dev: update biome schema and disable assist/source/organizeImports

also increase the default container width

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Everything needs to be reviewed by Hank
+*   @henrygd

.github/DISCUSSION_TEMPLATE/ideas.yml

@@ -0,0 +1,19 @@
+body:
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      description: Which part of Beszel is this about?
+      options:
+        - Hub
+        - Agent
+        - Hub & Agent
+      default: 0
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Description
+      description: Please describe in detail what you want to share.
+    validations:
+      required: true

.github/DISCUSSION_TEMPLATE/support.yml

@@ -1,19 +1,54 @@
 body:
-  - type: markdown
+  - type: checkboxes
+    id: terms
     attributes:
-      value: |
+      label: Welcome!
-        ### Before opening a discussion:
+      description: |
+        Thank you for reaching out to the Beszel community for support! To help us assist you better, please make sure to review the following points before submitting your request:
 
-        - Check the [common issues guide](https://beszel.dev/guide/common-issues).
+        Please note:
-        - Search existing [issues](https://github.com/henrygd/beszel/issues) and [discussions](https://github.com/henrygd/beszel/discussions) (including closed).
+        - For translation-related issues or requests, please use the [Crowdin project](https://crowdin.com/project/beszel).
+        **- Please do not submit support reqeusts that are specific to ZFS. We plan to add integration with ZFS utilities in the near future.**
+
+      options:
+      - label: I have read the [Documentation](https://beszel.dev/guide/getting-started)
+        required: true
+      - label: I have checked the [Common Issues Guide](https://beszel.dev/guide/common-issues) and my problem was not mentioned there.
+        required: true
+      - label: I have searched open and closed issues and discussions and my problem was not mentioned before.
+        required: true
+      - label: I have verified I am using the latest version available. You can check the latest release [here](https://github.com/henrygd/beszel/releases).
+        required: true
+
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      description: Which part of Beszel is this about?
+      options:
+        - Hub
+        - Agent
+        - Hub & Agent
+    default: 0
+    validations:
+      required: true
 
   - type: textarea
     id: description
     attributes:
-      label: Description
+      label: Problem Description
-      description: A clear and concise description of the issue or question. If applicable, add screenshots to help explain your problem.
+      description: |
+        How to write a good bug report?
+
+        - Respect the issue template as much as possible.
+        - The title should be short and descriptive.
+        - Explain the conditions which led you to report this issue: the context.
+        - The context should lead to something, a problem that you’re facing.
+        - Remain clear and concise.
+        - Format your messages to help the reader focus on what matters and understand the structure of your message, use [Markdown syntax](https://help.github.com/articles/github-flavored-markdown)
     validations:
       required: true
+
   - type: input
     id: system
     attributes:
@@ -21,13 +56,15 @@ body:
       placeholder: linux/amd64 (agent), freebsd/arm64 (hub)
     validations:
       required: true
-  - type: input
+  
-    id: version
+#  - type: input
-    attributes:
+#    id: version
-      label: Beszel version
+#    attributes:
-      placeholder: 0.9.1
+#      label: Beszel version
-    validations:
+#      placeholder: 0.9.1
-      required: true
+#    validations:
+#      required: true
+
   - type: dropdown
     id: install-method
     attributes:
@@ -41,18 +78,21 @@ body:
         - Other (please describe above)
     validations:
       required: true
+  
   - type: textarea
     id: config
     attributes:
       label: Configuration
       description: Please provide any relevant service configuration
       render: yaml
+
   - type: textarea
     id: hub-logs
     attributes:
       label: Hub Logs
       description: Check the logs page in PocketBase (`/_/#/logs`) for relevant errors (copy JSON).
       render: json
+
   - type: textarea
     id: agent-logs
     attributes:

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,8 +1,30 @@
 name: 🐛 Bug report
-description: Report a new bug or issue.
+description: Use this template to report a bug or issue.
 title: '[Bug]: '
-labels: ['bug', "needs confirmation"]
+labels: ['bug']
 body:
+  - type: checkboxes
+    attributes:
+      label: Welcome!
+      description: |
+        The issue tracker is for reporting bugs and feature requests only. For end-user related support questions, please use the **[GitHub Discussions](https://github.com/henrygd/beszel/discussions/new?category=support)** instead
+
+        Please note:
+        - For translation-related issues or requests, please use the [Crowdin project](https://crowdin.com/project/beszel).
+        - To request a change or feature, use the [feature request form](https://github.com/henrygd/beszel/issues/new?template=feature_request.yml).
+        - Any issues that can be resolved by consulting the documentation or by reviewing existing open or closed issues will be closed.
+        **- Please do not submit bugs that are specific to ZFS. We plan to add integration with ZFS utilities in the near future.**
+
+      options:
+      - label: I have read the [Documentation](https://beszel.dev/guide/getting-started)
+        required: true
+      - label: I have checked the [Common Issues Guide](https://beszel.dev/guide/common-issues) and my problem was not mentioned there.
+        required: true
+      - label: I have searched open and closed issues and my problem was not mentioned before.
+        required: true
+      - label: I have verified I am using the latest version available. You can check the latest release [here](https://github.com/henrygd/beszel/releases).
+        required: true
+
   - type: dropdown
     id: component
     attributes:
@@ -12,81 +34,53 @@ body:
         - Hub
         - Agent
         - Hub & Agent
+      default: 0
     validations:
       required: true
-  - type: markdown
-    attributes:
-      value: |
-        ### Thanks for taking the time to fill out this bug report!
 
-        - For more general support, please [start a support thread](https://github.com/henrygd/beszel/discussions/new?category=support).
-        - To request a change or feature, use the [feature request form](https://github.com/henrygd/beszel/issues/new?template=feature_request.yml).
-        - Please do not submit bugs that are specific to ZFS. We plan to add integration with ZFS utilities in the near future.
-
-        ### Before submitting a bug report:
-
-        - Check the [common issues guide](https://beszel.dev/guide/common-issues).
-        - Search existing [issues](https://github.com/henrygd/beszel/issues) and [discussions](https://github.com/henrygd/beszel/discussions) (including closed).
   - type: textarea
     id: description
     attributes:
-      label: Description
+      label: Problem Description
-      description: Explain the issue you experienced clearly and concisely.
+      description: |
-      placeholder: I went to the coffee pot and it was empty.
+        How to write a good bug report?
+
+        - Respect the issue template as much as possible.
+        - The title should be short and descriptive.
+        - Explain the conditions which led you to report this issue: the context.
+        - The context should lead to something, a problem that you’re facing.
+        - Remain clear and concise.
+        - Format your messages to help the reader focus on what matters and understand the structure of your message, use [Markdown syntax](https://help.github.com/articles/github-flavored-markdown)
     validations:
       required: true
+
   - type: textarea
     id: expected-behavior
     attributes:
       label: Expected Behavior
-      description: In a perfect world, what should have happened?
+      description: |
+        In a perfect world, what should have happened?
+        **Important:** Be specific. Vague descriptions like "it should work" are not helpful.
       placeholder: When I got to the coffee pot, it should have been full.
     validations:
       required: true
+
   - type: textarea
     id: steps-to-reproduce
     attributes:
       label: Steps to Reproduce
-      description: Describe how to reproduce the issue in repeatable steps.
+      description: |
+        Provide detailed, numbered steps that someone else can follow to reproduce the issue.
+        **Important:** Vague descriptions like "it doesn't work" or "it's broken" will result in the issue being closed.
+        Include specific actions, URLs, button clicks, and any relevant data or configuration.
       placeholder: |
         1. Go to the coffee pot.
         2. Make more coffee.
         3. Pour it into a cup.
+        4. Observe that the cup is empty instead of full.
     validations:
       required: true
-  - type: dropdown
+
-    id: category
-    attributes:
-      label: Category
-      description: Which category does this relate to most?
-      options:
-        - Metrics
-        - Charts & Visualization
-        - Settings & Configuration
-        - Notifications & Alerts
-        - Authentication
-        - Installation
-        - Performance
-        - UI / UX
-        - Other
-    validations:
-      required: true
-  - type: dropdown
-    id: metrics
-    attributes:
-      label: Affected Metrics
-      description: If applicable, which specific metric does this relate to most?
-      options:
-        - CPU
-        - Memory
-        - Storage
-        - Network
-        - Containers
-        - GPU
-        - Sensors
-        - Other
-    validations:
-      required: true
   - type: input
     id: system
     attributes:
@@ -94,6 +88,7 @@ body:
       placeholder: linux/amd64 (agent), freebsd/arm64 (hub)
     validations:
       required: true
+  
   - type: input
     id: version
     attributes:
@@ -101,6 +96,7 @@ body:
       placeholder: 0.9.1
     validations:
       required: true
+  
   - type: dropdown
     id: install-method
     attributes:
@@ -114,18 +110,21 @@ body:
         - Other (please describe above)
     validations:
       required: true
+  
   - type: textarea
     id: config
     attributes:
       label: Configuration
       description: Please provide any relevant service configuration
       render: yaml
+  
   - type: textarea
     id: hub-logs
     attributes:
       label: Hub Logs
       description: Check the logs page in PocketBase (`/_/#/logs`) for relevant errors (copy JSON).
       render: json
+  
   - type: textarea
     id: agent-logs
     attributes:

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,8 @@
 blank_issues_enabled: false
 contact_links:
+  - name: 🗣️ Translations
+    url: https://crowdin.com/project/beszel
+    about: Please report translation issues and request new translations here. 
   - name: 💬 Support and questions
     url: https://github.com/henrygd/beszel/discussions
     about: Ask and answer questions here.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,8 +1,25 @@
 name: 🚀 Feature request
 description: Request a new feature or change.
 title: "[Feature]: "
-labels: ["enhancement", "needs review"]
+labels: ["enhancement"]
 body:
+  - type: checkboxes
+    attributes:
+      label: Welcome!
+      description: |
+        The issue tracker is for reporting bugs and feature requests only. For end-user related support questions, please use the **[GitHub Discussions](https://github.com/henrygd/beszel/discussions)** instead
+
+        Please note:
+        - For **Bug reports**, use the [Bug Form](https://github.com/henrygd/beszel/issues/new?template=bug_report.yml).
+        - Any requests for new translations should be requested within the [crowdin project](https://crowdin.com/project/beszel).
+        - Create one issue per feature request. This helps us keep track of requests and prioritize them accordingly.
+
+      options:
+      - label: I have searched open and closed feature requests to make sure this or similar feature request does not already exist.
+        required: true
+      - label: This is a feature request, not a bug report or support question.
+        required: true
+
   - type: dropdown
     id: component
     attributes:
@@ -12,16 +29,25 @@ body:
         - Hub
         - Agent
         - Hub & Agent
+      default: 0
     validations:
       required: true
-  - type: markdown
+
-    attributes:
-      value: Before submitting, please search existing [issues](https://github.com/henrygd/beszel/issues) and [discussions](https://github.com/henrygd/beszel/discussions) (including closed).
   - type: textarea
+    id: description
     attributes:
-      label: Describe the feature you would like to see
+      label: Description
+      description: |
+        Describe the solution or feature you'd like. Explain what problem this solves or what value it adds.
+        **Important:** Be specific and detailed. Vague requests like "make it better" will be closed.
+      placeholder: |
+        Example:
+        - What is the feature?
+        - What problem does it solve?
+        - How should it work?
     validations:
       required: true
+
   - type: textarea
     id: motivation
     attributes:
@@ -29,48 +55,3 @@ body:
       description: Why do you want this feature? What problem does it solve?
     validations:
       required: true
-  - type: textarea
-    attributes:
-      label: Describe how you would like to see this feature implemented
-    validations:
-      required: true
-  - type: textarea
-    id: logs
-    attributes:
-      label: Screenshots
-      description: Please attach any relevant screenshots, such as images from your current solution or similar implementations.
-    validations:
-      required: false
-  - type: dropdown
-    id: category
-    attributes:
-      label: Category
-      description: Which category does this relate to most?
-      options:
-        - Metrics
-        - Charts & Visualization
-        - Settings & Configuration
-        - Notifications & Alerts
-        - Authentication
-        - Installation
-        - Performance
-        - UI / UX
-        - Other
-    validations:
-      required: true
-  - type: dropdown
-    id: metrics
-    attributes:
-      label: Affected Metrics
-      description: If applicable, which specific metric does this relate to most?
-      options:
-        - CPU
-        - Memory
-        - Storage
-        - Network
-        - Containers
-        - GPU
-        - Sensors
-        - Other
-    validations:
-      required: true

.github/workflows/docker-images.yml

@@ -10,51 +10,141 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
+      max-parallel: 5
       matrix:
         include:
+          # henrygd/beszel
           - image: henrygd/beszel
-            context: ./
             dockerfile: ./internal/dockerfile_hub
             registry: docker.io
             username_secret: DOCKERHUB_USERNAME
             password_secret: DOCKERHUB_TOKEN
+            tags: |
+              type=raw,value=edge
+              type=semver,pattern={{version}}
+              type=semver,pattern={{major}}.{{minor}}
+              type=semver,pattern={{major}}
+              type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
             
+          # henrygd/beszel-agent:alpine
           - image: henrygd/beszel-agent
-            context: ./
+            dockerfile: ./internal/dockerfile_agent_alpine
-            dockerfile: ./internal/dockerfile_agent
             registry: docker.io
             username_secret: DOCKERHUB_USERNAME
             password_secret: DOCKERHUB_TOKEN
+            tags: |
+              type=raw,value=alpine
+              type=semver,pattern={{version}}-alpine
+              type=semver,pattern={{major}}.{{minor}}-alpine
+              type=semver,pattern={{major}}-alpine
 
+          # henrygd/beszel-agent-nvidia
           - image: henrygd/beszel-agent-nvidia
-            context: ./
             dockerfile: ./internal/dockerfile_agent_nvidia
             platforms: linux/amd64
             registry: docker.io
             username_secret: DOCKERHUB_USERNAME
             password_secret: DOCKERHUB_TOKEN
+            tags: |
+              type=raw,value=edge
+              type=semver,pattern={{version}}
+              type=semver,pattern={{major}}.{{minor}}
+              type=semver,pattern={{major}}
+              type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
 
+          # henrygd/beszel-agent-intel
+          - image: henrygd/beszel-agent-intel
+            dockerfile: ./internal/dockerfile_agent_intel
+            platforms: linux/amd64
+            registry: docker.io
+            username_secret: DOCKERHUB_USERNAME
+            password_secret: DOCKERHUB_TOKEN
+            tags: |
+              type=raw,value=edge
+              type=semver,pattern={{version}}
+              type=semver,pattern={{major}}.{{minor}}
+              type=semver,pattern={{major}}
+              type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
+
+          # ghcr.io/henrygd/beszel
           - image: ghcr.io/${{ github.repository }}/beszel
-            context: ./
             dockerfile: ./internal/dockerfile_hub
             registry: ghcr.io
             username: ${{ github.actor }}
             password_secret: GITHUB_TOKEN
+            tags: |
+              type=raw,value=edge
+              type=semver,pattern={{version}}
+              type=semver,pattern={{major}}.{{minor}}
+              type=semver,pattern={{major}}
+              type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
 
+          # ghcr.io/henrygd/beszel-agent
           - image: ghcr.io/${{ github.repository }}/beszel-agent
-            context: ./
             dockerfile: ./internal/dockerfile_agent
             registry: ghcr.io
             username: ${{ github.actor }}
             password_secret: GITHUB_TOKEN
+            tags: |
+              type=raw,value=edge
+              type=raw,value=latest
+              type=semver,pattern={{version}}
+              type=semver,pattern={{major}}.{{minor}}
+              type=semver,pattern={{major}}
+              type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
 
+          # ghcr.io/henrygd/beszel-agent-nvidia
           - image: ghcr.io/${{ github.repository }}/beszel-agent-nvidia
-            context: ./
             dockerfile: ./internal/dockerfile_agent_nvidia
             platforms: linux/amd64
             registry: ghcr.io
             username: ${{ github.actor }}
             password_secret: GITHUB_TOKEN
+            tags: |
+              type=raw,value=edge
+              type=semver,pattern={{version}}
+              type=semver,pattern={{major}}.{{minor}}
+              type=semver,pattern={{major}}
+              type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
+
+          # ghcr.io/henrygd/beszel-agent-intel
+          - image: ghcr.io/${{ github.repository }}/beszel-agent-intel
+            dockerfile: ./internal/dockerfile_agent_intel
+            platforms: linux/amd64
+            registry: ghcr.io
+            username: ${{ github.actor }}
+            password_secret: GITHUB_TOKEN
+            tags: |
+              type=raw,value=edge
+              type=semver,pattern={{version}}
+              type=semver,pattern={{major}}.{{minor}}
+              type=semver,pattern={{major}}
+              type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
+
+          # ghcr.io/henrygd/beszel-agent:alpine
+          - image: ghcr.io/${{ github.repository }}/beszel-agent
+            dockerfile: ./internal/dockerfile_agent_alpine
+            registry: ghcr.io
+            username: ${{ github.actor }}
+            password_secret: GITHUB_TOKEN
+            tags: |
+              type=raw,value=alpine
+              type=semver,pattern={{version}}-alpine
+              type=semver,pattern={{major}}.{{minor}}-alpine
+              type=semver,pattern={{major}}-alpine
+
+          # henrygd/beszel-agent (keep at bottom so it gets built after :alpine and gets the latest tag)
+          - image: henrygd/beszel-agent
+            dockerfile: ./internal/dockerfile_agent
+            registry: docker.io
+            username_secret: DOCKERHUB_USERNAME
+            password_secret: DOCKERHUB_TOKEN
+            tags: |
+              type=raw,value=edge
+              type=semver,pattern={{version}}
+              type=semver,pattern={{major}}.{{minor}}
+              type=semver,pattern={{major}}
+              type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
 
     permissions:
       contents: read
@@ -84,12 +174,7 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ${{ matrix.image }}
-          tags: |
+          tags: ${{ matrix.tags }}
-            type=raw,value=edge
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-            type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
 
       # https://github.com/docker/login-action
       - name: Login to Docker Hub
@@ -107,7 +192,7 @@ jobs:
       - name: Build and push Docker image
         uses: docker/build-push-action@v5
         with:
-          context: "${{ matrix.context }}"
+          context: ./
           file: ${{ matrix.dockerfile }}
           platforms: ${{ matrix.platforms || 'linux/amd64,linux/arm64,linux/arm/v7' }}
           push: ${{ github.ref_type == 'tag' && secrets[matrix.password_secret] != '' }}

.github/workflows/inactivity-actions.yml

@@ -6,16 +6,30 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: write
   issues: write
   pull-requests: write
 
 jobs:
+  lock-inactive:
+    name: Lock Inactive Issues
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: klaasnicolaas/action-inactivity-lock@v1.1.3
+        id: lock
+        with:
+          days-inactive-issues: 14
+          lock-reason-issues: ""
+          # Action can not skip PRs, set it to 100 years to cover it.
+          days-inactive-prs: 36524
+          lock-reason-prs: ""
+
   close-stale:
     name: Close Stale Issues
     runs-on: ubuntu-24.04
     steps:
       - name: Close Stale Issues
-        uses: actions/stale@v9
+        uses: actions/stale@v10
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -32,12 +46,19 @@ jobs:
           # Timing
           days-before-issue-stale: 14
           days-before-issue-close: 7
+          # Action can not skip PRs, set it to 100 years to cover it.
+          days-before-pr-stale: 36524
+
+          # Max issues to process before early exit. Next run resumes from cache. GH API limit: 5000.
+          operations-per-run: 1500
 
           # Labels
           stale-issue-label: 'stale'
           remove-stale-when-updated: true
-          only-issue-labels: 'awaiting-requester'
+          any-of-labels: 'awaiting-requester'
+          exempt-issue-labels: 'enhancement' 
 
           # Exemptions
           exempt-assignees: true
+
           exempt-milestones: true

.github/workflows/label-from-dropdown.yml

@@ -1,82 +0,0 @@
-name: Label issues from dropdowns
-
-on:
-  issues:
-    types: [opened]
-
-jobs:
-  label_from_dropdown:
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-    steps:
-      - name: Apply labels based on dropdown choices
-        uses: actions/github-script@v7
-        with:
-          script: |
-
-            const issueNumber = context.issue.number;
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-
-            // Get the issue body
-            const body = context.payload.issue.body;
-
-            // Helper to find dropdown value in the body (assuming markdown format)
-            function extractSectionValue(heading) {
-              const regex = new RegExp(`### ${heading}\\s+([\\s\\S]*?)(?:\\n###|$)`, 'i');
-              const match = body.match(regex);
-              if (match) {
-                // Get the first non-empty line after the heading
-                const lines = match[1].split('\n').map(l => l.trim()).filter(Boolean);
-                return lines[0] || null;
-              }
-              return null;
-            }
-
-            // Extract dropdown selections
-            const category = extractSectionValue('Category');
-            const metrics = extractSectionValue('Affected Metrics');
-            const component = extractSectionValue('Component');
-
-            // Build labels to add
-            let labelsToAdd = [];
-            if (category) labelsToAdd.push(category);
-            if (metrics) labelsToAdd.push(metrics);
-            if (component) labelsToAdd.push(component);
-
-            // Get existing labels in the repo
-            const { data: existingLabels } = await github.rest.issues.listLabelsForRepo({
-              owner,
-              repo,
-              per_page: 100
-            });
-            const existingLabelNames = existingLabels.map(l => l.name);
-
-            // Find labels that need to be created
-            const labelsToCreate = labelsToAdd.filter(label => !existingLabelNames.includes(label));
-
-            // Create missing labels (with a default color)
-            for (const label of labelsToCreate) {
-              try {
-                await github.rest.issues.createLabel({
-                  owner,
-                  repo,
-                  name: label,
-                  color: 'ededed' // light gray, you can pick any hex color
-                });
-              } catch (e) {
-                // Ignore if label already exists (race condition), otherwise rethrow
-                if (!e || e.status !== 422) throw e;
-              }
-            }
-
-            // Now apply all labels (they all exist now)
-            if (labelsToAdd.length > 0) {
-              await github.rest.issues.addLabels({
-                owner,
-                repo,
-                issue_number: issueNumber,
-                labels: labelsToAdd
-              });
-            } 

.gitignore

@@ -10,6 +10,7 @@ dist
 *.exe
 internal/cmd/hub/hub
 internal/cmd/agent/agent
+agent.test
 node_modules
 build
 *timestamp*

.goreleaser.yml

@@ -5,6 +5,7 @@ project_name: beszel
 before:
   hooks:
     - go mod tidy
+    - go generate -run fetchsmartctl ./agent
 
 builds:
   - id: beszel
@@ -15,10 +16,21 @@ builds:
     goos:
       - linux
       - darwin
+      - windows
+      - freebsd
     goarch:
       - amd64
       - arm64
       - arm
+    ignore:
+      - goos: windows
+        goarch: arm64
+      - goos: windows
+        goarch: arm
+      - goos: freebsd
+        goarch: arm64
+      - goos: freebsd
+        goarch: arm
 
   - id: beszel-agent
     binary: beszel-agent
@@ -64,6 +76,18 @@ builds:
       - goos: windows
         goarch: riscv64
 
+  - id: beszel-agent-linux-amd64-glibc
+    binary: beszel-agent
+    main: internal/cmd/agent/agent.go
+    env:
+      - CGO_ENABLED=0
+    flags:
+      - -tags=glibc
+    goos:
+      - linux
+    goarch:
+      - amd64
+
 archives:
   - id: beszel-agent
     formats: [tar.gz]
@@ -77,6 +101,15 @@ archives:
       - goos: windows
         formats: [zip]
 
+  - id: beszel-agent-linux-amd64-glibc
+    formats: [tar.gz]
+    ids:
+      - beszel-agent-linux-amd64-glibc
+    name_template: >-
+      {{ .Binary }}_
+      {{- .Os }}_
+      {{- .Arch }}_glibc
+
   - id: beszel
     formats: [tar.gz]
     ids:
@@ -85,6 +118,9 @@ archives:
       {{ .Binary }}_
       {{- .Os }}_
       {{- .Arch }}
+    format_overrides:
+      - goos: windows
+        formats: [zip]
 
 nfpms:
   - id: beszel-agent
@@ -122,9 +158,7 @@ nfpms:
         - debconf
       scripts:
         templates: ./supplemental/debian/templates
-        # Currently broken due to a bug in goreleaser
+        config: ./supplemental/debian/config.sh
-        # https://github.com/goreleaser/goreleaser/issues/5487
-        #config: ./supplemental/debian/config.sh
 
 scoops:
   - ids: [beszel-agent]

Makefile

@@ -3,11 +3,45 @@ OS ?= $(shell go env GOOS)
 ARCH ?= $(shell go env GOARCH)
 # Skip building the web UI if true
 SKIP_WEB ?= false
+# Controls NVML/glibc agent build tag behavior:
+# - auto (default): enable on linux/amd64 glibc hosts
+# - true: always enable
+# - false: always disable
+NVML ?= auto
+
+# Detect glibc host for local linux/amd64 builds.
+HOST_GLIBC := $(shell \
+	if [ "$(OS)" = "linux" ] && [ "$(ARCH)" = "amd64" ]; then \
+		for p in /lib64/ld-linux-x86-64.so.2 /lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 /lib/ld-linux-x86-64.so.2; do \
+			[ -e "$$p" ] && { echo true; exit 0; }; \
+		done; \
+		if command -v ldd >/dev/null 2>&1; then \
+			if ldd --version 2>&1 | tr '[:upper:]' '[:lower:]' | awk '/gnu libc|glibc/{found=1} END{exit !found}'; then \
+				echo true; \
+			else \
+				echo false; \
+			fi; \
+		else \
+			echo false; \
+		fi; \
+	else \
+		echo false; \
+	fi)
+
+# Enable glibc build tag for NVML on supported Linux builds.
+AGENT_GO_TAGS :=
+ifeq ($(NVML),true)
+AGENT_GO_TAGS := -tags glibc
+else ifeq ($(NVML),auto)
+ifeq ($(HOST_GLIBC),true)
+AGENT_GO_TAGS := -tags glibc
+endif
+endif
 
 # Set executable extension based on target OS
 EXE_EXT := $(if $(filter windows,$(OS)),.exe,)
 
-.PHONY: tidy build-agent build-hub build-hub-dev build clean lint dev-server dev-agent dev-hub dev generate-locales
+.PHONY: tidy build-agent build-hub build-hub-dev build clean lint dev-server dev-agent dev-hub dev generate-locales fetch-smartctl-conditional
 .DEFAULT_GOAL := build
 
 clean:
@@ -17,7 +51,6 @@ clean:
 lint:
 	golangci-lint run
 
-test: export GOEXPERIMENT=synctest
 test:
 	go test -tags=testing ./...
 
@@ -46,9 +79,15 @@ build-dotnet-conditional:
 		fi; \
 	fi
 
+# Download smartctl.exe at build time for Windows (skips if already present)
+fetch-smartctl-conditional:
+	@if [ "$(OS)" = "windows" ]; then \
+		go generate -run fetchsmartctl ./agent; \
+	fi
+
 # Update build-agent to include conditional .NET build
-build-agent: tidy build-dotnet-conditional
+build-agent: tidy build-dotnet-conditional fetch-smartctl-conditional
-	GOOS=$(OS) GOARCH=$(ARCH) go build -o ./build/beszel-agent_$(OS)_$(ARCH)$(EXE_EXT) -ldflags "-w -s" ./internal/cmd/agent
+	GOOS=$(OS) GOARCH=$(ARCH) go build $(AGENT_GO_TAGS) -o ./build/beszel-agent_$(OS)_$(ARCH)$(EXE_EXT) -ldflags "-w -s" ./internal/cmd/agent
 
 build-hub: tidy $(if $(filter false,$(SKIP_WEB)),build-web-ui)
 	GOOS=$(OS) GOARCH=$(ARCH) go build -o ./build/beszel_$(OS)_$(ARCH)$(EXE_EXT) -ldflags "-w -s" ./internal/cmd/hub
@@ -84,9 +123,9 @@ dev-hub:
 
 dev-agent:
 	@if command -v entr >/dev/null 2>&1; then \
-		find ./internal/cmd/agent/*.go ./agent/*.go | entr -r go run github.com/henrygd/beszel/internal/cmd/agent; \
+		find ./internal/cmd/agent/*.go ./agent/*.go | entr -r go run $(AGENT_GO_TAGS) github.com/henrygd/beszel/internal/cmd/agent; \
 	else \
-		go run github.com/henrygd/beszel/internal/cmd/agent; \
+		go run $(AGENT_GO_TAGS) github.com/henrygd/beszel/internal/cmd/agent; \
 	fi
 	
 build-dotnet:

agent/agent.go

@@ -5,19 +5,17 @@
 package agent
 
 import (
-	"crypto/sha256"
-	"encoding/hex"
 	"log/slog"
 	"os"
-	"path/filepath"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/gliderlabs/ssh"
 	"github.com/henrygd/beszel"
+	"github.com/henrygd/beszel/agent/deltatracker"
+	"github.com/henrygd/beszel/internal/common"
 	"github.com/henrygd/beszel/internal/entities/system"
-	"github.com/shirou/gopsutil/v4/host"
 	gossh "golang.org/x/crypto/ssh"
 )
 
@@ -28,17 +26,25 @@ type Agent struct {
 	memCalc                   string                                                // Memory calculation formula
 	fsNames                   []string                                              // List of filesystem device names being monitored
 	fsStats                   map[string]*system.FsStats                            // Keeps track of disk stats for each filesystem
+	diskPrev                  map[uint16]map[string]prevDisk                        // Previous disk I/O counters per cache interval
+	diskUsageCacheDuration    time.Duration                                         // How long to cache disk usage (to avoid waking sleeping disks)
+	lastDiskUsageUpdate       time.Time                                             // Last time disk usage was collected
 	netInterfaces             map[string]struct{}                                   // Stores all valid network interfaces
-	netIoStats        system.NetIoStats          // Keeps track of bandwidth usage
+	netIoStats                map[uint16]system.NetIoStats                          // Keeps track of bandwidth usage per cache interval
+	netInterfaceDeltaTrackers map[uint16]*deltatracker.DeltaTracker[string, uint64] // Per-cache-time NIC delta trackers
 	dockerManager             *dockerManager                                        // Manages Docker API requests
 	sensorConfig              *SensorConfig                                         // Sensors config
-	systemInfo        system.Info                // Host system info
+	systemInfo                system.Info                                           // Host system info (dynamic)
+	systemDetails             system.Details                                        // Host system details (static, once-per-connection)
 	gpuManager                *GPUManager                                           // Manages GPU data
-	cache             *SessionCache              // Cache for system stats based on primary session ID
+	cache                     *systemDataCache                                      // Cache for system stats based on cache time
 	connectionManager         *ConnectionManager                                    // Channel to signal connection events
+	handlerRegistry           *HandlerRegistry                                      // Registry for routing incoming messages
 	server                    *ssh.Server                                           // SSH server
 	dataDir                   string                                                // Directory for persisting data
 	keys                      []gossh.PublicKey                                     // SSH public keys
+	smartManager              *SmartManager                                         // Manages SMART data
+	systemdManager            *systemdManager                                       // Manages systemd services
 }
 
 // NewAgent creates a new agent with the given data directory for persisting data.
@@ -46,10 +52,16 @@ type Agent struct {
 func NewAgent(dataDir ...string) (agent *Agent, err error) {
 	agent = &Agent{
 		fsStats: make(map[string]*system.FsStats),
-		cache:   NewSessionCache(69 * time.Second),
+		cache:   NewSystemDataCache(),
 	}
 
-	agent.dataDir, err = getDataDir(dataDir...)
+	// Initialize disk I/O previous counters storage
+	agent.diskPrev = make(map[uint16]map[string]prevDisk)
+	// Initialize per-cache-time network tracking structures
+	agent.netIoStats = make(map[uint16]system.NetIoStats)
+	agent.netInterfaceDeltaTrackers = make(map[uint16]*deltatracker.DeltaTracker[string, uint64])
+
+	agent.dataDir, err = GetDataDir(dataDir...)
 	if err != nil {
 		slog.Warn("Data directory not found")
 	} else {
@@ -58,6 +70,17 @@ func NewAgent(dataDir ...string) (agent *Agent, err error) {
 
 	agent.memCalc, _ = GetEnv("MEM_CALC")
 	agent.sensorConfig = agent.newSensorConfig()
+
+	// Parse disk usage cache duration (e.g., "15m", "1h") to avoid waking sleeping disks
+	if diskUsageCache, exists := GetEnv("DISK_USAGE_CACHE"); exists {
+		if duration, err := time.ParseDuration(diskUsageCache); err == nil {
+			agent.diskUsageCacheDuration = duration
+			slog.Info("DISK_USAGE_CACHE", "duration", duration)
+		} else {
+			slog.Warn("Invalid DISK_USAGE_CACHE", "err", err)
+		}
+	}
+
 	// Set up slog with a log level determined by the LOG_LEVEL env var
 	if logLevelStr, exists := GetEnv("LOG_LEVEL"); exists {
 		switch strings.ToLower(logLevelStr) {
@@ -73,31 +96,53 @@ func NewAgent(dataDir ...string) (agent *Agent, err error) {
 
 	slog.Debug(beszel.Version)
 
+	// initialize docker manager
+	agent.dockerManager = newDockerManager()
+
 	// initialize system info
-	agent.initializeSystemInfo()
+	agent.refreshSystemDetails()
+
+	// SMART_INTERVAL env var to update smart data at this interval
+	if smartIntervalEnv, exists := GetEnv("SMART_INTERVAL"); exists {
+		if duration, err := time.ParseDuration(smartIntervalEnv); err == nil && duration > 0 {
+			agent.systemDetails.SmartInterval = duration
+			slog.Info("SMART_INTERVAL", "duration", duration)
+		} else {
+			slog.Warn("Invalid SMART_INTERVAL", "err", err)
+		}
+	}
 
 	// initialize connection manager
 	agent.connectionManager = newConnectionManager(agent)
 
+	// initialize handler registry
+	agent.handlerRegistry = NewHandlerRegistry()
+
 	// initialize disk info
 	agent.initializeDiskInfo()
 
 	// initialize net io stats
 	agent.initializeNetIoStats()
 
-	// initialize docker manager
+	agent.systemdManager, err = newSystemdManager()
-	agent.dockerManager = newDockerManager(agent)
+	if err != nil {
+		slog.Debug("Systemd", "err", err)
+	}
+
+	agent.smartManager, err = NewSmartManager()
+	if err != nil {
+		slog.Debug("SMART", "err", err)
+	}
 
 	// initialize GPU manager
-	if gm, err := NewGPUManager(); err != nil {
+	agent.gpuManager, err = NewGPUManager()
+	if err != nil {
 		slog.Debug("GPU", "err", err)
-	} else {
-		agent.gpuManager = gm
 	}
 
 	// if debugging, print stats
 	if agent.debug {
-		slog.Debug("Stats", "data", agent.gatherStats(""))
+		slog.Debug("Stats", "data", agent.gatherStats(common.DataRequestOptions{CacheTimeMs: 60_000, IncludeDetails: true}))
 	}
 
 	return agent, nil
@@ -112,24 +157,31 @@ func GetEnv(key string) (value string, exists bool) {
 	return os.LookupEnv(key)
 }
 
-func (a *Agent) gatherStats(sessionID string) *system.CombinedData {
+func (a *Agent) gatherStats(options common.DataRequestOptions) *system.CombinedData {
 	a.Lock()
 	defer a.Unlock()
 
-	data, isCached := a.cache.Get(sessionID)
+	cacheTimeMs := options.CacheTimeMs
+	data, isCached := a.cache.Get(cacheTimeMs)
 	if isCached {
-		slog.Debug("Cached data", "session", sessionID)
+		slog.Debug("Cached data", "cacheTimeMs", cacheTimeMs)
 		return data
 	}
 
 	*data = system.CombinedData{
-		Stats: a.getSystemStats(),
+		Stats: a.getSystemStats(cacheTimeMs),
 		Info:  a.systemInfo,
 	}
-	slog.Debug("System data", "data", data)
+
+	// Include static system details only when requested
+	if options.IncludeDetails {
+		data.Details = &a.systemDetails
+	}
+
+	// slog.Info("System data", "data", data, "cacheTimeMs", cacheTimeMs)
 
 	if a.dockerManager != nil {
-		if containerStats, err := a.dockerManager.getDockerStats(); err == nil {
+		if containerStats, err := a.dockerManager.getDockerStats(cacheTimeMs); err == nil {
 			data.Containers = containerStats
 			slog.Debug("Containers", "data", data.Containers)
 		} else {
@@ -137,49 +189,47 @@ func (a *Agent) gatherStats(sessionID string) *system.CombinedData {
 		}
 	}
 
+	// skip updating systemd services if cache time is not the default 60sec interval
+	if a.systemdManager != nil && cacheTimeMs == 60_000 {
+		totalCount := uint16(a.systemdManager.getServiceStatsCount())
+		if totalCount > 0 {
+			numFailed := a.systemdManager.getFailedServiceCount()
+			data.Info.Services = []uint16{totalCount, numFailed}
+		}
+		if a.systemdManager.hasFreshStats {
+			data.SystemdServices = a.systemdManager.getServiceStats(nil, false)
+		}
+	}
+
 	data.Stats.ExtraFs = make(map[string]*system.FsStats)
+	data.Info.ExtraFsPct = make(map[string]float64)
 	for name, stats := range a.fsStats {
 		if !stats.Root && stats.DiskTotal > 0 {
-			data.Stats.ExtraFs[name] = stats
+			// Use custom name if available, otherwise use device name
+			key := name
+			if stats.Name != "" {
+				key = stats.Name
+			}
+			data.Stats.ExtraFs[key] = stats
+			// Add percentages to Info struct for dashboard
+			if stats.DiskTotal > 0 {
+				pct := twoDecimals((stats.DiskUsed / stats.DiskTotal) * 100)
+				data.Info.ExtraFsPct[key] = pct
+			}
 		}
 	}
 	slog.Debug("Extra FS", "data", data.Stats.ExtraFs)
 
-	a.cache.Set(sessionID, data)
+	a.cache.Set(data, cacheTimeMs)
 	return data
 }
 
-// StartAgent initializes and starts the agent with optional WebSocket connection
+// Start initializes and starts the agent with optional WebSocket connection
 func (a *Agent) Start(serverOptions ServerOptions) error {
 	a.keys = serverOptions.Keys
 	return a.connectionManager.Start(serverOptions)
 }
 
 func (a *Agent) getFingerprint() string {
-	// first look for a fingerprint in the data directory
+	return GetFingerprint(a.dataDir, a.systemDetails.Hostname, a.systemDetails.CpuModel)
-	if a.dataDir != "" {
-		if fp, err := os.ReadFile(filepath.Join(a.dataDir, "fingerprint")); err == nil {
-			return string(fp)
-		}
-	}
-
-	// if no fingerprint is found, generate one
-	fingerprint, err := host.HostID()
-	if err != nil || fingerprint == "" {
-		fingerprint = a.systemInfo.Hostname + a.systemInfo.CpuModel
-	}
-
-	// hash fingerprint
-	sum := sha256.Sum256([]byte(fingerprint))
-	fingerprint = hex.EncodeToString(sum[:24])
-
-	// save fingerprint to data directory
-	if a.dataDir != "" {
-		err = os.WriteFile(filepath.Join(a.dataDir, "fingerprint"), []byte(fingerprint), 0644)
-		if err != nil {
-			slog.Warn("Failed to save fingerprint", "err", err)
-		}
-	}
-
-	return fingerprint
 }

agent/agent_cache.go

@@ -1,37 +1,55 @@
 package agent
 
 import (
+	"sync"
 	"time"
 
 	"github.com/henrygd/beszel/internal/entities/system"
 )
 
-// Not thread safe since we only access from gatherStats which is already locked
+type systemDataCache struct {
-type SessionCache struct {
+	sync.RWMutex
+	cache map[uint16]*cacheNode
+}
+
+type cacheNode struct {
 	data       *system.CombinedData
 	lastUpdate time.Time
-	primarySession string
-	leaseTime      time.Duration
 }
 
-func NewSessionCache(leaseTime time.Duration) *SessionCache {
+// NewSystemDataCache creates a cache keyed by the polling interval in milliseconds.
-	return &SessionCache{
+func NewSystemDataCache() *systemDataCache {
-		leaseTime: leaseTime,
+	return &systemDataCache{
-		data:      &system.CombinedData{},
+		cache: make(map[uint16]*cacheNode),
 	}
 }
 
-func (c *SessionCache) Get(sessionID string) (stats *system.CombinedData, isCached bool) {
+// Get returns cached combined data when the entry is still considered fresh.
-	if sessionID != c.primarySession && time.Since(c.lastUpdate) < c.leaseTime {
+func (c *systemDataCache) Get(cacheTimeMs uint16) (stats *system.CombinedData, isCached bool) {
-		return c.data, true
+	c.RLock()
+	defer c.RUnlock()
+
+	node, ok := c.cache[cacheTimeMs]
+	if !ok {
+		return &system.CombinedData{}, false
 	}
-	return c.data, false
+	// allowedSkew := time.Second
+	// isFresh := time.Since(node.lastUpdate) < time.Duration(cacheTimeMs)*time.Millisecond-allowedSkew
+	// allow a 50% skew of the cache time
+	isFresh := time.Since(node.lastUpdate) < time.Duration(cacheTimeMs/2)*time.Millisecond
+	return node.data, isFresh
 }
 
-func (c *SessionCache) Set(sessionID string, data *system.CombinedData) {
+// Set stores the latest combined data snapshot for the given interval.
-	if data != nil {
+func (c *systemDataCache) Set(data *system.CombinedData, cacheTimeMs uint16) {
-		*c.data = *data
+	c.Lock()
+	defer c.Unlock()
+
+	node, ok := c.cache[cacheTimeMs]
+	if !ok {
+		node = &cacheNode{}
+		c.cache[cacheTimeMs] = node
 	}
-	c.primarySession = sessionID
+	node.data = data
-	c.lastUpdate = time.Now()
+	node.lastUpdate = time.Now()
 }

agent/agent_cache_test.go

@@ -1,5 +1,4 @@
 //go:build testing
-// +build testing
 
 package agent
 
@@ -8,82 +7,239 @@ import (
 	"testing/synctest"
 	"time"
 
+	"github.com/henrygd/beszel/internal/entities/container"
 	"github.com/henrygd/beszel/internal/entities/system"
-
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
-func TestSessionCache_GetSet(t *testing.T) {
+func createTestCacheData() *system.CombinedData {
-	synctest.Test(t, func(t *testing.T) {
+	return &system.CombinedData{
-		cache := NewSessionCache(69 * time.Second)
-
-		testData := &system.CombinedData{
-			Info: system.Info{
-				Hostname: "test-host",
-				Cores:    4,
-			},
 		Stats: system.Stats{
-				Cpu:     50.0,
+			Cpu:       50.5,
-				MemPct:  30.0,
+			Mem:       8192,
-				DiskPct: 40.0,
+			DiskTotal: 100000,
+		},
+		Info: system.Info{
+			AgentVersion: "0.12.0",
+		},
+		Containers: []*container.Stats{
+			{
+				Name: "test-container",
+				Cpu:  25.0,
+			},
+		},
+	}
+}
+
+func TestNewSystemDataCache(t *testing.T) {
+	cache := NewSystemDataCache()
+	require.NotNil(t, cache)
+	assert.NotNil(t, cache.cache)
+	assert.Empty(t, cache.cache)
+}
+
+func TestCacheGetSet(t *testing.T) {
+	cache := NewSystemDataCache()
+	data := createTestCacheData()
+
+	// Test setting data
+	cache.Set(data, 1000) // 1 second cache
+
+	// Test getting fresh data
+	retrieved, isCached := cache.Get(1000)
+	assert.True(t, isCached)
+	assert.Equal(t, data, retrieved)
+
+	// Test getting non-existent cache key
+	_, isCached = cache.Get(2000)
+	assert.False(t, isCached)
+}
+
+func TestCacheFreshness(t *testing.T) {
+	cache := NewSystemDataCache()
+	data := createTestCacheData()
+
+	testCases := []struct {
+		name        string
+		cacheTimeMs uint16
+		sleepMs     time.Duration
+		expectFresh bool
+	}{
+		{
+			name:        "fresh data - well within cache time",
+			cacheTimeMs: 1000, // 1 second
+			sleepMs:     100,  // 100ms
+			expectFresh: true,
+		},
+		{
+			name:        "fresh data - at 50% of cache time boundary",
+			cacheTimeMs: 1000, // 1 second, 50% = 500ms
+			sleepMs:     499,  // just under 500ms
+			expectFresh: true,
+		},
+		{
+			name:        "stale data - exactly at 50% cache time",
+			cacheTimeMs: 1000, // 1 second, 50% = 500ms
+			sleepMs:     500,  // exactly 500ms
+			expectFresh: false,
+		},
+		{
+			name:        "stale data - well beyond cache time",
+			cacheTimeMs: 1000, // 1 second
+			sleepMs:     800,  // 800ms
+			expectFresh: false,
+		},
+		{
+			name:        "short cache time",
+			cacheTimeMs: 200, // 200ms, 50% = 100ms
+			sleepMs:     150, // 150ms > 100ms
+			expectFresh: false,
 		},
 	}
 
-		// Test initial state - should not be cached
+	for _, tc := range testCases {
-		data, isCached := cache.Get("session1")
+		t.Run(tc.name, func(t *testing.T) {
-		assert.False(t, isCached, "Expected no cached data initially")
+			synctest.Test(t, func(t *testing.T) {
-		assert.NotNil(t, data, "Expected data to be initialized")
+				// Set data
-		// Set data for session1
+				cache.Set(data, tc.cacheTimeMs)
-		cache.Set("session1", testData)
 
-		time.Sleep(15 * time.Second)
+				// Wait for the specified duration
+				if tc.sleepMs > 0 {
+					time.Sleep(tc.sleepMs * time.Millisecond)
+				}
 
-		// Get data for a different session - should be cached
+				// Check freshness
-		data, isCached = cache.Get("session2")
+				_, isCached := cache.Get(tc.cacheTimeMs)
-		assert.True(t, isCached, "Expected data to be cached for non-primary session")
+				assert.Equal(t, tc.expectFresh, isCached)
-		require.NotNil(t, data, "Expected cached data to be returned")
+			})
-		assert.Equal(t, "test-host", data.Info.Hostname, "Hostname should match test data")
+		})
-		assert.Equal(t, 4, data.Info.Cores, "Cores should match test data")
+	}
-		assert.Equal(t, 50.0, data.Stats.Cpu, "CPU should match test data")
+}
-		assert.Equal(t, 30.0, data.Stats.MemPct, "Memory percentage should match test data")
-		assert.Equal(t, 40.0, data.Stats.DiskPct, "Disk percentage should match test data")
 
-		time.Sleep(10 * time.Second)
+func TestCacheMultipleIntervals(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		cache := NewSystemDataCache()
+		data1 := createTestCacheData()
+		data2 := &system.CombinedData{
+			Stats: system.Stats{
+				Cpu: 75.0,
+				Mem: 16384,
+			},
+			Info: system.Info{
+				AgentVersion: "0.12.0",
+			},
+			Containers: []*container.Stats{},
+		}
 
