsToString(t *testing.T) {
 			},
 			expected: "80, 1.2.3.4:443",
 		},
-		{
-			name: "same port bound to multiple IPs shows all entries",
-			ports: []port{
-				{PublicPort: 65533, IP: "172.16.151.72"},
-				{PublicPort: 65533, IP: "172.16.156.25"},
-			},
-			expected: "172.16.151.72:65533, 172.16.156.25:65533",
-		},
-		{
-			name: "same port bound to IPv4 and IPv6",
-			ports: []port{
-				{PublicPort: 65534, IP: "172.16.151.72"},
-				{PublicPort: 65534, IP: "fd04:38e2:98c6:3fd::72"},
-			},
-			expected: "172.16.151.72:65534, fd04:38e2:98c6:3fd::72:65534",
-		},
 		{
 			name: "ports slice is nilled after call",
 			ports: []port{

agent/fans.go

@@ -1,101 +0,0 @@
-package agent
-
-import (
-	"log/slog"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-
-	"github.com/henrygd/beszel/agent/utils"
-	"github.com/henrygd/beszel/internal/entities/system"
-)
-
-type fanSensor struct {
-	key, path string
-}
-
-var getFanSensors = newFanSensorCache(hwmonRoot)
-
-func newFanSensorCache(root string) func() ([]fanSensor, error) {
-	return sync.OnceValues(func() ([]fanSensor, error) {
-		return discoverHwmonFans(root)
-	})
-}
-
-// updateFans populates systemStats.Fans from the host's hwmon sysfs tree.
-// No-op on platforms where hwmon isn't available (see fans_other.go).
-func (a *Agent) updateFans(systemStats *system.Stats) {
-	if hwmonRoot == "" {
-		return
-	}
-	sensors, err := getFanSensors()
-	if err != nil {
-		slog.Debug("Error reading fans", "err", err)
-		return
-	}
-	fans := readFanSensors(sensors)
-	if len(fans) == 0 {
-		return
-	}
-	systemStats.Fans = fans
-	// Note: Commented out because we don't currently use this value in the UI.
-	// Compute the single "dashboard" value used by the FanSpeed alert.
-	// Per-sensor RPMs live in Stats.Fans and drive the multi-line FanChart
-	// in the UI; the alert path only needs one number to compare against
-	// the user's threshold, so we use the highest RPM across all fans
-	// a.systemInfo.DashboardFan = 0
-	// for _, rpm := range fans {
-	// 	if rpm > a.systemInfo.DashboardFan {
-	// 		a.systemInfo.DashboardFan = rpm
-	// 	}
-	// }
-}
-
-// readHwmonFans walks the given hwmon root (typically /sys/class/hwmon) and
-// returns a map of "<chip>_<label-or-fan-idx>" → RPM for every fan*_input
-// file it finds. Zero RPM is retained because it can represent a real fan that
-// has stopped; negative and malformed readings are ignored.
-func readHwmonFans(root string) (map[string]uint16, error) {
-	sensors, err := discoverHwmonFans(root)
-	if err != nil {
-		return nil, err
-	}
-	return readFanSensors(sensors), nil
-}
-
-func discoverHwmonFans(root string) ([]fanSensor, error) {
-	entries, err := os.ReadDir(root)
-	if err != nil {
-		return nil, err
-	}
-	var sensors []fanSensor
-	for _, entry := range entries {
-		chipDir := filepath.Join(root, entry.Name())
-		chipName := utils.ReadStringFile(filepath.Join(chipDir, "name"))
-		if chipName == "" {
-			chipName = entry.Name()
-		}
-		inputs, _ := filepath.Glob(filepath.Join(chipDir, "fan*_input"))
-		for _, inputPath := range inputs {
-			base := strings.TrimSuffix(filepath.Base(inputPath), "_input")
-			label := utils.ReadStringFile(filepath.Join(chipDir, base+"_label"))
-			key := chipName + "_" + base
-			if label != "" {
-				key = chipName + "_" + label
-			}
-			sensors = append(sensors, fanSensor{key, inputPath})
-		}
-	}
-	return sensors, nil
-}
-
-func readFanSensors(sensors []fanSensor) map[string]uint16 {
-	fans := make(map[string]uint16, len(sensors))
-	for _, sensor := range sensors {
-		if rpm, ok := utils.ReadUintFile(sensor.path); ok {
-			fans[sensor.key] = uint16(rpm)
-		}
-	}
-	return fans
-}

agent/fans_linux.go

@@ -1,8 +0,0 @@
-//go:build linux
-
-package agent
-
-// hwmonRoot is the sysfs entry point for hardware monitor chips. Each
-// subdirectory (hwmon0, hwmon1, …) is one chip; fan*_input files inside it
-// expose RPM readings.
-const hwmonRoot = "/sys/class/hwmon"

agent/fans_other.go

@@ -1,7 +0,0 @@
-//go:build !linux
-
-package agent
-
-// hwmonRoot is empty on non-Linux platforms — fan RPM reporting via sysfs
-// hwmon is Linux-specific. updateFans() short-circuits when this is empty.
-const hwmonRoot = ""

agent/fans_test.go

@@ -1,87 +0,0 @@
-//go:build testing
-
-package agent
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// writeFile creates path with parents and writes contents.
-func writeFile(t *testing.T, path, contents string) {
-	t.Helper()
-	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
-	require.NoError(t, os.WriteFile(path, []byte(contents), 0o644))
-}
-
-// TestReadHwmonFans verifies the /sys/class/hwmon walker:
-//   - picks up fan*_input from every chip,
-//   - keys entries by chip name + sensor label (or fan idx if no label),
-//   - retains 0 RPM for stopped fans,
-//   - tolerates chips with no fan files at all.
-func TestReadHwmonFans(t *testing.T) {
-	root := t.TempDir()
-
-	// hwmon0: Raspberry Pi 5 active cooler — one fan, no label.
-	writeFile(t, filepath.Join(root, "hwmon0", "name"), "pwmfan\n")
-	writeFile(t, filepath.Join(root, "hwmon0", "fan1_input"), "6500\n")
-
-	// hwmon1: a thermal-only chip, no fan files. Must not error.
-	writeFile(t, filepath.Join(root, "hwmon1", "name"), "cpu_thermal\n")
-	writeFile(t, filepath.Join(root, "hwmon1", "temp1_input"), "55000\n")
-
-	// hwmon2: two fans — one stopped (0 RPM) and one labeled "chassis".
-	writeFile(t, filepath.Join(root, "hwmon2", "name"), "nct6798\n")
-	writeFile(t, filepath.Join(root, "hwmon2", "fan1_input"), "0\n")
-	writeFile(t, filepath.Join(root, "hwmon2", "fan2_input"), "1200\n")
-	writeFile(t, filepath.Join(root, "hwmon2", "fan2_label"), "chassis\n")
-
-	fans, err := readHwmonFans(root)
-	require.NoError(t, err)
-
-	assert.Equal(t, map[string]uint16{
-		"pwmfan_fan1":     6500,
-		"nct6798_fan1":    0,
-		"nct6798_chassis": 1200,
-	}, fans)
-}
-
-// TestReadHwmonFansMissingRoot returns an error rather than panicking when the
-// hwmon root doesn't exist (e.g. running on a kernel without hwmon support).
-func TestReadHwmonFansMissingRoot(t *testing.T) {
-	_, err := readHwmonFans(filepath.Join(t.TempDir(), "does-not-exist"))
-	assert.Error(t, err)
-}
-
-// TestReadHwmonFansEmpty returns an empty map (not nil error) when the root
-// exists but contains no chips at all.
-func TestReadHwmonFansEmpty(t *testing.T) {
-	root := t.TempDir()
-	fans, err := readHwmonFans(root)
-	require.NoError(t, err)
-	assert.Empty(t, fans)
-}
-
-func TestFanDiscoveryCache(t *testing.T) {
-	root := t.TempDir()
-	input := filepath.Join(root, "hwmon0", "fan1_input")
-	writeFile(t, filepath.Join(root, "hwmon0", "name"), "chip\n")
-	writeFile(t, input, "1000\n")
-
-	getSensors := newFanSensorCache(root)
-	sensors, err := getSensors()
-	require.NoError(t, err)
-	fans := readFanSensors(sensors)
-	assert.Equal(t, uint16(1000), fans["chip_fan1"])
-
-	writeFile(t, input, "1200\n")
-	writeFile(t, filepath.Join(root, "hwmon0", "fan1_label"), "case\n")
-	sensors, err = getSensors()
-	require.NoError(t, err)
-	fans = readFanSensors(sensors)
-	assert.Equal(t, map[string]uint16{"chip_fan1": 1200}, fans)
-}

agent/gpu.go

@@ -542,7 +542,7 @@ func (gm *GPUManager) collectorDefinitions(caps gpuCapabilities) map[collectorSo
 	return map[collectorSource]collectorDefinition{
 		collectorSourceNVML: {
 			group:     collectorGroupNvidia,
-			available: true,
+			available: caps.hasNvidiaSmi,
 			start: func(_ func()) bool {
 				return gm.startNvmlCollector()
 			},
@@ -734,6 +734,9 @@ func NewGPUManager() (*GPUManager, error) {
 	}
 	var gm GPUManager
 	caps := gm.discoverGpuCapabilities()
+	if !hasAnyGpuCollector(caps) {
+		return nil, fmt.Errorf(noGPUFoundMsg)
+	}
 	gm.GpuDataMap = make(map[string]*system.GPUData)
 
 	// Jetson devices should always use tegrastats (ignore GPU_COLLECTOR).
@@ -742,7 +745,7 @@ func NewGPUManager() (*GPUManager, error) {
 		return &gm, nil
 	}
 
-	// Respect explicit collector selection before capability auto-detection.
+	// if GPU_COLLECTOR is set, start user-defined collectors.
 	if collectorConfig, ok := utils.GetEnv("GPU_COLLECTOR"); ok && strings.TrimSpace(collectorConfig) != "" {
 		priorities := parseCollectorPriority(collectorConfig)
 		if gm.startCollectorsByPriority(priorities, caps) == 0 {
@@ -751,10 +754,6 @@ func NewGPUManager() (*GPUManager, error) {
 		return &gm, nil
 	}
 
-	if !hasAnyGpuCollector(caps) {
-		return nil, fmt.Errorf(noGPUFoundMsg)
-	}
-
 	// auto-detect and start collectors when GPU_COLLECTOR is unset.
 	if gm.startCollectorsByPriority(gm.resolveLegacyCollectorPriority(caps), caps) == 0 {
 		return nil, fmt.Errorf(noGPUFoundMsg)

agent/gpu_amd_linux.go

@@ -156,7 +156,6 @@ func (gm *GPUManager) updateAmdGpuData(cardPath string) bool {
 func readSysfsFloat(path string) (float64, error) {
 	val, err := utils.ReadStringFileLimited(path, 64)
 	if err != nil {
-		slog.Debug("Failed to read sysfs value", "path", path, "error", err)
 		return 0, err
 	}
 	return strconv.ParseFloat(val, 64)

agent/gpu_test.go

@@ -1461,25 +1461,6 @@ func TestNewGPUManagerConfiguredCollectorsMustStart(t *testing.T) {
 	})
 }
 
-func TestCollectorDefinitionsNvmlDoesNotRequireNvidiaSmi(t *testing.T) {
-	gm := &GPUManager{}
-	definitions := gm.collectorDefinitions(gpuCapabilities{})
-	require.Contains(t, definitions, collectorSourceNVML)
-	assert.True(t, definitions[collectorSourceNVML].available)
-}
-
-func TestNewGPUManagerConfiguredNvmlBypassesCapabilityGate(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("PATH", dir)
-	t.Setenv("BESZEL_AGENT_GPU_COLLECTOR", "nvml")
-
-	gm, err := NewGPUManager()
-	require.Nil(t, gm)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "no configured GPU collectors are available")
-	assert.NotContains(t, err.Error(), noGPUFoundMsg)
-}
-
 func TestNewGPUManagerJetsonIgnoresCollectorConfig(t *testing.T) {
 	dir := t.TempDir()
 	t.Setenv("PATH", dir)

agent/handlers.go

@@ -166,16 +166,14 @@ type GetSmartDataHandler struct{}
 
 func (h *GetSmartDataHandler) Handle(hctx *HandlerContext) error {
 	if hctx.Agent.smartManager == nil {
-		return hctx.SendResponse(smart.SmartDataResponse{Data: map[string]smart.SmartData{}}, hctx.RequestID)
+		// return empty map to indicate no data
+		return hctx.SendResponse(map[string]smart.SmartData{}, hctx.RequestID)
 	}
-	complete, err := hctx.Agent.smartManager.Refresh(false)
-	if err != nil {
+	if err := hctx.Agent.smartManager.Refresh(false); err != nil {
 		slog.Debug("smart refresh failed", "err", err)
 	}
-	return hctx.SendResponse(smart.SmartDataResponse{
-		Data:     hctx.Agent.smartManager.GetCurrentData(),
-		Complete: complete,
-	}, hctx.RequestID)
+	data := hctx.Agent.smartManager.GetCurrentData()
+	return hctx.SendResponse(data, hctx.RequestID)
 }
 
 ////////////////////////////////////////////////////////////////////////////

agent/handlers_test.go

@@ -7,7 +7,6 @@ import (
 
 	"github.com/fxamacker/cbor/v2"
 	"github.com/henrygd/beszel/internal/common"
-	"github.com/henrygd/beszel/internal/entities/smart"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -18,18 +17,6 @@ type MockHandler struct {
 	handleFunc           func(ctx *HandlerContext) error
 }
 
-func TestNewAgentResponseSmartData(t *testing.T) {
-	response := newAgentResponse(smart.SmartDataResponse{
-		Data: map[string]smart.SmartData{
-			"AAA": {SerialNumber: "AAA"},
-		},
-		Complete: true,
-	}, nil)
-
-	assert.Equal(t, "AAA", response.SmartData["AAA"].SerialNumber)
-	assert.True(t, response.SmartComplete)
-}
-
 func (m *MockHandler) Handle(ctx *HandlerContext) error {
 	if m.handleFunc != nil {
 		return m.handleFunc(ctx)

agent/lhm/beszel_lhm.csproj

@@ -8,6 +8,6 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="LibreHardwareMonitorLib" Version="0.9.6" />
+    <PackageReference Include="LibreHardwareMonitorLib" Version="0.9.5" />
   </ItemGroup>
 </Project>

agent/mdraid_linux.go

@@ -180,13 +180,8 @@ func mdraidSmartStatus(health mdraidHealth) string {
 	if health.degraded > 0 {
 		return "FAILED"
 	}
-	if health.mismatchCnt > 0 {
-		return "WARNING"
-	}
-	// "check" scans for consistency problems without repairing mismatches.
-	// With no mismatches, keep it green while reporting progress attributes.
 	switch syncAction {
-	case "repair":
+	case "check", "repair":
 		return "WARNING"
 	}
 	switch state {

agent/mdraid_linux_test.go

@@ -94,18 +94,6 @@ func TestMdraidSmartStatus(t *testing.T) {
 	if got := mdraidSmartStatus(mdraidHealth{arrayState: "active", syncAction: "recover"}); got != "WARNING" {
 		t.Fatalf("mdraidSmartStatus(recover) = %q, want WARNING", got)
 	}
-	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", syncAction: "check"}); got != "PASSED" {
-		t.Fatalf("mdraidSmartStatus(clean+check) = %q, want PASSED", got)
-	}
-	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", syncAction: "check", mismatchCnt: 1}); got != "WARNING" {
-		t.Fatalf("mdraidSmartStatus(clean+check+mismatch) = %q, want WARNING", got)
-	}
-	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", mismatchCnt: 1}); got != "WARNING" {
-		t.Fatalf("mdraidSmartStatus(clean+mismatch) = %q, want WARNING", got)
-	}
-	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", syncAction: "repair"}); got != "WARNING" {
-		t.Fatalf("mdraidSmartStatus(repair) = %q, want WARNING", got)
-	}
 	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean"}); got != "PASSED" {
 		t.Fatalf("mdraidSmartStatus(clean) = %q, want PASSED", got)
 	}

agent/response.go

@@ -21,9 +21,6 @@ func newAgentResponse(data any, requestID *uint32) common.AgentResponse {
 		response.String = &v
 	case map[string]smart.SmartData:
 		response.SmartData = v
-	case smart.SmartDataResponse:
-		response.SmartData = v.Data
-		response.SmartComplete = v.Complete
 	case systemd.ServiceDetails:
 		response.ServiceInfo = v
 	default:

agent/sensors.go

@@ -19,20 +19,13 @@ import (
 	"github.com/shirou/gopsutil/v4/sensors"
 )
 
-var errTemperatureFetchTimeout = errors.New("temperature collection timed out")
-
-// Matches sensors.TemperaturesWithContext to allow for panic recovery (gopsutil/issues/1832)
-type getTempsFn func(ctx context.Context) ([]sensors.TemperatureStat, error)
-
 type SensorConfig struct {
 	context        context.Context
 	sensors        map[string]struct{}
 	primarySensor  string
-	timeout        time.Duration
 	isBlacklist    bool
 	hasWildcards   bool
 	skipCollection bool
-	firstRun       bool
 }
 
 func (a *Agent) newSensorConfig() *SensorConfig {
@@ -40,29 +33,25 @@ func (a *Agent) newSensorConfig() *SensorConfig {
 	sysSensors, _ := utils.GetEnv("SYS_SENSORS")
 	sensorsEnvVal, sensorsSet := utils.GetEnv("SENSORS")
 	skipCollection := sensorsSet && sensorsEnvVal == ""
-	sensorsTimeout, _ := utils.GetEnv("SENSORS_TIMEOUT")
 
-	return a.newSensorConfigWithEnv(primarySensor, sysSensors, sensorsEnvVal, sensorsTimeout, skipCollection)
+	return a.newSensorConfigWithEnv(primarySensor, sysSensors, sensorsEnvVal, skipCollection)
 }
 
+// Matches sensors.TemperaturesWithContext to allow for panic recovery (gopsutil/issues/1832)
+type getTempsFn func(ctx context.Context) ([]sensors.TemperatureStat, error)
+
+var (
+	errTemperatureFetchTimeout = errors.New("temperature collection timed out")
+	temperatureFetchTimeout    = 2 * time.Second
+)
+
 // newSensorConfigWithEnv creates a SensorConfig with the provided environment variables
 // sensorsSet indicates if the SENSORS environment variable was explicitly set (even to empty string)
-func (a *Agent) newSensorConfigWithEnv(primarySensor, sysSensors, sensorsEnvVal, sensorsTimeout string, skipCollection bool) *SensorConfig {
-	timeout := 2 * time.Second
-	if sensorsTimeout != "" {
-		if d, err := time.ParseDuration(sensorsTimeout); err == nil {
-			timeout = d
-		} else {
-			slog.Warn("Invalid SENSORS_TIMEOUT", "value", sensorsTimeout)
-		}
-	}
-
+func (a *Agent) newSensorConfigWithEnv(primarySensor, sysSensors, sensorsEnvVal string, skipCollection bool) *SensorConfig {
 	config := &SensorConfig{
 		context:        context.Background(),
 		primarySensor:  primarySensor,
-		timeout:        timeout,
 		skipCollection: skipCollection,
-		firstRun:       true,
 		sensors:        make(map[string]struct{}),
 	}
 
@@ -178,14 +167,6 @@ func (a *Agent) getTempsWithTimeout(getTemps getTempsFn) ([]sensors.TemperatureS
 		err   error
 	}
 
-	// Use a longer timeout on the first run to allow for initialization
-	// (e.g. Windows LHM subprocess startup)
-	timeout := a.sensorConfig.timeout
-	if a.sensorConfig.firstRun {
-		a.sensorConfig.firstRun = false
-		timeout = 10 * time.Second
-	}
-
 	resultCh := make(chan result, 1)
 	go func() {
 		temps, err := a.getTempsWithPanicRecovery(getTemps)
@@ -195,7 +176,7 @@ func (a *Agent) getTempsWithTimeout(getTemps getTempsFn) ([]sensors.TemperatureS
 	select {
 	case res := <-resultCh:
 		return res.temps, res.err
-	case <-time.After(timeout):
+	case <-time.After(temperatureFetchTimeout):
 		return nil, errTemperatureFetchTimeout
 	}
 }

agent/sensors_test.go

@@ -168,7 +168,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 		primarySensor  string
 		sysSensors     string
 		sensors        string
-		sensorsTimeout string
 		skipCollection bool
 		expectedConfig *SensorConfig
 	}{
@@ -180,37 +179,12 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:        context.Background(),
 				primarySensor:  "",
-				timeout:        2 * time.Second,
 				sensors:        map[string]struct{}{},
 				isBlacklist:    false,
 				hasWildcards:   false,
 				skipCollection: false,
 			},
 		},
-		{
-			name:           "Custom timeout",
-			primarySensor:  "",
-			sysSensors:     "",
-			sensors:        "",
-			sensorsTimeout: "5s",
-			expectedConfig: &SensorConfig{
-				context: context.Background(),
-				timeout: 5 * time.Second,
-				sensors: map[string]struct{}{},
-			},
-		},
-		{
-			name:           "Invalid timeout falls back to default",
-			primarySensor:  "",
-			sysSensors:     "",
-			sensors:        "",
-			sensorsTimeout: "notaduration",
-			expectedConfig: &SensorConfig{
-				context: context.Background(),
-				timeout: 2 * time.Second,
-				sensors: map[string]struct{}{},
-			},
-		},
 		{
 			name:           "Explicitly set to empty string",
 			primarySensor:  "",
@@ -220,7 +194,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:        context.Background(),
 				primarySensor:  "",
-				timeout:        2 * time.Second,
 				sensors:        map[string]struct{}{},
 				isBlacklist:    false,
 				hasWildcards:   false,
@@ -235,7 +208,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:       context.Background(),
 				primarySensor: "cpu_temp",
-				timeout:       2 * time.Second,
 				sensors:       map[string]struct{}{},
 				isBlacklist:   false,
 				hasWildcards:  false,
@@ -249,7 +221,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:       context.Background(),
 				primarySensor: "cpu_temp",
-				timeout:       2 * time.Second,
 				sensors: map[string]struct{}{
 					"cpu_temp": {},
 					"gpu_temp": {},
@@ -266,7 +237,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:       context.Background(),
 				primarySensor: "cpu_temp",
-				timeout:       2 * time.Second,
 				sensors: map[string]struct{}{
 					"cpu_temp": {},
 					"gpu_temp": {},
@@ -283,7 +253,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:       context.Background(),
 				primarySensor: "cpu_temp",
-				timeout:       2 * time.Second,
 				sensors: map[string]struct{}{
 					"cpu_*":    {},
 					"gpu_temp": {},
@@ -300,7 +269,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:       context.Background(),
 				primarySensor: "cpu_temp",
-				timeout:       2 * time.Second,
 				sensors: map[string]struct{}{
 					"cpu_*":    {},
 					"gpu_temp": {},
@@ -316,7 +284,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			sensors:       "cpu_temp",
 			expectedConfig: &SensorConfig{
 				primarySensor: "cpu_temp",
-				timeout:       2 * time.Second,
 				sensors: map[string]struct{}{
 					"cpu_temp": {},
 				},
@@ -328,7 +295,7 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result := agent.newSensorConfigWithEnv(tt.primarySensor, tt.sysSensors, tt.sensors, tt.sensorsTimeout, tt.skipCollection)
+			result := agent.newSensorConfigWithEnv(tt.primarySensor, tt.sysSensors, tt.sensors, tt.skipCollection)
 
 			// Check primary sensor
 			assert.Equal(t, tt.expectedConfig.primarySensor, result.primarySensor)
@@ -347,7 +314,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			// Check flags
 			assert.Equal(t, tt.expectedConfig.isBlacklist, result.isBlacklist)
 			assert.Equal(t, tt.expectedConfig.hasWildcards, result.hasWildcards)
-			assert.Equal(t, tt.expectedConfig.timeout, result.timeout)
 
 			// Check context
 			if tt.sysSensors != "" {
@@ -367,14 +333,12 @@ func TestNewSensorConfig(t *testing.T) {
 	t.Setenv("BESZEL_AGENT_PRIMARY_SENSOR", "test_primary")
 	t.Setenv("BESZEL_AGENT_SYS_SENSORS", "/test/path")
 	t.Setenv("BESZEL_AGENT_SENSORS", "test_sensor1,test_*,test_sensor3")
-	t.Setenv("BESZEL_AGENT_SENSORS_TIMEOUT", "7s")
 
 	agent := &Agent{}
 	result := agent.newSensorConfig()
 
 	// Verify results
 	assert.Equal(t, "test_primary", result.primarySensor)
-	assert.Equal(t, 7*time.Second, result.timeout)
 	assert.NotNil(t, result.sensors)
 	assert.Equal(t, 3, len(result.sensors))
 	assert.True(t, result.hasWildcards)
@@ -568,10 +532,15 @@ func TestGetTempsWithTimeout(t *testing.T) {
 	agent := &Agent{
 		sensorConfig: &SensorConfig{
 			context: context.Background(),
-			timeout: 10 * time.Millisecond,
 		},
 	}
 
+	originalTimeout := temperatureFetchTimeout
+	t.Cleanup(func() {
+		temperatureFetchTimeout = originalTimeout
+	})
+	temperatureFetchTimeout = 10 * time.Millisecond
+
 	t.Run("returns temperatures before timeout", func(t *testing.T) {
 		temps, err := agent.getTempsWithTimeout(func(ctx context.Context) ([]sensors.TemperatureStat, error) {
 			return []sensors.TemperatureStat{{SensorKey: "cpu_temp", Temperature: 42}}, nil
@@ -598,13 +567,15 @@ func TestUpdateTemperaturesSkipsOnTimeout(t *testing.T) {
 		systemInfo: system.Info{DashboardTemp: 99},
 		sensorConfig: &SensorConfig{
 			context: context.Background(),
-			timeout: 10 * time.Millisecond,
 		},
 	}
 
+	originalTimeout := temperatureFetchTimeout
 	t.Cleanup(func() {
+		temperatureFetchTimeout = originalTimeout
 		getSensorTemps = sensors.TemperaturesWithContext
 	})
+	temperatureFetchTimeout = 10 * time.Millisecond
 	getSensorTemps = func(ctx context.Context) ([]sensors.TemperatureStat, error) {
 		time.Sleep(50 * time.Millisecond)
 		return nil, nil

agent/server.go

@@ -29,6 +29,9 @@ type ServerOptions struct {
 	Keys    []gossh.PublicKey // SSH public keys for authentication
 }
 
+// hubVersions caches hub versions by session ID to avoid repeated parsing.
+var hubVersions map[string]semver.Version
+
 // StartServer starts the SSH server with the provided options.
 // It configures the server with secure defaults, sets up authentication,
 // and begins listening for connections. Returns an error if the server
@@ -96,15 +99,24 @@ func (a *Agent) StartServer(opts ServerOptions) error {
 	return a.server.Serve(ln)
 }
 
-// getHubVersion extracts the hub version from the SSH client version string
-// for a given session. Returns a zero version if parsing fails.
-func (a *Agent) getHubVersion(sessionCtx ssh.Context) semver.Version {
-	clientVersion := sessionCtx.Value(ssh.ContextKeyClientVersion)
-	if versionStr, ok := clientVersion.(string); ok {
-		hubVersion, _ := extractHubVersion(versionStr)
+// getHubVersion retrieves and caches the hub version for a given session.
+// It extracts the version from the SSH client version string and caches
+// it to avoid repeated parsing. Returns a zero version if parsing fails.
+func (a *Agent) getHubVersion(sessionId string, sessionCtx ssh.Context) semver.Version {
+	if hubVersions == nil {
+		hubVersions = make(map[string]semver.Version, 1)
+	}
+	hubVersion, ok := hubVersions[sessionId]
+	if ok {
 		return hubVersion
 	}
-	return semver.Version{}
+	// Extract hub version from SSH client version
+	clientVersion := sessionCtx.Value(ssh.ContextKeyClientVersion)
+	if versionStr, ok := clientVersion.(string); ok {
+		hubVersion, _ = extractHubVersion(versionStr)
+	}
+	hubVersions[sessionId] = hubVersion
+	return hubVersion
 }
 
 // handleSession handles an incoming SSH session by gathering system statistics
@@ -115,8 +127,9 @@ func (a *Agent) handleSession(s ssh.Session) {
 	a.connectionManager.eventChan <- SSHConnect
 
 	sessionCtx := s.Context()
+	sessionID := sessionCtx.SessionID()
 
-	hubVersion := a.getHubVersion(sessionCtx)
+	hubVersion := a.getHubVersion(sessionID, sessionCtx)
 
 	// Legacy one-shot behavior for older hubs
 	if hubVersion.LT(beszel.MinVersionAgentResponse) {
@@ -180,7 +193,7 @@ func (a *Agent) handleSSHRequest(w io.Writer, req *common.HubRequest[cbor.RawMes
 
 // handleLegacyStats serves the legacy one-shot stats payload for older hubs
 func (a *Agent) handleLegacyStats(w io.Writer, hubVersion semver.Version) error {
-	stats := a.gatherStats(common.DataRequestOptions{CacheTimeMs: defaultDataCacheTimeMs})
+	stats := a.gatherStats(common.DataRequestOptions{CacheTimeMs: 60_000})
 	return a.writeToSession(w, stats, hubVersion)
 }
 

agent/server_test.go

@@ -404,23 +404,27 @@ func TestGetHubVersion(t *testing.T) {
 		clientVersion: "SSH-2.0-beszel_0.12.0",
 	}
 
-	// Test first call - should extract version
-	version := agent.getHubVersion(mockCtx)
+	// Test first call - should extract and cache version
+	version := agent.getHubVersion("test-session-123", mockCtx)
 	assert.Equal(t, "0.12.0", version.String())
 
-	// Test that version reflects the current client version (no stale caching)
-	mockCtx.clientVersion = "SSH-2.0-beszel_0.11.0"
-	version = agent.getHubVersion(mockCtx)
+	// Test second call - should return cached version
+	mockCtx.clientVersion = "SSH-2.0-beszel_0.11.0" // Change version but should still return cached
+	version = agent.getHubVersion("test-session-123", mockCtx)
+	assert.Equal(t, "0.12.0", version.String()) // Should still be cached version
+
+	// Test different session - should extract new version
+	version = agent.getHubVersion("different-session", mockCtx)
 	assert.Equal(t, "0.11.0", version.String())
 
 	// Test with invalid version string (non-beszel client)
 	mockCtx.clientVersion = "SSH-2.0-OpenSSH_8.0"
-	version = agent.getHubVersion(mockCtx)
+	version = agent.getHubVersion("invalid-session", mockCtx)
 	assert.Equal(t, "0.0.0", version.String()) // Should be empty version for non-beszel clients
 
 	// Test with no client version
 	mockCtx.clientVersion = ""
-	version = agent.getHubVersion(mockCtx)
+	version = agent.getHubVersion("no-version-session", mockCtx)
 	assert.True(t, version.EQ(semver.Version{})) // Should be empty version
 }
 
@@ -497,6 +501,9 @@ func TestWriteToSessionEncoding(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			// Reset the global hubVersions map to ensure clean state for each test
+			hubVersions = nil
+
 			agent, err := NewAgent("")
 			require.NoError(t, err)
 
@@ -578,28 +585,39 @@ func createTestCombinedData() *system.CombinedData {
 	}
 }
 
-// TestGetHubVersionConcurrent guards against a regression of the
-// "concurrent map writes" panic previously caused by a shared, unsynchronized
-// hubVersions cache (see https://github.com/henrygd/beszel/issues/2128).
-// getHubVersion no longer shares mutable state between sessions, so calling
-// it concurrently from many goroutines must be safe under `go test -race`.
-func TestGetHubVersionConcurrent(t *testing.T) {
+func TestHubVersionCaching(t *testing.T) {
+	// Reset the global hubVersions map to ensure clean state
+	hubVersions = nil
+
 	agent, err := NewAgent("")
 	require.NoError(t, err)
 
-	const goroutines = 50
-	var wg sync.WaitGroup
-	wg.Add(goroutines)
-	for i := 0; i < goroutines; i++ {
-		go func(i int) {
-			defer wg.Done()
-			ctx := &mockSSHContext{
-				sessionID:     fmt.Sprintf("session-%d", i),
-				clientVersion: "SSH-2.0-beszel_0.12.0",
-			}
-			version := agent.getHubVersion(ctx)
-			assert.Equal(t, "0.12.0", version.String())
-		}(i)
+	ctx1 := &mockSSHContext{
+		sessionID:     "session1",
+		clientVersion: "SSH-2.0-beszel_0.12.0",
 	}
-	wg.Wait()
+	ctx2 := &mockSSHContext{
+		sessionID:     "session2",
+		clientVersion: "SSH-2.0-beszel_0.11.0",
+	}
+
+	// First calls should cache the versions
+	v1 := agent.getHubVersion("session1", ctx1)
+	v2 := agent.getHubVersion("session2", ctx2)
+
+	assert.Equal(t, "0.12.0", v1.String())
+	assert.Equal(t, "0.11.0", v2.String())
+
+	// Verify caching by changing context but keeping same session ID
+	ctx1.clientVersion = "SSH-2.0-beszel_0.10.0"
+	v1Cached := agent.getHubVersion("session1", ctx1)
+	assert.Equal(t, "0.12.0", v1Cached.String()) // Should still be cached version
+
+	// New session should get new version
+	ctx3 := &mockSSHContext{
+		sessionID:     "session3",
+		clientVersion: "SSH-2.0-beszel_0.13.0",
+	}
+	v3 := agent.getHubVersion("session3", ctx3)
+	assert.Equal(t, "0.13.0", v3.String())
 }

agent/smart.go

@@ -25,15 +25,12 @@ import (
 // SmartManager manages data collection for SMART devices
 type SmartManager struct {
 	sync.Mutex
-	SmartDataMap       map[string]*smart.SmartData
-	SmartDevices       []*DeviceInfo
-	refreshMutex       sync.Mutex
-	lastScanTime       time.Time
-	smartctlPath       string
-	excludedDevices    map[string]struct{}
-	darwinNvmeOnce     sync.Once
-	darwinNvmeCapacity map[string]uint64      // serial → bytes cache, written once via darwinNvmeOnce
-	darwinNvmeProvider func() ([]byte, error) // overridable for testing
+	SmartDataMap    map[string]*smart.SmartData
+	SmartDevices    []*DeviceInfo
+	refreshMutex    sync.Mutex
+	lastScanTime    time.Time
+	smartctlPath    string
+	excludedDevices map[string]struct{}
 }
 
 type scanOutput struct {
@@ -55,11 +52,6 @@ type DeviceInfo struct {
 	typeVerified bool
 	// parserType holds the parser type (nvme, sat, scsi) that last succeeded.
 	parserType string
-	// explicitType reports whether Type came from an explicit ":type" hint in
-	// SMART_DEVICES. Such a type is a deliberate user override and must always be
-	// passed to smartctl via -d, even for scsi/ata where a scan-detected type is
-	// otherwise left off (see smartctlArgs and issue #1345).
-	explicitType bool
 }
 
 // deviceKey is a composite key for a device, used to identify a device uniquely.
@@ -70,9 +62,8 @@ type deviceKey struct {
 
 var errNoValidSmartData = fmt.Errorf("no valid SMART data found") // Error for missing data
 
-// Refresh updates SMART data for all known devices and reports whether every
-// discovered device was collected successfully.
-func (sm *SmartManager) Refresh(forceScan bool) (bool, error) {
+// Refresh updates SMART data for all known devices
+func (sm *SmartManager) Refresh(forceScan bool) error {
 	sm.refreshMutex.Lock()
 	defer sm.refreshMutex.Unlock()
 
@@ -93,7 +84,7 @@ func (sm *SmartManager) Refresh(forceScan bool) (bool, error) {
 		}
 	}
 
-	return scanErr == nil && collectErr == nil, sm.resolveRefreshError(scanErr, collectErr)
+	return sm.resolveRefreshError(scanErr, collectErr)
 }
 
 // devicesSnapshot returns a copy of the current device slice to avoid iterating
@@ -257,9 +248,8 @@ func (sm *SmartManager) parseConfiguredDevices(config string) ([]*DeviceInfo, er
 		}
 
 		devices = append(devices, &DeviceInfo{
-			Name:         name,
-			Type:         devType,
-			explicitType: devType != "",
+			Name: name,
+			Type: devType,
 		})
 	}
 
@@ -565,9 +555,7 @@ func (sm *SmartManager) smartctlArgs(deviceInfo *DeviceInfo, includeStandby bool
 		deviceType = strings.ToLower(deviceInfo.Type)
 		parserType = strings.ToLower(deviceInfo.parserType)
 		// types sometimes misidentified in scan; see github.com/henrygd/beszel/issues/1345
-		// An explicit SMART_DEVICES ":type" hint is a deliberate override, so always
-		// pass it through; otherwise scsi/ata are left off so smartctl can auto-detect.
-		if deviceType != "" && (deviceInfo.explicitType || (deviceType != "scsi" && deviceType != "ata")) {
+		if deviceType != "" && deviceType != "scsi" && deviceType != "ata" {
 			args = append(args, "-d", deviceInfo.Type)
 		}
 	}
@@ -672,9 +660,6 @@ func mergeDeviceLists(existing, scanned, configured []*DeviceInfo) []*DeviceInfo
 		target.Type = prev.Type
 		target.typeVerified = true
 		target.parserType = prev.parserType
-		if prev.explicitType {
-			target.explicitType = true
-		}
 	}
 
 	// applyConfiguredMetadata updates a matched device with any configured
@@ -688,9 +673,6 @@ func mergeDeviceLists(existing, scanned, configured []*DeviceInfo) []*DeviceInfo
 			existingDev.typeVerified = false
 			existingDev.parserType = normalizeParserType(newType)
 		}
-		if configuredDev.explicitType {
-			existingDev.explicitType = true
-		}
 		if configuredDev.InfoName != "" {
 			existingDev.InfoName = configuredDev.InfoName
 		}
@@ -1051,52 +1033,6 @@ func parseScsiGigabytesProcessed(value string) int64 {
 	return parsed
 }
 
-// lookupDarwinNvmeCapacity returns the capacity in bytes for a given NVMe serial number on Darwin.
-// It uses system_profiler SPNVMeDataType to get capacity since Apple SSDs don't report user_capacity
-// via smartctl. Results are cached after the first call via sync.Once.
-func (sm *SmartManager) lookupDarwinNvmeCapacity(serial string) uint64 {
-	sm.darwinNvmeOnce.Do(func() {
-		sm.darwinNvmeCapacity = make(map[string]uint64)
-
-		provider := sm.darwinNvmeProvider
-		if provider == nil {
-			provider = func() ([]byte, error) {
-				ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-				defer cancel()
-				return exec.CommandContext(ctx, "system_profiler", "SPNVMeDataType", "-json").Output()
-			}
-		}
-
-		out, err := provider()
-		if err != nil {
-			slog.Debug("system_profiler NVMe lookup failed", "err", err)
-			return
-		}
-
-		var result struct {
-			SPNVMeDataType []struct {
-				Items []struct {
-					DeviceSerial string `json:"device_serial"`
-					SizeInBytes  uint64 `json:"size_in_bytes"`
-				} `json:"_items"`
-			} `json:"SPNVMeDataType"`
-		}
-		if err := json.Unmarshal(out, &result); err != nil {
-			slog.Debug("system_profiler NVMe parse failed", "err", err)
-			return
-		}
-
-		for _, controller := range result.SPNVMeDataType {
-			for _, item := range controller.Items {
-				if item.DeviceSerial != "" && item.SizeInBytes > 0 {
-					sm.darwinNvmeCapacity[item.DeviceSerial] = item.SizeInBytes
-				}
-			}
-		}
-	})
-	return sm.darwinNvmeCapacity[serial]
-}
-
 // parseSmartForNvme parses the output of smartctl --all -j /dev/nvmeX and updates the SmartDataMap
 // Returns hasValidData and exitStatus
 func (sm *SmartManager) parseSmartForNvme(output []byte) (bool, int) {
@@ -1133,12 +1069,6 @@ func (sm *SmartManager) parseSmartForNvme(output []byte) (bool, int) {
 	smartData.SerialNumber = data.SerialNumber
 	smartData.FirmwareVersion = data.FirmwareVersion
 	smartData.Capacity = data.UserCapacity.Bytes
-	if smartData.Capacity == 0 {
-		smartData.Capacity = data.NVMeTotalCapacity
-	}
-	if smartData.Capacity == 0 && (runtime.GOOS == "darwin" || sm.darwinNvmeProvider != nil) {
-		smartData.Capacity = sm.lookupDarwinNvmeCapacity(data.SerialNumber)
-	}
 	smartData.Temperature = data.NVMeSmartHealthInformationLog.Temperature
 	smartData.SmartStatus = getSmartStatus(smartData.Temperature, data.SmartStatus.Passed)
 	smartData.DiskName = data.Device.Name

agent/smart_test.go

@@ -392,81 +392,6 @@ func TestSmartctlArgs(t *testing.T) {
 	)
 }
 
-// TestSmartctlArgsExplicitType verifies that an explicit SMART_DEVICES type hint
-// is always passed to smartctl via -d, while a scan-detected scsi/ata type is
-// still left off so smartctl can auto-detect it (see issue #1345).
-func TestSmartctlArgsExplicitType(t *testing.T) {
-	sm := &SmartManager{}
-
-	// Scan-detected scsi: -d is intentionally omitted.
-	scanScsi := &DeviceInfo{Name: "/dev/sda", Type: "scsi"}
-	assert.Equal(t,
-		[]string{"-a", "--json=c", "/dev/sda"},
-		sm.smartctlArgs(scanScsi, false),
-	)
-
-	// Explicit scsi from SMART_DEVICES: -d scsi must be passed.
-	explicitScsi := &DeviceInfo{Name: "/dev/sda", Type: "scsi", explicitType: true}
-	assert.Equal(t,
-		[]string{"-d", "scsi", "-a", "--json=c", "/dev/sda"},
-		sm.smartctlArgs(explicitScsi, false),
-	)
-
-	// Explicit ata from SMART_DEVICES: -d ata must be passed (devstat still added).
-	explicitAta := &DeviceInfo{Name: "/dev/sdb", Type: "ata", explicitType: true}
-	assert.Equal(t,
-		[]string{"-d", "ata", "-a", "--json=c", "-l", "devstat", "/dev/sdb"},
-		sm.smartctlArgs(explicitAta, false),
-	)
-}
-
-// TestSmartDevicesExplicitTypeFlowsToSmartctlArgs is a regression test for
-// issue #2072: an explicit SMART_DEVICES type (e.g. /dev/sda:scsi) must win over
-// a wrong scan-detected type (sat) and be handed to smartctl as -d scsi.
-func TestSmartDevicesExplicitTypeFlowsToSmartctlArgs(t *testing.T) {
-	sm := &SmartManager{}
-
-	configured, err := sm.parseConfiguredDevices("/dev/sda:scsi")
-	require.NoError(t, err)
-	require.Len(t, configured, 1)
-	assert.True(t, configured[0].explicitType)
-
-	// smartctl --scan misreports this USB drive as sat, which fails on it.
-	scanned := []*DeviceInfo{
-		{Name: "/dev/sda", Type: "sat", Protocol: "ATA"},
-	}
-
-	merged := mergeDeviceLists(nil, scanned, configured)
-	require.Len(t, merged, 1)
-
-	device := merged[0]
-	assert.Equal(t, "scsi", device.Type, "configured type should win over scan-detected sat")
-	assert.True(t, device.explicitType, "explicit hint must survive the merge")
-
-	assert.Equal(t,
-		[]string{"-d", "scsi", "-a", "--json=c", "/dev/sda"},
-		sm.smartctlArgs(device, false),
-		"explicit scsi type must be passed to smartctl, not dropped",
-	)
-}
-
-// TestMergeDeviceListsPreservesExplicitTypeAcrossRescan ensures a verified,
-// explicitly-typed device keeps its explicit flag when a later scan re-reports
-// it with a different auto-detected type.
-func TestMergeDeviceListsPreservesExplicitTypeAcrossRescan(t *testing.T) {
-	existing := []*DeviceInfo{
-		{Name: "/dev/sda", Type: "scsi", parserType: "scsi", typeVerified: true, explicitType: true},
-	}
-	scanned := []*DeviceInfo{
-		{Name: "/dev/sda", Type: "sat"},
-	}
-
-	merged := mergeDeviceLists(existing, scanned, nil)
-	require.Len(t, merged, 1)
-	assert.Equal(t, "scsi", merged[0].Type)
-	assert.True(t, merged[0].explicitType, "explicit type flag should survive a rescan")
-}
-
 func TestResolveRefreshError(t *testing.T) {
 	scanErr := errors.New("scan failed")
 	collectErr := errors.New("collect failed")
@@ -1274,81 +1199,3 @@ func TestIsNvmeControllerPath(t *testing.T) {
 		})
 	}
 }
-
-func TestParseSmartForNvmeAppleSSD(t *testing.T) {
-	// Apple SSDs don't report user_capacity via smartctl; capacity should be fetched
-	// from system_profiler via the darwinNvmeProvider fallback.
-	fixturePath := filepath.Join("test-data", "smart", "apple_nvme.json")
-	data, err := os.ReadFile(fixturePath)
-	require.NoError(t, err)
-
-	providerCalls := 0
-	fakeProvider := func() ([]byte, error) {
-		providerCalls++
-		return []byte(`{
-			"SPNVMeDataType": [{
-				"_items": [{
-					"device_serial": "0ba0147940253c15",
-					"size_in_bytes": 251000193024
-				}]
-			}]
-		}`), nil
-	}
-
-	sm := &SmartManager{
-		SmartDataMap:       make(map[string]*smart.SmartData),
-		darwinNvmeProvider: fakeProvider,
-	}
-
-	hasData, _ := sm.parseSmartForNvme(data)
-	require.True(t, hasData)
-
-	deviceData, ok := sm.SmartDataMap["0ba0147940253c15"]
-	require.True(t, ok)
-	assert.Equal(t, "APPLE SSD AP0256Q", deviceData.ModelName)
-	assert.Equal(t, uint64(251000193024), deviceData.Capacity)
-	assert.Equal(t, uint8(42), deviceData.Temperature)
-	assert.Equal(t, "PASSED", deviceData.SmartStatus)
-	assert.Equal(t, 1, providerCalls, "system_profiler should be called once")
-
-	// Second parse: provider should NOT be called again (cache hit)
-	_, _ = sm.parseSmartForNvme(data)
-	assert.Equal(t, 1, providerCalls, "system_profiler should not be called again after caching")
-}
-
-func TestLookupDarwinNvmeCapacityMultipleDisks(t *testing.T) {
-	fakeProvider := func() ([]byte, error) {
-		return []byte(`{
-			"SPNVMeDataType": [
-				{
-					"_items": [
-						{"device_serial": "serial-disk0", "size_in_bytes": 251000193024},
-						{"device_serial": "serial-disk1", "size_in_bytes": 1000204886016}
-					]
-				},
-				{
-					"_items": [
-						{"device_serial": "serial-disk2", "size_in_bytes": 512110190592}
-					]
-				}
-			]
-		}`), nil
-	}
-
-	sm := &SmartManager{darwinNvmeProvider: fakeProvider}
-	assert.Equal(t, uint64(251000193024), sm.lookupDarwinNvmeCapacity("serial-disk0"))
-	assert.Equal(t, uint64(1000204886016), sm.lookupDarwinNvmeCapacity("serial-disk1"))
-	assert.Equal(t, uint64(512110190592), sm.lookupDarwinNvmeCapacity("serial-disk2"))
-	assert.Equal(t, uint64(0), sm.lookupDarwinNvmeCapacity("unknown-serial"))
-}
-
-func TestLookupDarwinNvmeCapacityProviderError(t *testing.T) {
-	fakeProvider := func() ([]byte, error) {
-		return nil, errors.New("system_profiler not found")
-	}
-
-	sm := &SmartManager{darwinNvmeProvider: fakeProvider}
-	assert.Equal(t, uint64(0), sm.lookupDarwinNvmeCapacity("any-serial"))
-	// Cache should be initialized even on error so we don't retry (Once already fired)
-	assert.NotNil(t, sm.darwinNvmeCapacity)
-}

agent/system.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"runtime"
 	"strings"
+	"time"
 
 	"github.com/henrygd/beszel"
 	"github.com/henrygd/beszel/agent/battery"
@@ -22,6 +23,13 @@ import (
 	"github.com/shirou/gopsutil/v4/mem"
 )
 
+// prevDisk stores previous per-device disk counters for a given cache interval
+type prevDisk struct {
+	readBytes  uint64
+	writeBytes uint64
+	at         time.Time
+}
+
 // Sets initial / non-changing values about the host system
 func (a *Agent) refreshSystemDetails() {
 	a.systemInfo.AgentVersion = beszel.Version
@@ -107,39 +115,14 @@ func (a *Agent) refreshSystemDetails() {
 	}
 }
 
-// attachSystemDetails returns details only for fresh default-interval responses.
-func (a *Agent) attachSystemDetails(data *system.CombinedData, cacheTimeMs uint16, includeRequested bool) *system.CombinedData {
-	if cacheTimeMs != defaultDataCacheTimeMs || (!includeRequested && !a.detailsDirty) {
-		return data
-	}
-
-	// copy data to avoid adding details to the original cached struct
-	response := *data
-	response.Details = &a.systemDetails
-	a.detailsDirty = false
-	return &response
-}
-
-// updateSystemDetails applies a mutation to the static details payload and marks
-// it for inclusion on the next fresh default-interval response.
-func (a *Agent) updateSystemDetails(updateFunc func(details *system.Details)) {
-	updateFunc(&a.systemDetails)
-	a.detailsDirty = true
-}
-
 // Returns current info, stats about the host system
 func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 	var systemStats system.Stats
 
 	// battery
-	if batteries, err := battery.GetBatteryStats(); err == nil {
-		systemStats.Batteries = make(map[string]uint8, len(batteries))
-		for _, device := range batteries {
-			systemStats.Batteries[device.Name] = device.Percent
-		}
-		if primary, ok := battery.Primary(batteries); ok {
-			systemStats.Battery = [2]uint8{primary.Percent, primary.State}
-		}
+	if batteryPercent, batteryState, err := battery.GetBatteryStats(); err == nil {
+		systemStats.Battery[0] = batteryPercent
+		systemStats.Battery[1] = batteryState
 	}
 
 	// cpu metrics
@@ -174,11 +157,21 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 
 	// memory
 	if v, err := mem.VirtualMemory(); err == nil {
-		used, cacheBuff, swapUsed := calculateHostMemoryUsage(v, a.memCalc == "htop")
 		// swap
 		systemStats.Swap = utils.BytesToGigabytes(v.SwapTotal)
-		systemStats.SwapUsed = utils.BytesToGigabytes(swapUsed)
-		v.Used = used
+		systemStats.SwapUsed = utils.BytesToGigabytes(v.SwapTotal - v.SwapFree - v.SwapCached)
+		// cache + buffers value for default mem calculation
+		// note: gopsutil automatically adds SReclaimable to v.Cached
+		cacheBuff := v.Cached + v.Buffers - v.Shared
+		if cacheBuff <= 0 {
+			cacheBuff = max(v.Total-v.Free-v.Used, 0)
+		}
+		// htop memory calculation overrides (likely outdated as of mid 2025)
+		if a.memCalc == "htop" {
+			// cacheBuff = v.Cached + v.Buffers - v.Shared
+			v.Used = v.Total - (v.Free + cacheBuff)
+			v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
+		}
 		// if a.memCalc == "legacy" {
 		// 	v.Used = v.Total - v.Free - v.Buffers - v.Cached
 		// 	cacheBuff = v.Total - v.Free - v.Used
@@ -188,14 +181,10 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 		if a.zfs {
 			if arcSize, _ := zfs.ARCSize(); arcSize > 0 && arcSize < v.Used {
 				v.Used = v.Used - arcSize
+				v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
 				systemStats.MemZfsArc = utils.BytesToGigabytes(arcSize)
 			}
 		}
-		if v.Total > 0 {
-			v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
-		} else {
-			v.UsedPercent = 0
-		}
 		systemStats.Mem = utils.BytesToGigabytes(v.Total)
 		systemStats.MemBuffCache = utils.BytesToGigabytes(cacheBuff)
 		systemStats.MemUsed = utils.BytesToGigabytes(v.Used)
@@ -215,9 +204,6 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 	// TODO: maybe refactor to methods on systemStats
 	a.updateTemperatures(&systemStats)
 
-	// fan speeds (Linux-only; sysfs hwmon)
-	a.updateFans(&systemStats)
-
 	// GPU data
 	if a.gpuManager != nil {
 		// reset high gpu percent
@@ -265,38 +251,6 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 	return systemStats
 }
 
-// calculateHostMemoryUsage derives counters defensively because /proc/meminfo may
-// change while gopsutil reads it. Invalid unsigned subtractions saturate at zero.
-func calculateHostMemoryUsage(v *mem.VirtualMemoryStat, htop bool) (used, cacheBuff, swapUsed uint64) {
-	used = v.Used
-	if used > v.Total {
-		used = saturatingSub(v.Total, v.Available)
-	}
-
-	// gopsutil automatically adds SReclaimable to Cached.
-	cacheBuff = min(v.Cached, v.Total)
-	cacheBuff += min(v.Buffers, v.Total-cacheBuff)
-	cacheBuff = saturatingSub(cacheBuff, min(v.Shared, v.Total))
-	if v.Cached == 0 && v.Buffers == 0 {
-		cacheBuff = saturatingSub(v.Total, v.Free, used)
-	}
-	if htop {
-		used = saturatingSub(v.Total, v.Free, cacheBuff)
-	}
-	return used, cacheBuff, saturatingSub(v.SwapTotal, v.SwapFree, v.SwapCached)
-}
-
-// saturatingSub subtracts each value, returning zero on underflow.
-func saturatingSub(value uint64, subtrahends ...uint64) uint64 {
-	for _, subtrahend := range subtrahends {
-		if subtrahend > value {
-			return 0
-		}
-		value -= subtrahend
-	}
-	return value
-}
-
 // getOsPrettyName attempts to get the pretty OS name from /etc/os-release on Linux systems
 func getOsPrettyName() (string, error) {
 	file, err := os.Open("/etc/os-release")

agent/system_test.go

@@ -1,115 +0,0 @@
-package agent
-
-import (
-	"testing"
-
-	"github.com/henrygd/beszel/internal/common"
-	"github.com/henrygd/beszel/internal/entities/system"
-	"github.com/shirou/gopsutil/v4/mem"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestGatherStatsDoesNotAttachDetailsToCachedRequests(t *testing.T) {
-	agent := &Agent{
-		cache:         NewSystemDataCache(),
-		systemDetails: system.Details{Hostname: "updated-host", Podman: true},
-		detailsDirty:  true,
-	}
-	cached := &system.CombinedData{
-		Info: system.Info{Hostname: "cached-host"},
-	}
-	agent.cache.Set(cached, defaultDataCacheTimeMs)
-
-	response := agent.gatherStats(common.DataRequestOptions{CacheTimeMs: defaultDataCacheTimeMs})
-
-	assert.Same(t, cached, response)
-	assert.Nil(t, response.Details)
-	assert.True(t, agent.detailsDirty)
-	assert.Equal(t, "cached-host", response.Info.Hostname)
-	assert.Nil(t, cached.Details)
-
-	secondResponse := agent.gatherStats(common.DataRequestOptions{CacheTimeMs: defaultDataCacheTimeMs})
-	assert.Same(t, cached, secondResponse)
-	assert.Nil(t, secondResponse.Details)
-}
-
-func TestCalculateHostMemoryUsage(t *testing.T) {
-	tests := []struct {
-		name                      string
-		memory                    mem.VirtualMemoryStat
-		htop                      bool
-		used, cacheBuff, swapUsed uint64
-	}{
-		{
-			name:      "normal",
-			memory:    mem.VirtualMemoryStat{Total: 100, Available: 40, Used: 60, Free: 20, Cached: 25, Buffers: 10, Shared: 5, SwapTotal: 20, SwapFree: 8, SwapCached: 2},
-			used:      60,
-			cacheBuff: 30,
-			swapUsed:  10,
-		},
-		{
-			name:      "inconsistent counters saturate",
-			memory:    mem.VirtualMemoryStat{Total: 100, Available: 110, Used: ^uint64(0) - 9, Free: 90, Cached: 5, Buffers: 10, Shared: 20, SwapTotal: 10, SwapFree: 9, SwapCached: 2},
-			used:      0,
-			cacheBuff: 0,
-			swapUsed:  0,
-		},
-		{
-			name:      "htop subtraction saturates",
-			memory:    mem.VirtualMemoryStat{Total: 100, Available: 20, Used: 80, Free: 90, Cached: 20, Buffers: 5, SwapTotal: 30, SwapFree: 10, SwapCached: 5},
-			htop:      true,
-			used:      0,
-			cacheBuff: 25,
-			swapUsed:  15,
-		},
-		{
-			name:      "zero cache from shared cancellation does not fall back",
-			memory:    mem.VirtualMemoryStat{Total: 100, Used: 60, Free: 10, Cached: 20, Buffers: 10, Shared: 30},
-			used:      60,
-			cacheBuff: 0,
-		},
-		{
-			name:      "absent cache counters use fallback",
-			memory:    mem.VirtualMemoryStat{Total: 100, Used: 60, Free: 10},
-			used:      60,
-			cacheBuff: 30,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			used, cacheBuff, swapUsed := calculateHostMemoryUsage(&tt.memory, tt.htop)
-			assert.Equal(t, tt.used, used)
-			assert.Equal(t, tt.cacheBuff, cacheBuff)
-			assert.Equal(t, tt.swapUsed, swapUsed)
-		})
-	}
-}
-
-func TestUpdateSystemDetailsMarksDetailsDirty(t *testing.T) {
-	agent := &Agent{}
-
-	agent.updateSystemDetails(func(details *system.Details) {
-		details.Hostname = "updated-host"
-		details.Podman = true
-	})
-
-	assert.True(t, agent.detailsDirty)
-	assert.Equal(t, "updated-host", agent.systemDetails.Hostname)
-	assert.True(t, agent.systemDetails.Podman)
-
-	original := &system.CombinedData{}
-	realTimeResponse := agent.attachSystemDetails(original, 1000, true)
-	assert.Same(t, original, realTimeResponse)
-	assert.Nil(t, realTimeResponse.Details)
-	assert.True(t, agent.detailsDirty)
-
-	response := agent.attachSystemDetails(original, defaultDataCacheTimeMs, false)
-	require.NotNil(t, response.Details)
-	assert.NotSame(t, original, response)
-	assert.Equal(t, "updated-host", response.Details.Hostname)
-	assert.True(t, response.Details.Podman)
-	assert.False(t, agent.detailsDirty)
-	assert.Nil(t, original.Details)
-}

agent/test-data/smart/apple_nvme.json

@@ -1,51 +0,0 @@
-{
-  "json_format_version": [1, 0],
-  "smartctl": {
-    "version": [7, 4],
-    "argv": ["smartctl", "-aix", "-j", "IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/ans@77400000/AppleASCWrapV4/iop-ans-nub/RTBuddy(ANS2)/RTBuddyService/AppleANS3NVMeController/NS_01@1"],
-    "exit_status": 4
-  },
-  "device": {
-    "name": "IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/ans@77400000/AppleASCWrapV4/iop-ans-nub/RTBuddy(ANS2)/RTBuddyService/AppleANS3NVMeController/NS_01@1",
-    "info_name": "IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/ans@77400000/AppleASCWrapV4/iop-ans-nub/RTBuddy(ANS2)/RTBuddyService/AppleANS3NVMeController/NS_01@1",
-    "type": "nvme",
-    "protocol": "NVMe"
-  },
-  "model_name": "APPLE SSD AP0256Q",
-  "serial_number": "0ba0147940253c15",
-  "firmware_version": "555",
-  "smart_support": {
-    "available": true,
-    "enabled": true
-  },
-  "smart_status": {
-    "passed": true,
-    "nvme": {
-      "value": 0
-    }
-  },
-  "nvme_smart_health_information_log": {
-    "critical_warning": 0,
-    "temperature": 42,
-    "available_spare": 100,
-    "available_spare_threshold": 99,
-    "percentage_used": 1,
-    "data_units_read": 270189386,
-    "data_units_written": 166753862,
-    "host_reads": 7543766995,
-    "host_writes": 3761621926,
-    "controller_busy_time": 0,
-    "power_cycles": 366,
-    "power_on_hours": 2850,
-    "unsafe_shutdowns": 195,
-    "media_errors": 0,
-    "num_err_log_entries": 0
-  },
-  "temperature": {
-    "current": 42
-  },
-  "power_cycle_count": 366,
-  "power_on_time": {
-    "hours": 2850
-  }
-}

agent/utils/utils.go

@@ -1,8 +1,6 @@
-// Package utils provides utility functions for the agent.
 package utils
 
 import (
-	"fmt"
 	"io"
 	"math"
 	"os"
@@ -70,9 +68,6 @@ func ReadStringFileLimited(path string, maxSize int) (string, error) {
 	if err != nil && err != io.EOF {
 		return "", err
 	}
-	if n < 0 {
-		return "", fmt.Errorf("%s returned negative bytes: %d", path, n)
-	}
 	return strings.TrimSpace(string(buf[:n])), nil
 }
 

beszel.go

@@ -6,7 +6,7 @@ import "github.com/blang/semver"
 
 const (
 	// Version is the current version of the application.
-	Version = "0.18.7"
+	Version = "0.18.5"
 	// AppName is the name of the application.
 	AppName = "beszel"
 )

go.mod

@@ -1,29 +1,28 @@
 module github.com/henrygd/beszel
 
-go 1.26.6
+go 1.26.1
 
 require (
 	github.com/blang/semver v3.5.1+incompatible
 	github.com/coreos/go-systemd/v22 v22.7.0
-	github.com/ebitengine/purego v0.10.2
-	github.com/fxamacker/cbor/v2 v2.9.2
+	github.com/distatus/battery v0.11.0
+	github.com/ebitengine/purego v0.10.0
+	github.com/fxamacker/cbor/v2 v2.9.0
 	github.com/gliderlabs/ssh v0.3.8
 	github.com/google/uuid v1.6.0
-	github.com/lxzan/gws v1.10.1
-	github.com/nicholas-fedor/shoutrrr v0.17.0
+	github.com/lxzan/gws v1.9.1
+	github.com/nicholas-fedor/shoutrrr v0.14.1
 	github.com/pocketbase/dbx v1.12.0
-	github.com/pocketbase/pocketbase v0.39.10
-	github.com/shirou/gopsutil/v4 v4.26.7
+	github.com/pocketbase/pocketbase v0.36.7
+	github.com/shirou/gopsutil/v4 v4.26.2
 	github.com/spf13/cast v1.10.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
-	golang.org/x/crypto v0.55.0
-	golang.org/x/exp v0.0.0-20260811152304-ee035b5b010f
-	golang.org/x/net v0.57.0
-	golang.org/x/sys v0.47.0
+	golang.org/x/crypto v0.49.0
+	golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90
+	golang.org/x/sys v0.42.0
 	gopkg.in/yaml.v3 v3.0.1
-	howett.net/plist v1.0.1
 )
 
 require (
@@ -35,35 +34,36 @@ require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/eclipse/paho.golang v0.23.0 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/fsnotify/fsnotify v1.10.1 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.15 // indirect
-	github.com/ganigeorgiev/fexpr v0.6.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
+	github.com/ganigeorgiev/fexpr v0.5.0 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
+	github.com/go-ozzo/ozzo-validation/v4 v4.3.0 // indirect
 	github.com/go-sql-driver/mysql v1.9.1 // indirect
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/klauspost/compress v1.19.2 // indirect
-	github.com/lufia/plan9stats v0.0.0-20260802145828-341c2f0c90b5 // indirect
-	github.com/mattn/go-colorable v0.1.15 // indirect
-	github.com/mattn/go-isatty v0.0.24 // indirect
+	github.com/klauspost/compress v1.18.5 // indirect
+	github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/pocketbase/ozzo-validation/v4 v4.3.0 // indirect
-	github.com/power-devops/perfstat v0.0.0-20260805114148-88456608a4f6 // indirect
+	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/tklauser/go-sysconf v0.4.0 // indirect
-	github.com/tklauser/numcpus v0.12.0 // indirect
+	github.com/tklauser/go-sysconf v0.3.16 // indirect
+	github.com/tklauser/numcpus v0.11.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	golang.org/x/image v0.45.0 // indirect
+	golang.org/x/image v0.38.0 // indirect
+	golang.org/x/net v0.52.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/term v0.45.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
-	modernc.org/libc v1.74.1 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/term v0.41.0 // indirect
+	golang.org/x/text v0.35.0 // indirect
+	howett.net/plist v1.0.1 // indirect
+	modernc.org/libc v1.70.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.12.0 // indirect
-	modernc.org/sqlite v1.55.0 // indirect
+	modernc.org/memory v1.11.0 // indirect
+	modernc.org/sqlite v1.46.2 // indirect
 )

go.sum

@@ -1,7 +1,7 @@
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
-github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
-github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/asaskevich/govalidator v0.0.0-20200108200545-475eaeb16496/go.mod h1:oGkLhpf+kjZl6xBf758TQhh5XrAeiJv/7FRz/2spLIg=
@@ -17,33 +17,35 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/disintegration/imaging v1.6.2 h1:w1LecBlG2Lnp8B3jk5zSuNqd7b4DXhcjwek1ei82L+c=
 github.com/disintegration/imaging v1.6.2/go.mod h1:44/5580QXChDfwIclfc/PCwrr44amcmDAg8hxG0Ewe4=
+github.com/distatus/battery v0.11.0 h1:KJk89gz90Iq/wJtbjjM9yUzBXV+ASV/EG2WOOL7N8lc=
+github.com/distatus/battery v0.11.0/go.mod h1:KmVkE8A8hpIX4T78QRdMktYpEp35QfOL8A8dwZBxq2k=
 github.com/domodwyer/mailyak/v3 v3.6.2 h1:x3tGMsyFhTCaxp6ycgR0FE/bu5QiNp+hetUuCOBXMn8=
 github.com/domodwyer/mailyak/v3 v3.6.2/go.mod h1:lOm/u9CyCVWHeaAmHIdF4RiKVxKUT/H5XX10lIKAL6c=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/ebitengine/purego v0.10.2 h1:W809HbnvzAxgdm+aOvlSekrM16wGCdT/e76+9tS7gzE=
-github.com/ebitengine/purego v0.10.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/ebitengine/purego v0.10.0 h1:QIw4xfpWT6GWTzaW5XEKy3HXoqrJGx1ijYHzTF0/ISU=
+github.com/ebitengine/purego v0.10.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/eclipse/paho.golang v0.23.0 h1:KHgl2wz6EJo7cMBmkuhpt7C576vP+kpPv7jjvSyR6Mk=
 github.com/eclipse/paho.golang v0.23.0/go.mod h1:nQRhTkoZv8EAiNs5UU0/WdQIx2NrnWUpL9nsGJTQN04=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
-github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
-github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78=
-github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/gabriel-vasile/mimetype v1.4.15 h1:05iP/CYtZ/w455R/KZM6rZ5ieAdh99UPtd+d3YzLmaI=
-github.com/gabriel-vasile/mimetype v1.4.15/go.mod h1:azpTcoLcDZRNgFou5j+APrqQx9HqVPWa6ijYQIIVswQ=
-github.com/ganigeorgiev/fexpr v0.6.0 h1:Fza3O/QMBKEudUvxV862qe6GjxM60GJjjKytdp+VQus=
-github.com/ganigeorgiev/fexpr v0.6.0/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
+github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
+github.com/ganigeorgiev/fexpr v0.5.0 h1:XA9JxtTE/Xm+g/JFI6RfZEHSiQlk+1glLvRK1Lpv/Tk=
+github.com/ganigeorgiev/fexpr v0.5.0/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
-github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
-github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
 github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
+github.com/go-ozzo/ozzo-validation/v4 v4.3.0 h1:byhDUpfEwjsVQb1vBunvIjh2BHQ9ead57VkAEY4V+Es=
+github.com/go-ozzo/ozzo-validation/v4 v4.3.0/go.mod h1:2NKgrcHl3z6cJs+3Oo940FPRiTzuqKbvfrL2RxCj6Ew=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.9.1 h1:FrjNGn/BsJQjVRuSa8CBrM5BWA9BWoXXat3KrtSb/iI=
 github.com/go-sql-driver/mysql v1.9.1/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
@@ -56,8 +58,8 @@ github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArs
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
-github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
+github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc h1:VBbFa1lDYWEeV5FZKUiYKYT0VxCp9twUmmaq9eb8sXw=
+github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
@@ -66,49 +68,47 @@ github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/jarcoal/httpmock v1.4.2 h1:dKwiP/9zITCPfBLsDn3kchbSOu16JrnxtVEmL0fPRcI=
-github.com/jarcoal/httpmock v1.4.2/go.mod h1:ftW1xULwo+j0R0JJkJIIi7UKigZUXCLLanykgjwBXL0=
+github.com/jarcoal/httpmock v1.4.1 h1:0Ju+VCFuARfFlhVXFc2HxlcQkfB+Xq12/EotHko+x2A=
+github.com/jarcoal/httpmock v1.4.1/go.mod h1:ftW1xULwo+j0R0JJkJIIi7UKigZUXCLLanykgjwBXL0=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
-github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8=
-github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/lufia/plan9stats v0.0.0-20260802145828-341c2f0c90b5 h1:eveIIGn4BGM3qknO74omf6HYr30/exH+eVUTuAgwjZ0=
-github.com/lufia/plan9stats v0.0.0-20260802145828-341c2f0c90b5/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
-github.com/lxzan/gws v1.10.1 h1:1xG+tDOV0lgDeVPf0wNT74u3cn0K3LpcavRrTPTrMwQ=
-github.com/lxzan/gws v1.10.1/go.mod h1:gXHSCPmTGryWJ4icuqy8Yho32E4YIMHH0fkDRYJRbdc=
-github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
-github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
-github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749 h1:Qj3hTcdWH8uMZDI41HNuTuJN525C7NBrbtH5kSO6fPk=
+github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
+github.com/lxzan/gws v1.9.1 h1:4lbIp4cW0hOLP3ejFHR/uWRy741AURx7oKkNNi2OT9o=
+github.com/lxzan/gws v1.9.1/go.mod h1:gXHSCPmTGryWJ4icuqy8Yho32E4YIMHH0fkDRYJRbdc=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/nicholas-fedor/shoutrrr v0.17.0 h1:xfp3z5QbE8jXvUhUEwWDk47SJ/b912VoB8MJJDU+q4E=
-github.com/nicholas-fedor/shoutrrr v0.17.0/go.mod h1:s4ldyLs6uwBy9lIjYrY+8lyTqJtPvZSrILw0CyMLock=
-github.com/onsi/ginkgo/v2 v2.32.0 h1:Hw7s2pVrQo/8Yz5N77qdnpHaoc+c6cC9WIV1Jce+J6E=
-github.com/onsi/ginkgo/v2 v2.32.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/nicholas-fedor/shoutrrr v0.14.1 h1:6sx4cJNfNuUtD6ygGlB0dqcCQ+abfsUh+b+6jgujf6A=
+github.com/nicholas-fedor/shoutrrr v0.14.1/go.mod h1:U7IywBkLpBV7rgn8iLbQ9/LklJG1gm24bFv5cXXsDKs=
+github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
+github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
+github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
+github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pocketbase/dbx v1.12.0 h1:/oLErM+A0b4xI0PWTGPqSDVjzix48PqI/bng2l0PzoA=
 github.com/pocketbase/dbx v1.12.0/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
-github.com/pocketbase/ozzo-validation/v4 v4.3.0 h1:uKBDVma7bZqgR2a6AwE+k9hkuDFfiZMpBHQdZ1z3iQs=
-github.com/pocketbase/ozzo-validation/v4 v4.3.0/go.mod h1:6XNjSTw/Jb2F8LOkKO3oyzIWExbrGiYoS4uVxVwz90g=
-github.com/pocketbase/pocketbase v0.39.10 h1:2j8TDJRuo3aAC8Y8F9WFux0SwYcxeDCgEYQxxdWkwGE=
-github.com/pocketbase/pocketbase v0.39.10/go.mod h1:tSX3anHQ7Ul6dPV9WhlEc6No1DtklGF69iwnVNW3BEE=
-github.com/power-devops/perfstat v0.0.0-20260805114148-88456608a4f6 h1:jL3a8soXdzuTCcRnKhOmtcsVOObdDTFf4O2B403HPRU=
-github.com/power-devops/perfstat v0.0.0-20260805114148-88456608a4f6/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
+github.com/pocketbase/pocketbase v0.36.7 h1:MrViB7BptPYrf2Nt25pJEYBqUdFjuhRKu1p5GTrkvPA=
+github.com/pocketbase/pocketbase v0.36.7/go.mod h1:qX4HuVjoKXtEg41fSJVM0JLfGWXbBmHxVv/FaE446r4=
+github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
+github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/shirou/gopsutil/v4 v4.26.7 h1:IXzpHz/dkMRYAhKkOXr1HB6SuzWU3eoyyeWe7g3bNZc=
-github.com/shirou/gopsutil/v4 v4.26.7/go.mod h1:5O9FjBiXoTDFatIWjZZosqj4pV0DRtLx598xGbBehzM=
+github.com/shirou/gopsutil/v4 v4.26.2 h1:X8i6sicvUFih4BmYIGT1m2wwgw2VG9YgrDTi7cIRGUI=
+github.com/shirou/gopsutil/v4 v4.26.2/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
 github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
@@ -122,51 +122,51 @@ github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+Q
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/tklauser/go-sysconf v0.4.0 h1:7H0uAN+7RkwWRaxhYXDLqa5V3LPrJeV8wmD9dRUgPQU=
-github.com/tklauser/go-sysconf v0.4.0/go.mod h1:8mTNWyog7H+MpKijp4VmKJAd2bbYQ2zuUwkYRbUArPI=
-github.com/tklauser/numcpus v0.12.0 h1:NR85qdvHA9pFse3x3weVZ0r0ST8R6l5RHbZrlRaqob4=
-github.com/tklauser/numcpus v0.12.0/go.mod h1:ABHeXzJnr/qqwguhClkZKT1/8VABcYrsyUiUGobwWJg=
+github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
+github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
+github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=
+github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
-go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/exp v0.0.0-20260811152304-ee035b5b010f h1:iXpLj9sdDH/RLYsnOMpbETK6KWtrHwvegcc4psWJHV8=
-golang.org/x/exp v0.0.0-20260811152304-ee035b5b010f/go.mod h1:EdfpwwqSu+0Li0mzskwHU6FWDV3t9Q+RZDo3QMUtL3Q=
+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
+golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 h1:jiDhWWeC7jfWqR9c/uplMOqJ0sbNlNWv0UkzE0vX1MA=
+golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90/go.mod h1:xE1HEv6b+1SCZ5/uscMRjUBKtIxworgEcEi+/n9NQDQ=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.45.0 h1:FMb1nTbH5H9vF55SriQHgFw5GnNL9Jg6L25BwXKzhB0=
-golang.org/x/image v0.45.0/go.mod h1:n62x/7RqlwXDvGsSU4u6IUTUf6KghUZ9Bt7cG/T9Fx4=
-golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
-golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
+golang.org/x/image v0.38.0 h1:5l+q+Y9JDC7mBOMjo4/aPhMDcxEptsX+Tt3GgRQRPuE=
+golang.org/x/image v0.38.0/go.mod h1:/3f6vaXC+6CEanU4KJxbcUZyEePbyKbaLoDOe4ehFYY=
+golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
+golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
+golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
+golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
+golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
-golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
+golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
+golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -177,30 +177,30 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
 howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
-modernc.org/cc/v4 v4.29.0 h1:CXgwL8cvxmyzBQZzbSl/6xFtMCryb6u8IOqDci39cgc=
-modernc.org/cc/v4 v4.29.0/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v4 v4.34.6 h1:sBgfIwyN0TQ9C5hwIeuqyeAKyMWnbvj2fvpF4L11uzU=
-modernc.org/ccgo/v4 v4.34.6/go.mod h1:SZ8YcN9NG7XVsQYdm6jYBvi8PQP1qi+kqB6OhjqI3Fk=
+modernc.org/cc/v4 v4.27.1 h1:9W30zRlYrefrDV2JE2O8VDtJ1yPGownxciz5rrbQZis=
+modernc.org/cc/v4 v4.27.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.32.0 h1:hjG66bI/kqIPX1b2yT6fr/jt+QedtP2fqojG2VrFuVw=
+modernc.org/ccgo/v4 v4.32.0/go.mod h1:6F08EBCx5uQc38kMGl+0Nm0oWczoo1c7cgpzEry7Uc0=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.4 h1:2g65LGVSmFQrXeITAw97x7hCRvZFcyE1uDP+7Vng7JI=
-modernc.org/gc/v3 v3.1.4/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
+modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.74.1 h1:bdR4VTKFMC4966QSNZ05XLGI/VwzVa2kTUX51Dm0riQ=
-modernc.org/libc v1.74.1/go.mod h1:uH4t5bOx3G3g9Xcmj10YKlTcVISlRDwv8VoQJG9n8Os=
+modernc.org/libc v1.70.0 h1:U58NawXqXbgpZ/dcdS9kMshu08aiA6b7gusEusqzNkw=
+modernc.org/libc v1.70.0/go.mod h1:OVmxFGP1CI/Z4L3E0Q3Mf1PDE0BucwMkcXjjLntvHJo=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.12.0 h1:twkmYNkGXCvtYWzoux02jtK6eovjZbdI0uHFUYp6kuU=
-modernc.org/memory v1.12.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
-modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
-modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.55.0 h1:hIFh0MCH0rGinQ/4KYb5/UbCkRkb+UP+OkLCVWa5MTM=
-modernc.org/sqlite v1.55.0/go.mod h1:4ntCLuNmnH8+GNqjka1wNg7KJd5/Hi5FYp8K+XQ7GZw=
+modernc.org/sqlite v1.46.2 h1:gkXQ6R0+AjxFC/fTDaeIVLbNLNrRoOK7YYVz5BKhTcE=
+modernc.org/sqlite v1.46.2/go.mod h1:hWjRO6Tj/5Ik8ieqxQybiEOUXy0NJFNp2tpvVpKlvig=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

internal/alerts/alerts.go

@@ -55,7 +55,6 @@ type SystemAlertStats struct {
 	Temperatures map[string]float32            `json:"t"`
 	LoadAvg      [3]float64                    `json:"la"`
 	Battery      [2]uint8                      `json:"bat"`
-	Batteries    map[string]uint8              `json:"bats"`
 	ExtraFs      map[string]SystemAlertFsStats `json:"efs"`
 }
 
@@ -303,6 +302,21 @@ func (am *AlertManager) SendShoutrrrAlert(notificationUrl, title, message, link,
 	return nil
 }
 
+func (am *AlertManager) SendTestNotification(e *core.RequestEvent) error {
+	var data struct {
+		URL string `json:"url"`
+	}
+	err := e.BindBody(&data)
+	if err != nil || data.URL == "" {
+		return e.BadRequestError("URL is required", err)
+	}
+	err = am.SendShoutrrrAlert(data.URL, "Test Alert", "This is a notification from Beszel.", am.hub.Settings().Meta.AppURL, "View Beszel")
+	if err != nil {
+		return e.JSON(200, map[string]string{"err": err.Error()})
+	}
+	return e.JSON(200, map[string]bool{"err": false})
+}
+
 // setAlertTriggered updates the "triggered" status of an alert record in the database
 func (am *AlertManager) setAlertTriggered(alert CachedAlertData, triggered bool) error {
 	alertRecord, err := am.hub.FindRecordById("alerts", alert.Id)

internal/alerts/alerts_api.go

@@ -3,11 +3,7 @@ package alerts
 import (
 	"database/sql"
 	"errors"
-	"net"
 	"net/http"
-	"net/url"
-	"slices"
-	"strings"
 