-		// Get data for the primary session - should not be cached
+		// Set data for different intervals
-		data, isCached = cache.Get("session1")
+		cache.Set(data1, 500)  // 500ms cache
-		assert.False(t, isCached, "Expected data not to be cached for primary session")
+		cache.Set(data2, 1000) // 1000ms cache
-		require.NotNil(t, data, "Expected data to be returned even if not cached")
-		assert.Equal(t, "test-host", data.Info.Hostname, "Hostname should match test data")
-		// if not cached, agent will update the data
-		cache.Set("session1", testData)
 
-		time.Sleep(45 * time.Second)
+		// Both should be fresh immediately
+		retrieved1, isCached1 := cache.Get(500)
+		assert.True(t, isCached1)
+		assert.Equal(t, data1, retrieved1)
 
-		// Get data for a different session - should still be cached
+		retrieved2, isCached2 := cache.Get(1000)
-		_, isCached = cache.Get("session2")
+		assert.True(t, isCached2)
-		assert.True(t, isCached, "Expected data to be cached for non-primary session")
+		assert.Equal(t, data2, retrieved2)
 
-		// Wait for the lease to expire
+		// Wait 300ms - 500ms cache should be stale (250ms threshold), 1000ms should still be fresh (500ms threshold)
-		time.Sleep(30 * time.Second)
+		time.Sleep(300 * time.Millisecond)
 
-		// Get data for session2 - should not be cached
+		_, isCached1 = cache.Get(500)
-		_, isCached = cache.Get("session2")
+		assert.False(t, isCached1)
-		assert.False(t, isCached, "Expected data not to be cached after lease expiration")
+
+		_, isCached2 = cache.Get(1000)
+		assert.True(t, isCached2)
+
+		// Wait another 300ms (total 600ms) - now 1000ms cache should also be stale
+		time.Sleep(300 * time.Millisecond)
+		_, isCached2 = cache.Get(1000)
+		assert.False(t, isCached2)
 	})
 }
 
-func TestSessionCache_NilData(t *testing.T) {
+func TestCacheOverwrite(t *testing.T) {
-	// Create a new SessionCache
+	cache := NewSystemDataCache()
-	cache := NewSessionCache(30 * time.Second)
+	data1 := createTestCacheData()
+	data2 := &system.CombinedData{
+		Stats: system.Stats{
+			Cpu: 90.0,
+			Mem: 32768,
+		},
+		Info: system.Info{
+			AgentVersion: "0.12.0",
+		},
+		Containers: []*container.Stats{},
+	}
 
-	// Test setting nil data (should not panic)
+	// Set initial data
-	assert.NotPanics(t, func() {
+	cache.Set(data1, 1000)
-		cache.Set("session1", nil)
+	retrieved, isCached := cache.Get(1000)
-	}, "Setting nil data should not panic")
+	assert.True(t, isCached)
+	assert.Equal(t, data1, retrieved)
 
-	// Get data - should not be nil even though we set nil
+	// Overwrite with new data
-	data, _ := cache.Get("session2")
+	cache.Set(data2, 1000)
-	assert.NotNil(t, data, "Expected data to not be nil after setting nil data")
+	retrieved, isCached = cache.Get(1000)
+	assert.True(t, isCached)
+	assert.Equal(t, data2, retrieved)
+	assert.NotEqual(t, data1, retrieved)
+}
+
+func TestCacheMiss(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		cache := NewSystemDataCache()
+
+		// Test getting from empty cache
+		_, isCached := cache.Get(1000)
+		assert.False(t, isCached)
+
+		// Set data for one interval
+		data := createTestCacheData()
+		cache.Set(data, 1000)
+
+		// Test getting different interval
+		_, isCached = cache.Get(2000)
+		assert.False(t, isCached)
+
+		// Test getting after data has expired
+		time.Sleep(600 * time.Millisecond) // 600ms > 500ms (50% of 1000ms)
+		_, isCached = cache.Get(1000)
+		assert.False(t, isCached)
+	})
+}
+
+func TestCacheZeroInterval(t *testing.T) {
+	cache := NewSystemDataCache()
+	data := createTestCacheData()
+
+	// Set with zero interval - should allow immediate cache
+	cache.Set(data, 0)
+
+	// With 0 interval, 50% is 0, so it should never be considered fresh
+	// (time.Since(lastUpdate) >= 0, which is not < 0)
+	_, isCached := cache.Get(0)
+	assert.False(t, isCached)
+}
+
+func TestCacheLargeInterval(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		cache := NewSystemDataCache()
+		data := createTestCacheData()
+
+		// Test with maximum uint16 value
+		cache.Set(data, 65535) // ~65 seconds
+
+		// Should be fresh immediately
+		_, isCached := cache.Get(65535)
+		assert.True(t, isCached)
+
+		// Should still be fresh after a short time
+		time.Sleep(100 * time.Millisecond)
+		_, isCached = cache.Get(65535)
+		assert.True(t, isCached)
+	})
 }

agent/agent_test_helpers.go

@@ -1,5 +1,4 @@
 //go:build testing
-// +build testing
 
 package agent
 

agent/battery/battery.go

@@ -6,12 +6,15 @@ package battery
 import (
 	"errors"
 	"log/slog"
+	"math"
 
 	"github.com/distatus/battery"
 )
 
-var systemHasBattery = false
+var (
-var haveCheckedBattery = false
+	systemHasBattery   = false
+	haveCheckedBattery = false
+)
 
 // HasReadableBattery checks if the system has a battery and returns true if it does.
 func HasReadableBattery() bool {
@@ -19,8 +22,13 @@ func HasReadableBattery() bool {
 		return systemHasBattery
 	}
 	haveCheckedBattery = true
-	bat, err := battery.Get(0)
+	batteries, err := battery.GetAll()
-	systemHasBattery = err == nil && bat != nil && bat.Design != 0 && bat.Full != 0
+	for _, bat := range batteries {
+		if bat != nil && (bat.Full > 0 || bat.Design > 0) {
+			systemHasBattery = true
+			break
+		}
+	}
 	if !systemHasBattery {
 		slog.Debug("No battery found", "err", err)
 	}
@@ -28,25 +36,49 @@ func HasReadableBattery() bool {
 }
 
 // GetBatteryStats returns the current battery percent and charge state
+// percent = (current charge of all batteries) / (sum of designed/full capacity of all batteries)
 func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
-	if !systemHasBattery {
+	if !HasReadableBattery() {
 		return batteryPercent, batteryState, errors.ErrUnsupported
 	}
 	batteries, err := battery.GetAll()
-	if err != nil || len(batteries) == 0 {
+	// we'll handle errors later by skipping batteries with errors, rather
-		return batteryPercent, batteryState, err
+	// than skipping everything because of the presence of some errors.
+	if len(batteries) == 0 {
+		return batteryPercent, batteryState, errors.New("no batteries")
 	}
+
 	totalCapacity := float64(0)
 	totalCharge := float64(0)
-	for _, bat := range batteries {
+	errs, partialErrs := err.(battery.Errors)
-		if bat.Design != 0 {
+
-			totalCapacity += bat.Design
+	batteryState = math.MaxUint8
-		} else {
+
+	for i, bat := range batteries {
+		if partialErrs && errs[i] != nil {
+			// if there were some errors, like missing data, skip it
+			continue
+		}
+		if bat == nil || bat.Full == 0 {
+			// skip batteries with no capacity. Charge is unlikely to ever be zero, but
+			// we can't guarantee that, so don't skip based on charge.
+			continue
+		}
 		totalCapacity += bat.Full
+		totalCharge += min(bat.Current, bat.Full)
+		if bat.State.Raw >= 0 {
+			batteryState = uint8(bat.State.Raw)
 		}
-		totalCharge += bat.Current
 	}
+
+	if totalCapacity == 0 || batteryState == math.MaxUint8 {
+		// for macs there's sometimes a ghost battery with 0 capacity
+		// https://github.com/distatus/battery/issues/34
+		// Instead of skipping over those batteries, we'll check for total 0 capacity
+		// and return an error. This also prevents a divide by zero.
+		return batteryPercent, batteryState, errors.New("no battery capacity")
+	}
+
 	batteryPercent = uint8(totalCharge / totalCapacity * 100)
-	batteryState = uint8(batteries[0].State.Raw)
 	return batteryPercent, batteryState, nil
 }

agent/client.go

@@ -142,7 +142,9 @@ func (client *WebSocketClient) OnOpen(conn *gws.Conn) {
 // OnClose handles WebSocket connection closure.
 // It logs the closure reason and notifies the connection manager.
 func (client *WebSocketClient) OnClose(conn *gws.Conn, err error) {
+	if err != nil {
 		slog.Warn("Connection closed", "err", strings.TrimPrefix(err.Error(), "gws: "))
+	}
 	client.agent.connectionManager.eventChan <- WebSocketDisconnect
 }
 
@@ -156,11 +158,15 @@ func (client *WebSocketClient) OnMessage(conn *gws.Conn, message *gws.Message) {
 		return
 	}
 
-	if err := cbor.NewDecoder(message.Data).Decode(client.hubRequest); err != nil {
+	var HubRequest common.HubRequest[cbor.RawMessage]
+
+	err := cbor.Unmarshal(message.Data.Bytes(), &HubRequest)
+	if err != nil {
 		slog.Error("Error parsing message", "err", err)
 		return
 	}
-	if err := client.handleHubRequest(client.hubRequest); err != nil {
+
+	if err := client.handleHubRequest(&HubRequest, HubRequest.Id); err != nil {
 		slog.Error("Error handling message", "err", err)
 	}
 }
@@ -173,7 +179,7 @@ func (client *WebSocketClient) OnPing(conn *gws.Conn, message []byte) {
 }
 
 // handleAuthChallenge verifies the authenticity of the hub and returns the system's fingerprint.
-func (client *WebSocketClient) handleAuthChallenge(msg *common.HubRequest[cbor.RawMessage]) (err error) {
+func (client *WebSocketClient) handleAuthChallenge(msg *common.HubRequest[cbor.RawMessage], requestID *uint32) (err error) {
 	var authRequest common.FingerprintRequest
 	if err := cbor.Unmarshal(msg.Data, &authRequest); err != nil {
 		return err
@@ -191,12 +197,13 @@ func (client *WebSocketClient) handleAuthChallenge(msg *common.HubRequest[cbor.R
 	}
 
 	if authRequest.NeedSysInfo {
-		response.Hostname = client.agent.systemInfo.Hostname
+		response.Name, _ = GetEnv("SYSTEM_NAME")
+		response.Hostname = client.agent.systemDetails.Hostname
 		serverAddr := client.agent.connectionManager.serverOptions.Addr
 		_, response.Port, _ = net.SplitHostPort(serverAddr)
 	}
 
-	return client.sendMessage(response)
+	return client.sendResponse(response, requestID)
 }
 
 // verifySignature verifies the signature of the token using the public keys.
@@ -221,25 +228,17 @@ func (client *WebSocketClient) Close() {
 	}
 }
 
-// handleHubRequest routes the request to the appropriate handler.
+// handleHubRequest routes the request to the appropriate handler using the handler registry.
-// It ensures the hub is verified before processing most requests.
+func (client *WebSocketClient) handleHubRequest(msg *common.HubRequest[cbor.RawMessage], requestID *uint32) error {
-func (client *WebSocketClient) handleHubRequest(msg *common.HubRequest[cbor.RawMessage]) error {
+	ctx := &HandlerContext{
-	if !client.hubVerified && msg.Action != common.CheckFingerprint {
+		Client:       client,
-		return errors.New("hub not verified")
+		Agent:        client.agent,
+		Request:      msg,
+		RequestID:    requestID,
+		HubVerified:  client.hubVerified,
+		SendResponse: client.sendResponse,
 	}
-	switch msg.Action {
+	return client.agent.handlerRegistry.Handle(ctx)
-	case common.GetData:
-		return client.sendSystemData()
-	case common.CheckFingerprint:
-		return client.handleAuthChallenge(msg)
-	}
-	return nil
-}
-
-// sendSystemData gathers and sends current system statistics to the hub.
-func (client *WebSocketClient) sendSystemData() error {
-	sysStats := client.agent.gatherStats(client.token)
-	return client.sendMessage(sysStats)
 }
 
 // sendMessage encodes the given data to CBOR and sends it as a binary message over the WebSocket connection to the hub.
@@ -248,7 +247,25 @@ func (client *WebSocketClient) sendMessage(data any) error {
 	if err != nil {
 		return err
 	}
-	return client.Conn.WriteMessage(gws.OpcodeBinary, bytes)
+	err = client.Conn.WriteMessage(gws.OpcodeBinary, bytes)
+	if err != nil {
+		// If writing fails (e.g., broken pipe due to network issues),
+		// close the connection to trigger reconnection logic (#1263)
+		client.Close()
+	}
+	return err
+}
+
+// sendResponse sends a response with optional request ID.
+// For ID-based requests, we must populate legacy typed fields for backward
+// compatibility with older hubs (<= 0.17) that don't read the generic Data field.
+func (client *WebSocketClient) sendResponse(data any, requestID *uint32) error {
+	if requestID != nil {
+		response := newAgentResponse(data, requestID)
+		return client.sendMessage(response)
+	}
+	// Legacy format - send data directly
+	return client.sendMessage(data)
 }
 
 // getUserAgent returns one of two User-Agent strings based on current time.

agent/client_test.go

@@ -1,5 +1,4 @@
 //go:build testing
-// +build testing
 
 package agent
 
@@ -301,7 +300,7 @@ func TestWebSocketClient_HandleHubRequest(t *testing.T) {
 				Data:   cbor.RawMessage{},
 			}
 
-			err := client.handleHubRequest(hubRequest)
+			err := client.handleHubRequest(hubRequest, nil)
 
 			if tc.expectError {
 				assert.Error(t, err)

agent/connection_manager.go

@@ -1,9 +1,9 @@
 package agent
 
 import (
+	"context"
 	"errors"
 	"log/slog"
-	"os"
 	"os/signal"
 	"syscall"
 	"time"
@@ -91,8 +91,8 @@ func (c *ConnectionManager) Start(serverOptions ServerOptions) error {
 	c.eventChan = make(chan ConnectionEvent, 1)
 
 	// signal handling for shutdown
-	sigChan := make(chan os.Signal, 1)
+	sigCtx, stopSignals := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
-	signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)
+	defer stopSignals()
 
 	c.startWsTicker()
 	c.connect()
@@ -109,8 +109,8 @@ func (c *ConnectionManager) Start(serverOptions ServerOptions) error {
 			_ = c.startWebSocketConnection()
 		case <-healthTicker:
 			_ = health.Update()
-		case <-sigChan:
+		case <-sigCtx.Done():
-			slog.Info("Shutting down")
+			slog.Info("Shutting down", "cause", context.Cause(sigCtx))
 			_ = c.agent.StopServer()
 			c.closeWebSocket()
 			return health.CleanUp()

agent/connection_manager_test.go

@@ -1,5 +1,4 @@
 //go:build testing
-// +build testing
 
 package agent
 

agent/cpu.go

@@ -0,0 +1,131 @@
+package agent
+
+import (
+	"math"
+	"runtime"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/shirou/gopsutil/v4/cpu"
+)
+
+var lastCpuTimes = make(map[uint16]cpu.TimesStat)
+var lastPerCoreCpuTimes = make(map[uint16][]cpu.TimesStat)
+
+// init initializes the CPU monitoring by storing the initial CPU times
+// for the default 60-second cache interval.
+func init() {
+	if times, err := cpu.Times(false); err == nil {
+		lastCpuTimes[60000] = times[0]
+	}
+	if perCoreTimes, err := cpu.Times(true); err == nil {
+		lastPerCoreCpuTimes[60000] = perCoreTimes
+	}
+}
+
+// CpuMetrics contains detailed CPU usage breakdown
+type CpuMetrics struct {
+	Total  float64
+	User   float64
+	System float64
+	Iowait float64
+	Steal  float64
+	Idle   float64
+}
+
+// getCpuMetrics calculates detailed CPU usage metrics using cached previous measurements.
+// It returns percentages for total, user, system, iowait, and steal time.
+func getCpuMetrics(cacheTimeMs uint16) (CpuMetrics, error) {
+	times, err := cpu.Times(false)
+	if err != nil || len(times) == 0 {
+		return CpuMetrics{}, err
+	}
+	// if cacheTimeMs is not in lastCpuTimes, use 60000 as fallback lastCpuTime
+	if _, ok := lastCpuTimes[cacheTimeMs]; !ok {
+		lastCpuTimes[cacheTimeMs] = lastCpuTimes[60000]
+	}
+
+	t1 := lastCpuTimes[cacheTimeMs]
+	t2 := times[0]
+
+	t1All, _ := getAllBusy(t1)
+	t2All, _ := getAllBusy(t2)
+
+	totalDelta := t2All - t1All
+	if totalDelta <= 0 {
+		return CpuMetrics{}, nil
+	}
+
+	metrics := CpuMetrics{
+		Total:  calculateBusy(t1, t2),
+		User:   clampPercent((t2.User - t1.User) / totalDelta * 100),
+		System: clampPercent((t2.System - t1.System) / totalDelta * 100),
+		Iowait: clampPercent((t2.Iowait - t1.Iowait) / totalDelta * 100),
+		Steal:  clampPercent((t2.Steal - t1.Steal) / totalDelta * 100),
+		Idle:   clampPercent((t2.Idle - t1.Idle) / totalDelta * 100),
+	}
+
+	lastCpuTimes[cacheTimeMs] = times[0]
+	return metrics, nil
+}
+
+// clampPercent ensures the percentage is between 0 and 100
+func clampPercent(value float64) float64 {
+	return math.Min(100, math.Max(0, value))
+}
+
+// getPerCoreCpuUsage calculates per-core CPU busy usage as integer percentages (0-100).
+// It uses cached previous measurements for the provided cache interval.
+func getPerCoreCpuUsage(cacheTimeMs uint16) (system.Uint8Slice, error) {
+	perCoreTimes, err := cpu.Times(true)
+	if err != nil || len(perCoreTimes) == 0 {
+		return nil, err
+	}
+
+	// Initialize cache if needed
+	if _, ok := lastPerCoreCpuTimes[cacheTimeMs]; !ok {
+		lastPerCoreCpuTimes[cacheTimeMs] = lastPerCoreCpuTimes[60000]
+	}
+
+	lastTimes := lastPerCoreCpuTimes[cacheTimeMs]
+
+	// Limit to the number of cores available in both samples
+	length := min(len(lastTimes), len(perCoreTimes))
+
+	usage := make([]uint8, length)
+	for i := 0; i < length; i++ {
+		t1 := lastTimes[i]
+		t2 := perCoreTimes[i]
+		usage[i] = uint8(math.Round(calculateBusy(t1, t2)))
+	}
+
+	lastPerCoreCpuTimes[cacheTimeMs] = perCoreTimes
+	return usage, nil
+}
+
+// calculateBusy calculates the CPU busy percentage between two time points.
+// It computes the ratio of busy time to total time elapsed between t1 and t2,
+// returning a percentage clamped between 0 and 100.
+func calculateBusy(t1, t2 cpu.TimesStat) float64 {
+	t1All, t1Busy := getAllBusy(t1)
+	t2All, t2Busy := getAllBusy(t2)
+
+	if t2All <= t1All || t2Busy <= t1Busy {
+		return 0
+	}
+	return clampPercent((t2Busy - t1Busy) / (t2All - t1All) * 100)
+}
+
+// getAllBusy calculates the total CPU time and busy CPU time from CPU times statistics.
+// On Linux, it excludes guest and guest_nice time from the total to match kernel behavior.
+// Returns total CPU time and busy CPU time (total minus idle and I/O wait time).
+func getAllBusy(t cpu.TimesStat) (float64, float64) {
+	tot := t.Total()
+	if runtime.GOOS == "linux" {
+		tot -= t.Guest     // Linux 2.6.24+
+		tot -= t.GuestNice // Linux 3.2.0+
+	}
+
+	busy := tot - t.Idle - t.Iowait
+
+	return tot, busy
+}

agent/data_dir.go

@@ -8,10 +8,10 @@ import (
 	"runtime"
 )
 
-// getDataDir returns the path to the data directory for the agent and an error
+// GetDataDir returns the path to the data directory for the agent and an error
 // if the directory is not valid. Attempts to find the optimal data directory if
 // no data directories are provided.
-func getDataDir(dataDirs ...string) (string, error) {
+func GetDataDir(dataDirs ...string) (string, error) {
 	if len(dataDirs) > 0 {
 		return testDataDirs(dataDirs)
 	}

agent/data_dir_test.go

@@ -1,5 +1,4 @@
 //go:build testing
-// +build testing
 
 package agent
 
@@ -17,7 +16,7 @@ func TestGetDataDir(t *testing.T) {
 	// Test with explicit dataDir parameter
 	t.Run("explicit data dir", func(t *testing.T) {
 		tempDir := t.TempDir()
-		result, err := getDataDir(tempDir)
+		result, err := GetDataDir(tempDir)
 		require.NoError(t, err)
 		assert.Equal(t, tempDir, result)
 	})
@@ -26,7 +25,7 @@ func TestGetDataDir(t *testing.T) {
 	t.Run("explicit data dir - create new", func(t *testing.T) {
 		tempDir := t.TempDir()
 		newDir := filepath.Join(tempDir, "new-data-dir")
-		result, err := getDataDir(newDir)
+		result, err := GetDataDir(newDir)
 		require.NoError(t, err)
 		assert.Equal(t, newDir, result)
 
@@ -52,7 +51,7 @@ func TestGetDataDir(t *testing.T) {
 
 		os.Setenv("BESZEL_AGENT_DATA_DIR", tempDir)
 
-		result, err := getDataDir()
+		result, err := GetDataDir()
 		require.NoError(t, err)
 		assert.Equal(t, tempDir, result)
 	})
@@ -60,7 +59,7 @@ func TestGetDataDir(t *testing.T) {
 	// Test with invalid explicit dataDir
 	t.Run("invalid explicit data dir", func(t *testing.T) {
 		invalidPath := "/invalid/path/that/cannot/be/created"
-		_, err := getDataDir(invalidPath)
+		_, err := GetDataDir(invalidPath)
 		assert.Error(t, err)
 	})
 
@@ -79,7 +78,7 @@ func TestGetDataDir(t *testing.T) {
 
 		// This will try platform-specific defaults, which may or may not work
 		// We're mainly testing that it doesn't panic and returns some result
-		result, err := getDataDir()
+		result, err := GetDataDir()
 		// We don't assert success/failure here since it depends on system permissions
 		// Just verify we get a string result if no error
 		if err == nil {

agent/deltatracker/deltatracker.go

@@ -37,6 +37,16 @@ func (t *DeltaTracker[K, V]) Set(id K, value V) {
 	t.current[id] = value
 }
 
+// Snapshot returns a copy of the current map.
+// func (t *DeltaTracker[K, V]) Snapshot() map[K]V {
+// 	t.RLock()
+// 	defer t.RUnlock()
+
+// 	copyMap := make(map[K]V, len(t.current))
+// 	maps.Copy(copyMap, t.current)
+// 	return copyMap
+// }
+
 // Deltas returns a map of all calculated deltas for the current interval.
 func (t *DeltaTracker[K, V]) Deltas() map[K]V {
 	t.RLock()
@@ -53,6 +63,15 @@ func (t *DeltaTracker[K, V]) Deltas() map[K]V {
 	return deltas
 }
 
+// Previous returns the previously recorded value for the given key, if it exists.
+func (t *DeltaTracker[K, V]) Previous(id K) (V, bool) {
+	t.RLock()
+	defer t.RUnlock()
+
+	value, ok := t.previous[id]
+	return value, ok
+}
+
 // Delta returns the delta for a single key.
 // Returns 0 if the key doesn't exist or has no previous value.
 func (t *DeltaTracker[K, V]) Delta(id K) V {

agent/disk.go

@@ -13,11 +13,34 @@ import (
 	"github.com/shirou/gopsutil/v4/disk"
 )
 
+// parseFilesystemEntry parses a filesystem entry in the format "device__customname"
+// Returns the device/filesystem part and the custom name part
+func parseFilesystemEntry(entry string) (device, customName string) {
+	entry = strings.TrimSpace(entry)
+	if parts := strings.SplitN(entry, "__", 2); len(parts) == 2 {
+		device = strings.TrimSpace(parts[0])
+		customName = strings.TrimSpace(parts[1])
+	} else {
+		device = entry
+	}
+	return device, customName
+}
+
+func isDockerSpecialMountpoint(mountpoint string) bool {
+	switch mountpoint {
+	case "/etc/hosts", "/etc/resolv.conf", "/etc/hostname":
+		return true
+	default:
+		return false
+	}
+}
+
 // Sets up the filesystems to monitor for disk usage and I/O.
 func (a *Agent) initializeDiskInfo() {
 	filesystem, _ := GetEnv("FILESYSTEM")
 	efPath := "/extra-filesystems"
 	hasRoot := false
+	isWindows := runtime.GOOS == "windows"
 
 	partitions, err := disk.Partitions(false)
 	if err != nil {
@@ -25,6 +48,13 @@ func (a *Agent) initializeDiskInfo() {
 	}
 	slog.Debug("Disk", "partitions", partitions)
 
+	// trim trailing backslash for Windows devices (#1361)
+	if isWindows {
+		for i, p := range partitions {
+			partitions[i].Device = strings.TrimSuffix(p.Device, "\\")
+		}
+	}
+
 	// ioContext := context.WithValue(a.sensorsContext,
 	// 	common.EnvKey, common.EnvMap{common.HostProcEnvKey: "/tmp/testproc"},
 	// )
@@ -37,9 +67,9 @@ func (a *Agent) initializeDiskInfo() {
 	slog.Debug("Disk I/O", "diskstats", diskIoCounters)
 
 	// Helper function to add a filesystem to fsStats if it doesn't exist
-	addFsStat := func(device, mountpoint string, root bool) {
+	addFsStat := func(device, mountpoint string, root bool, customName ...string) {
 		var key string
-		if runtime.GOOS == "windows" {
+		if isWindows {
 			key = device
 		} else {
 			key = filepath.Base(device)
@@ -48,11 +78,15 @@ func (a *Agent) initializeDiskInfo() {
 		if _, exists := a.fsStats[key]; !exists {
 			if root {
 				slog.Info("Detected root device", "name", key)
-				// Check if root device is in /proc/diskstats, use fallback if not
+				// Check if root device is in /proc/diskstats. Do not guess a
+				// fallback device for root: that can misattribute root I/O to a
+				// different disk while usage remains tied to root mountpoint.
 				if _, ioMatch = diskIoCounters[key]; !ioMatch {
-					key, ioMatch = findIoDevice(filesystem, diskIoCounters, a.fsStats)
+					if matchedKey, match := findIoDevice(filesystem, diskIoCounters); match {
-					if !ioMatch {
+						key = matchedKey
-						slog.Info("Using I/O fallback", "device", device, "mountpoint", mountpoint, "fallback", key)
+						ioMatch = true
+					} else {
+						slog.Warn("Root I/O unmapped; set FILESYSTEM", "device", device, "mountpoint", mountpoint)
 					}
 				}
 			} else {
@@ -66,10 +100,17 @@ func (a *Agent) initializeDiskInfo() {
 					}
 				}
 			}
-			a.fsStats[key] = &system.FsStats{Root: root, Mountpoint: mountpoint}
+			fsStats := &system.FsStats{Root: root, Mountpoint: mountpoint}
+			if len(customName) > 0 && customName[0] != "" {
+				fsStats.Name = customName[0]
+			}
+			a.fsStats[key] = fsStats
 		}
 	}
 
+	// Get the appropriate root mount point for this system
+	rootMountPoint := a.getRootMountPoint()
+
 	// Use FILESYSTEM env var to find root filesystem
 	if filesystem != "" {
 		for _, p := range partitions {
@@ -86,11 +127,14 @@ func (a *Agent) initializeDiskInfo() {
 
 	// Add EXTRA_FILESYSTEMS env var values to fsStats
 	if extraFilesystems, exists := GetEnv("EXTRA_FILESYSTEMS"); exists {
-		for _, fs := range strings.Split(extraFilesystems, ",") {
+		for fsEntry := range strings.SplitSeq(extraFilesystems, ",") {
+			// Parse custom name from format: device__customname
+			fs, customName := parseFilesystemEntry(fsEntry)
+
 			found := false
 			for _, p := range partitions {
 				if strings.HasSuffix(p.Device, fs) || p.Mountpoint == fs {
-					addFsStat(p.Device, p.Mountpoint, false)
+					addFsStat(p.Device, p.Mountpoint, false, customName)
 					found = true
 					break
 				}
@@ -98,7 +142,7 @@ func (a *Agent) initializeDiskInfo() {
 			// if not in partitions, test if we can get disk usage
 			if !found {
 				if _, err := disk.Usage(fs); err == nil {
-					addFsStat(filepath.Base(fs), fs, false)
+					addFsStat(filepath.Base(fs), fs, false, customName)
 				} else {
 					slog.Error("Invalid filesystem", "name", fs, "err", err)
 				}
@@ -110,8 +154,8 @@ func (a *Agent) initializeDiskInfo() {
 	for _, p := range partitions {
 		// fmt.Println(p.Device, p.Mountpoint)
 		// Binary root fallback or docker root fallback
-		if !hasRoot && (p.Mountpoint == "/" || (p.Mountpoint == "/etc/hosts" && strings.HasPrefix(p.Device, "/dev"))) {
+		if !hasRoot && (p.Mountpoint == rootMountPoint || (isDockerSpecialMountpoint(p.Mountpoint) && strings.HasPrefix(p.Device, "/dev"))) {
-			fs, match := findIoDevice(filepath.Base(p.Device), diskIoCounters, a.fsStats)
+			fs, match := findIoDevice(filepath.Base(p.Device), diskIoCounters)
 			if match {
 				addFsStat(fs, p.Mountpoint, true)
 				hasRoot = true
@@ -120,7 +164,8 @@ func (a *Agent) initializeDiskInfo() {
 
 		// Check if device is in /extra-filesystems
 		if strings.HasPrefix(p.Mountpoint, efPath) {
-			addFsStat(p.Device, p.Mountpoint, false)
+			device, customName := parseFilesystemEntry(p.Mountpoint)
+			addFsStat(device, p.Mountpoint, false, customName)
 		}
 	}
 
@@ -135,7 +180,8 @@ func (a *Agent) initializeDiskInfo() {
 				mountpoint := filepath.Join(efPath, folder.Name())
 				slog.Debug("/extra-filesystems", "mountpoint", mountpoint)
 				if !existingMountpoints[mountpoint] {
-					addFsStat(folder.Name(), mountpoint, false)
+					device, customName := parseFilesystemEntry(folder.Name())
+					addFsStat(device, mountpoint, false, customName)
 				}
 			}
 		}
@@ -143,33 +189,26 @@ func (a *Agent) initializeDiskInfo() {
 
 	// If no root filesystem set, use fallback
 	if !hasRoot {
-		rootDevice, _ := findIoDevice(filepath.Base(filesystem), diskIoCounters, a.fsStats)
+		rootKey := filepath.Base(rootMountPoint)
-		slog.Info("Root disk", "mountpoint", "/", "io", rootDevice)
+		if _, exists := a.fsStats[rootKey]; exists {
-		a.fsStats[rootDevice] = &system.FsStats{Root: true, Mountpoint: "/"}
+			rootKey = "root"
+		}
+		slog.Warn("Root device not detected; root I/O disabled", "mountpoint", rootMountPoint)
+		a.fsStats[rootKey] = &system.FsStats{Root: true, Mountpoint: rootMountPoint}
 	}
 
 	a.initializeDiskIoStats(diskIoCounters)
 }
 
-// Returns matching device from /proc/diskstats,
+// Returns matching device from /proc/diskstats.
-// or the device with the most reads if no match is found.
 // bool is true if a match was found.
-func findIoDevice(filesystem string, diskIoCounters map[string]disk.IOCountersStat, fsStats map[string]*system.FsStats) (string, bool) {
+func findIoDevice(filesystem string, diskIoCounters map[string]disk.IOCountersStat) (string, bool) {
-	var maxReadBytes uint64
-	maxReadDevice := "/"
 	for _, d := range diskIoCounters {
 		if d.Name == filesystem || (d.Label != "" && d.Label == filesystem) {
 			return d.Name, true
 		}
-		if d.ReadBytes > maxReadBytes {
-			// don't use if device already exists in fsStats
-			if _, exists := fsStats[d.Name]; !exists {
-				maxReadBytes = d.ReadBytes
-				maxReadDevice = d.Name
 	}
-		}
+	return "", false
-	}
-	return maxReadDevice, false
 }
 
 // Sets start values for disk I/O stats.
@@ -189,3 +228,141 @@ func (a *Agent) initializeDiskIoStats(diskIoCounters map[string]disk.IOCountersS
 		a.fsNames = append(a.fsNames, device)
 	}
 }
+
+// Updates disk usage statistics for all monitored filesystems
+func (a *Agent) updateDiskUsage(systemStats *system.Stats) {
+	// Check if we should skip extra filesystem collection to avoid waking sleeping disks.
+	// Root filesystem is always updated since it can't be sleeping while the agent runs.
+	// Always collect on first call (lastDiskUsageUpdate is zero) or if caching is disabled.
+	cacheExtraFs := a.diskUsageCacheDuration > 0 &&
+		!a.lastDiskUsageUpdate.IsZero() &&
+		time.Since(a.lastDiskUsageUpdate) < a.diskUsageCacheDuration
+
+	// disk usage
+	for _, stats := range a.fsStats {
+		// Skip non-root filesystems if caching is active
+		if cacheExtraFs && !stats.Root {
+			continue
+		}
+		if d, err := disk.Usage(stats.Mountpoint); err == nil {
+			stats.DiskTotal = bytesToGigabytes(d.Total)
+			stats.DiskUsed = bytesToGigabytes(d.Used)
+			if stats.Root {
+				systemStats.DiskTotal = bytesToGigabytes(d.Total)
+				systemStats.DiskUsed = bytesToGigabytes(d.Used)
+				systemStats.DiskPct = twoDecimals(d.UsedPercent)
+			}
+		} else {
+			// reset stats if error (likely unmounted)
+			slog.Error("Error getting disk stats", "name", stats.Mountpoint, "err", err)
+			stats.DiskTotal = 0
+			stats.DiskUsed = 0
+			stats.TotalRead = 0
+			stats.TotalWrite = 0
+		}
+	}
+
+	// Update the last disk usage update time when we've collected extra filesystems
+	if !cacheExtraFs {
+		a.lastDiskUsageUpdate = time.Now()
+	}
+}
+
+// Updates disk I/O statistics for all monitored filesystems
+func (a *Agent) updateDiskIo(cacheTimeMs uint16, systemStats *system.Stats) {
+	// disk i/o (cache-aware per interval)
+	if ioCounters, err := disk.IOCounters(a.fsNames...); err == nil {
+		// Ensure map for this interval exists
+		if _, ok := a.diskPrev[cacheTimeMs]; !ok {
+			a.diskPrev[cacheTimeMs] = make(map[string]prevDisk)
+		}
+		now := time.Now()
+		for name, d := range ioCounters {
+			stats := a.fsStats[d.Name]
+			if stats == nil {
+				// skip devices not tracked
+				continue
+			}
+
+			// Previous snapshot for this interval and device
+			prev, hasPrev := a.diskPrev[cacheTimeMs][name]
+			if !hasPrev {
+				// Seed from agent-level fsStats if present, else seed from current
+				prev = prevDisk{readBytes: stats.TotalRead, writeBytes: stats.TotalWrite, at: stats.Time}
+				if prev.at.IsZero() {
+					prev = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
+				}
+			}
+
+			msElapsed := uint64(now.Sub(prev.at).Milliseconds())
+			if msElapsed < 100 {
+				// Avoid division by zero or clock issues; update snapshot and continue
+				a.diskPrev[cacheTimeMs][name] = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
+				continue
+			}
+
+			diskIORead := (d.ReadBytes - prev.readBytes) * 1000 / msElapsed
+			diskIOWrite := (d.WriteBytes - prev.writeBytes) * 1000 / msElapsed
+			readMbPerSecond := bytesToMegabytes(float64(diskIORead))
+			writeMbPerSecond := bytesToMegabytes(float64(diskIOWrite))
+
+			// validate values
+			if readMbPerSecond > 50_000 || writeMbPerSecond > 50_000 {
+				slog.Warn("Invalid disk I/O. Resetting.", "name", d.Name, "read", readMbPerSecond, "write", writeMbPerSecond)
+				// Reset interval snapshot and seed from current
+				a.diskPrev[cacheTimeMs][name] = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
+				// also refresh agent baseline to avoid future negatives
+				a.initializeDiskIoStats(ioCounters)
+				continue
+			}
+
+			// Update per-interval snapshot
+			a.diskPrev[cacheTimeMs][name] = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
+
+			// Update global fsStats baseline for cross-interval correctness
+			stats.Time = now
+			stats.TotalRead = d.ReadBytes
+			stats.TotalWrite = d.WriteBytes
+			stats.DiskReadPs = readMbPerSecond
+			stats.DiskWritePs = writeMbPerSecond
+			stats.DiskReadBytes = diskIORead
+			stats.DiskWriteBytes = diskIOWrite
+
+			if stats.Root {
+				systemStats.DiskReadPs = stats.DiskReadPs
+				systemStats.DiskWritePs = stats.DiskWritePs
+				systemStats.DiskIO[0] = diskIORead
+				systemStats.DiskIO[1] = diskIOWrite
+			}
+		}
+	}
+}
+
+// getRootMountPoint returns the appropriate root mount point for the system
+// For immutable systems like Fedora Silverblue, it returns /sysroot instead of /
+func (a *Agent) getRootMountPoint() string {
+	// 1. Check if /etc/os-release contains indicators of an immutable system
+	if osReleaseContent, err := os.ReadFile("/etc/os-release"); err == nil {
+		content := string(osReleaseContent)
+		if strings.Contains(content, "fedora") && strings.Contains(content, "silverblue") ||
+			strings.Contains(content, "coreos") ||
+			strings.Contains(content, "flatcar") ||
+			strings.Contains(content, "rhel-atomic") ||
+			strings.Contains(content, "centos-atomic") {
+			// Verify that /sysroot exists before returning it
+			if _, err := os.Stat("/sysroot"); err == nil {
+				return "/sysroot"
+			}
+		}
+	}
+
+	// 2. Check if /run/ostree is present (ostree-based systems like Silverblue)
+	if _, err := os.Stat("/run/ostree"); err == nil {
+		// Verify that /sysroot exists before returning it
+		if _, err := os.Stat("/sysroot"); err == nil {
+			return "/sysroot"
+		}
+	}
+
+	return "/"
+}

agent/disk_test.go

@@ -0,0 +1,374 @@
+//go:build testing
+
+package agent
+
+import (
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/shirou/gopsutil/v4/disk"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestParseFilesystemEntry(t *testing.T) {
+	tests := []struct {
+		name         string
+		input        string
+		expectedFs   string
+		expectedName string
+	}{
+		{
+			name:         "simple device name",
+			input:        "sda1",
+			expectedFs:   "sda1",
+			expectedName: "",
+		},
+		{
+			name:         "device with custom name",
+			input:        "sda1__my-storage",
+			expectedFs:   "sda1",
+			expectedName: "my-storage",
+		},
+		{
+			name:         "full device path with custom name",
+			input:        "/dev/sdb1__backup-drive",
+			expectedFs:   "/dev/sdb1",
+			expectedName: "backup-drive",
+		},
+		{
+			name:         "NVMe device with custom name",
+			input:        "nvme0n1p2__fast-ssd",
+			expectedFs:   "nvme0n1p2",
+			expectedName: "fast-ssd",
+		},
+		{
+			name:         "whitespace trimmed",
+			input:        "  sda2__trimmed-name  ",
+			expectedFs:   "sda2",
+			expectedName: "trimmed-name",
+		},
+		{
+			name:         "empty custom name",
+			input:        "sda3__",
+			expectedFs:   "sda3",
+			expectedName: "",
+		},
+		{
+			name:         "empty device name",
+			input:        "__just-custom",
+			expectedFs:   "",
+			expectedName: "just-custom",
+		},
+		{
+			name:         "multiple underscores in custom name",
+			input:        "sda1__my_custom_drive",
+			expectedFs:   "sda1",
+			expectedName: "my_custom_drive",
+		},
+		{
+			name:         "custom name with spaces",
+			input:        "sda1__My Storage Drive",
+			expectedFs:   "sda1",
+			expectedName: "My Storage Drive",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fsEntry := strings.TrimSpace(tt.input)
+			var fs, customName string
+			if parts := strings.SplitN(fsEntry, "__", 2); len(parts) == 2 {
+				fs = strings.TrimSpace(parts[0])
+				customName = strings.TrimSpace(parts[1])
+			} else {
+				fs = fsEntry
+			}
+
+			assert.Equal(t, tt.expectedFs, fs)
+			assert.Equal(t, tt.expectedName, customName)
+		})
+	}
+}
+
+func TestFindIoDevice(t *testing.T) {
+	t.Run("matches by device name", func(t *testing.T) {
+		ioCounters := map[string]disk.IOCountersStat{
+			"sda": {Name: "sda"},
+			"sdb": {Name: "sdb"},
+		}
+
+		device, ok := findIoDevice("sdb", ioCounters)
+		assert.True(t, ok)
+		assert.Equal(t, "sdb", device)
+	})
+
+	t.Run("matches by device label", func(t *testing.T) {
+		ioCounters := map[string]disk.IOCountersStat{
+			"sda": {Name: "sda", Label: "rootfs"},
+			"sdb": {Name: "sdb"},
+		}
+
+		device, ok := findIoDevice("rootfs", ioCounters)
+		assert.True(t, ok)
+		assert.Equal(t, "sda", device)
+	})
+
+	t.Run("returns no fallback when not found", func(t *testing.T) {
+		ioCounters := map[string]disk.IOCountersStat{
+			"sda": {Name: "sda"},
+			"sdb": {Name: "sdb"},
+		}
+
+		device, ok := findIoDevice("nvme0n1p1", ioCounters)
+		assert.False(t, ok)
+		assert.Equal(t, "", device)
+	})
+}
+
+func TestIsDockerSpecialMountpoint(t *testing.T) {
+	testCases := []struct {
+		name       string
+		mountpoint string
+		expected   bool
+	}{
+		{name: "hosts", mountpoint: "/etc/hosts", expected: true},
+		{name: "resolv", mountpoint: "/etc/resolv.conf", expected: true},
+		{name: "hostname", mountpoint: "/etc/hostname", expected: true},
+		{name: "root", mountpoint: "/", expected: false},
+		{name: "passwd", mountpoint: "/etc/passwd", expected: false},
+		{name: "extra-filesystem", mountpoint: "/extra-filesystems/sda1", expected: false},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.expected, isDockerSpecialMountpoint(tc.mountpoint))
+		})
+	}
+}
+
+func TestInitializeDiskInfoWithCustomNames(t *testing.T) {
+	// Set up environment variables
+	oldEnv := os.Getenv("EXTRA_FILESYSTEMS")
+	defer func() {
+		if oldEnv != "" {
+			os.Setenv("EXTRA_FILESYSTEMS", oldEnv)
+		} else {
+			os.Unsetenv("EXTRA_FILESYSTEMS")
+		}
+	}()
+
+	// Test with custom names
+	os.Setenv("EXTRA_FILESYSTEMS", "sda1__my-storage,/dev/sdb1__backup-drive,nvme0n1p2")
+
+	// Mock disk partitions (we'll just test the parsing logic)
+	// Since the actual disk operations are system-dependent, we'll focus on the parsing
+	testCases := []struct {
+		envValue      string
+		expectedFs    []string
+		expectedNames map[string]string
+	}{
+		{
+			envValue:   "sda1__my-storage,sdb1__backup-drive",
+			expectedFs: []string{"sda1", "sdb1"},
+			expectedNames: map[string]string{
+				"sda1": "my-storage",
+				"sdb1": "backup-drive",
+			},
+		},
+		{
+			envValue:   "sda1,nvme0n1p2__fast-ssd",
+			expectedFs: []string{"sda1", "nvme0n1p2"},
+			expectedNames: map[string]string{
+				"nvme0n1p2": "fast-ssd",
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run("env_"+tc.envValue, func(t *testing.T) {
+			os.Setenv("EXTRA_FILESYSTEMS", tc.envValue)
+
+			// Create mock partitions that would match our test cases
+			partitions := []disk.PartitionStat{}
+			for _, fs := range tc.expectedFs {
+				if strings.HasPrefix(fs, "/dev/") {
+					partitions = append(partitions, disk.PartitionStat{
+						Device:     fs,
+						Mountpoint: fs,
+					})
+				} else {
+					partitions = append(partitions, disk.PartitionStat{
+						Device:     "/dev/" + fs,
+						Mountpoint: "/" + fs,
+					})
+				}
+			}
+
+			// Test the parsing logic by calling the relevant part
+			// We'll create a simplified version to test just the parsing
+			extraFilesystems := tc.envValue
+			for _, fsEntry := range strings.Split(extraFilesystems, ",") {
+				// Parse the entry
+				fsEntry = strings.TrimSpace(fsEntry)
+				var fs, customName string
+				if parts := strings.SplitN(fsEntry, "__", 2); len(parts) == 2 {
+					fs = strings.TrimSpace(parts[0])
+					customName = strings.TrimSpace(parts[1])
+				} else {
+					fs = fsEntry
+				}
+
+				// Verify the device is in our expected list
+				assert.Contains(t, tc.expectedFs, fs, "parsed device should be in expected list")
+
+				// Check if custom name should exist
+				if expectedName, exists := tc.expectedNames[fs]; exists {
+					assert.Equal(t, expectedName, customName, "custom name should match expected")
+				} else {
+					assert.Empty(t, customName, "custom name should be empty when not expected")
+				}
+			}
+		})
+	}
+}
+
+func TestFsStatsWithCustomNames(t *testing.T) {
+	// Test that FsStats properly stores custom names
+	fsStats := &system.FsStats{
+		Mountpoint: "/mnt/storage",
+		Name:       "my-custom-storage",
+		DiskTotal:  100.0,
+		DiskUsed:   50.0,
+	}
+
+	assert.Equal(t, "my-custom-storage", fsStats.Name)
+	assert.Equal(t, "/mnt/storage", fsStats.Mountpoint)
+	assert.Equal(t, 100.0, fsStats.DiskTotal)
+	assert.Equal(t, 50.0, fsStats.DiskUsed)
+}
+
+func TestExtraFsKeyGeneration(t *testing.T) {
+	// Test the logic for generating ExtraFs keys with custom names
+	testCases := []struct {
+		name        string
+		deviceName  string
+		customName  string
+		expectedKey string
+	}{
+		{
+			name:        "with custom name",
+			deviceName:  "sda1",
+			customName:  "my-storage",
+			expectedKey: "my-storage",
+		},
+		{
+			name:        "without custom name",
+			deviceName:  "sda1",
+			customName:  "",
+			expectedKey: "sda1",
+		},
+		{
+			name:        "empty custom name falls back to device",
+			deviceName:  "nvme0n1p2",
+			customName:  "",
+			expectedKey: "nvme0n1p2",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Simulate the key generation logic from agent.go
+			key := tc.deviceName
+			if tc.customName != "" {
+				key = tc.customName
+			}
+			assert.Equal(t, tc.expectedKey, key)
+		})
+	}
+}
+
+func TestDiskUsageCaching(t *testing.T) {
+	t.Run("caching disabled updates all filesystems", func(t *testing.T) {
+		agent := &Agent{
+			fsStats: map[string]*system.FsStats{
+				"sda": {Root: true, Mountpoint: "/"},
+				"sdb": {Root: false, Mountpoint: "/mnt/storage"},
+			},
+			diskUsageCacheDuration: 0, // caching disabled
+		}
+
+		var stats system.Stats
+		agent.updateDiskUsage(&stats)
+
+		// Both should be updated (non-zero values from disk.Usage)
+		// Root stats should be populated in systemStats
+		assert.True(t, agent.lastDiskUsageUpdate.IsZero() || !agent.lastDiskUsageUpdate.IsZero(),
+			"lastDiskUsageUpdate should be set when caching is disabled")
+	})
+
+	t.Run("caching enabled always updates root filesystem", func(t *testing.T) {
+		agent := &Agent{
+			fsStats: map[string]*system.FsStats{
+				"sda": {Root: true, Mountpoint: "/", DiskTotal: 100, DiskUsed: 50},
+				"sdb": {Root: false, Mountpoint: "/mnt/storage", DiskTotal: 200, DiskUsed: 100},
+			},
+			diskUsageCacheDuration: 1 * time.Hour,
+			lastDiskUsageUpdate:    time.Now(), // cache is fresh
+		}
+
+		// Store original extra fs values
+		originalExtraTotal := agent.fsStats["sdb"].DiskTotal
+		originalExtraUsed := agent.fsStats["sdb"].DiskUsed
+
+		var stats system.Stats
+		agent.updateDiskUsage(&stats)
+
+		// Root should be updated (systemStats populated from disk.Usage call)
+		// We can't easily check if disk.Usage was called, but we verify the flow works
+
+		// Extra filesystem should retain cached values (not reset)
+		assert.Equal(t, originalExtraTotal, agent.fsStats["sdb"].DiskTotal,
+			"extra filesystem DiskTotal should be unchanged when cached")
+		assert.Equal(t, originalExtraUsed, agent.fsStats["sdb"].DiskUsed,
+			"extra filesystem DiskUsed should be unchanged when cached")
+	})
+
+	t.Run("first call always updates all filesystems", func(t *testing.T) {
+		agent := &Agent{
+			fsStats: map[string]*system.FsStats{
+				"sda": {Root: true, Mountpoint: "/"},
+				"sdb": {Root: false, Mountpoint: "/mnt/storage"},
+			},
+			diskUsageCacheDuration: 1 * time.Hour,
+			// lastDiskUsageUpdate is zero (first call)
+		}
+
+		var stats system.Stats
+		agent.updateDiskUsage(&stats)
+
+		// After first call, lastDiskUsageUpdate should be set
+		assert.False(t, agent.lastDiskUsageUpdate.IsZero(),
+			"lastDiskUsageUpdate should be set after first call")
+	})
+
+	t.Run("expired cache updates extra filesystems", func(t *testing.T) {
+		agent := &Agent{
+			fsStats: map[string]*system.FsStats{
+				"sda": {Root: true, Mountpoint: "/"},
+				"sdb": {Root: false, Mountpoint: "/mnt/storage"},
+			},
+			diskUsageCacheDuration: 1 * time.Millisecond,
+			lastDiskUsageUpdate:    time.Now().Add(-1 * time.Second), // cache expired
+		}
+
+		var stats system.Stats
+		agent.updateDiskUsage(&stats)
+
+		// lastDiskUsageUpdate should be refreshed since cache expired
+		assert.True(t, time.Since(agent.lastDiskUsageUpdate) < time.Second,
+			"lastDiskUsageUpdate should be refreshed when cache expires")
+	})
+}

agent/docker.go

@@ -1,30 +1,59 @@
 package agent
 
 import (
+	"bufio"
 	"bytes"
 	"context"
+	"encoding/binary"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"io"
 	"log/slog"
 	"net"
 	"net/http"
 	"net/url"
 	"os"
+	"path"
+	"regexp"
 	"strings"
 	"sync"
 	"time"
 
+	"github.com/henrygd/beszel/agent/deltatracker"
 	"github.com/henrygd/beszel/internal/entities/container"
 
 	"github.com/blang/semver"
 )
 
+// ansiEscapePattern matches ANSI escape sequences (colors, cursor movement, etc.)
+// This includes CSI sequences like \x1b[...m and simple escapes like \x1b[K
+var ansiEscapePattern = regexp.MustCompile(`\x1b\[[0-9;]*[a-zA-Z]|\x1b\][^\x07]*\x07|\x1b[@-Z\\-_]`)
+var dockerContainerIDPattern = regexp.MustCompile(`^[a-fA-F0-9]{12,64}$`)
+
+const (
+	// Docker API timeout in milliseconds
+	dockerTimeoutMs = 2100
+	// Maximum realistic network speed (5 GB/s) to detect bad deltas
+	maxNetworkSpeedBps uint64 = 5e9
+	// Maximum conceivable memory usage of a container (100TB) to detect bad memory stats
+	maxMemoryUsage uint64 = 100 * 1024 * 1024 * 1024 * 1024
+	// Number of log lines to request when fetching container logs
+	dockerLogsTail = 200
+	// Maximum size of a single log frame (1MB) to prevent memory exhaustion
+	// A single log line larger than 1MB is likely an error or misconfiguration
+	maxLogFrameSize = 1024 * 1024
+	// Maximum total log content size (5MB) to prevent memory exhaustion
+	// This provides a reasonable limit for network transfer and browser rendering
+	maxTotalLogSize = 5 * 1024 * 1024
+)
+
 type dockerManager struct {
 	client              *http.Client                // Client to query Docker API
 	wg                  sync.WaitGroup              // WaitGroup to wait for all goroutines to finish
 	sem                 chan struct{}               // Semaphore to limit concurrent container requests
 	containerStatsMutex sync.RWMutex                // Mutex to prevent concurrent access to containerStatsMap
-	apiContainerList    []*container.ApiInfo        // List of containers from Docker API (no pointer)
+	apiContainerList    []*container.ApiInfo        // List of containers from Docker API
 	containerStatsMap   map[string]*container.Stats // Keeps track of container stats
 	validIds            map[string]struct{}         // Map of valid container ids, used to prune invalid containers from containerStatsMap
 	goodDockerVersion   bool                        // Whether docker version is at least 25.0.0 (one-shot works correctly)
@@ -32,6 +61,20 @@ type dockerManager struct {
 	buf                 *bytes.Buffer               // Buffer to store and read response bodies
 	decoder             *json.Decoder               // Reusable JSON decoder that reads from buf
 	apiStats            *container.ApiStats         // Reusable API stats object
+	excludeContainers   []string                    // Patterns to exclude containers by name
+	usingPodman         bool                        // Whether the Docker Engine API is running on Podman
+
+	// Cache-time-aware tracking for CPU stats (similar to cpu.go)
+	// Maps cache time intervals to container-specific CPU usage tracking
+	lastCpuContainer map[uint16]map[string]uint64    // cacheTimeMs -> containerId -> last cpu container usage
+	lastCpuSystem    map[uint16]map[string]uint64    // cacheTimeMs -> containerId -> last cpu system usage
+	lastCpuReadTime  map[uint16]map[string]time.Time // cacheTimeMs -> containerId -> last read time (Windows)
+
+	// Network delta trackers - one per cache time to avoid interference
+	// cacheTimeMs -> DeltaTracker for network bytes sent/received
+	networkSentTrackers map[uint16]*deltatracker.DeltaTracker[string, uint64]
+	networkRecvTrackers map[uint16]*deltatracker.DeltaTracker[string, uint64]
+	retrySleep          func(time.Duration)
 }
 
 // userAgentRoundTripper is a custom http.RoundTripper that adds a User-Agent header to all requests
@@ -62,8 +105,21 @@ func (d *dockerManager) dequeue() {
 	}
 }
 
-// Returns stats for all running containers
+// shouldExcludeContainer checks if a container name matches any exclusion pattern
-func (dm *dockerManager) getDockerStats() ([]*container.Stats, error) {
+func (dm *dockerManager) shouldExcludeContainer(name string) bool {
+	if len(dm.excludeContainers) == 0 {
+		return false
+	}
+	for _, pattern := range dm.excludeContainers {
+		if match, _ := path.Match(pattern, name); match {
+			return true
+		}
+	}
+	return false
+}
+
+// Returns stats for all running containers with cache-time-aware delta tracking
+func (dm *dockerManager) getDockerStats(cacheTimeMs uint16) ([]*container.Stats, error) {
 	resp, err := dm.client.Get("http://localhost/containers/json")
 	if err != nil {
 		return nil, err
@@ -87,9 +143,15 @@ func (dm *dockerManager) getDockerStats() ([]*container.Stats, error) {
 
 	var failedContainers []*container.ApiInfo
 
-	for i := range dm.apiContainerList {
+	for _, ctr := range dm.apiContainerList {
-		ctr := dm.apiContainerList[i]
 		ctr.IdShort = ctr.Id[:12]
+
+		// Skip this container if it matches the exclusion pattern
+		if dm.shouldExcludeContainer(ctr.Names[0][1:]) {
+			slog.Debug("Excluding container", "name", ctr.Names[0][1:])
+			continue
+		}
+
 		dm.validIds[ctr.IdShort] = struct{}{}
 		// check if container is less than 1 minute old (possible restart)
 		// note: can't use Created field because it's not updated on restart
@@ -98,9 +160,9 @@ func (dm *dockerManager) getDockerStats() ([]*container.Stats, error) {
 			dm.deleteContainerStatsSync(ctr.IdShort)
 		}
 		dm.queue()
-		go func() {
+		go func(ctr *container.ApiInfo) {
 			defer dm.dequeue()
-			err := dm.updateContainerStats(ctr)
+			err := dm.updateContainerStats(ctr, cacheTimeMs)
 			// if error, delete from map and add to failed list to retry
 			if err != nil {
 				dm.containerStatsMutex.Lock()
@@ -108,7 +170,7 @@ func (dm *dockerManager) getDockerStats() ([]*container.Stats, error) {
 				failedContainers = append(failedContainers, ctr)
 				dm.containerStatsMutex.Unlock()
 			}
-		}()
+		}(ctr)
 	}
 
 	dm.wg.Wait()
@@ -119,13 +181,12 @@ func (dm *dockerManager) getDockerStats() ([]*container.Stats, error) {
 		for i := range failedContainers {
 			ctr := failedContainers[i]
 			dm.queue()
-			go func() {
+			go func(ctr *container.ApiInfo) {
 				defer dm.dequeue()
-				err = dm.updateContainerStats(ctr)
+				if err2 := dm.updateContainerStats(ctr, cacheTimeMs); err2 != nil {
-				if err != nil {
+					slog.Error("Error getting container stats", "err", err2)
-					slog.Error("Error getting container stats", "err", err)
 				}
-			}()
+			}(ctr)
 		}
 		dm.wg.Wait()
 	}
@@ -140,18 +201,193 @@ func (dm *dockerManager) getDockerStats() ([]*container.Stats, error) {
 		}
 	}
 
+	// prepare network trackers for next interval for this cache time
+	dm.cycleNetworkDeltasForCacheTime(cacheTimeMs)
+
 	return stats, nil
 }
 
-// Updates stats for individual container
+// initializeCpuTracking initializes CPU tracking maps for a specific cache time interval
-func (dm *dockerManager) updateContainerStats(ctr *container.ApiInfo) error {
+func (dm *dockerManager) initializeCpuTracking(cacheTimeMs uint16) {
+	// Initialize cache time maps if they don't exist
+	if dm.lastCpuContainer[cacheTimeMs] == nil {
+		dm.lastCpuContainer[cacheTimeMs] = make(map[string]uint64)
+	}
+	if dm.lastCpuSystem[cacheTimeMs] == nil {
+		dm.lastCpuSystem[cacheTimeMs] = make(map[string]uint64)
+	}
+	// Ensure the outer map exists before indexing
+	if dm.lastCpuReadTime == nil {
+		dm.lastCpuReadTime = make(map[uint16]map[string]time.Time)
+	}
+	if dm.lastCpuReadTime[cacheTimeMs] == nil {
+		dm.lastCpuReadTime[cacheTimeMs] = make(map[string]time.Time)
+	}
+}
+
+// getCpuPreviousValues returns previous CPU values for a container and cache time interval
+func (dm *dockerManager) getCpuPreviousValues(cacheTimeMs uint16, containerId string) (uint64, uint64) {
+	return dm.lastCpuContainer[cacheTimeMs][containerId], dm.lastCpuSystem[cacheTimeMs][containerId]
+}
+
+// setCpuCurrentValues stores current CPU values for a container and cache time interval
+func (dm *dockerManager) setCpuCurrentValues(cacheTimeMs uint16, containerId string, cpuContainer, cpuSystem uint64) {
+	dm.lastCpuContainer[cacheTimeMs][containerId] = cpuContainer
+	dm.lastCpuSystem[cacheTimeMs][containerId] = cpuSystem
+}
+
+// calculateMemoryUsage calculates memory usage from Docker API stats
+func calculateMemoryUsage(apiStats *container.ApiStats, isWindows bool) (uint64, error) {
+	if isWindows {
+		return apiStats.MemoryStats.PrivateWorkingSet, nil
+	}
+
+	memCache := apiStats.MemoryStats.Stats.InactiveFile
+	if memCache == 0 {
+		memCache = apiStats.MemoryStats.Stats.Cache
+	}
+
+	usedDelta := apiStats.MemoryStats.Usage - memCache
+	if usedDelta <= 0 || usedDelta > maxMemoryUsage {
+		return 0, fmt.Errorf("bad memory stats")
+	}
+
+	return usedDelta, nil
+}
+
+// getNetworkTracker returns the DeltaTracker for a specific cache time, creating it if needed
+func (dm *dockerManager) getNetworkTracker(cacheTimeMs uint16, isSent bool) *deltatracker.DeltaTracker[string, uint64] {
+	var trackers map[uint16]*deltatracker.DeltaTracker[string, uint64]
+	if isSent {
+		trackers = dm.networkSentTrackers
+	} else {
+		trackers = dm.networkRecvTrackers
+	}
+
+	if trackers[cacheTimeMs] == nil {
+		trackers[cacheTimeMs] = deltatracker.NewDeltaTracker[string, uint64]()
+	}
+
+	return trackers[cacheTimeMs]
+}
+
+// cycleNetworkDeltasForCacheTime cycles the network delta trackers for a specific cache time
+func (dm *dockerManager) cycleNetworkDeltasForCacheTime(cacheTimeMs uint16) {
+	if dm.networkSentTrackers[cacheTimeMs] != nil {
+		dm.networkSentTrackers[cacheTimeMs].Cycle()
+	}
+	if dm.networkRecvTrackers[cacheTimeMs] != nil {
+		dm.networkRecvTrackers[cacheTimeMs].Cycle()
+	}
+}
+
+// calculateNetworkStats calculates network sent/receive deltas using DeltaTracker
+func (dm *dockerManager) calculateNetworkStats(ctr *container.ApiInfo, apiStats *container.ApiStats, stats *container.Stats, initialized bool, name string, cacheTimeMs uint16) (uint64, uint64) {
+	var total_sent, total_recv uint64
+	for _, v := range apiStats.Networks {
+		total_sent += v.TxBytes
+		total_recv += v.RxBytes
+	}
+
+	// Get the DeltaTracker for this specific cache time
+	sentTracker := dm.getNetworkTracker(cacheTimeMs, true)
+	recvTracker := dm.getNetworkTracker(cacheTimeMs, false)
+
+	// Set current values in the cache-time-specific DeltaTracker
+	sentTracker.Set(ctr.IdShort, total_sent)
+	recvTracker.Set(ctr.IdShort, total_recv)
+
+	// Get deltas (bytes since last measurement)
+	sent_delta_raw := sentTracker.Delta(ctr.IdShort)
+	recv_delta_raw := recvTracker.Delta(ctr.IdShort)
+
+	// Calculate bytes per second independently for Tx and Rx if we have previous data
+	var sent_delta, recv_delta uint64
+	if initialized {
+		millisecondsElapsed := uint64(time.Since(stats.PrevReadTime).Milliseconds())
+		if millisecondsElapsed > 0 {
+			if sent_delta_raw > 0 {
+				sent_delta = sent_delta_raw * 1000 / millisecondsElapsed
+				if sent_delta > maxNetworkSpeedBps {
+					slog.Warn("Bad network delta", "container", name)
+					sent_delta = 0
+				}
+			}
+			if recv_delta_raw > 0 {
+				recv_delta = recv_delta_raw * 1000 / millisecondsElapsed
+				if recv_delta > maxNetworkSpeedBps {
+					slog.Warn("Bad network delta", "container", name)
+					recv_delta = 0
+				}
+			}
+		}
+	}
+
+	return sent_delta, recv_delta
+}
+
+// validateCpuPercentage checks if CPU percentage is within valid range
+func validateCpuPercentage(cpuPct float64, containerName string) error {
+	if cpuPct > 100 {
+		return fmt.Errorf("%s cpu pct greater than 100: %+v", containerName, cpuPct)
+	}
+	return nil
+}
+
+// updateContainerStatsValues updates the final stats values
+func updateContainerStatsValues(stats *container.Stats, cpuPct float64, usedMemory uint64, sent_delta, recv_delta uint64, readTime time.Time) {
+	stats.Cpu = twoDecimals(cpuPct)
+	stats.Mem = bytesToMegabytes(float64(usedMemory))
+	stats.Bandwidth = [2]uint64{sent_delta, recv_delta}
+	// TODO(0.19+): stop populating NetworkSent/NetworkRecv (deprecated in 0.18.3)
+	stats.NetworkSent = bytesToMegabytes(float64(sent_delta))
+	stats.NetworkRecv = bytesToMegabytes(float64(recv_delta))
+	stats.PrevReadTime = readTime
+}
+
+func parseDockerStatus(status string) (string, container.DockerHealth) {
+	trimmed := strings.TrimSpace(status)
+	if trimmed == "" {
+		return "", container.DockerHealthNone
+	}
+
+	// Remove "About " from status
+	trimmed = strings.Replace(trimmed, "About ", "", 1)
+
+	openIdx := strings.LastIndex(trimmed, "(")
+	if openIdx == -1 || !strings.HasSuffix(trimmed, ")") {
+		return trimmed, container.DockerHealthNone
+	}
+
+	statusText := strings.TrimSpace(trimmed[:openIdx])
+	if statusText == "" {
+		statusText = trimmed
+	}
+
+	healthText := strings.ToLower(strings.TrimSpace(strings.TrimSuffix(trimmed[openIdx+1:], ")")))
+	// Some Docker statuses include a "health:" prefix inside the parentheses.
+	// Strip it so it maps correctly to the known health states.
+	if colonIdx := strings.IndexRune(healthText, ':'); colonIdx != -1 {
+		prefix := strings.TrimSpace(healthText[:colonIdx])
+		if prefix == "health" || prefix == "health status" {
+			healthText = strings.TrimSpace(healthText[colonIdx+1:])
+		}
+	}
+	if health, ok := container.DockerHealthStrings[healthText]; ok {
+		return statusText, health
+	}
+
+	return trimmed, container.DockerHealthNone
+}
+
+// Updates stats for individual container with cache-time-aware delta tracking
+func (dm *dockerManager) updateContainerStats(ctr *container.ApiInfo, cacheTimeMs uint16) error {
 	name := ctr.Names[0][1:]
 
-	resp, err := dm.client.Get("http://localhost/containers/" + ctr.IdShort + "/stats?stream=0&one-shot=1")
+	resp, err := dm.client.Get(fmt.Sprintf("http://localhost/containers/%s/stats?stream=0&one-shot=1", ctr.IdShort))
 	if err != nil {
 		return err
 	}
-	defer resp.Body.Close()
 
 	dm.containerStatsMutex.Lock()
 	defer dm.containerStatsMutex.Unlock()
@@ -159,82 +395,76 @@ func (dm *dockerManager) updateContainerStats(ctr *container.ApiInfo) error {
 	// add empty values if they doesn't exist in map
 	stats, initialized := dm.containerStatsMap[ctr.IdShort]
 	if !initialized {
-		stats = &container.Stats{Name: name}
+		stats = &container.Stats{Name: name, Id: ctr.IdShort, Image: ctr.Image}
 		dm.containerStatsMap[ctr.IdShort] = stats
 	}
 
+	stats.Id = ctr.IdShort
+
+	statusText, health := parseDockerStatus(ctr.Status)
+	stats.Status = statusText
+	stats.Health = health
+
 	// reset current stats
 	stats.Cpu = 0
 	stats.Mem = 0
+	stats.Bandwidth = [2]uint64{0, 0}
+	// TODO(0.19+): stop populating NetworkSent/NetworkRecv (deprecated in 0.18.3)
 	stats.NetworkSent = 0
 	stats.NetworkRecv = 0
 
-	// docker host container stats response
-	// res := dm.getApiStats()
-	// defer dm.putApiStats(res)
-	//
-
 	res := dm.apiStats
 	res.Networks = nil
 	if err := dm.decode(resp, res); err != nil {
 		return err
 	}
 
-	// calculate cpu and memory stats
+	// Initialize CPU tracking for this cache time interval
-	var usedMemory uint64
+	dm.initializeCpuTracking(cacheTimeMs)
+
+	// Get previous CPU values
+	prevCpuContainer, prevCpuSystem := dm.getCpuPreviousValues(cacheTimeMs, ctr.IdShort)
+
+	// Calculate CPU percentage based on platform
 	var cpuPct float64
-
-	// store current cpu stats
-	prevCpuContainer, prevCpuSystem := stats.CpuContainer, stats.CpuSystem
-	stats.CpuContainer = res.CPUStats.CPUUsage.TotalUsage
-	stats.CpuSystem = res.CPUStats.SystemUsage
-
 	if dm.isWindows {
-		usedMemory = res.MemoryStats.PrivateWorkingSet
+		prevRead := dm.lastCpuReadTime[cacheTimeMs][ctr.IdShort]
-		cpuPct = res.CalculateCpuPercentWindows(prevCpuContainer, stats.PrevReadTime)
+		cpuPct = res.CalculateCpuPercentWindows(prevCpuContainer, prevRead)
 	} else {
-		// check if container has valid data, otherwise may be in restart loop (#103)
-		if res.MemoryStats.Usage == 0 {
-			return fmt.Errorf("%s - no memory stats - see https://github.com/henrygd/beszel/issues/144", name)
-		}
-		memCache := res.MemoryStats.Stats.InactiveFile
-		if memCache == 0 {
-			memCache = res.MemoryStats.Stats.Cache
-		}
-		usedMemory = res.MemoryStats.Usage - memCache
-
 		cpuPct = res.CalculateCpuPercentLinux(prevCpuContainer, prevCpuSystem)
 	}
 
-	if cpuPct > 100 {
+	// Calculate memory usage
-		return fmt.Errorf("%s cpu pct greater than 100: %+v", name, cpuPct)
+	usedMemory, err := calculateMemoryUsage(res, dm.isWindows)
+	if err != nil {
+		return fmt.Errorf("%s - %w - see https://github.com/henrygd/beszel/issues/144", name, err)
 	}
 
-	// network
+	// Store current CPU stats for next calculation
+	currentCpuContainer := res.CPUStats.CPUUsage.TotalUsage
+	currentCpuSystem := res.CPUStats.SystemUsage
+	dm.setCpuCurrentValues(cacheTimeMs, ctr.IdShort, currentCpuContainer, currentCpuSystem)
+
+	// Validate CPU percentage
+	if err := validateCpuPercentage(cpuPct, name); err != nil {
+		return err
+	}
+
+	// Calculate network stats using DeltaTracker
+	sent_delta, recv_delta := dm.calculateNetworkStats(ctr, res, stats, initialized, name, cacheTimeMs)
+
+	// Store current network values for legacy compatibility
 	var total_sent, total_recv uint64
 	for _, v := range res.Networks {
 		total_sent += v.TxBytes
 		total_recv += v.RxBytes
 	}
-	var sent_delta, recv_delta uint64
-	millisecondsElapsed := uint64(time.Since(stats.PrevReadTime).Milliseconds())
-	if initialized && millisecondsElapsed > 0 {
-		// get bytes per second
-		sent_delta = (total_sent - stats.PrevNet.Sent) * 1000 / millisecondsElapsed
-		recv_delta = (total_recv - stats.PrevNet.Recv) * 1000 / millisecondsElapsed
-		// check for unrealistic network values (> 5GB/s)
-		if sent_delta > 5e9 || recv_delta > 5e9 {
-			slog.Warn("Bad network delta", "container", name)
-			sent_delta, recv_delta = 0, 0
-		}
-	}
 	stats.PrevNet.Sent, stats.PrevNet.Recv = total_sent, total_recv
 
-	stats.Cpu = twoDecimals(cpuPct)
+	// Update final stats values
-	stats.Mem = bytesToMegabytes(float64(usedMemory))
+	updateContainerStatsValues(stats, cpuPct, usedMemory, sent_delta, recv_delta, res.Read)
-	stats.NetworkSent = bytesToMegabytes(float64(sent_delta))
+	// store per-cache-time read time for Windows CPU percent calc
-	stats.NetworkRecv = bytesToMegabytes(float64(recv_delta))
+	dm.lastCpuReadTime[cacheTimeMs][ctr.IdShort] = res.Read
-	stats.PrevReadTime = res.Read
 
 	return nil
 }
@@ -244,10 +474,19 @@ func (dm *dockerManager) deleteContainerStatsSync(id string) {
 	dm.containerStatsMutex.Lock()
 	defer dm.containerStatsMutex.Unlock()
 	delete(dm.containerStatsMap, id)
+	for ct := range dm.lastCpuContainer {
+		delete(dm.lastCpuContainer[ct], id)
+	}
+	for ct := range dm.lastCpuSystem {
+		delete(dm.lastCpuSystem[ct], id)
+	}
+	for ct := range dm.lastCpuReadTime {
+		delete(dm.lastCpuReadTime[ct], id)
+	}
 }
 
 // Creates a new http client for Docker or Podman API
-func newDockerManager(a *Agent) *dockerManager {
+func newDockerManager() *dockerManager {
 	dockerHost, exists := GetEnv("DOCKER_HOST")
 	if exists {
 		// return nil if set to empty string
@@ -283,7 +522,7 @@ func newDockerManager(a *Agent) *dockerManager {
 	}
 
 	// configurable timeout
-	timeout := time.Millisecond * 2100
+	timeout := time.Millisecond * time.Duration(dockerTimeoutMs)
 	if t, set := GetEnv("DOCKER_TIMEOUT"); set {
 		timeout, err = time.ParseDuration(t)
 		if err != nil {
@@ -299,6 +538,19 @@ func newDockerManager(a *Agent) *dockerManager {
 		userAgent: "Docker-Client/",
 	}
 
+	// Read container exclusion patterns from environment variable
+	var excludeContainers []string
+	if excludeStr, set := GetEnv("EXCLUDE_CONTAINERS"); set && excludeStr != "" {
+		parts := strings.SplitSeq(excludeStr, ",")
+		for part := range parts {
+			trimmed := strings.TrimSpace(part)
+			if trimmed != "" {
+				excludeContainers = append(excludeContainers, trimmed)
+			}
+		}
+		slog.Info("EXCLUDE_CONTAINERS", "patterns", excludeContainers)
+	}
+
 	manager := &dockerManager{
 		client: &http.Client{
 			Timeout:   timeout,
@@ -308,37 +560,67 @@ func newDockerManager(a *Agent) *dockerManager {
 		sem:               make(chan struct{}, 5),
 		apiContainerList:  []*container.ApiInfo{},
 		apiStats:          &container.ApiStats{},
+		excludeContainers: excludeContainers,
+
+		// Initialize cache-time-aware tracking structures
+		lastCpuContainer:    make(map[uint16]map[string]uint64),
+		lastCpuSystem:       make(map[uint16]map[string]uint64),
+		lastCpuReadTime:     make(map[uint16]map[string]time.Time),
+		networkSentTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
+		networkRecvTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
+		retrySleep:          time.Sleep,
 	}
 
 	// If using podman, return client
 	if strings.Contains(dockerHost, "podman") {
-		a.systemInfo.Podman = true
+		manager.usingPodman = true
 		manager.goodDockerVersion = true
 		return manager
 	}
 
-	// Check docker version
+	// run version check in goroutine to avoid blocking (server may not be ready and requires retries)
-	// (versions before 25.0.0 have a bug with one-shot which requires all requests to be made in one batch)
+	go manager.checkDockerVersion()
+
+	// give version check a chance to complete before returning
+	time.Sleep(50 * time.Millisecond)
+
+	return manager
+}
+
+// checkDockerVersion checks Docker version and sets goodDockerVersion if at least 25.0.0.
+// Versions before 25.0.0 have a bug with one-shot which requires all requests to be made in one batch.
+func (dm *dockerManager) checkDockerVersion() {
+	var err error
+	var resp *http.Response
 	var versionInfo struct {
 		Version string `json:"Version"`
 	}
-	resp, err := manager.client.Get("http://localhost/version")
+	const versionMaxTries = 2
-	if err != nil {
+	for i := 1; i <= versionMaxTries; i++ {
-		return manager
+		resp, err = dm.client.Get("http://localhost/version")
+		if err == nil && resp.StatusCode == http.StatusOK {
+			break
 		}
-
+		if resp != nil {
-	if err := manager.decode(resp, &versionInfo); err != nil {
+			resp.Body.Close()
-		return manager
+		}
+		if i < versionMaxTries {
+			slog.Debug("Failed to get Docker version; retrying", "attempt", i, "err", err, "response", resp)
+			dm.retrySleep(5 * time.Second)
+		}
+	}
+	if err != nil || resp.StatusCode != http.StatusOK {
+		return
+	}
+	if err := dm.decode(resp, &versionInfo); err != nil {
+		return
 	}
-
 	// if version > 24, one-shot works correctly and we can limit concurrent operations
 	if dockerVersion, err := semver.Parse(versionInfo.Version); err == nil && dockerVersion.Major > 24 {
-		manager.goodDockerVersion = true
+		dm.goodDockerVersion = true
 	} else {
 		slog.Info(fmt.Sprintf("Docker %s is outdated. Upgrade if possible. See https://github.com/henrygd/beszel/issues/58", versionInfo.Version))
 	}
-
-	return manager
 }
 
 // Decodes Docker API JSON response using a reusable buffer and decoder. Not thread safe.
@@ -368,3 +650,191 @@ func getDockerHost() string {
 	}
 	return scheme + socks[0]
 }
+
+func validateContainerID(containerID string) error {
+	if !dockerContainerIDPattern.MatchString(containerID) {
+		return fmt.Errorf("invalid container id")
+	}
+	return nil
+}
+
+func buildDockerContainerEndpoint(containerID, action string, query url.Values) (string, error) {
+	if err := validateContainerID(containerID); err != nil {
+		return "", err
+	}
+	u := &url.URL{
+		Scheme: "http",
+		Host:   "localhost",
+		Path:   fmt.Sprintf("/containers/%s/%s", url.PathEscape(containerID), action),
+	}
+	if len(query) > 0 {
+		u.RawQuery = query.Encode()
+	}
+	return u.String(), nil
+}
+
+// getContainerInfo fetches the inspection data for a container
+func (dm *dockerManager) getContainerInfo(ctx context.Context, containerID string) ([]byte, error) {
+	endpoint, err := buildDockerContainerEndpoint(containerID, "json", nil)
+	if err != nil {
+		return nil, err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	resp, err := dm.client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 1024))
+		return nil, fmt.Errorf("container info request failed: %s: %s", resp.Status, strings.TrimSpace(string(body)))
+	}
+
+	// Remove sensitive environment variables from Config.Env
+	var containerInfo map[string]any
+	if err := json.NewDecoder(resp.Body).Decode(&containerInfo); err != nil {
+		return nil, err
+	}
+	if config, ok := containerInfo["Config"].(map[string]any); ok {
+		delete(config, "Env")
+	}
+
+	return json.Marshal(containerInfo)
+}
+
+// getLogs fetches the logs for a container
+func (dm *dockerManager) getLogs(ctx context.Context, containerID string) (string, error) {
+	query := url.Values{
+		"stdout": []string{"1"},
+		"stderr": []string{"1"},
+		"tail":   []string{fmt.Sprintf("%d", dockerLogsTail)},
+	}
+	endpoint, err := buildDockerContainerEndpoint(containerID, "logs", query)
+	if err != nil {
+		return "", err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return "", err
+	}
+
+	resp, err := dm.client.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 1024))
+		return "", fmt.Errorf("logs request failed: %s: %s", resp.Status, strings.TrimSpace(string(body)))
+	}
+
+	var builder strings.Builder
+	contentType := resp.Header.Get("Content-Type")
+	multiplexed := strings.HasSuffix(contentType, "multiplexed-stream")
+	logReader := io.Reader(resp.Body)
+	if !multiplexed {
+		// Podman may return multiplexed logs without Content-Type. Sniff the first frame header
+		// with a small buffered reader only when the header check fails.
+		bufferedReader := bufio.NewReaderSize(resp.Body, 8)
+		multiplexed = detectDockerMultiplexedStream(bufferedReader)
+		logReader = bufferedReader
+	}
+	if err := decodeDockerLogStream(logReader, &builder, multiplexed); err != nil {
+		return "", err
+	}
+
+	// Strip ANSI escape sequences from logs for clean display in web UI
+	logs := builder.String()
+	if strings.Contains(logs, "\x1b") {
+		logs = ansiEscapePattern.ReplaceAllString(logs, "")
+	}
+	return logs, nil
+}
+
+func detectDockerMultiplexedStream(reader *bufio.Reader) bool {
+	const headerSize = 8
+	header, err := reader.Peek(headerSize)
+	if err != nil {
+		return false
+	}
+	if header[0] != 0x01 && header[0] != 0x02 {
+		return false
+	}
+	// Docker's stream framing header reserves bytes 1-3 as zero.
+	if header[1] != 0 || header[2] != 0 || header[3] != 0 {
+		return false
+	}
+	frameLen := binary.BigEndian.Uint32(header[4:])
+	return frameLen <= maxLogFrameSize
+}
+
+func decodeDockerLogStream(reader io.Reader, builder *strings.Builder, multiplexed bool) error {
+	if !multiplexed {
+		_, err := io.Copy(builder, io.LimitReader(reader, maxTotalLogSize))
+		return err
+	}
+	const headerSize = 8
+	var header [headerSize]byte
+	totalBytesRead := 0
+
+	for {
+		if _, err := io.ReadFull(reader, header[:]); err != nil {
+			if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
+				return nil
+			}
+			return err
+		}
+
+		frameLen := binary.BigEndian.Uint32(header[4:])
+		if frameLen == 0 {
+			continue
+		}
+
+		// Prevent memory exhaustion from excessively large frames
+		if frameLen > maxLogFrameSize {
+			return fmt.Errorf("log frame size (%d) exceeds maximum (%d)", frameLen, maxLogFrameSize)
+		}
+
+		// Check if reading this frame would exceed total log size limit
+		if totalBytesRead+int(frameLen) > maxTotalLogSize {
+			// Read and discard remaining data to avoid blocking
+			_, _ = io.CopyN(io.Discard, reader, int64(frameLen))
+			slog.Debug("Truncating logs: limit reached", "read", totalBytesRead, "limit", maxTotalLogSize)
+			return nil
+		}
+
+		n, err := io.CopyN(builder, reader, int64(frameLen))
+		if err != nil {
+			if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
+				return nil
+			}
+			return err
+		}
+		totalBytesRead += int(n)
+	}
+}
+
+// GetHostInfo fetches the system info from Docker
+func (dm *dockerManager) GetHostInfo() (info container.HostInfo, err error) {
+	resp, err := dm.client.Get("http://localhost/info")
+	if err != nil {
+		return info, err
+	}
+	defer resp.Body.Close()
+
+	if err := json.NewDecoder(resp.Body).Decode(&info); err != nil {
+		return info, err
+	}
+
+	return info, nil
+}
+
+func (dm *dockerManager) IsPodman() bool {
+	return dm.usingPodman
+}

agent/emmc_common.go

@@ -0,0 +1,95 @@
+package agent
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+func isEmmcBlockName(name string) bool {
+	if !strings.HasPrefix(name, "mmcblk") {
+		return false
+	}
+	suffix := strings.TrimPrefix(name, "mmcblk")
+	if suffix == "" {
+		return false
+	}
+	for _, c := range suffix {
+		if c < '0' || c > '9' {
+			return false
+		}
+	}
+	return true
+}
+
+func parseHexOrDecByte(s string) (uint8, bool) {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return 0, false
+	}
+	base := 10
+	if strings.HasPrefix(s, "0x") || strings.HasPrefix(s, "0X") {
+		base = 16
+		s = s[2:]
+	}
+	parsed, err := strconv.ParseUint(s, base, 8)
+	if err != nil {
+		return 0, false
+	}
+	return uint8(parsed), true
+}
+
+func parseHexBytePair(s string) (uint8, uint8, bool) {
+	fields := strings.Fields(s)
+	if len(fields) < 2 {
+		return 0, 0, false
+	}
+	a, okA := parseHexOrDecByte(fields[0])
+	b, okB := parseHexOrDecByte(fields[1])
+	if !okA && !okB {
+		return 0, 0, false
+	}
+	return a, b, true
+}
+
+func emmcSmartStatus(preEOL uint8) string {
+	switch preEOL {
+	case 0x01:
+		return "PASSED"
+	case 0x02:
+		return "WARNING"
+	case 0x03:
+		return "FAILED"
+	default:
+		return "UNKNOWN"
+	}
+}
+
+func emmcPreEOLString(preEOL uint8) string {
+	switch preEOL {
+	case 0x01:
+		return "0x01 (normal)"
+	case 0x02:
+		return "0x02 (warning)"
+	case 0x03:
+		return "0x03 (urgent)"
+	default:
+		return fmt.Sprintf("0x%02x", preEOL)
+	}
+}
+
+func emmcLifeTimeString(v uint8) string {
+	// JEDEC eMMC: 0x01..0x0A => 0-100% used in 10% steps, 0x0B => exceeded.
+	switch {
+	case v == 0:
+		return "0x00 (not reported)"
+	case v >= 0x01 && v <= 0x0A:
+		low := int(v-1) * 10
+		high := int(v) * 10
+		return fmt.Sprintf("0x%02x (%d-%d%% used)", v, low, high)
+	case v == 0x0B:
+		return "0x0b (>100% used)"
+	default:
+		return fmt.Sprintf("0x%02x", v)
+	}
+}

agent/emmc_common_test.go

@@ -0,0 +1,78 @@
+package agent
+
+import "testing"
+
+func TestParseHexOrDecByte(t *testing.T) {
+	tests := []struct {
+		in   string
+		want uint8
+		ok   bool
+	}{
+		{"0x01", 1, true},
+		{"0X0b", 11, true},
+		{"01", 1, true},
+		{" 3 ", 3, true},
+		{"", 0, false},
+		{"0x", 0, false},
+		{"nope", 0, false},
+	}
+
+	for _, tt := range tests {
+		got, ok := parseHexOrDecByte(tt.in)
+		if ok != tt.ok || got != tt.want {
+			t.Fatalf("parseHexOrDecByte(%q) = (%d,%v), want (%d,%v)", tt.in, got, ok, tt.want, tt.ok)
+		}
+	}
+}
+
+func TestParseHexBytePair(t *testing.T) {
+	a, b, ok := parseHexBytePair("0x01 0x02\n")
+	if !ok || a != 1 || b != 2 {
+		t.Fatalf("parseHexBytePair hex = (%d,%d,%v), want (1,2,true)", a, b, ok)
+	}
+
+	a, b, ok = parseHexBytePair("01 02")
+	if !ok || a != 1 || b != 2 {
+		t.Fatalf("parseHexBytePair dec = (%d,%d,%v), want (1,2,true)", a, b, ok)
+	}
+
+	_, _, ok = parseHexBytePair("0x01")
+	if ok {
+		t.Fatalf("parseHexBytePair short input ok=true, want false")
+	}
+}
+
+func TestEmmcSmartStatus(t *testing.T) {
+	if got := emmcSmartStatus(0x01); got != "PASSED" {
+		t.Fatalf("emmcSmartStatus(0x01) = %q, want PASSED", got)
+	}
+	if got := emmcSmartStatus(0x02); got != "WARNING" {
+		t.Fatalf("emmcSmartStatus(0x02) = %q, want WARNING", got)
+	}
+	if got := emmcSmartStatus(0x03); got != "FAILED" {
+		t.Fatalf("emmcSmartStatus(0x03) = %q, want FAILED", got)
+	}
+	if got := emmcSmartStatus(0x00); got != "UNKNOWN" {
+		t.Fatalf("emmcSmartStatus(0x00) = %q, want UNKNOWN", got)
+	}
+}
+
+func TestIsEmmcBlockName(t *testing.T) {
+	cases := []struct {
+		name string
+		ok   bool
+	}{
+		{"mmcblk0", true},
+		{"mmcblk1", true},
+		{"mmcblk10", true},
+		{"mmcblk0p1", false},
+		{"sda", false},
+		{"mmcblk", false},
+		{"mmcblkA", false},
+	}
+	for _, c := range cases {
+		if got := isEmmcBlockName(c.name); got != c.ok {
+			t.Fatalf("isEmmcBlockName(%q) = %v, want %v", c.name, got, c.ok)
+		}
+	}
+}

agent/emmc_linux.go

@@ -0,0 +1,227 @@
+//go:build linux
+
+package agent
+
+import (
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/henrygd/beszel/internal/entities/smart"
+)
+
+// emmcSysfsRoot is a test hook; production value is "/sys".
+var emmcSysfsRoot = "/sys"
+
+type emmcHealth struct {
+	model    string
+	serial   string
+	revision string
+	capacity uint64
+	preEOL   uint8
+	lifeA    uint8
+	lifeB    uint8
+}
+
+func scanEmmcDevices() []*DeviceInfo {
+	blockDir := filepath.Join(emmcSysfsRoot, "class", "block")
+	entries, err := os.ReadDir(blockDir)
+	if err != nil {
+		return nil
+	}
+
+	devices := make([]*DeviceInfo, 0, 2)
+	for _, ent := range entries {
+		name := ent.Name()
+		if !isEmmcBlockName(name) {
+			continue
+		}
+
+		deviceDir := filepath.Join(blockDir, name, "device")
+		if !hasEmmcHealthFiles(deviceDir) {
+			continue
+		}
+
+		devPath := filepath.Join("/dev", name)
+		devices = append(devices, &DeviceInfo{
+			Name:     devPath,
+			Type:     "emmc",
+			InfoName: devPath + " [eMMC]",
+			Protocol: "MMC",
+		})
+	}
+
+	return devices
+}
+
+func (sm *SmartManager) collectEmmcHealth(deviceInfo *DeviceInfo) (bool, error) {
+	if deviceInfo == nil || deviceInfo.Name == "" {
+		return false, nil
+	}
+
+	base := filepath.Base(deviceInfo.Name)
+	if !isEmmcBlockName(base) && !strings.EqualFold(deviceInfo.Type, "emmc") && !strings.EqualFold(deviceInfo.Type, "mmc") {
+		return false, nil
+	}
+
+	health, ok := readEmmcHealth(base)
+	if !ok {
+		return false, nil
+	}
+
+	// Normalize the device type to keep pruning logic stable across refreshes.
+	deviceInfo.Type = "emmc"
+
+	key := health.serial
+	if key == "" {
+		key = filepath.Join("/dev", base)
+	}
+
+	status := emmcSmartStatus(health.preEOL)
+
+	attrs := []*smart.SmartAttribute{
+		{
+			Name:      "PreEOLInfo",
+			RawValue:  uint64(health.preEOL),
+			RawString: emmcPreEOLString(health.preEOL),
+		},
+		{
+			Name:      "DeviceLifeTimeEstA",
+			RawValue:  uint64(health.lifeA),
+			RawString: emmcLifeTimeString(health.lifeA),
+		},
+		{
+			Name:      "DeviceLifeTimeEstB",
+			RawValue:  uint64(health.lifeB),
+			RawString: emmcLifeTimeString(health.lifeB),
+		},
+	}
+
+	sm.Lock()
+	defer sm.Unlock()
+
+	if _, exists := sm.SmartDataMap[key]; !exists {
+		sm.SmartDataMap[key] = &smart.SmartData{}
+	}
+
+	data := sm.SmartDataMap[key]
+	data.ModelName = health.model
+	data.SerialNumber = health.serial
+	data.FirmwareVersion = health.revision
+	data.Capacity = health.capacity
+	data.Temperature = 0
+	data.SmartStatus = status
+	data.DiskName = filepath.Join("/dev", base)
+	data.DiskType = "emmc"
+	data.Attributes = attrs
+
+	return true, nil
+}
+
+func readEmmcHealth(blockName string) (emmcHealth, bool) {
+	var out emmcHealth
+
+	if !isEmmcBlockName(blockName) {
+		return out, false
+	}
+
+	deviceDir := filepath.Join(emmcSysfsRoot, "class", "block", blockName, "device")
+	preEOL, okPre := readHexByteFile(filepath.Join(deviceDir, "pre_eol_info"))
+
+	// Some kernels expose EXT_CSD lifetime via "life_time" (two bytes), others as
+	// separate files. Support both.
+	lifeA, lifeB, okLife := readLifeTime(deviceDir)
+
+	if !okPre && !okLife {
+		return out, false
+	}
+
+	out.preEOL = preEOL
+	out.lifeA = lifeA
+	out.lifeB = lifeB
+
+	out.model = readStringFile(filepath.Join(deviceDir, "name"))
+	out.serial = readStringFile(filepath.Join(deviceDir, "serial"))
+	out.revision = readStringFile(filepath.Join(deviceDir, "prv"))
+
+	if capBytes, ok := readBlockCapacityBytes(blockName); ok {
+		out.capacity = capBytes
+	}
+
+	return out, true
+}
+
+func readLifeTime(deviceDir string) (uint8, uint8, bool) {
+	if content, ok := readStringFileOK(filepath.Join(deviceDir, "life_time")); ok {
+		a, b, ok := parseHexBytePair(content)
+		return a, b, ok
+	}
+
+	a, okA := readHexByteFile(filepath.Join(deviceDir, "device_life_time_est_typ_a"))
+	b, okB := readHexByteFile(filepath.Join(deviceDir, "device_life_time_est_typ_b"))
+	if okA || okB {
+		return a, b, true
+	}
+	return 0, 0, false
+}
+
+func readBlockCapacityBytes(blockName string) (uint64, bool) {
+	sizePath := filepath.Join(emmcSysfsRoot, "class", "block", blockName, "size")
+	lbsPath := filepath.Join(emmcSysfsRoot, "class", "block", blockName, "queue", "logical_block_size")
+
+	sizeStr, ok := readStringFileOK(sizePath)
+	if !ok {
+		return 0, false
+	}
+	sectors, err := strconv.ParseUint(sizeStr, 10, 64)
+	if err != nil || sectors == 0 {
+		return 0, false
+	}
+
+	lbsStr, ok := readStringFileOK(lbsPath)
+	logicalBlockSize := uint64(512)
+	if ok {
+		if parsed, err := strconv.ParseUint(lbsStr, 10, 64); err == nil && parsed > 0 {
+			logicalBlockSize = parsed
+		}
+	}
+
+	return sectors * logicalBlockSize, true
+}
+
+func readHexByteFile(path string) (uint8, bool) {
+	content, ok := readStringFileOK(path)
+	if !ok {
+		return 0, false
+	}
+	b, ok := parseHexOrDecByte(content)
+	return b, ok
+}
+
+func readStringFile(path string) string {
+	content, _ := readStringFileOK(path)
+	return content
+}
+
+func readStringFileOK(path string) (string, bool) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return "", false
+	}
+	return strings.TrimSpace(string(b)), true
+}
+
+func hasEmmcHealthFiles(deviceDir string) bool {
+	entries, err := os.ReadDir(deviceDir)
+	if err != nil {
+		return false
+	}
+	for _, ent := range entries {
+		switch ent.Name() {
+		case "pre_eol_info", "life_time", "device_life_time_est_typ_a", "device_life_time_est_typ_b":
+			return true
+		}
+	}
+	return false
+}