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
@@ -121,72 +117,3 @@ func DeleteUserAlerts(e *core.RequestEvent) error {
 
 	return e.JSON(http.StatusOK, map[string]any{"success": true, "count": numDeleted})
 }
-
-// SendTestNotification handles API request to send a test notification to a specified Shoutrrr URL
-func (am *AlertManager) SendTestNotification(e *core.RequestEvent) error {
-	var data struct {
-		URL string `json:"url"`
-	}
-	err := e.BindBody(&data)
-	if err != nil || data.URL == "" {
-		return e.BadRequestError("URL is required", err)
-	}
-	// Only allow admins to send test notifications to internal URLs
-	if !e.Auth.IsSuperuser() && e.Auth.GetString("role") != "admin" {
-		internalURL, err := isInternalURL(data.URL)
-		if err != nil {
-			return e.BadRequestError(err.Error(), nil)
-		}
-		if internalURL {
-			return e.ForbiddenError("Only admins can send to internal destinations", nil)
-		}
-	}
-	err = am.SendShoutrrrAlert(data.URL, "Test Alert", "This is a notification from Beszel.", am.hub.Settings().Meta.AppURL, "View Beszel")
-	if err != nil {
-		return e.JSON(200, map[string]string{"err": err.Error()})
-	}
-	return e.JSON(200, map[string]bool{"err": false})
-}
-
-// isInternalURL checks if the given shoutrrr URL points to an internal destination (localhost or private IP)
-func isInternalURL(rawURL string) (bool, error) {
-	parsedURL, err := url.Parse(rawURL)
-	if err != nil {
-		return false, err
-	}
-
-	host := parsedURL.Hostname()
-	if host == "" {
-		return false, nil
-	}
-
-	if strings.EqualFold(host, "localhost") {
-		return true, nil
-	}
-
-	if ip := net.ParseIP(host); ip != nil {
-		return isInternalIP(ip), nil
-	}
-
-	// Some Shoutrrr URLs use the host position for service identifiers rather than a
-	// network hostname (for example, discord://token@webhookid). Restrict DNS lookups
-	// to names that look like actual hostnames so valid service URLs keep working.
-	if !strings.Contains(host, ".") {
-		return false, nil
-	}
-
-	ips, err := net.LookupIP(host)
-	if err != nil {
-		return false, nil
-	}
-
-	if slices.ContainsFunc(ips, isInternalIP) {
-		return true, nil
-	}
-
-	return false, nil
-}
-
-func isInternalIP(ip net.IP) bool {
-	return ip.IsPrivate() || ip.IsLoopback() || ip.IsUnspecified()
-}

internal/alerts/alerts_api_test.go

@@ -1,501 +0,0 @@
-//go:build testing
-
-package alerts_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"io"
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/henrygd/beszel/internal/alerts"
-	beszelTests "github.com/henrygd/beszel/internal/tests"
-	pbTests "github.com/pocketbase/pocketbase/tests"
-
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/core"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// marshal to json and return an io.Reader (for use in ApiScenario.Body)
-func jsonReader(v any) io.Reader {
-	data, err := json.Marshal(v)
-	if err != nil {
-		panic(err)
-	}
-	return bytes.NewReader(data)
-}
-
-func TestIsInternalURL(t *testing.T) {
-	testCases := []struct {
-		name     string
-		url      string
-		internal bool
-	}{
-		{name: "loopback ipv4", url: "generic://127.0.0.1", internal: true},
-		{name: "localhost hostname", url: "generic://localhost", internal: true},
-		{name: "localhost hostname", url: "generic+http://localhost/api/v1/postStuff", internal: true},
-		{name: "localhost hostname", url: "generic+http://127.0.0.1:8080/api/v1/postStuff", internal: true},
-		{name: "localhost hostname", url: "generic+https://beszel.dev/api/v1/postStuff", internal: false},
-		{name: "public ipv4", url: "generic://8.8.8.8", internal: false},
-		{name: "token style service url", url: "discord://abc123@123456789", internal: false},
-		{name: "single label service url", url: "slack://token@team/channel", internal: false},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			internal, err := alerts.IsInternalURL(testCase.url)
-			assert.NoError(t, err)
-			assert.Equal(t, testCase.internal, internal)
-		})
-	}
-}
-
-func TestUserAlertsApi(t *testing.T) {
-	hub, _ := beszelTests.NewTestHub(t.TempDir())
-	defer hub.Cleanup()
-
-	hub.StartHub()
-
-	user1, _ := beszelTests.CreateUser(hub, "alertstest@example.com", "password")
-	user1Token, _ := user1.NewAuthToken()
-
-	user2, _ := beszelTests.CreateUser(hub, "alertstest2@example.com", "password")
-	user2Token, _ := user2.NewAuthToken()
-
-	system1, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
-		"name":  "system1",
-		"users": []string{user1.Id},
-		"host":  "127.0.0.1",
-	})
-
-	system2, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
-		"name":  "system2",
-		"users": []string{user1.Id, user2.Id},
-		"host":  "127.0.0.2",
-	})
-
-	userRecords, _ := hub.CountRecords("users")
-	assert.EqualValues(t, 2, userRecords, "all users should be created")
-
-	systemRecords, _ := hub.CountRecords("systems")
-	assert.EqualValues(t, 2, systemRecords, "all systems should be created")
-
-	testAppFactory := func(t testing.TB) *pbTests.TestApp {
-		return hub.TestApp
-	}
-
-	scenarios := []beszelTests.ApiScenario{
-		// {
-		// 	Name:            "GET not implemented - returns index",
-		// 	Method:          http.MethodGet,
-		// 	URL:             "/api/beszel/user-alerts",
-		// 	ExpectedStatus:  200,
-		// 	ExpectedContent: []string{"<html ", "globalThis.BESZEL"},
-		// 	TestAppFactory:  testAppFactory,
-		// },
-		{
-			Name:            "POST no auth",
-			Method:          http.MethodPost,
-			URL:             "/api/beszel/user-alerts",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST no body",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Bad data"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST bad data",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Bad data"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"invalidField": "this should cause validation error",
-				"threshold":    "not a number",
-			}),
-		},
-		{
-			Name:   "POST malformed JSON",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Bad data"},
-			TestAppFactory:  testAppFactory,
-			Body:            strings.NewReader(`{"alertType": "cpu", "threshold": 80, "enabled": true,}`),
-		},
-		{
-			Name:   "POST valid alert data multiple systems",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":      "CPU",
-				"value":     69,
-				"min":       9,
-				"systems":   []string{system1.Id, system2.Id},
-				"overwrite": false,
-			}),
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				// check total alerts
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
-				// check alert has correct values
-				matchingAlerts, _ := app.CountRecords("alerts", dbx.HashExp{"name": "CPU", "user": user1.Id, "system": system1.Id, "value": 69, "min": 9})
-				assert.EqualValues(t, 1, matchingAlerts, "should have 1 alert")
-			},
-		},
-		{
-			Name:   "POST valid alert data single system",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "Memory",
-				"systems": []string{system1.Id},
-				"value":   90,
-				"min":     10,
-			}),
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				user1Alerts, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
-				assert.EqualValues(t, 3, user1Alerts, "should have 3 alerts")
-			},
-		},
-		{
-			Name:   "Overwrite: false, should not overwrite existing alert",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":      "CPU",
-				"value":     45,
-				"min":       5,
-				"systems":   []string{system1.Id},
-				"overwrite": false,
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				beszelTests.CreateRecord(app, "alerts", map[string]any{
-					"name":   "CPU",
-					"system": system1.Id,
-					"user":   user1.Id,
-					"value":  80,
-					"min":    10,
-				})
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 1, alerts, "should have 1 alert")
-				alert, _ := app.FindFirstRecordByFilter("alerts", "name = 'CPU' && user = {:user}", dbx.Params{"user": user1.Id})
-				assert.EqualValues(t, 80, alert.Get("value"), "should have 80 as value")
-			},
-		},
-		{
-			Name:   "Overwrite: true, should overwrite existing alert",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":      "CPU",
-				"value":     45,
-				"min":       5,
-				"systems":   []string{system2.Id},
-				"overwrite": true,
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				beszelTests.CreateRecord(app, "alerts", map[string]any{
-					"name":   "CPU",
-					"system": system2.Id,
-					"user":   user2.Id,
-					"value":  80,
-					"min":    10,
-				})
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 1, alerts, "should have 1 alert")
-				alert, _ := app.FindFirstRecordByFilter("alerts", "name = 'CPU' && user = {:user}", dbx.Params{"user": user2.Id})
-				assert.EqualValues(t, 45, alert.Get("value"), "should have 45 as value")
-			},
-		},
-		{
-			Name:            "DELETE no auth",
-			Method:          http.MethodDelete,
-			URL:             "/api/beszel/user-alerts",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "CPU",
-				"systems": []string{system1.Id},
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				beszelTests.CreateRecord(app, "alerts", map[string]any{
-					"name":   "CPU",
-					"system": system1.Id,
-					"user":   user1.Id,
-					"value":  80,
-					"min":    10,
-				})
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 1, alerts, "should have 1 alert")
-			},
-		},
-		{
-			Name:   "DELETE alert",
-			Method: http.MethodDelete,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"count\":1", "\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "CPU",
-				"systems": []string{system1.Id},
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				beszelTests.CreateRecord(app, "alerts", map[string]any{
-					"name":   "CPU",
-					"system": system1.Id,
-					"user":   user1.Id,
-					"value":  80,
-					"min":    10,
-				})
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.Zero(t, alerts, "should have 0 alerts")
-			},
-		},
-		{
-			Name:   "DELETE alert multiple systems",
-			Method: http.MethodDelete,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"count\":2", "\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "Memory",
-				"systems": []string{system1.Id, system2.Id},
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				for _, systemId := range []string{system1.Id, system2.Id} {
-					_, err := beszelTests.CreateRecord(app, "alerts", map[string]any{
-						"name":   "Memory",
-						"system": systemId,
-						"user":   user1.Id,
-						"value":  90,
-						"min":    10,
-					})
-					assert.NoError(t, err, "should create alert")
-				}
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.Zero(t, alerts, "should have 0 alerts")
-			},
-		},
-		{
-			Name:   "User 2 should not be able to delete alert of user 1",
-			Method: http.MethodDelete,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"count\":1", "\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "CPU",
-				"systems": []string{system2.Id},
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				for _, user := range []string{user1.Id, user2.Id} {
-					beszelTests.CreateRecord(app, "alerts", map[string]any{
-						"name":   "CPU",
-						"system": system2.Id,
-						"user":   user,
-						"value":  80,
-						"min":    10,
-					})
-				}
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
-				user1AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
-				assert.EqualValues(t, 1, user1AlertCount, "should have 1 alert")
-				user2AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user2.Id})
-				assert.EqualValues(t, 1, user2AlertCount, "should have 1 alert")
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				user1AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
-				assert.EqualValues(t, 1, user1AlertCount, "should have 1 alert")
-				user2AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user2.Id})
-				assert.Zero(t, user2AlertCount, "should have 0 alerts")
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-func TestSendTestNotification(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-	defer hub.Cleanup()
-
-	userToken, err := user.NewAuthToken()
-
-	adminUser, err := beszelTests.CreateUserWithRole(hub, "admin@example.com", "password123", "admin")
-	assert.NoError(t, err, "Failed to create admin user")
-	adminUserToken, err := adminUser.NewAuthToken()
-
-	superuser, err := beszelTests.CreateSuperuser(hub, "superuser@example.com", "password123")
-	assert.NoError(t, err, "Failed to create superuser")
-	superuserToken, err := superuser.NewAuthToken()
-	assert.NoError(t, err, "Failed to create superuser auth token")
-
-	testAppFactory := func(t testing.TB) *pbTests.TestApp {
-		return hub.TestApp
-	}
-
-	scenarios := []beszelTests.ApiScenario{
-		{
-			Name:            "POST /test-notification - no auth should fail",
-			Method:          http.MethodPost,
-			URL:             "/api/beszel/test-notification",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"url": "generic://127.0.0.1",
-			}),
-		},
-		{
-			Name:           "POST /test-notification - with external auth should succeed",
-			Method:         http.MethodPost,
-			URL:            "/api/beszel/test-notification",
-			TestAppFactory: testAppFactory,
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			Body: jsonReader(map[string]any{
-				"url": "generic://8.8.8.8",
-			}),
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"err\":"},
-		},
-		{
-			Name:           "POST /test-notification - local url with user auth should fail",
-			Method:         http.MethodPost,
-			URL:            "/api/beszel/test-notification",
-			TestAppFactory: testAppFactory,
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			Body: jsonReader(map[string]any{
-				"url": "generic://localhost:8010",
-			}),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{"Only admins"},
-		},
-		{
-			Name:           "POST /test-notification - internal url with user auth should fail",
-			Method:         http.MethodPost,
-			URL:            "/api/beszel/test-notification",
-			TestAppFactory: testAppFactory,
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			Body: jsonReader(map[string]any{
-				"url": "generic+http://192.168.0.5",
-			}),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{"Only admins"},
-		},
-		{
-			Name:           "POST /test-notification - internal url with admin auth should succeed",
-			Method:         http.MethodPost,
-			URL:            "/api/beszel/test-notification",
-			TestAppFactory: testAppFactory,
-			Headers: map[string]string{
-				"Authorization": adminUserToken,
-			},
-			Body: jsonReader(map[string]any{
-				"url": "generic://127.0.0.1",
-			}),
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"err\":"},
-		},
-		{
-			Name:           "POST /test-notification - internal url with superuser auth should succeed",
-			Method:         http.MethodPost,
-			URL:            "/api/beszel/test-notification",
-			TestAppFactory: testAppFactory,
-			Headers: map[string]string{
-				"Authorization": superuserToken,
-			},
-			Body: jsonReader(map[string]any{
-				"url": "generic://127.0.0.1",
-			}),
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"err\":"},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

internal/alerts/alerts_quiet_hours_test.go

@@ -322,9 +322,8 @@ func TestAlertSilencedMultiUser(t *testing.T) {
 }
 
 func TestAlertSilencedWithActualAlert(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-
 	synctest.Test(t, func(t *testing.T) {
+		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		// Create a system

internal/alerts/alerts_status.go

@@ -109,18 +109,6 @@ func (am *AlertManager) cancelPendingAlert(alertID string) bool {
 	return true
 }
 
-// CancelPendingStatusAlerts cancels all pending status alert timers for a given system.
-// This is called when a system is paused to prevent delayed alerts from firing.
-func (am *AlertManager) CancelPendingStatusAlerts(systemID string) {
-	am.pendingAlerts.Range(func(key, value any) bool {
-		info := value.(*alertInfo)
-		if info.alertData.SystemID == systemID {
-			am.cancelPendingAlert(key.(string))
-		}
-		return true
-	})
-}
-
 // processPendingAlert sends a "down" alert if the pending alert has expired and the system is still down.
 func (am *AlertManager) processPendingAlert(alertID string) {
 	value, loaded := am.pendingAlerts.LoadAndDelete(alertID)

internal/alerts/alerts_status_test.go

@@ -29,9 +29,8 @@ func setStatusAlertEmail(t *testing.T, hub core.App, userID, email string) {
 }
 
 func TestStatusAlerts(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-
 	synctest.Test(t, func(t *testing.T) {
+		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		systems, err := beszelTests.CreateSystems(hub, 4, user.Id, "paused")
@@ -235,9 +234,8 @@ func TestHandleStatusAlertsDoesNotSendRecoveryWhileDownIsOnlyPending(t *testing.
 }
 
 func TestStatusAlertTimerCancellationPreventsBoundaryDelivery(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-
 	synctest.Test(t, func(t *testing.T) {
+		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		userSettings, err := hub.FindFirstRecordByFilter("user_settings", "user={:user}", map[string]any{"user": user.Id})
@@ -338,9 +336,8 @@ func TestStatusAlertDownFiresAfterDelayExpires(t *testing.T) {
 }
 
 func TestStatusAlertMultipleUsersRespectDifferentMinutes(t *testing.T) {
-	hub, user1 := beszelTests.GetHubWithUser(t)
-
 	synctest.Test(t, func(t *testing.T) {
+		hub, user1 := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		setStatusAlertEmail(t, hub, user1.Id, "user1@example.com")
@@ -426,9 +423,8 @@ func TestStatusAlertMultipleUsersRespectDifferentMinutes(t *testing.T) {
 }
 
 func TestStatusAlertMultipleUsersRecoveryBetweenMinutesOnlyAlertsEarlierUser(t *testing.T) {
-	hub, user1 := beszelTests.GetHubWithUser(t)
-
 	synctest.Test(t, func(t *testing.T) {
+		hub, user1 := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		setStatusAlertEmail(t, hub, user1.Id, "user1@example.com")
@@ -820,9 +816,8 @@ func TestResolveStatusAlerts(t *testing.T) {
 }
 
 func TestAlertsHistoryStatus(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-
 	synctest.Test(t, func(t *testing.T) {
+		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		// Create a system
@@ -887,9 +882,8 @@ func TestAlertsHistoryStatus(t *testing.T) {
 }
 
 func TestStatusAlertClearedBeforeSend(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-
 	synctest.Test(t, func(t *testing.T) {
+		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		// Create a system
@@ -947,68 +941,3 @@ func TestStatusAlertClearedBeforeSend(t *testing.T) {
 		assert.EqualValues(t, 0, alertHistoryCount, "Should have no unresolved alert history records since alert never triggered")
 	})
 }
-
-func TestCancelPendingStatusAlertsClearsAllAlertsForSystem(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-	defer hub.Cleanup()
-
-	userSettings, err := hub.FindFirstRecordByFilter("user_settings", "user={:user}", map[string]any{"user": user.Id})
-	require.NoError(t, err)
-	userSettings.Set("settings", `{"emails":["test@example.com"],"webhooks":[]}`)
-	require.NoError(t, hub.Save(userSettings))
-
-	systemCollection, err := hub.FindCollectionByNameOrId("systems")
-	require.NoError(t, err)
-
-	system1 := core.NewRecord(systemCollection)
-	system1.Set("name", "system-1")
-	system1.Set("status", "up")
-	system1.Set("host", "127.0.0.1")
-	system1.Set("users", []string{user.Id})
-	require.NoError(t, hub.Save(system1))
-
-	system2 := core.NewRecord(systemCollection)
-	system2.Set("name", "system-2")
-	system2.Set("status", "up")
-	system2.Set("host", "127.0.0.2")
-	system2.Set("users", []string{user.Id})
-	require.NoError(t, hub.Save(system2))
-
-	alertCollection, err := hub.FindCollectionByNameOrId("alerts")
-	require.NoError(t, err)
-
-	alert1 := core.NewRecord(alertCollection)
-	alert1.Set("user", user.Id)
-	alert1.Set("system", system1.Id)
-	alert1.Set("name", "Status")
-	alert1.Set("triggered", false)
-	alert1.Set("min", 5)
-	require.NoError(t, hub.Save(alert1))
-
-	alert2 := core.NewRecord(alertCollection)
-	alert2.Set("user", user.Id)
-	alert2.Set("system", system2.Id)
-	alert2.Set("name", "Status")
-	alert2.Set("triggered", false)
-	alert2.Set("min", 5)
-	require.NoError(t, hub.Save(alert2))
-
-	am := alerts.NewTestAlertManagerWithoutWorker(hub)
-	initialEmailCount := hub.TestMailer.TotalSend()
-
-	// Both systems go down
-	require.NoError(t, am.HandleStatusAlerts("down", system1))
-	require.NoError(t, am.HandleStatusAlerts("down", system2))
-	assert.Equal(t, 2, am.GetPendingAlertsCount(), "both systems should have pending alerts")
-
-	// System 1 is paused — cancel its pending alerts
-	am.CancelPendingStatusAlerts(system1.Id)
-	assert.Equal(t, 1, am.GetPendingAlertsCount(), "only system2 alert should remain pending after pausing system1")
-
-	// Expire and process remaining alerts — only system2 should fire
-	am.ForceExpirePendingAlerts()
-	processed, err := am.ProcessPendingAlerts()
-	require.NoError(t, err)
-	assert.Len(t, processed, 1, "only the non-paused system's alert should be processed")
-	assert.Equal(t, initialEmailCount+1, hub.TestMailer.TotalSend(), "only system2 should send a down notification")
-}

internal/alerts/alerts_system.go

@@ -63,7 +63,7 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 		case "GPU":
 			val = data.Info.GpuPct
 		case "Battery":
-			if !hasRepresentativeBattery(data.Stats.Battery, data.Stats.Batteries) {
+			if data.Stats.Battery[0] == 0 {
 				continue
 			}
 			val = float64(data.Stats.Battery[0])
@@ -167,7 +167,6 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 		stat := systemStats[i]
 		// subtract 10 seconds to give a small time buffer
 		systemStatsCreation := stat.Created.Time().Add(-time.Second * 10)
-		stats = SystemAlertStats{}
 		if err := json.Unmarshal(stat.Stats, &stats); err != nil {
 			return err
 		}
@@ -236,9 +235,6 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 				}
 				alert.val += maxUsage
 			case "Battery":
-				if !hasRepresentativeBattery(stats.Battery, stats.Batteries) {
-					continue
-				}
 				alert.val += float64(stats.Battery[0])
 			default:
 				continue
@@ -301,10 +297,6 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 	return nil
 }
 
-func hasRepresentativeBattery(legacy [2]uint8, batteries map[string]uint8) bool {
-	return legacy != [2]uint8{} || len(batteries) > 0
-}
-
 func (am *AlertManager) sendSystemAlert(alert SystemAlertData) {
 	// log.Printf("Sending alert %s: val %f | count %d | threshold %f\n", alert.name, alert.val, alert.count, alert.threshold)
 	systemName := alert.systemRecord.GetString("name")

internal/alerts/alerts_system_test.go

@@ -95,10 +95,11 @@ func waitForSystemAlert(d time.Duration) {
 
 func testOneMinuteSystemAlert[T any](t *testing.T, alertName string, threshold float64, setValue systemAlertValueSetter[T], triggerValue, resolveValue T) {
 	t.Helper()
-	fixture := newSystemAlertTestFixture(t, alertName, 1, threshold)
-	defer fixture.cleanup()
 
 	synctest.Test(t, func(t *testing.T) {
+		fixture := newSystemAlertTestFixture(t, alertName, 1, threshold)
+		defer fixture.cleanup()
+
 		submitValue(fixture, t, triggerValue, setValue)
 		waitForSystemAlert(time.Second)
 
@@ -117,10 +118,11 @@ func testOneMinuteSystemAlert[T any](t *testing.T, alertName string, threshold f
 
 func testMultiMinuteSystemAlert[T any](t *testing.T, alertName string, threshold float64, min int, setValue systemAlertValueSetter[T], baselineValue, triggerValue, resolveValue T) {
 	t.Helper()
-	fixture := newSystemAlertTestFixture(t, alertName, min, threshold)
-	defer fixture.cleanup()
 
 	synctest.Test(t, func(t *testing.T) {
+		fixture := newSystemAlertTestFixture(t, alertName, min, threshold)
+		defer fixture.cleanup()
+
 		submitValue(fixture, t, baselineValue, setValue)
 		waitForSystemAlert(time.Minute + time.Second)
 		fixture.assertTriggered(t, false, "Alert should not be triggered yet")
@@ -199,7 +201,7 @@ func TestSystemAlertsOneMin(t *testing.T) {
 	testOneMinuteSystemAlert(t, "LoadAvg1", 4, setLoadAvgAlertValue, [3]float64{4.1, 0, 0}, [3]float64{3.9, 0, 0})
 	testOneMinuteSystemAlert(t, "LoadAvg5", 4, setLoadAvgAlertValue, [3]float64{0, 4.1, 0}, [3]float64{0, 3.9, 0})
 	testOneMinuteSystemAlert(t, "LoadAvg15", 4, setLoadAvgAlertValue, [3]float64{0, 0, 4.1}, [3]float64{0, 0, 3.9})
-	testOneMinuteSystemAlert(t, "Battery", 20, setBatteryAlertValue, [2]uint8{0, 1}, [2]uint8{21, 0})
+	testOneMinuteSystemAlert(t, "Battery", 20, setBatteryAlertValue, [2]uint8{19, 0}, [2]uint8{21, 0})
 }
 
 func TestSystemAlertsTwoMin(t *testing.T) {

internal/alerts/alerts_test.go

@@ -3,6 +3,11 @@
 package alerts_test
 
 import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
 	"testing"
 	"testing/synctest"
 	"time"
@@ -11,13 +16,362 @@ import (
 
 	"github.com/henrygd/beszel/internal/alerts"
 	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	pbTests "github.com/pocketbase/pocketbase/tests"
 	"github.com/stretchr/testify/assert"
 )
 
-func TestAlertsHistory(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
+// marshal to json and return an io.Reader (for use in ApiScenario.Body)
+func jsonReader(v any) io.Reader {
+	data, err := json.Marshal(v)
+	if err != nil {
+		panic(err)
+	}
+	return bytes.NewReader(data)
+}
 
+func TestUserAlertsApi(t *testing.T) {
+	hub, _ := beszelTests.NewTestHub(t.TempDir())
+	defer hub.Cleanup()
+
+	hub.StartHub()
+
+	user1, _ := beszelTests.CreateUser(hub, "alertstest@example.com", "password")
+	user1Token, _ := user1.NewAuthToken()
+
+	user2, _ := beszelTests.CreateUser(hub, "alertstest2@example.com", "password")
+	user2Token, _ := user2.NewAuthToken()
+
+	system1, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "system1",
+		"users": []string{user1.Id},
+		"host":  "127.0.0.1",
+	})
+
+	system2, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "system2",
+		"users": []string{user1.Id, user2.Id},
+		"host":  "127.0.0.2",
+	})
+
+	userRecords, _ := hub.CountRecords("users")
+	assert.EqualValues(t, 2, userRecords, "all users should be created")
+
+	systemRecords, _ := hub.CountRecords("systems")
+	assert.EqualValues(t, 2, systemRecords, "all systems should be created")
+
+	testAppFactory := func(t testing.TB) *pbTests.TestApp {
+		return hub.TestApp
+	}
+
+	scenarios := []beszelTests.ApiScenario{
+		// {
+		// 	Name:            "GET not implemented - returns index",
+		// 	Method:          http.MethodGet,
+		// 	URL:             "/api/beszel/user-alerts",
+		// 	ExpectedStatus:  200,
+		// 	ExpectedContent: []string{"<html ", "globalThis.BESZEL"},
+		// 	TestAppFactory:  testAppFactory,
+		// },
+		{
+			Name:            "POST no auth",
+			Method:          http.MethodPost,
+			URL:             "/api/beszel/user-alerts",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "POST no body",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"Bad data"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "POST bad data",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"Bad data"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"invalidField": "this should cause validation error",
+				"threshold":    "not a number",
+			}),
+		},
+		{
+			Name:   "POST malformed JSON",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"Bad data"},
+			TestAppFactory:  testAppFactory,
+			Body:            strings.NewReader(`{"alertType": "cpu", "threshold": 80, "enabled": true,}`),
+		},
+		{
+			Name:   "POST valid alert data multiple systems",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":      "CPU",
+				"value":     69,
+				"min":       9,
+				"systems":   []string{system1.Id, system2.Id},
+				"overwrite": false,
+			}),
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				// check total alerts
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
+				// check alert has correct values
+				matchingAlerts, _ := app.CountRecords("alerts", dbx.HashExp{"name": "CPU", "user": user1.Id, "system": system1.Id, "value": 69, "min": 9})
+				assert.EqualValues(t, 1, matchingAlerts, "should have 1 alert")
+			},
+		},
+		{
+			Name:   "POST valid alert data single system",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "Memory",
+				"systems": []string{system1.Id},
+				"value":   90,
+				"min":     10,
+			}),
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				user1Alerts, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
+				assert.EqualValues(t, 3, user1Alerts, "should have 3 alerts")
+			},
+		},
+		{
+			Name:   "Overwrite: false, should not overwrite existing alert",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":      "CPU",
+				"value":     45,
+				"min":       5,
+				"systems":   []string{system1.Id},
+				"overwrite": false,
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name":   "CPU",
+					"system": system1.Id,
+					"user":   user1.Id,
+					"value":  80,
+					"min":    10,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 1, alerts, "should have 1 alert")
+				alert, _ := app.FindFirstRecordByFilter("alerts", "name = 'CPU' && user = {:user}", dbx.Params{"user": user1.Id})
+				assert.EqualValues(t, 80, alert.Get("value"), "should have 80 as value")
+			},
+		},
+		{
+			Name:   "Overwrite: true, should overwrite existing alert",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user2Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":      "CPU",
+				"value":     45,
+				"min":       5,
+				"systems":   []string{system2.Id},
+				"overwrite": true,
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name":   "CPU",
+					"system": system2.Id,
+					"user":   user2.Id,
+					"value":  80,
+					"min":    10,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 1, alerts, "should have 1 alert")
+				alert, _ := app.FindFirstRecordByFilter("alerts", "name = 'CPU' && user = {:user}", dbx.Params{"user": user2.Id})
+				assert.EqualValues(t, 45, alert.Get("value"), "should have 45 as value")
+			},
+		},
+		{
+			Name:            "DELETE no auth",
+			Method:          http.MethodDelete,
+			URL:             "/api/beszel/user-alerts",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system1.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name":   "CPU",
+					"system": system1.Id,
+					"user":   user1.Id,
+					"value":  80,
+					"min":    10,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 1, alerts, "should have 1 alert")
+			},
+		},
+		{
+			Name:   "DELETE alert",
+			Method: http.MethodDelete,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"count\":1", "\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system1.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name":   "CPU",
+					"system": system1.Id,
+					"user":   user1.Id,
+					"value":  80,
+					"min":    10,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.Zero(t, alerts, "should have 0 alerts")
+			},
+		},
+		{
+			Name:   "DELETE alert multiple systems",
+			Method: http.MethodDelete,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"count\":2", "\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "Memory",
+				"systems": []string{system1.Id, system2.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				for _, systemId := range []string{system1.Id, system2.Id} {
+					_, err := beszelTests.CreateRecord(app, "alerts", map[string]any{
+						"name":   "Memory",
+						"system": systemId,
+						"user":   user1.Id,
+						"value":  90,
+						"min":    10,
+					})
+					assert.NoError(t, err, "should create alert")
+				}
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.Zero(t, alerts, "should have 0 alerts")
+			},
+		},
+		{
+			Name:   "User 2 should not be able to delete alert of user 1",
+			Method: http.MethodDelete,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user2Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"count\":1", "\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system2.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				for _, user := range []string{user1.Id, user2.Id} {
+					beszelTests.CreateRecord(app, "alerts", map[string]any{
+						"name":   "CPU",
+						"system": system2.Id,
+						"user":   user,
+						"value":  80,
+						"min":    10,
+					})
+				}
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
+				user1AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
+				assert.EqualValues(t, 1, user1AlertCount, "should have 1 alert")
+				user2AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user2.Id})
+				assert.EqualValues(t, 1, user2AlertCount, "should have 1 alert")
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				user1AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
+				assert.EqualValues(t, 1, user1AlertCount, "should have 1 alert")
+				user2AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user2.Id})
+				assert.Zero(t, user2AlertCount, "should have 0 alerts")
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestAlertsHistory(t *testing.T) {
 	synctest.Test(t, func(t *testing.T) {
+		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		// Create systems and alerts

internal/alerts/alerts_test_helpers.go

@@ -95,7 +95,3 @@ func (am *AlertManager) RestorePendingStatusAlerts() error {
 func (am *AlertManager) SetAlertTriggered(alert CachedAlertData, triggered bool) error {
 	return am.setAlertTriggered(alert, triggered)
 }
-
-func IsInternalURL(rawURL string) (bool, error) {
-	return isInternalURL(rawURL)
-}

internal/cmd/agent/agent.go

@@ -195,6 +195,6 @@ func main() {
 	}
 
 	if err := a.Start(serverConfig); err != nil {
-		log.Fatal("Failed to start: ", err)
+		log.Fatal("Failed to start server: ", err)
 	}
 }

internal/common/common-ws.go

@@ -42,8 +42,7 @@ type AgentResponse struct {
 	SmartData   map[string]smart.SmartData `cbor:"5,keyasint,omitempty,omitzero"` // Legacy (<= 0.17)
 	ServiceInfo systemd.ServiceDetails     `cbor:"6,keyasint,omitempty,omitzero"` // Legacy (<= 0.17)
 	// Data is the generic response payload for new endpoints (0.18+)
-	Data          cbor.RawMessage `cbor:"7,keyasint,omitempty,omitzero"`
-	SmartComplete bool            `cbor:"8,keyasint,omitempty,omitzero"`
+	Data cbor.RawMessage `cbor:"7,keyasint,omitempty,omitzero"`
 }
 
 type FingerprintRequest struct {

internal/entities/container/container.go

@@ -52,17 +52,6 @@ type HostInfo struct {
 }
 
 func (s *ApiStats) CalculateCpuPercentLinux(prevCpuContainer uint64, prevCpuSystem uint64) float64 {
-	// A counter can read lower than the stored previous value when a stats
-	// response is processed after a newer one for the same container, or when an
-	// accounting counter resets. Unsigned subtraction wraps to ~2^64 instead of
-	// going negative: on the container counter that surfaces as an absurd
-	// percentage the caller rejects, discarding the whole sample; on the system
-	// counter it inflates the divisor and silently reports near-zero CPU.
-	// Treat either direction as a new baseline.
-	if s.CPUStats.CPUUsage.TotalUsage < prevCpuContainer || s.CPUStats.SystemUsage < prevCpuSystem {
-		return 0.0
-	}
-
 	cpuDelta := s.CPUStats.CPUUsage.TotalUsage - prevCpuContainer
 	systemDelta := s.CPUStats.SystemUsage - prevCpuSystem
 
@@ -81,11 +70,7 @@ func (s *ApiStats) CalculateCpuPercentWindows(prevCpuUsage uint64, prevRead time
 	possIntervals /= 100                // Convert to number of 100ns intervals
 	possIntervals *= uint64(s.NumProcs) // Multiple by the number of processors
 
-	// Intervals used. Same rollback guard as the Linux path: an out-of-order or
-	// reset counter would wrap the subtraction to ~2^64.
-	if s.CPUStats.CPUUsage.TotalUsage < prevCpuUsage {
-		return 0.0
-	}
+	// Intervals used
 	intervalsUsed := s.CPUStats.CPUUsage.TotalUsage - prevCpuUsage
 
 	// Percentage avoiding divide-by-zero

internal/entities/smart/smart.go

@@ -494,7 +494,7 @@ type SmartInfoForNvme struct {
 	FirmwareVersion string           `json:"firmware_version"`
 	// NVMePCIVendor                 NVMePCIVendor                 `json:"nvme_pci_vendor"`
 	// NVMeIEEEOUIIdentifier         uint32                        `json:"nvme_ieee_oui_identifier"`
-	NVMeTotalCapacity uint64 `json:"nvme_total_capacity"`
+	// NVMeTotalCapacity             uint64                        `json:"nvme_total_capacity"`
 	// NVMeUnallocatedCapacity       uint64                        `json:"nvme_unallocated_capacity"`
 	// NVMeControllerID              uint16                        `json:"nvme_controller_id"`
 	// NVMeVersion                   VersionStringInfo             `json:"nvme_version"`
@@ -531,13 +531,6 @@ type SmartData struct {
 	Attributes      []*SmartAttribute `json:"a,omitempty" cbor:"9,keyasint,omitempty"`
 }
 
-// SmartDataResponse contains the collected data and whether every discovered
-// device was collected. Older agents omit Complete, so hubs must not prune from it.
-type SmartDataResponse struct {
-	Data     map[string]SmartData `json:"data" cbor:"0,keyasint"`
-	Complete bool                 `json:"complete" cbor:"1,keyasint,omitempty"` // Whether every discovered device was collected
-}
-
 type SmartAttribute struct {
 	ID         uint16 `json:"id,omitempty" cbor:"0,keyasint,omitempty"`
 	Name       string `json:"n" cbor:"1,keyasint"`

internal/entities/system/system.go

@@ -33,8 +33,6 @@ type Stats struct {
 	MaxNetworkSent float64             `json:"nsm,omitempty" cbor:"-"`
 	MaxNetworkRecv float64             `json:"nrm,omitempty" cbor:"-"`
 	Temperatures   map[string]float64  `json:"t,omitempty" cbor:"20,keyasint,omitempty"`
-	Fans           map[string]uint16   `json:"f,omitempty" cbor:"36,keyasint,omitempty"`
-	Batteries      map[string]uint8    `json:"bats,omitempty" cbor:"37,keyasint,omitempty"`
 	ExtraFs        map[string]*FsStats `json:"efs,omitempty" cbor:"21,keyasint,omitempty"`
 	GPUData        map[string]GPUData  `json:"g,omitempty" cbor:"22,keyasint,omitempty"`
 	// LoadAvg1       float64             `json:"l1,omitempty" cbor:"23,keyasint,omitempty"`
@@ -44,14 +42,12 @@ type Stats struct {
 	MaxBandwidth [2]uint64 `json:"bm,omitzero" cbor:"-"`                   // [sent bytes, recv bytes]
 	// TODO: remove other load fields in future release in favor of load avg array
 	LoadAvg           [3]float64           `json:"la,omitempty" cbor:"28,keyasint"`
-	Battery           [2]uint8             `json:"bat,omitzero" cbor:"29,keyasint,omitzero"`    // [percent, charge state]
+	Battery           [2]uint8             `json:"bat,omitzero" cbor:"29,keyasint,omitzero"`    // [percent, charge state, current]
 	NetworkInterfaces map[string][4]uint64 `json:"ni,omitempty" cbor:"31,keyasint,omitempty"`   // [upload bytes, download bytes, total upload, total download]
 	DiskIO            [2]uint64            `json:"dio,omitzero" cbor:"32,keyasint,omitzero"`    // [read bytes, write bytes]
 	MaxDiskIO         [2]uint64            `json:"diom,omitzero" cbor:"-"`                      // [max read bytes, max write bytes]
 	CpuBreakdown      []float64            `json:"cpub,omitempty" cbor:"33,keyasint,omitempty"` // [user, system, iowait, steal, idle]
 	CpuCoresUsage     Uint8Slice           `json:"cpus,omitempty" cbor:"34,keyasint,omitempty"` // per-core busy usage [CPU0..]
-	DiskIoStats       [6]float64           `json:"dios,omitzero" cbor:"35,keyasint,omitzero"`   // [read time %, write time %, io utilization %, r_await ms, w_await ms, weighted io %]
-	MaxDiskIoStats    [6]float64           `json:"diosm,omitzero" cbor:"-"`                     // max values for DiskIoStats
 }
 
 // Uint8Slice wraps []uint8 to customize JSON encoding while keeping CBOR efficient.
@@ -97,12 +93,10 @@ type FsStats struct {
 	MaxDiskReadPS  float64   `json:"rm,omitempty" cbor:"-"`
 	MaxDiskWritePS float64   `json:"wm,omitempty" cbor:"-"`
 	// TODO: remove DiskReadPs and DiskWritePs in future release in favor of DiskReadBytes and DiskWriteBytes
-	DiskReadBytes     uint64     `json:"rb" cbor:"6,keyasint,omitempty"`
-	DiskWriteBytes    uint64     `json:"wb" cbor:"7,keyasint,omitempty"`
-	MaxDiskReadBytes  uint64     `json:"rbm,omitempty" cbor:"-"`
-	MaxDiskWriteBytes uint64     `json:"wbm,omitempty" cbor:"-"`
-	DiskIoStats       [6]float64 `json:"dios,omitzero" cbor:"8,keyasint,omitzero"` // [read time %, write time %, io utilization %, r_await ms, w_await ms, weighted io %]
-	MaxDiskIoStats    [6]float64 `json:"diosm,omitzero" cbor:"-"`                  // max values for DiskIoStats
+	DiskReadBytes     uint64 `json:"rb" cbor:"6,keyasint,omitempty"`
+	DiskWriteBytes    uint64 `json:"wb" cbor:"7,keyasint,omitempty"`
+	MaxDiskReadBytes  uint64 `json:"rbm,omitempty" cbor:"-"`
+	MaxDiskWriteBytes uint64 `json:"wbm,omitempty" cbor:"-"`
 }
 
 type NetIoStats struct {

internal/entities/system/system_test.go

@@ -1,37 +0,0 @@
-package system
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/fxamacker/cbor/v2"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestStatsBatteryTransport(t *testing.T) {
-	stats := Stats{Battery: [2]uint8{0, 1}, Batteries: map[string]uint8{"Primary": 0, "Mouse": 75}}
-
-	jsonData, err := json.Marshal(stats)
-	require.NoError(t, err)
-	var jsonPayload map[string]any
-	require.NoError(t, json.Unmarshal(jsonData, &jsonPayload))
-	assert.Equal(t, []any{float64(0), float64(1)}, jsonPayload["bat"])
-	assert.Equal(t, map[string]any{"Primary": float64(0), "Mouse": float64(75)}, jsonPayload["bats"])
-
-	cborData, err := cbor.Marshal(stats)
-	require.NoError(t, err)
-	var decoded Stats
-	require.NoError(t, cbor.Unmarshal(cborData, &decoded))
-	assert.Equal(t, stats.Battery, decoded.Battery)
-	assert.Equal(t, stats.Batteries, decoded.Batteries)
-}
-
-func TestStatsLegacyBatteryPayload(t *testing.T) {
-	data, err := json.Marshal(Stats{Battery: [2]uint8{50, 4}})
-	require.NoError(t, err)
-	var payload map[string]any
-	require.NoError(t, json.Unmarshal(data, &payload))
-	assert.Contains(t, payload, "bat")
-	assert.NotContains(t, payload, "bats")
-}

internal/ghupdate/checksum.go

@@ -1,43 +0,0 @@
-package ghupdate
-
-import (
-	"bytes"
-	"crypto/sha256"
-	"encoding/hex"
-	"fmt"
-	"io"
-	"os"
-	"strings"
-)
-
-func verifyAssetChecksum(path, digest string) error {
-	algorithm, expectedHex, ok := strings.Cut(digest, ":")
-	if !ok || algorithm == "" || expectedHex == "" {
-		return fmt.Errorf("invalid release digest %q", digest)
-	}
-	if !strings.EqualFold(algorithm, "sha256") {
-		return fmt.Errorf("unsupported release digest algorithm %q", algorithm)
-	}
-
-	expected, err := hex.DecodeString(expectedHex)
-	if err != nil || len(expected) != sha256.Size {
-		return fmt.Errorf("invalid SHA-256 release digest %q", digest)
-	}
-
-	file, err := os.Open(path)
-	if err != nil {
-		return fmt.Errorf("failed to open release for checksum verification: %w", err)
-	}
-	defer file.Close()
-
-	hash := sha256.New()
-	if _, err := io.Copy(hash, file); err != nil {
-		return fmt.Errorf("failed to calculate release checksum: %w", err)
-	}
-	actual := hash.Sum(nil)
-	if !bytes.Equal(actual, expected) {
-		return fmt.Errorf("release checksum mismatch: expected %s, got %s", expectedHex, hex.EncodeToString(actual))
-	}
-
-	return nil
-}

internal/ghupdate/checksum_test.go

@@ -1,57 +0,0 @@
-package ghupdate
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestVerifyAssetChecksum(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "asset")
-	if err := os.WriteFile(path, []byte("beszel release asset"), 0600); err != nil {
-		t.Fatal(err)
-	}
-
-	tests := []struct {
-		name    string
-		digest  string
-		wantErr string
-	}{
-		{
-			name:   "valid",
-			digest: "sha256:2316f86af2c3af2f0ef595ad5359cdd19b329d4829a5425460ca9ffbf92671ab",
-		},
-		{
-			name:    "mismatch",
-			digest:  "sha256:0316f86af2c3af2f0ef595ad5359cdd19b329d4829a5425460ca9ffbf92671ab",
-			wantErr: "checksum mismatch",
-		},
-		{
-			name:    "malformed",
-			digest:  "sha256:not-a-checksum",
-			wantErr: "invalid SHA-256",
-		},
-		{
-			name:    "missing",
-			wantErr: "invalid release digest",
-		},
-		{
-			name:    "unsupported algorithm",
-			digest:  "sha512:2316f86af2c3af2f0ef595ad5359cdd19b329d4829a5425460ca9ffbf92671ab",
-			wantErr: "unsupported",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := verifyAssetChecksum(path, tt.digest)
-			if tt.wantErr == "" && err != nil {
-				t.Fatalf("expected checksum to verify, got %v", err)
-			}
-			if tt.wantErr != "" && (err == nil || !strings.Contains(err.Error(), tt.wantErr)) {
-				t.Fatalf("expected error containing %q, got %v", tt.wantErr, err)
-			}
-		})
-	}
-}

internal/ghupdate/extract.go

@@ -46,23 +46,18 @@ func extractTarGz(srcPath, destDir string) error {
 			return err
 		}
 
-		path, err := archivePath(destDir, header.Name)
-		if err != nil {
-			return err
-		}
-
 		if header.Typeflag == tar.TypeDir {
-			if err := os.MkdirAll(path, 0755); err != nil {
+			if err := os.MkdirAll(filepath.Join(destDir, header.Name), 0755); err != nil {
 				return err
 			}
 			continue
 		}
 
-		if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+		if err := os.MkdirAll(filepath.Dir(filepath.Join(destDir, header.Name)), 0755); err != nil {
 			return err
 		}
 
-		outFile, err := os.Create(path)
+		outFile, err := os.Create(filepath.Join(destDir, header.Name))
 		if err != nil {
 			return err
 		}
@@ -77,14 +72,6 @@ func extractTarGz(srcPath, destDir string) error {
 	return nil
 }
 
-// archivePath returns a path within destDir, rejecting path traversal entries.
-func archivePath(destDir, name string) (string, error) {
-	if !filepath.IsLocal(name) {
-		return "", fmt.Errorf("invalid file path: %q", name)
-	}
-	return filepath.Join(destDir, name), nil
-}
-
 // extractZip extracts the zip archive at "src" to "dest".
 //
 // Note that only dirs and regular files will be extracted.
@@ -97,6 +84,9 @@ func extractZip(src, dest string) error {
 	}
 	defer zr.Close()
 
+	// normalize dest path to check later for Zip Slip
+	dest = filepath.Clean(dest) + string(os.PathSeparator)
+
 	for _, f := range zr.File {
 		err := extractFile(f, dest)
 		if err != nil {
@@ -110,9 +100,11 @@ func extractZip(src, dest string) error {
 // extractFile extracts the provided zipFile into "basePath/zipFileName" path,
 // creating all the necessary path directories.
 func extractFile(zipFile *zip.File, basePath string) error {
-	path, err := archivePath(basePath, zipFile.Name)
-	if err != nil {
-		return err
+	path := filepath.Join(basePath, zipFile.Name)
+
+	// check for Zip Slip
+	if !strings.HasPrefix(path, basePath) {
+		return fmt.Errorf("invalid file path: %s", path)
 	}
 
 	r, err := zipFile.Open()

internal/ghupdate/ghupdate.go

@@ -135,33 +135,21 @@ func (p *updater) update() (updated bool, err error) {
 		return false, err
 	}
 
-	if err := os.MkdirAll(p.config.DataDir, 0755); err != nil {
-		return false, fmt.Errorf("failed to create update data directory: %w", err)
-	}
-	releaseDir, err := os.MkdirTemp(p.config.DataDir, ".beszel_update-")
-	if err != nil {
-		return false, fmt.Errorf("failed to create update directory: %w", err)
-	}
+	releaseDir := filepath.Join(p.config.DataDir, ".beszel_update")
 	defer os.RemoveAll(releaseDir)
 
 	ColorPrintf(ColorYellow, "Downloading %s...", asset.Name)
 
 	// download the release asset
-	assetPath, err := archivePath(releaseDir, asset.Name)
-	if err != nil {
-		return false, err
-	}
+	assetPath := filepath.Join(releaseDir, asset.Name)
 	if err := downloadFile(p.config.Context, p.config.HttpClient, asset.DownloadUrl, assetPath, p.config.UseMirror); err != nil {
 		return false, err
 	}
-	ColorPrint(ColorYellow, "Verifying checksum...")
-	if err := verifyAssetChecksum(assetPath, asset.Digest); err != nil {
-		return false, err
-	}
 
 	ColorPrintf(ColorYellow, "Extracting %s...", asset.Name)
 
-	extractDir := filepath.Join(releaseDir, "extracted")
+	extractDir := filepath.Join(releaseDir, "extracted_"+asset.Name)
+	defer os.RemoveAll(extractDir)
 
 	// Extract the archive (automatically detects format)
 	if err := extract(assetPath, extractDir); err != nil {

internal/ghupdate/ghupdate_test.go

@@ -1,9 +1,6 @@
 package ghupdate
 
 import (
-	"archive/tar"
-	"compress/gzip"
-	"os"
 	"path/filepath"
 	"testing"
 )
@@ -46,59 +43,3 @@ func TestExtractFailure(t *testing.T) {
 		t.Fatal("Expected Extract to fail due to missing tar.gz file")
 	}
 }
-
-func TestArchivePath(t *testing.T) {
-	destDir := t.TempDir()
-	for _, name := range []string{
-		"",
-		"..",
-		filepath.Join("..", "file"),
-		filepath.Join("dir", "..", "..", "file"),
-		string(os.PathSeparator) + filepath.Join("tmp", "file"),
-	} {
-		if _, err := archivePath(destDir, name); err == nil {
-			t.Errorf("expected %q to be rejected", name)
-		}
-	}
-
-	name := filepath.Join("dir", "file")
-	if path, err := archivePath(destDir, name); err != nil || path != filepath.Join(destDir, name) {
-		t.Errorf("archivePath(%q) = %q, %v", name, path, err)
-	}
-}
-
-func TestExtractTarGzRejectsPathTraversal(t *testing.T) {
-	testDir := t.TempDir()
-	archivePath := filepath.Join(testDir, "malicious.tar.gz")
-	destDir := filepath.Join(testDir, "extract")
-	escapedPath := filepath.Join(testDir, "escaped")
-
-	archive, err := os.Create(archivePath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	gz := gzip.NewWriter(archive)
-	tw := tar.NewWriter(gz)
-	if err := tw.WriteHeader(&tar.Header{Name: "../escaped", Mode: 0600, Size: 1}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := tw.Write([]byte("x")); err != nil {
-		t.Fatal(err)
-	}
-	if err := tw.Close(); err != nil {
-		t.Fatal(err)
-	}
-	if err := gz.Close(); err != nil {
-		t.Fatal(err)
-	}
-	if err := archive.Close(); err != nil {
-		t.Fatal(err)
-	}
-
-	if err := extract(archivePath, destDir); err == nil {
-		t.Fatal("expected path traversal archive to be rejected")
-	}
-	if _, err := os.Stat(escapedPath); !os.IsNotExist(err) {
-		t.Fatalf("path traversal wrote %s", escapedPath)
-	}
-}

internal/ghupdate/release.go

@@ -8,7 +8,6 @@ import (
 type releaseAsset struct {
 	Name        string `json:"name"`
 	DownloadUrl string `json:"browser_download_url"`
-	Digest      string `json:"digest"`
 	Id          int    `json:"id"`
 	Size        int    `json:"size"`
 }

internal/hub/agent_connect.go

@@ -317,9 +317,6 @@ func getRealIP(r *http.Request) string {
 	if ip := r.Header.Get("CF-Connecting-IP"); ip != "" {
 		return ip
 	}
-	if ip := r.Header.Get("X-Real-IP"); ip != "" {
-		return ip
-	}
 	if ip := r.Header.Get("X-Forwarded-For"); ip != "" {
 		// X-Forwarded-For can contain a comma-separated list: "client_ip, proxy1, proxy2"
 		// Take the first one

internal/hub/agent_connect_test.go

@@ -1796,24 +1796,6 @@ func TestGetRealIP(t *testing.T) {
 			remoteAddr: "127.0.0.1:12345",
 			expectedIP: "192.168.1.8",
 		},
-		{
-			name:       "X-Real-IP header",
-			headers:    map[string]string{"X-Real-IP": "10.8.0.4"},
-			remoteAddr: "172.21.0.1:12345",
-			expectedIP: "10.8.0.4",
-		},
-		{
-			name:       "X-Real-IP takes precedence over X-Forwarded-For",
-			headers:    map[string]string{"X-Real-IP": "10.8.0.4", "X-Forwarded-For": "10.8.0.5"},
-			remoteAddr: "172.21.0.1:12345",
-			expectedIP: "10.8.0.4",
-		},
-		{
-			name:       "CF-Connecting-IP takes precedence over X-Real-IP",
-			headers:    map[string]string{"CF-Connecting-IP": "1.2.3.4", "X-Real-IP": "10.8.0.4"},
-			remoteAddr: "172.21.0.1:12345",
-			expectedIP: "1.2.3.4",
-		},
 	}
 
 	for _, tc := range testCases {

internal/hub/api.go

@@ -3,7 +3,6 @@ package hub
 import (
 	"context"
 	"net/http"
-	"regexp"
 	"strings"
 	"time"
 
@@ -14,7 +13,6 @@ import (
 	"github.com/henrygd/beszel/internal/ghupdate"
 	"github.com/henrygd/beszel/internal/hub/config"
 	"github.com/henrygd/beszel/internal/hub/systems"
-	"github.com/henrygd/beszel/internal/hub/utils"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/apis"
 	"github.com/pocketbase/pocketbase/core"
@@ -27,32 +25,6 @@ type UpdateInfo struct {
 	Url       string `json:"url"`
 }
 
-var containerIDPattern = regexp.MustCompile(`^[a-fA-F0-9]{12,64}$`)
-
-// Middleware to allow only admin role users
-var requireAdminRole = customAuthMiddleware(func(e *core.RequestEvent) bool {
-	return e.Auth.GetString("role") == "admin"
-})
-
-// Middleware to exclude readonly users
-var excludeReadOnlyRole = customAuthMiddleware(func(e *core.RequestEvent) bool {
-	return e.Auth.GetString("role") != "readonly"
-})
-
-// customAuthMiddleware handles boilerplate for custom authentication middlewares. fn should
-// return true if the request is allowed, false otherwise. e.Auth is guaranteed to be non-nil.
-func customAuthMiddleware(fn func(*core.RequestEvent) bool) func(*core.RequestEvent) error {
-	return func(e *core.RequestEvent) error {
-		if e.Auth == nil {
-			return e.UnauthorizedError("The request requires valid record authorization token.", nil)
-		}
-		if !fn(e) {
-			return e.ForbiddenError("The authorized record is not allowed to perform this action.", nil)
-		}
-		return e.Next()
-	}
-}
-
 // registerMiddlewares registers custom middlewares
 func (h *Hub) registerMiddlewares(se *core.ServeEvent) {
 	// authorizes request with user matching the provided email
@@ -61,7 +33,7 @@ func (h *Hub) registerMiddlewares(se *core.ServeEvent) {
 			return e.Next()
 		}
 		isAuthRefresh := e.Request.URL.Path == "/api/collections/users/auth-refresh" && e.Request.Method == http.MethodPost
-		e.Auth, err = e.App.FindAuthRecordByEmail("users", email)
+		e.Auth, err = e.App.FindFirstRecordByData("users", "email", email)
 		if err != nil || !isAuthRefresh {
 			return e.Next()
 		}
@@ -71,13 +43,13 @@ func (h *Hub) registerMiddlewares(se *core.ServeEvent) {
 		return e.Next()
 	}
 	// authenticate with trusted header
-	if autoLogin, _ := utils.GetEnv("AUTO_LOGIN"); autoLogin != "" {
+	if autoLogin, _ := GetEnv("AUTO_LOGIN"); autoLogin != "" {
 		se.Router.BindFunc(func(e *core.RequestEvent) error {
 			return authorizeRequestWithEmail(e, autoLogin)
 		})
 	}
 	// authenticate with trusted header
-	if trustedHeader, _ := utils.GetEnv("TRUSTED_AUTH_HEADER"); trustedHeader != "" {
+	if trustedHeader, _ := GetEnv("TRUSTED_AUTH_HEADER"); trustedHeader != "" {
 		se.Router.BindFunc(func(e *core.RequestEvent) error {
 			return authorizeRequestWithEmail(e, e.Request.Header.Get(trustedHeader))
 		})
@@ -105,30 +77,30 @@ func (h *Hub) registerApiRoutes(se *core.ServeEvent) error {
 	apiAuth.GET("/info", h.getInfo)
 	apiAuth.GET("/getkey", h.getInfo) // deprecated - keep for compatibility w/ integrations
 	// check for updates
-	if optIn, _ := utils.GetEnv("CHECK_UPDATES"); optIn == "true" {
+	if optIn, _ := GetEnv("CHECK_UPDATES"); optIn == "true" {
 		var updateInfo UpdateInfo
 		apiAuth.GET("/update", updateInfo.getUpdate)
 	}
 	// send test notification
 	apiAuth.POST("/test-notification", h.SendTestNotification)
 	// heartbeat status and test
-	apiAuth.GET("/heartbeat-status", h.getHeartbeatStatus).BindFunc(requireAdminRole)
-	apiAuth.POST("/test-heartbeat", h.testHeartbeat).BindFunc(requireAdminRole)
+	apiAuth.GET("/heartbeat-status", h.getHeartbeatStatus)
+	apiAuth.POST("/test-heartbeat", h.testHeartbeat)
 	// get config.yml content
-	apiAuth.GET("/config-yaml", config.GetYamlConfig).BindFunc(requireAdminRole)
+	apiAuth.GET("/config-yaml", config.GetYamlConfig)
 	// handle agent websocket connection
 	apiNoAuth.GET("/agent-connect", h.handleAgentConnect)
 	// get or create universal tokens
-	apiAuth.GET("/universal-token", h.getUniversalToken).BindFunc(excludeReadOnlyRole)
+	apiAuth.GET("/universal-token", h.getUniversalToken)
 	// update / delete user alerts
 	apiAuth.POST("/user-alerts", alerts.UpsertUserAlerts)
 	apiAuth.DELETE("/user-alerts", alerts.DeleteUserAlerts)
 	// refresh SMART devices for a system
-	apiAuth.POST("/smart/refresh", h.refreshSmartData).BindFunc(excludeReadOnlyRole)
+	apiAuth.POST("/smart/refresh", h.refreshSmartData)
 	// get systemd service details
 	apiAuth.GET("/systemd/info", h.getSystemdInfo)
 	// /containers routes
-	if enabled, _ := utils.GetEnv("CONTAINER_DETAILS"); enabled != "false" {
+	if enabled, _ := GetEnv("CONTAINER_DETAILS"); enabled != "false" {
 		// get container logs
 		apiAuth.GET("/containers/logs", h.getContainerLogs)
 		// get container info
@@ -148,7 +120,7 @@ func (h *Hub) getInfo(e *core.RequestEvent) error {
 		Key:     h.pubKey,
 		Version: beszel.Version,
 	}
-	if optIn, _ := utils.GetEnv("CHECK_UPDATES"); optIn == "true" {
+	if optIn, _ := GetEnv("CHECK_UPDATES"); optIn == "true" {
 		info.CheckUpdate = true
 	}
 	return e.JSON(http.StatusOK, info)
@@ -181,10 +153,6 @@ func (info *UpdateInfo) getUpdate(e *core.RequestEvent) error {
 
 // GetUniversalToken handles the universal token API endpoint (create, read, delete)
 func (h *Hub) getUniversalToken(e *core.RequestEvent) error {
-	if e.Auth.IsSuperuser() {
-		return e.ForbiddenError("Superusers cannot use universal tokens", nil)
-	}
-
 	tokenMap := universalTokenMap.GetMap()
 	userID := e.Auth.Id
 	query := e.Request.URL.Query()
@@ -278,6 +246,9 @@ func (h *Hub) getUniversalToken(e *core.RequestEvent) error {
 
 // getHeartbeatStatus returns current heartbeat configuration and whether it's enabled
 func (h *Hub) getHeartbeatStatus(e *core.RequestEvent) error {
+	if e.Auth.GetString("role") != "admin" {
+		return e.ForbiddenError("Requires admin role", nil)
+	}
 	if h.hb == nil {
 		return e.JSON(http.StatusOK, map[string]any{
 			"enabled": false,
@@ -295,6 +266,9 @@ func (h *Hub) getHeartbeatStatus(e *core.RequestEvent) error {
 
 // testHeartbeat triggers a single heartbeat ping and returns the result
 func (h *Hub) testHeartbeat(e *core.RequestEvent) error {
+	if e.Auth.GetString("role") != "admin" {
+		return e.ForbiddenError("Requires admin role", nil)
+	}
 	if h.hb == nil {
 		return e.JSON(http.StatusOK, map[string]any{
 			"err": "Heartbeat not configured. Set HEARTBEAT_URL environment variable.",
@@ -311,18 +285,21 @@ func (h *Hub) containerRequestHandler(e *core.RequestEvent, fetchFunc func(*syst
 	systemID := e.Request.URL.Query().Get("system")
 	containerID := e.Request.URL.Query().Get("container")
 
-	if systemID == "" || containerID == "" || !containerIDPattern.MatchString(containerID) {
-		return e.BadRequestError("Invalid system or container parameter", nil)
+	if systemID == "" || containerID == "" {
+		return e.JSON(http.StatusBadRequest, map[string]string{"error": "system and container parameters are required"})
+	}
+	if !containerIDPattern.MatchString(containerID) {
+		return e.JSON(http.StatusBadRequest, map[string]string{"error": "invalid container parameter"})
 	}
 
 	system, err := h.sm.GetSystem(systemID)
-	if err != nil || !system.HasUser(e.App, e.Auth) {
-		return e.NotFoundError("", nil)
+	if err != nil {
+		return e.JSON(http.StatusNotFound, map[string]string{"error": "system not found"})
 	}
 
 	data, err := fetchFunc(system, containerID)
 	if err != nil {
-		return e.InternalServerError("", err)
+		return e.JSON(http.StatusNotFound, map[string]string{"error": err.Error()})
 	}
 
 	return e.JSON(http.StatusOK, map[string]string{responseKey: data})
@@ -348,23 +325,15 @@ func (h *Hub) getSystemdInfo(e *core.RequestEvent) error {
 	serviceName := query.Get("service")
 
 	if systemID == "" || serviceName == "" {
-		return e.BadRequestError("Invalid system or service parameter", nil)
+		return e.JSON(http.StatusBadRequest, map[string]string{"error": "system and service parameters are required"})
 	}
 	system, err := h.sm.GetSystem(systemID)
-	if err != nil || !system.HasUser(e.App, e.Auth) {
-		return e.NotFoundError("", nil)
-	}
-	// verify service exists before fetching details
-	_, err = e.App.FindFirstRecordByFilter("systemd_services", "system = {:system} && name = {:name}", dbx.Params{
-		"system": systemID,
-		"name":   serviceName,
-	})
 	if err != nil {
-		return e.NotFoundError("", err)
+		return e.JSON(http.StatusNotFound, map[string]string{"error": "system not found"})
 	}
 	details, err := system.FetchSystemdInfoFromAgent(serviceName)
 	if err != nil {
-		return e.InternalServerError("", err)
+		return e.JSON(http.StatusNotFound, map[string]string{"error": err.Error()})
 	}
 	e.Response.Header().Set("Cache-Control", "public, max-age=60")
 	return e.JSON(http.StatusOK, map[string]any{"details": details})
@@ -375,16 +344,17 @@ func (h *Hub) getSystemdInfo(e *core.RequestEvent) error {
 func (h *Hub) refreshSmartData(e *core.RequestEvent) error {
 	systemID := e.Request.URL.Query().Get("system")
 	if systemID == "" {
-		return e.BadRequestError("Invalid system parameter", nil)
+		return e.JSON(http.StatusBadRequest, map[string]string{"error": "system parameter is required"})
 	}
 
 	system, err := h.sm.GetSystem(systemID)
-	if err != nil || !system.HasUser(e.App, e.Auth) {
-		return e.NotFoundError("", nil)
+	if err != nil {
+		return e.JSON(http.StatusNotFound, map[string]string{"error": "system not found"})
 	}
 
+	// Fetch and save SMART devices
 	if err := system.FetchAndSaveSmartDevices(); err != nil {
-		return e.InternalServerError("", err)
+		return e.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
 	}
 
 	return e.JSON(http.StatusOK, map[string]string{"status": "ok"})

internal/hub/api_test.go

@@ -3,7 +3,6 @@ package hub_test
 import (
 	"bytes"
 	"encoding/json"
-	"fmt"
 	"io"
 	"net/http"
 	"testing"
@@ -26,33 +25,33 @@ func jsonReader(v any) io.Reader {
 }
 
 func TestApiRoutesAuthentication(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
+	hub, _ := beszelTests.NewTestHub(t.TempDir())
 	defer hub.Cleanup()
 
+	hub.StartHub()
+
+	// Create test user and get auth token
+	user, err := beszelTests.CreateUser(hub, "testuser@example.com", "password123")
+	require.NoError(t, err, "Failed to create test user")
+
+	adminUser, err := beszelTests.CreateRecord(hub, "users", map[string]any{
+		"email":    "admin@example.com",
+		"password": "password123",
+		"role":     "admin",
+	})
+	require.NoError(t, err, "Failed to create admin user")
+	adminUserToken, err := adminUser.NewAuthToken()
+
+	// superUser, err := beszelTests.CreateRecord(hub, core.CollectionNameSuperusers, map[string]any{
+	// 	"email":    "superuser@example.com",
+	// 	"password": "password123",
+	// })
+	// require.NoError(t, err, "Failed to create superuser")
+
 	userToken, err := user.NewAuthToken()
 	require.NoError(t, err, "Failed to create auth token")
 
-	// Create test user and get auth token
-	user2, err := beszelTests.CreateUser(hub, "testuser@example.com", "password123")
-	require.NoError(t, err, "Failed to create test user")
-	user2Token, err := user2.NewAuthToken()
-	require.NoError(t, err, "Failed to create user2 auth token")
-
-	adminUser, err := beszelTests.CreateUserWithRole(hub, "admin@example.com", "password123", "admin")
-	require.NoError(t, err, "Failed to create admin user")
-	adminUserToken, err := adminUser.NewAuthToken()
-
-	readOnlyUser, err := beszelTests.CreateUserWithRole(hub, "readonly@example.com", "password123", "readonly")
-	require.NoError(t, err, "Failed to create readonly user")
-	readOnlyUserToken, err := readOnlyUser.NewAuthToken()
-	require.NoError(t, err, "Failed to create readonly user auth token")
-
-	superuser, err := beszelTests.CreateSuperuser(hub, "superuser@example.com", "password123")
-	require.NoError(t, err, "Failed to create superuser")
-	superuserToken, err := superuser.NewAuthToken()
-	require.NoError(t, err, "Failed to create superuser auth token")
-
-	// Create test system
+	// Create test system for user-alerts endpoints
 	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
 		"name":  "test-system",
 		"users": []string{user.Id},
@@ -66,6 +65,31 @@ func TestApiRoutesAuthentication(t *testing.T) {
 
 	scenarios := []beszelTests.ApiScenario{
 		// Auth Protected Routes - Should require authentication
+		{
+			Name:            "POST /test-notification - no auth should fail",
+			Method:          http.MethodPost,
+			URL:             "/api/beszel/test-notification",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"url": "generic://127.0.0.1",
+			}),
+		},
+		{
+			Name:           "POST /test-notification - with auth should succeed",
+			Method:         http.MethodPost,
+			URL:            "/api/beszel/test-notification",
+			TestAppFactory: testAppFactory,
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			Body: jsonReader(map[string]any{
+				"url": "generic://127.0.0.1",
+			}),
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"sending message"},
+		},
 		{
 			Name:            "GET /config-yaml - no auth should fail",
 			Method:          http.MethodGet,
@@ -82,7 +106,7 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  403,
-			ExpectedContent: []string{"The authorized record is not allowed to perform this action."},
+			ExpectedContent: []string{"Requires admin"},
 			TestAppFactory:  testAppFactory,
 		},
 		{
@@ -112,7 +136,7 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  403,
-			ExpectedContent: []string{"The authorized record is not allowed to perform this action."},
+			ExpectedContent: []string{"Requires admin role"},
 			TestAppFactory:  testAppFactory,
 		},
 		{
@@ -134,7 +158,7 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  403,
-			ExpectedContent: []string{"The authorized record is not allowed to perform this action."},
+			ExpectedContent: []string{"Requires admin role"},
 			TestAppFactory:  testAppFactory,
 		},
 		{
@@ -178,74 +202,6 @@ func TestApiRoutesAuthentication(t *testing.T) {
 			ExpectedContent: []string{"\"permanent\":true", "permanent-token-123"},
 			TestAppFactory:  testAppFactory,
 		},
-		{
-			Name:   "GET /universal-token - superuser should fail",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/universal-token",
-			Headers: map[string]string{
-				"Authorization": superuserToken,
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{"Superusers cannot use universal tokens"},
-			TestAppFactory: func(t testing.TB) *pbTests.TestApp {
-				return hub.TestApp
-			},
-		},
-		{
-			Name:   "GET /universal-token - with readonly auth should fail",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/universal-token",
-			Headers: map[string]string{
-				"Authorization": readOnlyUserToken,
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{"The authorized record is not allowed to perform this action."},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST /smart/refresh - missing system should fail 400 with user auth",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/smart/refresh",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Invalid", "system", "parameter"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST /smart/refresh - with readonly auth should fail",
-			Method: http.MethodPost,
-			URL:    fmt.Sprintf("/api/beszel/smart/refresh?system=%s", system.Id),
-			Headers: map[string]string{
-				"Authorization": readOnlyUserToken,
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{"The authorized record is not allowed to perform this action."},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST /smart/refresh - non-user system should fail",
-			Method: http.MethodPost,
-			URL:    fmt.Sprintf("/api/beszel/smart/refresh?system=%s", system.Id),
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{"The requested resource wasn't found."},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST /smart/refresh - good user should pass validation",
-			Method: http.MethodPost,
-			URL:    fmt.Sprintf("/api/beszel/smart/refresh?system=%s", system.Id),
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  500,
-			ExpectedContent: []string{"Something went wrong while processing your request."},
-			TestAppFactory:  testAppFactory,
-		},
 		{
 			Name:            "POST /user-alerts - no auth should fail",
 			Method:          http.MethodPost,
@@ -317,59 +273,20 @@ func TestApiRoutesAuthentication(t *testing.T) {
 		{
 			Name:            "GET /containers/logs - no auth should fail",
 			Method:          http.MethodGet,
-			URL:             "/api/beszel/containers/logs?system=test-system&container=abababababab",
+			URL:             "/api/beszel/containers/logs?system=test-system&container=test-container",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{"requires valid"},
 			TestAppFactory:  testAppFactory,
 		},
-		{
-			Name:            "GET /containers/logs - request for valid non-user system should fail",
-			Method:          http.MethodGet,
-			URL:             fmt.Sprintf("/api/beszel/containers/logs?system=%s&container=abababababab", system.Id),
-			ExpectedStatus:  404,
-			ExpectedContent: []string{"The requested resource wasn't found."},
-			TestAppFactory:  testAppFactory,
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-		},
-		{
-			Name:            "GET /containers/info - request for valid non-user system should fail",
-			Method:          http.MethodGet,
-			URL:             fmt.Sprintf("/api/beszel/containers/info?system=%s&container=abababababab", system.Id),
-			ExpectedStatus:  404,
-			ExpectedContent: []string{"The requested resource wasn't found."},
-			TestAppFactory:  testAppFactory,
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-		},
-		{
-			Name:            "GET /containers/info - SHARE_ALL_SYSTEMS allows non-member user",
-			Method:          http.MethodGet,
-			URL:             fmt.Sprintf("/api/beszel/containers/info?system=%s&container=abababababab", system.Id),
-			ExpectedStatus:  500,
-			ExpectedContent: []string{"Something went wrong while processing your request."},
-			TestAppFactory:  testAppFactory,
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				t.Setenv("SHARE_ALL_SYSTEMS", "true")
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				t.Setenv("SHARE_ALL_SYSTEMS", "")
-			},
-		},
 		{
 			Name:   "GET /containers/logs - with auth but missing system param should fail",
 			Method: http.MethodGet,
-			URL:    "/api/beszel/containers/logs?container=abababababab",
+			URL:    "/api/beszel/containers/logs?container=test-container",
 			Headers: map[string]string{
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  400,
-			ExpectedContent: []string{"Invalid", "parameter"},
+			ExpectedContent: []string{"system and container parameters are required"},
 			TestAppFactory:  testAppFactory,
 		},
 		{
@@ -380,7 +297,7 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  400,
-			ExpectedContent: []string{"Invalid", "parameter"},
+			ExpectedContent: []string{"system and container parameters are required"},
 			TestAppFactory:  testAppFactory,
 		},
 		{
@@ -391,7 +308,7 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  404,
-			ExpectedContent: []string{"The requested resource wasn't found."},
+			ExpectedContent: []string{"system not found"},
 			TestAppFactory:  testAppFactory,
 		},
 		{
@@ -402,7 +319,7 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  400,
-			ExpectedContent: []string{"Invalid", "parameter"},
+			ExpectedContent: []string{"invalid container parameter"},
 			TestAppFactory:  testAppFactory,
 		},
 		{
@@ -413,7 +330,7 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  400,
-			ExpectedContent: []string{"Invalid", "parameter"},
+			ExpectedContent: []string{"invalid container parameter"},
 			TestAppFactory:  testAppFactory,
 		},
 		{
@@ -424,114 +341,9 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  400,
-			ExpectedContent: []string{"Invalid", "parameter"},
+			ExpectedContent: []string{"invalid container parameter"},
 			TestAppFactory:  testAppFactory,
 		},
-		{
-			Name:   "GET /containers/logs - good user should pass validation",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/containers/logs?system=" + system.Id + "&container=0123456789ab",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  500,
-			ExpectedContent: []string{"Something went wrong while processing your request."},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /containers/info - good user should pass validation",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/containers/info?system=" + system.Id + "&container=0123456789ab",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  500,
-			ExpectedContent: []string{"Something went wrong while processing your request."},
-			TestAppFactory:  testAppFactory,
-		},
-		// /systemd routes
-		{
-			Name:            "GET /systemd/info - no auth should fail",
-			Method:          http.MethodGet,
-			URL:             fmt.Sprintf("/api/beszel/systemd/info?system=%s&service=nginx.service", system.Id),
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:            "GET /systemd/info - request for valid non-user system should fail",
-			Method:          http.MethodGet,
-			URL:             fmt.Sprintf("/api/beszel/systemd/info?system=%s&service=nginx.service", system.Id),
-			ExpectedStatus:  404,
-			ExpectedContent: []string{"The requested resource wasn't found."},
-			TestAppFactory:  testAppFactory,
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-		},
-		{
-			Name:   "GET /systemd/info - with auth but missing system param should fail",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/systemd/info?service=nginx.service",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Invalid", "parameter"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /systemd/info - with auth but missing service param should fail",
-			Method: http.MethodGet,
-			URL:    fmt.Sprintf("/api/beszel/systemd/info?system=%s", system.Id),
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Invalid", "parameter"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /systemd/info - with auth but invalid system should fail",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/systemd/info?system=invalid-system&service=nginx.service",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{"The requested resource wasn't found."},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /systemd/info - service not in systemd_services collection should fail",
-			Method: http.MethodGet,
-			URL:    fmt.Sprintf("/api/beszel/systemd/info?system=%s&service=notregistered.service", system.Id),
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{"The requested resource wasn't found."},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /systemd/info - with auth and existing service record should pass validation",
-			Method: http.MethodGet,
-			URL:    fmt.Sprintf("/api/beszel/systemd/info?system=%s&service=nginx.service", system.Id),
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  500,
-			ExpectedContent: []string{"Something went wrong while processing your request."},
-			TestAppFactory:  testAppFactory,
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.CreateRecord(app, "systemd_services", map[string]any{
-					"system": system.Id,
-					"name":   "nginx.service",
-					"state":  0,
-					"sub":    1,
-				})
-			},
-		},
 
 		// Auth Optional Routes - Should work without authentication
 		{
@@ -622,17 +434,13 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"systems": []string{system.Id},
 			}),
 		},
-		// this works but diff behavior on prod vs dev.
-		// dev returns 502; prod returns 200 with static html page 404
-		// TODO: align dev and prod behavior and re-enable this test
-		// {
-		// 	Name:               "GET /update - shouldn't exist without CHECK_UPDATES env var",
-		// 	Method:             http.MethodGet,
-		// 	URL:                "/api/beszel/update",
-		// 	NotExpectedContent: []string{"v:", "\"v\":"},
-		// 	ExpectedStatus: 502,
-		// 	TestAppFactory: testAppFactory,
-		// },
+		{
+			Name:           "GET /update - shouldn't exist without CHECK_UPDATES env var",
+			Method:         http.MethodGet,
+			URL:            "/api/beszel/update",
+			ExpectedStatus: 502,
+			TestAppFactory: testAppFactory,
+		},
 	}
 
 	for _, scenario := range scenarios {

internal/hub/collections.go

@@ -1,9 +1,6 @@
 package hub
 
-import (
-	"github.com/henrygd/beszel/internal/hub/utils"
-	"github.com/pocketbase/pocketbase/core"
-)
+import "github.com/pocketbase/pocketbase/core"
 
 type collectionRules struct {
 	list   *string
@@ -25,11 +22,11 @@ func setCollectionAuthSettings(app core.App) error {
 	}
 
 	// disable email auth if DISABLE_PASSWORD_AUTH env var is set
-	disablePasswordAuth, _ := utils.GetEnv("DISABLE_PASSWORD_AUTH")
+	disablePasswordAuth, _ := GetEnv("DISABLE_PASSWORD_AUTH")
 	usersCollection.PasswordAuth.Enabled = disablePasswordAuth != "true"
 	usersCollection.PasswordAuth.IdentityFields = []string{"email"}
 	// allow oauth user creation if USER_CREATION is set
-	if userCreation, _ := utils.GetEnv("USER_CREATION"); userCreation == "true" {
+	if userCreation, _ := GetEnv("USER_CREATION"); userCreation == "true" {
 		cr := "@request.context = 'oauth2'"
 		usersCollection.CreateRule = &cr
 	} else {
@@ -37,7 +34,7 @@ func setCollectionAuthSettings(app core.App) error {
 	}
 
 	// enable mfaOtp mfa if MFA_OTP env var is set
-	mfaOtp, _ := utils.GetEnv("MFA_OTP")
+	mfaOtp, _ := GetEnv("MFA_OTP")
 	usersCollection.OTP.Length = 6
 	superusersCollection.OTP.Length = 6
 	usersCollection.OTP.Enabled = mfaOtp == "true"
@@ -53,7 +50,7 @@ func setCollectionAuthSettings(app core.App) error {
 
 	// When SHARE_ALL_SYSTEMS is enabled, any authenticated user can read
 	// system-scoped data. Write rules continue to block readonly users.
-	shareAllSystems, _ := utils.GetEnv("SHARE_ALL_SYSTEMS")
+	shareAllSystems, _ := GetEnv("SHARE_ALL_SYSTEMS")
 
 	authenticatedRule := "@request.auth.id != \"\""
 	systemsMemberRule := authenticatedRule + " && users.id ?= @request.auth.id"

internal/hub/config/config.go

@@ -279,6 +279,9 @@ func createFingerprintRecord(app core.App, systemID, token string) error {
 
 // Returns the current config.yml file as a JSON object
 func GetYamlConfig(e *core.RequestEvent) error {
+	if e.Auth.GetString("role") != "admin" {
+		return e.ForbiddenError("Requires admin role", nil)
+	}
 	configContent, err := generateYAML(e.App)
 	if err != nil {
 		return err

internal/hub/config/config_test.go

@@ -64,7 +64,7 @@ func createConfigTestFingerprint(app core.App, systemID, token, fingerprint stri
 
 // TestConfigSyncWithTokens tests the config.SyncSystems function with various token scenarios
 func TestConfigSyncWithTokens(t *testing.T) {
-	testHub, err := tests.NewTestHub(t.TempDir())
+	testHub, err := tests.NewTestHub()
 	require.NoError(t, err)
 	defer testHub.Cleanup()
 

internal/hub/hub.go

@@ -9,13 +9,13 @@ import (
 	"net/url"
 	"os"
 	"path"
+	"regexp"
 	"strings"
 
 	"github.com/henrygd/beszel/internal/alerts"
 	"github.com/henrygd/beszel/internal/hub/config"
 	"github.com/henrygd/beszel/internal/hub/heartbeat"
 	"github.com/henrygd/beszel/internal/hub/systems"
-	"github.com/henrygd/beszel/internal/hub/utils"
 	"github.com/henrygd/beszel/internal/records"
 	"github.com/henrygd/beszel/internal/users"
 
@@ -38,6 +38,8 @@ type Hub struct {
 	appURL string
 }
 
+var containerIDPattern = regexp.MustCompile(`^[a-fA-F0-9]{12,64}$`)
+
 // NewHub creates a new Hub instance with default configuration
 func NewHub(app core.App) *Hub {
 	hub := &Hub{App: app}
@@ -45,7 +47,7 @@ func NewHub(app core.App) *Hub {
 	hub.um = users.NewUserManager(hub)
 	hub.rm = records.NewRecordManager(hub)
 	hub.sm = systems.NewSystemManager(hub)
-	hub.hb = heartbeat.New(app, utils.GetEnv)
+	hub.hb = heartbeat.New(app, GetEnv)
 	if hub.hb != nil {
 		hub.hbStop = make(chan struct{})
 	}
@@ -53,6 +55,15 @@ func NewHub(app core.App) *Hub {
 	return hub
 }
 
+// GetEnv retrieves an environment variable with a "BESZEL_HUB_" prefix, or falls back to the unprefixed key.
+func GetEnv(key string) (value string, exists bool) {
+	if value, exists = os.LookupEnv("BESZEL_HUB_" + key); exists {
+		return value, exists
+	}
+	// Fallback to the old unprefixed key
+	return os.LookupEnv(key)
+}
+
 // onAfterBootstrapAndMigrations ensures the provided function runs after the database is set up and migrations are applied.
 // This is a workaround for behavior in PocketBase where onBootstrap runs before migrations, forcing use of onServe for this purpose.
 // However, PB's tests.TestApp is already bootstrapped, generally doesn't serve, but does handle migrations.
@@ -123,7 +134,7 @@ func (h *Hub) initialize(app core.App) error {
 	// batch requests (for alerts)
 	settings.Batch.Enabled = true
 	// set URL if APP_URL env is set
-	if appURL, isSet := utils.GetEnv("APP_URL"); isSet {
+	if appURL, isSet := GetEnv("APP_URL"); isSet {
 		h.appURL = appURL
 		settings.Meta.AppURL = appURL
 	}

internal/hub/server.go

@@ -1,42 +0,0 @@
-package hub
-
-import (
-	"encoding/json"
-	"net/url"
-	"strings"
-
-	"github.com/henrygd/beszel"
-	"github.com/henrygd/beszel/internal/hub/utils"
-)
-
-// PublicAppInfo defines the structure of the public app information that will be injected into the HTML
-type PublicAppInfo struct {
-	BASE_PATH           string
-	HUB_VERSION         string
-	HUB_URL             string
-	OAUTH_DISABLE_POPUP bool `json:"OAUTH_DISABLE_POPUP,omitempty"`
-}
-
-// modifyIndexHTML injects the public app information into the index.html content
-func modifyIndexHTML(hub *Hub, html []byte) string {
-	info := getPublicAppInfo(hub)
-	content, err := json.Marshal(info)
-	if err != nil {
-		return string(html)
-	}
-	htmlContent := strings.ReplaceAll(string(html), "./", info.BASE_PATH)
-	return strings.Replace(htmlContent, "\"{info}\"", string(content), 1)
-}
-
-func getPublicAppInfo(hub *Hub) PublicAppInfo {
-	parsedURL, _ := url.Parse(hub.appURL)
-	info := PublicAppInfo{
-		BASE_PATH:   strings.TrimSuffix(parsedURL.Path, "/") + "/",
-		HUB_VERSION: beszel.Version,
-		HUB_URL:     hub.appURL,
-	}
-	if val, _ := utils.GetEnv("OAUTH_DISABLE_POPUP"); val == "true" {
-		info.OAUTH_DISABLE_POPUP = true
-	}
-	return info
-}

internal/hub/server_development.go

@@ -5,11 +5,14 @@ package hub
 import (
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"net/http/httputil"
 	"net/url"
 	"strings"
 
+	"github.com/henrygd/beszel"
+
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/osutils"
 )
@@ -36,7 +39,7 @@ func (rm *responseModifier) RoundTrip(req *http.Request) (*http.Response, error)
 	}
 	resp.Body.Close()
 	// Create a new response with the modified body
-	modifiedBody := modifyIndexHTML(rm.hub, body)
+	modifiedBody := rm.modifyHTML(string(body))
 	resp.Body = io.NopCloser(strings.NewReader(modifiedBody))
 	resp.ContentLength = int64(len(modifiedBody))
 	resp.Header.Set("Content-Length", fmt.Sprintf("%d", len(modifiedBody)))
@@ -44,8 +47,22 @@ func (rm *responseModifier) RoundTrip(req *http.Request) (*http.Response, error)
 	return resp, nil
 }
 
+func (rm *responseModifier) modifyHTML(html string) string {
+	parsedURL, err := url.Parse(rm.hub.appURL)
+	if err != nil {
+		return html
+	}
+	// fix base paths in html if using subpath
+	basePath := strings.TrimSuffix(parsedURL.Path, "/") + "/"
+	html = strings.ReplaceAll(html, "./", basePath)
+	html = strings.Replace(html, "{{V}}", beszel.Version, 1)
+	html = strings.Replace(html, "{{HUB_URL}}", rm.hub.appURL, 1)
+	return html
+}
+
 // startServer sets up the development server for Beszel
 func (h *Hub) startServer(se *core.ServeEvent) error {
+	slog.Info("starting server", "appURL", h.appURL)
 	proxy := httputil.NewSingleHostReverseProxy(&url.URL{
 		Scheme: "http",
 		Host:   "localhost:5173",

internal/hub/server_production.go

@@ -5,9 +5,10 @@ package hub
 import (
 	"io/fs"
 	"net/http"
+	"net/url"
 	"strings"
 