agent/emmc_linux_test.go

@@ -0,0 +1,80 @@
+//go:build linux
+
+package agent
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/henrygd/beszel/internal/entities/smart"
+)
+
+func TestEmmcMockSysfsScanAndCollect(t *testing.T) {
+	tmp := t.TempDir()
+	prev := emmcSysfsRoot
+	emmcSysfsRoot = tmp
+	t.Cleanup(func() { emmcSysfsRoot = prev })
+
+	// Fake: /sys/class/block/mmcblk0
+	mmcDeviceDir := filepath.Join(tmp, "class", "block", "mmcblk0", "device")
+	mmcQueueDir := filepath.Join(tmp, "class", "block", "mmcblk0", "queue")
+	if err := os.MkdirAll(mmcDeviceDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(mmcQueueDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+
+	write := func(path, content string) {
+		t.Helper()
+		if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	write(filepath.Join(mmcDeviceDir, "pre_eol_info"), "0x02\n")
+	write(filepath.Join(mmcDeviceDir, "life_time"), "0x04 0x05\n")
+	write(filepath.Join(mmcDeviceDir, "name"), "H26M52103FMR\n")
+	write(filepath.Join(mmcDeviceDir, "serial"), "01234567\n")
+	write(filepath.Join(mmcDeviceDir, "prv"), "0x08\n")
+	write(filepath.Join(mmcQueueDir, "logical_block_size"), "512\n")
+	write(filepath.Join(tmp, "class", "block", "mmcblk0", "size"), "1024\n") // sectors
+
+	devs := scanEmmcDevices()
+	if len(devs) != 1 {
+		t.Fatalf("scanEmmcDevices() = %d devices, want 1", len(devs))
+	}
+	if devs[0].Name != "/dev/mmcblk0" || devs[0].Type != "emmc" {
+		t.Fatalf("scanEmmcDevices()[0] = %+v, want Name=/dev/mmcblk0 Type=emmc", devs[0])
+	}
+
+	sm := &SmartManager{SmartDataMap: map[string]*smart.SmartData{}}
+	ok, err := sm.collectEmmcHealth(devs[0])
+	if err != nil || !ok {
+		t.Fatalf("collectEmmcHealth() = (ok=%v, err=%v), want (true,nil)", ok, err)
+	}
+	if len(sm.SmartDataMap) != 1 {
+		t.Fatalf("SmartDataMap len=%d, want 1", len(sm.SmartDataMap))
+	}
+	var got *smart.SmartData
+	for _, v := range sm.SmartDataMap {
+		got = v
+		break
+	}
+	if got == nil {
+		t.Fatalf("SmartDataMap value nil")
+	}
+	if got.DiskType != "emmc" || got.DiskName != "/dev/mmcblk0" {
+		t.Fatalf("disk fields = (type=%q name=%q), want (emmc,/dev/mmcblk0)", got.DiskType, got.DiskName)
+	}
+	if got.SmartStatus != "WARNING" {
+		t.Fatalf("SmartStatus=%q, want WARNING", got.SmartStatus)
+	}
+	if got.SerialNumber != "01234567" || got.ModelName == "" || got.Capacity == 0 {
+		t.Fatalf("identity fields = (model=%q serial=%q cap=%d), want non-empty model, serial 01234567, cap>0", got.ModelName, got.SerialNumber, got.Capacity)
+	}
+	if len(got.Attributes) < 3 {
+		t.Fatalf("attributes len=%d, want >= 3", len(got.Attributes))
+	}
+}

agent/emmc_stub.go

@@ -0,0 +1,14 @@
+//go:build !linux
+
+package agent
+
+// Non-Linux builds: eMMC health via sysfs is not available.
+
+func scanEmmcDevices() []*DeviceInfo {
+	return nil
+}
+
+func (sm *SmartManager) collectEmmcHealth(deviceInfo *DeviceInfo) (bool, error) {
+	return false, nil
+}
+

agent/fingerprint.go

@@ -0,0 +1,87 @@
+package agent
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/shirou/gopsutil/v4/cpu"
+	"github.com/shirou/gopsutil/v4/host"
+)
+
+const fingerprintFileName = "fingerprint"
+
+// knownBadUUID is a commonly known "product_uuid" that is not unique across systems.
+const knownBadUUID = "03000200-0400-0500-0006-000700080009"
+
+// GetFingerprint returns the agent fingerprint. It first tries to read a saved
+// fingerprint from the data directory. If not found (or dataDir is empty), it
+// generates one from system properties. The hostname and cpuModel parameters are
+// used as fallback material if host.HostID() fails. If either is empty, they
+// are fetched from the system automatically.
+//
+// If a new fingerprint is generated and a dataDir is provided, it is saved.
+func GetFingerprint(dataDir, hostname, cpuModel string) string {
+	if dataDir != "" {
+		if fp, err := readFingerprint(dataDir); err == nil {
+			return fp
+		}
+	}
+	fp := generateFingerprint(hostname, cpuModel)
+	if dataDir != "" {
+		_ = SaveFingerprint(dataDir, fp)
+	}
+	return fp
+}
+
+// generateFingerprint creates a fingerprint from system properties.
+// It tries host.HostID() first, falling back to hostname + cpuModel.
+// If hostname or cpuModel are empty, they are fetched from the system.
+func generateFingerprint(hostname, cpuModel string) string {
+	fingerprint, err := host.HostID()
+	if err != nil || fingerprint == "" || fingerprint == knownBadUUID {
+		if hostname == "" {
+			hostname, _ = os.Hostname()
+		}
+		if cpuModel == "" {
+			if info, err := cpu.Info(); err == nil && len(info) > 0 {
+				cpuModel = info[0].ModelName
+			}
+		}
+		fingerprint = hostname + cpuModel
+	}
+
+	sum := sha256.Sum256([]byte(fingerprint))
+	return hex.EncodeToString(sum[:24])
+}
+
+// readFingerprint reads the saved fingerprint from the data directory.
+func readFingerprint(dataDir string) (string, error) {
+	fp, err := os.ReadFile(filepath.Join(dataDir, fingerprintFileName))
+	if err != nil {
+		return "", err
+	}
+	s := strings.TrimSpace(string(fp))
+	if s == "" {
+		return "", errors.New("fingerprint file is empty")
+	}
+	return s, nil
+}
+
+// SaveFingerprint writes the fingerprint to the data directory.
+func SaveFingerprint(dataDir, fingerprint string) error {
+	return os.WriteFile(filepath.Join(dataDir, fingerprintFileName), []byte(fingerprint), 0o644)
+}
+
+// DeleteFingerprint removes the saved fingerprint file from the data directory.
+// Returns nil if the file does not exist (idempotent).
+func DeleteFingerprint(dataDir string) error {
+	err := os.Remove(filepath.Join(dataDir, fingerprintFileName))
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	return err
+}

agent/fingerprint_test.go

@@ -0,0 +1,102 @@
+//go:build testing
+
+package agent
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetFingerprint(t *testing.T) {
+	t.Run("reads existing fingerprint from file", func(t *testing.T) {
+		dir := t.TempDir()
+		expected := "abc123def456"
+		err := os.WriteFile(filepath.Join(dir, fingerprintFileName), []byte(expected), 0644)
+		require.NoError(t, err)
+
+		fp := GetFingerprint(dir, "", "")
+		assert.Equal(t, expected, fp)
+	})
+
+	t.Run("trims whitespace from file", func(t *testing.T) {
+		dir := t.TempDir()
+		err := os.WriteFile(filepath.Join(dir, fingerprintFileName), []byte("  abc123  \n"), 0644)
+		require.NoError(t, err)
+
+		fp := GetFingerprint(dir, "", "")
+		assert.Equal(t, "abc123", fp)
+	})
+
+	t.Run("generates fingerprint when file does not exist", func(t *testing.T) {
+		dir := t.TempDir()
+		fp := GetFingerprint(dir, "", "")
+		assert.NotEmpty(t, fp)
+	})
+
+	t.Run("generates fingerprint when dataDir is empty", func(t *testing.T) {
+		fp := GetFingerprint("", "", "")
+		assert.NotEmpty(t, fp)
+	})
+
+	t.Run("generates consistent fingerprint for same inputs", func(t *testing.T) {
+		fp1 := GetFingerprint("", "myhost", "mycpu")
+		fp2 := GetFingerprint("", "myhost", "mycpu")
+		assert.Equal(t, fp1, fp2)
+	})
+
+	t.Run("prefers saved fingerprint over generated", func(t *testing.T) {
+		dir := t.TempDir()
+		require.NoError(t, SaveFingerprint(dir, "saved-fp"))
+
+		fp := GetFingerprint(dir, "anyhost", "anycpu")
+		assert.Equal(t, "saved-fp", fp)
+	})
+}
+
+func TestSaveFingerprint(t *testing.T) {
+	t.Run("saves fingerprint to file", func(t *testing.T) {
+		dir := t.TempDir()
+		err := SaveFingerprint(dir, "abc123")
+		require.NoError(t, err)
+
+		content, err := os.ReadFile(filepath.Join(dir, fingerprintFileName))
+		require.NoError(t, err)
+		assert.Equal(t, "abc123", string(content))
+	})
+
+	t.Run("overwrites existing fingerprint", func(t *testing.T) {
+		dir := t.TempDir()
+		require.NoError(t, SaveFingerprint(dir, "old"))
+		require.NoError(t, SaveFingerprint(dir, "new"))
+
+		content, err := os.ReadFile(filepath.Join(dir, fingerprintFileName))
+		require.NoError(t, err)
+		assert.Equal(t, "new", string(content))
+	})
+}
+
+func TestDeleteFingerprint(t *testing.T) {
+	t.Run("deletes existing fingerprint", func(t *testing.T) {
+		dir := t.TempDir()
+		fp := filepath.Join(dir, fingerprintFileName)
+		err := os.WriteFile(fp, []byte("abc123"), 0644)
+		require.NoError(t, err)
+
+		err = DeleteFingerprint(dir)
+		require.NoError(t, err)
+
+		// Verify file is gone
+		_, err = os.Stat(fp)
+		assert.True(t, os.IsNotExist(err))
+	})
+
+	t.Run("no error when file does not exist", func(t *testing.T) {
+		dir := t.TempDir()
+		err := DeleteFingerprint(dir)
+		assert.NoError(t, err)
+	})
+}

agent/gpu.go

@@ -5,16 +5,17 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
+	"log/slog"
+	"maps"
 	"os/exec"
 	"regexp"
+	"runtime"
 	"strconv"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/henrygd/beszel/internal/entities/system"
-
-	"golang.org/x/exp/slog"
 )
 
 const (
@@ -22,18 +23,15 @@ const (
 	nvidiaSmiCmd    string = "nvidia-smi"
 	rocmSmiCmd      string = "rocm-smi"
 	tegraStatsCmd   string = "tegrastats"
-
+	nvtopCmd        string = "nvtop"
-	// Polling intervals
+	powermetricsCmd string = "powermetrics"
-	nvidiaSmiInterval  string        = "4"    // in seconds
+	macmonCmd       string = "macmon"
-	tegraStatsInterval string        = "3700" // in milliseconds
+	noGPUFoundMsg   string = "no GPU found - see https://beszel.dev/guide/gpu"
-	rocmSmiInterval    time.Duration = 4300 * time.Millisecond
 
 	// Command retry and timeout constants
 	retryWaitTime     time.Duration = 5 * time.Second
 	maxFailureRetries int           = 5
 
-	cmdBufferSize uint16 = 10 * 1024
-
 	// Unit Conversions
 	mebibytesInAMegabyte float64 = 1.024  // nvidia-smi reports memory in MiB
 	milliwattsInAWatt    float64 = 1000.0 // tegrastats reports power in mW
@@ -42,10 +40,22 @@ const (
 // GPUManager manages data collection for GPUs (either Nvidia or AMD)
 type GPUManager struct {
 	sync.Mutex
-	nvidiaSmi  bool
-	rocmSmi    bool
-	tegrastats bool
 	GpuDataMap map[string]*system.GPUData
+	// lastAvgData stores the last calculated averages for each GPU
+	// Used when a collection happens before new data arrives (Count == 0)
+	lastAvgData map[string]system.GPUData
+	// Per-cache-key tracking for delta calculations
+	// cacheKey -> gpuId -> snapshot of last count/usage/power values
+	lastSnapshots map[uint16]map[string]*gpuSnapshot
+}
+
+// gpuSnapshot stores the last observed incremental values for delta tracking
+type gpuSnapshot struct {
+	count    uint32
+	usage    float64
+	power    float64
+	powerPkg float64
+	engines  map[string]float64
 }
 
 // RocmSmiJson represents the JSON structure of rocm-smi output
@@ -66,10 +76,63 @@ type gpuCollector struct {
 	cmdArgs []string
 	parse   func([]byte) bool // returns true if valid data was found
 	buf     []byte
+	bufSize uint16
 }
 
 var errNoValidData = fmt.Errorf("no valid GPU data found") // Error for missing data
 
+// collectorSource identifies a selectable GPU collector in GPU_COLLECTOR.
+type collectorSource string
+
+const (
+	collectorSourceNVTop        collectorSource = collectorSource(nvtopCmd)
+	collectorSourceNVML         collectorSource = "nvml"
+	collectorSourceNvidiaSMI    collectorSource = collectorSource(nvidiaSmiCmd)
+	collectorSourceIntelGpuTop  collectorSource = collectorSource(intelGpuStatsCmd)
+	collectorSourceAmdSysfs     collectorSource = "amd_sysfs"
+	collectorSourceRocmSMI      collectorSource = collectorSource(rocmSmiCmd)
+	collectorSourceMacmon       collectorSource = collectorSource(macmonCmd)
+	collectorSourcePowermetrics collectorSource = collectorSource(powermetricsCmd)
+	collectorGroupNvidia        string          = "nvidia"
+	collectorGroupIntel         string          = "intel"
+	collectorGroupAmd           string          = "amd"
+	collectorGroupApple         string          = "apple"
+)
+
+func isValidCollectorSource(source collectorSource) bool {
+	switch source {
+	case collectorSourceNVTop,
+		collectorSourceNVML,
+		collectorSourceNvidiaSMI,
+		collectorSourceIntelGpuTop,
+		collectorSourceAmdSysfs,
+		collectorSourceRocmSMI,
+		collectorSourceMacmon,
+		collectorSourcePowermetrics:
+		return true
+	}
+	return false
+}
+
+// gpuCapabilities describes detected GPU tooling and sysfs support on the host.
+type gpuCapabilities struct {
+	hasNvidiaSmi    bool
+	hasRocmSmi      bool
+	hasAmdSysfs     bool
+	hasTegrastats   bool
+	hasIntelGpuTop  bool
+	hasNvtop        bool
+	hasMacmon       bool
+	hasPowermetrics bool
+}
+
+type collectorDefinition struct {
+	group              string
+	available          bool
+	start              func(onFailure func()) bool
+	deprecationWarning string
+}
+
 // starts and manages the ongoing collection of GPU data for the specified GPU management utility
 func (c *gpuCollector) start() {
 	for {
@@ -99,7 +162,7 @@ func (c *gpuCollector) collect() error {
 
 	scanner := bufio.NewScanner(stdout)
 	if c.buf == nil {
-		c.buf = make([]byte, 0, cmdBufferSize)
+		c.buf = make([]byte, 0, c.bufSize)
 	}
 	scanner.Buffer(c.buf, bufio.MaxScanTokenSize)
 
@@ -121,10 +184,10 @@ func (gm *GPUManager) getJetsonParser() func(output []byte) bool {
 	// use closure to avoid recompiling the regex
 	ramPattern := regexp.MustCompile(`RAM (\d+)/(\d+)MB`)
 	gr3dPattern := regexp.MustCompile(`GR3D_FREQ (\d+)%`)
-	tempPattern := regexp.MustCompile(`tj@(\d+\.?\d*)C`)
+	tempPattern := regexp.MustCompile(`(?:tj|GPU)@(\d+\.?\d*)C`)
 	// Orin Nano / NX do not have GPU specific power monitor
 	// TODO: Maybe use VDD_IN for Nano / NX and add a total system power chart
-	powerPattern := regexp.MustCompile(`(GPU_SOC|CPU_GPU_CV) (\d+)mW`)
+	powerPattern := regexp.MustCompile(`(GPU_SOC|CPU_GPU_CV)\s+(\d+)mW|VDD_SYS_GPU\s+(\d+)/\d+`)
 
 	// jetson devices have only one gpu so we'll just initialize here
 	gpuData := &system.GPUData{Name: "GPU"}
@@ -153,7 +216,13 @@ func (gm *GPUManager) getJetsonParser() func(output []byte) bool {
 		// Parse power usage
 		powerMatches := powerPattern.FindSubmatch(output)
 		if powerMatches != nil {
-			power, _ := strconv.ParseFloat(string(powerMatches[2]), 64)
+			// powerMatches[2] is the "(GPU_SOC|CPU_GPU_CV) <N>mW" capture
+			// powerMatches[3] is the "VDD_SYS_GPU <N>/<N>" capture
+			powerStr := string(powerMatches[2])
+			if powerStr == "" {
+				powerStr = string(powerMatches[3])
+			}
+			power, _ := strconv.ParseFloat(powerStr, 64)
 			gpuData.Power += power / milliwattsInAWatt
 		}
 		gpuData.Count++
@@ -216,10 +285,11 @@ func (gm *GPUManager) parseAmdData(output []byte) bool {
 		totalMemory, _ := strconv.ParseFloat(v.MemoryTotal, 64)
 		usage, _ := strconv.ParseFloat(v.Usage, 64)
 
-		if _, ok := gm.GpuDataMap[v.ID]; !ok {
+		id := v.ID
-			gm.GpuDataMap[v.ID] = &system.GPUData{Name: v.Name}
+		if _, ok := gm.GpuDataMap[id]; !ok {
+			gm.GpuDataMap[id] = &system.GPUData{Name: v.Name}
 		}
-		gpu := gm.GpuDataMap[v.ID]
+		gpu := gm.GpuDataMap[id]
 		gpu.Temperature, _ = strconv.ParseFloat(v.Temperature, 64)
 		gpu.MemoryUsed = bytesToMegabytes(memoryUsage)
 		gpu.MemoryTotal = bytesToMegabytes(totalMemory)
@@ -230,36 +300,21 @@ func (gm *GPUManager) parseAmdData(output []byte) bool {
 	return true
 }
 
-// sums and resets the current GPU utilization data since the last update
+// GetCurrentData returns GPU utilization data averaged since the last call with this cacheKey
-func (gm *GPUManager) GetCurrentData() map[string]system.GPUData {
+func (gm *GPUManager) GetCurrentData(cacheKey uint16) map[string]system.GPUData {
 	gm.Lock()
 	defer gm.Unlock()
 
-	// check for GPUs with the same name
+	gm.initializeSnapshots(cacheKey)
-	nameCounts := make(map[string]int)
+	nameCounts := gm.countGPUNames()
-	for _, gpu := range gm.GpuDataMap {
-		nameCounts[gpu.Name]++
-	}
 
-	// copy / reset the data
 	gpuData := make(map[string]system.GPUData, len(gm.GpuDataMap))
 	for id, gpu := range gm.GpuDataMap {
-		gpuAvg := *gpu
+		gpuAvg := gm.calculateGPUAverage(id, gpu, cacheKey)
+		gm.updateInstantaneousValues(&gpuAvg, gpu)
+		gm.storeSnapshot(id, gpu, cacheKey)
 
-		gpuAvg.Temperature = twoDecimals(gpu.Temperature)
+		// Append id to name if there are multiple GPUs with the same name
-		gpuAvg.MemoryUsed = twoDecimals(gpu.MemoryUsed)
-		gpuAvg.MemoryTotal = twoDecimals(gpu.MemoryTotal)
-
-		// avoid division by zero
-		if gpu.Count > 0 {
-			gpuAvg.Usage = twoDecimals(gpu.Usage / gpu.Count)
-			gpuAvg.Power = twoDecimals(gpu.Power / gpu.Count)
-		}
-
-		// reset accumulators in the original
-		gpu.Usage, gpu.Power, gpu.Count = 0, 0, 0
-
-		// append id to the name if there are multiple GPUs with the same name
 		if nameCounts[gpu.Name] > 1 {
 			gpuAvg.Name = fmt.Sprintf("%s %s", gpu.Name, id)
 		}
@@ -269,48 +324,204 @@ func (gm *GPUManager) GetCurrentData() map[string]system.GPUData {
 	return gpuData
 }
 
-// detectGPUs checks for the presence of GPU management tools (nvidia-smi, rocm-smi, tegrastats)
+// initializeSnapshots ensures snapshot maps are initialized for the given cache key
-// in the system path. It sets the corresponding flags in the GPUManager struct if any of these
+func (gm *GPUManager) initializeSnapshots(cacheKey uint16) {
-// tools are found. If none of the tools are found, it returns an error indicating that no GPU
+	if gm.lastAvgData == nil {
-// management tools are available.
+		gm.lastAvgData = make(map[string]system.GPUData)
-func (gm *GPUManager) detectGPUs() error {
-	if _, err := exec.LookPath(nvidiaSmiCmd); err == nil {
-		gm.nvidiaSmi = true
 	}
-	if _, err := exec.LookPath(rocmSmiCmd); err == nil {
+	if gm.lastSnapshots == nil {
-		gm.rocmSmi = true
+		gm.lastSnapshots = make(map[uint16]map[string]*gpuSnapshot)
 	}
-	if _, err := exec.LookPath(tegraStatsCmd); err == nil {
+	if gm.lastSnapshots[cacheKey] == nil {
-		gm.tegrastats = true
+		gm.lastSnapshots[cacheKey] = make(map[string]*gpuSnapshot)
-		gm.nvidiaSmi = false
 	}
-	if gm.nvidiaSmi || gm.rocmSmi || gm.tegrastats {
-		return nil
-	}
-	return fmt.Errorf("no GPU found - install nvidia-smi, rocm-smi, or tegrastats")
 }
 
-// startCollector starts the appropriate GPU data collector based on the command
+// countGPUNames returns a map of GPU names to their occurrence count
-func (gm *GPUManager) startCollector(command string) {
+func (gm *GPUManager) countGPUNames() map[string]int {
-	collector := gpuCollector{
+	nameCounts := make(map[string]int)
-		name: command,
+	for _, gpu := range gm.GpuDataMap {
+		nameCounts[gpu.Name]++
 	}
-	switch command {
+	return nameCounts
-	case nvidiaSmiCmd:
+}
-		collector.cmdArgs = []string{
+
-			"-l", nvidiaSmiInterval,
+// calculateGPUAverage computes the average GPU metrics since the last snapshot for this cache key
+func (gm *GPUManager) calculateGPUAverage(id string, gpu *system.GPUData, cacheKey uint16) system.GPUData {
+	lastSnapshot := gm.lastSnapshots[cacheKey][id]
+	currentCount := uint32(gpu.Count)
+	deltaCount := gm.calculateDeltaCount(currentCount, lastSnapshot)
+
+	// If no new data arrived
+	if deltaCount == 0 {
+		// If GPU appears suspended (instantaneous values are 0), return zero values
+		// Otherwise return last known average for temporary collection gaps
+		if gpu.Temperature == 0 && gpu.MemoryUsed == 0 {
+			return system.GPUData{Name: gpu.Name}
+		}
+		return gm.lastAvgData[id] // zero value if not found
+	}
+
+	// Calculate new average
+	gpuAvg := *gpu
+	deltaUsage, deltaPower, deltaPowerPkg := gm.calculateDeltas(gpu, lastSnapshot)
+
+	gpuAvg.Power = twoDecimals(deltaPower / float64(deltaCount))
+
+	if gpu.Engines != nil {
+		// make fresh map for averaged engine metrics to avoid mutating
+		// the accumulator map stored in gm.GpuDataMap
+		gpuAvg.Engines = make(map[string]float64, len(gpu.Engines))
+		gpuAvg.Usage = gm.calculateIntelGPUUsage(&gpuAvg, gpu, lastSnapshot, deltaCount)
+		gpuAvg.PowerPkg = twoDecimals(deltaPowerPkg / float64(deltaCount))
+	} else {
+		gpuAvg.Usage = twoDecimals(deltaUsage / float64(deltaCount))
+	}
+
+	gm.lastAvgData[id] = gpuAvg
+	return gpuAvg
+}
+
+// calculateDeltaCount returns the change in count since the last snapshot
+func (gm *GPUManager) calculateDeltaCount(currentCount uint32, lastSnapshot *gpuSnapshot) uint32 {
+	if lastSnapshot != nil {
+		return currentCount - lastSnapshot.count
+	}
+	return currentCount
+}
+
+// calculateDeltas computes the change in usage, power, and powerPkg since the last snapshot
+func (gm *GPUManager) calculateDeltas(gpu *system.GPUData, lastSnapshot *gpuSnapshot) (deltaUsage, deltaPower, deltaPowerPkg float64) {
+	if lastSnapshot != nil {
+		return gpu.Usage - lastSnapshot.usage,
+			gpu.Power - lastSnapshot.power,
+			gpu.PowerPkg - lastSnapshot.powerPkg
+	}
+	return gpu.Usage, gpu.Power, gpu.PowerPkg
+}
+
+// calculateIntelGPUUsage computes Intel GPU usage from engine metrics and returns max engine usage
+func (gm *GPUManager) calculateIntelGPUUsage(gpuAvg, gpu *system.GPUData, lastSnapshot *gpuSnapshot, deltaCount uint32) float64 {
+	maxEngineUsage := 0.0
+	for name, engine := range gpu.Engines {
+		var deltaEngine float64
+		if lastSnapshot != nil && lastSnapshot.engines != nil {
+			deltaEngine = engine - lastSnapshot.engines[name]
+		} else {
+			deltaEngine = engine
+		}
+		gpuAvg.Engines[name] = twoDecimals(deltaEngine / float64(deltaCount))
+		maxEngineUsage = max(maxEngineUsage, deltaEngine/float64(deltaCount))
+	}
+	return twoDecimals(maxEngineUsage)
+}
+
+// updateInstantaneousValues updates values that should reflect current state, not averages
+func (gm *GPUManager) updateInstantaneousValues(gpuAvg *system.GPUData, gpu *system.GPUData) {
+	gpuAvg.Temperature = twoDecimals(gpu.Temperature)
+	gpuAvg.MemoryUsed = twoDecimals(gpu.MemoryUsed)
+	gpuAvg.MemoryTotal = twoDecimals(gpu.MemoryTotal)
+}
+
+// storeSnapshot saves the current GPU state for this cache key
+func (gm *GPUManager) storeSnapshot(id string, gpu *system.GPUData, cacheKey uint16) {
+	snapshot := &gpuSnapshot{
+		count:    uint32(gpu.Count),
+		usage:    gpu.Usage,
+		power:    gpu.Power,
+		powerPkg: gpu.PowerPkg,
+	}
+	if gpu.Engines != nil {
+		snapshot.engines = make(map[string]float64, len(gpu.Engines))
+		maps.Copy(snapshot.engines, gpu.Engines)
+	}
+	gm.lastSnapshots[cacheKey][id] = snapshot
+}
+
+// discoverGpuCapabilities checks for available GPU tooling and sysfs support.
+// It only reports capability presence and does not apply policy decisions.
+func (gm *GPUManager) discoverGpuCapabilities() gpuCapabilities {
+	caps := gpuCapabilities{
+		hasAmdSysfs: gm.hasAmdSysfs(),
+	}
+	if _, err := exec.LookPath(nvidiaSmiCmd); err == nil {
+		caps.hasNvidiaSmi = true
+	}
+	if _, err := exec.LookPath(rocmSmiCmd); err == nil {
+		caps.hasRocmSmi = true
+	}
+	if _, err := exec.LookPath(tegraStatsCmd); err == nil {
+		caps.hasTegrastats = true
+	}
+	if _, err := exec.LookPath(intelGpuStatsCmd); err == nil {
+		caps.hasIntelGpuTop = true
+	}
+	if _, err := exec.LookPath(nvtopCmd); err == nil {
+		caps.hasNvtop = true
+	}
+	if runtime.GOOS == "darwin" {
+		if _, err := exec.LookPath(macmonCmd); err == nil {
+			caps.hasMacmon = true
+		}
+		if _, err := exec.LookPath(powermetricsCmd); err == nil {
+			caps.hasPowermetrics = true
+		}
+	}
+	return caps
+}
+
+func hasAnyGpuCollector(caps gpuCapabilities) bool {
+	return caps.hasNvidiaSmi || caps.hasRocmSmi || caps.hasAmdSysfs || caps.hasTegrastats || caps.hasIntelGpuTop || caps.hasNvtop || caps.hasMacmon || caps.hasPowermetrics
+}
+
+func (gm *GPUManager) startIntelCollector() {
+	go func() {
+		failures := 0
+		for {
+			if err := gm.collectIntelStats(); err != nil {
+				failures++
+				if failures > maxFailureRetries {
+					break
+				}
+				slog.Warn("Error collecting Intel GPU data; see https://beszel.dev/guide/gpu", "err", err)
+				time.Sleep(retryWaitTime)
+				continue
+			}
+		}
+	}()
+}
+
+func (gm *GPUManager) startNvidiaSmiCollector(intervalSeconds string) {
+	collector := gpuCollector{
+		name:    nvidiaSmiCmd,
+		bufSize: 10 * 1024,
+		cmdArgs: []string{
+			"-l", intervalSeconds,
 			"--query-gpu=index,name,temperature.gpu,memory.used,memory.total,utilization.gpu,power.draw",
 			"--format=csv,noheader,nounits",
+		},
+		parse: gm.parseNvidiaData,
 	}
-		collector.parse = gm.parseNvidiaData
 	go collector.start()
-	case tegraStatsCmd:
+}
-		collector.cmdArgs = []string{"--interval", tegraStatsInterval}
+
-		collector.parse = gm.getJetsonParser()
+func (gm *GPUManager) startTegraStatsCollector(intervalMilliseconds string) {
+	collector := gpuCollector{
+		name:    tegraStatsCmd,
+		bufSize: 10 * 1024,
+		cmdArgs: []string{"--interval", intervalMilliseconds},
+		parse:   gm.getJetsonParser(),
+	}
 	go collector.start()
-	case rocmSmiCmd:
+}
-		collector.cmdArgs = []string{"--showid", "--showtemp", "--showuse", "--showpower", "--showproductname", "--showmeminfo", "vram", "--json"}
+
-		collector.parse = gm.parseAmdData
+func (gm *GPUManager) startRocmSmiCollector(pollInterval time.Duration) {
+	collector := gpuCollector{
+		name:    rocmSmiCmd,
+		bufSize: 10 * 1024,
+		cmdArgs: []string{"--showid", "--showtemp", "--showuse", "--showpower", "--showproductname", "--showmeminfo", "vram", "--json"},
+		parse:   gm.parseAmdData,
+	}
 	go func() {
 		failures := 0
 		for {
@@ -319,30 +530,232 @@ func (gm *GPUManager) startCollector(command string) {
 				if failures > maxFailureRetries {
 					break
 				}
-					slog.Warn("Error collecting AMD GPU data", "err", err)
+				slog.Warn("Error collecting AMD GPU data via rocm-smi", "err", err)
 			}
-				time.Sleep(rocmSmiInterval)
+			time.Sleep(pollInterval)
 		}
 	}()
+}
+
+func (gm *GPUManager) collectorDefinitions(caps gpuCapabilities) map[collectorSource]collectorDefinition {
+	return map[collectorSource]collectorDefinition{
+		collectorSourceNVML: {
+			group:     collectorGroupNvidia,
+			available: caps.hasNvidiaSmi,
+			start: func(_ func()) bool {
+				return gm.startNvmlCollector()
+			},
+		},
+		collectorSourceNvidiaSMI: {
+			group:     collectorGroupNvidia,
+			available: caps.hasNvidiaSmi,
+			start: func(_ func()) bool {
+				gm.startNvidiaSmiCollector("4") // seconds
+				return true
+			},
+		},
+		collectorSourceIntelGpuTop: {
+			group:     collectorGroupIntel,
+			available: caps.hasIntelGpuTop,
+			start: func(_ func()) bool {
+				gm.startIntelCollector()
+				return true
+			},
+		},
+		collectorSourceAmdSysfs: {
+			group:     collectorGroupAmd,
+			available: caps.hasAmdSysfs,
+			start: func(_ func()) bool {
+				return gm.startAmdSysfsCollector()
+			},
+		},
+		collectorSourceRocmSMI: {
+			group:              collectorGroupAmd,
+			available:          caps.hasRocmSmi,
+			deprecationWarning: "rocm-smi is deprecated and may be removed in a future release",
+			start: func(_ func()) bool {
+				gm.startRocmSmiCollector(4300 * time.Millisecond)
+				return true
+			},
+		},
+		collectorSourceNVTop: {
+			available: caps.hasNvtop,
+			start: func(onFailure func()) bool {
+				gm.startNvtopCollector("30", onFailure) // tens of milliseconds
+				return true
+			},
+		},
+		collectorSourceMacmon: {
+			group:     collectorGroupApple,
+			available: caps.hasMacmon,
+			start: func(_ func()) bool {
+				gm.startMacmonCollector()
+				return true
+			},
+		},
+		collectorSourcePowermetrics: {
+			group:     collectorGroupApple,
+			available: caps.hasPowermetrics,
+			start: func(_ func()) bool {
+				gm.startPowermetricsCollector()
+				return true
+			},
+		},
 	}
 }
 
+// parseCollectorPriority parses GPU_COLLECTOR and returns valid ordered entries.
+func parseCollectorPriority(value string) []collectorSource {
+	parts := strings.Split(value, ",")
+	priorities := make([]collectorSource, 0, len(parts))
+	for _, raw := range parts {
+		name := collectorSource(strings.TrimSpace(strings.ToLower(raw)))
+		if !isValidCollectorSource(name) {
+			if name != "" {
+				slog.Warn("Ignoring unknown GPU collector", "collector", name)
+			}
+			continue
+		}
+		priorities = append(priorities, name)
+	}
+	return priorities
+}
+
+// startNvmlCollector initializes NVML and starts its polling loop.
+func (gm *GPUManager) startNvmlCollector() bool {
+	collector := &nvmlCollector{gm: gm}
+	if err := collector.init(); err != nil {
+		slog.Warn("Failed to initialize NVML", "err", err)
+		return false
+	}
+	go collector.start()
+	return true
+}
+
+// startAmdSysfsCollector starts AMD GPU collection via sysfs.
+func (gm *GPUManager) startAmdSysfsCollector() bool {
+	go func() {
+		if err := gm.collectAmdStats(); err != nil {
+			slog.Warn("Error collecting AMD GPU data via sysfs", "err", err)
+		}
+	}()
+	return true
+}
+
+// startCollectorsByPriority starts collectors in order with one source per vendor group.
+func (gm *GPUManager) startCollectorsByPriority(priorities []collectorSource, caps gpuCapabilities) int {
+	definitions := gm.collectorDefinitions(caps)
+	selectedGroups := make(map[string]bool, 3)
+	started := 0
+	for i, source := range priorities {
+		definition, ok := definitions[source]
+		if !ok || !definition.available {
+			continue
+		}
+		// nvtop is not a vendor-specific collector, so should only be used if no other collectors are selected or it is first in GPU_COLLECTOR.
+		if source == collectorSourceNVTop {
+			if len(selectedGroups) > 0 {
+				slog.Warn("Skipping nvtop because other collectors are selected")
+				continue
+			}
+			// if nvtop fails, fall back to remaining collectors.
+			remaining := append([]collectorSource(nil), priorities[i+1:]...)
+			if definition.start(func() {
+				gm.startCollectorsByPriority(remaining, caps)
+			}) {
+				started++
+				return started
+			}
+		}
+		group := definition.group
+		if group == "" || selectedGroups[group] {
+			continue
+		}
+		if definition.deprecationWarning != "" {
+			slog.Warn(definition.deprecationWarning)
+		}
+		if definition.start(nil) {
+			selectedGroups[group] = true
+			started++
+		}
+	}
+	return started
+}
+
+// resolveLegacyCollectorPriority builds the default collector order when GPU_COLLECTOR is unset.
+func (gm *GPUManager) resolveLegacyCollectorPriority(caps gpuCapabilities) []collectorSource {
+	priorities := make([]collectorSource, 0, 4)
+
+	if caps.hasNvidiaSmi && !caps.hasTegrastats {
+		if nvml, _ := GetEnv("NVML"); nvml == "true" {
+			priorities = append(priorities, collectorSourceNVML, collectorSourceNvidiaSMI)
+		} else {
+			priorities = append(priorities, collectorSourceNvidiaSMI)
+		}
+	}
+
+	if caps.hasRocmSmi {
+		if val, _ := GetEnv("AMD_SYSFS"); val == "true" {
+			priorities = append(priorities, collectorSourceAmdSysfs)
+		} else {
+			priorities = append(priorities, collectorSourceRocmSMI)
+		}
+	} else if caps.hasAmdSysfs {
+		priorities = append(priorities, collectorSourceAmdSysfs)
+	}
+
+	if caps.hasIntelGpuTop {
+		priorities = append(priorities, collectorSourceIntelGpuTop)
+	}
+
+	// Apple collectors are currently opt-in only for testing.
+	// Enable them with GPU_COLLECTOR=macmon or GPU_COLLECTOR=powermetrics.
+	// TODO: uncomment below when Apple collectors are confirmed to be working.
+	//
+	// Prefer macmon on macOS (no sudo). Fall back to powermetrics if present.
+	// if caps.hasMacmon {
+	// 	priorities = append(priorities, collectorSourceMacmon)
+	// } else if caps.hasPowermetrics {
+	// 	priorities = append(priorities, collectorSourcePowermetrics)
+	// }
+
+	// Keep nvtop as a last resort only when no vendor collector exists.
+	if len(priorities) == 0 && caps.hasNvtop {
+		priorities = append(priorities, collectorSourceNVTop)
+	}
+	return priorities
+}
+
 // NewGPUManager creates and initializes a new GPUManager
 func NewGPUManager() (*GPUManager, error) {
+	if skipGPU, _ := GetEnv("SKIP_GPU"); skipGPU == "true" {
+		return nil, nil
+	}
 	var gm GPUManager
-	if err := gm.detectGPUs(); err != nil {
+	caps := gm.discoverGpuCapabilities()
-		return nil, err
+	if !hasAnyGpuCollector(caps) {
+		return nil, fmt.Errorf(noGPUFoundMsg)
 	}
 	gm.GpuDataMap = make(map[string]*system.GPUData)
 
-	if gm.nvidiaSmi {
+	// Jetson devices should always use tegrastats (ignore GPU_COLLECTOR).
-		gm.startCollector(nvidiaSmiCmd)
+	if caps.hasTegrastats {
+		gm.startTegraStatsCollector("3700")
+		return &gm, nil
 	}
-	if gm.rocmSmi {
+
-		gm.startCollector(rocmSmiCmd)
+	// if GPU_COLLECTOR is set, start user-defined collectors.
+	if collectorConfig, ok := GetEnv("GPU_COLLECTOR"); ok && strings.TrimSpace(collectorConfig) != "" {
+		priorities := parseCollectorPriority(collectorConfig)
+		if gm.startCollectorsByPriority(priorities, caps) == 0 {
+			return nil, fmt.Errorf("no configured GPU collectors are available")
 		}
-	if gm.tegrastats {
+		return &gm, nil
-		gm.startCollector(tegraStatsCmd)
+	}
+
+	// auto-detect and start collectors when GPU_COLLECTOR is unset.
+	if gm.startCollectorsByPriority(gm.resolveLegacyCollectorPriority(caps), caps) == 0 {
+		return nil, fmt.Errorf(noGPUFoundMsg)
 	}
 
 	return &gm, nil

agent/gpu_amd_linux.go

@@ -0,0 +1,302 @@
+//go:build linux
+
+package agent
+
+import (
+	"bufio"
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+)
+
+var amdgpuNameCache = struct {
+	sync.RWMutex
+	hits   map[string]string
+	misses map[string]struct{}
+}{
+	hits:   make(map[string]string),
+	misses: make(map[string]struct{}),
+}
+
+// hasAmdSysfs returns true if any AMD GPU sysfs nodes are found
+func (gm *GPUManager) hasAmdSysfs() bool {
+	cards, err := filepath.Glob("/sys/class/drm/card*/device/vendor")
+	if err != nil {
+		return false
+	}
+	for _, vendorPath := range cards {
+		vendor, err := os.ReadFile(vendorPath)
+		if err == nil && strings.TrimSpace(string(vendor)) == "0x1002" {
+			return true
+		}
+	}
+	return false
+}
+
+// collectAmdStats collects AMD GPU metrics directly from sysfs to avoid the overhead of rocm-smi
+func (gm *GPUManager) collectAmdStats() error {
+	sysfsPollInterval := 3000 * time.Millisecond
+	cards, err := filepath.Glob("/sys/class/drm/card*")
+	if err != nil {
+		return err
+	}
+
+	var amdGpuPaths []string
+	for _, card := range cards {
+		// Ignore symbolic links and non-main card directories
+		if strings.Contains(filepath.Base(card), "-") || !isAmdGpu(card) {
+			continue
+		}
+		amdGpuPaths = append(amdGpuPaths, card)
+	}
+
+	if len(amdGpuPaths) == 0 {
+		return errNoValidData
+	}
+
+	slog.Debug("Using sysfs for AMD GPU data collection")
+
+	failures := 0
+	for {
+		hasData := false
+		for _, cardPath := range amdGpuPaths {
+			if gm.updateAmdGpuData(cardPath) {
+				hasData = true
+			}
+		}
+		if !hasData {
+			failures++
+			if failures > maxFailureRetries {
+				return errNoValidData
+			}
+			slog.Warn("No AMD GPU data from sysfs", "failures", failures)
+			time.Sleep(retryWaitTime)
+			continue
+		}
+		failures = 0
+		time.Sleep(sysfsPollInterval)
+	}
+}
+
+// isAmdGpu checks whether a DRM card path belongs to AMD vendor ID 0x1002.
+func isAmdGpu(cardPath string) bool {
+	vendorPath := filepath.Join(cardPath, "device/vendor")
+	vendor, err := os.ReadFile(vendorPath)
+	if err != nil {
+		return false
+	}
+	return strings.TrimSpace(string(vendor)) == "0x1002"
+}
+
+// updateAmdGpuData reads GPU metrics from sysfs and updates the GPU data map.
+// Returns true if at least some data was successfully read.
+func (gm *GPUManager) updateAmdGpuData(cardPath string) bool {
+	devicePath := filepath.Join(cardPath, "device")
+	id := filepath.Base(cardPath)
+
+	// Read all sysfs values first (no lock needed - these can be slow)
+	usage, usageErr := readSysfsFloat(filepath.Join(devicePath, "gpu_busy_percent"))
+	memUsed, memUsedErr := readSysfsFloat(filepath.Join(devicePath, "mem_info_vram_used"))
+	memTotal, _ := readSysfsFloat(filepath.Join(devicePath, "mem_info_vram_total"))
+	// if gtt is present, add it to the memory used and total (https://github.com/henrygd/beszel/issues/1569#issuecomment-3837640484)
+	if gttUsed, err := readSysfsFloat(filepath.Join(devicePath, "mem_info_gtt_used")); err == nil && gttUsed > 0 {
+		if gttTotal, err := readSysfsFloat(filepath.Join(devicePath, "mem_info_gtt_total")); err == nil {
+			memUsed += gttUsed
+			memTotal += gttTotal
+		}
+	}
+
+	var temp, power float64
+	hwmons, _ := filepath.Glob(filepath.Join(devicePath, "hwmon/hwmon*"))
+	for _, hwmonDir := range hwmons {
+		if t, err := readSysfsFloat(filepath.Join(hwmonDir, "temp1_input")); err == nil {
+			temp = t / 1000.0
+		}
+		if p, err := readSysfsFloat(filepath.Join(hwmonDir, "power1_average")); err == nil {
+			power += p / 1000000.0
+		} else if p, err := readSysfsFloat(filepath.Join(hwmonDir, "power1_input")); err == nil {
+			power += p / 1000000.0
+		}
+	}
+
+	// Check if we got any meaningful data
+	if usageErr != nil && memUsedErr != nil && temp == 0 {
+		return false
+	}
+
+	// Single lock to update all values atomically
+	gm.Lock()
+	defer gm.Unlock()
+
+	gpu, ok := gm.GpuDataMap[id]
+	if !ok {
+		gpu = &system.GPUData{Name: getAmdGpuName(devicePath)}
+		gm.GpuDataMap[id] = gpu
+	}
+
+	if usageErr == nil {
+		gpu.Usage += usage
+	}
+	gpu.MemoryUsed = bytesToMegabytes(memUsed)
+	gpu.MemoryTotal = bytesToMegabytes(memTotal)
+	gpu.Temperature = temp
+	gpu.Power += power
+	gpu.Count++
+	return true
+}
+
+// readSysfsFloat reads and parses a numeric value from a sysfs file.
+func readSysfsFloat(path string) (float64, error) {
+	val, err := os.ReadFile(path)
+	if err != nil {
+		return 0, err
+	}
+	return strconv.ParseFloat(strings.TrimSpace(string(val)), 64)
+}
+
+// normalizeHexID normalizes hex IDs by trimming spaces, lowercasing, and dropping 0x.
+func normalizeHexID(id string) string {
+	return strings.TrimPrefix(strings.ToLower(strings.TrimSpace(id)), "0x")
+}
+
+// cacheKeyForAmdgpu builds the cache key for a device and optional revision.
+func cacheKeyForAmdgpu(deviceID, revisionID string) string {
+	if revisionID != "" {
+		return deviceID + ":" + revisionID
+	}
+	return deviceID
+}
+
+// lookupAmdgpuNameInFile resolves an AMDGPU name from amdgpu.ids by device/revision.
+func lookupAmdgpuNameInFile(deviceID, revisionID, filePath string) (name string, exact bool, found bool) {
+	file, err := os.Open(filePath)
+	if err != nil {
+		return "", false, false
+	}
+	defer file.Close()
+
+	var byDevice string
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		parts := strings.SplitN(line, ",", 3)
+		if len(parts) != 3 {
+			continue
+		}
+
+		dev := normalizeHexID(parts[0])
+		rev := normalizeHexID(parts[1])
+		productName := strings.TrimSpace(parts[2])
+		if dev == "" || productName == "" || dev != deviceID {
+			continue
+		}
+		if byDevice == "" {
+			byDevice = productName
+		}
+		if revisionID != "" && rev == revisionID {
+			return productName, true, true
+		}
+	}
+	if byDevice != "" {
+		return byDevice, false, true
+	}
+	return "", false, false
+}
+
+// getCachedAmdgpuName returns cached hit/miss status for the given device/revision.
+func getCachedAmdgpuName(deviceID, revisionID string) (name string, found bool, done bool) {
+	// Build the list of cache keys to check. We always look up the exact device+revision key.
+	// When revisionID is set, we also look up deviceID alone, since the cache may store a
+	// device-only fallback when we couldn't resolve the exact revision.
+	keys := []string{cacheKeyForAmdgpu(deviceID, revisionID)}
+	if revisionID != "" {
+		keys = append(keys, deviceID)
+	}
+
+	knownMisses := 0
+	amdgpuNameCache.RLock()
+	defer amdgpuNameCache.RUnlock()
+	for _, key := range keys {
+		if name, ok := amdgpuNameCache.hits[key]; ok {
+			return name, true, true
+		}
+		if _, ok := amdgpuNameCache.misses[key]; ok {
+			knownMisses++
+		}
+	}
+	// done=true means "don't bother doing slow lookup": we either found a name (above) or
+	// every key we checked was already a known miss, so we've tried before and failed.
+	return "", false, knownMisses == len(keys)
+}
+
+// normalizeAmdgpuName trims standard suffixes from AMDGPU product names.
+func normalizeAmdgpuName(name string) string {
+	for _, suffix := range []string{" Graphics", " Series"} {
+		name = strings.TrimSuffix(name, suffix)
+	}
+	return name
+}
+
+// cacheAmdgpuName stores a resolved AMDGPU name in the lookup cache.
+func cacheAmdgpuName(deviceID, revisionID, name string, exact bool) {
+	name = normalizeAmdgpuName(name)
+	amdgpuNameCache.Lock()
+	defer amdgpuNameCache.Unlock()
+	if exact && revisionID != "" {
+		amdgpuNameCache.hits[cacheKeyForAmdgpu(deviceID, revisionID)] = name
+	}
+	amdgpuNameCache.hits[deviceID] = name
+}
+
+// cacheMissingAmdgpuName records unresolved device/revision lookups.
+func cacheMissingAmdgpuName(deviceID, revisionID string) {
+	amdgpuNameCache.Lock()
+	defer amdgpuNameCache.Unlock()
+	amdgpuNameCache.misses[deviceID] = struct{}{}
+	if revisionID != "" {
+		amdgpuNameCache.misses[cacheKeyForAmdgpu(deviceID, revisionID)] = struct{}{}
+	}
+}
+
+// getAmdGpuName attempts to get a descriptive GPU name.
+// First tries product_name (rarely available), then looks up the PCI device ID.
+// Falls back to showing the raw device ID if not found in the lookup table.
+func getAmdGpuName(devicePath string) string {
+	// Try product_name first (works for some enterprise GPUs)
+	if prod, err := os.ReadFile(filepath.Join(devicePath, "product_name")); err == nil {
+		return strings.TrimSpace(string(prod))
+	}
+
+	// Read PCI device ID and look it up
+	if deviceID, err := os.ReadFile(filepath.Join(devicePath, "device")); err == nil {
+		id := normalizeHexID(string(deviceID))
+		revision := ""
+		if revBytes, revErr := os.ReadFile(filepath.Join(devicePath, "revision")); revErr == nil {
+			revision = normalizeHexID(string(revBytes))
+		}
+
+		if name, found, done := getCachedAmdgpuName(id, revision); found {
+			return name
+		} else if !done {
+			if name, exact, ok := lookupAmdgpuNameInFile(id, revision, "/usr/share/libdrm/amdgpu.ids"); ok {
+				cacheAmdgpuName(id, revision, name, exact)
+				return normalizeAmdgpuName(name)
+			}
+			cacheMissingAmdgpuName(id, revision)
+		}
+
+		return fmt.Sprintf("AMD GPU (%s)", id)
+	}
+
+	return "AMD GPU"
+}

agent/gpu_amd_linux_test.go

@@ -0,0 +1,264 @@
+//go:build linux
+
+package agent
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNormalizeHexID(t *testing.T) {
+	tests := []struct {
+		in   string
+		want string
+	}{
+		{"0x1002", "1002"},
+		{"C2", "c2"},
+		{"  15BF  ", "15bf"},
+		{"0x15bf", "15bf"},
+		{"", ""},
+	}
+	for _, tt := range tests {
+		subName := tt.in
+		if subName == "" {
+			subName = "empty_string"
+		}
+		t.Run(subName, func(t *testing.T) {
+			got := normalizeHexID(tt.in)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestCacheKeyForAmdgpu(t *testing.T) {
+	tests := []struct {
+		deviceID   string
+		revisionID string
+		want       string
+	}{
+		{"1114", "c2", "1114:c2"},
+		{"15bf", "", "15bf"},
+		{"1506", "c1", "1506:c1"},
+	}
+	for _, tt := range tests {
+		got := cacheKeyForAmdgpu(tt.deviceID, tt.revisionID)
+		assert.Equal(t, tt.want, got)
+	}
+}
+
+func TestReadSysfsFloat(t *testing.T) {
+	dir := t.TempDir()
+
+	validPath := filepath.Join(dir, "val")
+	require.NoError(t, os.WriteFile(validPath, []byte("  42.5  \n"), 0o644))
+	got, err := readSysfsFloat(validPath)
+	require.NoError(t, err)
+	assert.Equal(t, 42.5, got)
+
+	// Integer and scientific
+	sciPath := filepath.Join(dir, "sci")
+	require.NoError(t, os.WriteFile(sciPath, []byte("1e2"), 0o644))
+	got, err = readSysfsFloat(sciPath)
+	require.NoError(t, err)
+	assert.Equal(t, 100.0, got)
+
+	// Missing file
+	_, err = readSysfsFloat(filepath.Join(dir, "missing"))
+	require.Error(t, err)
+
+	// Invalid content
+	badPath := filepath.Join(dir, "bad")
+	require.NoError(t, os.WriteFile(badPath, []byte("not a number"), 0o644))
+	_, err = readSysfsFloat(badPath)
+	require.Error(t, err)
+}
+
+func TestIsAmdGpu(t *testing.T) {
+	dir := t.TempDir()
+	deviceDir := filepath.Join(dir, "device")
+	require.NoError(t, os.MkdirAll(deviceDir, 0o755))
+
+	// AMD vendor 0x1002 -> true
+	require.NoError(t, os.WriteFile(filepath.Join(deviceDir, "vendor"), []byte("0x1002\n"), 0o644))
+	assert.True(t, isAmdGpu(dir), "vendor 0x1002 should be AMD")
+
+	// Non-AMD vendor -> false
+	require.NoError(t, os.WriteFile(filepath.Join(deviceDir, "vendor"), []byte("0x10de\n"), 0o644))
+	assert.False(t, isAmdGpu(dir), "vendor 0x10de should not be AMD")
+
+	// Missing vendor file -> false
+	require.NoError(t, os.Remove(filepath.Join(deviceDir, "vendor")))
+	assert.False(t, isAmdGpu(dir), "missing vendor file should be false")
+}
+
+func TestAmdgpuNameCacheRoundTrip(t *testing.T) {
+	// Cache a name and retrieve it (unique key to avoid affecting other tests)
+	deviceID, revisionID := "cachedev99", "00"
+	cacheAmdgpuName(deviceID, revisionID, "AMD Test GPU 99 Graphics", true)
+
+	name, found, done := getCachedAmdgpuName(deviceID, revisionID)
+	assert.True(t, found)
+	assert.True(t, done)
+	assert.Equal(t, "AMD Test GPU 99", name)
+
+	// Device-only key also stored
+	name2, found2, _ := getCachedAmdgpuName(deviceID, "")
+	assert.True(t, found2)
+	assert.Equal(t, "AMD Test GPU 99", name2)
+
+	// Cache a miss
+	cacheMissingAmdgpuName("missedev99", "ab")
+	_, found3, done3 := getCachedAmdgpuName("missedev99", "ab")
+	assert.False(t, found3)
+	assert.True(t, done3, "done should be true so caller skips file lookup")
+}
+
+func TestUpdateAmdGpuDataWithFakeSysfs(t *testing.T) {
+	tests := []struct {
+		name            string
+		writeGTT        bool
+		wantMemoryUsed  float64
+		wantMemoryTotal float64
+	}{
+		{
+			name:            "sums vram and gtt when gtt is present",
+			writeGTT:        true,
+			wantMemoryUsed:  bytesToMegabytes(1073741824 + 536870912),
+			wantMemoryTotal: bytesToMegabytes(2147483648 + 4294967296),
+		},
+		{
+			name:            "falls back to vram when gtt is missing",
+			writeGTT:        false,
+			wantMemoryUsed:  bytesToMegabytes(1073741824),
+			wantMemoryTotal: bytesToMegabytes(2147483648),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			cardPath := filepath.Join(dir, "card0")
+			devicePath := filepath.Join(cardPath, "device")
+			hwmonPath := filepath.Join(devicePath, "hwmon", "hwmon0")
+			require.NoError(t, os.MkdirAll(hwmonPath, 0o755))
+
+			write := func(name, content string) {
+				require.NoError(t, os.WriteFile(filepath.Join(devicePath, name), []byte(content), 0o644))
+			}
+			write("vendor", "0x1002")
+			write("device", "0x1506")
+			write("revision", "0xc1")
+			write("gpu_busy_percent", "25")
+			write("mem_info_vram_used", "1073741824")
+			write("mem_info_vram_total", "2147483648")
+			if tt.writeGTT {
+				write("mem_info_gtt_used", "536870912")
+				write("mem_info_gtt_total", "4294967296")
+			}
+			require.NoError(t, os.WriteFile(filepath.Join(hwmonPath, "temp1_input"), []byte("45000"), 0o644))
+			require.NoError(t, os.WriteFile(filepath.Join(hwmonPath, "power1_input"), []byte("20000000"), 0o644))
+
+			// Pre-cache name so getAmdGpuName returns a known value (it uses system amdgpu.ids path)
+			cacheAmdgpuName("1506", "c1", "AMD Radeon 610M Graphics", true)
+
+			gm := &GPUManager{GpuDataMap: make(map[string]*system.GPUData)}
+			ok := gm.updateAmdGpuData(cardPath)
+			require.True(t, ok)
+
+			gpu, ok := gm.GpuDataMap["card0"]
+			require.True(t, ok)
+			assert.Equal(t, "AMD Radeon 610M", gpu.Name)
+			assert.Equal(t, 25.0, gpu.Usage)
+			assert.Equal(t, tt.wantMemoryUsed, gpu.MemoryUsed)
+			assert.Equal(t, tt.wantMemoryTotal, gpu.MemoryTotal)
+			assert.Equal(t, 45.0, gpu.Temperature)
+			assert.Equal(t, 20.0, gpu.Power)
+			assert.Equal(t, 1.0, gpu.Count)
+		})
+	}
+}
+
+func TestLookupAmdgpuNameInFile(t *testing.T) {
+	idsPath := filepath.Join("test-data", "amdgpu.ids")
+
+	tests := []struct {
+		name       string
+		deviceID   string
+		revisionID string
+		wantName   string
+		wantExact  bool
+		wantFound  bool
+	}{
+		{
+			name:       "exact device and revision match",
+			deviceID:   "1114",
+			revisionID: "c2",
+			wantName:   "AMD Radeon 860M Graphics",
+			wantExact:  true,
+			wantFound:  true,
+		},
+		{
+			name:       "exact match 15BF revision 01 returns 760M",
+			deviceID:   "15bf",
+			revisionID: "01",
+			wantName:   "AMD Radeon 760M Graphics",
+			wantExact:  true,
+			wantFound:  true,
+		},
+		{
+			name:       "exact match 15BF revision 00 returns 780M",
+			deviceID:   "15bf",
+			revisionID: "00",
+			wantName:   "AMD Radeon 780M Graphics",
+			wantExact:  true,
+			wantFound:  true,
+		},
+		{
+			name:       "device-only match returns first entry for device",
+			deviceID:   "1506",
+			revisionID: "",
+			wantName:   "AMD Radeon 610M",
+			wantExact:  false,
+			wantFound:  true,
+		},
+		{
+			name:       "unknown device not found",
+			deviceID:   "dead",
+			revisionID: "00",
+			wantName:   "",
+			wantExact:  false,
+			wantFound:  false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotName, gotExact, gotFound := lookupAmdgpuNameInFile(tt.deviceID, tt.revisionID, idsPath)
+			assert.Equal(t, tt.wantName, gotName, "name")
+			assert.Equal(t, tt.wantExact, gotExact, "exact")
+			assert.Equal(t, tt.wantFound, gotFound, "found")
+		})
+	}
+}
+
+func TestGetAmdGpuNameFromIdsFile(t *testing.T) {
+	// Test that getAmdGpuName resolves a name when we can't inject the ids path.
+	// We only verify behavior when product_name is missing and device/revision
+	// would be read from sysfs; the actual lookup uses /usr/share/libdrm/amdgpu.ids.
+	// So this test focuses on normalizeAmdgpuName and that lookupAmdgpuNameInFile
+	// returns the expected name for our test-data file.
+	idsPath := filepath.Join("test-data", "amdgpu.ids")
+	name, exact, found := lookupAmdgpuNameInFile("1435", "ae", idsPath)
+	require.True(t, found)
+	require.True(t, exact)
+	assert.Equal(t, "AMD Custom GPU 0932", name)
+	assert.Equal(t, "AMD Custom GPU 0932", normalizeAmdgpuName(name))
+
+	// " Graphics" suffix is trimmed by normalizeAmdgpuName
+	name2 := "AMD Radeon 860M Graphics"
+	assert.Equal(t, "AMD Radeon 860M", normalizeAmdgpuName(name2))
+}

agent/gpu_amd_unsupported.go

@@ -0,0 +1,15 @@
+//go:build !linux
+
+package agent
+
+import (
+	"errors"
+)
+
+func (gm *GPUManager) hasAmdSysfs() bool {
+	return false
+}
+
+func (gm *GPUManager) collectAmdStats() error {
+	return errors.ErrUnsupported
+}

agent/gpu_darwin.go

@@ -0,0 +1,252 @@
+//go:build darwin
+
+package agent
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"io"
+	"log/slog"
+	"os/exec"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+)
+
+const (
+	// powermetricsSampleIntervalMs is the sampling interval passed to powermetrics (-i).
+	powermetricsSampleIntervalMs = 500
+	// powermetricsPollInterval is how often we run powermetrics to collect a new sample.
+	powermetricsPollInterval = 2 * time.Second
+	// macmonIntervalMs is the sampling interval passed to macmon pipe (-i), in milliseconds.
+	macmonIntervalMs = 2500
+)
+
+const appleGPUID = "0"
+
+// startPowermetricsCollector runs powermetrics --samplers gpu_power in a loop and updates
+// GPU usage and power. Requires root (sudo) on macOS. A single logical GPU is reported as id "0".
+func (gm *GPUManager) startPowermetricsCollector() {
+	// Ensure single GPU entry for Apple GPU
+	if _, ok := gm.GpuDataMap[appleGPUID]; !ok {
+		gm.GpuDataMap[appleGPUID] = &system.GPUData{Name: "Apple GPU"}
+	}
+
+	go func() {
+		failures := 0
+		for {
+			if err := gm.collectPowermetrics(); err != nil {
+				failures++
+				if failures > maxFailureRetries {
+					slog.Warn("powermetrics GPU collector failed repeatedly, stopping", "err", err)
+					break
+				}
+				slog.Warn("Error collecting macOS GPU data via powermetrics (may require sudo)", "err", err)
+				time.Sleep(retryWaitTime)
+				continue
+			}
+			failures = 0
+			time.Sleep(powermetricsPollInterval)
+		}
+	}()
+}
+
+// collectPowermetrics runs powermetrics once and parses GPU usage and power from its output.
+func (gm *GPUManager) collectPowermetrics() error {
+	interval := strconv.Itoa(powermetricsSampleIntervalMs)
+	cmd := exec.Command(powermetricsCmd, "--samplers", "gpu_power", "-i", interval, "-n", "1")
+	cmd.Stderr = nil
+	out, err := cmd.Output()
+	if err != nil {
+		return err
+	}
+	if !gm.parsePowermetricsData(out) {
+		return errNoValidData
+	}
+	return nil
+}
+
+// parsePowermetricsData parses powermetrics gpu_power output and updates GpuDataMap["0"].
+// Example output:
+//
+//	**** GPU usage ****
+//	GPU HW active frequency: 444 MHz
+//	GPU HW active residency:   0.97% (444 MHz: .97% ...
+//	GPU idle residency:  99.03%
+//	GPU Power: 4 mW
+func (gm *GPUManager) parsePowermetricsData(output []byte) bool {
+	var idleResidency, powerMW float64
+	var gotIdle, gotPower bool
+
+	scanner := bufio.NewScanner(bytes.NewReader(output))
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if strings.HasPrefix(line, "GPU idle residency:") {
+			// "GPU idle residency:  99.03%"
+			fields := strings.Fields(strings.TrimPrefix(line, "GPU idle residency:"))
+			if len(fields) >= 1 {
+				pct := strings.TrimSuffix(fields[0], "%")
+				if v, err := strconv.ParseFloat(pct, 64); err == nil {
+					idleResidency = v
+					gotIdle = true
+				}
+			}
+		} else if strings.HasPrefix(line, "GPU Power:") {
+			// "GPU Power: 4 mW"
+			fields := strings.Fields(strings.TrimPrefix(line, "GPU Power:"))
+			if len(fields) >= 1 {
+				if v, err := strconv.ParseFloat(fields[0], 64); err == nil {
+					powerMW = v
+					gotPower = true
+				}
+			}
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return false
+	}
+	if !gotIdle && !gotPower {
+		return false
+	}
+
+	gm.Lock()
+	defer gm.Unlock()
+
+	if _, ok := gm.GpuDataMap[appleGPUID]; !ok {
+		gm.GpuDataMap[appleGPUID] = &system.GPUData{Name: "Apple GPU"}
+	}
+	gpu := gm.GpuDataMap[appleGPUID]
+
+	if gotIdle {
+		// Usage = 100 - idle residency (e.g. 100 - 99.03 = 0.97%)
+		gpu.Usage += 100 - idleResidency
+	}
+	if gotPower {
+		// mW -> W
+		gpu.Power += powerMW / milliwattsInAWatt
+	}
+	gpu.Count++
+	return true
+}
+
+// startMacmonCollector runs `macmon pipe` in a loop and parses one JSON object per line.
+// This collector does not require sudo. A single logical GPU is reported as id "0".
+func (gm *GPUManager) startMacmonCollector() {
+	if _, ok := gm.GpuDataMap[appleGPUID]; !ok {
+		gm.GpuDataMap[appleGPUID] = &system.GPUData{Name: "Apple GPU"}
+	}
+
+	go func() {
+		failures := 0
+		for {
+			if err := gm.collectMacmonPipe(); err != nil {
+				failures++
+				if failures > maxFailureRetries {
+					slog.Warn("macmon GPU collector failed repeatedly, stopping", "err", err)
+					break
+				}
+				slog.Warn("Error collecting macOS GPU data via macmon", "err", err)
+				time.Sleep(retryWaitTime)
+				continue
+			}
+			failures = 0
+			// `macmon pipe` is long-running; if it returns, wait a bit before restarting.
+			time.Sleep(retryWaitTime)
+		}
+	}()
+}
+
+type macmonTemp struct {
+	GPUTempAvg float64 `json:"gpu_temp_avg"`
+}
+
+type macmonSample struct {
+	GPUPower    float64    `json:"gpu_power"`     // watts (macmon reports fractional values)
+	GPURAMPower float64    `json:"gpu_ram_power"` // watts
+	GPUUsage    []float64  `json:"gpu_usage"`     // [freq_mhz, usage] where usage is typically 0..1
+	Temp        macmonTemp `json:"temp"`
+}
+
+func (gm *GPUManager) collectMacmonPipe() (err error) {
+	cmd := exec.Command(macmonCmd, "pipe", "-i", strconv.Itoa(macmonIntervalMs))
+	// Avoid blocking if macmon writes to stderr.
+	cmd.Stderr = io.Discard
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return err
+	}
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+
+	// Ensure we always reap the child to avoid zombies on any return path and
+	// propagate a non-zero exit code if no other error was set.
+	defer func() {
+		_ = stdout.Close()
+		if cmd.ProcessState == nil || !cmd.ProcessState.Exited() {
+			_ = cmd.Process.Kill()
+		}
+		if waitErr := cmd.Wait(); err == nil && waitErr != nil {
+			err = waitErr
+		}
+	}()
+
+	scanner := bufio.NewScanner(stdout)
+	var hadSample bool
+	for scanner.Scan() {
+		line := bytes.TrimSpace(scanner.Bytes())
+		if len(line) == 0 {
+			continue
+		}
+		if gm.parseMacmonLine(line) {
+			hadSample = true
+		}
+	}
+	if scanErr := scanner.Err(); scanErr != nil {
+		return scanErr
+	}
+	if !hadSample {
+		return errNoValidData
+	}
+	return nil
+}
+
+// parseMacmonLine parses a single macmon JSON line and updates Apple GPU metrics.
+func (gm *GPUManager) parseMacmonLine(line []byte) bool {
+	var sample macmonSample
+	if err := json.Unmarshal(line, &sample); err != nil {
+		return false
+	}
+
+	usage := 0.0
+	if len(sample.GPUUsage) >= 2 {
+		usage = sample.GPUUsage[1]
+		// Heuristic: macmon typically reports 0..1; convert to percentage.
+		if usage <= 1.0 {
+			usage *= 100
+		}
+	}
+
+	// Consider the line valid if it contains at least one GPU metric.
+	if usage == 0 && sample.GPUPower == 0 && sample.Temp.GPUTempAvg == 0 {
+		return false
+	}
+
+	gm.Lock()
+	defer gm.Unlock()
+
+	gpu, ok := gm.GpuDataMap[appleGPUID]
+	if !ok {
+		gpu = &system.GPUData{Name: "Apple GPU"}
+		gm.GpuDataMap[appleGPUID] = gpu
+	}
+	gpu.Temperature = sample.Temp.GPUTempAvg
+	gpu.Usage += usage
+	// macmon reports power in watts; include VRAM power if present.
+	gpu.Power += sample.GPUPower + sample.GPURAMPower
+	gpu.Count++
+	return true
+}

agent/gpu_darwin_test.go

@@ -0,0 +1,81 @@
+//go:build darwin
+
+package agent
+
+import (
+	"testing"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParsePowermetricsData(t *testing.T) {
+	input := `
+Machine model: Mac14,10
+OS version: 25D125
+
+*** Sampled system activity (Sat Feb 14 00:42:06 2026 -0500) (503.05ms elapsed) ***
+
+**** GPU usage ****
+
+GPU HW active frequency: 444 MHz
+GPU HW active residency:   0.97% (444 MHz: .97% 612 MHz:   0% 808 MHz:   0% 968 MHz:   0% 1110 MHz:   0% 1236 MHz:   0% 1338 MHz:   0% 1398 MHz:   0%)
+GPU SW requested state: (P1 : 100% P2 :   0% P3 :   0% P4 :   0% P5 :   0% P6 :   0% P7 :   0% P8 :   0%)
+GPU idle residency:  99.03%
+GPU Power: 4 mW
+`
+	gm := &GPUManager{
+		GpuDataMap: make(map[string]*system.GPUData),
+	}
+	valid := gm.parsePowermetricsData([]byte(input))
+	require.True(t, valid)
+
+	g0, ok := gm.GpuDataMap["0"]
+	require.True(t, ok)
+	assert.Equal(t, "Apple GPU", g0.Name)
+	// Usage = 100 - 99.03 = 0.97
+	assert.InDelta(t, 0.97, g0.Usage, 0.01)
+	// 4 mW -> 0.004 W
+	assert.InDelta(t, 0.004, g0.Power, 0.0001)
+	assert.Equal(t, 1.0, g0.Count)
+}
+
+func TestParsePowermetricsDataPartial(t *testing.T) {
+	// Only power line (e.g. older macOS or different sampler output)
+	input := `
+**** GPU usage ****
+GPU Power: 120 mW
+`
+	gm := &GPUManager{
+		GpuDataMap: make(map[string]*system.GPUData),
+	}
+	valid := gm.parsePowermetricsData([]byte(input))
+	require.True(t, valid)
+
+	g0, ok := gm.GpuDataMap["0"]
+	require.True(t, ok)
+	assert.Equal(t, "Apple GPU", g0.Name)
+	assert.InDelta(t, 0.12, g0.Power, 0.001)
+	assert.Equal(t, 1.0, g0.Count)
+}
+
+func TestParseMacmonLine(t *testing.T) {
+	input := `{"all_power":0.6468324661254883,"ane_power":0.0,"cpu_power":0.6359732151031494,"ecpu_usage":[2061,0.1726151406764984],"gpu_power":0.010859241709113121,"gpu_ram_power":0.000965250947047025,"gpu_usage":[503,0.013633215799927711],"memory":{"ram_total":17179869184,"ram_usage":12322914304,"swap_total":0,"swap_usage":0},"pcpu_usage":[1248,0.11792058497667313],"ram_power":0.14885640144348145,"sys_power":10.4955415725708,"temp":{"cpu_temp_avg":23.041261672973633,"gpu_temp_avg":29.44516944885254},"timestamp":"2026-02-17T19:34:27.942556+00:00"}`
+
+	gm := &GPUManager{
+		GpuDataMap: make(map[string]*system.GPUData),
+	}
+	valid := gm.parseMacmonLine([]byte(input))
+	require.True(t, valid)
+
+	g0, ok := gm.GpuDataMap["0"]
+	require.True(t, ok)
+	assert.Equal(t, "Apple GPU", g0.Name)
+	// macmon reports usage fraction 0..1; expect percent conversion.
+	assert.InDelta(t, 1.3633, g0.Usage, 0.05)
+	// power includes gpu_power + gpu_ram_power
+	assert.InDelta(t, 0.011824, g0.Power, 0.0005)
+	assert.InDelta(t, 29.445, g0.Temperature, 0.01)
+	assert.Equal(t, 1.0, g0.Count)
+}

agent/gpu_darwin_unsupported.go

@@ -0,0 +1,9 @@
+//go:build !darwin
+
+package agent
+
+// startPowermetricsCollector is a no-op on non-darwin platforms; the real implementation is in gpu_darwin.go.
+func (gm *GPUManager) startPowermetricsCollector() {}
+
+// startMacmonCollector is a no-op on non-darwin platforms; the real implementation is in gpu_darwin.go.
+func (gm *GPUManager) startMacmonCollector() {}

agent/gpu_intel.go

@@ -0,0 +1,207 @@
+package agent
+
+import (
+	"bufio"
+	"io"
+	"os/exec"
+	"strconv"
+	"strings"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+)
+
+const (
+	intelGpuStatsCmd      string = "intel_gpu_top"
+	intelGpuStatsInterval string = "3300" // in milliseconds
+)
+
+type intelGpuStats struct {
+	PowerGPU float64
+	PowerPkg float64
+	Engines  map[string]float64
+}
+
+// updateIntelFromStats updates aggregated GPU data from a single intelGpuStats sample
+func (gm *GPUManager) updateIntelFromStats(sample *intelGpuStats) bool {
+	gm.Lock()
+	defer gm.Unlock()
+
+	// only one gpu for now - cmd doesn't provide all by default
+	id := "i0" // prefix with i to avoid conflicts with nvidia card ids
+	gpuData, ok := gm.GpuDataMap[id]
+	if !ok {
+		gpuData = &system.GPUData{Name: "GPU", Engines: make(map[string]float64)}
+		gm.GpuDataMap[id] = gpuData
+	}
+
+	gpuData.Power += sample.PowerGPU
+	gpuData.PowerPkg += sample.PowerPkg
+
+	if gpuData.Engines == nil {
+		gpuData.Engines = make(map[string]float64, len(sample.Engines))
+	}
+	for name, engine := range sample.Engines {
+		gpuData.Engines[name] += engine
+	}
+
+	gpuData.Count++
+	return true
+}
+
+// collectIntelStats executes intel_gpu_top in text mode (-l) and parses the output
+func (gm *GPUManager) collectIntelStats() (err error) {
+	// Build command arguments, optionally selecting a device via -d
+	args := []string{"-s", intelGpuStatsInterval, "-l"}
+	if dev, ok := GetEnv("INTEL_GPU_DEVICE"); ok && dev != "" {
+		args = append(args, "-d", dev)
+	}
+	cmd := exec.Command(intelGpuStatsCmd, args...)
+	// Avoid blocking if intel_gpu_top writes to stderr
+	cmd.Stderr = io.Discard
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return err
+	}
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+
+	// Ensure we always reap the child to avoid zombies on any return path and
+	// propagate a non-zero exit code if no other error was set.
+	defer func() {
+		// Best-effort close of the pipe (unblock the child if it writes)
+		_ = stdout.Close()
+		if cmd.ProcessState == nil || !cmd.ProcessState.Exited() {
+			_ = cmd.Process.Kill()
+		}
+		if waitErr := cmd.Wait(); err == nil && waitErr != nil {
+			err = waitErr
+		}
+	}()
+
+	scanner := bufio.NewScanner(stdout)
+	var header1 string
+	var engineNames []string
+	var friendlyNames []string
+	var preEngineCols int
+	var powerIndex int
+	var hadDataRow bool
+	// skip first data row because it sometimes has erroneous data
+	var skippedFirstDataRow bool
+
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" {
+			continue
+		}
+
+		// first header line
+		if strings.HasPrefix(line, "Freq") {
+			header1 = line
+			continue
+		}
+
+		// second header line
+		if strings.HasPrefix(line, "req") {
+			engineNames, friendlyNames, powerIndex, preEngineCols = gm.parseIntelHeaders(header1, line)
+			continue
+		}
+
+		// Data row
+		if !skippedFirstDataRow {
+			skippedFirstDataRow = true
+			continue
+		}
+		sample, err := gm.parseIntelData(line, engineNames, friendlyNames, powerIndex, preEngineCols)
+		if err != nil {
+			return err
+		}
+		hadDataRow = true
+		gm.updateIntelFromStats(&sample)
+	}
+	if scanErr := scanner.Err(); scanErr != nil {
+		return scanErr
+	}
+	if !hadDataRow {
+		return errNoValidData
+	}
+	return nil
+}
+
+func (gm *GPUManager) parseIntelHeaders(header1 string, header2 string) (engineNames []string, friendlyNames []string, powerIndex int, preEngineCols int) {
+	// Build indexes
+	h1 := strings.Fields(header1)
+	h2 := strings.Fields(header2)
+	powerIndex = -1 // Initialize to -1, will be set to actual index if found
+	// Collect engine names from header1
+	for _, col := range h1 {
+		key := strings.TrimRightFunc(col, func(r rune) bool {
+			return (r >= '0' && r <= '9') || r == '/'
+		})
+		var friendly string
+		switch key {
+		case "RCS":
+			friendly = "Render/3D"
+		case "BCS":
+			friendly = "Blitter"
+		case "VCS":
+			friendly = "Video"
+		case "VECS":
+			friendly = "VideoEnhance"
+		case "CCS":
+			friendly = "Compute"
+		default:
+			continue
+		}
+		engineNames = append(engineNames, key)
+		friendlyNames = append(friendlyNames, friendly)
+	}
+	// find power gpu index among pre-engine columns
+	if n := len(engineNames); n > 0 {
+		preEngineCols = max(len(h2)-3*n, 0)
+		limit := min(len(h2), preEngineCols)
+		for i := range limit {
+			if strings.EqualFold(h2[i], "gpu") {
+				powerIndex = i
+				break
+			}
+		}
+	}
+	return engineNames, friendlyNames, powerIndex, preEngineCols
+}
+
+func (gm *GPUManager) parseIntelData(line string, engineNames []string, friendlyNames []string, powerIndex int, preEngineCols int) (sample intelGpuStats, err error) {
+	fields := strings.Fields(line)
+	if len(fields) == 0 {
+		return sample, errNoValidData
+	}
+	// Make sure row has enough columns for engines
+	if need := preEngineCols + 3*len(engineNames); len(fields) < need {
+		return sample, errNoValidData
+	}
+	if powerIndex >= 0 && powerIndex < len(fields) {
+		if v, perr := strconv.ParseFloat(fields[powerIndex], 64); perr == nil {
+			sample.PowerGPU = v
+		}
+		if v, perr := strconv.ParseFloat(fields[powerIndex+1], 64); perr == nil {
+			sample.PowerPkg = v
+		}
+	}
+	if len(engineNames) > 0 {
+		sample.Engines = make(map[string]float64, len(engineNames))
+		for k := range engineNames {
+			base := preEngineCols + 3*k
+			if base < len(fields) {
+				busy := 0.0
+				if v, e := strconv.ParseFloat(fields[base], 64); e == nil {
+					busy = v
+				}
+				cur := sample.Engines[friendlyNames[k]]
+				sample.Engines[friendlyNames[k]] = cur + busy
+			} else {
+				sample.Engines[friendlyNames[k]] = 0
+			}
+		}
+	}
+	return sample, nil
+}

agent/gpu_nvml.go

@@ -0,0 +1,224 @@
+//go:build amd64 && (windows || (linux && glibc))
+
+package agent
+
+import (
+	"fmt"
+	"log/slog"
+	"strings"
+	"time"
+	"unsafe"
+
+	"github.com/ebitengine/purego"
+	"github.com/henrygd/beszel/internal/entities/system"
+)
+
+// NVML constants and types
+const (
+	nvmlSuccess int = 0
+)
+
+type nvmlDevice uintptr
+
+type nvmlReturn int
+
+type nvmlMemoryV1 struct {
+	Total uint64
+	Free  uint64
+	Used  uint64
+}
+
+type nvmlMemoryV2 struct {
+	Version  uint32
+	Total    uint64
+	Reserved uint64
+	Free     uint64
+	Used     uint64
+}
+
+type nvmlUtilization struct {
+	Gpu    uint32
+	Memory uint32
+}
+
+type nvmlPciInfo struct {
+	BusId          [16]byte
+	Domain         uint32
+	Bus            uint32
+	Device         uint32
+	PciDeviceId    uint32
+	PciSubSystemId uint32
+}
+
+// NVML function signatures
+var (
+	nvmlInit                      func() nvmlReturn
+	nvmlShutdown                  func() nvmlReturn
+	nvmlDeviceGetCount            func(count *uint32) nvmlReturn
+	nvmlDeviceGetHandleByIndex    func(index uint32, device *nvmlDevice) nvmlReturn
+	nvmlDeviceGetName             func(device nvmlDevice, name *byte, length uint32) nvmlReturn
+	nvmlDeviceGetMemoryInfo       func(device nvmlDevice, memory uintptr) nvmlReturn
+	nvmlDeviceGetUtilizationRates func(device nvmlDevice, utilization *nvmlUtilization) nvmlReturn
+	nvmlDeviceGetTemperature      func(device nvmlDevice, sensorType int, temp *uint32) nvmlReturn
+	nvmlDeviceGetPowerUsage       func(device nvmlDevice, power *uint32) nvmlReturn
+	nvmlDeviceGetPciInfo          func(device nvmlDevice, pci *nvmlPciInfo) nvmlReturn
+	nvmlErrorString               func(result nvmlReturn) string
+)
+
+type nvmlCollector struct {
+	gm      *GPUManager
+	lib     uintptr
+	devices []nvmlDevice
+	bdfs    []string
+	isV2    bool
+}
+
+func (c *nvmlCollector) init() error {
+	slog.Debug("NVML: Initializing")
+	libPath := getNVMLPath()
+
+	lib, err := openLibrary(libPath)
+	if err != nil {
+		return fmt.Errorf("failed to load %s: %w", libPath, err)
+	}
+	c.lib = lib
+
+	purego.RegisterLibFunc(&nvmlInit, lib, "nvmlInit")
+	purego.RegisterLibFunc(&nvmlShutdown, lib, "nvmlShutdown")
+	purego.RegisterLibFunc(&nvmlDeviceGetCount, lib, "nvmlDeviceGetCount")
+	purego.RegisterLibFunc(&nvmlDeviceGetHandleByIndex, lib, "nvmlDeviceGetHandleByIndex")
+	purego.RegisterLibFunc(&nvmlDeviceGetName, lib, "nvmlDeviceGetName")
+	// Try to get v2 memory info, fallback to v1 if not available
+	if hasSymbol(lib, "nvmlDeviceGetMemoryInfo_v2") {
+		c.isV2 = true
+		purego.RegisterLibFunc(&nvmlDeviceGetMemoryInfo, lib, "nvmlDeviceGetMemoryInfo_v2")
+	} else {
+		purego.RegisterLibFunc(&nvmlDeviceGetMemoryInfo, lib, "nvmlDeviceGetMemoryInfo")
+	}
+	purego.RegisterLibFunc(&nvmlDeviceGetUtilizationRates, lib, "nvmlDeviceGetUtilizationRates")
+	purego.RegisterLibFunc(&nvmlDeviceGetTemperature, lib, "nvmlDeviceGetTemperature")
+	purego.RegisterLibFunc(&nvmlDeviceGetPowerUsage, lib, "nvmlDeviceGetPowerUsage")
+	purego.RegisterLibFunc(&nvmlDeviceGetPciInfo, lib, "nvmlDeviceGetPciInfo")
+	purego.RegisterLibFunc(&nvmlErrorString, lib, "nvmlErrorString")
+
+	if ret := nvmlInit(); ret != nvmlReturn(nvmlSuccess) {
+		return fmt.Errorf("nvmlInit failed: %v", ret)
+	}
+
+	var count uint32
+	if ret := nvmlDeviceGetCount(&count); ret != nvmlReturn(nvmlSuccess) {
+		return fmt.Errorf("nvmlDeviceGetCount failed: %v", ret)
+	}
+
+	for i := uint32(0); i < count; i++ {
+		var device nvmlDevice
+		if ret := nvmlDeviceGetHandleByIndex(i, &device); ret == nvmlReturn(nvmlSuccess) {
+			c.devices = append(c.devices, device)
+			// Get BDF for power state check
+			var pci nvmlPciInfo
+			if ret := nvmlDeviceGetPciInfo(device, &pci); ret == nvmlReturn(nvmlSuccess) {
+				busID := string(pci.BusId[:])
+				if idx := strings.Index(busID, "\x00"); idx != -1 {
+					busID = busID[:idx]
+				}
+				c.bdfs = append(c.bdfs, strings.ToLower(busID))
+			} else {
+				c.bdfs = append(c.bdfs, "")
+			}
+		}
+	}
+
+	return nil
+}
+
+func (c *nvmlCollector) start() {
+	defer nvmlShutdown()
+	ticker := time.Tick(3 * time.Second)
+
+	for range ticker {
+		c.collect()
+	}
+}
+
+func (c *nvmlCollector) collect() {
+	c.gm.Lock()
+	defer c.gm.Unlock()
+
+	for i, device := range c.devices {
+		id := fmt.Sprintf("%d", i)
+		bdf := c.bdfs[i]
+
+		// Update GPUDataMap
+		if _, ok := c.gm.GpuDataMap[id]; !ok {
+			var nameBuf [64]byte
+			if ret := nvmlDeviceGetName(device, &nameBuf[0], 64); ret != nvmlReturn(nvmlSuccess) {
+				continue
+			}
+			name := string(nameBuf[:strings.Index(string(nameBuf[:]), "\x00")])
+			name = strings.TrimPrefix(name, "NVIDIA ")
+			c.gm.GpuDataMap[id] = &system.GPUData{Name: strings.TrimSuffix(name, " Laptop GPU")}
+		}
+		gpu := c.gm.GpuDataMap[id]
+
+		if bdf != "" && !c.isGPUActive(bdf) {
+			slog.Debug("NVML: GPU is suspended, skipping", "bdf", bdf)
+			gpu.Temperature = 0
+			gpu.MemoryUsed = 0
+			continue
+		}
+
+		// Utilization
+		var utilization nvmlUtilization
+		if ret := nvmlDeviceGetUtilizationRates(device, &utilization); ret != nvmlReturn(nvmlSuccess) {
+			slog.Debug("NVML: Utilization failed (GPU likely suspended)", "bdf", bdf, "ret", ret)
+			gpu.Temperature = 0
+			gpu.MemoryUsed = 0
+			continue
+		}
+
+		slog.Debug("NVML: Collecting data for GPU", "bdf", bdf)
+
+		// Temperature
+		var temp uint32
+		nvmlDeviceGetTemperature(device, 0, &temp) // 0 is NVML_TEMPERATURE_GPU
+
+		// Memory: only poll if GPU is active to avoid leaving D3cold state (#1522)
+		if utilization.Gpu > 0 {
+			var usedMem, totalMem uint64
+			if c.isV2 {
+				var memory nvmlMemoryV2
+				memory.Version = 0x02000028 // (2 << 24) | 40 bytes
+				if ret := nvmlDeviceGetMemoryInfo(device, uintptr(unsafe.Pointer(&memory))); ret != nvmlReturn(nvmlSuccess) {
+					slog.Debug("NVML: MemoryInfo_v2 failed", "bdf", bdf, "ret", ret)
+				} else {
+					usedMem = memory.Used
+					totalMem = memory.Total
+				}
+			} else {
+				var memory nvmlMemoryV1
+				if ret := nvmlDeviceGetMemoryInfo(device, uintptr(unsafe.Pointer(&memory))); ret != nvmlReturn(nvmlSuccess) {
+					slog.Debug("NVML: MemoryInfo failed", "bdf", bdf, "ret", ret)
+				} else {
+					usedMem = memory.Used
+					totalMem = memory.Total
+				}
+			}
+			if totalMem > 0 {
+				gpu.MemoryUsed = float64(usedMem) / 1024 / 1024 / mebibytesInAMegabyte
+				gpu.MemoryTotal = float64(totalMem) / 1024 / 1024 / mebibytesInAMegabyte
+			}
+		} else {
+			slog.Debug("NVML: Skipping memory info (utilization=0)", "bdf", bdf)
+		}
+
+		// Power
+		var power uint32
+		nvmlDeviceGetPowerUsage(device, &power)
+
+		gpu.Temperature = float64(temp)
+		gpu.Usage += float64(utilization.Gpu)
+		gpu.Power += float64(power) / 1000.0
+		gpu.Count++
+		slog.Debug("NVML: Collected data", "gpu", gpu)
+	}
+}

agent/gpu_nvml_linux.go

@@ -0,0 +1,57 @@
+//go:build glibc && linux && amd64
+
+package agent
+
+import (
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/ebitengine/purego"
+)
+
+func openLibrary(name string) (uintptr, error) {
+	return purego.Dlopen(name, purego.RTLD_NOW|purego.RTLD_GLOBAL)
+}
+
+func getNVMLPath() string {
+	return "libnvidia-ml.so.1"
+}
+
+func hasSymbol(lib uintptr, symbol string) bool {
+	_, err := purego.Dlsym(lib, symbol)
+	return err == nil
+}
+
+func (c *nvmlCollector) isGPUActive(bdf string) bool {
+	// runtime_status
+	statusPath := filepath.Join("/sys/bus/pci/devices", bdf, "power/runtime_status")
+	status, err := os.ReadFile(statusPath)
+	if err != nil {
+		slog.Debug("NVML: Can't read runtime_status", "bdf", bdf, "err", err)
+		return true // Assume active if we can't read status
+	}
+	statusStr := strings.TrimSpace(string(status))
+	if statusStr != "active" && statusStr != "resuming" {
+		slog.Debug("NVML: GPU not active", "bdf", bdf, "status", statusStr)
+		return false
+	}
+
+	// power_state (D0 check)
+	// Find any drm card device power_state
+	pstatePathPattern := filepath.Join("/sys/bus/pci/devices", bdf, "drm/card*/device/power_state")
+	matches, _ := filepath.Glob(pstatePathPattern)
+	if len(matches) > 0 {
+		pstate, err := os.ReadFile(matches[0])
+		if err == nil {
+			pstateStr := strings.TrimSpace(string(pstate))
+			if pstateStr != "D0" {
+				slog.Debug("NVML: GPU not in D0 state", "bdf", bdf, "pstate", pstateStr)
+				return false
+			}
+		}
+	}
+
+	return true
+}

agent/gpu_nvml_unsupported.go

@@ -0,0 +1,15 @@
+//go:build (!linux && !windows) || !amd64 || (linux && !glibc)
+
+package agent
+
+import "fmt"
+
+type nvmlCollector struct {
+	gm *GPUManager
+}
+
+func (c *nvmlCollector) init() error {
+	return fmt.Errorf("nvml not supported on this platform")
+}
+
+func (c *nvmlCollector) start() {}

agent/gpu_nvml_windows.go

@@ -0,0 +1,25 @@
+//go:build windows && amd64
+
+package agent
+
+import (
+	"golang.org/x/sys/windows"
+)
+
+func openLibrary(name string) (uintptr, error) {
+	handle, err := windows.LoadLibrary(name)
+	return uintptr(handle), err
+}
+
+func getNVMLPath() string {
+	return "nvml.dll"
+}
+
+func hasSymbol(lib uintptr, symbol string) bool {
+	_, err := windows.GetProcAddress(windows.Handle(lib), symbol)
+	return err == nil
+}
+
+func (c *nvmlCollector) isGPUActive(bdf string) bool {
+	return true
+}