-	"github.com/henrygd/beszel/internal/hub/utils"
+	"github.com/henrygd/beszel"
 	"github.com/henrygd/beszel/internal/site"
 
 	"github.com/pocketbase/pocketbase/apis"
@@ -16,13 +17,22 @@ import (
 
 // startServer sets up the production server for Beszel
 func (h *Hub) startServer(se *core.ServeEvent) error {
+	// parse app url
+	parsedURL, err := url.Parse(h.appURL)
+	if err != nil {
+		return err
+	}
+	// fix base paths in html if using subpath
+	basePath := strings.TrimSuffix(parsedURL.Path, "/") + "/"
 	indexFile, _ := fs.ReadFile(site.DistDirFS, "index.html")
-	html := modifyIndexHTML(h, indexFile)
+	html := strings.ReplaceAll(string(indexFile), "./", basePath)
+	html = strings.Replace(html, "{{V}}", beszel.Version, 1)
+	html = strings.Replace(html, "{{HUB_URL}}", h.appURL, 1)
 	// set up static asset serving
 	staticPaths := [2]string{"/static/", "/assets/"}
 	serveStatic := apis.Static(site.DistDirFS, false)
 	// get CSP configuration
-	csp, cspExists := utils.GetEnv("CSP")
+	csp, cspExists := GetEnv("CSP")
 	// add route
 	se.Router.GET("/{path...}", func(e *core.RequestEvent) error {
 		// serve static assets if path is in staticPaths

internal/hub/systems/ssh_timeout_test.go

@@ -1,56 +0,0 @@
-//go:build testing
-
-package systems
-
-import (
-	"errors"
-	"testing"
-	"testing/synctest"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// TestRunWithTimeout covers the guard added for issue #2041: the per-system SSH
-// data exchange must never block the updater indefinitely on a dead connection.
-func TestRunWithTimeout(t *testing.T) {
-	t.Run("returns the operation result when it completes before the timeout", func(t *testing.T) {
-		synctest.Test(t, func(t *testing.T) {
-			wantErr := errors.New("boom")
-			onTimeoutCalled := false
-
-			retry, err := runWithTimeout(10*time.Second, func() (bool, error) {
-				return true, wantErr
-			}, func() { onTimeoutCalled = true })
-
-			assert.True(t, retry, "should return the operation's retry value")
-			assert.Equal(t, wantErr, err, "should return the operation's error")
-			assert.False(t, onTimeoutCalled, "onTimeout must not fire when the op completes")
-		})
-	})
-
-	t.Run("times out and tears down the connection when the op blocks", func(t *testing.T) {
-		synctest.Test(t, func(t *testing.T) {
-			// unblock simulates a half-open connection: the op is stuck reading a
-			// response that never arrives until the connection is torn down.
-			unblock := make(chan struct{})
-			onTimeoutCalled := false
-			start := time.Now()
-
-			retry, err := runWithTimeout(5*time.Second, func() (bool, error) {
-				<-unblock
-				return false, nil
-			}, func() {
-				onTimeoutCalled = true
-				close(unblock) // tearing down the connection releases the blocked read
-			})
-
-			assert.Equal(t, 5*time.Second, time.Since(start), "should return exactly at the timeout")
-			assert.True(t, retry, "a timeout should be retryable so the next tick re-dials")
-			assert.Error(t, err, "a timeout must surface an error so the system is set down")
-			assert.True(t, onTimeoutCalled, "onTimeout must fire so the dead connection is closed")
-
-			synctest.Wait() // ensure the released op goroutine exits cleanly
-		})
-	})
-}

internal/hub/systems/system.go

@@ -14,7 +14,6 @@ import (
 
 	"github.com/henrygd/beszel/internal/common"
 	"github.com/henrygd/beszel/internal/hub/transport"
-	"github.com/henrygd/beszel/internal/hub/utils"
 	"github.com/henrygd/beszel/internal/hub/ws"
 
 	"github.com/henrygd/beszel/internal/entities/container"
@@ -146,7 +145,6 @@ func (sys *System) update() error {
 		// update smart interval if it's set on the agent side
 		if data.Details.SmartInterval > 0 {
 			sys.smartInterval = data.Details.SmartInterval
-			sys.manager.hub.Logger().Info("SMART interval updated from agent details", "system", sys.Id, "interval", sys.smartInterval.String())
 			// make sure we reset expiration of lastFetch to remain as long as the new smart interval
 			// to prevent premature expiration leading to new fetch if interval is different.
 			sys.manager.smartFetchMap.UpdateExpiration(sys.Id, sys.smartInterval+time.Minute)
@@ -158,10 +156,11 @@ func (sys *System) update() error {
 		if sys.smartInterval <= 0 {
 			sys.smartInterval = time.Hour
 		}
-		if sys.shouldFetchSmart() && sys.smartFetching.CompareAndSwap(false, true) {
-			sys.manager.hub.Logger().Info("SMART fetch", "system", sys.Id, "interval", sys.smartInterval.String())
+		lastFetch, _ := sys.manager.smartFetchMap.GetOk(sys.Id)
+		if time.Since(time.UnixMilli(lastFetch-1e4)) >= sys.smartInterval && sys.smartFetching.CompareAndSwap(false, true) {
 			go func() {
 				defer sys.smartFetching.Store(false)
+				sys.manager.smartFetchMap.Set(sys.Id, time.Now().UnixMilli(), sys.smartInterval+time.Minute)
 				_ = sys.FetchAndSaveSmartDevices()
 			}()
 		}
@@ -185,7 +184,7 @@ func (sys *System) handlePaused() {
 
 // createRecords updates the system record and adds system_stats and container_stats records
 func (sys *System) createRecords(data *system.CombinedData) (*core.Record, error) {
-	systemRecord, err := sys.getRecord(sys.manager.hub)
+	systemRecord, err := sys.getRecord()
 	if err != nil {
 		return nil, err
 	}
@@ -344,8 +343,8 @@ func createContainerRecords(app core.App, data []*container.Stats, systemId stri
 
 // getRecord retrieves the system record from the database.
 // If the record is not found, it removes the system from the manager.
-func (sys *System) getRecord(app core.App) (*core.Record, error) {
-	record, err := app.FindRecordById("systems", sys.Id)
+func (sys *System) getRecord() (*core.Record, error) {
+	record, err := sys.manager.hub.FindRecordById("systems", sys.Id)
 	if err != nil || record == nil {
 		_ = sys.manager.RemoveSystem(sys.Id)
 		return nil, err
@@ -353,27 +352,6 @@ func (sys *System) getRecord(app core.App) (*core.Record, error) {
 	return record, nil
 }
 
-// HasUser checks if the given user is in the system's users list.
-// Returns true if SHARE_ALL_SYSTEMS is enabled (any authenticated user can access any system).
-func (sys *System) HasUser(app core.App, user *core.Record) bool {
-	if user == nil {
-		return false
-	}
-	if v, _ := utils.GetEnv("SHARE_ALL_SYSTEMS"); v == "true" {
-		return true
-	}
-	var recordData = struct {
-		Users string
-	}{}
-	err := app.DB().NewQuery("SELECT users FROM systems WHERE id={:id}").
-		Bind(dbx.Params{"id": sys.Id}).
-		One(&recordData)
-	if err != nil || recordData.Users == "" {
-		return false
-	}
-	return strings.Contains(recordData.Users, user.Id)
-}
-
 // setDown marks a system as down in the database.
 // It takes the original error that caused the system to go down and returns any error
 // encountered during the process of updating the system status.
@@ -381,14 +359,13 @@ func (sys *System) setDown(originalError error) error {
 	if sys.Status == down || sys.Status == paused {
 		return nil
 	}
-	record, err := sys.getRecord(sys.manager.hub)
+	record, err := sys.getRecord()
 	if err != nil {
 		return err
 	}
 	if originalError != nil {
 		sys.manager.hub.Logger().Error("System down", "system", record.GetString("name"), "err", originalError)
 	}
-	sys.detailsFetched.Store(false)
 	record.Set("status", down)
 	return sys.manager.hub.SaveNoValidate(record)
 }
@@ -532,16 +509,11 @@ func (sys *System) FetchSystemdInfoFromAgent(serviceName string) (systemd.Servic
 	return result, err
 }
 
-// FetchSmartDataFromAgent fetches SMART data from the agent.
-func (sys *System) FetchSmartDataFromAgent() (smart.SmartDataResponse, error) {
+// FetchSmartDataFromAgent fetches SMART data from the agent
+func (sys *System) FetchSmartDataFromAgent() (map[string]smart.SmartData, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
 	defer cancel()
-	if sys.agentVersion.LT(beszel.MinVersionAgentResponse) {
-		var data map[string]smart.SmartData
-		err := sys.request(ctx, common.GetSmartData, nil, &data)
-		return smart.SmartDataResponse{Data: data}, err
-	}
-	var result smart.SmartDataResponse
+	var result map[string]smart.SmartData
 	err := sys.request(ctx, common.GetSmartData, nil, &result)
 	return result, err
 }
@@ -629,17 +601,10 @@ func (sys *System) runSSHOperation(timeout time.Duration, retries int, operation
 			continue
 		}
 
-		// Bound the whole operation. A half-open TCP connection (a dead peer that
-		// never sends RST/FIN) or a wedged agent that accepts the session but
-		// never writes a response would otherwise block the read forever. Because
-		// StartUpdater runs update() synchronously on its ticker, that stalls the
-		// per-system updater indefinitely with no error and no re-dial until the
-		// hub is restarted (issue #2041). On timeout we tear down the connection
-		// so the blocked read unwinds and the system is re-dialed on the next tick.
-		retry, opErr := runWithTimeout(sshOperationTimeout, func() (bool, error) {
+		retry, opErr := func() (bool, error) {
 			defer session.Close()
 			return operation(session)
-		}, sys.closeSSHConnection)
+		}()
 
 		if opErr == nil {
 			return nil
@@ -658,43 +623,6 @@ func (sys *System) runSSHOperation(timeout time.Duration, retries int, operation
 	return fmt.Errorf("ssh operation failed")
 }
 
-// sshOperationTimeout bounds a single SSH data exchange (send request, read
-// response, wait for the remote command to exit). It is more generous than the
-// session-creation timeout to tolerate briefly slow agents, but is kept well
-// under the collection interval so a stalled connection is detected and
-// re-dialed within one cycle (see issue #2041).
-const sshOperationTimeout = 20 * time.Second
-
-// runWithTimeout runs op in a goroutine and returns its result, or, if op does
-// not finish within timeout, calls onTimeout (used to tear down the connection
-// so a blocked op can unwind) and returns a retryable timeout error. This
-// guarantees the caller can never block indefinitely on a dead SSH connection.
-func runWithTimeout(timeout time.Duration, op func() (bool, error), onTimeout func()) (retry bool, err error) {
-	type opResult struct {
-		retry bool
-		err   error
-	}
-	// Buffered so the op goroutine never leaks even when we return on timeout.
-	done := make(chan opResult, 1)
-	go func() {
-		r, e := op()
-		done <- opResult{retry: r, err: e}
-	}()
-
-	timer := time.NewTimer(timeout)
-	defer timer.Stop()
-
-	select {
-	case res := <-done:
-		return res.retry, res.err
-	case <-timer.C:
-		if onTimeout != nil {
-			onTimeout()
-		}
-		return true, fmt.Errorf("ssh operation timed out after %s", timeout)
-	}
-}
-
 // createSSHClient creates a new SSH client for the system
 func (s *System) createSSHClient() error {
 	if s.manager.sshConfig == nil {
@@ -710,43 +638,14 @@ func (s *System) createSSHClient() error {
 		host = net.JoinHostPort(host, s.Port)
 	}
 	var err error
-	s.client, err = dialSSHWithKeepAlive(network, host, s.manager.sshConfig)
+	s.client, err = ssh.Dial(network, host, s.manager.sshConfig)
 	if err != nil {
 		return err
 	}
 	s.agentVersion, _ = extractAgentVersion(string(s.client.Conn.ServerVersion()))
-	s.manager.resetFailedSmartFetchState(s.Id)
 	return nil
 }
 
-// sshKeepAliveInterval is the TCP keep-alive idle interval for SSH connections
-// to agents. Enabling OS-level keep-alives lets the hub eventually detect a
-// dead peer on an otherwise idle connection instead of trusting it forever.
-// This is a backstop for genuine network death; an application-level wedge
-// (agent process hung while its kernel keeps ACKing) is caught by the
-// per-operation timeout in runSSHOperation instead (see issue #2041).
-const sshKeepAliveInterval = 30 * time.Second
-
-// dialSSHWithKeepAlive dials an SSH connection like ssh.Dial, but enables TCP
-// keep-alive on the underlying connection so half-open connections are
-// eventually detected by the operating system.
-func dialSSHWithKeepAlive(network, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
-	dialer := net.Dialer{
-		Timeout:   config.Timeout,
-		KeepAlive: sshKeepAliveInterval,
-	}
-	conn, err := dialer.Dial(network, addr)
-	if err != nil {
-		return nil, err
-	}
-	sshConn, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
-	if err != nil {
-		_ = conn.Close()
-		return nil, err
-	}
-	return ssh.NewClient(sshConn, chans, reqs), nil
-}
-
 // createSessionWithTimeout creates a new SSH session with a timeout to avoid hanging
 // in case of network issues
 func (sys *System) createSessionWithTimeout(timeout time.Duration) (*ssh.Session, error) {

internal/hub/systems/system_manager.go

@@ -41,10 +41,10 @@ var errSystemExists = errors.New("system exists")
 // SystemManager manages a collection of monitored systems and their connections.
 // It handles system lifecycle, status updates, and maintains both SSH and WebSocket connections.
 type SystemManager struct {
-	hub           hubLike                               // Hub interface for database and alert operations
-	systems       *store.Store[string, *System]         // Thread-safe store of active systems
-	sshConfig     *ssh.ClientConfig                     // SSH client configuration for system connections
-	smartFetchMap *expirymap.ExpiryMap[smartFetchState] // Stores last SMART fetch time/result; TTL is only for cleanup
+	hub           hubLike                       // Hub interface for database and alert operations
+	systems       *store.Store[string, *System] // Thread-safe store of active systems
+	sshConfig     *ssh.ClientConfig             // SSH client configuration for system connections
+	smartFetchMap *expirymap.ExpiryMap[int64]   // Stores last SMART fetch time per system ID
 }
 
 // hubLike defines the interface requirements for the hub dependency.
@@ -54,7 +54,6 @@ type hubLike interface {
 	GetSSHKey(dataDir string) (ssh.Signer, error)
 	HandleSystemAlerts(systemRecord *core.Record, data *system.CombinedData) error
 	HandleStatusAlerts(status string, systemRecord *core.Record) error
-	CancelPendingStatusAlerts(systemID string)
 }
 
 // NewSystemManager creates a new SystemManager instance with the provided hub.
@@ -63,7 +62,7 @@ func NewSystemManager(hub hubLike) *SystemManager {
 	return &SystemManager{
 		systems:       store.New(map[string]*System{}),
 		hub:           hub,
-		smartFetchMap: expirymap.New[smartFetchState](time.Hour),
+		smartFetchMap: expirymap.New[int64](time.Hour),
 	}
 }
 
@@ -190,7 +189,6 @@ func (sm *SystemManager) onRecordAfterUpdateSuccess(e *core.RecordEvent) error {
 			system.closeSSHConnection()
 		}
 		_ = deactivateAlerts(e.App, e.Record.Id)
-		sm.hub.CancelPendingStatusAlerts(e.Record.Id)
 		return e.Next()
 	case pending:
 		// Resume monitoring, preferring existing WebSocket connection
@@ -308,7 +306,6 @@ func (sm *SystemManager) AddWebSocketSystem(systemId string, agentVersion semver
 	if err != nil {
 		return err
 	}
-	sm.resetFailedSmartFetchState(systemId)
 
 	system := sm.NewSystem(systemId)
 	system.WsConn = wsConn
@@ -320,15 +317,6 @@ func (sm *SystemManager) AddWebSocketSystem(systemId string, agentVersion semver
 	return nil
 }
 
-// resetFailedSmartFetchState clears only failed SMART cooldown entries so a fresh
-// agent reconnect retries SMART discovery immediately after configuration changes.
-func (sm *SystemManager) resetFailedSmartFetchState(systemID string) {
-	state, ok := sm.smartFetchMap.GetOk(systemID)
-	if ok && !state.Successful {
-		sm.smartFetchMap.Remove(systemID)
-	}
-}
-
 // createSSHClientConfig initializes the SSH client configuration for connecting to an agent's server
 func (sm *SystemManager) createSSHClientConfig() error {
 	privateKey, err := sm.hub.GetSSHKey("")

internal/hub/systems/system_smart.go

@@ -4,67 +4,22 @@ import (
 	"database/sql"
 	"errors"
 	"strings"
-	"time"
 
 	"github.com/henrygd/beszel/internal/entities/smart"
-	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 )
 
-type smartFetchState struct {
-	LastAttempt int64
-	Successful  bool
-}
-
 // FetchAndSaveSmartDevices fetches SMART data from the agent and saves it to the database
 func (sys *System) FetchAndSaveSmartDevices() error {
-	response, err := sys.FetchSmartDataFromAgent()
-	if err != nil {
-		sys.recordSmartFetchResult(err, 0)
+	smartData, err := sys.FetchSmartDataFromAgent()
+	if err != nil || len(smartData) == 0 {
 		return err
 	}
-	err = sys.saveSmartDevices(response.Data, response.Complete)
-	sys.recordSmartFetchResult(err, len(response.Data))
-	return err
+	return sys.saveSmartDevices(smartData)
 }
 
-// recordSmartFetchResult stores a cooldown entry for the SMART interval and marks
-// whether the last fetch produced any devices, so failed setup can retry on reconnect.
-func (sys *System) recordSmartFetchResult(err error, deviceCount int) {
-	if sys.manager == nil {
-		return
-	}
-	interval := sys.smartFetchInterval()
-	success := err == nil && deviceCount > 0
-	if sys.manager.hub != nil {
-		sys.manager.hub.Logger().Info("SMART fetch result", "system", sys.Id, "success", success, "devices", deviceCount, "interval", interval.String(), "err", err)
-	}
-	sys.manager.smartFetchMap.Set(sys.Id, smartFetchState{LastAttempt: time.Now().UnixMilli(), Successful: success}, interval+time.Minute)
-}
-
-// shouldFetchSmart returns true when there is no active SMART cooldown entry for this system.
-func (sys *System) shouldFetchSmart() bool {
-	if sys.manager == nil {
-		return true
-	}
-	state, ok := sys.manager.smartFetchMap.GetOk(sys.Id)
-	if !ok {
-		return true
-	}
-	return !time.UnixMilli(state.LastAttempt).Add(sys.smartFetchInterval()).After(time.Now())
-}
-
-// smartFetchInterval returns the agent-provided SMART interval or the default when unset.
-func (sys *System) smartFetchInterval() time.Duration {
-	if sys.smartInterval > 0 {
-		return sys.smartInterval
-	}
-	return time.Hour
-}
-
-// saveSmartDevices saves SMART device data and, after a complete refresh,
-// removes rows for devices that are no longer reported.
-func (sys *System) saveSmartDevices(smartData map[string]smart.SmartData, complete bool) error {
+// saveSmartDevices saves SMART device data to the smart_devices collection
+func (sys *System) saveSmartDevices(smartData map[string]smart.SmartData) error {
 	if len(smartData) == 0 {
 		return nil
 	}
@@ -75,49 +30,20 @@ func (sys *System) saveSmartDevices(smartData map[string]smart.SmartData, comple
 		return err
 	}
 
-	currentIDs := make(map[string]struct{}, len(smartData))
-	for deviceKey := range smartData {
-		currentIDs[makeStableHashId(sys.Id, deviceKey)] = struct{}{}
+	for deviceKey, device := range smartData {
+		if err := sys.upsertSmartDeviceRecord(collection, deviceKey, device); err != nil {
+			return err
+		}
 	}
 
-	err = hub.RunInTransaction(func(txApp core.App) error {
-		if complete {
-			existing, err := txApp.FindRecordsByFilter(
-				collection,
-				"system = {:system}",
-				"",
-				0,
-				0,
-				dbx.Params{"system": sys.Id},
-			)
-			if err != nil {
-				return err
-			}
-			for _, record := range existing {
-				if _, ok := currentIDs[record.Id]; ok {
-					continue
-				}
-				if err := txApp.Delete(record); err != nil {
-					return err
-				}
-			}
-		}
-
-		for deviceKey, device := range smartData {
-			if err := sys.upsertSmartDeviceRecord(txApp, collection, deviceKey, device); err != nil {
-				return err
-			}
-		}
-
-		return nil
-	})
-	return err
+	return nil
 }
 
-func (sys *System) upsertSmartDeviceRecord(app core.App, collection *core.Collection, deviceKey string, device smart.SmartData) error {
+func (sys *System) upsertSmartDeviceRecord(collection *core.Collection, deviceKey string, device smart.SmartData) error {
+	hub := sys.manager.hub
 	recordID := makeStableHashId(sys.Id, deviceKey)
 
-	record, err := app.FindRecordById(collection, recordID)
+	record, err := hub.FindRecordById(collection, recordID)
 	if err != nil {
 		if !errors.Is(err, sql.ErrNoRows) {
 			return err
@@ -145,7 +71,7 @@ func (sys *System) upsertSmartDeviceRecord(app core.App, collection *core.Collec
 	record.Set("cycles", powerCycles)
 	record.Set("attributes", device.Attributes)
 
-	return app.SaveNoValidate(record)
+	return hub.SaveNoValidate(record)
 }
 
 // extractPowerMetrics extracts power on hours and power cycles from SMART attributes

internal/hub/systems/system_smart_test.go

@@ -1,229 +0,0 @@
-//go:build testing
-
-package systems
-
-import (
-	"errors"
-	"testing"
-	"time"
-
-	"github.com/henrygd/beszel/internal/entities/smart"
-	esystem "github.com/henrygd/beszel/internal/entities/system"
-	"github.com/henrygd/beszel/internal/hub/expirymap"
-	_ "github.com/henrygd/beszel/internal/migrations"
-
-	"github.com/pocketbase/pocketbase/core"
-	pbtests "github.com/pocketbase/pocketbase/tests"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/crypto/ssh"
-)
-
-// stubHub implements hubLike using a plain pocketbase test app, so
-// smart-device DB tests can run in-package without an import cycle to
-// internal/hub (which imports this package).
-type stubHub struct{ core.App }
-
-func (stubHub) GetSSHKey(dataDir string) (ssh.Signer, error) { return nil, nil }
-func (stubHub) HandleSystemAlerts(systemRecord *core.Record, data *esystem.CombinedData) error {
-	return nil
-}
-func (stubHub) HandleStatusAlerts(status string, systemRecord *core.Record) error { return nil }
-func (stubHub) CancelPendingStatusAlerts(systemID string)                         {}
-
-// newTestSystemWithHub creates a System backed by a real (temp) database, along
-// with a matching "systems" record, for tests that need to exercise DB reads/writes.
-func newTestSystemWithHub(t *testing.T) (*System, *pbtests.TestApp) {
-	t.Helper()
-	testApp, err := pbtests.NewTestApp(t.TempDir())
-	require.NoError(t, err)
-	t.Cleanup(testApp.Cleanup)
-
-	sm := &SystemManager{hub: stubHub{testApp}, smartFetchMap: expirymap.New[smartFetchState](time.Hour)}
-	t.Cleanup(sm.smartFetchMap.StopCleaner)
-
-	col, err := testApp.FindCachedCollectionByNameOrId("systems")
-	require.NoError(t, err)
-	systemRecord := core.NewRecord(col)
-	systemRecord.Set("name", "test-system")
-	systemRecord.Set("host", "127.0.0.1")
-	systemRecord.Set("port", "45876")
-	require.NoError(t, testApp.SaveNoValidate(systemRecord))
-
-	sys := &System{Id: systemRecord.Id, manager: sm}
-	return sys, testApp
-}
-
-func TestRecordSmartFetchResult(t *testing.T) {
-	sm := &SystemManager{smartFetchMap: expirymap.New[smartFetchState](time.Hour)}
-	t.Cleanup(sm.smartFetchMap.StopCleaner)
-
-	sys := &System{
-		Id:            "system-1",
-		manager:       sm,
-		smartInterval: time.Hour,
-	}
-
-	// Successful fetch with devices
-	sys.recordSmartFetchResult(nil, 5)
-	state, ok := sm.smartFetchMap.GetOk(sys.Id)
-	assert.True(t, ok, "expected smart fetch result to be stored")
-	assert.True(t, state.Successful, "expected successful fetch state to be recorded")
-
-	// Failed fetch
-	sys.recordSmartFetchResult(errors.New("failed"), 0)
-	state, ok = sm.smartFetchMap.GetOk(sys.Id)
-	assert.True(t, ok, "expected failed smart fetch state to be stored")
-	assert.False(t, state.Successful, "expected failed smart fetch state to be marked unsuccessful")
-
-	// Successful fetch but no devices
-	sys.recordSmartFetchResult(nil, 0)
-	state, ok = sm.smartFetchMap.GetOk(sys.Id)
-	assert.True(t, ok, "expected fetch with zero devices to be stored")
-	assert.False(t, state.Successful, "expected fetch with zero devices to be marked unsuccessful")
-}
-
-func TestShouldFetchSmart(t *testing.T) {
-	sm := &SystemManager{smartFetchMap: expirymap.New[smartFetchState](time.Hour)}
-	t.Cleanup(sm.smartFetchMap.StopCleaner)
-
-	sys := &System{
-		Id:            "system-1",
-		manager:       sm,
-		smartInterval: time.Hour,
-	}
-
-	assert.True(t, sys.shouldFetchSmart(), "expected initial smart fetch to be allowed")
-
-	sys.recordSmartFetchResult(errors.New("failed"), 0)
-	assert.False(t, sys.shouldFetchSmart(), "expected smart fetch to be blocked while interval entry exists")
-
-	sm.smartFetchMap.Remove(sys.Id)
-	assert.True(t, sys.shouldFetchSmart(), "expected smart fetch to be allowed after interval entry is cleared")
-}
-
-func TestShouldFetchSmart_IgnoresExtendedTTLWhenFetchIsDue(t *testing.T) {
-	sm := &SystemManager{smartFetchMap: expirymap.New[smartFetchState](time.Hour)}
-	t.Cleanup(sm.smartFetchMap.StopCleaner)
-
-	sys := &System{
-		Id:            "system-1",
-		manager:       sm,
-		smartInterval: time.Hour,
-	}
-
-	sm.smartFetchMap.Set(sys.Id, smartFetchState{
-		LastAttempt: time.Now().Add(-2 * time.Hour).UnixMilli(),
-		Successful:  true,
-	}, 10*time.Minute)
-	sm.smartFetchMap.UpdateExpiration(sys.Id, 3*time.Hour)
-
-	assert.True(t, sys.shouldFetchSmart(), "expected fetch time to take precedence over updated TTL")
-}
-
-func TestResetFailedSmartFetchState(t *testing.T) {
-	sm := &SystemManager{smartFetchMap: expirymap.New[smartFetchState](time.Hour)}
-	t.Cleanup(sm.smartFetchMap.StopCleaner)
-
-	sm.smartFetchMap.Set("system-1", smartFetchState{LastAttempt: time.Now().UnixMilli(), Successful: false}, time.Hour)
-	sm.resetFailedSmartFetchState("system-1")
-	_, ok := sm.smartFetchMap.GetOk("system-1")
-	assert.False(t, ok, "expected failed smart fetch state to be cleared on reconnect")
-
-	sm.smartFetchMap.Set("system-1", smartFetchState{LastAttempt: time.Now().UnixMilli(), Successful: true}, time.Hour)
-	sm.resetFailedSmartFetchState("system-1")
-	_, ok = sm.smartFetchMap.GetOk("system-1")
-	assert.True(t, ok, "expected successful smart fetch state to be preserved")
-}
-
-// countSmartDeviceRecords returns the number of smart_devices rows for the given system.
-func countSmartDeviceRecords(t *testing.T, app core.App, systemID string) []*core.Record {
-	t.Helper()
-	records, err := app.FindAllRecords("smart_devices", nil)
-	require.NoError(t, err)
-	var forSystem []*core.Record
-	for _, r := range records {
-		if r.GetString("system") == systemID {
-			forSystem = append(forSystem, r)
-		}
-	}
-	return forSystem
-}
-
-func TestSaveSmartDevices_RemovesStaleDevices(t *testing.T) {
-	sys, testApp := newTestSystemWithHub(t)
-
-	// first fetch reports two devices: sda (serial AAA) and sdb (serial BBB)
-	err := sys.saveSmartDevices(map[string]smart.SmartData{
-		"AAA": {SerialNumber: "AAA", DiskName: "sda", ModelName: "Disk A"},
-		"BBB": {SerialNumber: "BBB", DiskName: "sdb", ModelName: "Disk B"},
-	}, true)
-	require.NoError(t, err)
-
-	records := countSmartDeviceRecords(t, testApp, sys.Id)
-	require.Len(t, records, 2, "expected both devices to be saved")
-
-	var recordA *core.Record
-	for _, r := range records {
-		if r.GetString("serial") == "AAA" {
-			recordA = r
-		}
-	}
-	require.NotNil(t, recordA, "expected to find device AAA")
-	originalID := recordA.Id
-
-	deleteEvents := 0
-	testApp.OnRecordAfterDeleteSuccess("smart_devices").BindFunc(func(e *core.RecordEvent) error {
-		deleteEvents++
-		return e.Next()
-	})
-
-	// A complete refresh confirms that BBB is gone, so remove it through
-	// PocketBase and notify realtime subscribers.
-	err = sys.saveSmartDevices(map[string]smart.SmartData{
-		"AAA": {SerialNumber: "AAA", DiskName: "sda", ModelName: "Disk A", Temperature: 42},
-	}, true)
-	require.NoError(t, err)
-
-	records = countSmartDeviceRecords(t, testApp, sys.Id)
-	require.Len(t, records, 1, "expected stale device BBB to be removed")
-	assert.Equal(t, "AAA", records[0].GetString("serial"))
-	assert.Equal(t, originalID, records[0].Id, "expected existing device to be updated in place, not recreated")
-	assert.EqualValues(t, 42, records[0].GetInt("temp"))
-	assert.Equal(t, 1, deleteEvents, "expected PocketBase delete hooks to run")
-}
-
-func TestSaveSmartDevices_IncompleteDataDoesNotRemoveDevices(t *testing.T) {
-	sys, testApp := newTestSystemWithHub(t)
-
-	require.NoError(t, sys.saveSmartDevices(map[string]smart.SmartData{
-		"AAA": {SerialNumber: "AAA", DiskName: "sda"},
-		"BBB": {SerialNumber: "BBB", DiskName: "sdb"},
-	}, true))
-
-	// AAA was collected but BBB failed. The response is useful for updating AAA,
-	// but it is not authoritative enough to remove BBB.
-	require.NoError(t, sys.saveSmartDevices(map[string]smart.SmartData{
-		"AAA": {SerialNumber: "AAA", DiskName: "sda", Temperature: 42},
-	}, false))
-
-	assert.Len(t, countSmartDeviceRecords(t, testApp, sys.Id), 2)
-	recordA, err := testApp.FindRecordById("smart_devices", makeStableHashId(sys.Id, "AAA"))
-	require.NoError(t, err)
-	assert.EqualValues(t, 42, recordA.GetInt("temp"))
-}
-
-func TestSaveSmartDevices_EmptyDataIsNoop(t *testing.T) {
-	sys, testApp := newTestSystemWithHub(t)
-
-	err := sys.saveSmartDevices(map[string]smart.SmartData{
-		"AAA": {SerialNumber: "AAA", DiskName: "sda"},
-	}, true)
-	require.NoError(t, err)
-
-	err = sys.saveSmartDevices(map[string]smart.SmartData{}, true)
-	require.NoError(t, err)
-
-	records := countSmartDeviceRecords(t, testApp, sys.Id)
-	assert.Len(t, records, 1, "empty fetch result should not delete existing devices")
-}

internal/hub/systems/systems_test.go

@@ -421,60 +421,3 @@ func testOld(t *testing.T, hub *tests.TestHub) {
 		assert.NoError(t, err)
 	})
 }
-
-func TestHasUser(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	sm := hub.GetSystemManager()
-	err = sm.Initialize()
-	require.NoError(t, err)
-
-	user1, err := tests.CreateUser(hub, "user1@test.com", "password123")
-	require.NoError(t, err)
-	user2, err := tests.CreateUser(hub, "user2@test.com", "password123")
-	require.NoError(t, err)
-
-	systemRecord, err := tests.CreateRecord(hub, "systems", map[string]any{
-		"name":  "has-user-test",
-		"host":  "127.0.0.1",
-		"port":  "33914",
-		"users": []string{user1.Id},
-	})
-	require.NoError(t, err)
-
-	sys, err := sm.GetSystemFromStore(systemRecord.Id)
-	require.NoError(t, err)
-
-	t.Run("user in list returns true", func(t *testing.T) {
-		assert.True(t, sys.HasUser(hub, user1))
-	})
-
-	t.Run("user not in list returns false", func(t *testing.T) {
-		assert.False(t, sys.HasUser(hub, user2))
-	})
-
-	t.Run("unknown user ID returns false", func(t *testing.T) {
-		assert.False(t, sys.HasUser(hub, nil))
-	})
-
-	t.Run("SHARE_ALL_SYSTEMS=true grants access to non-member", func(t *testing.T) {
-		t.Setenv("SHARE_ALL_SYSTEMS", "true")
-		assert.True(t, sys.HasUser(hub, user2))
-	})
-
-	t.Run("BESZEL_HUB_SHARE_ALL_SYSTEMS=true grants access to non-member", func(t *testing.T) {
-		t.Setenv("BESZEL_HUB_SHARE_ALL_SYSTEMS", "true")
-		assert.True(t, sys.HasUser(hub, user2))
-	})
-
-	t.Run("additional user works", func(t *testing.T) {
-		assert.False(t, sys.HasUser(hub, user2))
-		systemRecord.Set("users", []string{user1.Id, user2.Id})
-		err = hub.Save(systemRecord)
-		require.NoError(t, err)
-		assert.True(t, sys.HasUser(hub, user1))
-		assert.True(t, sys.HasUser(hub, user2))
-	})
-}

internal/hub/transport/transport.go

@@ -88,23 +88,15 @@ func unmarshalLegacyResponse(resp common.AgentResponse, action common.WebSocketA
 		*d = *resp.String
 		return nil
 	case common.GetSmartData:
-		switch d := dest.(type) {
-		case *map[string]smart.SmartData:
-			if resp.SmartData == nil {
-				return errors.New("no SMART data in response")
-			}
-			*d = resp.SmartData
-			return nil
-		case *smart.SmartDataResponse:
-			if resp.SmartData == nil {
-				return errors.New("no SMART data in response")
-			}
-			d.Data = resp.SmartData
-			d.Complete = resp.SmartComplete
-			return nil
-		default:
+		d, ok := dest.(*map[string]smart.SmartData)
+		if !ok {
 			return fmt.Errorf("unexpected dest type for GetSmartData: %T", dest)
 		}
+		if resp.SmartData == nil {
+			return errors.New("no SMART data in response")
+		}
+		*d = resp.SmartData
+		return nil
 	case common.GetSystemdInfo:
 		d, ok := dest.(*systemd.ServiceDetails)
 		if !ok {

internal/hub/transport/transport_test.go

@@ -1,33 +0,0 @@
-package transport
-
-import (
-	"testing"
-
-	"github.com/henrygd/beszel/internal/common"
-	"github.com/henrygd/beszel/internal/entities/smart"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestUnmarshalSmartDataResponse(t *testing.T) {
-	for _, test := range []struct {
-		name     string
-		complete bool
-	}{
-		{name: "complete response", complete: true},
-		{name: "older agent defaults to incomplete", complete: false},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			response := common.AgentResponse{
-				SmartData: map[string]smart.SmartData{
-					"AAA": {SerialNumber: "AAA"},
-				},
-				SmartComplete: test.complete,
-			}
-			var result smart.SmartDataResponse
-			require.NoError(t, UnmarshalResponse(response, common.GetSmartData, &result))
-			assert.Equal(t, test.complete, result.Complete)
-			assert.Equal(t, "AAA", result.Data["AAA"].SerialNumber)
-		})
-	}
-}

internal/hub/utils/utils.go

@@ -1,12 +0,0 @@
-// Package utils provides utility functions for the hub.
-package utils
-
-import "os"
-
-// GetEnv retrieves an environment variable with a "BESZEL_HUB_" prefix, or falls back to the unprefixed key.
-func GetEnv(key string) (value string, exists bool) {
-	if value, exists = os.LookupEnv("BESZEL_HUB_" + key); exists {
-		return value, exists
-	}
-	return os.LookupEnv(key)
-}

internal/records/records.go

@@ -3,8 +3,10 @@ package records
 
 import (
 	"encoding/json"
-	"log/slog"
+	"fmt"
+	"log"
 	"math"
+	"strings"
 	"time"
 
 	"github.com/henrygd/beszel/internal/entities/container"
@@ -37,6 +39,16 @@ type StatsRecord struct {
 	Stats []byte `db:"stats"`
 }
 
+// global variables for reusing allocations
+var (
+	statsRecord    StatsRecord
+	containerStats []container.Stats
+	sumStats       system.Stats
+	tempStats      system.Stats
+	queryParams    = make(dbx.Params, 1)
+	containerSums  = make(map[string]*container.Stats)
+)
+
 // Create longer records by averaging shorter records
 func (rm *RecordManager) CreateLongerRecords() {
 	// start := time.Now()
@@ -68,18 +80,15 @@ func (rm *RecordManager) CreateLongerRecords() {
 		},
 	}
 	// wrap the operations in a transaction
-	// Pocketbase cron does not handle errors, log them here.
 	rm.app.RunInTransaction(func(txApp core.App) error {
 		var err error
 		collections := [2]*core.Collection{}
 		collections[0], err = txApp.FindCachedCollectionByNameOrId("system_stats")
 		if err != nil {
-			slog.Error("Error finding cached collection using system stats:", "err", err)
 			return err
 		}
 		collections[1], err = txApp.FindCachedCollectionByNameOrId("container_stats")
 		if err != nil {
-			slog.Error("Error finding cached collection using container stats:", "err", err)
 			return err
 		}
 		var systems RecordIds
@@ -145,7 +154,7 @@ func (rm *RecordManager) CreateLongerRecords() {
 						longerRecord.Set("stats", rm.AverageContainerStats(db, recordIds))
 					}
 					if err := txApp.SaveNoValidate(longerRecord); err != nil {
-						slog.Error("failed to save longer record", "err", err)
+						log.Println("failed to save longer record", "err", err)
 					}
 				}
 			}
@@ -154,52 +163,41 @@ func (rm *RecordManager) CreateLongerRecords() {
 		return nil
 	})
 
+	statsRecord.Stats = statsRecord.Stats[:0]
+
 	// log.Println("finished creating longer records", "time (ms)", time.Since(start).Milliseconds())
 }
 
 // Calculate the average stats of a list of system_stats records without reflect
 func (rm *RecordManager) AverageSystemStats(db dbx.Builder, records RecordIds) *system.Stats {
-	stats := make([]system.Stats, 0, len(records))
-	var row StatsRecord
-	params := make(dbx.Params, 1)
-	for _, rec := range records {
-		row.Stats = row.Stats[:0]
-		params["id"] = rec.Id
-		db.NewQuery("SELECT stats FROM system_stats WHERE id = {:id}").Bind(params).One(&row)
-		var s system.Stats
-		if err := json.Unmarshal(row.Stats, &s); err != nil {
-			continue
-		}
-		stats = append(stats, s)
-	}
-	result := AverageSystemStatsSlice(stats)
-	return &result
-}
-
-// AverageSystemStatsSlice computes the average of a slice of system stats.
-func AverageSystemStatsSlice(records []system.Stats) system.Stats {
-	var sum system.Stats
-	count := float64(len(records))
-	if count == 0 {
-		return sum
-	}
-
+	// Clear/reset global structs for reuse
+	sumStats = system.Stats{}
+	tempStats = system.Stats{}
+	sum := &sumStats
+	stats := &tempStats
 	// necessary because uint8 is not big enough for the sum
 	batterySum := 0
-	batteryCount := 0
-	batterySums := make(map[string]uint64)
-	batteryCounts := make(map[string]uint64)
 	// accumulate per-core usage across records
 	var cpuCoresSums []uint64
 	// accumulate cpu breakdown [user, system, iowait, steal, idle]
 	var cpuBreakdownSums []float64
+
+	count := float64(len(records))
 	tempCount := float64(0)
-	var fanSums map[string]uint64
-	fanCount := uint64(0)
 
 	// Accumulate totals
-	for i := range records {
-		stats := &records[i]
+	for _, record := range records {
+		id := record.Id
+		// clear global statsRecord for reuse
+		statsRecord.Stats = statsRecord.Stats[:0]
+		// reset tempStats each iteration to avoid omitzero fields retaining stale values
+		*stats = system.Stats{}
+
+		queryParams["id"] = id
+		db.NewQuery("SELECT stats FROM system_stats WHERE id = {:id}").Bind(queryParams).One(&statsRecord)
+		if err := json.Unmarshal(statsRecord.Stats, stats); err != nil {
+			continue
+		}
 
 		sum.Cpu += stats.Cpu
 		// accumulate cpu time breakdowns if present
@@ -207,8 +205,8 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 			if len(cpuBreakdownSums) < len(stats.CpuBreakdown) {
 				cpuBreakdownSums = append(cpuBreakdownSums, make([]float64, len(stats.CpuBreakdown)-len(cpuBreakdownSums))...)
 			}
-			for j, v := range stats.CpuBreakdown {
-				cpuBreakdownSums[j] += v
+			for i, v := range stats.CpuBreakdown {
+				cpuBreakdownSums[i] += v
 			}
 		}
 		sum.Mem += stats.Mem
@@ -232,18 +230,8 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 		sum.Bandwidth[1] += stats.Bandwidth[1]
 		sum.DiskIO[0] += stats.DiskIO[0]
 		sum.DiskIO[1] += stats.DiskIO[1]
-		for i := range stats.DiskIoStats {
-			sum.DiskIoStats[i] += stats.DiskIoStats[i]
-		}
-		if hasBattery(stats.Battery, stats.Batteries) {
-			batterySum += int(stats.Battery[0])
-			batteryCount++
-			sum.Battery[1] = stats.Battery[1]
-		}
-		for name, percent := range stats.Batteries {
-			batterySums[name] += uint64(percent)
-			batteryCounts[name]++
-		}
+		batterySum += int(stats.Battery[0])
+		sum.Battery[1] = stats.Battery[1]
 
 		// accumulate per-core usage if present
 		if stats.CpuCoresUsage != nil {
@@ -251,8 +239,8 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 				// extend slices to accommodate core count
 				cpuCoresSums = append(cpuCoresSums, make([]uint64, len(stats.CpuCoresUsage)-len(cpuCoresSums))...)
 			}
-			for j, v := range stats.CpuCoresUsage {
-				cpuCoresSums[j] += uint64(v)
+			for i, v := range stats.CpuCoresUsage {
+				cpuCoresSums[i] += uint64(v)
 			}
 		}
 		// Set peak values
@@ -266,9 +254,6 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 		sum.MaxBandwidth[1] = max(sum.MaxBandwidth[1], stats.MaxBandwidth[1], stats.Bandwidth[1])
 		sum.MaxDiskIO[0] = max(sum.MaxDiskIO[0], stats.MaxDiskIO[0], stats.DiskIO[0])
 		sum.MaxDiskIO[1] = max(sum.MaxDiskIO[1], stats.MaxDiskIO[1], stats.DiskIO[1])
-		for i := range stats.DiskIoStats {
-			sum.MaxDiskIoStats[i] = max(sum.MaxDiskIoStats[i], stats.MaxDiskIoStats[i], stats.DiskIoStats[i])
-		}
 
 		// Accumulate network interfaces
 		if sum.NetworkInterfaces == nil {
@@ -294,17 +279,6 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 			}
 		}
 
-		// Accumulate fan speeds
-		if stats.Fans != nil {
-			if fanSums == nil {
-				fanSums = make(map[string]uint64, len(stats.Fans))
-			}
-			fanCount++
-			for key, value := range stats.Fans {
-				fanSums[key] += uint64(value)
-			}
-		}
-
 		// Accumulate extra filesystem stats
 		if stats.ExtraFs != nil {
 			if sum.ExtraFs == nil {
@@ -325,10 +299,6 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 				fs.DiskWriteBytes += value.DiskWriteBytes
 				fs.MaxDiskReadBytes = max(fs.MaxDiskReadBytes, value.MaxDiskReadBytes, value.DiskReadBytes)
 				fs.MaxDiskWriteBytes = max(fs.MaxDiskWriteBytes, value.MaxDiskWriteBytes, value.DiskWriteBytes)
-				for i := range value.DiskIoStats {
-					fs.DiskIoStats[i] += value.DiskIoStats[i]
-					fs.MaxDiskIoStats[i] = max(fs.MaxDiskIoStats[i], value.MaxDiskIoStats[i], value.DiskIoStats[i])
-				}
 			}
 		}
 
@@ -363,161 +333,133 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 		}
 	}
 
-	// Compute averages
-	sum.Cpu = twoDecimals(sum.Cpu / count)
-	sum.Mem = twoDecimals(sum.Mem / count)
-	sum.MemUsed = twoDecimals(sum.MemUsed / count)
-	sum.MemPct = twoDecimals(sum.MemPct / count)
-	sum.MemBuffCache = twoDecimals(sum.MemBuffCache / count)
-	sum.MemZfsArc = twoDecimals(sum.MemZfsArc / count)
-	sum.Swap = twoDecimals(sum.Swap / count)
-	sum.SwapUsed = twoDecimals(sum.SwapUsed / count)
-	sum.DiskTotal = twoDecimals(sum.DiskTotal / count)
-	sum.DiskUsed = twoDecimals(sum.DiskUsed / count)
-	sum.DiskPct = twoDecimals(sum.DiskPct / count)
-	sum.DiskReadPs = twoDecimals(sum.DiskReadPs / count)
-	sum.DiskWritePs = twoDecimals(sum.DiskWritePs / count)
-	sum.DiskIO[0] = sum.DiskIO[0] / uint64(count)
-	sum.DiskIO[1] = sum.DiskIO[1] / uint64(count)
-	for i := range sum.DiskIoStats {
-		sum.DiskIoStats[i] = twoDecimals(sum.DiskIoStats[i] / count)
-	}
-	sum.NetworkSent = twoDecimals(sum.NetworkSent / count)
-	sum.NetworkRecv = twoDecimals(sum.NetworkRecv / count)
-	sum.LoadAvg[0] = twoDecimals(sum.LoadAvg[0] / count)
-	sum.LoadAvg[1] = twoDecimals(sum.LoadAvg[1] / count)
-	sum.LoadAvg[2] = twoDecimals(sum.LoadAvg[2] / count)
-	sum.Bandwidth[0] = sum.Bandwidth[0] / uint64(count)
-	sum.Bandwidth[1] = sum.Bandwidth[1] / uint64(count)
-	if batteryCount > 0 {
-		sum.Battery[0] = uint8(batterySum / batteryCount)
-	}
-	if len(batterySums) > 0 {
-		sum.Batteries = make(map[string]uint8, len(batterySums))
-		for name, total := range batterySums {
-			sum.Batteries[name] = uint8(total / batteryCounts[name])
-		}
-	}
+	// Compute averages in place
+	if count > 0 {
+		sum.Cpu = twoDecimals(sum.Cpu / count)
+		sum.Mem = twoDecimals(sum.Mem / count)
+		sum.MemUsed = twoDecimals(sum.MemUsed / count)
+		sum.MemPct = twoDecimals(sum.MemPct / count)
+		sum.MemBuffCache = twoDecimals(sum.MemBuffCache / count)
+		sum.MemZfsArc = twoDecimals(sum.MemZfsArc / count)
+		sum.Swap = twoDecimals(sum.Swap / count)
+		sum.SwapUsed = twoDecimals(sum.SwapUsed / count)
+		sum.DiskTotal = twoDecimals(sum.DiskTotal / count)
+		sum.DiskUsed = twoDecimals(sum.DiskUsed / count)
+		sum.DiskPct = twoDecimals(sum.DiskPct / count)
+		sum.DiskReadPs = twoDecimals(sum.DiskReadPs / count)
+		sum.DiskWritePs = twoDecimals(sum.DiskWritePs / count)
+		sum.DiskIO[0] = sum.DiskIO[0] / uint64(count)
+		sum.DiskIO[1] = sum.DiskIO[1] / uint64(count)
+		sum.NetworkSent = twoDecimals(sum.NetworkSent / count)
+		sum.NetworkRecv = twoDecimals(sum.NetworkRecv / count)
+		sum.LoadAvg[0] = twoDecimals(sum.LoadAvg[0] / count)
+		sum.LoadAvg[1] = twoDecimals(sum.LoadAvg[1] / count)
+		sum.LoadAvg[2] = twoDecimals(sum.LoadAvg[2] / count)
+		sum.Bandwidth[0] = sum.Bandwidth[0] / uint64(count)
+		sum.Bandwidth[1] = sum.Bandwidth[1] / uint64(count)
+		sum.Battery[0] = uint8(batterySum / int(count))
 
-	// Average network interfaces
-	if sum.NetworkInterfaces != nil {
-		for key := range sum.NetworkInterfaces {
-			sum.NetworkInterfaces[key] = [4]uint64{
-				sum.NetworkInterfaces[key][0] / uint64(count),
-				sum.NetworkInterfaces[key][1] / uint64(count),
-				sum.NetworkInterfaces[key][2],
-				sum.NetworkInterfaces[key][3],
-			}
-		}
-	}
-
-	// Average temperatures
-	if sum.Temperatures != nil && tempCount > 0 {
-		for key := range sum.Temperatures {
-			sum.Temperatures[key] = twoDecimals(sum.Temperatures[key] / tempCount)
-		}
-	}
-
-	// Average fan speeds
-	if fanSums != nil && fanCount > 0 {
-		sum.Fans = make(map[string]uint16, len(fanSums))
-		for key, value := range fanSums {
-			sum.Fans[key] = uint16(value / fanCount)
-		}
-	}
-
-	// Average extra filesystem stats
-	if sum.ExtraFs != nil {
-		for key := range sum.ExtraFs {
-			fs := sum.ExtraFs[key]
-			fs.DiskTotal = twoDecimals(fs.DiskTotal / count)
-			fs.DiskUsed = twoDecimals(fs.DiskUsed / count)
-			fs.DiskWritePs = twoDecimals(fs.DiskWritePs / count)
-			fs.DiskReadPs = twoDecimals(fs.DiskReadPs / count)
-			fs.DiskReadBytes = fs.DiskReadBytes / uint64(count)
-			fs.DiskWriteBytes = fs.DiskWriteBytes / uint64(count)
-			for i := range fs.DiskIoStats {
-				fs.DiskIoStats[i] = twoDecimals(fs.DiskIoStats[i] / count)
-			}
-		}
-	}
-
-	// Average GPU data
-	if sum.GPUData != nil {
-		for id := range sum.GPUData {
-			gpu := sum.GPUData[id]
-			gpu.Temperature = twoDecimals(gpu.Temperature / count)
-			gpu.MemoryUsed = twoDecimals(gpu.MemoryUsed / count)
-			gpu.MemoryTotal = twoDecimals(gpu.MemoryTotal / count)
-			gpu.Usage = twoDecimals(gpu.Usage / count)
-			gpu.Power = twoDecimals(gpu.Power / count)
-			gpu.Count = twoDecimals(gpu.Count / count)
-
-			if gpu.Engines != nil {
-				for engineKey := range gpu.Engines {
-					gpu.Engines[engineKey] = twoDecimals(gpu.Engines[engineKey] / count)
+		// Average network interfaces
+		if sum.NetworkInterfaces != nil {
+			for key := range sum.NetworkInterfaces {
+				sum.NetworkInterfaces[key] = [4]uint64{
+					sum.NetworkInterfaces[key][0] / uint64(count),
+					sum.NetworkInterfaces[key][1] / uint64(count),
+					sum.NetworkInterfaces[key][2],
+					sum.NetworkInterfaces[key][3],
 				}
 			}
-
-			sum.GPUData[id] = gpu
 		}
-	}
 
-	// Average per-core usage
-	if len(cpuCoresSums) > 0 {
-		avg := make(system.Uint8Slice, len(cpuCoresSums))
-		for i := range cpuCoresSums {
-			v := math.Round(float64(cpuCoresSums[i]) / count)
-			avg[i] = uint8(v)
+		// Average temperatures
+		if sum.Temperatures != nil && tempCount > 0 {
+			for key := range sum.Temperatures {
+				sum.Temperatures[key] = twoDecimals(sum.Temperatures[key] / tempCount)
+			}
 		}
-		sum.CpuCoresUsage = avg
-	}
 
-	// Average CPU breakdown
-	if len(cpuBreakdownSums) > 0 {
-		avg := make([]float64, len(cpuBreakdownSums))
-		for i := range cpuBreakdownSums {
-			avg[i] = twoDecimals(cpuBreakdownSums[i] / count)
+		// Average extra filesystem stats
+		if sum.ExtraFs != nil {
+			for key := range sum.ExtraFs {
+				fs := sum.ExtraFs[key]
+				fs.DiskTotal = twoDecimals(fs.DiskTotal / count)
+				fs.DiskUsed = twoDecimals(fs.DiskUsed / count)
+				fs.DiskWritePs = twoDecimals(fs.DiskWritePs / count)
+				fs.DiskReadPs = twoDecimals(fs.DiskReadPs / count)
+				fs.DiskReadBytes = fs.DiskReadBytes / uint64(count)
+				fs.DiskWriteBytes = fs.DiskWriteBytes / uint64(count)
+			}
+		}
+
+		// Average GPU data
+		if sum.GPUData != nil {
+			for id := range sum.GPUData {
+				gpu := sum.GPUData[id]
+				gpu.Temperature = twoDecimals(gpu.Temperature / count)
+				gpu.MemoryUsed = twoDecimals(gpu.MemoryUsed / count)
+				gpu.MemoryTotal = twoDecimals(gpu.MemoryTotal / count)
+				gpu.Usage = twoDecimals(gpu.Usage / count)
+				gpu.Power = twoDecimals(gpu.Power / count)
+				gpu.Count = twoDecimals(gpu.Count / count)
+
+				if gpu.Engines != nil {
+					for engineKey := range gpu.Engines {
+						gpu.Engines[engineKey] = twoDecimals(gpu.Engines[engineKey] / count)
+					}
+				}
+
+				sum.GPUData[id] = gpu
+			}
+		}
+
+		// Average per-core usage
+		if len(cpuCoresSums) > 0 {
+			avg := make(system.Uint8Slice, len(cpuCoresSums))
+			for i := range cpuCoresSums {
+				v := math.Round(float64(cpuCoresSums[i]) / count)
+				avg[i] = uint8(v)
+			}
+			sum.CpuCoresUsage = avg
+		}
+
+		// Average CPU breakdown
+		if len(cpuBreakdownSums) > 0 {
+			avg := make([]float64, len(cpuBreakdownSums))
+			for i := range cpuBreakdownSums {
+				avg[i] = twoDecimals(cpuBreakdownSums[i] / count)
+			}
+			sum.CpuBreakdown = avg
 		}
-		sum.CpuBreakdown = avg
 	}
 
 	return sum
 }
 
-func hasBattery(legacy [2]uint8, batteries map[string]uint8) bool {
-	return legacy != [2]uint8{} || len(batteries) > 0
-}
-
 // Calculate the average stats of a list of container_stats records
 func (rm *RecordManager) AverageContainerStats(db dbx.Builder, records RecordIds) []container.Stats {
-	allStats := make([][]container.Stats, 0, len(records))
-	var row StatsRecord
-	params := make(dbx.Params, 1)
-	for _, rec := range records {
-		row.Stats = row.Stats[:0]
-		params["id"] = rec.Id
-		db.NewQuery("SELECT stats FROM container_stats WHERE id = {:id}").Bind(params).One(&row)
-		var cs []container.Stats
-		if err := json.Unmarshal(row.Stats, &cs); err != nil {
-			return []container.Stats{}
-		}
-		allStats = append(allStats, cs)
+	// Clear global map for reuse
+	for k := range containerSums {
+		delete(containerSums, k)
 	}
-	return AverageContainerStatsSlice(allStats)
-}
-
-// AverageContainerStatsSlice computes the average of container stats across multiple time periods.
-func AverageContainerStatsSlice(records [][]container.Stats) []container.Stats {
-	if len(records) == 0 {
-		return []container.Stats{}
-	}
-	sums := make(map[string]*container.Stats)
+	sums := containerSums
 	count := float64(len(records))
 
-	for _, containerStats := range records {
+	for i := range records {
+		id := records[i].Id
+		// clear global statsRecord for reuse
+		statsRecord.Stats = statsRecord.Stats[:0]
+		// must set to nil (not [:0]) to avoid json.Unmarshal reusing backing array
+		// which causes omitzero fields to inherit stale values from previous iterations
+		containerStats = nil
+
+		queryParams["id"] = id
+		db.NewQuery("SELECT stats FROM container_stats WHERE id = {:id}").Bind(queryParams).One(&statsRecord)
+
+		if err := json.Unmarshal(statsRecord.Stats, &containerStats); err != nil {
+			return []container.Stats{}
+		}
 		for i := range containerStats {
-			stat := &containerStats[i]
+			stat := containerStats[i]
 			if _, ok := sums[stat.Name]; !ok {
 				sums[stat.Name] = &container.Stats{Name: stat.Name}
 			}
@@ -546,6 +488,133 @@ func AverageContainerStatsSlice(records [][]container.Stats) []container.Stats {
 	return result
 }
 
+// Delete old records
+func (rm *RecordManager) DeleteOldRecords() {
+	rm.app.RunInTransaction(func(txApp core.App) error {
+		err := deleteOldSystemStats(txApp)
+		if err != nil {
+			return err
+		}
+		err = deleteOldContainerRecords(txApp)
+		if err != nil {
+			return err
+		}
+		err = deleteOldSystemdServiceRecords(txApp)
+		if err != nil {
+			return err
+		}
+		err = deleteOldAlertsHistory(txApp, 200, 250)
+		if err != nil {
+			return err
+		}
+		err = deleteOldQuietHours(txApp)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// Delete old alerts history records
+func deleteOldAlertsHistory(app core.App, countToKeep, countBeforeDeletion int) error {
+	db := app.DB()
+	var users []struct {
+		Id string `db:"user"`
+	}
+	err := db.NewQuery("SELECT user, COUNT(*) as count FROM alerts_history GROUP BY user HAVING count > {:countBeforeDeletion}").Bind(dbx.Params{"countBeforeDeletion": countBeforeDeletion}).All(&users)
+	if err != nil {
+		return err
+	}
+	for _, user := range users {
+		_, err = db.NewQuery("DELETE FROM alerts_history WHERE user = {:user} AND id NOT IN (SELECT id FROM alerts_history WHERE user = {:user} ORDER BY created DESC LIMIT {:countToKeep})").Bind(dbx.Params{"user": user.Id, "countToKeep": countToKeep}).Execute()
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Deletes system_stats records older than what is displayed in the UI
+func deleteOldSystemStats(app core.App) error {
+	// Collections to process
+	collections := [2]string{"system_stats", "container_stats"}
+
+	// Record types and their retention periods
+	type RecordDeletionData struct {
+		recordType string
+		retention  time.Duration
+	}
+	recordData := []RecordDeletionData{
+		{recordType: "1m", retention: time.Hour},             // 1 hour
+		{recordType: "10m", retention: 12 * time.Hour},       // 12 hours
+		{recordType: "20m", retention: 24 * time.Hour},       // 1 day
+		{recordType: "120m", retention: 7 * 24 * time.Hour},  // 7 days
+		{recordType: "480m", retention: 30 * 24 * time.Hour}, // 30 days
+	}
+
+	now := time.Now().UTC()
+
+	for _, collection := range collections {
+		// Build the WHERE clause
+		var conditionParts []string
+		var params dbx.Params = make(map[string]any)
+		for i := range recordData {
+			rd := recordData[i]
+			// Create parameterized condition for this record type
+			dateParam := fmt.Sprintf("date%d", i)
+			conditionParts = append(conditionParts, fmt.Sprintf("(type = '%s' AND created < {:%s})", rd.recordType, dateParam))
+			params[dateParam] = now.Add(-rd.retention)
+		}
+		// Combine conditions with OR
+		conditionStr := strings.Join(conditionParts, " OR ")
+		// Construct and execute the full raw query
+		rawQuery := fmt.Sprintf("DELETE FROM %s WHERE %s", collection, conditionStr)
+		if _, err := app.DB().NewQuery(rawQuery).Bind(params).Execute(); err != nil {
+			return fmt.Errorf("failed to delete from %s: %v", collection, err)
+		}
+	}
+	return nil
+}
+
+// Deletes systemd service records that haven't been updated in the last 20 minutes
+func deleteOldSystemdServiceRecords(app core.App) error {
+	now := time.Now().UTC()
+	twentyMinutesAgo := now.Add(-20 * time.Minute)
+
+	// Delete systemd service records where updated < twentyMinutesAgo
+	_, err := app.DB().NewQuery("DELETE FROM systemd_services WHERE updated < {:updated}").Bind(dbx.Params{"updated": twentyMinutesAgo.UnixMilli()}).Execute()
+	if err != nil {
+		return fmt.Errorf("failed to delete old systemd service records: %v", err)
+	}
+
+	return nil
+}
+
+// Deletes container records that haven't been updated in the last 10 minutes
+func deleteOldContainerRecords(app core.App) error {
+	now := time.Now().UTC()
+	tenMinutesAgo := now.Add(-10 * time.Minute)
+
+	// Delete container records where updated < tenMinutesAgo
+	_, err := app.DB().NewQuery("DELETE FROM containers WHERE updated < {:updated}").Bind(dbx.Params{"updated": tenMinutesAgo.UnixMilli()}).Execute()
+	if err != nil {
+		return fmt.Errorf("failed to delete old container records: %v", err)
+	}
+
+	return nil
+}
+
+// Deletes old quiet hours records where end date has passed
+func deleteOldQuietHours(app core.App) error {
+	now := time.Now().UTC()
+	_, err := app.DB().NewQuery("DELETE FROM quiet_hours WHERE type = 'one-time' AND end < {:now}").Bind(dbx.Params{"now": now}).Execute()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
 /* Round float to two decimals */
 func twoDecimals(value float64) float64 {
 	return math.Round(value*100) / 100

internal/records/records_averaging_test.go

@@ -1,864 +0,0 @@
-//go:build testing
-
-package records_test
-
-import (
-	"sort"
-	"testing"
-
-	"github.com/henrygd/beszel/internal/entities/container"
-	"github.com/henrygd/beszel/internal/entities/system"
-	"github.com/henrygd/beszel/internal/records"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestAverageSystemStatsSlice_Empty(t *testing.T) {
-	result := records.AverageSystemStatsSlice(nil)
-	assert.Equal(t, system.Stats{}, result)
-
-	result = records.AverageSystemStatsSlice([]system.Stats{})
-	assert.Equal(t, system.Stats{}, result)
-}
-
-func TestAverageSystemStatsSlice_SingleRecord(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu:          45.67,
-			Mem:          16.0,
-			MemUsed:      8.5,
-			MemPct:       53.12,
-			MemBuffCache: 2.0,
-			Swap:         4.0,
-			SwapUsed:     1.0,
-			DiskTotal:    500.0,
-			DiskUsed:     250.0,
-			DiskPct:      50.0,
-			DiskReadPs:   100.5,
-			DiskWritePs:  200.75,
-			NetworkSent:  10.5,
-			NetworkRecv:  20.25,
-			LoadAvg:      [3]float64{1.5, 2.0, 3.5},
-			Bandwidth:    [2]uint64{1000, 2000},
-			DiskIO:       [2]uint64{500, 600},
-			Battery:      [2]uint8{80, 1},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	assert.Equal(t, 45.67, result.Cpu)
-	assert.Equal(t, 16.0, result.Mem)
-	assert.Equal(t, 8.5, result.MemUsed)
-	assert.Equal(t, 53.12, result.MemPct)
-	assert.Equal(t, 2.0, result.MemBuffCache)
-	assert.Equal(t, 4.0, result.Swap)
-	assert.Equal(t, 1.0, result.SwapUsed)
-	assert.Equal(t, 500.0, result.DiskTotal)
-	assert.Equal(t, 250.0, result.DiskUsed)
-	assert.Equal(t, 50.0, result.DiskPct)
-	assert.Equal(t, 100.5, result.DiskReadPs)
-	assert.Equal(t, 200.75, result.DiskWritePs)
-	assert.Equal(t, 10.5, result.NetworkSent)
-	assert.Equal(t, 20.25, result.NetworkRecv)
-	assert.Equal(t, [3]float64{1.5, 2.0, 3.5}, result.LoadAvg)
-	assert.Equal(t, [2]uint64{1000, 2000}, result.Bandwidth)
-	assert.Equal(t, [2]uint64{500, 600}, result.DiskIO)
-	assert.Equal(t, uint8(80), result.Battery[0])
-	assert.Equal(t, uint8(1), result.Battery[1])
-}
-
-func TestAverageSystemStatsSlice_BasicAveraging(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu:          20.0,
-			Mem:          16.0,
-			MemUsed:      6.0,
-			MemPct:       37.5,
-			MemBuffCache: 1.0,
-			MemZfsArc:    0.5,
-			Swap:         4.0,
-			SwapUsed:     1.0,
-			DiskTotal:    500.0,
-			DiskUsed:     200.0,
-			DiskPct:      40.0,
-			DiskReadPs:   100.0,
-			DiskWritePs:  200.0,
-			NetworkSent:  10.0,
-			NetworkRecv:  20.0,
-			LoadAvg:      [3]float64{1.0, 2.0, 3.0},
-			Bandwidth:    [2]uint64{1000, 2000},
-			DiskIO:       [2]uint64{400, 600},
-			Battery:      [2]uint8{80, 1},
-		},
-		{
-			Cpu:          40.0,
-			Mem:          16.0,
-			MemUsed:      10.0,
-			MemPct:       62.5,
-			MemBuffCache: 3.0,
-			MemZfsArc:    1.5,
-			Swap:         4.0,
-			SwapUsed:     3.0,
-			DiskTotal:    500.0,
-			DiskUsed:     300.0,
-			DiskPct:      60.0,
-			DiskReadPs:   200.0,
-			DiskWritePs:  400.0,
-			NetworkSent:  30.0,
-			NetworkRecv:  40.0,
-			LoadAvg:      [3]float64{3.0, 4.0, 5.0},
-			Bandwidth:    [2]uint64{3000, 4000},
-			DiskIO:       [2]uint64{600, 800},
-			Battery:      [2]uint8{60, 1},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	assert.Equal(t, 30.0, result.Cpu)
-	assert.Equal(t, 16.0, result.Mem)
-	assert.Equal(t, 8.0, result.MemUsed)
-	assert.Equal(t, 50.0, result.MemPct)
-	assert.Equal(t, 2.0, result.MemBuffCache)
-	assert.Equal(t, 1.0, result.MemZfsArc)
-	assert.Equal(t, 4.0, result.Swap)
-	assert.Equal(t, 2.0, result.SwapUsed)
-	assert.Equal(t, 500.0, result.DiskTotal)
-	assert.Equal(t, 250.0, result.DiskUsed)
-	assert.Equal(t, 50.0, result.DiskPct)
-	assert.Equal(t, 150.0, result.DiskReadPs)
-	assert.Equal(t, 300.0, result.DiskWritePs)
-	assert.Equal(t, 20.0, result.NetworkSent)
-	assert.Equal(t, 30.0, result.NetworkRecv)
-	assert.Equal(t, [3]float64{2.0, 3.0, 4.0}, result.LoadAvg)
-	assert.Equal(t, [2]uint64{2000, 3000}, result.Bandwidth)
-	assert.Equal(t, [2]uint64{500, 700}, result.DiskIO)
-	assert.Equal(t, uint8(70), result.Battery[0])
-	assert.Equal(t, uint8(1), result.Battery[1])
-}
-
-func TestAverageSystemStatsSlice_PeakValues(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu:            20.0,
-			MaxCpu:         25.0,
-			MemUsed:        6.0,
-			MaxMem:         7.0,
-			NetworkSent:    10.0,
-			MaxNetworkSent: 15.0,
-			NetworkRecv:    20.0,
-			MaxNetworkRecv: 25.0,
-			DiskReadPs:     100.0,
-			MaxDiskReadPs:  120.0,
-			DiskWritePs:    200.0,
-			MaxDiskWritePs: 220.0,
-			Bandwidth:      [2]uint64{1000, 2000},
-			MaxBandwidth:   [2]uint64{1500, 2500},
-			DiskIO:         [2]uint64{400, 600},
-			MaxDiskIO:      [2]uint64{500, 700},
-			DiskIoStats:    [6]float64{10.0, 20.0, 30.0, 5.0, 8.0, 12.0},
-			MaxDiskIoStats: [6]float64{15.0, 25.0, 35.0, 6.0, 9.0, 14.0},
-		},
-		{
-			Cpu:            40.0,
-			MaxCpu:         50.0,
-			MemUsed:        10.0,
-			MaxMem:         12.0,
-			NetworkSent:    30.0,
-			MaxNetworkSent: 35.0,
-			NetworkRecv:    40.0,
-			MaxNetworkRecv: 45.0,
-			DiskReadPs:     200.0,
-			MaxDiskReadPs:  210.0,
-			DiskWritePs:    400.0,
-			MaxDiskWritePs: 410.0,
-			Bandwidth:      [2]uint64{3000, 4000},
-			MaxBandwidth:   [2]uint64{3500, 4500},
-			DiskIO:         [2]uint64{600, 800},
-			MaxDiskIO:      [2]uint64{650, 850},
-			DiskIoStats:    [6]float64{50.0, 60.0, 70.0, 15.0, 18.0, 22.0},
-			MaxDiskIoStats: [6]float64{55.0, 65.0, 75.0, 16.0, 19.0, 23.0},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	assert.Equal(t, 50.0, result.MaxCpu)
-	assert.Equal(t, 12.0, result.MaxMem)
-	assert.Equal(t, 35.0, result.MaxNetworkSent)
-	assert.Equal(t, 45.0, result.MaxNetworkRecv)
-	assert.Equal(t, 210.0, result.MaxDiskReadPs)
-	assert.Equal(t, 410.0, result.MaxDiskWritePs)
-	assert.Equal(t, [2]uint64{3500, 4500}, result.MaxBandwidth)
-	assert.Equal(t, [2]uint64{650, 850}, result.MaxDiskIO)
-	assert.Equal(t, [6]float64{30.0, 40.0, 50.0, 10.0, 13.0, 17.0}, result.DiskIoStats)
-	assert.Equal(t, [6]float64{55.0, 65.0, 75.0, 16.0, 19.0, 23.0}, result.MaxDiskIoStats)
-}
-
-func TestAverageSystemStatsSlice_DiskIoStats(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu:            10.0,
-			DiskIoStats:    [6]float64{10.0, 20.0, 30.0, 5.0, 8.0, 12.0},
-			MaxDiskIoStats: [6]float64{12.0, 22.0, 32.0, 6.0, 9.0, 13.0},
-		},
-		{
-			Cpu:            20.0,
-			DiskIoStats:    [6]float64{30.0, 40.0, 50.0, 15.0, 18.0, 22.0},
-			MaxDiskIoStats: [6]float64{28.0, 38.0, 48.0, 14.0, 17.0, 21.0},
-		},
-		{
-			Cpu:            30.0,
-			DiskIoStats:    [6]float64{20.0, 30.0, 40.0, 10.0, 12.0, 16.0},
-			MaxDiskIoStats: [6]float64{25.0, 35.0, 45.0, 11.0, 13.0, 17.0},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	// Average: (10+30+20)/3=20, (20+40+30)/3=30, (30+50+40)/3=40, (5+15+10)/3=10, (8+18+12)/3≈12.67, (12+22+16)/3≈16.67
-	assert.Equal(t, 20.0, result.DiskIoStats[0])
-	assert.Equal(t, 30.0, result.DiskIoStats[1])
-	assert.Equal(t, 40.0, result.DiskIoStats[2])
-	assert.Equal(t, 10.0, result.DiskIoStats[3])
-	assert.Equal(t, 12.67, result.DiskIoStats[4])
-	assert.Equal(t, 16.67, result.DiskIoStats[5])
-	// Max: current DiskIoStats[0] wins for record 2 (30 > MaxDiskIoStats 28)
-	assert.Equal(t, 30.0, result.MaxDiskIoStats[0])
-	assert.Equal(t, 40.0, result.MaxDiskIoStats[1])
-	assert.Equal(t, 50.0, result.MaxDiskIoStats[2])
-	assert.Equal(t, 15.0, result.MaxDiskIoStats[3])
-	assert.Equal(t, 18.0, result.MaxDiskIoStats[4])
-	assert.Equal(t, 22.0, result.MaxDiskIoStats[5])
-}
-
-// Tests that current DiskIoStats values are considered when computing MaxDiskIoStats.
-func TestAverageSystemStatsSlice_DiskIoStatsPeakFromCurrentValues(t *testing.T) {
-	input := []system.Stats{
-		{Cpu: 10.0, DiskIoStats: [6]float64{95.0, 90.0, 85.0, 50.0, 60.0, 80.0}, MaxDiskIoStats: [6]float64{80.0, 80.0, 80.0, 40.0, 50.0, 70.0}},
-		{Cpu: 20.0, DiskIoStats: [6]float64{10.0, 10.0, 10.0, 5.0, 6.0, 8.0}, MaxDiskIoStats: [6]float64{20.0, 20.0, 20.0, 10.0, 12.0, 16.0}},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	// Current value from first record (95, 90, 85, 50, 60, 80) beats MaxDiskIoStats in both records
-	assert.Equal(t, 95.0, result.MaxDiskIoStats[0])
-	assert.Equal(t, 90.0, result.MaxDiskIoStats[1])
-	assert.Equal(t, 85.0, result.MaxDiskIoStats[2])
-	assert.Equal(t, 50.0, result.MaxDiskIoStats[3])
-	assert.Equal(t, 60.0, result.MaxDiskIoStats[4])
-	assert.Equal(t, 80.0, result.MaxDiskIoStats[5])
-}
-
-// Tests that current values are considered when computing peaks
-// (i.e., current cpu > MaxCpu should still win).
-func TestAverageSystemStatsSlice_PeakFromCurrentValues(t *testing.T) {
-	input := []system.Stats{
-		{Cpu: 95.0, MaxCpu: 80.0, MemUsed: 15.0, MaxMem: 10.0},
-		{Cpu: 10.0, MaxCpu: 20.0, MemUsed: 5.0, MaxMem: 8.0},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	assert.Equal(t, 95.0, result.MaxCpu)
-	assert.Equal(t, 15.0, result.MaxMem)
-}
-
-// Tests that records without temperature data are excluded from the temperature average.
-func TestAverageSystemStatsSlice_Temperatures(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu:          10.0,
-			Temperatures: map[string]float64{"cpu": 60.0, "gpu": 70.0},
-		},
-		{
-			Cpu:          20.0,
-			Temperatures: map[string]float64{"cpu": 80.0, "gpu": 90.0},
-		},
-		{
-			// No temperatures - should not affect temp averaging
-			Cpu: 30.0,
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.Temperatures)
-	// Average over 2 records that had temps, not 3
-	assert.Equal(t, 70.0, result.Temperatures["cpu"])
-	assert.Equal(t, 80.0, result.Temperatures["gpu"])
-}
-
-// Tests that fan speeds are averaged and records without fan data are excluded.
-func TestAverageSystemStatsSlice_Fans(t *testing.T) {
-	input := []system.Stats{
-		{
-			Fans: map[string]uint16{"cpu": 60_000, "case": 1_000},
-		},
-		{
-			Fans: map[string]uint16{"cpu": 50_000, "case": 2_000},
-		},
-		{
-			// No fan data - should not affect fan averaging
-			Cpu: 30.0,
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.Fans)
-	assert.Equal(t, uint16(55_000), result.Fans["cpu"])
-	assert.Equal(t, uint16(1_500), result.Fans["case"])
-}
-
-func TestAverageSystemStatsSlice_NetworkInterfaces(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu: 10.0,
-			NetworkInterfaces: map[string][4]uint64{
-				"eth0": {100, 200, 150, 250},
-				"eth1": {50, 60, 70, 80},
-			},
-		},
-		{
-			Cpu: 20.0,
-			NetworkInterfaces: map[string][4]uint64{
-				"eth0": {200, 400, 300, 500},
-				"eth1": {150, 160, 170, 180},
-			},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.NetworkInterfaces)
-	// [0] and [1] are averaged, [2] and [3] are max
-	assert.Equal(t, [4]uint64{150, 300, 300, 500}, result.NetworkInterfaces["eth0"])
-	assert.Equal(t, [4]uint64{100, 110, 170, 180}, result.NetworkInterfaces["eth1"])
-}
-
-func TestAverageSystemStatsSlice_ExtraFs(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu: 10.0,
-			ExtraFs: map[string]*system.FsStats{
-				"/data": {
-					DiskTotal:         1000.0,
-					DiskUsed:          400.0,
-					DiskReadPs:        50.0,
-					DiskWritePs:       100.0,
-					MaxDiskReadPS:     60.0,
-					MaxDiskWritePS:    110.0,
-					DiskReadBytes:     5000,
-					DiskWriteBytes:    10000,
-					MaxDiskReadBytes:  6000,
-					MaxDiskWriteBytes: 11000,
-					DiskIoStats:       [6]float64{10.0, 20.0, 30.0, 5.0, 8.0, 12.0},
-					MaxDiskIoStats:    [6]float64{12.0, 22.0, 32.0, 6.0, 9.0, 13.0},
-				},
-			},
-		},
-		{
-			Cpu: 20.0,
-			ExtraFs: map[string]*system.FsStats{
-				"/data": {
-					DiskTotal:         1000.0,
-					DiskUsed:          600.0,
-					DiskReadPs:        150.0,
-					DiskWritePs:       200.0,
-					MaxDiskReadPS:     160.0,
-					MaxDiskWritePS:    210.0,
-					DiskReadBytes:     15000,
-					DiskWriteBytes:    20000,
-					MaxDiskReadBytes:  16000,
-					MaxDiskWriteBytes: 21000,
-					DiskIoStats:       [6]float64{50.0, 60.0, 70.0, 15.0, 18.0, 22.0},
-					MaxDiskIoStats:    [6]float64{55.0, 65.0, 75.0, 16.0, 19.0, 23.0},
-				},
-			},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.ExtraFs)
-	require.NotNil(t, result.ExtraFs["/data"])
-	fs := result.ExtraFs["/data"]
-	assert.Equal(t, 1000.0, fs.DiskTotal)
-	assert.Equal(t, 500.0, fs.DiskUsed)
-	assert.Equal(t, 100.0, fs.DiskReadPs)
-	assert.Equal(t, 150.0, fs.DiskWritePs)
-	assert.Equal(t, 160.0, fs.MaxDiskReadPS)
-	assert.Equal(t, 210.0, fs.MaxDiskWritePS)
-	assert.Equal(t, uint64(10000), fs.DiskReadBytes)
-	assert.Equal(t, uint64(15000), fs.DiskWriteBytes)
-	assert.Equal(t, uint64(16000), fs.MaxDiskReadBytes)
-	assert.Equal(t, uint64(21000), fs.MaxDiskWriteBytes)
-	assert.Equal(t, [6]float64{30.0, 40.0, 50.0, 10.0, 13.0, 17.0}, fs.DiskIoStats)
-	assert.Equal(t, [6]float64{55.0, 65.0, 75.0, 16.0, 19.0, 23.0}, fs.MaxDiskIoStats)
-}
-
-// Tests that ExtraFs DiskIoStats peak considers current values, not just previous peaks.
-func TestAverageSystemStatsSlice_ExtraFsDiskIoStatsPeakFromCurrentValues(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu: 10.0,
-			ExtraFs: map[string]*system.FsStats{
-				"/data": {
-					DiskIoStats:    [6]float64{95.0, 90.0, 85.0, 50.0, 60.0, 80.0}, // exceeds MaxDiskIoStats
-					MaxDiskIoStats: [6]float64{80.0, 80.0, 80.0, 40.0, 50.0, 70.0},
-				},
-			},
-		},
-		{
-			Cpu: 20.0,
-			ExtraFs: map[string]*system.FsStats{
-				"/data": {
-					DiskIoStats:    [6]float64{10.0, 10.0, 10.0, 5.0, 6.0, 8.0},
-					MaxDiskIoStats: [6]float64{20.0, 20.0, 20.0, 10.0, 12.0, 16.0},
-				},
-			},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	fs := result.ExtraFs["/data"]
-	assert.Equal(t, 95.0, fs.MaxDiskIoStats[0])
-	assert.Equal(t, 90.0, fs.MaxDiskIoStats[1])
-	assert.Equal(t, 85.0, fs.MaxDiskIoStats[2])
-	assert.Equal(t, 50.0, fs.MaxDiskIoStats[3])
-	assert.Equal(t, 60.0, fs.MaxDiskIoStats[4])
-	assert.Equal(t, 80.0, fs.MaxDiskIoStats[5])
-}
-
-// Tests that extra FS peak values consider current values, not just previous peaks.
-func TestAverageSystemStatsSlice_ExtraFsPeaksFromCurrentValues(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu: 10.0,
-			ExtraFs: map[string]*system.FsStats{
-				"/data": {
-					DiskReadPs:       500.0, // exceeds MaxDiskReadPS
-					MaxDiskReadPS:    100.0,
-					DiskReadBytes:    50000,
-					MaxDiskReadBytes: 10000,
-				},
-			},
-		},
-		{
-			Cpu: 20.0,
-			ExtraFs: map[string]*system.FsStats{
-				"/data": {
-					DiskReadPs:       50.0,
-					MaxDiskReadPS:    200.0,
-					DiskReadBytes:    5000,
-					MaxDiskReadBytes: 20000,
-				},
-			},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	fs := result.ExtraFs["/data"]
-	assert.Equal(t, 500.0, fs.MaxDiskReadPS)
-	assert.Equal(t, uint64(50000), fs.MaxDiskReadBytes)
-}
-
-func TestAverageSystemStatsSlice_GPUData(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu: 10.0,
-			GPUData: map[string]system.GPUData{
-				"gpu0": {
-					Name:        "RTX 4090",
-					Temperature: 60.0,
-					MemoryUsed:  4.0,
-					MemoryTotal: 24.0,
-					Usage:       30.0,
-					Power:       200.0,
-					Count:       1.0,
-					Engines: map[string]float64{
-						"3D":    50.0,
-						"Video": 10.0,
-					},
-				},
-			},
-		},
-		{
-			Cpu: 20.0,
-			GPUData: map[string]system.GPUData{
-				"gpu0": {
-					Name:        "RTX 4090",
-					Temperature: 80.0,
-					MemoryUsed:  8.0,
-					MemoryTotal: 24.0,
-					Usage:       70.0,
-					Power:       300.0,
-					Count:       1.0,
-					Engines: map[string]float64{
-						"3D":    90.0,
-						"Video": 30.0,
-					},
-				},
-			},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.GPUData)
-	gpu := result.GPUData["gpu0"]
-	assert.Equal(t, "RTX 4090", gpu.Name)
-	assert.Equal(t, 70.0, gpu.Temperature)
-	assert.Equal(t, 6.0, gpu.MemoryUsed)
-	assert.Equal(t, 24.0, gpu.MemoryTotal)
-	assert.Equal(t, 50.0, gpu.Usage)
-	assert.Equal(t, 250.0, gpu.Power)
-	assert.Equal(t, 1.0, gpu.Count)
-	require.NotNil(t, gpu.Engines)
-	assert.Equal(t, 70.0, gpu.Engines["3D"])
-	assert.Equal(t, 20.0, gpu.Engines["Video"])
-}
-
-func TestAverageSystemStatsSlice_MultipleGPUs(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu: 10.0,
-			GPUData: map[string]system.GPUData{
-				"gpu0": {Name: "GPU A", Usage: 20.0, Temperature: 50.0},
-				"gpu1": {Name: "GPU B", Usage: 60.0, Temperature: 70.0},
-			},
-		},
-		{
-			Cpu: 20.0,
-			GPUData: map[string]system.GPUData{
-				"gpu0": {Name: "GPU A", Usage: 40.0, Temperature: 60.0},
-				"gpu1": {Name: "GPU B", Usage: 80.0, Temperature: 80.0},
-			},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.GPUData)
-	assert.Equal(t, 30.0, result.GPUData["gpu0"].Usage)
-	assert.Equal(t, 55.0, result.GPUData["gpu0"].Temperature)
-	assert.Equal(t, 70.0, result.GPUData["gpu1"].Usage)
-	assert.Equal(t, 75.0, result.GPUData["gpu1"].Temperature)
-}
-
-func TestAverageSystemStatsSlice_CpuCoresUsage(t *testing.T) {
-	input := []system.Stats{
-		{Cpu: 10.0, CpuCoresUsage: system.Uint8Slice{10, 20, 30, 40}},
-		{Cpu: 20.0, CpuCoresUsage: system.Uint8Slice{30, 40, 50, 60}},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.CpuCoresUsage)
-	assert.Equal(t, system.Uint8Slice{20, 30, 40, 50}, result.CpuCoresUsage)
-}
-
-// Tests that per-core usage rounds correctly (e.g., 15.5 -> 16 via math.Round).
-func TestAverageSystemStatsSlice_CpuCoresUsageRounding(t *testing.T) {
-	input := []system.Stats{
-		{Cpu: 10.0, CpuCoresUsage: system.Uint8Slice{11}},
-		{Cpu: 20.0, CpuCoresUsage: system.Uint8Slice{20}},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.CpuCoresUsage)
-	// (11+20)/2 = 15.5, rounds to 16
-	assert.Equal(t, uint8(16), result.CpuCoresUsage[0])
-}
-
-func TestAverageSystemStatsSlice_CpuBreakdown(t *testing.T) {
-	input := []system.Stats{
-		{Cpu: 10.0, CpuBreakdown: []float64{5.0, 3.0, 1.0, 0.5, 90.5}},
-		{Cpu: 20.0, CpuBreakdown: []float64{15.0, 7.0, 3.0, 1.5, 73.5}},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.CpuBreakdown)
-	assert.Equal(t, []float64{10.0, 5.0, 2.0, 1.0, 82.0}, result.CpuBreakdown)
-}
-
-// Tests that Battery[1] (charge state) uses the last record's value.
-func TestAverageSystemStatsSlice_BatteryLastChargeState(t *testing.T) {
-	input := []system.Stats{
-		{Cpu: 10.0, Battery: [2]uint8{100, 1}}, // charging
-		{Cpu: 20.0, Battery: [2]uint8{90, 0}},  // not charging
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	assert.Equal(t, uint8(95), result.Battery[0])
-	assert.Equal(t, uint8(0), result.Battery[1]) // last record's charge state
-}
-
-func TestAverageSystemStatsSlice_BatteriesIndependentSamples(t *testing.T) {
-	input := []system.Stats{
-		{Battery: [2]uint8{80, 4}, Batteries: map[string]uint8{"Primary": 80, "Mouse": 0}},
-		{Battery: [2]uint8{60, 3}, Batteries: map[string]uint8{"Primary": 60}},
-		{Battery: [2]uint8{30, 4}, Batteries: map[string]uint8{"Mouse": 40}},
-		{},
-	}
-	result := records.AverageSystemStatsSlice(input)
-	assert.Equal(t, map[string]uint8{"Primary": 70, "Mouse": 20}, result.Batteries)
-	assert.Equal(t, uint8(56), result.Battery[0], "representative battery excludes absent samples")
-	assert.Equal(t, uint8(4), result.Battery[1], "representative state comes from its latest sample")
-}
-
-func TestAverageSystemStatsSlice_ZeroRepresentativeBattery(t *testing.T) {
-	result := records.AverageSystemStatsSlice([]system.Stats{
-		{Battery: [2]uint8{0, 1}, Batteries: map[string]uint8{"Primary": 0}},
-		{},
-	})
-	assert.Equal(t, [2]uint8{0, 1}, result.Battery)
-	assert.Equal(t, map[string]uint8{"Primary": 0}, result.Batteries)
-}
-
-func TestAverageSystemStatsSlice_ThreeRecordsRounding(t *testing.T) {
-	input := []system.Stats{
-		{Cpu: 10.0, Mem: 8.0},
-		{Cpu: 20.0, Mem: 8.0},
-		{Cpu: 30.0, Mem: 8.0},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	assert.Equal(t, 20.0, result.Cpu)
-	assert.Equal(t, 8.0, result.Mem)
-}
-
-// Tests records where some have optional fields and others don't.
-func TestAverageSystemStatsSlice_MixedOptionalFields(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu:           10.0,
-			CpuCoresUsage: system.Uint8Slice{50, 60},
-			CpuBreakdown:  []float64{5.0, 3.0, 1.0, 0.5, 90.5},
-			GPUData: map[string]system.GPUData{
-				"gpu0": {Name: "GPU", Usage: 40.0},
-			},
-		},
-		{
-			Cpu: 20.0,
-			// No CpuCoresUsage, CpuBreakdown, or GPUData
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	assert.Equal(t, 15.0, result.Cpu)
-	// CpuCoresUsage: only 1 record had it, so sum/2
-	require.NotNil(t, result.CpuCoresUsage)
-	assert.Equal(t, uint8(25), result.CpuCoresUsage[0])
-	assert.Equal(t, uint8(30), result.CpuCoresUsage[1])
-	// CpuBreakdown: only 1 record had it, so sum/2
-	require.NotNil(t, result.CpuBreakdown)
-	assert.Equal(t, 2.5, result.CpuBreakdown[0])
-	// GPUData: only 1 record had it, so sum/2
-	require.NotNil(t, result.GPUData)
-	assert.Equal(t, 20.0, result.GPUData["gpu0"].Usage)
-}
-
-// Tests with 10 records matching the common real-world case (10 x 1m -> 1 x 10m).
-func TestAverageSystemStatsSlice_TenRecords(t *testing.T) {
-	input := make([]system.Stats, 10)
-	for i := range input {
-		input[i] = system.Stats{
-			Cpu:         float64(i * 10), // 0, 10, 20, ..., 90
-			Mem:         16.0,
-			MemUsed:     float64(4 + i),  // 4, 5, 6, ..., 13
-			MemPct:      float64(25 + i), // 25, 26, ..., 34
-			DiskTotal:   500.0,
-			DiskUsed:    250.0,
-			DiskPct:     50.0,
-			NetworkSent: float64(i),
-			NetworkRecv: float64(i * 2),
-			Bandwidth:   [2]uint64{uint64(i * 1000), uint64(i * 2000)},
-			LoadAvg:     [3]float64{float64(i), float64(i) * 0.5, float64(i) * 0.25},
-		}
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	assert.Equal(t, 45.0, result.Cpu)    // avg of 0..90
-	assert.Equal(t, 16.0, result.Mem)    // constant
-	assert.Equal(t, 8.5, result.MemUsed) // avg of 4..13
-	assert.Equal(t, 29.5, result.MemPct) // avg of 25..34
-	assert.Equal(t, 500.0, result.DiskTotal)
-	assert.Equal(t, 250.0, result.DiskUsed)
-	assert.Equal(t, 50.0, result.DiskPct)
-	assert.Equal(t, 4.5, result.NetworkSent)
-	assert.Equal(t, 9.0, result.NetworkRecv)
-	assert.Equal(t, [2]uint64{4500, 9000}, result.Bandwidth)
-}
-
-// --- Container Stats Tests ---
-
-func TestAverageContainerStatsSlice_Empty(t *testing.T) {
-	result := records.AverageContainerStatsSlice(nil)
-	assert.Equal(t, []container.Stats{}, result)
-
-	result = records.AverageContainerStatsSlice([][]container.Stats{})
-	assert.Equal(t, []container.Stats{}, result)
-}
-
-func TestAverageContainerStatsSlice_SingleRecord(t *testing.T) {
-	input := [][]container.Stats{
-		{
-			{Name: "nginx", Cpu: 5.0, Mem: 128.0, Bandwidth: [2]uint64{1000, 2000}},
-		},
-	}
-
-	result := records.AverageContainerStatsSlice(input)
-
-	require.Len(t, result, 1)
-	assert.Equal(t, "nginx", result[0].Name)
-	assert.Equal(t, 5.0, result[0].Cpu)
-	assert.Equal(t, 128.0, result[0].Mem)
-	assert.Equal(t, [2]uint64{1000, 2000}, result[0].Bandwidth)
-}
-
-func TestAverageContainerStatsSlice_BasicAveraging(t *testing.T) {
-	input := [][]container.Stats{
-		{
-			{Name: "nginx", Cpu: 10.0, Mem: 100.0, Bandwidth: [2]uint64{1000, 2000}},
-			{Name: "redis", Cpu: 5.0, Mem: 64.0, Bandwidth: [2]uint64{500, 1000}},
-		},
-		{
-			{Name: "nginx", Cpu: 20.0, Mem: 200.0, Bandwidth: [2]uint64{3000, 4000}},
-			{Name: "redis", Cpu: 15.0, Mem: 128.0, Bandwidth: [2]uint64{1500, 2000}},
-		},
-	}
-
-	result := records.AverageContainerStatsSlice(input)
-	sort.Slice(result, func(i, j int) bool { return result[i].Name < result[j].Name })
-
-	require.Len(t, result, 2)
-
-	assert.Equal(t, "nginx", result[0].Name)
-	assert.Equal(t, 15.0, result[0].Cpu)
-	assert.Equal(t, 150.0, result[0].Mem)
-	assert.Equal(t, [2]uint64{2000, 3000}, result[0].Bandwidth)
-
-	assert.Equal(t, "redis", result[1].Name)
-	assert.Equal(t, 10.0, result[1].Cpu)
-	assert.Equal(t, 96.0, result[1].Mem)
-	assert.Equal(t, [2]uint64{1000, 1500}, result[1].Bandwidth)
-}
-
-// Tests containers that appear in some records but not all.
-func TestAverageContainerStatsSlice_ContainerAppearsInSomeRecords(t *testing.T) {
-	input := [][]container.Stats{
-		{
-			{Name: "nginx", Cpu: 10.0, Mem: 100.0},
-			{Name: "redis", Cpu: 5.0, Mem: 64.0},
-		},
-		{
-			{Name: "nginx", Cpu: 20.0, Mem: 200.0},
-			// redis not present
-		},
-	}
-
-	result := records.AverageContainerStatsSlice(input)
-	sort.Slice(result, func(i, j int) bool { return result[i].Name < result[j].Name })
-
-	require.Len(t, result, 2)
-
-	assert.Equal(t, "nginx", result[0].Name)
-	assert.Equal(t, 15.0, result[0].Cpu)
-	assert.Equal(t, 150.0, result[0].Mem)
-
-	// redis: sum / count where count = total records (2), not records containing redis
-	assert.Equal(t, "redis", result[1].Name)
-	assert.Equal(t, 2.5, result[1].Cpu)
-	assert.Equal(t, 32.0, result[1].Mem)
-}
-
-// Tests backward compatibility with deprecated NetworkSent/NetworkRecv (MB) when Bandwidth is zero.
-func TestAverageContainerStatsSlice_DeprecatedNetworkFields(t *testing.T) {
-	input := [][]container.Stats{
-		{
-			{Name: "nginx", Cpu: 10.0, Mem: 100.0, NetworkSent: 1.0, NetworkRecv: 2.0}, // 1 MB, 2 MB
-		},
-		{
-			{Name: "nginx", Cpu: 20.0, Mem: 200.0, NetworkSent: 3.0, NetworkRecv: 4.0}, // 3 MB, 4 MB
-		},
-	}
-
-	result := records.AverageContainerStatsSlice(input)
-
-	require.Len(t, result, 1)
-	assert.Equal(t, "nginx", result[0].Name)
-	// avg sent = (1*1048576 + 3*1048576) / 2 = 2*1048576
-	assert.Equal(t, uint64(2*1048576), result[0].Bandwidth[0])
-	// avg recv = (2*1048576 + 4*1048576) / 2 = 3*1048576
-	assert.Equal(t, uint64(3*1048576), result[0].Bandwidth[1])
-}
-
-// Tests that when Bandwidth is set, deprecated NetworkSent/NetworkRecv are ignored.
-func TestAverageContainerStatsSlice_MixedBandwidthAndDeprecated(t *testing.T) {
-	input := [][]container.Stats{
-		{
-			{Name: "nginx", Cpu: 10.0, Mem: 100.0, Bandwidth: [2]uint64{5000, 6000}, NetworkSent: 99.0, NetworkRecv: 99.0},
-		},
-		{
-			{Name: "nginx", Cpu: 20.0, Mem: 200.0, Bandwidth: [2]uint64{7000, 8000}},
-		},
-	}
-
-	result := records.AverageContainerStatsSlice(input)
-
-	require.Len(t, result, 1)
-	assert.Equal(t, uint64(6000), result[0].Bandwidth[0])
-	assert.Equal(t, uint64(7000), result[0].Bandwidth[1])
-}
-
-func TestAverageContainerStatsSlice_ThreeRecords(t *testing.T) {
-	input := [][]container.Stats{
-		{{Name: "app", Cpu: 1.0, Mem: 100.0}},
-		{{Name: "app", Cpu: 2.0, Mem: 200.0}},
-		{{Name: "app", Cpu: 3.0, Mem: 300.0}},
-	}
-
-	result := records.AverageContainerStatsSlice(input)
-
-	require.Len(t, result, 1)
-	assert.Equal(t, 2.0, result[0].Cpu)
-	assert.Equal(t, 200.0, result[0].Mem)
-}
-
-func TestAverageContainerStatsSlice_ManyContainers(t *testing.T) {
-	input := [][]container.Stats{
-		{
-			{Name: "a", Cpu: 10.0, Mem: 100.0},
-			{Name: "b", Cpu: 20.0, Mem: 200.0},
-			{Name: "c", Cpu: 30.0, Mem: 300.0},
-			{Name: "d", Cpu: 40.0, Mem: 400.0},
-		},
-		{
-			{Name: "a", Cpu: 20.0, Mem: 200.0},
-			{Name: "b", Cpu: 30.0, Mem: 300.0},
-			{Name: "c", Cpu: 40.0, Mem: 400.0},
-			{Name: "d", Cpu: 50.0, Mem: 500.0},
-		},
-	}
-
-	result := records.AverageContainerStatsSlice(input)
-	sort.Slice(result, func(i, j int) bool { return result[i].Name < result[j].Name })
-
-	require.Len(t, result, 4)
-	assert.Equal(t, 15.0, result[0].Cpu)
-	assert.Equal(t, 25.0, result[1].Cpu)
-	assert.Equal(t, 35.0, result[2].Cpu)
-	assert.Equal(t, 45.0, result[3].Cpu)
-}