agent/gpu_nvtop.go

@@ -0,0 +1,159 @@
+package agent
+
+import (
+	"encoding/json"
+	"io"
+	"log/slog"
+	"os/exec"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+)
+
+type nvtopSnapshot struct {
+	DeviceName string  `json:"device_name"`
+	Temp       *string `json:"temp"`
+	PowerDraw  *string `json:"power_draw"`
+	GpuUtil    *string `json:"gpu_util"`
+	MemTotal   *string `json:"mem_total"`
+	MemUsed    *string `json:"mem_used"`
+}
+
+// parseNvtopNumber parses nvtop numeric strings with units (C/W/%).
+func parseNvtopNumber(raw string) float64 {
+	cleaned := strings.TrimSpace(raw)
+	cleaned = strings.TrimSuffix(cleaned, "C")
+	cleaned = strings.TrimSuffix(cleaned, "W")
+	cleaned = strings.TrimSuffix(cleaned, "%")
+	val, _ := strconv.ParseFloat(cleaned, 64)
+	return val
+}
+
+// parseNvtopData parses a single nvtop JSON snapshot payload.
+func (gm *GPUManager) parseNvtopData(output []byte) bool {
+	var snapshots []nvtopSnapshot
+	if err := json.Unmarshal(output, &snapshots); err != nil || len(snapshots) == 0 {
+		return false
+	}
+	return gm.updateNvtopSnapshots(snapshots)
+}
+
+// updateNvtopSnapshots applies one decoded nvtop snapshot batch to GPU accumulators.
+func (gm *GPUManager) updateNvtopSnapshots(snapshots []nvtopSnapshot) bool {
+	gm.Lock()
+	defer gm.Unlock()
+
+	valid := false
+	usedIDs := make(map[string]struct{}, len(snapshots))
+	for i, sample := range snapshots {
+		if sample.DeviceName == "" {
+			continue
+		}
+		indexID := "n" + strconv.Itoa(i)
+		id := indexID
+
+		// nvtop ordering can change, so prefer reusing an existing slot with matching device name.
+		if existingByIndex, ok := gm.GpuDataMap[indexID]; ok && existingByIndex.Name != "" && existingByIndex.Name != sample.DeviceName {
+			for existingID, gpu := range gm.GpuDataMap {
+				if !strings.HasPrefix(existingID, "n") {
+					continue
+				}
+				if _, taken := usedIDs[existingID]; taken {
+					continue
+				}
+				if gpu.Name == sample.DeviceName {
+					id = existingID
+					break
+				}
+			}
+		}
+
+		if _, ok := gm.GpuDataMap[id]; !ok {
+			gm.GpuDataMap[id] = &system.GPUData{Name: sample.DeviceName}
+		}
+		gpu := gm.GpuDataMap[id]
+		gpu.Name = sample.DeviceName
+
+		if sample.Temp != nil {
+			gpu.Temperature = parseNvtopNumber(*sample.Temp)
+		}
+		if sample.MemUsed != nil {
+			gpu.MemoryUsed = bytesToMegabytes(parseNvtopNumber(*sample.MemUsed))
+		}
+		if sample.MemTotal != nil {
+			gpu.MemoryTotal = bytesToMegabytes(parseNvtopNumber(*sample.MemTotal))
+		}
+		if sample.GpuUtil != nil {
+			gpu.Usage += parseNvtopNumber(*sample.GpuUtil)
+		}
+		if sample.PowerDraw != nil {
+			gpu.Power += parseNvtopNumber(*sample.PowerDraw)
+		}
+		gpu.Count++
+		usedIDs[id] = struct{}{}
+		valid = true
+	}
+	return valid
+}
+
+// collectNvtopStats runs nvtop loop mode and continuously decodes JSON snapshots.
+func (gm *GPUManager) collectNvtopStats(interval string) error {
+	cmd := exec.Command(nvtopCmd, "-lP", "-d", interval)
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return err
+	}
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	defer func() {
+		_ = stdout.Close()
+		if cmd.ProcessState == nil || !cmd.ProcessState.Exited() {
+			_ = cmd.Process.Kill()
+		}
+		_ = cmd.Wait()
+	}()
+
+	decoder := json.NewDecoder(stdout)
+	foundValid := false
+	for {
+		var snapshots []nvtopSnapshot
+		if err := decoder.Decode(&snapshots); err != nil {
+			if err == io.EOF {
+				if foundValid {
+					return nil
+				}
+				return errNoValidData
+			}
+			return err
+		}
+		if gm.updateNvtopSnapshots(snapshots) {
+			foundValid = true
+		}
+	}
+}
+
+// startNvtopCollector starts nvtop collection with retry or fallback callback handling.
+func (gm *GPUManager) startNvtopCollector(interval string, onFailure func()) {
+	go func() {
+		failures := 0
+		for {
+			if err := gm.collectNvtopStats(interval); err != nil {
+				if onFailure != nil {
+					slog.Warn("Error collecting GPU data via nvtop", "err", err)
+					onFailure()
+					return
+				}
+				failures++
+				if failures > maxFailureRetries {
+					break
+				}
+				slog.Warn("Error collecting GPU data via nvtop", "err", err)
+				time.Sleep(retryWaitTime)
+				continue
+			}
+		}
+	}()
+}

agent/handlers.go

@@ -0,0 +1,205 @@
+package agent
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/fxamacker/cbor/v2"
+	"github.com/henrygd/beszel/internal/common"
+	"github.com/henrygd/beszel/internal/entities/smart"
+
+	"log/slog"
+)
+
+// HandlerContext provides context for request handlers
+type HandlerContext struct {
+	Client      *WebSocketClient
+	Agent       *Agent
+	Request     *common.HubRequest[cbor.RawMessage]
+	RequestID   *uint32
+	HubVerified bool
+	// SendResponse abstracts how a handler sends responses (WS or SSH)
+	SendResponse func(data any, requestID *uint32) error
+}
+
+// RequestHandler defines the interface for handling specific websocket request types
+type RequestHandler interface {
+	// Handle processes the request and returns an error if unsuccessful
+	Handle(hctx *HandlerContext) error
+}
+
+// Responder sends handler responses back to the hub (over WS or SSH)
+type Responder interface {
+	SendResponse(data any, requestID *uint32) error
+}
+
+// HandlerRegistry manages the mapping between actions and their handlers
+type HandlerRegistry struct {
+	handlers map[common.WebSocketAction]RequestHandler
+}
+
+// NewHandlerRegistry creates a new handler registry with default handlers
+func NewHandlerRegistry() *HandlerRegistry {
+	registry := &HandlerRegistry{
+		handlers: make(map[common.WebSocketAction]RequestHandler),
+	}
+
+	registry.Register(common.GetData, &GetDataHandler{})
+	registry.Register(common.CheckFingerprint, &CheckFingerprintHandler{})
+	registry.Register(common.GetContainerLogs, &GetContainerLogsHandler{})
+	registry.Register(common.GetContainerInfo, &GetContainerInfoHandler{})
+	registry.Register(common.GetSmartData, &GetSmartDataHandler{})
+	registry.Register(common.GetSystemdInfo, &GetSystemdInfoHandler{})
+
+	return registry
+}
+
+// Register registers a handler for a specific action type
+func (hr *HandlerRegistry) Register(action common.WebSocketAction, handler RequestHandler) {
+	hr.handlers[action] = handler
+}
+
+// Handle routes the request to the appropriate handler
+func (hr *HandlerRegistry) Handle(hctx *HandlerContext) error {
+	handler, exists := hr.handlers[hctx.Request.Action]
+	if !exists {
+		return fmt.Errorf("unknown action: %d", hctx.Request.Action)
+	}
+
+	// Check verification requirement - default to requiring verification
+	if hctx.Request.Action != common.CheckFingerprint && !hctx.HubVerified {
+		return errors.New("hub not verified")
+	}
+
+	// Log handler execution for debugging
+	// slog.Debug("Executing handler", "action", hctx.Request.Action)
+
+	return handler.Handle(hctx)
+}
+
+// GetHandler returns the handler for a specific action
+func (hr *HandlerRegistry) GetHandler(action common.WebSocketAction) (RequestHandler, bool) {
+	handler, exists := hr.handlers[action]
+	return handler, exists
+}
+
+////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////
+
+// GetDataHandler handles system data requests
+type GetDataHandler struct{}
+
+func (h *GetDataHandler) Handle(hctx *HandlerContext) error {
+	var options common.DataRequestOptions
+	_ = cbor.Unmarshal(hctx.Request.Data, &options)
+
+	sysStats := hctx.Agent.gatherStats(options)
+	return hctx.SendResponse(sysStats, hctx.RequestID)
+}
+
+////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////
+
+// CheckFingerprintHandler handles authentication challenges
+type CheckFingerprintHandler struct{}
+
+func (h *CheckFingerprintHandler) Handle(hctx *HandlerContext) error {
+	return hctx.Client.handleAuthChallenge(hctx.Request, hctx.RequestID)
+}
+
+////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////
+
+// GetContainerLogsHandler handles container log requests
+type GetContainerLogsHandler struct{}
+
+func (h *GetContainerLogsHandler) Handle(hctx *HandlerContext) error {
+	if hctx.Agent.dockerManager == nil {
+		return hctx.SendResponse("", hctx.RequestID)
+	}
+
+	var req common.ContainerLogsRequest
+	if err := cbor.Unmarshal(hctx.Request.Data, &req); err != nil {
+		return err
+	}
+
+	ctx := context.Background()
+	logContent, err := hctx.Agent.dockerManager.getLogs(ctx, req.ContainerID)
+	if err != nil {
+		return err
+	}
+
+	return hctx.SendResponse(logContent, hctx.RequestID)
+}
+
+////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////
+
+// GetContainerInfoHandler handles container info requests
+type GetContainerInfoHandler struct{}
+
+func (h *GetContainerInfoHandler) Handle(hctx *HandlerContext) error {
+	if hctx.Agent.dockerManager == nil {
+		return hctx.SendResponse("", hctx.RequestID)
+	}
+
+	var req common.ContainerInfoRequest
+	if err := cbor.Unmarshal(hctx.Request.Data, &req); err != nil {
+		return err
+	}
+
+	ctx := context.Background()
+	info, err := hctx.Agent.dockerManager.getContainerInfo(ctx, req.ContainerID)
+	if err != nil {
+		return err
+	}
+
+	return hctx.SendResponse(string(info), hctx.RequestID)
+}
+
+////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////
+
+// GetSmartDataHandler handles SMART data requests
+type GetSmartDataHandler struct{}
+
+func (h *GetSmartDataHandler) Handle(hctx *HandlerContext) error {
+	if hctx.Agent.smartManager == nil {
+		// return empty map to indicate no data
+		return hctx.SendResponse(map[string]smart.SmartData{}, hctx.RequestID)
+	}
+	if err := hctx.Agent.smartManager.Refresh(false); err != nil {
+		slog.Debug("smart refresh failed", "err", err)
+	}
+	data := hctx.Agent.smartManager.GetCurrentData()
+	return hctx.SendResponse(data, hctx.RequestID)
+}
+
+////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////
+
+// GetSystemdInfoHandler handles detailed systemd service info requests
+type GetSystemdInfoHandler struct{}
+
+func (h *GetSystemdInfoHandler) Handle(hctx *HandlerContext) error {
+	if hctx.Agent.systemdManager == nil {
+		return errors.ErrUnsupported
+	}
+
+	var req common.SystemdInfoRequest
+	if err := cbor.Unmarshal(hctx.Request.Data, &req); err != nil {
+		return err
+	}
+	if req.ServiceName == "" {
+		return errors.New("service name is required")
+	}
+
+	details, err := hctx.Agent.systemdManager.getServiceDetails(req.ServiceName)
+	if err != nil {
+		return err
+	}
+
+	return hctx.SendResponse(details, hctx.RequestID)
+}

agent/handlers_test.go

@@ -0,0 +1,111 @@
+//go:build testing
+
+package agent
+
+import (
+	"testing"
+
+	"github.com/fxamacker/cbor/v2"
+	"github.com/henrygd/beszel/internal/common"
+	"github.com/stretchr/testify/assert"
+)
+
+// MockHandler for testing
+type MockHandler struct {
+	requiresVerification bool
+	description          string
+	handleFunc           func(ctx *HandlerContext) error
+}
+
+func (m *MockHandler) Handle(ctx *HandlerContext) error {
+	if m.handleFunc != nil {
+		return m.handleFunc(ctx)
+	}
+	return nil
+}
+
+func (m *MockHandler) RequiresVerification() bool {
+	return m.requiresVerification
+}
+
+// TestHandlerRegistry tests the handler registry functionality
+func TestHandlerRegistry(t *testing.T) {
+	t.Run("default registration", func(t *testing.T) {
+		registry := NewHandlerRegistry()
+
+		// Check default handlers are registered
+		getDataHandler, exists := registry.GetHandler(common.GetData)
+		assert.True(t, exists)
+		assert.IsType(t, &GetDataHandler{}, getDataHandler)
+
+		fingerprintHandler, exists := registry.GetHandler(common.CheckFingerprint)
+		assert.True(t, exists)
+		assert.IsType(t, &CheckFingerprintHandler{}, fingerprintHandler)
+	})
+
+	t.Run("custom handler registration", func(t *testing.T) {
+		registry := NewHandlerRegistry()
+		mockHandler := &MockHandler{
+			requiresVerification: true,
+			description:          "Test handler",
+		}
+
+		// Register a custom handler for a mock action
+		const mockAction common.WebSocketAction = 99
+		registry.Register(mockAction, mockHandler)
+
+		// Verify registration
+		handler, exists := registry.GetHandler(mockAction)
+		assert.True(t, exists)
+		assert.Equal(t, mockHandler, handler)
+	})
+
+	t.Run("unknown action", func(t *testing.T) {
+		registry := NewHandlerRegistry()
+		ctx := &HandlerContext{
+			Request: &common.HubRequest[cbor.RawMessage]{
+				Action: common.WebSocketAction(255), // Unknown action
+			},
+			HubVerified: true,
+		}
+
+		err := registry.Handle(ctx)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "unknown action: 255")
+	})
+
+	t.Run("verification required", func(t *testing.T) {
+		registry := NewHandlerRegistry()
+		ctx := &HandlerContext{
+			Request: &common.HubRequest[cbor.RawMessage]{
+				Action: common.GetData, // Requires verification
+			},
+			HubVerified: false, // Not verified
+		}
+
+		err := registry.Handle(ctx)
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "hub not verified")
+	})
+}
+
+// TestCheckFingerprintHandler tests the CheckFingerprint handler
+func TestCheckFingerprintHandler(t *testing.T) {
+	handler := &CheckFingerprintHandler{}
+
+	t.Run("handle with invalid data", func(t *testing.T) {
+		client := &WebSocketClient{}
+		ctx := &HandlerContext{
+			Client:      client,
+			HubVerified: false,
+			Request: &common.HubRequest[cbor.RawMessage]{
+				Action: common.CheckFingerprint,
+				Data:   cbor.RawMessage{}, // Empty/invalid data
+			},
+		}
+
+		// Should fail to decode the fingerprint request
+		err := handler.Handle(ctx)
+		assert.Error(t, err)
+	})
+}

agent/health/health.go

@@ -9,11 +9,31 @@ import (
 	"log"
 	"os"
 	"path/filepath"
+	"runtime"
 	"time"
 )
 
 // healthFile is the path to the health file
-var healthFile = filepath.Join(os.TempDir(), "beszel_health")
+var healthFile = getHealthFilePath()
+
+func getHealthFilePath() string {
+	filename := "beszel_health"
+	if runtime.GOOS == "linux" {
+		fullPath := filepath.Join("/dev/shm", filename)
+		if err := updateHealthFile(fullPath); err == nil {
+			return fullPath
+		}
+	}
+	return filepath.Join(os.TempDir(), filename)
+}
+
+func updateHealthFile(path string) error {
+	file, err := os.Create(path)
+	if err != nil {
+		return err
+	}
+	return file.Close()
+}
 
 // Check checks if the agent is connected by checking the modification time of the health file
 func Check() error {
@@ -30,11 +50,7 @@ func Check() error {
 
 // Update updates the modification time of the health file
 func Update() error {
-	file, err := os.Create(healthFile)
+	return updateHealthFile(healthFile)
-	if err != nil {
-		return err
-	}
-	return file.Close()
 }
 
 // CleanUp removes the health file

agent/health/health_test.go

@@ -1,5 +1,4 @@
 //go:build testing
-// +build testing
 
 package health
 
@@ -37,7 +36,6 @@ func TestHealth(t *testing.T) {
 	})
 
 	// This test uses synctest to simulate time passing.
-	// NOTE: This test requires GOEXPERIMENT=synctest to run.
 	t.Run("check with simulated time", func(t *testing.T) {
 		synctest.Test(t, func(t *testing.T) {
 			// Update the file to set the initial timestamp.

agent/lhm/beszel_lhm.cs

@@ -52,7 +52,12 @@ class Program
     foreach (var sensor in hardware.Sensors)
     {
       var validTemp = sensor.SensorType == SensorType.Temperature && sensor.Value.HasValue;
-      if (!validTemp || sensor.Name.Contains("Distance"))
+      if (!validTemp ||
+          sensor.Name.IndexOf("Distance", StringComparison.OrdinalIgnoreCase) >= 0 ||
+          sensor.Name.IndexOf("Limit", StringComparison.OrdinalIgnoreCase) >= 0 ||
+          sensor.Name.IndexOf("Critical", StringComparison.OrdinalIgnoreCase) >= 0 ||
+          sensor.Name.IndexOf("Warning", StringComparison.OrdinalIgnoreCase) >= 0 ||
+          sensor.Name.IndexOf("Resolution", StringComparison.OrdinalIgnoreCase) >= 0)
       {
         continue;
       }

agent/lhm/beszel_lhm.csproj

@@ -3,9 +3,11 @@
     <OutputType>Exe</OutputType>
     <TargetFramework>net48</TargetFramework>
     <Platforms>x64</Platforms>
+    <RuntimeIdentifier>win-x64</RuntimeIdentifier>
+    <AppendRuntimeIdentifierToOutputPath>false</AppendRuntimeIdentifierToOutputPath>
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="LibreHardwareMonitorLib" Version="0.9.4" />
+    <PackageReference Include="LibreHardwareMonitorLib" Version="0.9.5" />
   </ItemGroup>
 </Project>

agent/network.go

@@ -3,6 +3,7 @@ package agent
 import (
 	"fmt"
 	"log/slog"
+	"path"
 	"strings"
 	"time"
 
@@ -11,10 +12,116 @@ import (
 	psutilNet "github.com/shirou/gopsutil/v4/net"
 )
 
-var netInterfaceDeltaTracker = deltatracker.NewDeltaTracker[string, uint64]()
+// NicConfig controls inclusion/exclusion of network interfaces via the NICS env var
+//
+// Behavior mirrors SensorConfig's matching logic:
+// - Leading '-' means blacklist mode; otherwise whitelist mode
+// - Supports '*' wildcards using path.Match
+// - In whitelist mode with an empty list, no NICs are selected
+// - In blacklist mode with an empty list, all NICs are selected
+type NicConfig struct {
+	nics         map[string]struct{}
+	isBlacklist  bool
+	hasWildcards bool
+}
 
-func (a *Agent) updateNetworkStats(systemStats *system.Stats) {
+func newNicConfig(nicsEnvVal string) *NicConfig {
+	cfg := &NicConfig{
+		nics: make(map[string]struct{}),
+	}
+	if strings.HasPrefix(nicsEnvVal, "-") {
+		cfg.isBlacklist = true
+		nicsEnvVal = nicsEnvVal[1:]
+	}
+	for nic := range strings.SplitSeq(nicsEnvVal, ",") {
+		nic = strings.TrimSpace(nic)
+		if nic != "" {
+			cfg.nics[nic] = struct{}{}
+			if strings.Contains(nic, "*") {
+				cfg.hasWildcards = true
+			}
+		}
+	}
+	return cfg
+}
+
+// isValidNic determines if a NIC should be included based on NicConfig rules
+func isValidNic(nicName string, cfg *NicConfig) bool {
+	// Empty list behavior differs by mode: blacklist: allow all; whitelist: allow none
+	if len(cfg.nics) == 0 {
+		return cfg.isBlacklist
+	}
+
+	// Exact match: return true if whitelist, false if blacklist
+	if _, exactMatch := cfg.nics[nicName]; exactMatch {
+		return !cfg.isBlacklist
+	}
+
+	// If no wildcards, return true if blacklist, false if whitelist
+	if !cfg.hasWildcards {
+		return cfg.isBlacklist
+	}
+
+	// Check for wildcard patterns
+	for pattern := range cfg.nics {
+		if !strings.Contains(pattern, "*") {
+			continue
+		}
+		if match, _ := path.Match(pattern, nicName); match {
+			return !cfg.isBlacklist
+		}
+	}
+
+	return cfg.isBlacklist
+}
+
+func (a *Agent) updateNetworkStats(cacheTimeMs uint16, systemStats *system.Stats) {
 	// network stats
+	a.ensureNetInterfacesInitialized()
+
+	a.ensureNetworkInterfacesMap(systemStats)
+
+	if netIO, err := psutilNet.IOCounters(true); err == nil {
+		nis, msElapsed := a.loadAndTickNetBaseline(cacheTimeMs)
+		totalBytesSent, totalBytesRecv := a.sumAndTrackPerNicDeltas(cacheTimeMs, msElapsed, netIO, systemStats)
+		bytesSentPerSecond, bytesRecvPerSecond := a.computeBytesPerSecond(msElapsed, totalBytesSent, totalBytesRecv, nis)
+		a.applyNetworkTotals(cacheTimeMs, netIO, systemStats, nis, totalBytesSent, totalBytesRecv, bytesSentPerSecond, bytesRecvPerSecond)
+	}
+}
+
+func (a *Agent) initializeNetIoStats() {
+	// reset valid network interfaces
+	a.netInterfaces = make(map[string]struct{}, 0)
+
+	// parse NICS env var for whitelist / blacklist
+	nicsEnvVal, nicsEnvExists := GetEnv("NICS")
+	var nicCfg *NicConfig
+	if nicsEnvExists {
+		nicCfg = newNicConfig(nicsEnvVal)
+	}
+
+	// get current network I/O stats and record valid interfaces
+	if netIO, err := psutilNet.IOCounters(true); err == nil {
+		for _, v := range netIO {
+			if nicsEnvExists && !isValidNic(v.Name, nicCfg) {
+				continue
+			}
+			if a.skipNetworkInterface(v) {
+				continue
+			}
+			slog.Info("Detected network interface", "name", v.Name, "sent", v.BytesSent, "recv", v.BytesRecv)
+			// store as a valid network interface
+			a.netInterfaces[v.Name] = struct{}{}
+		}
+	}
+
+	// Reset per-cache-time trackers and baselines so they will reinitialize on next use
+	a.netInterfaceDeltaTrackers = make(map[uint16]*deltatracker.DeltaTracker[string, uint64])
+	a.netIoStats = make(map[uint16]system.NetIoStats)
+}
+
+// ensureNetInterfacesInitialized re-initializes NICs if none are currently tracked
+func (a *Agent) ensureNetInterfacesInitialized() {
 	if len(a.netInterfaces) == 0 {
 		// if no network interfaces, initialize again
 		// this is a fix if agent started before network is online (#466)
@@ -22,48 +129,94 @@ func (a *Agent) updateNetworkStats(systemStats *system.Stats) {
 		// don't miss an interface that's been added after agent started in any circumstance
 		a.initializeNetIoStats()
 	}
+}
 
+// ensureNetworkInterfacesMap ensures systemStats.NetworkInterfaces map exists
+func (a *Agent) ensureNetworkInterfacesMap(systemStats *system.Stats) {
 	if systemStats.NetworkInterfaces == nil {
 		systemStats.NetworkInterfaces = make(map[string][4]uint64, 0)
 	}
+}
+
+// loadAndTickNetBaseline returns the NetIoStats baseline and milliseconds elapsed, updating time
+func (a *Agent) loadAndTickNetBaseline(cacheTimeMs uint16) (netIoStat system.NetIoStats, msElapsed uint64) {
+	netIoStat = a.netIoStats[cacheTimeMs]
+	if netIoStat.Time.IsZero() {
+		netIoStat.Time = time.Now()
+		msElapsed = 0
+	} else {
+		msElapsed = uint64(time.Since(netIoStat.Time).Milliseconds())
+		netIoStat.Time = time.Now()
+	}
+	return netIoStat, msElapsed
+}
+
+// sumAndTrackPerNicDeltas accumulates totals and records per-NIC up/down deltas into systemStats
+func (a *Agent) sumAndTrackPerNicDeltas(cacheTimeMs uint16, msElapsed uint64, netIO []psutilNet.IOCountersStat, systemStats *system.Stats) (totalBytesSent, totalBytesRecv uint64) {
+	tracker := a.netInterfaceDeltaTrackers[cacheTimeMs]
+	if tracker == nil {
+		tracker = deltatracker.NewDeltaTracker[string, uint64]()
+		a.netInterfaceDeltaTrackers[cacheTimeMs] = tracker
+	}
+	tracker.Cycle()
 
-	if netIO, err := psutilNet.IOCounters(true); err == nil {
-		msElapsed := uint64(time.Since(a.netIoStats.Time).Milliseconds())
-		a.netIoStats.Time = time.Now()
-		totalBytesSent := uint64(0)
-		totalBytesRecv := uint64(0)
-		netInterfaceDeltaTracker.Cycle()
-		// sum all bytes sent and received
 	for _, v := range netIO {
-			// skip if not in valid network interfaces list
 		if _, exists := a.netInterfaces[v.Name]; !exists {
 			continue
 		}
 		totalBytesSent += v.BytesSent
 		totalBytesRecv += v.BytesRecv
 
-			// track deltas for each network interface
 		var upDelta, downDelta uint64
 		upKey, downKey := fmt.Sprintf("%sup", v.Name), fmt.Sprintf("%sdown", v.Name)
-			netInterfaceDeltaTracker.Set(upKey, v.BytesSent)
+		tracker.Set(upKey, v.BytesSent)
-			netInterfaceDeltaTracker.Set(downKey, v.BytesRecv)
+		tracker.Set(downKey, v.BytesRecv)
 		if msElapsed > 0 {
-				upDelta = netInterfaceDeltaTracker.Delta(upKey) * 1000 / msElapsed
+			if prevVal, ok := tracker.Previous(upKey); ok {
-				downDelta = netInterfaceDeltaTracker.Delta(downKey) * 1000 / msElapsed
+				var deltaBytes uint64
+				if v.BytesSent >= prevVal {
+					deltaBytes = v.BytesSent - prevVal
+				} else {
+					deltaBytes = v.BytesSent
+				}
+				upDelta = deltaBytes * 1000 / msElapsed
+			}
+			if prevVal, ok := tracker.Previous(downKey); ok {
+				var deltaBytes uint64
+				if v.BytesRecv >= prevVal {
+					deltaBytes = v.BytesRecv - prevVal
+				} else {
+					deltaBytes = v.BytesRecv
+				}
+				downDelta = deltaBytes * 1000 / msElapsed
+			}
 		}
-			// add interface to systemStats
 		systemStats.NetworkInterfaces[v.Name] = [4]uint64{upDelta, downDelta, v.BytesSent, v.BytesRecv}
 	}
 
-		// add to systemStats
+	return totalBytesSent, totalBytesRecv
-		var bytesSentPerSecond, bytesRecvPerSecond uint64
+}
+
+// computeBytesPerSecond calculates per-second totals from elapsed time and totals
+func (a *Agent) computeBytesPerSecond(msElapsed, totalBytesSent, totalBytesRecv uint64, nis system.NetIoStats) (bytesSentPerSecond, bytesRecvPerSecond uint64) {
 	if msElapsed > 0 {
-			bytesSentPerSecond = (totalBytesSent - a.netIoStats.BytesSent) * 1000 / msElapsed
+		bytesSentPerSecond = (totalBytesSent - nis.BytesSent) * 1000 / msElapsed
-			bytesRecvPerSecond = (totalBytesRecv - a.netIoStats.BytesRecv) * 1000 / msElapsed
+		bytesRecvPerSecond = (totalBytesRecv - nis.BytesRecv) * 1000 / msElapsed
 	}
+	return bytesSentPerSecond, bytesRecvPerSecond
+}
+
+// applyNetworkTotals validates and writes computed network stats, or resets on anomaly
+func (a *Agent) applyNetworkTotals(
+	cacheTimeMs uint16,
+	netIO []psutilNet.IOCountersStat,
+	systemStats *system.Stats,
+	nis system.NetIoStats,
+	totalBytesSent, totalBytesRecv uint64,
+	bytesSentPerSecond, bytesRecvPerSecond uint64,
+) {
 	networkSentPs := bytesToMegabytes(float64(bytesSentPerSecond))
 	networkRecvPs := bytesToMegabytes(float64(bytesRecvPerSecond))
-		// add check for issue (#150) where sent is a massive number
 	if networkSentPs > 10_000 || networkRecvPs > 10_000 {
 		slog.Warn("Invalid net stats. Resetting.", "sent", networkSentPs, "recv", networkRecvPs)
 		for _, v := range netIO {
@@ -72,60 +225,21 @@ func (a *Agent) updateNetworkStats(systemStats *system.Stats) {
 			}
 			slog.Info(v.Name, "recv", v.BytesRecv, "sent", v.BytesSent)
 		}
-			// reset network I/O stats
 		a.initializeNetIoStats()
-		} else {
+		delete(a.netIoStats, cacheTimeMs)
+		delete(a.netInterfaceDeltaTrackers, cacheTimeMs)
+		systemStats.NetworkSent = 0
+		systemStats.NetworkRecv = 0
+		systemStats.Bandwidth[0], systemStats.Bandwidth[1] = 0, 0
+		return
+	}
+
 	systemStats.NetworkSent = networkSentPs
 	systemStats.NetworkRecv = networkRecvPs
 	systemStats.Bandwidth[0], systemStats.Bandwidth[1] = bytesSentPerSecond, bytesRecvPerSecond
-			// update netIoStats
+	nis.BytesSent = totalBytesSent
-			a.netIoStats.BytesSent = totalBytesSent
+	nis.BytesRecv = totalBytesRecv
-			a.netIoStats.BytesRecv = totalBytesRecv
+	a.netIoStats[cacheTimeMs] = nis
-		}
-	}
-}
-
-func (a *Agent) initializeNetIoStats() {
-	// reset valid network interfaces
-	a.netInterfaces = make(map[string]struct{}, 0)
-
-	// map of network interface names passed in via NICS env var
-	var nicsMap map[string]struct{}
-	nics, nicsEnvExists := GetEnv("NICS")
-	if nicsEnvExists {
-		nicsMap = make(map[string]struct{}, 0)
-		for nic := range strings.SplitSeq(nics, ",") {
-			nicsMap[nic] = struct{}{}
-		}
-	}
-
-	// reset network I/O stats
-	a.netIoStats.BytesSent = 0
-	a.netIoStats.BytesRecv = 0
-
-	// get intial network I/O stats
-	if netIO, err := psutilNet.IOCounters(true); err == nil {
-		a.netIoStats.Time = time.Now()
-		for _, v := range netIO {
-			switch {
-			// skip if nics exists and the interface is not in the list
-			case nicsEnvExists:
-				if _, nameInNics := nicsMap[v.Name]; !nameInNics {
-					continue
-				}
-			// otherwise run the interface name through the skipNetworkInterface function
-			default:
-				if a.skipNetworkInterface(v) {
-					continue
-				}
-			}
-			slog.Info("Detected network interface", "name", v.Name, "sent", v.BytesSent, "recv", v.BytesRecv)
-			a.netIoStats.BytesSent += v.BytesSent
-			a.netIoStats.BytesRecv += v.BytesRecv
-			// store as a valid network interface
-			a.netInterfaces[v.Name] = struct{}{}
-		}
-	}
 }
 
 func (a *Agent) skipNetworkInterface(v psutilNet.IOCountersStat) bool {
@@ -135,6 +249,7 @@ func (a *Agent) skipNetworkInterface(v psutilNet.IOCountersStat) bool {
 		strings.HasPrefix(v.Name, "br-"),
 		strings.HasPrefix(v.Name, "veth"),
 		strings.HasPrefix(v.Name, "bond"),
+		strings.HasPrefix(v.Name, "cali"),
 		v.BytesRecv == 0,
 		v.BytesSent == 0:
 		return true

agent/network_test.go

@@ -0,0 +1,502 @@
+//go:build testing
+
+package agent
+
+import (
+	"testing"
+	"time"
+
+	"github.com/henrygd/beszel/agent/deltatracker"
+	"github.com/henrygd/beszel/internal/entities/system"
+	psutilNet "github.com/shirou/gopsutil/v4/net"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsValidNic(t *testing.T) {
+	tests := []struct {
+		name          string
+		nicName       string
+		config        *NicConfig
+		expectedValid bool
+	}{
+		{
+			name:    "Whitelist - NIC in list",
+			nicName: "eth0",
+			config: &NicConfig{
+				nics:        map[string]struct{}{"eth0": {}},
+				isBlacklist: false,
+			},
+			expectedValid: true,
+		},
+		{
+			name:    "Whitelist - NIC not in list",
+			nicName: "wlan0",
+			config: &NicConfig{
+				nics:        map[string]struct{}{"eth0": {}},
+				isBlacklist: false,
+			},
+			expectedValid: false,
+		},
+		{
+			name:    "Blacklist - NIC in list",
+			nicName: "eth0",
+			config: &NicConfig{
+				nics:        map[string]struct{}{"eth0": {}},
+				isBlacklist: true,
+			},
+			expectedValid: false,
+		},
+		{
+			name:    "Blacklist - NIC not in list",
+			nicName: "wlan0",
+			config: &NicConfig{
+				nics:        map[string]struct{}{"eth0": {}},
+				isBlacklist: true,
+			},
+			expectedValid: true,
+		},
+		{
+			name:    "Whitelist with wildcard - matching pattern",
+			nicName: "eth1",
+			config: &NicConfig{
+				nics:         map[string]struct{}{"eth*": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+			expectedValid: true,
+		},
+		{
+			name:    "Whitelist with wildcard - non-matching pattern",
+			nicName: "wlan0",
+			config: &NicConfig{
+				nics:         map[string]struct{}{"eth*": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+			expectedValid: false,
+		},
+		{
+			name:    "Blacklist with wildcard - matching pattern",
+			nicName: "eth1",
+			config: &NicConfig{
+				nics:         map[string]struct{}{"eth*": {}},
+				isBlacklist:  true,
+				hasWildcards: true,
+			},
+			expectedValid: false,
+		},
+		{
+			name:    "Blacklist with wildcard - non-matching pattern",
+			nicName: "wlan0",
+			config: &NicConfig{
+				nics:         map[string]struct{}{"eth*": {}},
+				isBlacklist:  true,
+				hasWildcards: true,
+			},
+			expectedValid: true,
+		},
+		{
+			name:    "Empty whitelist config - no NICs allowed",
+			nicName: "eth0",
+			config: &NicConfig{
+				nics:        map[string]struct{}{},
+				isBlacklist: false,
+			},
+			expectedValid: false,
+		},
+		{
+			name:    "Empty blacklist config - all NICs allowed",
+			nicName: "eth0",
+			config: &NicConfig{
+				nics:        map[string]struct{}{},
+				isBlacklist: true,
+			},
+			expectedValid: true,
+		},
+		{
+			name:    "Multiple patterns - exact match",
+			nicName: "eth0",
+			config: &NicConfig{
+				nics:        map[string]struct{}{"eth0": {}, "wlan*": {}},
+				isBlacklist: false,
+			},
+			expectedValid: true,
+		},
+		{
+			name:    "Multiple patterns - wildcard match",
+			nicName: "wlan1",
+			config: &NicConfig{
+				nics:         map[string]struct{}{"eth0": {}, "wlan*": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+			expectedValid: true,
+		},
+		{
+			name:    "Multiple patterns - no match",
+			nicName: "bond0",
+			config: &NicConfig{
+				nics:         map[string]struct{}{"eth0": {}, "wlan*": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+			expectedValid: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isValidNic(tt.nicName, tt.config)
+			assert.Equal(t, tt.expectedValid, result)
+		})
+	}
+}
+
+func TestNewNicConfig(t *testing.T) {
+	tests := []struct {
+		name        string
+		nicsEnvVal  string
+		expectedCfg *NicConfig
+	}{
+		{
+			name:       "Empty string",
+			nicsEnvVal: "",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{},
+				isBlacklist:  false,
+				hasWildcards: false,
+			},
+		},
+		{
+			name:       "Single NIC whitelist",
+			nicsEnvVal: "eth0",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{"eth0": {}},
+				isBlacklist:  false,
+				hasWildcards: false,
+			},
+		},
+		{
+			name:       "Multiple NICs whitelist",
+			nicsEnvVal: "eth0,wlan0",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{"eth0": {}, "wlan0": {}},
+				isBlacklist:  false,
+				hasWildcards: false,
+			},
+		},
+		{
+			name:       "Blacklist mode",
+			nicsEnvVal: "-eth0,wlan0",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{"eth0": {}, "wlan0": {}},
+				isBlacklist:  true,
+				hasWildcards: false,
+			},
+		},
+		{
+			name:       "With wildcards",
+			nicsEnvVal: "eth*,wlan0",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{"eth*": {}, "wlan0": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+		},
+		{
+			name:       "Blacklist with wildcards",
+			nicsEnvVal: "-eth*,wlan0",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{"eth*": {}, "wlan0": {}},
+				isBlacklist:  true,
+				hasWildcards: true,
+			},
+		},
+		{
+			name:       "With whitespace",
+			nicsEnvVal: "eth0, wlan0 , eth1",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{"eth0": {}, "wlan0": {}, "eth1": {}},
+				isBlacklist:  false,
+				hasWildcards: false,
+			},
+		},
+		{
+			name:       "Only wildcards",
+			nicsEnvVal: "eth*,wlan*",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{"eth*": {}, "wlan*": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+		},
+		{
+			name:       "Leading dash only",
+			nicsEnvVal: "-",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{},
+				isBlacklist:  true,
+				hasWildcards: false,
+			},
+		},
+		{
+			name:       "Mixed exact and wildcard",
+			nicsEnvVal: "eth0,br-*",
+			expectedCfg: &NicConfig{
+				nics:         map[string]struct{}{"eth0": {}, "br-*": {}},
+				isBlacklist:  false,
+				hasWildcards: true,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := newNicConfig(tt.nicsEnvVal)
+			require.NotNil(t, cfg)
+			assert.Equal(t, tt.expectedCfg.isBlacklist, cfg.isBlacklist)
+			assert.Equal(t, tt.expectedCfg.hasWildcards, cfg.hasWildcards)
+			assert.Equal(t, tt.expectedCfg.nics, cfg.nics)
+		})
+	}
+}
+func TestEnsureNetworkInterfacesMap(t *testing.T) {
+	var a Agent
+	var stats system.Stats
+
+	// Initially nil
+	assert.Nil(t, stats.NetworkInterfaces)
+	// Ensure map is created
+	a.ensureNetworkInterfacesMap(&stats)
+	assert.NotNil(t, stats.NetworkInterfaces)
+	// Idempotent
+	a.ensureNetworkInterfacesMap(&stats)
+	assert.NotNil(t, stats.NetworkInterfaces)
+}
+
+func TestLoadAndTickNetBaseline(t *testing.T) {
+	a := &Agent{netIoStats: make(map[uint16]system.NetIoStats)}
+
+	// First call initializes time and returns 0 elapsed
+	ni, elapsed := a.loadAndTickNetBaseline(100)
+	assert.Equal(t, uint64(0), elapsed)
+	assert.False(t, ni.Time.IsZero())
+
+	// Store back what loadAndTick returns to mimic updateNetworkStats behavior
+	a.netIoStats[100] = ni
+
+	time.Sleep(2 * time.Millisecond)
+
+	// Next call should produce >= 0 elapsed and update time
+	ni2, elapsed2 := a.loadAndTickNetBaseline(100)
+	assert.True(t, elapsed2 > 0)
+	assert.False(t, ni2.Time.IsZero())
+}
+
+func TestComputeBytesPerSecond(t *testing.T) {
+	a := &Agent{}
+
+	// No elapsed -> zero rate
+	bytesUp, bytesDown := a.computeBytesPerSecond(0, 2000, 3000, system.NetIoStats{BytesSent: 1000, BytesRecv: 1000})
+	assert.Equal(t, uint64(0), bytesUp)
+	assert.Equal(t, uint64(0), bytesDown)
+
+	// With elapsed -> per-second calculation
+	bytesUp, bytesDown = a.computeBytesPerSecond(500, 6000, 11000, system.NetIoStats{BytesSent: 1000, BytesRecv: 1000})
+	// (6000-1000)*1000/500 = 10000; (11000-1000)*1000/500 = 20000
+	assert.Equal(t, uint64(10000), bytesUp)
+	assert.Equal(t, uint64(20000), bytesDown)
+}
+
+func TestSumAndTrackPerNicDeltas(t *testing.T) {
+	a := &Agent{
+		netInterfaces:             map[string]struct{}{"eth0": {}, "wlan0": {}},
+		netInterfaceDeltaTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
+	}
+
+	// Two samples for same cache interval to verify delta behavior
+	cache := uint16(42)
+	net1 := []psutilNet.IOCountersStat{{Name: "eth0", BytesSent: 1000, BytesRecv: 2000}}
+	stats1 := &system.Stats{}
+	a.ensureNetworkInterfacesMap(stats1)
+	tx1, rx1 := a.sumAndTrackPerNicDeltas(cache, 0, net1, stats1)
+	assert.Equal(t, uint64(1000), tx1)
+	assert.Equal(t, uint64(2000), rx1)
+
+	// Second cycle with elapsed, larger counters -> deltas computed inside
+	net2 := []psutilNet.IOCountersStat{{Name: "eth0", BytesSent: 4000, BytesRecv: 9000}}
+	stats := &system.Stats{}
+	a.ensureNetworkInterfacesMap(stats)
+	tx2, rx2 := a.sumAndTrackPerNicDeltas(cache, 1000, net2, stats)
+	assert.Equal(t, uint64(4000), tx2)
+	assert.Equal(t, uint64(9000), rx2)
+	// Up/Down deltas per second should be (4000-1000)/1s = 3000 and (9000-2000)/1s = 7000
+	ni, ok := stats.NetworkInterfaces["eth0"]
+	assert.True(t, ok)
+	assert.Equal(t, uint64(3000), ni[0])
+	assert.Equal(t, uint64(7000), ni[1])
+}
+
+func TestSumAndTrackPerNicDeltasHandlesCounterReset(t *testing.T) {
+	a := &Agent{
+		netInterfaces:             map[string]struct{}{"eth0": {}},
+		netInterfaceDeltaTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
+	}
+
+	cache := uint16(77)
+
+	// First interval establishes baseline values
+	initial := []psutilNet.IOCountersStat{{Name: "eth0", BytesSent: 4_000, BytesRecv: 6_000}}
+	statsInitial := &system.Stats{}
+	a.ensureNetworkInterfacesMap(statsInitial)
+	_, _ = a.sumAndTrackPerNicDeltas(cache, 0, initial, statsInitial)
+
+	// Second interval increments counters normally so previous snapshot gets populated
+	increment := []psutilNet.IOCountersStat{{Name: "eth0", BytesSent: 9_000, BytesRecv: 11_000}}
+	statsIncrement := &system.Stats{}
+	a.ensureNetworkInterfacesMap(statsIncrement)
+	_, _ = a.sumAndTrackPerNicDeltas(cache, 1_000, increment, statsIncrement)
+
+	niIncrement, ok := statsIncrement.NetworkInterfaces["eth0"]
+	require.True(t, ok)
+	assert.Equal(t, uint64(5_000), niIncrement[0])
+	assert.Equal(t, uint64(5_000), niIncrement[1])
+
+	// Third interval simulates counter reset (values drop below previous totals)
+	reset := []psutilNet.IOCountersStat{{Name: "eth0", BytesSent: 1_200, BytesRecv: 1_500}}
+	statsReset := &system.Stats{}
+	a.ensureNetworkInterfacesMap(statsReset)
+	_, _ = a.sumAndTrackPerNicDeltas(cache, 1_000, reset, statsReset)
+
+	niReset, ok := statsReset.NetworkInterfaces["eth0"]
+	require.True(t, ok)
+	assert.Equal(t, uint64(1_200), niReset[0], "upload delta should match new counter value after reset")
+	assert.Equal(t, uint64(1_500), niReset[1], "download delta should match new counter value after reset")
+}
+
+func TestApplyNetworkTotals(t *testing.T) {
+	tests := []struct {
+		name                  string
+		bytesSentPerSecond    uint64
+		bytesRecvPerSecond    uint64
+		totalBytesSent        uint64
+		totalBytesRecv        uint64
+		expectReset           bool
+		expectedNetworkSent   float64
+		expectedNetworkRecv   float64
+		expectedBandwidthSent uint64
+		expectedBandwidthRecv uint64
+	}{
+		{
+			name:                  "Valid network stats - normal values",
+			bytesSentPerSecond:    1000000, // 1 MB/s
+			bytesRecvPerSecond:    2000000, // 2 MB/s
+			totalBytesSent:        10000000,
+			totalBytesRecv:        20000000,
+			expectReset:           false,
+			expectedNetworkSent:   0.95, // ~1 MB/s rounded to 2 decimals
+			expectedNetworkRecv:   1.91, // ~2 MB/s rounded to 2 decimals
+			expectedBandwidthSent: 1000000,
+			expectedBandwidthRecv: 2000000,
+		},
+		{
+			name:               "Invalid network stats - sent exceeds threshold",
+			bytesSentPerSecond: 11000000000, // ~10.5 GB/s > 10 GB/s threshold
+			bytesRecvPerSecond: 1000000,     // 1 MB/s
+			totalBytesSent:     10000000,
+			totalBytesRecv:     20000000,
+			expectReset:        true,
+		},
+		{
+			name:               "Invalid network stats - recv exceeds threshold",
+			bytesSentPerSecond: 1000000,     // 1 MB/s
+			bytesRecvPerSecond: 11000000000, // ~10.5 GB/s > 10 GB/s threshold
+			totalBytesSent:     10000000,
+			totalBytesRecv:     20000000,
+			expectReset:        true,
+		},
+		{
+			name:               "Invalid network stats - both exceed threshold",
+			bytesSentPerSecond: 12000000000, // ~11.4 GB/s
+			bytesRecvPerSecond: 13000000000, // ~12.4 GB/s
+			totalBytesSent:     10000000,
+			totalBytesRecv:     20000000,
+			expectReset:        true,
+		},
+		{
+			name:                  "Valid network stats - at threshold boundary",
+			bytesSentPerSecond:    10485750000, // ~9999.99 MB/s (rounds to 9999.99)
+			bytesRecvPerSecond:    10485750000, // ~9999.99 MB/s (rounds to 9999.99)
+			totalBytesSent:        10000000,
+			totalBytesRecv:        20000000,
+			expectReset:           false,
+			expectedNetworkSent:   9999.99,
+			expectedNetworkRecv:   9999.99,
+			expectedBandwidthSent: 10485750000,
+			expectedBandwidthRecv: 10485750000,
+		},
+		{
+			name:                  "Zero values",
+			bytesSentPerSecond:    0,
+			bytesRecvPerSecond:    0,
+			totalBytesSent:        0,
+			totalBytesRecv:        0,
+			expectReset:           false,
+			expectedNetworkSent:   0.0,
+			expectedNetworkRecv:   0.0,
+			expectedBandwidthSent: 0,
+			expectedBandwidthRecv: 0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Setup agent with initialized maps
+			a := &Agent{
+				netInterfaces:             make(map[string]struct{}),
+				netIoStats:                make(map[uint16]system.NetIoStats),
+				netInterfaceDeltaTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
+			}
+
+			cacheTimeMs := uint16(100)
+			netIO := []psutilNet.IOCountersStat{
+				{Name: "eth0", BytesSent: 1000, BytesRecv: 2000},
+			}
+			systemStats := &system.Stats{}
+			nis := system.NetIoStats{}
+
+			a.applyNetworkTotals(
+				cacheTimeMs,
+				netIO,
+				systemStats,
+				nis,
+				tt.totalBytesSent,
+				tt.totalBytesRecv,
+				tt.bytesSentPerSecond,
+				tt.bytesRecvPerSecond,
+			)
+
+			if tt.expectReset {
+				// Should have reset network tracking state - maps cleared and stats zeroed
+				assert.NotContains(t, a.netIoStats, cacheTimeMs, "cache entry should be cleared after reset")
+				assert.NotContains(t, a.netInterfaceDeltaTrackers, cacheTimeMs, "tracker should be cleared on reset")
+				assert.Zero(t, systemStats.NetworkSent)
+				assert.Zero(t, systemStats.NetworkRecv)
+				assert.Zero(t, systemStats.Bandwidth[0])
+				assert.Zero(t, systemStats.Bandwidth[1])
+			} else {
+				// Should have applied stats
+				assert.Equal(t, tt.expectedNetworkSent, systemStats.NetworkSent)
+				assert.Equal(t, tt.expectedNetworkRecv, systemStats.NetworkRecv)
+				assert.Equal(t, tt.expectedBandwidthSent, systemStats.Bandwidth[0])
+				assert.Equal(t, tt.expectedBandwidthRecv, systemStats.Bandwidth[1])
+
+				// Should have updated NetIoStats
+				updatedNis := a.netIoStats[cacheTimeMs]
+				assert.Equal(t, tt.totalBytesSent, updatedNis.BytesSent)
+				assert.Equal(t, tt.totalBytesRecv, updatedNis.BytesRecv)
+			}
+		})
+	}
+}

agent/response.go

@@ -0,0 +1,31 @@
+package agent
+
+import (
+	"github.com/fxamacker/cbor/v2"
+	"github.com/henrygd/beszel/internal/common"
+	"github.com/henrygd/beszel/internal/entities/smart"
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/henrygd/beszel/internal/entities/systemd"
+)
+
+// newAgentResponse creates an AgentResponse using legacy typed fields.
+// This maintains backward compatibility with <= 0.17 hubs that expect specific fields.
+func newAgentResponse(data any, requestID *uint32) common.AgentResponse {
+	response := common.AgentResponse{Id: requestID}
+	switch v := data.(type) {
+	case *system.CombinedData:
+		response.SystemData = v
+	case *common.FingerprintResponse:
+		response.Fingerprint = v
+	case string:
+		response.String = &v
+	case map[string]smart.SmartData:
+		response.SmartData = v
+	case systemd.ServiceDetails:
+		response.ServiceInfo = v
+	default:
+		// For unknown types, use the generic Data field
+		response.Data, _ = cbor.Marshal(data)
+	}
+	return response
+}

agent/sensors_test.go

@@ -1,5 +1,4 @@
 //go:build testing
-// +build testing
 
 package agent
 

agent/server.go

@@ -36,6 +36,9 @@ var hubVersions map[string]semver.Version
 // and begins listening for connections. Returns an error if the server
 // is already running or if there's an issue starting the server.
 func (a *Agent) StartServer(opts ServerOptions) error {
+	if disableSSH, _ := GetEnv("DISABLE_SSH"); disableSSH == "true" {
+		return errors.New("SSH disabled")
+	}
 	if a.server != nil {
 		return errors.New("server already started")
 	}
@@ -127,15 +130,70 @@ func (a *Agent) handleSession(s ssh.Session) {
 
 	hubVersion := a.getHubVersion(sessionID, sessionCtx)
 
-	stats := a.gatherStats(sessionID)
+	// Legacy one-shot behavior for older hubs
-
+	if hubVersion.LT(beszel.MinVersionAgentResponse) {
-	err := a.writeToSession(s, stats, hubVersion)
+		if err := a.handleLegacyStats(s, hubVersion); err != nil {
-	if err != nil {
+			slog.Error("Error encoding stats", "err", err)
-		slog.Error("Error encoding stats", "err", err, "stats", stats)
 			s.Exit(1)
-	} else {
+			return
-		s.Exit(0)
 		}
+	}
+
+	var req common.HubRequest[cbor.RawMessage]
+	if err := cbor.NewDecoder(s).Decode(&req); err != nil {
+		// Fallback to legacy one-shot if the first decode fails
+		if err2 := a.handleLegacyStats(s, hubVersion); err2 != nil {
+			slog.Error("Error encoding stats (fallback)", "err", err2)
+			s.Exit(1)
+			return
+		}
+		s.Exit(0)
+		return
+	}
+	if err := a.handleSSHRequest(s, &req); err != nil {
+		slog.Error("SSH request handling failed", "err", err)
+		s.Exit(1)
+		return
+	}
+	s.Exit(0)
+}
+
+// handleSSHRequest builds a handler context and dispatches to the shared registry
+func (a *Agent) handleSSHRequest(w io.Writer, req *common.HubRequest[cbor.RawMessage]) error {
+	// SSH does not support fingerprint auth action
+	if req.Action == common.CheckFingerprint {
+		return cbor.NewEncoder(w).Encode(common.AgentResponse{Error: "unsupported action"})
+	}
+
+	// responder that writes AgentResponse to stdout
+	// Uses legacy typed fields for backward compatibility with <= 0.17
+	sshResponder := func(data any, requestID *uint32) error {
+		response := newAgentResponse(data, requestID)
+		return cbor.NewEncoder(w).Encode(response)
+	}
+
+	ctx := &HandlerContext{
+		Client:       nil,
+		Agent:        a,
+		Request:      req,
+		RequestID:    nil,
+		HubVerified:  true,
+		SendResponse: sshResponder,
+	}
+
+	if handler, ok := a.handlerRegistry.GetHandler(req.Action); ok {
+		if err := handler.Handle(ctx); err != nil {
+			return cbor.NewEncoder(w).Encode(common.AgentResponse{Error: err.Error()})
+		}
+		return nil
+	}
+	return cbor.NewEncoder(w).Encode(common.AgentResponse{Error: fmt.Sprintf("unknown action: %d", req.Action)})
+}
+
+// handleLegacyStats serves the legacy one-shot stats payload for older hubs
+func (a *Agent) handleLegacyStats(w io.Writer, hubVersion semver.Version) error {
+	stats := a.gatherStats(common.DataRequestOptions{CacheTimeMs: 60_000})
+	return a.writeToSession(w, stats, hubVersion)
 }
 
 // writeToSession encodes and writes system statistics to the session.

agent/server_test.go

@@ -1,3 +1,5 @@
+//go:build testing
+
 package agent
 
 import (
@@ -180,6 +182,23 @@ func TestStartServer(t *testing.T) {
 	}
 }
 
+func TestStartServerDisableSSH(t *testing.T) {
+	os.Setenv("BESZEL_AGENT_DISABLE_SSH", "true")
+	defer os.Unsetenv("BESZEL_AGENT_DISABLE_SSH")
+
+	agent, err := NewAgent("")
+	require.NoError(t, err)
+
+	opts := ServerOptions{
+		Network: "tcp",
+		Addr:    ":45990",
+	}
+
+	err = agent.StartServer(opts)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "SSH disabled")
+}
+
 /////////////////////////////////////////////////////////////////
 //////////////////// ParseKeys Tests ////////////////////////////
 /////////////////////////////////////////////////////////////////
@@ -513,7 +532,7 @@ func TestWriteToSessionEncoding(t *testing.T) {
 				err = json.Unmarshal([]byte(encodedData), &decodedJson)
 				assert.Error(t, err, "Should not be valid JSON data")
 
-				assert.Equal(t, testData.Info.Hostname, decodedCbor.Info.Hostname)
+				assert.Equal(t, testData.Details.Hostname, decodedCbor.Details.Hostname)
 				assert.Equal(t, testData.Stats.Cpu, decodedCbor.Stats.Cpu)
 			} else {
 				// Should be JSON - try to decode as JSON
@@ -526,7 +545,7 @@ func TestWriteToSessionEncoding(t *testing.T) {
 				assert.Error(t, err, "Should not be valid CBOR data")
 
 				// Verify the decoded JSON data matches our test data
-				assert.Equal(t, testData.Info.Hostname, decodedJson.Info.Hostname)
+				assert.Equal(t, testData.Details.Hostname, decodedJson.Details.Hostname)
 				assert.Equal(t, testData.Stats.Cpu, decodedJson.Stats.Cpu)
 
 				// Verify it looks like JSON (starts with '{' and contains readable field names)
@@ -550,13 +569,12 @@ func createTestCombinedData() *system.CombinedData {
 			DiskUsed:  549755813888,  // 512GB
 			DiskPct:   50.0,
 		},
-		Info: system.Info{
+		Details: &system.Details{
 			Hostname: "test-host",
-			Cores:        8,
+		},
-			CpuModel:     "Test CPU Model",
+		Info: system.Info{
 			Uptime:       3600,
 			AgentVersion: "0.12.0",
-			Os:           system.Linux,
 		},
 		Containers: []*container.Stats{
 			{

agent/smart_nonwindows.go

@@ -0,0 +1,9 @@
+//go:build !windows
+
+package agent
+
+import "errors"
+
+func ensureEmbeddedSmartctl() (string, error) {
+	return "", errors.ErrUnsupported
+}

agent/smart_test.go

@@ -0,0 +1,953 @@
+//go:build testing
+
+package agent
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/henrygd/beszel/internal/entities/smart"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseSmartForScsi(t *testing.T) {
+	fixturePath := filepath.Join("test-data", "smart", "scsi.json")
+	data, err := os.ReadFile(fixturePath)
+	if err != nil {
+		t.Fatalf("failed reading fixture: %v", err)
+	}
+
+	sm := &SmartManager{
+		SmartDataMap: make(map[string]*smart.SmartData),
+	}
+
+	hasData, exitStatus := sm.parseSmartForScsi(data)
+	if !hasData {
+		t.Fatalf("expected SCSI data to parse successfully")
+	}
+	if exitStatus != 0 {
+		t.Fatalf("expected exit status 0, got %d", exitStatus)
+	}
+
+	deviceData, ok := sm.SmartDataMap["9YHSDH9B"]
+	if !ok {
+		t.Fatalf("expected smart data entry for serial 9YHSDH9B")
+	}
+
+	assert.Equal(t, deviceData.ModelName, "YADRO WUH721414AL4204")
+	assert.Equal(t, deviceData.SerialNumber, "9YHSDH9B")
+	assert.Equal(t, deviceData.FirmwareVersion, "C240")
+	assert.Equal(t, deviceData.DiskName, "/dev/sde")
+	assert.Equal(t, deviceData.DiskType, "scsi")
+	assert.EqualValues(t, deviceData.Temperature, 34)
+	assert.Equal(t, deviceData.SmartStatus, "PASSED")
+	assert.EqualValues(t, deviceData.Capacity, 14000519643136)
+
+	if len(deviceData.Attributes) == 0 {
+		t.Fatalf("expected attributes to be populated")
+	}
+
+	assertAttrValue(t, deviceData.Attributes, "PowerOnHours", 458)
+	assertAttrValue(t, deviceData.Attributes, "PowerOnMinutes", 25)
+	assertAttrValue(t, deviceData.Attributes, "GrownDefectList", 0)
+	assertAttrValue(t, deviceData.Attributes, "StartStopCycles", 2)
+	assertAttrValue(t, deviceData.Attributes, "LoadUnloadCycles", 418)
+	assertAttrValue(t, deviceData.Attributes, "ReadGigabytesProcessed", 3641)
+	assertAttrValue(t, deviceData.Attributes, "WriteGigabytesProcessed", 2124590)
+	assertAttrValue(t, deviceData.Attributes, "VerifyGigabytesProcessed", 0)
+}
+
+func TestParseSmartForSata(t *testing.T) {
+	fixturePath := filepath.Join("test-data", "smart", "sda.json")
+	data, err := os.ReadFile(fixturePath)
+	require.NoError(t, err)
+
+	sm := &SmartManager{
+		SmartDataMap: make(map[string]*smart.SmartData),
+	}
+
+	hasData, exitStatus := sm.parseSmartForSata(data)
+	require.True(t, hasData)
+	assert.Equal(t, 64, exitStatus)
+
+	deviceData, ok := sm.SmartDataMap["9C40918040082"]
+	require.True(t, ok, "expected smart data entry for serial 9C40918040082")
+
+	assert.Equal(t, "P3-2TB", deviceData.ModelName)
+	assert.Equal(t, "X0104A0", deviceData.FirmwareVersion)
+	assert.Equal(t, "/dev/sda", deviceData.DiskName)
+	assert.Equal(t, "sat", deviceData.DiskType)
+	assert.Equal(t, uint8(31), deviceData.Temperature)
+	assert.Equal(t, "PASSED", deviceData.SmartStatus)
+	assert.Equal(t, uint64(2048408248320), deviceData.Capacity)
+	if assert.NotEmpty(t, deviceData.Attributes) {
+		assertAttrValue(t, deviceData.Attributes, "Temperature_Celsius", 31)
+	}
+}
+
+func TestParseSmartForSataDeviceStatisticsTemperature(t *testing.T) {
+	jsonPayload := []byte(`{
+		"smartctl": {"exit_status": 0},
+		"device": {"name": "/dev/sdb", "type": "sat"},
+		"model_name": "SanDisk SSD U110 16GB",
+		"serial_number": "DEVSTAT123",
+		"firmware_version": "U21B001",
+		"user_capacity": {"bytes": 16013942784},
+		"smart_status": {"passed": true},
+		"ata_smart_attributes": {"table": []},
+		"ata_device_statistics": {
+			"pages": [
+				{
+					"number": 5,
+					"name": "Temperature Statistics",
+					"table": [
+						{"name": "Current Temperature", "value": 22, "flags": {"valid": true}}
+					]
+				}
+			]
+		}
+	}`)
+
+	sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
+	hasData, exitStatus := sm.parseSmartForSata(jsonPayload)
+	require.True(t, hasData)
+	assert.Equal(t, 0, exitStatus)
+
+	deviceData, ok := sm.SmartDataMap["DEVSTAT123"]
+	require.True(t, ok, "expected smart data entry for serial DEVSTAT123")
+	assert.Equal(t, uint8(22), deviceData.Temperature)
+}
+
+func TestParseSmartForSataParentheticalRawValue(t *testing.T) {
+	jsonPayload := []byte(`{
+		"smartctl": {"exit_status": 0},
+		"device": {"name": "/dev/sdz", "type": "sat"},
+		"model_name": "Example",
+		"serial_number": "PARENTHESES123",
+		"firmware_version": "1.0",
+		"user_capacity": {"bytes": 1024},
+		"smart_status": {"passed": true},
+		"temperature": {"current": 25},
+		"ata_smart_attributes": {
+			"table": [
+				{
+					"id": 9,
+					"name": "Power_On_Hours",
+					"value": 93,
+					"worst": 55,
+					"thresh": 0,
+					"when_failed": "",
+                    "raw": {
+                        "value": 57891864217128,
+                        "string": "39925 (212 206 0)"
+                    }
+				}
+			]
+		}
+	}`)
+
+	sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
+
+	hasData, exitStatus := sm.parseSmartForSata(jsonPayload)
+	require.True(t, hasData)
+	assert.Equal(t, 0, exitStatus)
+
+	data, ok := sm.SmartDataMap["PARENTHESES123"]
+	require.True(t, ok)
+	require.Len(t, data.Attributes, 1)
+
+	attr := data.Attributes[0]
+	assert.Equal(t, uint64(39925), attr.RawValue)
+	assert.Equal(t, "39925 (212 206 0)", attr.RawString)
+}
+
+func TestParseSmartForNvme(t *testing.T) {
+	fixturePath := filepath.Join("test-data", "smart", "nvme0.json")
+	data, err := os.ReadFile(fixturePath)
+	require.NoError(t, err)
+
+	sm := &SmartManager{
+		SmartDataMap: make(map[string]*smart.SmartData),
+	}
+
+	hasData, exitStatus := sm.parseSmartForNvme(data)
+	require.True(t, hasData)
+	assert.Equal(t, 0, exitStatus)
+
+	deviceData, ok := sm.SmartDataMap["2024031600129"]
+	require.True(t, ok, "expected smart data entry for serial 2024031600129")
+
+	assert.Equal(t, "PELADN 512GB", deviceData.ModelName)
+	assert.Equal(t, "VC2S038E", deviceData.FirmwareVersion)
+	assert.Equal(t, "/dev/nvme0", deviceData.DiskName)
+	assert.Equal(t, "nvme", deviceData.DiskType)
+	assert.Equal(t, uint8(61), deviceData.Temperature)
+	assert.Equal(t, "PASSED", deviceData.SmartStatus)
+	assert.Equal(t, uint64(512110190592), deviceData.Capacity)
+	if assert.NotEmpty(t, deviceData.Attributes) {
+		assertAttrValue(t, deviceData.Attributes, "PercentageUsed", 0)
+		assertAttrValue(t, deviceData.Attributes, "DataUnitsWritten", 16040567)
+	}
+}
+
+func TestHasDataForDevice(t *testing.T) {
+	sm := &SmartManager{
+		SmartDataMap: map[string]*smart.SmartData{
+			"serial-1": {DiskName: "/dev/sda"},
+			"serial-2": nil,
+		},
+	}
+
+	assert.True(t, sm.hasDataForDevice("/dev/sda"))
+	assert.False(t, sm.hasDataForDevice("/dev/sdb"))
+}
+
+func TestDevicesSnapshotReturnsCopy(t *testing.T) {
+	originalDevice := &DeviceInfo{Name: "/dev/sda"}
+	sm := &SmartManager{
+		SmartDevices: []*DeviceInfo{
+			originalDevice,
+			{Name: "/dev/sdb"},
+		},
+	}
+
+	snapshot := sm.devicesSnapshot()
+	require.Len(t, snapshot, 2)
+
+	sm.SmartDevices[0] = &DeviceInfo{Name: "/dev/sdz"}
+	assert.Equal(t, "/dev/sda", snapshot[0].Name)
+
+	snapshot[1] = &DeviceInfo{Name: "/dev/nvme0"}
+	assert.Equal(t, "/dev/sdb", sm.SmartDevices[1].Name)
+
+	sm.SmartDevices = append(sm.SmartDevices, &DeviceInfo{Name: "/dev/nvme1"})
+	assert.Len(t, snapshot, 2)
+}
+
+func TestScanDevicesWithEnvOverrideAndSeparator(t *testing.T) {
+	t.Setenv("SMART_DEVICES_SEPARATOR", "|")
+	t.Setenv("SMART_DEVICES", "/dev/sda:jmb39x-q,0|/dev/nvme0:nvme")
+
+	sm := &SmartManager{
+		SmartDataMap: make(map[string]*smart.SmartData),
+	}
+
+	err := sm.ScanDevices(true)
+	require.NoError(t, err)
+
+	require.Len(t, sm.SmartDevices, 2)
+	assert.Equal(t, "/dev/sda", sm.SmartDevices[0].Name)
+	assert.Equal(t, "jmb39x-q,0", sm.SmartDevices[0].Type)
+	assert.Equal(t, "/dev/nvme0", sm.SmartDevices[1].Name)
+	assert.Equal(t, "nvme", sm.SmartDevices[1].Type)
+}
+
+func TestScanDevicesWithEnvOverride(t *testing.T) {
+	t.Setenv("SMART_DEVICES", "/dev/sda:sat, /dev/nvme0:nvme")
+
+	sm := &SmartManager{
+		SmartDataMap: make(map[string]*smart.SmartData),
+	}
+
+	err := sm.ScanDevices(true)
+	require.NoError(t, err)
+
+	require.Len(t, sm.SmartDevices, 2)
+	assert.Equal(t, "/dev/sda", sm.SmartDevices[0].Name)
+	assert.Equal(t, "sat", sm.SmartDevices[0].Type)
+	assert.Equal(t, "/dev/nvme0", sm.SmartDevices[1].Name)
+	assert.Equal(t, "nvme", sm.SmartDevices[1].Type)
+}
+
+func TestScanDevicesWithEnvOverrideInvalid(t *testing.T) {
+	t.Setenv("SMART_DEVICES", ":sat")
+
+	sm := &SmartManager{
+		SmartDataMap: make(map[string]*smart.SmartData),
+	}
+
+	err := sm.ScanDevices(true)
+	require.Error(t, err)
+}
+
+func TestScanDevicesWithEnvOverrideEmpty(t *testing.T) {
+	t.Setenv("SMART_DEVICES", "   ")
+
+	sm := &SmartManager{
+		SmartDataMap: make(map[string]*smart.SmartData),
+	}
+
+	err := sm.ScanDevices(true)
+	assert.ErrorIs(t, err, errNoValidSmartData)
+	assert.Empty(t, sm.SmartDevices)
+}
+
+func TestSmartctlArgsWithoutType(t *testing.T) {
+	device := &DeviceInfo{Name: "/dev/sda"}
+
+	sm := &SmartManager{}
+
+	args := sm.smartctlArgs(device, true)
+	assert.Equal(t, []string{"-a", "--json=c", "-n", "standby", "/dev/sda"}, args)
+}
+
+func TestSmartctlArgs(t *testing.T) {
+	sm := &SmartManager{}
+
+	sataDevice := &DeviceInfo{Name: "/dev/sda", Type: "sat"}
+	assert.Equal(t,
+		[]string{"-d", "sat", "-a", "--json=c", "-l", "devstat", "-n", "standby", "/dev/sda"},
+		sm.smartctlArgs(sataDevice, true),
+	)
+
+	assert.Equal(t,
+		[]string{"-d", "sat", "-a", "--json=c", "-l", "devstat", "/dev/sda"},
+		sm.smartctlArgs(sataDevice, false),
+	)
+
+	nvmeDevice := &DeviceInfo{Name: "/dev/nvme0", Type: "nvme"}
+	assert.Equal(t,
+		[]string{"-d", "nvme", "-a", "--json=c", "-n", "standby", "/dev/nvme0"},
+		sm.smartctlArgs(nvmeDevice, true),
+	)
+
+	assert.Equal(t,
+		[]string{"-a", "--json=c", "-n", "standby"},
+		sm.smartctlArgs(nil, true),
+	)
+}
+
+func TestResolveRefreshError(t *testing.T) {
+	scanErr := errors.New("scan failed")
+	collectErr := errors.New("collect failed")
+
+	tests := []struct {
+		name        string
+		devices     []*DeviceInfo
+		data        map[string]*smart.SmartData
+		scanErr     error
+		collectErr  error
+		expectedErr error
+		expectNoErr bool
+	}{
+		{
+			name:        "no devices returns scan error",
+			devices:     nil,
+			data:        make(map[string]*smart.SmartData),
+			scanErr:     scanErr,
+			expectedErr: scanErr,
+		},
+		{
+			name:        "has data ignores errors",
+			devices:     []*DeviceInfo{{Name: "/dev/sda"}},
+			data:        map[string]*smart.SmartData{"serial": {}},
+			scanErr:     scanErr,
+			collectErr:  collectErr,
+			expectNoErr: true,
+		},
+		{
+			name:        "collect error preferred",
+			devices:     []*DeviceInfo{{Name: "/dev/sda"}},
+			data:        make(map[string]*smart.SmartData),
+			collectErr:  collectErr,
+			expectedErr: collectErr,
+		},
+		{
+			name:        "scan error returned when no data",
+			devices:     []*DeviceInfo{{Name: "/dev/sda"}},
+			data:        make(map[string]*smart.SmartData),
+			scanErr:     scanErr,
+			expectedErr: scanErr,
+		},
+		{
+			name:        "no errors returns sentinel",
+			devices:     []*DeviceInfo{{Name: "/dev/sda"}},
+			data:        make(map[string]*smart.SmartData),
+			expectedErr: errNoValidSmartData,
+		},
+		{
+			name:        "no devices collect error",
+			devices:     nil,
+			data:        make(map[string]*smart.SmartData),
+			collectErr:  collectErr,
+			expectedErr: collectErr,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			sm := &SmartManager{
+				SmartDevices: tt.devices,
+				SmartDataMap: tt.data,
+			}
+
+			err := sm.resolveRefreshError(tt.scanErr, tt.collectErr)
+			if tt.expectNoErr {
+				assert.NoError(t, err)
+				return
+			}
+
+			if tt.expectedErr == nil {
+				assert.NoError(t, err)
+			} else {
+				assert.Equal(t, tt.expectedErr, err)
+			}
+		})
+	}
+}
+
+func TestParseScan(t *testing.T) {
+	sm := &SmartManager{
+		SmartDataMap: map[string]*smart.SmartData{
+			"serial-active": {DiskName: "/dev/sda"},
+			"serial-stale":  {DiskName: "/dev/sdb"},
+		},
+	}
+
+	scanJSON := []byte(`{
+        "devices": [
+            {"name": "/dev/sda", "type": "sat", "info_name": "/dev/sda [SAT]", "protocol": "ATA"},
+            {"name": "/dev/nvme0", "type": "nvme", "info_name": "/dev/nvme0", "protocol": "NVMe"}
+        ]
+    }`)
+
+	devices, hasData := sm.parseScan(scanJSON)
+	assert.True(t, hasData)
+
+	sm.updateSmartDevices(devices)
+
+	require.Len(t, sm.SmartDevices, 2)
+	assert.Equal(t, "/dev/sda", sm.SmartDevices[0].Name)
+	assert.Equal(t, "sat", sm.SmartDevices[0].Type)
+	assert.Equal(t, "/dev/nvme0", sm.SmartDevices[1].Name)
+	assert.Equal(t, "nvme", sm.SmartDevices[1].Type)
+
+	_, activeExists := sm.SmartDataMap["serial-active"]
+	assert.True(t, activeExists, "active smart data should be preserved when device path remains")
+
+	_, staleExists := sm.SmartDataMap["serial-stale"]
+	assert.False(t, staleExists, "stale smart data entry should be removed when device path disappears")
+}
+
+func TestMergeDeviceListsPrefersConfigured(t *testing.T) {
+	scanned := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "sat", InfoName: "scan-info", Protocol: "ATA"},
+		{Name: "/dev/nvme0", Type: "nvme"},
+	}
+
+	configured := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "sat-override"},
+		{Name: "/dev/sdb", Type: "sat"},
+	}
+
+	merged := mergeDeviceLists(nil, scanned, configured)
+	require.Len(t, merged, 3)
+
+	byName := make(map[string]*DeviceInfo, len(merged))
+	for _, dev := range merged {
+		byName[dev.Name] = dev
+	}
+
+	require.Contains(t, byName, "/dev/sda")
+	assert.Equal(t, "sat-override", byName["/dev/sda"].Type, "configured type should override scanned type")
+	assert.Equal(t, "scan-info", byName["/dev/sda"].InfoName, "scan metadata should be preserved when config does not provide it")
+
+	require.Contains(t, byName, "/dev/nvme0")
+	assert.Equal(t, "nvme", byName["/dev/nvme0"].Type)
+
+	require.Contains(t, byName, "/dev/sdb")
+	assert.Equal(t, "sat", byName["/dev/sdb"].Type)
+}
+
+func TestMergeDeviceListsPreservesVerification(t *testing.T) {
+	existing := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "sat+megaraid", parserType: "sat", typeVerified: true},
+	}
+
+	scanned := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "nvme"},
+	}
+
+	merged := mergeDeviceLists(existing, scanned, nil)
+	require.Len(t, merged, 1)
+
+	device := merged[0]
+	assert.True(t, device.typeVerified)
+	assert.Equal(t, "sat", device.parserType)
+	assert.Equal(t, "sat+megaraid", device.Type)
+}
+
+func TestMergeDeviceListsUpdatesTypeWhenUnverified(t *testing.T) {
+	existing := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "sat", parserType: "sat", typeVerified: false},
+	}
+
+	scanned := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "nvme"},
+	}
+
+	merged := mergeDeviceLists(existing, scanned, nil)
+	require.Len(t, merged, 1)
+
+	device := merged[0]
+	assert.False(t, device.typeVerified)
+	assert.Equal(t, "nvme", device.Type)
+	assert.Equal(t, "", device.parserType)
+}
+
+func TestMergeDeviceListsHandlesDevicesWithSameNameAndDifferentTypes(t *testing.T) {
+	// There are use cases where the same device name is re-used,
+	// for example, a RAID controller with multiple drives.
+	scanned := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "megaraid,0"},
+		{Name: "/dev/sda", Type: "megaraid,1"},
+		{Name: "/dev/sda", Type: "megaraid,2"},
+	}
+
+	merged := mergeDeviceLists(nil, scanned, nil)
+	require.Len(t, merged, 3, "should have 3 separate devices for RAID controller")
+
+	byKey := make(map[string]*DeviceInfo, len(merged))
+	for _, dev := range merged {
+		key := dev.Name + "|" + dev.Type
+		byKey[key] = dev
+	}
+
+	assert.Contains(t, byKey, "/dev/sda|megaraid,0")
+	assert.Contains(t, byKey, "/dev/sda|megaraid,1")
+	assert.Contains(t, byKey, "/dev/sda|megaraid,2")
+}
+
+func TestMergeDeviceListsHandlesMixedRAIDAndRegular(t *testing.T) {
+	// Test mixing RAID drives with regular devices
+	scanned := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "megaraid,0"},
+		{Name: "/dev/sda", Type: "megaraid,1"},
+		{Name: "/dev/sdb", Type: "sat"},
+		{Name: "/dev/nvme0", Type: "nvme"},
+	}
+
+	merged := mergeDeviceLists(nil, scanned, nil)
+	require.Len(t, merged, 4, "should have 4 separate devices")
+
+	byKey := make(map[string]*DeviceInfo, len(merged))
+	for _, dev := range merged {
+		key := dev.Name + "|" + dev.Type
+		byKey[key] = dev
+	}
+
+	assert.Contains(t, byKey, "/dev/sda|megaraid,0")
+	assert.Contains(t, byKey, "/dev/sda|megaraid,1")
+	assert.Contains(t, byKey, "/dev/sdb|sat")
+	assert.Contains(t, byKey, "/dev/nvme0|nvme")
+}
+
+func TestUpdateSmartDevicesPreservesRAIDDrives(t *testing.T) {
+	// Test that updateSmartDevices correctly validates RAID drives using composite keys
+	sm := &SmartManager{
+		SmartDevices: []*DeviceInfo{
+			{Name: "/dev/sda", Type: "megaraid,0"},
+			{Name: "/dev/sda", Type: "megaraid,1"},
+		},
+		SmartDataMap: map[string]*smart.SmartData{
+			"serial-0": {
+				DiskName:     "/dev/sda",
+				DiskType:     "megaraid,0",
+				SerialNumber: "serial-0",
+			},
+			"serial-1": {
+				DiskName:     "/dev/sda",
+				DiskType:     "megaraid,1",
+				SerialNumber: "serial-1",
+			},
+			"serial-stale": {
+				DiskName:     "/dev/sda",
+				DiskType:     "megaraid,2",
+				SerialNumber: "serial-stale",
+			},
+		},
+	}
+
+	sm.updateSmartDevices(sm.SmartDevices)
+
+	// serial-0 and serial-1 should be preserved (matching devices exist)
+	assert.Contains(t, sm.SmartDataMap, "serial-0")
+	assert.Contains(t, sm.SmartDataMap, "serial-1")
+	// serial-stale should be removed (no matching device)
+	assert.NotContains(t, sm.SmartDataMap, "serial-stale")
+}
+
+func TestParseSmartOutputMarksVerified(t *testing.T) {
+	fixturePath := filepath.Join("test-data", "smart", "nvme0.json")
+	data, err := os.ReadFile(fixturePath)
+	require.NoError(t, err)
+
+	sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
+	device := &DeviceInfo{Name: "/dev/nvme0"}
+
+	require.True(t, sm.parseSmartOutput(device, data))
+	assert.Equal(t, "nvme", device.Type)
+	assert.Equal(t, "nvme", device.parserType)
+	assert.True(t, device.typeVerified)
+}
+
+func TestParseSmartOutputKeepsCustomType(t *testing.T) {
+	fixturePath := filepath.Join("test-data", "smart", "sda.json")
+	data, err := os.ReadFile(fixturePath)
+	require.NoError(t, err)
+
+	sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
+	device := &DeviceInfo{Name: "/dev/sda", Type: "sat+megaraid"}
+
+	require.True(t, sm.parseSmartOutput(device, data))
+	assert.Equal(t, "sat+megaraid", device.Type)
+	assert.Equal(t, "sat", device.parserType)
+	assert.True(t, device.typeVerified)
+}
+
+func TestParseSmartOutputResetsVerificationOnFailure(t *testing.T) {
+	sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
+	device := &DeviceInfo{Name: "/dev/sda", Type: "sat", parserType: "sat", typeVerified: true}
+
+	assert.False(t, sm.parseSmartOutput(device, []byte("not json")))
+	assert.False(t, device.typeVerified)
+	assert.Equal(t, "sat", device.parserType)
+}
+
+func assertAttrValue(t *testing.T, attributes []*smart.SmartAttribute, name string, expected uint64) {
+	t.Helper()
+	attr := findAttr(attributes, name)
+	if attr == nil {
+		t.Fatalf("expected attribute %s to be present", name)
+	}
+	if attr.RawValue != expected {
+		t.Fatalf("unexpected attribute %s value: got %d, want %d", name, attr.RawValue, expected)
+	}
+}
+
+func findAttr(attributes []*smart.SmartAttribute, name string) *smart.SmartAttribute {
+	for _, attr := range attributes {
+		if attr != nil && attr.Name == name {
+			return attr
+		}
+	}
+	return nil
+}
+
+func TestIsVirtualDevice(t *testing.T) {
+	sm := &SmartManager{}
+
+	tests := []struct {
+		name     string
+		vendor   string
+		product  string
+		model    string
+		expected bool
+	}{
+		{"regular drive", "SEAGATE", "ST1000DM003", "ST1000DM003-1CH162", false},
+		{"qemu virtual", "QEMU", "QEMU HARDDISK", "QEMU HARDDISK", true},
+		{"virtualbox virtual", "VBOX", "HARDDISK", "VBOX HARDDISK", true},
+		{"vmware virtual", "VMWARE", "Virtual disk", "VMWARE Virtual disk", true},
+		{"virtual in model", "ATA", "VIRTUAL", "VIRTUAL DISK", true},
+		{"iet virtual", "IET", "VIRTUAL-DISK", "VIRTUAL-DISK", true},
+		{"hyper-v virtual", "MSFT", "VIRTUAL HD", "VIRTUAL HD", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			data := &smart.SmartInfoForSata{
+				ScsiVendor:  tt.vendor,
+				ScsiProduct: tt.product,
+				ModelName:   tt.model,
+			}
+			result := sm.isVirtualDevice(data)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestIsVirtualDeviceNvme(t *testing.T) {
+	sm := &SmartManager{}
+
+	tests := []struct {
+		name     string
+		model    string
+		expected bool
+	}{
+		{"regular nvme", "Samsung SSD 970 EVO Plus 1TB", false},
+		{"qemu virtual", "QEMU NVMe Ctrl", true},
+		{"virtualbox virtual", "VBOX NVMe", true},
+		{"vmware virtual", "VMWARE NVMe", true},
+		{"virtual in model", "Virtual NVMe Device", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			data := &smart.SmartInfoForNvme{
+				ModelName: tt.model,
+			}
+			result := sm.isVirtualDeviceNvme(data)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestIsVirtualDeviceScsi(t *testing.T) {
+	sm := &SmartManager{}
+
+	tests := []struct {
+		name     string
+		vendor   string
+		product  string
+		model    string
+		expected bool
+	}{
+		{"regular scsi", "SEAGATE", "ST1000DM003", "ST1000DM003-1CH162", false},
+		{"qemu virtual", "QEMU", "QEMU HARDDISK", "QEMU HARDDISK", true},
+		{"virtualbox virtual", "VBOX", "HARDDISK", "VBOX HARDDISK", true},
+		{"vmware virtual", "VMWARE", "Virtual disk", "VMWARE Virtual disk", true},
+		{"virtual in model", "ATA", "VIRTUAL", "VIRTUAL DISK", true},
+		{"iet virtual", "IET", "VIRTUAL-DISK", "VIRTUAL-DISK", true},
+		{"hyper-v virtual", "MSFT", "VIRTUAL HD", "VIRTUAL HD", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			data := &smart.SmartInfoForScsi{
+				ScsiVendor:    tt.vendor,
+				ScsiProduct:   tt.product,
+				ScsiModelName: tt.model,
+			}
+			result := sm.isVirtualDeviceScsi(data)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestRefreshExcludedDevices(t *testing.T) {
+	tests := []struct {
+		name         string
+		envValue     string
+		expectedDevs map[string]struct{}
+	}{
+		{
+			name:         "empty env",
+			envValue:     "",
+			expectedDevs: map[string]struct{}{},
+		},
+		{
+			name:     "single device",
+			envValue: "/dev/sda",
+			expectedDevs: map[string]struct{}{
+				"/dev/sda": {},
+			},
+		},
+		{
+			name:     "multiple devices",
+			envValue: "/dev/sda,/dev/sdb,/dev/nvme0",
+			expectedDevs: map[string]struct{}{
+				"/dev/sda":   {},
+				"/dev/sdb":   {},
+				"/dev/nvme0": {},
+			},
+		},
+		{
+			name:     "devices with whitespace",
+			envValue: " /dev/sda , /dev/sdb ,  /dev/nvme0  ",
+			expectedDevs: map[string]struct{}{
+				"/dev/sda":   {},
+				"/dev/sdb":   {},
+				"/dev/nvme0": {},
+			},
+		},
+		{
+			name:     "duplicate devices",
+			envValue: "/dev/sda,/dev/sdb,/dev/sda",
+			expectedDevs: map[string]struct{}{
+				"/dev/sda": {},
+				"/dev/sdb": {},
+			},
+		},
+		{
+			name:     "empty entries and whitespace",
+			envValue: "/dev/sda,, /dev/sdb , , ",
+			expectedDevs: map[string]struct{}{
+				"/dev/sda": {},
+				"/dev/sdb": {},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.envValue != "" {
+				t.Setenv("EXCLUDE_SMART", tt.envValue)
+			} else {
+				// Ensure env var is not set for empty test
+				os.Unsetenv("EXCLUDE_SMART")
+			}
+
+			sm := &SmartManager{}
+			sm.refreshExcludedDevices()
+
+			assert.Equal(t, tt.expectedDevs, sm.excludedDevices)
+		})
+	}
+}
+
+func TestIsExcludedDevice(t *testing.T) {
+	sm := &SmartManager{
+		excludedDevices: map[string]struct{}{
+			"/dev/sda":   {},
+			"/dev/nvme0": {},
+		},
+	}
+
+	tests := []struct {
+		name         string
+		deviceName   string
+		expectedBool bool
+	}{
+		{"excluded device sda", "/dev/sda", true},
+		{"excluded device nvme0", "/dev/nvme0", true},
+		{"non-excluded device sdb", "/dev/sdb", false},
+		{"non-excluded device nvme1", "/dev/nvme1", false},
+		{"empty device name", "", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := sm.isExcludedDevice(tt.deviceName)
+			assert.Equal(t, tt.expectedBool, result)
+		})
+	}
+}
+
+func TestFilterExcludedDevices(t *testing.T) {
+	tests := []struct {
+		name           string
+		excludedDevs   map[string]struct{}
+		inputDevices   []*DeviceInfo
+		expectedDevs   []*DeviceInfo
+		expectedLength int
+	}{
+		{
+			name:         "no exclusions",
+			excludedDevs: map[string]struct{}{},
+			inputDevices: []*DeviceInfo{
+				{Name: "/dev/sda"},
+				{Name: "/dev/sdb"},
+				{Name: "/dev/nvme0"},
+			},
+			expectedDevs: []*DeviceInfo{
+				{Name: "/dev/sda"},
+				{Name: "/dev/sdb"},
+				{Name: "/dev/nvme0"},
+			},
+			expectedLength: 3,
+		},
+		{
+			name: "some devices excluded",
+			excludedDevs: map[string]struct{}{
+				"/dev/sda":   {},
+				"/dev/nvme0": {},
+			},
+			inputDevices: []*DeviceInfo{
+				{Name: "/dev/sda"},
+				{Name: "/dev/sdb"},
+				{Name: "/dev/nvme0"},
+				{Name: "/dev/nvme1"},
+			},
+			expectedDevs: []*DeviceInfo{
+				{Name: "/dev/sdb"},
+				{Name: "/dev/nvme1"},
+			},
+			expectedLength: 2,
+		},
+		{
+			name: "all devices excluded",
+			excludedDevs: map[string]struct{}{
+				"/dev/sda": {},
+				"/dev/sdb": {},
+			},
+			inputDevices: []*DeviceInfo{
+				{Name: "/dev/sda"},
+				{Name: "/dev/sdb"},
+			},
+			expectedDevs:   []*DeviceInfo{},
+			expectedLength: 0,
+		},
+		{
+			name:           "nil devices",
+			excludedDevs:   map[string]struct{}{},
+			inputDevices:   nil,
+			expectedDevs:   []*DeviceInfo{},
+			expectedLength: 0,
+		},
+		{
+			name: "filter nil and empty name devices",
+			excludedDevs: map[string]struct{}{
+				"/dev/sda": {},
+			},
+			inputDevices: []*DeviceInfo{
+				{Name: "/dev/sda"},
+				nil,
+				{Name: ""},
+				{Name: "/dev/sdb"},
+			},
+			expectedDevs: []*DeviceInfo{
+				{Name: "/dev/sdb"},
+			},
+			expectedLength: 1,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			sm := &SmartManager{
+				excludedDevices: tt.excludedDevs,
+			}
+
+			result := sm.filterExcludedDevices(tt.inputDevices)
+
+			assert.Len(t, result, tt.expectedLength)
+			assert.Equal(t, tt.expectedDevs, result)
+		})
+	}
+}
+
+func TestIsNvmeControllerPath(t *testing.T) {
+	tests := []struct {
+		path     string
+		expected bool
+	}{
+		// Controller paths (should return true)
+		{"/dev/nvme0", true},
+		{"/dev/nvme1", true},
+		{"/dev/nvme10", true},
+		{"nvme0", true},
+
+		// Namespace paths (should return false)
+		{"/dev/nvme0n1", false},
+		{"/dev/nvme1n1", false},
+		{"/dev/nvme0n1p1", false},
+		{"nvme0n1", false},
+
+		// Non-NVMe paths (should return false)
+		{"/dev/sda", false},
+		{"/dev/sda1", false},
+		{"/dev/hda", false},
+		{"", false},
+		{"/dev/nvme", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.path, func(t *testing.T) {
+			result := isNvmeControllerPath(tt.path)
+			assert.Equal(t, tt.expected, result, "path: %s", tt.path)
+		})
+	}
+}

agent/smart_windows.go

@@ -0,0 +1,40 @@
+//go:build windows
+
+package agent
+
+import (
+	_ "embed"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sync"
+)
+
+//go:embed smartmontools/smartctl.exe
+var embeddedSmartctl []byte
+
+var (
+	smartctlOnce sync.Once
+	smartctlPath string
+	smartctlErr  error
+)
+
+func ensureEmbeddedSmartctl() (string, error) {
+	smartctlOnce.Do(func() {
+		destDir := filepath.Join(os.TempDir(), "beszel", "smartmontools")
+		if err := os.MkdirAll(destDir, 0o755); err != nil {
+			smartctlErr = fmt.Errorf("failed to create smartctl directory: %w", err)
+			return
+		}
+
+		destPath := filepath.Join(destDir, "smartctl.exe")
+		if err := os.WriteFile(destPath, embeddedSmartctl, 0o755); err != nil {
+			smartctlErr = fmt.Errorf("failed to write embedded smartctl: %w", err)
+			return
+		}
+
+		smartctlPath = destPath
+	})
+
+	return smartctlPath, smartctlErr
+}

agent/system.go

@@ -2,60 +2,107 @@ package agent
 
 import (
 	"bufio"
+	"errors"
 	"fmt"
 	"log/slog"
 	"os"
+	"runtime"
 	"strconv"
 	"strings"
 	"time"
 
 	"github.com/henrygd/beszel"
 	"github.com/henrygd/beszel/agent/battery"
+	"github.com/henrygd/beszel/internal/entities/container"
 	"github.com/henrygd/beszel/internal/entities/system"
 
 	"github.com/shirou/gopsutil/v4/cpu"
-	"github.com/shirou/gopsutil/v4/disk"
 	"github.com/shirou/gopsutil/v4/host"
 	"github.com/shirou/gopsutil/v4/load"
 	"github.com/shirou/gopsutil/v4/mem"
 )
 
+// prevDisk stores previous per-device disk counters for a given cache interval
+type prevDisk struct {
+	readBytes  uint64
+	writeBytes uint64
+	at         time.Time
+}
+
 // Sets initial / non-changing values about the host system
-func (a *Agent) initializeSystemInfo() {
+func (a *Agent) refreshSystemDetails() {
 	a.systemInfo.AgentVersion = beszel.Version
-	a.systemInfo.Hostname, _ = os.Hostname()
+
+	// get host info from Docker if available
+	var hostInfo container.HostInfo
+
+	if a.dockerManager != nil {
+		a.systemDetails.Podman = a.dockerManager.IsPodman()
+		hostInfo, _ = a.dockerManager.GetHostInfo()
+	}
+
+	a.systemDetails.Hostname, _ = os.Hostname()
+	if arch, err := host.KernelArch(); err == nil {
+		a.systemDetails.Arch = arch
+	} else {
+		a.systemDetails.Arch = runtime.GOARCH
+	}
 
 	platform, _, version, _ := host.PlatformInformation()
 
 	if platform == "darwin" {
-		a.systemInfo.KernelVersion = version
+		a.systemDetails.Os = system.Darwin
-		a.systemInfo.Os = system.Darwin
+		a.systemDetails.OsName = fmt.Sprintf("macOS %s", version)
 	} else if strings.Contains(platform, "indows") {
-		a.systemInfo.KernelVersion = fmt.Sprintf("%s %s", strings.Replace(platform, "Microsoft ", "", 1), version)
+		a.systemDetails.Os = system.Windows
-		a.systemInfo.Os = system.Windows
+		a.systemDetails.OsName = strings.Replace(platform, "Microsoft ", "", 1)
+		a.systemDetails.Kernel = version
 	} else if platform == "freebsd" {
-		a.systemInfo.Os = system.Freebsd
+		a.systemDetails.Os = system.Freebsd
-		a.systemInfo.KernelVersion = version
+		a.systemDetails.Kernel, _ = host.KernelVersion()
+		if prettyName, err := getOsPrettyName(); err == nil {
+			a.systemDetails.OsName = prettyName
 		} else {
-		a.systemInfo.Os = system.Linux
+			a.systemDetails.OsName = "FreeBSD"
+		}
+	} else {
+		a.systemDetails.Os = system.Linux
+		a.systemDetails.OsName = hostInfo.OperatingSystem
+		if a.systemDetails.OsName == "" {
+			if prettyName, err := getOsPrettyName(); err == nil {
+				a.systemDetails.OsName = prettyName
+			} else {
+				a.systemDetails.OsName = platform
+			}
+		}
+		a.systemDetails.Kernel = hostInfo.KernelVersion
+		if a.systemDetails.Kernel == "" {
+			a.systemDetails.Kernel, _ = host.KernelVersion()
 		}
-
-	if a.systemInfo.KernelVersion == "" {
-		a.systemInfo.KernelVersion, _ = host.KernelVersion()
 	}
 