internal/records/records_deletion.go

@@ -1,139 +0,0 @@
-package records
-
-import (
-	"fmt"
-	"log/slog"
-	"strings"
-	"time"
-
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/core"
-)
-
-// Delete old records
-func (rm *RecordManager) DeleteOldRecords() {
-	// Pocketbase cron does not handle errors, log them here.
-	rm.app.RunInTransaction(func(txApp core.App) error {
-		err := deleteOldSystemStats(txApp)
-		if err != nil {
-			slog.Error("Error deleting old system stats", "err", err)
-		}
-		err = deleteOldContainerRecords(txApp)
-		if err != nil {
-			slog.Error("Error deleting old container records", "err", err)
-		}
-		err = deleteOldSystemdServiceRecords(txApp)
-		if err != nil {
-			slog.Error("Error deleting old systemd service records", "err", err)
-		}
-		err = deleteOldAlertsHistory(txApp, 200, 250)
-		if err != nil {
-			slog.Error("Error deleting old alerts history", "err", err)
-		}
-		err = deleteOldQuietHours(txApp)
-		if err != nil {
-			slog.Error("Error deleting old quiet hours", "err", err)
-		}
-		return nil
-	})
-}
-
-// Delete old alerts history records
-func deleteOldAlertsHistory(app core.App, countToKeep, countBeforeDeletion int) error {
-	db := app.DB()
-	var users []struct {
-		Id string `db:"user"`
-	}
-	err := db.NewQuery("SELECT user, COUNT(*) as count FROM alerts_history GROUP BY user HAVING count > {:countBeforeDeletion}").Bind(dbx.Params{"countBeforeDeletion": countBeforeDeletion}).All(&users)
-	if err != nil {
-		return err
-	}
-	for _, user := range users {
-		_, err = db.NewQuery("DELETE FROM alerts_history WHERE user = {:user} AND id NOT IN (SELECT id FROM alerts_history WHERE user = {:user} ORDER BY created DESC LIMIT {:countToKeep})").Bind(dbx.Params{"user": user.Id, "countToKeep": countToKeep}).Execute()
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// Deletes system_stats records older than what is displayed in the UI
-func deleteOldSystemStats(app core.App) error {
-	// Collections to process
-	collections := [2]string{"system_stats", "container_stats"}
-
-	// Record types and their retention periods
-	type RecordDeletionData struct {
-		recordType string
-		retention  time.Duration
-	}
-	recordData := []RecordDeletionData{
-		{recordType: "1m", retention: time.Hour},             // 1 hour
-		{recordType: "10m", retention: 12 * time.Hour},       // 12 hours
-		{recordType: "20m", retention: 24 * time.Hour},       // 1 day
-		{recordType: "120m", retention: 7 * 24 * time.Hour},  // 7 days
-		{recordType: "480m", retention: 30 * 24 * time.Hour}, // 30 days
-	}
-
-	now := time.Now().UTC()
-
-	for _, collection := range collections {
-		// Build the WHERE clause
-		var conditionParts []string
-		var params dbx.Params = make(map[string]any)
-		for i := range recordData {
-			rd := recordData[i]
-			// Create parameterized condition for this record type
-			dateParam := fmt.Sprintf("date%d", i)
-			conditionParts = append(conditionParts, fmt.Sprintf("(type = '%s' AND created < {:%s})", rd.recordType, dateParam))
-			params[dateParam] = now.Add(-rd.retention)
-		}
-		// Combine conditions with OR
-		conditionStr := strings.Join(conditionParts, " OR ")
-		// Construct and execute the full raw query
-		rawQuery := fmt.Sprintf("DELETE FROM %s WHERE %s", collection, conditionStr)
-		if _, err := app.DB().NewQuery(rawQuery).Bind(params).Execute(); err != nil {
-			return fmt.Errorf("failed to delete from %s: %v", collection, err)
-		}
-	}
-	return nil
-}
-
-// Deletes systemd service records that haven't been updated in the last 20 minutes
-func deleteOldSystemdServiceRecords(app core.App) error {
-	now := time.Now().UTC()
-	twentyMinutesAgo := now.Add(-20 * time.Minute)
-
-	// Delete systemd service records where updated < twentyMinutesAgo
-	_, err := app.DB().NewQuery("DELETE FROM systemd_services WHERE updated < {:updated}").Bind(dbx.Params{"updated": twentyMinutesAgo.UnixMilli()}).Execute()
-	if err != nil {
-		return fmt.Errorf("failed to delete old systemd service records: %v", err)
-	}
-
-	return nil
-}
-
-// Deletes container records that haven't been updated in the last 10 minutes
-func deleteOldContainerRecords(app core.App) error {
-	now := time.Now().UTC()
-	tenMinutesAgo := now.Add(-10 * time.Minute)
-
-	// Delete container records where updated < tenMinutesAgo
-	_, err := app.DB().NewQuery("DELETE FROM containers WHERE updated < {:updated}").Bind(dbx.Params{"updated": tenMinutesAgo.UnixMilli()}).Execute()
-	if err != nil {
-		return fmt.Errorf("failed to delete old container records: %v", err)
-	}
-
-	return nil
-}
-
-// Deletes old quiet hours records where end date has passed
-func deleteOldQuietHours(app core.App) error {
-	now := time.Now().UTC()
-	_, err := app.DB().NewQuery("DELETE FROM quiet_hours WHERE type = 'one-time' AND end < {:now}").Bind(dbx.Params{"now": now}).Execute()
-	if err != nil {
-		return err
-	}
-
-	return nil
-}

internal/records/records_deletion_test.go

@@ -1,428 +0,0 @@
-//go:build testing
-
-package records_test
-
-import (
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/henrygd/beszel/internal/records"
-	"github.com/henrygd/beszel/internal/tests"
-
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/types"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestDeleteOldRecords tests the main DeleteOldRecords function
-func TestDeleteOldRecords(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	rm := records.NewRecordManager(hub)
-
-	// Create test user for alerts history
-	user, err := tests.CreateUser(hub, "test@example.com", "testtesttest")
-	require.NoError(t, err)
-
-	// Create test system
-	system, err := tests.CreateRecord(hub, "systems", map[string]any{
-		"name":   "test-system",
-		"host":   "localhost",
-		"port":   "45876",
-		"status": "up",
-		"users":  []string{user.Id},
-	})
-	require.NoError(t, err)
-
-	now := time.Now()
-
-	// Create old system_stats records that should be deleted
-	var record *core.Record
-	record, err = tests.CreateRecord(hub, "system_stats", map[string]any{
-		"system": system.Id,
-		"type":   "1m",
-		"stats":  `{"cpu": 50.0, "mem": 1024}`,
-	})
-	require.NoError(t, err)
-	// created is autodate field, so we need to set it manually
-	record.SetRaw("created", now.UTC().Add(-2*time.Hour).Format(types.DefaultDateLayout))
-	err = hub.SaveNoValidate(record)
-	require.NoError(t, err)
-	require.NotNil(t, record)
-	require.InDelta(t, record.GetDateTime("created").Time().UTC().Unix(), now.UTC().Add(-2*time.Hour).Unix(), 1)
-	require.Equal(t, record.Get("system"), system.Id)
-	require.Equal(t, record.Get("type"), "1m")
-
-	// Create recent system_stats record that should be kept
-	_, err = tests.CreateRecord(hub, "system_stats", map[string]any{
-		"system":  system.Id,
-		"type":    "1m",
-		"stats":   `{"cpu": 30.0, "mem": 512}`,
-		"created": now.Add(-30 * time.Minute), // 30 minutes old, should be kept
-	})
-	require.NoError(t, err)
-
-	// Create many alerts history records to trigger deletion
-	for i := range 260 { // More than countBeforeDeletion (250)
-		_, err = tests.CreateRecord(hub, "alerts_history", map[string]any{
-			"user":    user.Id,
-			"name":    "CPU",
-			"value":   i + 1,
-			"system":  system.Id,
-			"created": now.Add(-time.Duration(i) * time.Minute),
-		})
-		require.NoError(t, err)
-	}
-
-	// Count records before deletion
-	systemStatsCountBefore, err := hub.CountRecords("system_stats")
-	require.NoError(t, err)
-	alertsCountBefore, err := hub.CountRecords("alerts_history")
-	require.NoError(t, err)
-
-	// Run deletion
-	rm.DeleteOldRecords()
-
-	// Count records after deletion
-	systemStatsCountAfter, err := hub.CountRecords("system_stats")
-	require.NoError(t, err)
-	alertsCountAfter, err := hub.CountRecords("alerts_history")
-	require.NoError(t, err)
-
-	// Verify old system stats were deleted
-	assert.Less(t, systemStatsCountAfter, systemStatsCountBefore, "Old system stats should be deleted")
-
-	// Verify alerts history was trimmed
-	assert.Less(t, alertsCountAfter, alertsCountBefore, "Excessive alerts history should be deleted")
-	assert.Equal(t, alertsCountAfter, int64(200), "Alerts count should be equal to countToKeep (200)")
-}
-
-// TestDeleteOldSystemStats tests the deleteOldSystemStats function
-func TestDeleteOldSystemStats(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	// Create test system
-	user, err := tests.CreateUser(hub, "test@example.com", "testtesttest")
-	require.NoError(t, err)
-
-	system, err := tests.CreateRecord(hub, "systems", map[string]any{
-		"name":   "test-system",
-		"host":   "localhost",
-		"port":   "45876",
-		"status": "up",
-		"users":  []string{user.Id},
-	})
-	require.NoError(t, err)
-
-	now := time.Now().UTC()
-
-	// Test data for different record types and their retention periods
-	testCases := []struct {
-		recordType   string
-		retention    time.Duration
-		shouldBeKept bool
-		ageFromNow   time.Duration
-		description  string
-	}{
-		{"1m", time.Hour, true, 30 * time.Minute, "1m record within 1 hour should be kept"},
-		{"1m", time.Hour, false, 2 * time.Hour, "1m record older than 1 hour should be deleted"},
-		{"10m", 12 * time.Hour, true, 6 * time.Hour, "10m record within 12 hours should be kept"},
-		{"10m", 12 * time.Hour, false, 24 * time.Hour, "10m record older than 12 hours should be deleted"},
-		{"20m", 24 * time.Hour, true, 12 * time.Hour, "20m record within 24 hours should be kept"},
-		{"20m", 24 * time.Hour, false, 48 * time.Hour, "20m record older than 24 hours should be deleted"},
-		{"120m", 7 * 24 * time.Hour, true, 3 * 24 * time.Hour, "120m record within 7 days should be kept"},
-		{"120m", 7 * 24 * time.Hour, false, 10 * 24 * time.Hour, "120m record older than 7 days should be deleted"},
-		{"480m", 30 * 24 * time.Hour, true, 15 * 24 * time.Hour, "480m record within 30 days should be kept"},
-		{"480m", 30 * 24 * time.Hour, false, 45 * 24 * time.Hour, "480m record older than 30 days should be deleted"},
-	}
-
-	// Create test records for both system_stats and container_stats
-	collections := []string{"system_stats", "container_stats"}
-	recordIds := make(map[string][]string)
-
-	for _, collection := range collections {
-		recordIds[collection] = make([]string, 0)
-
-		for i, tc := range testCases {
-			recordTime := now.Add(-tc.ageFromNow)
-
-			var stats string
-			if collection == "system_stats" {
-				stats = fmt.Sprintf(`{"cpu": %d.0, "mem": %d}`, i*10, i*100)
-			} else {
-				stats = fmt.Sprintf(`[{"name": "container%d", "cpu": %d.0, "mem": %d}]`, i, i*5, i*50)
-			}
-
-			record, err := tests.CreateRecord(hub, collection, map[string]any{
-				"system": system.Id,
-				"type":   tc.recordType,
-				"stats":  stats,
-			})
-			require.NoError(t, err)
-			record.SetRaw("created", recordTime.Format(types.DefaultDateLayout))
-			err = hub.SaveNoValidate(record)
-			require.NoError(t, err)
-			recordIds[collection] = append(recordIds[collection], record.Id)
-		}
-	}
-
-	// Run deletion
-	err = records.DeleteOldSystemStats(hub)
-	require.NoError(t, err)
-
-	// Verify results
-	for _, collection := range collections {
-		for i, tc := range testCases {
-			recordId := recordIds[collection][i]
-
-			// Try to find the record
-			_, err := hub.FindRecordById(collection, recordId)
-
-			if tc.shouldBeKept {
-				assert.NoError(t, err, "Record should exist: %s", tc.description)
-			} else {
-				assert.Error(t, err, "Record should be deleted: %s", tc.description)
-			}
-		}
-	}
-}
-
-// TestDeleteOldAlertsHistory tests the deleteOldAlertsHistory function
-func TestDeleteOldAlertsHistory(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	// Create test users
-	user1, err := tests.CreateUser(hub, "user1@example.com", "testtesttest")
-	require.NoError(t, err)
-
-	user2, err := tests.CreateUser(hub, "user2@example.com", "testtesttest")
-	require.NoError(t, err)
-
-	system, err := tests.CreateRecord(hub, "systems", map[string]any{
-		"name":   "test-system",
-		"host":   "localhost",
-		"port":   "45876",
-		"status": "up",
-		"users":  []string{user1.Id, user2.Id},
-	})
-	require.NoError(t, err)
-	now := time.Now().UTC()
-
-	testCases := []struct {
-		name                  string
-		user                  *core.Record
-		alertCount            int
-		countToKeep           int
-		countBeforeDeletion   int
-		expectedAfterDeletion int
-		description           string
-	}{
-		{
-			name:                  "User with few alerts (below threshold)",
-			user:                  user1,
-			alertCount:            100,
-			countToKeep:           50,
-			countBeforeDeletion:   150,
-			expectedAfterDeletion: 100, // No deletion because below threshold
-			description:           "User with alerts below countBeforeDeletion should not have any deleted",
-		},
-		{
-			name:                  "User with many alerts (above threshold)",
-			user:                  user2,
-			alertCount:            300,
-			countToKeep:           100,
-			countBeforeDeletion:   200,
-			expectedAfterDeletion: 100, // Should be trimmed to countToKeep
-			description:           "User with alerts above countBeforeDeletion should be trimmed to countToKeep",
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			// Create alerts for this user
-			for i := 0; i < tc.alertCount; i++ {
-				_, err := tests.CreateRecord(hub, "alerts_history", map[string]any{
-					"user":    tc.user.Id,
-					"name":    "CPU",
-					"value":   i + 1,
-					"system":  system.Id,
-					"created": now.Add(-time.Duration(i) * time.Minute),
-				})
-				require.NoError(t, err)
-			}
-
-			// Count before deletion
-			countBefore, err := hub.CountRecords("alerts_history",
-				dbx.NewExp("user = {:user}", dbx.Params{"user": tc.user.Id}))
-			require.NoError(t, err)
-			assert.Equal(t, int64(tc.alertCount), countBefore, "Initial count should match")
-
-			// Run deletion
-			err = records.DeleteOldAlertsHistory(hub, tc.countToKeep, tc.countBeforeDeletion)
-			require.NoError(t, err)
-
-			// Count after deletion
-			countAfter, err := hub.CountRecords("alerts_history",
-				dbx.NewExp("user = {:user}", dbx.Params{"user": tc.user.Id}))
-			require.NoError(t, err)
-
-			assert.Equal(t, int64(tc.expectedAfterDeletion), countAfter, tc.description)
-
-			// If deletion occurred, verify the most recent records were kept
-			if tc.expectedAfterDeletion < tc.alertCount {
-				records, err := hub.FindRecordsByFilter("alerts_history",
-					"user = {:user}",
-					"-created", // Order by created DESC
-					tc.countToKeep,
-					0,
-					map[string]any{"user": tc.user.Id})
-				require.NoError(t, err)
-				assert.Len(t, records, tc.expectedAfterDeletion, "Should have exactly countToKeep records")
-
-				// Verify records are in descending order by created time
-				for i := 1; i < len(records); i++ {
-					prev := records[i-1].GetDateTime("created").Time()
-					curr := records[i].GetDateTime("created").Time()
-					assert.True(t, prev.After(curr) || prev.Equal(curr),
-						"Records should be ordered by created time (newest first)")
-				}
-			}
-		})
-	}
-}
-
-// TestDeleteOldAlertsHistoryEdgeCases tests edge cases for alerts history deletion
-func TestDeleteOldAlertsHistoryEdgeCases(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	t.Run("No users with excessive alerts", func(t *testing.T) {
-		// Create user with few alerts
-		user, err := tests.CreateUser(hub, "few@example.com", "testtesttest")
-		require.NoError(t, err)
-
-		system, err := tests.CreateRecord(hub, "systems", map[string]any{
-			"name":   "test-system",
-			"host":   "localhost",
-			"port":   "45876",
-			"status": "up",
-			"users":  []string{user.Id},
-		})
-
-		// Create only 5 alerts (well below threshold)
-		for i := range 5 {
-			_, err := tests.CreateRecord(hub, "alerts_history", map[string]any{
-				"user":   user.Id,
-				"name":   "CPU",
-				"value":  i + 1,
-				"system": system.Id,
-			})
-			require.NoError(t, err)
-		}
-
-		// Should not error and should not delete anything
-		err = records.DeleteOldAlertsHistory(hub, 10, 20)
-		require.NoError(t, err)
-
-		count, err := hub.CountRecords("alerts_history")
-		require.NoError(t, err)
-		assert.Equal(t, int64(5), count, "All alerts should remain")
-	})
-
-	t.Run("Empty alerts_history table", func(t *testing.T) {
-		// Clear any existing alerts
-		_, err := hub.DB().NewQuery("DELETE FROM alerts_history").Execute()
-		require.NoError(t, err)
-
-		// Should not error with empty table
-		err = records.DeleteOldAlertsHistory(hub, 10, 20)
-		require.NoError(t, err)
-	})
-}
-
-// TestDeleteOldSystemdServiceRecords tests systemd service cleanup via DeleteOldRecords
-func TestDeleteOldSystemdServiceRecords(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	rm := records.NewRecordManager(hub)
-
-	// Create test user and system
-	user, err := tests.CreateUser(hub, "test@example.com", "testtesttest")
-	require.NoError(t, err)
-
-	system, err := tests.CreateRecord(hub, "systems", map[string]any{
-		"name":   "test-system",
-		"host":   "localhost",
-		"port":   "45876",
-		"status": "up",
-		"users":  []string{user.Id},
-	})
-	require.NoError(t, err)
-
-	now := time.Now().UTC()
-
-	// Create old systemd service records that should be deleted (older than 20 minutes)
-	oldRecord, err := tests.CreateRecord(hub, "systemd_services", map[string]any{
-		"system":  system.Id,
-		"name":    "nginx.service",
-		"state":   0, // Active
-		"sub":     1, // Running
-		"cpu":     5.0,
-		"cpuPeak": 10.0,
-		"memory":  1024000,
-		"memPeak": 2048000,
-	})
-	require.NoError(t, err)
-	// Set updated time to 25 minutes ago (should be deleted)
-	oldRecord.SetRaw("updated", now.Add(-25*time.Minute).UnixMilli())
-	err = hub.SaveNoValidate(oldRecord)
-	require.NoError(t, err)
-
-	// Create recent systemd service record that should be kept (within 20 minutes)
-	recentRecord, err := tests.CreateRecord(hub, "systemd_services", map[string]any{
-		"system":  system.Id,
-		"name":    "apache.service",
-		"state":   1, // Inactive
-		"sub":     0, // Dead
-		"cpu":     2.0,
-		"cpuPeak": 3.0,
-		"memory":  512000,
-		"memPeak": 1024000,
-	})
-	require.NoError(t, err)
-	// Set updated time to 10 minutes ago (should be kept)
-	recentRecord.SetRaw("updated", now.Add(-10*time.Minute).UnixMilli())
-	err = hub.SaveNoValidate(recentRecord)
-	require.NoError(t, err)
-
-	// Count records before deletion
-	countBefore, err := hub.CountRecords("systemd_services")
-	require.NoError(t, err)
-	assert.Equal(t, int64(2), countBefore, "Should have 2 systemd service records initially")
-
-	// Run deletion via RecordManager
-	rm.DeleteOldRecords()
-
-	// Count records after deletion
-	countAfter, err := hub.CountRecords("systemd_services")
-	require.NoError(t, err)
-	assert.Equal(t, int64(1), countAfter, "Should have 1 systemd service record after deletion")
-
-	// Verify the correct record was kept
-	remainingRecords, err := hub.FindRecordsByFilter("systemd_services", "", "", 10, 0, nil)
-	require.NoError(t, err)
-	assert.Len(t, remainingRecords, 1, "Should have exactly 1 record remaining")
-	assert.Equal(t, "apache.service", remainingRecords[0].Get("name"), "The recent record should be kept")
-}

internal/records/records_test.go

@@ -3,15 +3,430 @@
 package records_test
 
 import (
+	"fmt"
 	"testing"
+	"time"
 
 	"github.com/henrygd/beszel/internal/records"
 	"github.com/henrygd/beszel/internal/tests"
 
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/types"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+// TestDeleteOldRecords tests the main DeleteOldRecords function
+func TestDeleteOldRecords(t *testing.T) {
+	hub, err := tests.NewTestHub(t.TempDir())
+	require.NoError(t, err)
+	defer hub.Cleanup()
+
+	rm := records.NewRecordManager(hub)
+
+	// Create test user for alerts history
+	user, err := tests.CreateUser(hub, "test@example.com", "testtesttest")
+	require.NoError(t, err)
+
+	// Create test system
+	system, err := tests.CreateRecord(hub, "systems", map[string]any{
+		"name":   "test-system",
+		"host":   "localhost",
+		"port":   "45876",
+		"status": "up",
+		"users":  []string{user.Id},
+	})
+	require.NoError(t, err)
+
+	now := time.Now()
+
+	// Create old system_stats records that should be deleted
+	var record *core.Record
+	record, err = tests.CreateRecord(hub, "system_stats", map[string]any{
+		"system": system.Id,
+		"type":   "1m",
+		"stats":  `{"cpu": 50.0, "mem": 1024}`,
+	})
+	require.NoError(t, err)
+	// created is autodate field, so we need to set it manually
+	record.SetRaw("created", now.UTC().Add(-2*time.Hour).Format(types.DefaultDateLayout))
+	err = hub.SaveNoValidate(record)
+	require.NoError(t, err)
+	require.NotNil(t, record)
+	require.InDelta(t, record.GetDateTime("created").Time().UTC().Unix(), now.UTC().Add(-2*time.Hour).Unix(), 1)
+	require.Equal(t, record.Get("system"), system.Id)
+	require.Equal(t, record.Get("type"), "1m")
+
+	// Create recent system_stats record that should be kept
+	_, err = tests.CreateRecord(hub, "system_stats", map[string]any{
+		"system":  system.Id,
+		"type":    "1m",
+		"stats":   `{"cpu": 30.0, "mem": 512}`,
+		"created": now.Add(-30 * time.Minute), // 30 minutes old, should be kept
+	})
+	require.NoError(t, err)
+
+	// Create many alerts history records to trigger deletion
+	for i := range 260 { // More than countBeforeDeletion (250)
+		_, err = tests.CreateRecord(hub, "alerts_history", map[string]any{
+			"user":    user.Id,
+			"name":    "CPU",
+			"value":   i + 1,
+			"system":  system.Id,
+			"created": now.Add(-time.Duration(i) * time.Minute),
+		})
+		require.NoError(t, err)
+	}
+
+	// Count records before deletion
+	systemStatsCountBefore, err := hub.CountRecords("system_stats")
+	require.NoError(t, err)
+	alertsCountBefore, err := hub.CountRecords("alerts_history")
+	require.NoError(t, err)
+
+	// Run deletion
+	rm.DeleteOldRecords()
+
+	// Count records after deletion
+	systemStatsCountAfter, err := hub.CountRecords("system_stats")
+	require.NoError(t, err)
+	alertsCountAfter, err := hub.CountRecords("alerts_history")
+	require.NoError(t, err)
+
+	// Verify old system stats were deleted
+	assert.Less(t, systemStatsCountAfter, systemStatsCountBefore, "Old system stats should be deleted")
+
+	// Verify alerts history was trimmed
+	assert.Less(t, alertsCountAfter, alertsCountBefore, "Excessive alerts history should be deleted")
+	assert.Equal(t, alertsCountAfter, int64(200), "Alerts count should be equal to countToKeep (200)")
+}
+
+// TestDeleteOldSystemStats tests the deleteOldSystemStats function
+func TestDeleteOldSystemStats(t *testing.T) {
+	hub, err := tests.NewTestHub(t.TempDir())
+	require.NoError(t, err)
+	defer hub.Cleanup()
+
+	// Create test system
+	user, err := tests.CreateUser(hub, "test@example.com", "testtesttest")
+	require.NoError(t, err)
+
+	system, err := tests.CreateRecord(hub, "systems", map[string]any{
+		"name":   "test-system",
+		"host":   "localhost",
+		"port":   "45876",
+		"status": "up",
+		"users":  []string{user.Id},
+	})
+	require.NoError(t, err)
+
+	now := time.Now().UTC()
+
+	// Test data for different record types and their retention periods
+	testCases := []struct {
+		recordType   string
+		retention    time.Duration
+		shouldBeKept bool
+		ageFromNow   time.Duration
+		description  string
+	}{
+		{"1m", time.Hour, true, 30 * time.Minute, "1m record within 1 hour should be kept"},
+		{"1m", time.Hour, false, 2 * time.Hour, "1m record older than 1 hour should be deleted"},
+		{"10m", 12 * time.Hour, true, 6 * time.Hour, "10m record within 12 hours should be kept"},
+		{"10m", 12 * time.Hour, false, 24 * time.Hour, "10m record older than 12 hours should be deleted"},
+		{"20m", 24 * time.Hour, true, 12 * time.Hour, "20m record within 24 hours should be kept"},
+		{"20m", 24 * time.Hour, false, 48 * time.Hour, "20m record older than 24 hours should be deleted"},
+		{"120m", 7 * 24 * time.Hour, true, 3 * 24 * time.Hour, "120m record within 7 days should be kept"},
+		{"120m", 7 * 24 * time.Hour, false, 10 * 24 * time.Hour, "120m record older than 7 days should be deleted"},
+		{"480m", 30 * 24 * time.Hour, true, 15 * 24 * time.Hour, "480m record within 30 days should be kept"},
+		{"480m", 30 * 24 * time.Hour, false, 45 * 24 * time.Hour, "480m record older than 30 days should be deleted"},
+	}
+
+	// Create test records for both system_stats and container_stats
+	collections := []string{"system_stats", "container_stats"}
+	recordIds := make(map[string][]string)
+
+	for _, collection := range collections {
+		recordIds[collection] = make([]string, 0)
+
+		for i, tc := range testCases {
+			recordTime := now.Add(-tc.ageFromNow)
+
+			var stats string
+			if collection == "system_stats" {
+				stats = fmt.Sprintf(`{"cpu": %d.0, "mem": %d}`, i*10, i*100)
+			} else {
+				stats = fmt.Sprintf(`[{"name": "container%d", "cpu": %d.0, "mem": %d}]`, i, i*5, i*50)
+			}
+
+			record, err := tests.CreateRecord(hub, collection, map[string]any{
+				"system": system.Id,
+				"type":   tc.recordType,
+				"stats":  stats,
+			})
+			require.NoError(t, err)
+			record.SetRaw("created", recordTime.Format(types.DefaultDateLayout))
+			err = hub.SaveNoValidate(record)
+			require.NoError(t, err)
+			recordIds[collection] = append(recordIds[collection], record.Id)
+		}
+	}
+
+	// Run deletion
+	err = records.DeleteOldSystemStats(hub)
+	require.NoError(t, err)
+
+	// Verify results
+	for _, collection := range collections {
+		for i, tc := range testCases {
+			recordId := recordIds[collection][i]
+
+			// Try to find the record
+			_, err := hub.FindRecordById(collection, recordId)
+
+			if tc.shouldBeKept {
+				assert.NoError(t, err, "Record should exist: %s", tc.description)
+			} else {
+				assert.Error(t, err, "Record should be deleted: %s", tc.description)
+			}
+		}
+	}
+}
+
+// TestDeleteOldAlertsHistory tests the deleteOldAlertsHistory function
+func TestDeleteOldAlertsHistory(t *testing.T) {
+	hub, err := tests.NewTestHub(t.TempDir())
+	require.NoError(t, err)
+	defer hub.Cleanup()
+
+	// Create test users
+	user1, err := tests.CreateUser(hub, "user1@example.com", "testtesttest")
+	require.NoError(t, err)
+
+	user2, err := tests.CreateUser(hub, "user2@example.com", "testtesttest")
+	require.NoError(t, err)
+
+	system, err := tests.CreateRecord(hub, "systems", map[string]any{
+		"name":   "test-system",
+		"host":   "localhost",
+		"port":   "45876",
+		"status": "up",
+		"users":  []string{user1.Id, user2.Id},
+	})
+	require.NoError(t, err)
+	now := time.Now().UTC()
+
+	testCases := []struct {
+		name                  string
+		user                  *core.Record
+		alertCount            int
+		countToKeep           int
+		countBeforeDeletion   int
+		expectedAfterDeletion int
+		description           string
+	}{
+		{
+			name:                  "User with few alerts (below threshold)",
+			user:                  user1,
+			alertCount:            100,
+			countToKeep:           50,
+			countBeforeDeletion:   150,
+			expectedAfterDeletion: 100, // No deletion because below threshold
+			description:           "User with alerts below countBeforeDeletion should not have any deleted",
+		},
+		{
+			name:                  "User with many alerts (above threshold)",
+			user:                  user2,
+			alertCount:            300,
+			countToKeep:           100,
+			countBeforeDeletion:   200,
+			expectedAfterDeletion: 100, // Should be trimmed to countToKeep
+			description:           "User with alerts above countBeforeDeletion should be trimmed to countToKeep",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Create alerts for this user
+			for i := 0; i < tc.alertCount; i++ {
+				_, err := tests.CreateRecord(hub, "alerts_history", map[string]any{
+					"user":    tc.user.Id,
+					"name":    "CPU",
+					"value":   i + 1,
+					"system":  system.Id,
+					"created": now.Add(-time.Duration(i) * time.Minute),
+				})
+				require.NoError(t, err)
+			}
+
+			// Count before deletion
+			countBefore, err := hub.CountRecords("alerts_history",
+				dbx.NewExp("user = {:user}", dbx.Params{"user": tc.user.Id}))
+			require.NoError(t, err)
+			assert.Equal(t, int64(tc.alertCount), countBefore, "Initial count should match")
+
+			// Run deletion
+			err = records.DeleteOldAlertsHistory(hub, tc.countToKeep, tc.countBeforeDeletion)
+			require.NoError(t, err)
+
+			// Count after deletion
+			countAfter, err := hub.CountRecords("alerts_history",
+				dbx.NewExp("user = {:user}", dbx.Params{"user": tc.user.Id}))
+			require.NoError(t, err)
+
+			assert.Equal(t, int64(tc.expectedAfterDeletion), countAfter, tc.description)
+
+			// If deletion occurred, verify the most recent records were kept
+			if tc.expectedAfterDeletion < tc.alertCount {
+				records, err := hub.FindRecordsByFilter("alerts_history",
+					"user = {:user}",
+					"-created", // Order by created DESC
+					tc.countToKeep,
+					0,
+					map[string]any{"user": tc.user.Id})
+				require.NoError(t, err)
+				assert.Len(t, records, tc.expectedAfterDeletion, "Should have exactly countToKeep records")
+
+				// Verify records are in descending order by created time
+				for i := 1; i < len(records); i++ {
+					prev := records[i-1].GetDateTime("created").Time()
+					curr := records[i].GetDateTime("created").Time()
+					assert.True(t, prev.After(curr) || prev.Equal(curr),
+						"Records should be ordered by created time (newest first)")
+				}
+			}
+		})
+	}
+}
+
+// TestDeleteOldAlertsHistoryEdgeCases tests edge cases for alerts history deletion
+func TestDeleteOldAlertsHistoryEdgeCases(t *testing.T) {
+	hub, err := tests.NewTestHub(t.TempDir())
+	require.NoError(t, err)
+	defer hub.Cleanup()
+
+	t.Run("No users with excessive alerts", func(t *testing.T) {
+		// Create user with few alerts
+		user, err := tests.CreateUser(hub, "few@example.com", "testtesttest")
+		require.NoError(t, err)
+
+		system, err := tests.CreateRecord(hub, "systems", map[string]any{
+			"name":   "test-system",
+			"host":   "localhost",
+			"port":   "45876",
+			"status": "up",
+			"users":  []string{user.Id},
+		})
+
+		// Create only 5 alerts (well below threshold)
+		for i := range 5 {
+			_, err := tests.CreateRecord(hub, "alerts_history", map[string]any{
+				"user":   user.Id,
+				"name":   "CPU",
+				"value":  i + 1,
+				"system": system.Id,
+			})
+			require.NoError(t, err)
+		}
+
+		// Should not error and should not delete anything
+		err = records.DeleteOldAlertsHistory(hub, 10, 20)
+		require.NoError(t, err)
+
+		count, err := hub.CountRecords("alerts_history")
+		require.NoError(t, err)
+		assert.Equal(t, int64(5), count, "All alerts should remain")
+	})
+
+	t.Run("Empty alerts_history table", func(t *testing.T) {
+		// Clear any existing alerts
+		_, err := hub.DB().NewQuery("DELETE FROM alerts_history").Execute()
+		require.NoError(t, err)
+
+		// Should not error with empty table
+		err = records.DeleteOldAlertsHistory(hub, 10, 20)
+		require.NoError(t, err)
+	})
+}
+
+// TestDeleteOldSystemdServiceRecords tests systemd service cleanup via DeleteOldRecords
+func TestDeleteOldSystemdServiceRecords(t *testing.T) {
+	hub, err := tests.NewTestHub(t.TempDir())
+	require.NoError(t, err)
+	defer hub.Cleanup()
+
+	rm := records.NewRecordManager(hub)
+
+	// Create test user and system
+	user, err := tests.CreateUser(hub, "test@example.com", "testtesttest")
+	require.NoError(t, err)
+
+	system, err := tests.CreateRecord(hub, "systems", map[string]any{
+		"name":   "test-system",
+		"host":   "localhost",
+		"port":   "45876",
+		"status": "up",
+		"users":  []string{user.Id},
+	})
+	require.NoError(t, err)
+
+	now := time.Now().UTC()
+
+	// Create old systemd service records that should be deleted (older than 20 minutes)
+	oldRecord, err := tests.CreateRecord(hub, "systemd_services", map[string]any{
+		"system":  system.Id,
+		"name":    "nginx.service",
+		"state":   0, // Active
+		"sub":     1, // Running
+		"cpu":     5.0,
+		"cpuPeak": 10.0,
+		"memory":  1024000,
+		"memPeak": 2048000,
+	})
+	require.NoError(t, err)
+	// Set updated time to 25 minutes ago (should be deleted)
+	oldRecord.SetRaw("updated", now.Add(-25*time.Minute).UnixMilli())
+	err = hub.SaveNoValidate(oldRecord)
+	require.NoError(t, err)
+
+	// Create recent systemd service record that should be kept (within 20 minutes)
+	recentRecord, err := tests.CreateRecord(hub, "systemd_services", map[string]any{
+		"system":  system.Id,
+		"name":    "apache.service",
+		"state":   1, // Inactive
+		"sub":     0, // Dead
+		"cpu":     2.0,
+		"cpuPeak": 3.0,
+		"memory":  512000,
+		"memPeak": 1024000,
+	})
+	require.NoError(t, err)
+	// Set updated time to 10 minutes ago (should be kept)
+	recentRecord.SetRaw("updated", now.Add(-10*time.Minute).UnixMilli())
+	err = hub.SaveNoValidate(recentRecord)
+	require.NoError(t, err)
+
+	// Count records before deletion
+	countBefore, err := hub.CountRecords("systemd_services")
+	require.NoError(t, err)
+	assert.Equal(t, int64(2), countBefore, "Should have 2 systemd service records initially")
+
+	// Run deletion via RecordManager
+	rm.DeleteOldRecords()
+
+	// Count records after deletion
+	countAfter, err := hub.CountRecords("systemd_services")
+	require.NoError(t, err)
+	assert.Equal(t, int64(1), countAfter, "Should have 1 systemd service record after deletion")
+
+	// Verify the correct record was kept
+	remainingRecords, err := hub.FindRecordsByFilter("systemd_services", "", "", 10, 0, nil)
+	require.NoError(t, err)
+	assert.Len(t, remainingRecords, 1, "Should have exactly 1 record remaining")
+	assert.Equal(t, "apache.service", remainingRecords[0].Get("name"), "The recent record should be kept")
+}
+
 // TestRecordManagerCreation tests RecordManager creation
 func TestRecordManagerCreation(t *testing.T) {
 	hub, err := tests.NewTestHub(t.TempDir())

internal/site/bun.lock

@@ -41,7 +41,7 @@
         "recharts": "^2.15.4",
         "shiki": "^3.13.0",
         "tailwind-merge": "^3.3.1",
-        "valibot": "^1.3.1",
+        "valibot": "^0.42.1",
       },
       "devDependencies": {
         "@biomejs/biome": "2.2.4",
@@ -927,7 +927,7 @@
 
     "util-deprecate": ["util-deprecate@1.0.2", "", {}, "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw=="],
 
-    "valibot": ["valibot@1.3.1", "", { "peerDependencies": { "typescript": ">=5" }, "optionalPeers": ["typescript"] }, "sha512-sfdRir/QFM0JaF22hqTroPc5xy4DimuGQVKFrzF1YfGwaS1nJot3Y8VqMdLO2Lg27fMzat2yD3pY5PbAYO39Gg=="],
+    "valibot": ["valibot@0.42.1", "", { "peerDependencies": { "typescript": ">=5" } }, "sha512-3keXV29Ar5b//Hqi4MbSdV7lfVp6zuYLZuA9V1PvQUsXqogr+u5lvLPLk3A4f74VUXDnf/JfWMN6sB+koJ/FFw=="],
 
     "vfile": ["vfile@6.0.3", "", { "dependencies": { "@types/unist": "^3.0.0", "vfile-message": "^4.0.0" } }, "sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q=="],
 

internal/site/index.html

@@ -4,7 +4,6 @@
 		<meta charset="UTF-8" />
 		<link rel="manifest" href="./static/manifest.json" crossorigin="use-credentials" />
 		<link rel="icon" type="image/svg+xml" href="./static/icon.svg" />
-		<link rel="apple-touch-icon" href="./static/icon.png" />
 		<meta name="viewport" content="width=device-width, initial-scale=1.0,maximum-scale=1.0, user-scalable=no, viewport-fit=cover" />
 		<meta name="robots" content="noindex, nofollow" />
 		<title>Beszel</title>
@@ -22,7 +21,11 @@
 			})();
 		</script>
 		<script>
-			globalThis.BESZEL = "{info}"
+			globalThis.BESZEL = {
+				BASE_PATH: "%BASE_URL%",
+				HUB_VERSION: "{{V}}",
+				HUB_URL: "{{HUB_URL}}"
+			}
 		</script>
 	</head>
 	<body>

internal/site/package-lock.json

@@ -1,12 +1,12 @@
 {
 	"name": "beszel",
-	"version": "0.18.7",
+	"version": "0.18.3",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "beszel",
-			"version": "0.18.7",
+			"version": "0.18.3",
 			"dependencies": {
 				"@henrygd/queue": "^1.0.7",
 				"@henrygd/semaphore": "^0.0.2",
@@ -44,7 +44,7 @@
 				"recharts": "^2.15.4",
 				"shiki": "^3.13.0",
 				"tailwind-merge": "^3.3.1",
-				"valibot": "^1.3.1"
+				"valibot": "^0.42.1"
 			},
 			"devDependencies": {
 				"@biomejs/biome": "2.2.4",
@@ -986,6 +986,29 @@
 			"integrity": "sha512-N3W7MKwTRmAxOjeG0NAT18oe2Xn3KdjkpMR6crbkF1UDamMGPjyigqEsefiv+qTaxibtc1a+zXCVzb9YXANVqw==",
 			"license": "MIT"
 		},
+		"node_modules/@isaacs/balanced-match": {
+			"version": "4.0.1",
+			"resolved": "https://registry.npmjs.org/@isaacs/balanced-match/-/balanced-match-4.0.1.tgz",
+			"integrity": "sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": "20 || >=22"
+			}
+		},
+		"node_modules/@isaacs/brace-expansion": {
+			"version": "5.0.0",
+			"resolved": "https://registry.npmjs.org/@isaacs/brace-expansion/-/brace-expansion-5.0.0.tgz",
+			"integrity": "sha512-ZT55BDLV0yv0RBm2czMiZ+SqCGO7AvmOM3G/w2xhVPH+te0aKgFjmBvGlL1dH+ql2tgGO3MVrbb3jCKyvpgnxA==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"@isaacs/balanced-match": "^4.0.1"
+			},
+			"engines": {
+				"node": "20 || >=22"
+			}
+		},
 		"node_modules/@isaacs/cliui": {
 			"version": "8.0.2",
 			"resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
@@ -1220,9 +1243,9 @@
 			}
 		},
 		"node_modules/@lingui/cli/node_modules/picomatch": {
-			"version": "2.3.2",
-			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-			"integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+			"version": "2.3.1",
+			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+			"integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {
@@ -2385,9 +2408,9 @@
 			"license": "MIT"
 		},
 		"node_modules/@rollup/rollup-android-arm-eabi": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.60.1.tgz",
-			"integrity": "sha512-d6FinEBLdIiK+1uACUttJKfgZREXrF0Qc2SmLII7W2AD8FfiZ9Wjd+rD/iRuf5s5dWrr1GgwXCvPqOuDquOowA==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.48.1.tgz",
+			"integrity": "sha512-rGmb8qoG/zdmKoYELCBwu7vt+9HxZ7Koos3pD0+sH5fR3u3Wb/jGcpnqxcnWsPEKDUyzeLSqksN8LJtgXjqBYw==",
 			"cpu": [
 				"arm"
 			],
@@ -2399,9 +2422,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-android-arm64": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.60.1.tgz",
-			"integrity": "sha512-YjG/EwIDvvYI1YvYbHvDz/BYHtkY4ygUIXHnTdLhG+hKIQFBiosfWiACWortsKPKU/+dUwQQCKQM3qrDe8c9BA==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.48.1.tgz",
+			"integrity": "sha512-4e9WtTxrk3gu1DFE+imNJr4WsL13nWbD/Y6wQcyku5qadlKHY3OQ3LJ/INrrjngv2BJIHnIzbqMk1GTAC2P8yQ==",
 			"cpu": [
 				"arm64"
 			],
@@ -2413,9 +2436,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-darwin-arm64": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.60.1.tgz",
-			"integrity": "sha512-mjCpF7GmkRtSJwon+Rq1N8+pI+8l7w5g9Z3vWj4T7abguC4Czwi3Yu/pFaLvA3TTeMVjnu3ctigusqWUfjZzvw==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.48.1.tgz",
+			"integrity": "sha512-+XjmyChHfc4TSs6WUQGmVf7Hkg8ferMAE2aNYYWjiLzAS/T62uOsdfnqv+GHRjq7rKRnYh4mwWb4Hz7h/alp8A==",
 			"cpu": [
 				"arm64"
 			],
@@ -2427,9 +2450,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-darwin-x64": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.60.1.tgz",
-			"integrity": "sha512-haZ7hJ1JT4e9hqkoT9R/19XW2QKqjfJVv+i5AGg57S+nLk9lQnJ1F/eZloRO3o9Scy9CM3wQ9l+dkXtcBgN5Ew==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.48.1.tgz",
+			"integrity": "sha512-upGEY7Ftw8M6BAJyGwnwMw91rSqXTcOKZnnveKrVWsMTF8/k5mleKSuh7D4v4IV1pLxKAk3Tbs0Lo9qYmii5mQ==",
 			"cpu": [
 				"x64"
 			],
@@ -2441,9 +2464,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-freebsd-arm64": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.60.1.tgz",
-			"integrity": "sha512-czw90wpQq3ZsAVBlinZjAYTKduOjTywlG7fEeWKUA7oCmpA8xdTkxZZlwNJKWqILlq0wehoZcJYfBvOyhPTQ6w==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.48.1.tgz",
+			"integrity": "sha512-P9ViWakdoynYFUOZhqq97vBrhuvRLAbN/p2tAVJvhLb8SvN7rbBnJQcBu8e/rQts42pXGLVhfsAP0k9KXWa3nQ==",
 			"cpu": [
 				"arm64"
 			],
@@ -2455,9 +2478,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-freebsd-x64": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.60.1.tgz",
-			"integrity": "sha512-KVB2rqsxTHuBtfOeySEyzEOB7ltlB/ux38iu2rBQzkjbwRVlkhAGIEDiiYnO2kFOkJp+Z7pUXKyrRRFuFUKt+g==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.48.1.tgz",
+			"integrity": "sha512-VLKIwIpnBya5/saccM8JshpbxfyJt0Dsli0PjXozHwbSVaHTvWXJH1bbCwPXxnMzU4zVEfgD1HpW3VQHomi2AQ==",
 			"cpu": [
 				"x64"
 			],
@@ -2469,9 +2492,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.60.1.tgz",
-			"integrity": "sha512-L+34Qqil+v5uC0zEubW7uByo78WOCIrBvci69E7sFASRl0X7b/MB6Cqd1lky/CtcSVTydWa2WZwFuWexjS5o6g==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.48.1.tgz",
+			"integrity": "sha512-3zEuZsXfKaw8n/yF7t8N6NNdhyFw3s8xJTqjbTDXlipwrEHo4GtIKcMJr5Ed29leLpB9AugtAQpAHW0jvtKKaQ==",
 			"cpu": [
 				"arm"
 			],
@@ -2483,9 +2506,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-arm-musleabihf": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.60.1.tgz",
-			"integrity": "sha512-n83O8rt4v34hgFzlkb1ycniJh7IR5RCIqt6mz1VRJD6pmhRi0CXdmfnLu9dIUS6buzh60IvACM842Ffb3xd6Gg==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.48.1.tgz",
+			"integrity": "sha512-leo9tOIlKrcBmmEypzunV/2w946JeLbTdDlwEZ7OnnsUyelZ72NMnT4B2vsikSgwQifjnJUbdXzuW4ToN1wV+Q==",
 			"cpu": [
 				"arm"
 			],
@@ -2497,9 +2520,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-arm64-gnu": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.60.1.tgz",
-			"integrity": "sha512-Nql7sTeAzhTAja3QXeAI48+/+GjBJ+QmAH13snn0AJSNL50JsDqotyudHyMbO2RbJkskbMbFJfIJKWA6R1LCJQ==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.48.1.tgz",
+			"integrity": "sha512-Vy/WS4z4jEyvnJm+CnPfExIv5sSKqZrUr98h03hpAMbE2aI0aD2wvK6GiSe8Gx2wGp3eD81cYDpLLBqNb2ydwQ==",
 			"cpu": [
 				"arm64"
 			],
@@ -2511,9 +2534,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-arm64-musl": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.60.1.tgz",
-			"integrity": "sha512-+pUymDhd0ys9GcKZPPWlFiZ67sTWV5UU6zOJat02M1+PiuSGDziyRuI/pPue3hoUwm2uGfxdL+trT6Z9rxnlMA==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.48.1.tgz",
+			"integrity": "sha512-x5Kzn7XTwIssU9UYqWDB9VpLpfHYuXw5c6bJr4Mzv9kIv242vmJHbI5PJJEnmBYitUIfoMCODDhR7KoZLot2VQ==",
 			"cpu": [
 				"arm64"
 			],
@@ -2524,24 +2547,10 @@
 				"linux"
 			]
 		},
-		"node_modules/@rollup/rollup-linux-loong64-gnu": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.60.1.tgz",
-			"integrity": "sha512-VSvgvQeIcsEvY4bKDHEDWcpW4Yw7BtlKG1GUT4FzBUlEKQK0rWHYBqQt6Fm2taXS+1bXvJT6kICu5ZwqKCnvlQ==",
-			"cpu": [
-				"loong64"
-			],
-			"dev": true,
-			"license": "MIT",
-			"optional": true,
-			"os": [
-				"linux"
-			]
-		},
-		"node_modules/@rollup/rollup-linux-loong64-musl": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.60.1.tgz",
-			"integrity": "sha512-4LqhUomJqwe641gsPp6xLfhqWMbQV04KtPp7/dIp0nzPxAkNY1AbwL5W0MQpcalLYk07vaW9Kp1PBhdpZYYcEw==",
+		"node_modules/@rollup/rollup-linux-loongarch64-gnu": {
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loongarch64-gnu/-/rollup-linux-loongarch64-gnu-4.48.1.tgz",
+			"integrity": "sha512-yzCaBbwkkWt/EcgJOKDUdUpMHjhiZT/eDktOPWvSRpqrVE04p0Nd6EGV4/g7MARXXeOqstflqsKuXVM3H9wOIQ==",
 			"cpu": [
 				"loong64"
 			],
@@ -2553,23 +2562,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-ppc64-gnu": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.60.1.tgz",
-			"integrity": "sha512-tLQQ9aPvkBxOc/EUT6j3pyeMD6Hb8QF2BTBnCQWP/uu1lhc9AIrIjKnLYMEroIz/JvtGYgI9dF3AxHZNaEH0rw==",
-			"cpu": [
-				"ppc64"
-			],
-			"dev": true,
-			"license": "MIT",
-			"optional": true,
-			"os": [
-				"linux"
-			]
-		},
-		"node_modules/@rollup/rollup-linux-ppc64-musl": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.60.1.tgz",
-			"integrity": "sha512-RMxFhJwc9fSXP6PqmAz4cbv3kAyvD1etJFjTx4ONqFP9DkTkXsAMU4v3Vyc5BgzC+anz7nS/9tp4obsKfqkDHg==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.48.1.tgz",
+			"integrity": "sha512-UK0WzWUjMAJccHIeOpPhPcKBqax7QFg47hwZTp6kiMhQHeOYJeaMwzeRZe1q5IiTKsaLnHu9s6toSYVUlZ2QtQ==",
 			"cpu": [
 				"ppc64"
 			],
@@ -2581,9 +2576,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-riscv64-gnu": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.60.1.tgz",
-			"integrity": "sha512-QKgFl+Yc1eEk6MmOBfRHYF6lTxiiiV3/z/BRrbSiW2I7AFTXoBFvdMEyglohPj//2mZS4hDOqeB0H1ACh3sBbg==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.48.1.tgz",
+			"integrity": "sha512-3NADEIlt+aCdCbWVZ7D3tBjBX1lHpXxcvrLt/kdXTiBrOds8APTdtk2yRL2GgmnSVeX4YS1JIf0imFujg78vpw==",
 			"cpu": [
 				"riscv64"
 			],
@@ -2595,9 +2590,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-riscv64-musl": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.60.1.tgz",
-			"integrity": "sha512-RAjXjP/8c6ZtzatZcA1RaQr6O1TRhzC+adn8YZDnChliZHviqIjmvFwHcxi4JKPSDAt6Uhf/7vqcBzQJy0PDJg==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.48.1.tgz",
+			"integrity": "sha512-euuwm/QTXAMOcyiFCcrx0/S2jGvFlKJ2Iro8rsmYL53dlblp3LkUQVFzEidHhvIPPvcIsxDhl2wkBE+I6YVGzA==",
 			"cpu": [
 				"riscv64"
 			],
@@ -2609,9 +2604,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-s390x-gnu": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.60.1.tgz",
-			"integrity": "sha512-wcuocpaOlaL1COBYiA89O6yfjlp3RwKDeTIA0hM7OpmhR1Bjo9j31G1uQVpDlTvwxGn2nQs65fBFL5UFd76FcQ==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.48.1.tgz",
+			"integrity": "sha512-w8mULUjmPdWLJgmTYJx/W6Qhln1a+yqvgwmGXcQl2vFBkWsKGUBRbtLRuKJUln8Uaimf07zgJNxOhHOvjSQmBQ==",
 			"cpu": [
 				"s390x"
 			],
@@ -2623,9 +2618,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-x64-gnu": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.60.1.tgz",
-			"integrity": "sha512-77PpsFQUCOiZR9+LQEFg9GClyfkNXj1MP6wRnzYs0EeWbPcHs02AXu4xuUbM1zhwn3wqaizle3AEYg5aeoohhg==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.48.1.tgz",
+			"integrity": "sha512-90taWXCWxTbClWuMZD0DKYohY1EovA+W5iytpE89oUPmT5O1HFdf8cuuVIylE6vCbrGdIGv85lVRzTcpTRZ+kA==",
 			"cpu": [
 				"x64"
 			],
@@ -2637,9 +2632,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-x64-musl": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.60.1.tgz",
-			"integrity": "sha512-5cIATbk5vynAjqqmyBjlciMJl1+R/CwX9oLk/EyiFXDWd95KpHdrOJT//rnUl4cUcskrd0jCCw3wpZnhIHdD9w==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.48.1.tgz",
+			"integrity": "sha512-2Gu29SkFh1FfTRuN1GR1afMuND2GKzlORQUP3mNMJbqdndOg7gNsa81JnORctazHRokiDzQ5+MLE5XYmZW5VWg==",
 			"cpu": [
 				"x64"
 			],
@@ -2650,38 +2645,10 @@
 				"linux"
 			]
 		},
-		"node_modules/@rollup/rollup-openbsd-x64": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.60.1.tgz",
-			"integrity": "sha512-cl0w09WsCi17mcmWqqglez9Gk8isgeWvoUZ3WiJFYSR3zjBQc2J5/ihSjpl+VLjPqjQ/1hJRcqBfLjssREQILw==",
-			"cpu": [
-				"x64"
-			],
-			"dev": true,
-			"license": "MIT",
-			"optional": true,
-			"os": [
-				"openbsd"
-			]
-		},
-		"node_modules/@rollup/rollup-openharmony-arm64": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.60.1.tgz",
-			"integrity": "sha512-4Cv23ZrONRbNtbZa37mLSueXUCtN7MXccChtKpUnQNgF010rjrjfHx3QxkS2PI7LqGT5xXyYs1a7LbzAwT0iCA==",
-			"cpu": [
-				"arm64"
-			],
-			"dev": true,
-			"license": "MIT",
-			"optional": true,
-			"os": [
-				"openharmony"
-			]
-		},
 		"node_modules/@rollup/rollup-win32-arm64-msvc": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.60.1.tgz",
-			"integrity": "sha512-i1okWYkA4FJICtr7KpYzFpRTHgy5jdDbZiWfvny21iIKky5YExiDXP+zbXzm3dUcFpkEeYNHgQ5fuG236JPq0g==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.48.1.tgz",
+			"integrity": "sha512-6kQFR1WuAO50bxkIlAVeIYsz3RUx+xymwhTo9j94dJ+kmHe9ly7muH23sdfWduD0BA8pD9/yhonUvAjxGh34jQ==",
 			"cpu": [
 				"arm64"
 			],
@@ -2693,9 +2660,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-win32-ia32-msvc": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.60.1.tgz",
-			"integrity": "sha512-u09m3CuwLzShA0EYKMNiFgcjjzwqtUMLmuCJLeZWjjOYA3IT2Di09KaxGBTP9xVztWyIWjVdsB2E9goMjZvTQg==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.48.1.tgz",
+			"integrity": "sha512-RUyZZ/mga88lMI3RlXFs4WQ7n3VyU07sPXmMG7/C1NOi8qisUg57Y7LRarqoGoAiopmGmChUhSwfpvQ3H5iGSQ==",
 			"cpu": [
 				"ia32"
 			],
@@ -2706,24 +2673,10 @@
 				"win32"
 			]
 		},
-		"node_modules/@rollup/rollup-win32-x64-gnu": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.60.1.tgz",
-			"integrity": "sha512-k+600V9Zl1CM7eZxJgMyTUzmrmhB/0XZnF4pRypKAlAgxmedUA+1v9R+XOFv56W4SlHEzfeMtzujLJD22Uz5zg==",
-			"cpu": [
-				"x64"
-			],
-			"dev": true,
-			"license": "MIT",
-			"optional": true,
-			"os": [
-				"win32"
-			]
-		},
 		"node_modules/@rollup/rollup-win32-x64-msvc": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.60.1.tgz",
-			"integrity": "sha512-lWMnixq/QzxyhTV6NjQJ4SFo1J6PvOX8vUx5Wb4bBPsEb+8xZ89Bz6kOXpfXj9ak9AHTQVQzlgzBEc1SyM27xQ==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.48.1.tgz",
+			"integrity": "sha512-8a/caCUN4vkTChxkaIJcMtwIVcBhi4X2PQRoT+yCK3qRYaZ7cURrmJFL5Ux9H9RaMIXj9RuihckdmkBX3zZsgg==",
 			"cpu": [
 				"x64"
 			],
@@ -3282,66 +3235,6 @@
 				"node": ">=14.0.0"
 			}
 		},
-		"node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
-			"version": "1.4.5",
-			"dev": true,
-			"inBundle": true,
-			"license": "MIT",
-			"optional": true,
-			"dependencies": {
-				"@emnapi/wasi-threads": "1.0.4",
-				"tslib": "^2.4.0"
-			}
-		},
-		"node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
-			"version": "1.4.5",
-			"dev": true,
-			"inBundle": true,
-			"license": "MIT",
-			"optional": true,
-			"dependencies": {
-				"tslib": "^2.4.0"
-			}
-		},
-		"node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
-			"version": "1.0.4",
-			"dev": true,
-			"inBundle": true,
-			"license": "MIT",
-			"optional": true,
-			"dependencies": {
-				"tslib": "^2.4.0"
-			}
-		},
-		"node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
-			"version": "0.2.12",
-			"dev": true,
-			"inBundle": true,
-			"license": "MIT",
-			"optional": true,
-			"dependencies": {
-				"@emnapi/core": "^1.4.3",
-				"@emnapi/runtime": "^1.4.3",
-				"@tybys/wasm-util": "^0.10.0"
-			}
-		},
-		"node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
-			"version": "0.10.0",
-			"dev": true,
-			"inBundle": true,
-			"license": "MIT",
-			"optional": true,
-			"dependencies": {
-				"tslib": "^2.4.0"
-			}
-		},
-		"node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
-			"version": "2.8.0",
-			"dev": true,
-			"inBundle": true,
-			"license": "0BSD",
-			"optional": true
-		},
 		"node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
 			"version": "4.1.12",
 			"resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.1.12.tgz",
@@ -3696,9 +3589,9 @@
 			}
 		},
 		"node_modules/anymatch/node_modules/picomatch": {
-			"version": "2.3.2",
-			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-			"integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+			"version": "2.3.1",
+			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+			"integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {
@@ -3727,16 +3620,6 @@
 				"node": ">=10"
 			}
 		},
-		"node_modules/balanced-match": {
-			"version": "4.0.4",
-			"resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-			"integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
-			"dev": true,
-			"license": "MIT",
-			"engines": {
-				"node": "18 || 20 || >=22"
-			}
-		},
 		"node_modules/base64-js": {
 			"version": "1.5.1",
 			"resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
@@ -3783,19 +3666,6 @@
 				"readable-stream": "^3.4.0"
 			}
 		},
-		"node_modules/brace-expansion": {
-			"version": "5.0.5",
-			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-			"integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
-			"dev": true,
-			"license": "MIT",
-			"dependencies": {
-				"balanced-match": "^4.0.2"
-			},
-			"engines": {
-				"node": "18 || 20 || >=22"
-			}
-		},
 		"node_modules/braces": {
 			"version": "3.0.3",
 			"resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
@@ -5202,9 +5072,9 @@
 			"license": "MIT"
 		},
 		"node_modules/lodash": {
-			"version": "4.18.1",
-			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
-			"integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
+			"version": "4.17.23",
+			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
+			"integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
 			"license": "MIT"
 		},
 		"node_modules/lodash.sortby": {
@@ -5397,9 +5267,9 @@
 			}
 		},
 		"node_modules/micromatch/node_modules/picomatch": {
-			"version": "2.3.2",
-			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-			"integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+			"version": "2.3.1",
+			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+			"integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {
@@ -5420,16 +5290,16 @@
 			}
 		},
 		"node_modules/minimatch": {
-			"version": "10.2.5",
-			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
-			"integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
+			"version": "10.1.1",
+			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.1.1.tgz",
+			"integrity": "sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ==",
 			"dev": true,
 			"license": "BlueOak-1.0.0",
 			"dependencies": {
-				"brace-expansion": "^5.0.5"
+				"@isaacs/brace-expansion": "^5.0.0"
 			},
 			"engines": {
-				"node": "18 || 20 || >=22"
+				"node": "20 || >=22"
 			},
 			"funding": {
 				"url": "https://github.com/sponsors/isaacs"
@@ -5705,9 +5575,9 @@
 			"license": "ISC"
 		},
 		"node_modules/picomatch": {
-			"version": "4.0.4",
-			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-			"integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+			"version": "4.0.3",
+			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
+			"integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {
@@ -6086,9 +5956,9 @@
 			"license": "ISC"
 		},
 		"node_modules/rollup": {
-			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/rollup/-/rollup-4.60.1.tgz",
-			"integrity": "sha512-VmtB2rFU/GroZ4oL8+ZqXgSA38O6GR8KSIvWmEFv63pQ0G6KaBH9s07PO8XTXP4vI+3UJUEypOfjkGfmSBBR0w==",
+			"version": "4.48.1",
+			"resolved": "https://registry.npmjs.org/rollup/-/rollup-4.48.1.tgz",
+			"integrity": "sha512-jVG20NvbhTYDkGAty2/Yh7HK6/q3DGSRH4o8ALKGArmMuaauM9kLfoMZ+WliPwA5+JHr2lTn3g557FxBV87ifg==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -6102,31 +5972,26 @@
 				"npm": ">=8.0.0"
 			},
 			"optionalDependencies": {
-				"@rollup/rollup-android-arm-eabi": "4.60.1",
-				"@rollup/rollup-android-arm64": "4.60.1",
-				"@rollup/rollup-darwin-arm64": "4.60.1",
-				"@rollup/rollup-darwin-x64": "4.60.1",
-				"@rollup/rollup-freebsd-arm64": "4.60.1",
-				"@rollup/rollup-freebsd-x64": "4.60.1",
-				"@rollup/rollup-linux-arm-gnueabihf": "4.60.1",
-				"@rollup/rollup-linux-arm-musleabihf": "4.60.1",
-				"@rollup/rollup-linux-arm64-gnu": "4.60.1",
-				"@rollup/rollup-linux-arm64-musl": "4.60.1",
-				"@rollup/rollup-linux-loong64-gnu": "4.60.1",
-				"@rollup/rollup-linux-loong64-musl": "4.60.1",
-				"@rollup/rollup-linux-ppc64-gnu": "4.60.1",
-				"@rollup/rollup-linux-ppc64-musl": "4.60.1",
-				"@rollup/rollup-linux-riscv64-gnu": "4.60.1",
-				"@rollup/rollup-linux-riscv64-musl": "4.60.1",
-				"@rollup/rollup-linux-s390x-gnu": "4.60.1",
-				"@rollup/rollup-linux-x64-gnu": "4.60.1",
-				"@rollup/rollup-linux-x64-musl": "4.60.1",
-				"@rollup/rollup-openbsd-x64": "4.60.1",
-				"@rollup/rollup-openharmony-arm64": "4.60.1",
-				"@rollup/rollup-win32-arm64-msvc": "4.60.1",
-				"@rollup/rollup-win32-ia32-msvc": "4.60.1",
-				"@rollup/rollup-win32-x64-gnu": "4.60.1",
-				"@rollup/rollup-win32-x64-msvc": "4.60.1",
+				"@rollup/rollup-android-arm-eabi": "4.48.1",
+				"@rollup/rollup-android-arm64": "4.48.1",
+				"@rollup/rollup-darwin-arm64": "4.48.1",
+				"@rollup/rollup-darwin-x64": "4.48.1",
+				"@rollup/rollup-freebsd-arm64": "4.48.1",
+				"@rollup/rollup-freebsd-x64": "4.48.1",
+				"@rollup/rollup-linux-arm-gnueabihf": "4.48.1",
+				"@rollup/rollup-linux-arm-musleabihf": "4.48.1",
+				"@rollup/rollup-linux-arm64-gnu": "4.48.1",
+				"@rollup/rollup-linux-arm64-musl": "4.48.1",
+				"@rollup/rollup-linux-loongarch64-gnu": "4.48.1",
+				"@rollup/rollup-linux-ppc64-gnu": "4.48.1",
+				"@rollup/rollup-linux-riscv64-gnu": "4.48.1",
+				"@rollup/rollup-linux-riscv64-musl": "4.48.1",
+				"@rollup/rollup-linux-s390x-gnu": "4.48.1",
+				"@rollup/rollup-linux-x64-gnu": "4.48.1",
+				"@rollup/rollup-linux-x64-musl": "4.48.1",
+				"@rollup/rollup-win32-arm64-msvc": "4.48.1",
+				"@rollup/rollup-win32-ia32-msvc": "4.48.1",
+				"@rollup/rollup-win32-x64-msvc": "4.48.1",
 				"fsevents": "~2.3.2"
 			}
 		},
@@ -6425,9 +6290,9 @@
 			}
 		},
 		"node_modules/tar": {
-			"version": "7.5.13",
-			"resolved": "https://registry.npmjs.org/tar/-/tar-7.5.13.tgz",
-			"integrity": "sha512-tOG/7GyXpFevhXVh8jOPJrmtRpOTsYqUIkVdVooZYJS/z8WhfQUX8RJILmeuJNinGAMSu1veBr4asSHFt5/hng==",
+			"version": "7.5.7",
+			"resolved": "https://registry.npmjs.org/tar/-/tar-7.5.7.tgz",
+			"integrity": "sha512-fov56fJiRuThVFXD6o6/Q354S7pnWMJIVlDBYijsTNx6jKSE4pvrDTs6lUnmGvNyfJwFQQwWy3owKz1ucIhveQ==",
 			"dev": true,
 			"license": "BlueOak-1.0.0",
 			"dependencies": {
@@ -6694,9 +6559,9 @@
 			"license": "MIT"
 		},
 		"node_modules/valibot": {
-			"version": "1.3.1",
-			"resolved": "https://registry.npmjs.org/valibot/-/valibot-1.3.1.tgz",
-			"integrity": "sha512-sfdRir/QFM0JaF22hqTroPc5xy4DimuGQVKFrzF1YfGwaS1nJot3Y8VqMdLO2Lg27fMzat2yD3pY5PbAYO39Gg==",
+			"version": "0.42.1",
+			"resolved": "https://registry.npmjs.org/valibot/-/valibot-0.42.1.tgz",
+			"integrity": "sha512-3keXV29Ar5b//Hqi4MbSdV7lfVp6zuYLZuA9V1PvQUsXqogr+u5lvLPLk3A4f74VUXDnf/JfWMN6sB+koJ/FFw==",
 			"license": "MIT",
 			"peerDependencies": {
 				"typescript": ">=5"

internal/site/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "beszel",
 	"private": true,
-	"version": "0.18.7",
+	"version": "0.18.5",
 	"type": "module",
 	"scripts": {
 		"dev": "vite --host",
@@ -52,7 +52,7 @@
 		"recharts": "^2.15.4",
 		"shiki": "^3.13.0",
 		"tailwind-merge": "^3.3.1",
-		"valibot": "^1.3.1"
+		"valibot": "^0.42.1"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "2.2.4",