 	// cpu model
 	if info, err := cpu.Info(); err == nil && len(info) > 0 {
-		a.systemInfo.CpuModel = info[0].ModelName
+		a.systemDetails.CpuModel = info[0].ModelName
 	}
 	// cores / threads
-	a.systemInfo.Cores, _ = cpu.Counts(false)
+	cores, _ := cpu.Counts(false)
-	if threads, err := cpu.Counts(true); err == nil {
+	threads := hostInfo.NCPU
-		if threads > 0 && threads < a.systemInfo.Cores {
+	if threads == 0 {
-			// in lxc logical cores reflects container limits, so use that as cores if lower
+		threads, _ = cpu.Counts(true)
-			a.systemInfo.Cores = threads
+	}
-		} else {
+	// in lxc, logical cores reflects container limits, so use that as cores if lower
-			a.systemInfo.Threads = threads
+	if threads > 0 && threads < cores {
+		cores = threads
+	}
+	a.systemDetails.Cores = cores
+	a.systemDetails.Threads = threads
+
+	// total memory
+	a.systemDetails.MemoryTotal = hostInfo.MemTotal
+	if a.systemDetails.MemoryTotal == 0 {
+		if v, err := mem.VirtualMemory(); err == nil {
+			a.systemDetails.MemoryTotal = v.Total
 		}
 	}
 
@@ -68,20 +115,33 @@ func (a *Agent) initializeSystemInfo() {
 }
 
 // Returns current info, stats about the host system
-func (a *Agent) getSystemStats() system.Stats {
+func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 	var systemStats system.Stats
 
 	// battery
-	if battery.HasReadableBattery() {
+	if batteryPercent, batteryState, err := battery.GetBatteryStats(); err == nil {
-		systemStats.Battery[0], systemStats.Battery[1], _ = battery.GetBatteryStats()
+		systemStats.Battery[0] = batteryPercent
+		systemStats.Battery[1] = batteryState
 	}
 
-	// cpu percent
+	// cpu metrics
-	cpuPct, err := cpu.Percent(0, false)
+	cpuMetrics, err := getCpuMetrics(cacheTimeMs)
-	if err != nil {
+	if err == nil {
-		slog.Error("Error getting cpu percent", "err", err)
+		systemStats.Cpu = twoDecimals(cpuMetrics.Total)
-	} else if len(cpuPct) > 0 {
+		systemStats.CpuBreakdown = []float64{
-		systemStats.Cpu = twoDecimals(cpuPct[0])
+			twoDecimals(cpuMetrics.User),
+			twoDecimals(cpuMetrics.System),
+			twoDecimals(cpuMetrics.Iowait),
+			twoDecimals(cpuMetrics.Steal),
+			twoDecimals(cpuMetrics.Idle),
+		}
+	} else {
+		slog.Error("Error getting cpu metrics", "err", err)
+	}
+
+	// per-core cpu usage
+	if perCoreUsage, err := getPerCoreCpuUsage(cacheTimeMs); err == nil {
+		systemStats.CpuCoresUsage = perCoreUsage
 	}
 
 	// load average
@@ -100,14 +160,22 @@ func (a *Agent) getSystemStats() system.Stats {
 		systemStats.Swap = bytesToGigabytes(v.SwapTotal)
 		systemStats.SwapUsed = bytesToGigabytes(v.SwapTotal - v.SwapFree - v.SwapCached)
 		// cache + buffers value for default mem calculation
-		cacheBuff := v.Total - v.Free - v.Used
-		// htop memory calculation overrides
-		if a.memCalc == "htop" {
 		// note: gopsutil automatically adds SReclaimable to v.Cached
-			cacheBuff = v.Cached + v.Buffers - v.Shared
+		cacheBuff := v.Cached + v.Buffers - v.Shared
+		if cacheBuff <= 0 {
+			cacheBuff = max(v.Total-v.Free-v.Used, 0)
+		}
+		// htop memory calculation overrides (likely outdated as of mid 2025)
+		if a.memCalc == "htop" {
+			// cacheBuff = v.Cached + v.Buffers - v.Shared
 			v.Used = v.Total - (v.Free + cacheBuff)
 			v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
 		}
+		// if a.memCalc == "legacy" {
+		// 	v.Used = v.Total - v.Free - v.Buffers - v.Cached
+		// 	cacheBuff = v.Total - v.Free - v.Used
+		// 	v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
+		// }
 		// subtract ZFS ARC size from used memory and add as its own category
 		if a.zfs {
 			if arcSize, _ := getARCSize(); arcSize > 0 && arcSize < v.Used {
@@ -123,56 +191,13 @@ func (a *Agent) getSystemStats() system.Stats {
 	}
 
 	// disk usage
-	for _, stats := range a.fsStats {
+	a.updateDiskUsage(&systemStats)
-		if d, err := disk.Usage(stats.Mountpoint); err == nil {
-			stats.DiskTotal = bytesToGigabytes(d.Total)
-			stats.DiskUsed = bytesToGigabytes(d.Used)
-			if stats.Root {
-				systemStats.DiskTotal = bytesToGigabytes(d.Total)
-				systemStats.DiskUsed = bytesToGigabytes(d.Used)
-				systemStats.DiskPct = twoDecimals(d.UsedPercent)
-			}
-		} else {
-			// reset stats if error (likely unmounted)
-			slog.Error("Error getting disk stats", "name", stats.Mountpoint, "err", err)
-			stats.DiskTotal = 0
-			stats.DiskUsed = 0
-			stats.TotalRead = 0
-			stats.TotalWrite = 0
-		}
-	}
 
-	// disk i/o
+	// disk i/o (cache-aware per interval)
-	if ioCounters, err := disk.IOCounters(a.fsNames...); err == nil {
+	a.updateDiskIo(cacheTimeMs, &systemStats)
-		for _, d := range ioCounters {
-			stats := a.fsStats[d.Name]
-			if stats == nil {
-				continue
-			}
-			secondsElapsed := time.Since(stats.Time).Seconds()
-			readPerSecond := bytesToMegabytes(float64(d.ReadBytes-stats.TotalRead) / secondsElapsed)
-			writePerSecond := bytesToMegabytes(float64(d.WriteBytes-stats.TotalWrite) / secondsElapsed)
-			// check for invalid values and reset stats if so
-			if readPerSecond < 0 || writePerSecond < 0 || readPerSecond > 50_000 || writePerSecond > 50_000 {
-				slog.Warn("Invalid disk I/O. Resetting.", "name", d.Name, "read", readPerSecond, "write", writePerSecond)
-				a.initializeDiskIoStats(ioCounters)
-				break
-			}
-			stats.Time = time.Now()
-			stats.DiskReadPs = readPerSecond
-			stats.DiskWritePs = writePerSecond
-			stats.TotalRead = d.ReadBytes
-			stats.TotalWrite = d.WriteBytes
-			// if root filesystem, update system stats
-			if stats.Root {
-				systemStats.DiskReadPs = stats.DiskReadPs
-				systemStats.DiskWritePs = stats.DiskWritePs
-			}
-		}
-	}
 
-	// network stats
+	// network stats (per cache interval)
-	a.updateNetworkStats(&systemStats)
+	a.updateNetworkStats(cacheTimeMs, &systemStats)
 
 	// temperatures
 	// TODO: maybe refactor to methods on systemStats
@@ -183,7 +208,7 @@ func (a *Agent) getSystemStats() system.Stats {
 		// reset high gpu percent
 		a.systemInfo.GpuPct = 0
 		// get current GPU data
-		if gpuData := a.gpuManager.GetCurrentData(); len(gpuData) > 0 {
+		if gpuData := a.gpuManager.GetCurrentData(cacheTimeMs); len(gpuData) > 0 {
 			systemStats.GPUData = gpuData
 
 			// add temperatures
@@ -211,21 +236,16 @@ func (a *Agent) getSystemStats() system.Stats {
 		}
 	}
 
-	// update base system info
+	// update system info
 	a.systemInfo.ConnectionType = a.connectionManager.ConnectionType
 	a.systemInfo.Cpu = systemStats.Cpu
 	a.systemInfo.LoadAvg = systemStats.LoadAvg
-	// TODO: remove these in future release in favor of load avg array
-	a.systemInfo.LoadAvg1 = systemStats.LoadAvg[0]
-	a.systemInfo.LoadAvg5 = systemStats.LoadAvg[1]
-	a.systemInfo.LoadAvg15 = systemStats.LoadAvg[2]
 	a.systemInfo.MemPct = systemStats.MemPct
 	a.systemInfo.DiskPct = systemStats.DiskPct
+	a.systemInfo.Battery = systemStats.Battery
 	a.systemInfo.Uptime, _ = host.Uptime()
-	// TODO: in future release, remove MB bandwidth values in favor of bytes
-	a.systemInfo.Bandwidth = twoDecimals(systemStats.NetworkSent + systemStats.NetworkRecv)
 	a.systemInfo.BandwidthBytes = systemStats.Bandwidth[0] + systemStats.Bandwidth[1]
-	slog.Debug("sysinfo", "data", a.systemInfo)
+	a.systemInfo.Threads = a.systemDetails.Threads
 
 	return systemStats
 }
@@ -255,3 +275,24 @@ func getARCSize() (uint64, error) {
 
 	return 0, fmt.Errorf("failed to parse size field")
 }
+
+// getOsPrettyName attempts to get the pretty OS name from /etc/os-release on Linux systems
+func getOsPrettyName() (string, error) {
+	file, err := os.Open("/etc/os-release")
+	if err != nil {
+		return "", err
+	}
+	defer file.Close()
+
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		line := scanner.Text()
+		if after, ok := strings.CutPrefix(line, "PRETTY_NAME="); ok {
+			value := after
+			value = strings.Trim(value, `"`)
+			return value, nil
+		}
+	}
+
+	return "", errors.New("pretty name not found")
+}

agent/systemd.go

@@ -0,0 +1,313 @@
+//go:build linux
+
+package agent
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"maps"
+	"math"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/coreos/go-systemd/v22/dbus"
+	"github.com/henrygd/beszel/internal/entities/systemd"
+)
+
+var errNoActiveTime = errors.New("no active time")
+
+// systemdManager manages the collection of systemd service statistics.
+type systemdManager struct {
+	sync.Mutex
+	serviceStatsMap map[string]*systemd.Service
+	isRunning       bool
+	hasFreshStats   bool
+	patterns        []string
+}
+
+// isSystemdAvailable checks if systemd is used on the system to avoid unnecessary connection attempts (#1548)
+func isSystemdAvailable() bool {
+	paths := []string{
+		"/run/systemd/system",
+		"/run/dbus/system_bus_socket",
+		"/var/run/dbus/system_bus_socket",
+	}
+	for _, path := range paths {
+		if _, err := os.Stat(path); err == nil {
+			return true
+		}
+	}
+	if data, err := os.ReadFile("/proc/1/comm"); err == nil {
+		return strings.TrimSpace(string(data)) == "systemd"
+	}
+	return false
+}
+
+// newSystemdManager creates a new systemdManager.
+func newSystemdManager() (*systemdManager, error) {
+	if skipSystemd, _ := GetEnv("SKIP_SYSTEMD"); skipSystemd == "true" {
+		return nil, nil
+	}
+
+	// Check if systemd is available on the system before attempting connection
+	if !isSystemdAvailable() {
+		slog.Debug("Systemd not available")
+		return nil, nil
+	}
+
+	conn, err := dbus.NewSystemConnectionContext(context.Background())
+	if err != nil {
+		slog.Debug("Error connecting to systemd", "err", err, "ref", "https://beszel.dev/guide/systemd")
+		return nil, err
+	}
+
+	manager := &systemdManager{
+		serviceStatsMap: make(map[string]*systemd.Service),
+		patterns:        getServicePatterns(),
+	}
+
+	manager.startWorker(conn)
+
+	return manager, nil
+}
+
+func (sm *systemdManager) startWorker(conn *dbus.Conn) {
+	if sm.isRunning {
+		return
+	}
+	sm.isRunning = true
+	// prime the service stats map with the current services
+	_ = sm.getServiceStats(conn, true)
+	// update the services every 10 minutes
+	go func() {
+		for {
+			time.Sleep(time.Minute * 10)
+			_ = sm.getServiceStats(nil, true)
+		}
+	}()
+}
+
+// getServiceStatsCount returns the number of systemd services.
+func (sm *systemdManager) getServiceStatsCount() int {
+	return len(sm.serviceStatsMap)
+}
+
+// getFailedServiceCount returns the number of systemd services in a failed state.
+func (sm *systemdManager) getFailedServiceCount() uint16 {
+	sm.Lock()
+	defer sm.Unlock()
+	count := uint16(0)
+	for _, service := range sm.serviceStatsMap {
+		if service.State == systemd.StatusFailed {
+			count++
+		}
+	}
+	return count
+}
+
+// getServiceStats collects statistics for all running systemd services.
+func (sm *systemdManager) getServiceStats(conn *dbus.Conn, refresh bool) []*systemd.Service {
+	// start := time.Now()
+	// defer func() {
+	// 	slog.Info("systemdManager.getServiceStats", "duration", time.Since(start))
+	// }()
+
+	var services []*systemd.Service
+	var err error
+
+	if !refresh {
+		// return nil
+		sm.Lock()
+		defer sm.Unlock()
+		for _, service := range sm.serviceStatsMap {
+			services = append(services, service)
+		}
+		sm.hasFreshStats = false
+		return services
+	}
+
+	if conn == nil || !conn.Connected() {
+		conn, err = dbus.NewSystemConnectionContext(context.Background())
+		if err != nil {
+			return nil
+		}
+		defer conn.Close()
+	}
+
+	units, err := conn.ListUnitsByPatternsContext(context.Background(), []string{"loaded"}, sm.patterns)
+	if err != nil {
+		slog.Error("Error listing systemd service units", "err", err)
+		return nil
+	}
+
+	// Track which units are currently present to remove stale entries
+	currentUnits := make(map[string]struct{}, len(units))
+
+	for _, unit := range units {
+		currentUnits[unit.Name] = struct{}{}
+		service, err := sm.updateServiceStats(conn, unit)
+		if err != nil {
+			continue
+		}
+		services = append(services, service)
+	}
+
+	// Remove services that no longer exist in systemd
+	sm.Lock()
+	for unitName := range sm.serviceStatsMap {
+		if _, exists := currentUnits[unitName]; !exists {
+			delete(sm.serviceStatsMap, unitName)
+		}
+	}
+	sm.Unlock()
+
+	sm.hasFreshStats = true
+	return services
+}
+
+// updateServiceStats updates the statistics for a single systemd service.
+func (sm *systemdManager) updateServiceStats(conn *dbus.Conn, unit dbus.UnitStatus) (*systemd.Service, error) {
+	sm.Lock()
+	defer sm.Unlock()
+
+	ctx := context.Background()
+
+	// if service has never been active (no active since time), skip it
+	if activeEnterTsProp, err := conn.GetUnitTypePropertyContext(ctx, unit.Name, "Unit", "ActiveEnterTimestamp"); err == nil {
+		if ts, ok := activeEnterTsProp.Value.Value().(uint64); !ok || ts == 0 || ts == math.MaxUint64 {
+			return nil, errNoActiveTime
+		}
+	} else {
+		return nil, err
+	}
+
+	service, serviceExists := sm.serviceStatsMap[unit.Name]
+	if !serviceExists {
+		service = &systemd.Service{Name: unescapeServiceName(strings.TrimSuffix(unit.Name, ".service"))}
+		sm.serviceStatsMap[unit.Name] = service
+	}
+
+	memPeak := service.MemPeak
+	if memPeakProp, err := conn.GetUnitTypePropertyContext(ctx, unit.Name, "Service", "MemoryPeak"); err == nil {
+		// If memPeak is MaxUint64 the api is saying it's not available
+		if v, ok := memPeakProp.Value.Value().(uint64); ok && v != math.MaxUint64 {
+			memPeak = v
+		}
+	}
+
+	var memUsage uint64
+	if memProp, err := conn.GetUnitTypePropertyContext(ctx, unit.Name, "Service", "MemoryCurrent"); err == nil {
+		// If memUsage is MaxUint64 the api is saying it's not available
+		if v, ok := memProp.Value.Value().(uint64); ok && v != math.MaxUint64 {
+			memUsage = v
+		}
+	}
+
+	service.State = systemd.ParseServiceStatus(unit.ActiveState)
+	service.Sub = systemd.ParseServiceSubState(unit.SubState)
+
+	// some systems always return 0 for mem peak, so we should update the peak if the current usage is greater
+	if memUsage > memPeak {
+		memPeak = memUsage
+	}
+
+	var cpuUsage uint64
+	if cpuProp, err := conn.GetUnitTypePropertyContext(ctx, unit.Name, "Service", "CPUUsageNSec"); err == nil {
+		if v, ok := cpuProp.Value.Value().(uint64); ok {
+			cpuUsage = v
+		}
+	}
+
+	service.Mem = memUsage
+	if memPeak > service.MemPeak {
+		service.MemPeak = memPeak
+	}
+	service.UpdateCPUPercent(cpuUsage)
+
+	return service, nil
+}
+
+// getServiceDetails collects extended information for a specific systemd service.
+func (sm *systemdManager) getServiceDetails(serviceName string) (systemd.ServiceDetails, error) {
+	conn, err := dbus.NewSystemConnectionContext(context.Background())
+	if err != nil {
+		return nil, err
+	}
+	defer conn.Close()
+
+	unitName := serviceName
+	if !strings.HasSuffix(unitName, ".service") {
+		unitName += ".service"
+	}
+
+	ctx := context.Background()
+	props, err := conn.GetUnitPropertiesContext(ctx, unitName)
+	if err != nil {
+		return nil, err
+	}
+
+	// Start with all unit properties
+	details := make(systemd.ServiceDetails)
+	maps.Copy(details, props)
+
+	// // Add service-specific properties
+	servicePropNames := []string{
+		"MainPID", "ExecMainPID", "TasksCurrent", "TasksMax",
+		"MemoryCurrent", "MemoryPeak", "MemoryLimit", "CPUUsageNSec",
+		"NRestarts", "ExecMainStartTimestampRealtime", "Result",
+	}
+
+	for _, propName := range servicePropNames {
+		if variant, err := conn.GetUnitTypePropertyContext(ctx, unitName, "Service", propName); err == nil {
+			value := variant.Value.Value()
+			// Check if the value is MaxUint64, which indicates unlimited/infinite
+			if uint64Value, ok := value.(uint64); ok && uint64Value == math.MaxUint64 {
+				// Set to nil to indicate unlimited - frontend will handle this appropriately
+				details[propName] = nil
+			} else {
+				details[propName] = value
+			}
+		}
+	}
+
+	return details, nil
+}
+
+// unescapeServiceName unescapes systemd service names that contain C-style escape sequences like \x2d
+func unescapeServiceName(name string) string {
+	if !strings.Contains(name, "\\x") {
+		return name
+	}
+	unescaped, err := strconv.Unquote("\"" + name + "\"")
+	if err != nil {
+		return name
+	}
+	return unescaped
+}
+
+// getServicePatterns returns the list of service patterns to match.
+// It reads from the SERVICE_PATTERNS environment variable if set,
+// otherwise defaults to "*service".
+func getServicePatterns() []string {
+	patterns := []string{}
+	if envPatterns, _ := GetEnv("SERVICE_PATTERNS"); envPatterns != "" {
+		for pattern := range strings.SplitSeq(envPatterns, ",") {
+			pattern = strings.TrimSpace(pattern)
+			if pattern == "" {
+				continue
+			}
+			if !strings.HasSuffix(pattern, ".service") {
+				pattern += ".service"
+			}
+			patterns = append(patterns, pattern)
+		}
+	}
+	if len(patterns) == 0 {
+		patterns = []string{"*.service"}
+	}
+	return patterns
+}

agent/systemd_nonlinux.go

@@ -0,0 +1,38 @@
+//go:build !linux
+
+package agent
+
+import (
+	"errors"
+
+	"github.com/henrygd/beszel/internal/entities/systemd"
+)
+
+// systemdManager manages the collection of systemd service statistics.
+type systemdManager struct {
+	hasFreshStats bool
+}
+
+// newSystemdManager creates a new systemdManager.
+func newSystemdManager() (*systemdManager, error) {
+	return &systemdManager{}, nil
+}
+
+// getServiceStats returns nil for non-linux systems.
+func (sm *systemdManager) getServiceStats(conn any, refresh bool) []*systemd.Service {
+	return nil
+}
+
+// getServiceStatsCount returns 0 for non-linux systems.
+func (sm *systemdManager) getServiceStatsCount() int {
+	return 0
+}
+
+// getFailedServiceCount returns 0 for non-linux systems.
+func (sm *systemdManager) getFailedServiceCount() uint16 {
+	return 0
+}
+
+func (sm *systemdManager) getServiceDetails(string) (systemd.ServiceDetails, error) {
+	return nil, errors.New("systemd manager unavailable")
+}

agent/systemd_nonlinux_test.go

@@ -0,0 +1,53 @@
+//go:build !linux && testing
+
+package agent
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNewSystemdManager(t *testing.T) {
+	manager, err := newSystemdManager()
+	assert.NoError(t, err)
+	assert.NotNil(t, manager)
+}
+
+func TestSystemdManagerGetServiceStats(t *testing.T) {
+	manager, err := newSystemdManager()
+	assert.NoError(t, err)
+
+	// Test with refresh = true
+	result := manager.getServiceStats("any-service", true)
+	assert.Nil(t, result)
+
+	// Test with refresh = false
+	result = manager.getServiceStats("any-service", false)
+	assert.Nil(t, result)
+}
+
+func TestSystemdManagerGetServiceDetails(t *testing.T) {
+	manager, err := newSystemdManager()
+	assert.NoError(t, err)
+
+	result, err := manager.getServiceDetails("any-service")
+	assert.Error(t, err)
+	assert.Equal(t, "systemd manager unavailable", err.Error())
+	assert.Nil(t, result)
+
+	// Test with empty service name
+	result, err = manager.getServiceDetails("")
+	assert.Error(t, err)
+	assert.Equal(t, "systemd manager unavailable", err.Error())
+	assert.Nil(t, result)
+}
+
+func TestSystemdManagerFields(t *testing.T) {
+	manager, err := newSystemdManager()
+	assert.NoError(t, err)
+
+	// The non-linux manager should be a simple struct with no special fields
+	// We can't test private fields directly, but we can test the methods work
+	assert.NotNil(t, manager)
+}

agent/systemd_test.go

@@ -0,0 +1,188 @@
+//go:build linux && testing
+
+package agent
+
+import (
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestUnescapeServiceName(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{"nginx.service", "nginx.service"},                                     // No escaping needed
+		{"test\\x2dwith\\x2ddashes.service", "test-with-dashes.service"},       // \x2d is dash
+		{"service\\x20with\\x20spaces.service", "service with spaces.service"}, // \x20 is space
+		{"mixed\\x2dand\\x2dnormal", "mixed-and-normal"},                       // Mixed escaped and normal
+		{"no-escape-here", "no-escape-here"},                                   // No escape sequences
+		{"", ""},                                                               // Empty string
+		{"\\x2d\\x2d", "--"},                                                   // Multiple escapes
+	}
+
+	for _, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			result := unescapeServiceName(test.input)
+			assert.Equal(t, test.expected, result)
+		})
+	}
+}
+
+func TestUnescapeServiceNameInvalid(t *testing.T) {
+	// Test invalid escape sequences - should return original string
+	invalidInputs := []string{
+		"invalid\\x",   // Incomplete escape
+		"invalid\\xZZ", // Invalid hex
+		"invalid\\x2",  // Incomplete hex
+		"invalid\\xyz", // Not a valid escape
+	}
+
+	for _, input := range invalidInputs {
+		t.Run(input, func(t *testing.T) {
+			result := unescapeServiceName(input)
+			assert.Equal(t, input, result, "Invalid escape sequences should return original string")
+		})
+	}
+}
+
+func TestIsSystemdAvailable(t *testing.T) {
+	// Note: This test's result will vary based on the actual system running the tests
+	// On systems with systemd, it should return true
+	// On systems without systemd, it should return false
+	result := isSystemdAvailable()
+
+	// Check if either the /run/systemd/system directory exists or PID 1 is systemd
+	runSystemdExists := false
+	if _, err := os.Stat("/run/systemd/system"); err == nil {
+		runSystemdExists = true
+	}
+
+	pid1IsSystemd := false
+	if data, err := os.ReadFile("/proc/1/comm"); err == nil {
+		pid1IsSystemd = strings.TrimSpace(string(data)) == "systemd"
+	}
+
+	expected := runSystemdExists || pid1IsSystemd
+
+	assert.Equal(t, expected, result, "isSystemdAvailable should correctly detect systemd presence")
+
+	// Log the result for informational purposes
+	if result {
+		t.Log("Systemd is available on this system")
+	} else {
+		t.Log("Systemd is not available on this system")
+	}
+}
+
+func TestGetServicePatterns(t *testing.T) {
+	tests := []struct {
+		name           string
+		prefixedEnv    string
+		unprefixedEnv  string
+		expected       []string
+		cleanupEnvVars bool
+	}{
+		{
+			name:           "default when no env var set",
+			prefixedEnv:    "",
+			unprefixedEnv:  "",
+			expected:       []string{"*.service"},
+			cleanupEnvVars: true,
+		},
+		{
+			name:           "single pattern with prefixed env",
+			prefixedEnv:    "nginx",
+			unprefixedEnv:  "",
+			expected:       []string{"nginx.service"},
+			cleanupEnvVars: true,
+		},
+		{
+			name:           "single pattern with unprefixed env",
+			prefixedEnv:    "",
+			unprefixedEnv:  "nginx",
+			expected:       []string{"nginx.service"},
+			cleanupEnvVars: true,
+		},
+		{
+			name:           "prefixed env takes precedence",
+			prefixedEnv:    "nginx",
+			unprefixedEnv:  "apache",
+			expected:       []string{"nginx.service"},
+			cleanupEnvVars: true,
+		},
+		{
+			name:           "multiple patterns",
+			prefixedEnv:    "nginx,apache,postgresql",
+			unprefixedEnv:  "",
+			expected:       []string{"nginx.service", "apache.service", "postgresql.service"},
+			cleanupEnvVars: true,
+		},
+		{
+			name:           "patterns with .service suffix",
+			prefixedEnv:    "nginx.service,apache.service",
+			unprefixedEnv:  "",
+			expected:       []string{"nginx.service", "apache.service"},
+			cleanupEnvVars: true,
+		},
+		{
+			name:           "mixed patterns with and without suffix",
+			prefixedEnv:    "nginx.service,apache,postgresql.service",
+			unprefixedEnv:  "",
+			expected:       []string{"nginx.service", "apache.service", "postgresql.service"},
+			cleanupEnvVars: true,
+		},
+		{
+			name:           "patterns with whitespace",
+			prefixedEnv:    " nginx , apache , postgresql ",
+			unprefixedEnv:  "",
+			expected:       []string{"nginx.service", "apache.service", "postgresql.service"},
+			cleanupEnvVars: true,
+		},
+		{
+			name:           "empty patterns are skipped",
+			prefixedEnv:    "nginx,,apache,  ,postgresql",
+			unprefixedEnv:  "",
+			expected:       []string{"nginx.service", "apache.service", "postgresql.service"},
+			cleanupEnvVars: true,
+		},
+		{
+			name:           "wildcard pattern",
+			prefixedEnv:    "*nginx*,*apache*",
+			unprefixedEnv:  "",
+			expected:       []string{"*nginx*.service", "*apache*.service"},
+			cleanupEnvVars: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Clean up any existing env vars
+			os.Unsetenv("BESZEL_AGENT_SERVICE_PATTERNS")
+			os.Unsetenv("SERVICE_PATTERNS")
+
+			// Set up environment variables
+			if tt.prefixedEnv != "" {
+				os.Setenv("BESZEL_AGENT_SERVICE_PATTERNS", tt.prefixedEnv)
+			}
+			if tt.unprefixedEnv != "" {
+				os.Setenv("SERVICE_PATTERNS", tt.unprefixedEnv)
+			}
+
+			// Run the function
+			result := getServicePatterns()
+
+			// Verify results
+			assert.Equal(t, tt.expected, result, "Patterns should match expected values")
+
+			// Cleanup
+			if tt.cleanupEnvVars {
+				os.Unsetenv("BESZEL_AGENT_SERVICE_PATTERNS")
+				os.Unsetenv("SERVICE_PATTERNS")
+			}
+		})
+	}
+}

agent/test-data/amdgpu.ids

@@ -0,0 +1,700 @@
+# List of AMDGPU IDs
+#
+# Syntax:
+# device_id,	revision_id,	product_name        <-- single tab after comma
+
+1.0.0
+1114,	C2,	AMD Radeon 860M Graphics
+1114,	C3,	AMD Radeon 840M Graphics
+1114,	D2,	AMD Radeon 860M Graphics
+1114,	D3,	AMD Radeon 840M Graphics
+1309,	00,	AMD Radeon R7 Graphics
+130A,	00,	AMD Radeon R6 Graphics
+130B,	00,	AMD Radeon R4 Graphics
+130C,	00,	AMD Radeon R7 Graphics
+130D,	00,	AMD Radeon R6 Graphics
+130E,	00,	AMD Radeon R5 Graphics
+130F,	00,	AMD Radeon R7 Graphics
+130F,	D4,	AMD Radeon R7 Graphics
+130F,	D5,	AMD Radeon R7 Graphics
+130F,	D6,	AMD Radeon R7 Graphics
+130F,	D7,	AMD Radeon R7 Graphics
+1313,	00,	AMD Radeon R7 Graphics
+1313,	D4,	AMD Radeon R7 Graphics
+1313,	D5,	AMD Radeon R7 Graphics
+1313,	D6,	AMD Radeon R7 Graphics
+1315,	00,	AMD Radeon R5 Graphics
+1315,	D4,	AMD Radeon R5 Graphics
+1315,	D5,	AMD Radeon R5 Graphics
+1315,	D6,	AMD Radeon R5 Graphics
+1315,	D7,	AMD Radeon R5 Graphics
+1316,	00,	AMD Radeon R5 Graphics
+1318,	00,	AMD Radeon R5 Graphics
+131B,	00,	AMD Radeon R4 Graphics
+131C,	00,	AMD Radeon R7 Graphics
+131D,	00,	AMD Radeon R6 Graphics
+1435,	AE,	AMD Custom GPU 0932
+1506,	C1,	AMD Radeon 610M
+1506,	C2,	AMD Radeon 610M
+1506,	C3,	AMD Radeon 610M
+1506,	C4,	AMD Radeon 610M
+150E,	C1,	AMD Radeon 890M Graphics
+150E,	C4,	AMD Radeon 890M Graphics
+150E,	C5,	AMD Radeon 890M Graphics
+150E,	C6,	AMD Radeon 890M Graphics
+150E,	D1,	AMD Radeon 890M Graphics
+150E,	D2,	AMD Radeon 890M Graphics
+150E,	D3,	AMD Radeon 890M Graphics
+1586,	C1,	Radeon 8060S Graphics
+1586,	C2,	Radeon 8050S Graphics
+1586,	C4,	Radeon 8050S Graphics
+1586,	D1,	Radeon 8060S Graphics
+1586,	D2,	Radeon 8050S Graphics
+1586,	D4,	Radeon 8050S Graphics
+1586,	D5,	Radeon 8040S Graphics
+15BF,	00,	AMD Radeon 780M Graphics
+15BF,	01,	AMD Radeon 760M Graphics
+15BF,	02,	AMD Radeon 780M Graphics
+15BF,	03,	AMD Radeon 760M Graphics
+15BF,	C1,	AMD Radeon 780M Graphics
+15BF,	C2,	AMD Radeon 780M Graphics
+15BF,	C3,	AMD Radeon 760M Graphics
+15BF,	C4,	AMD Radeon 780M Graphics
+15BF,	C5,	AMD Radeon 740M Graphics
+15BF,	C6,	AMD Radeon 780M Graphics
+15BF,	C7,	AMD Radeon 780M Graphics
+15BF,	C8,	AMD Radeon 760M Graphics
+15BF,	C9,	AMD Radeon 780M Graphics
+15BF,	CA,	AMD Radeon 740M Graphics
+15BF,	CB,	AMD Radeon 760M Graphics
+15BF,	CC,	AMD Radeon 740M Graphics
+15BF,	CD,	AMD Radeon 760M Graphics
+15BF,	CF,	AMD Radeon 780M Graphics
+15BF,	D0,	AMD Radeon 780M Graphics
+15BF,	D1,	AMD Radeon 780M Graphics
+15BF,	D2,	AMD Radeon 780M Graphics
+15BF,	D3,	AMD Radeon 780M Graphics
+15BF,	D4,	AMD Radeon 780M Graphics
+15BF,	D5,	AMD Radeon 760M Graphics
+15BF,	D6,	AMD Radeon 760M Graphics
+15BF,	D7,	AMD Radeon 780M Graphics
+15BF,	D8,	AMD Radeon 740M Graphics
+15BF,	D9,	AMD Radeon 780M Graphics
+15BF,	DA,	AMD Radeon 780M Graphics
+15BF,	DB,	AMD Radeon 760M Graphics
+15BF,	DC,	AMD Radeon 760M Graphics
+15BF,	DD,	AMD Radeon 780M Graphics
+15BF,	DE,	AMD Radeon 740M Graphics
+15BF,	DF,	AMD Radeon 760M Graphics
+15BF,	F0,	AMD Radeon 760M Graphics
+15C8,	C1,	AMD Radeon 740M Graphics
+15C8,	C2,	AMD Radeon 740M Graphics
+15C8,	C3,	AMD Radeon 740M Graphics
+15C8,	C4,	AMD Radeon 740M Graphics
+15C8,	D1,	AMD Radeon 740M Graphics
+15C8,	D2,	AMD Radeon 740M Graphics
+15C8,	D3,	AMD Radeon 740M Graphics
+15C8,	D4,	AMD Radeon 740M Graphics
+15D8,	00,	AMD Radeon RX Vega 8 Graphics WS
+15D8,	91,	AMD Radeon Vega 3 Graphics
+15D8,	91,	AMD Ryzen Embedded R1606G with Radeon Vega Gfx
+15D8,	92,	AMD Radeon Vega 3 Graphics
+15D8,	92,	AMD Ryzen Embedded R1505G with Radeon Vega Gfx
+15D8,	93,	AMD Radeon Vega 1 Graphics
+15D8,	A1,	AMD Radeon Vega 10 Graphics
+15D8,	A2,	AMD Radeon Vega 8 Graphics
+15D8,	A3,	AMD Radeon Vega 6 Graphics
+15D8,	A4,	AMD Radeon Vega 3 Graphics
+15D8,	B1,	AMD Radeon Vega 10 Graphics
+15D8,	B2,	AMD Radeon Vega 8 Graphics
+15D8,	B3,	AMD Radeon Vega 6 Graphics
+15D8,	B4,	AMD Radeon Vega 3 Graphics
+15D8,	C1,	AMD Radeon Vega 10 Graphics
+15D8,	C2,	AMD Radeon Vega 8 Graphics
+15D8,	C3,	AMD Radeon Vega 6 Graphics
+15D8,	C4,	AMD Radeon Vega 3 Graphics
+15D8,	C5,	AMD Radeon Vega 3 Graphics
+15D8,	C8,	AMD Radeon Vega 11 Graphics
+15D8,	C9,	AMD Radeon Vega 8 Graphics
+15D8,	CA,	AMD Radeon Vega 11 Graphics
+15D8,	CB,	AMD Radeon Vega 8 Graphics
+15D8,	CC,	AMD Radeon Vega 3 Graphics
+15D8,	CE,	AMD Radeon Vega 3 Graphics
+15D8,	CF,	AMD Ryzen Embedded R1305G with Radeon Vega Gfx
+15D8,	D1,	AMD Radeon Vega 10 Graphics
+15D8,	D2,	AMD Radeon Vega 8 Graphics
+15D8,	D3,	AMD Radeon Vega 6 Graphics
+15D8,	D4,	AMD Radeon Vega 3 Graphics
+15D8,	D8,	AMD Radeon Vega 11 Graphics
+15D8,	D9,	AMD Radeon Vega 8 Graphics
+15D8,	DA,	AMD Radeon Vega 11 Graphics
+15D8,	DB,	AMD Radeon Vega 3 Graphics
+15D8,	DB,	AMD Radeon Vega 8 Graphics
+15D8,	DC,	AMD Radeon Vega 3 Graphics
+15D8,	DD,	AMD Radeon Vega 3 Graphics
+15D8,	DE,	AMD Radeon Vega 3 Graphics
+15D8,	DF,	AMD Radeon Vega 3 Graphics
+15D8,	E3,	AMD Radeon Vega 3 Graphics
+15D8,	E4,	AMD Ryzen Embedded R1102G with Radeon Vega Gfx
+15DD,	81,	AMD Ryzen Embedded V1807B with Radeon Vega Gfx
+15DD,	82,	AMD Ryzen Embedded V1756B with Radeon Vega Gfx
+15DD,	83,	AMD Ryzen Embedded V1605B with Radeon Vega Gfx
+15DD,	84,	AMD Radeon Vega 6 Graphics
+15DD,	85,	AMD Ryzen Embedded V1202B with Radeon Vega Gfx
+15DD,	86,	AMD Radeon Vega 11 Graphics
+15DD,	88,	AMD Radeon Vega 8 Graphics
+15DD,	C1,	AMD Radeon Vega 11 Graphics
+15DD,	C2,	AMD Radeon Vega 8 Graphics
+15DD,	C3,	AMD Radeon Vega 3 / 10 Graphics
+15DD,	C4,	AMD Radeon Vega 8 Graphics
+15DD,	C5,	AMD Radeon Vega 3 Graphics
+15DD,	C6,	AMD Radeon Vega 11 Graphics
+15DD,	C8,	AMD Radeon Vega 8 Graphics
+15DD,	C9,	AMD Radeon Vega 11 Graphics
+15DD,	CA,	AMD Radeon Vega 8 Graphics
+15DD,	CB,	AMD Radeon Vega 3 Graphics
+15DD,	CC,	AMD Radeon Vega 6 Graphics
+15DD,	CE,	AMD Radeon Vega 3 Graphics
+15DD,	CF,	AMD Radeon Vega 3 Graphics
+15DD,	D0,	AMD Radeon Vega 10 Graphics
+15DD,	D1,	AMD Radeon Vega 8 Graphics
+15DD,	D3,	AMD Radeon Vega 11 Graphics
+15DD,	D5,	AMD Radeon Vega 8 Graphics
+15DD,	D6,	AMD Radeon Vega 11 Graphics
+15DD,	D7,	AMD Radeon Vega 8 Graphics
+15DD,	D8,	AMD Radeon Vega 3 Graphics
+15DD,	D9,	AMD Radeon Vega 6 Graphics
+15DD,	E1,	AMD Radeon Vega 3 Graphics
+15DD,	E2,	AMD Radeon Vega 3 Graphics
+163F,	AE,	AMD Custom GPU 0405
+163F,	E1,	AMD Custom GPU 0405
+164E,	D8,	AMD Radeon 610M
+164E,	D9,	AMD Radeon 610M
+164E,	DA,	AMD Radeon 610M
+164E,	DB,	AMD Radeon 610M
+164E,	DC,	AMD Radeon 610M
+1681,	06,	AMD Radeon 680M
+1681,	07,	AMD Radeon 660M
+1681,	0A,	AMD Radeon 680M
+1681,	0B,	AMD Radeon 660M
+1681,	C7,	AMD Radeon 680M
+1681,	C8,	AMD Radeon 680M
+1681,	C9,	AMD Radeon 660M
+1900,	01,	AMD Radeon 780M Graphics
+1900,	02,	AMD Radeon 760M Graphics
+1900,	03,	AMD Radeon 780M Graphics
+1900,	04,	AMD Radeon 760M Graphics
+1900,	05,	AMD Radeon 780M Graphics
+1900,	06,	AMD Radeon 780M Graphics
+1900,	07,	AMD Radeon 760M Graphics
+1900,	B0,	AMD Radeon 780M Graphics
+1900,	B1,	AMD Radeon 780M Graphics
+1900,	B2,	AMD Radeon 780M Graphics
+1900,	B3,	AMD Radeon 780M Graphics
+1900,	B4,	AMD Radeon 780M Graphics
+1900,	B5,	AMD Radeon 780M Graphics
+1900,	B6,	AMD Radeon 780M Graphics
+1900,	B7,	AMD Radeon 760M Graphics
+1900,	B8,	AMD Radeon 760M Graphics
+1900,	B9,	AMD Radeon 780M Graphics
+1900,	BA,	AMD Radeon 780M Graphics
+1900,	BB,	AMD Radeon 780M Graphics
+1900,	C0,	AMD Radeon 780M Graphics
+1900,	C1,	AMD Radeon 760M Graphics
+1900,	C2,	AMD Radeon 780M Graphics
+1900,	C3,	AMD Radeon 760M Graphics
+1900,	C4,	AMD Radeon 780M Graphics
+1900,	C5,	AMD Radeon 780M Graphics
+1900,	C6,	AMD Radeon 760M Graphics
+1900,	C7,	AMD Radeon 780M Graphics
+1900,	C8,	AMD Radeon 760M Graphics
+1900,	C9,	AMD Radeon 780M Graphics
+1900,	CA,	AMD Radeon 760M Graphics
+1900,	CB,	AMD Radeon 780M Graphics
+1900,	CC,	AMD Radeon 780M Graphics
+1900,	CD,	AMD Radeon 760M Graphics
+1900,	CE,	AMD Radeon 780M Graphics
+1900,	CF,	AMD Radeon 760M Graphics
+1900,	D0,	AMD Radeon 780M Graphics
+1900,	D1,	AMD Radeon 760M Graphics
+1900,	D2,	AMD Radeon 780M Graphics
+1900,	D3,	AMD Radeon 760M Graphics
+1900,	D4,	AMD Radeon 780M Graphics
+1900,	D5,	AMD Radeon 780M Graphics
+1900,	D6,	AMD Radeon 760M Graphics
+1900,	D7,	AMD Radeon 780M Graphics
+1900,	D8,	AMD Radeon 760M Graphics
+1900,	D9,	AMD Radeon 780M Graphics
+1900,	DA,	AMD Radeon 760M Graphics
+1900,	DB,	AMD Radeon 780M Graphics
+1900,	DC,	AMD Radeon 780M Graphics
+1900,	DD,	AMD Radeon 760M Graphics
+1900,	DE,	AMD Radeon 780M Graphics
+1900,	DF,	AMD Radeon 760M Graphics
+1900,	F0,	AMD Radeon 780M Graphics
+1900,	F1,	AMD Radeon 780M Graphics
+1900,	F2,	AMD Radeon 780M Graphics
+1901,	C1,	AMD Radeon 740M Graphics
+1901,	C2,	AMD Radeon 740M Graphics
+1901,	C3,	AMD Radeon 740M Graphics
+1901,	C6,	AMD Radeon 740M Graphics
+1901,	C7,	AMD Radeon 740M Graphics
+1901,	C8,	AMD Radeon 740M Graphics
+1901,	C9,	AMD Radeon 740M Graphics
+1901,	CA,	AMD Radeon 740M Graphics
+1901,	D1,	AMD Radeon 740M Graphics
+1901,	D2,	AMD Radeon 740M Graphics
+1901,	D3,	AMD Radeon 740M Graphics
+1901,	D4,	AMD Radeon 740M Graphics
+1901,	D5,	AMD Radeon 740M Graphics
+1901,	D6,	AMD Radeon 740M Graphics
+1901,	D7,	AMD Radeon 740M Graphics
+1901,	D8,	AMD Radeon 740M Graphics
+6600,	00,	AMD Radeon HD 8600 / 8700M
+6600,	81,	AMD Radeon R7 M370
+6601,	00,	AMD Radeon HD 8500M / 8700M
+6604,	00,	AMD Radeon R7 M265 Series
+6604,	81,	AMD Radeon R7 M350
+6605,	00,	AMD Radeon R7 M260 Series
+6605,	81,	AMD Radeon R7 M340
+6606,	00,	AMD Radeon HD 8790M
+6607,	00,	AMD Radeon R5 M240
+6608,	00,	AMD FirePro W2100
+6610,	00,	AMD Radeon R7 200 Series
+6610,	81,	AMD Radeon R7 350
+6610,	83,	AMD Radeon R5 340
+6610,	87,	AMD Radeon R7 200 Series
+6611,	00,	AMD Radeon R7 200 Series
+6611,	87,	AMD Radeon R7 200 Series
+6613,	00,	AMD Radeon R7 200 Series
+6617,	00,	AMD Radeon R7 240 Series
+6617,	87,	AMD Radeon R7 200 Series
+6617,	C7,	AMD Radeon R7 240 Series
+6640,	00,	AMD Radeon HD 8950
+6640,	80,	AMD Radeon R9 M380
+6646,	00,	AMD Radeon R9 M280X
+6646,	80,	AMD Radeon R9 M385
+6646,	80,	AMD Radeon R9 M470X
+6647,	00,	AMD Radeon R9 M200X Series
+6647,	80,	AMD Radeon R9 M380
+6649,	00,	AMD FirePro W5100
+6658,	00,	AMD Radeon R7 200 Series
+665C,	00,	AMD Radeon HD 7700 Series
+665D,	00,	AMD Radeon R7 200 Series
+665F,	81,	AMD Radeon R7 360 Series
+6660,	00,	AMD Radeon HD 8600M Series
+6660,	81,	AMD Radeon R5 M335
+6660,	83,	AMD Radeon R5 M330
+6663,	00,	AMD Radeon HD 8500M Series
+6663,	83,	AMD Radeon R5 M320
+6664,	00,	AMD Radeon R5 M200 Series
+6665,	00,	AMD Radeon R5 M230 Series
+6665,	83,	AMD Radeon R5 M320
+6665,	C3,	AMD Radeon R5 M435
+6666,	00,	AMD Radeon R5 M200 Series
+6667,	00,	AMD Radeon R5 M200 Series
+666F,	00,	AMD Radeon HD 8500M
+66A1,	02,	AMD Instinct MI60 / MI50
+66A1,	06,	AMD Radeon Pro VII
+66AF,	C1,	AMD Radeon VII
+6780,	00,	AMD FirePro W9000
+6784,	00,	ATI FirePro V (FireGL V) Graphics Adapter
+6788,	00,	ATI FirePro V (FireGL V) Graphics Adapter
+678A,	00,	AMD FirePro W8000
+6798,	00,	AMD Radeon R9 200 / HD 7900 Series
+6799,	00,	AMD Radeon HD 7900 Series
+679A,	00,	AMD Radeon HD 7900 Series
+679B,	00,	AMD Radeon HD 7900 Series
+679E,	00,	AMD Radeon HD 7800 Series
+67A0,	00,	AMD Radeon FirePro W9100
+67A1,	00,	AMD Radeon FirePro W8100
+67B0,	00,	AMD Radeon R9 200 Series
+67B0,	80,	AMD Radeon R9 390 Series
+67B1,	00,	AMD Radeon R9 200 Series
+67B1,	80,	AMD Radeon R9 390 Series
+67B9,	00,	AMD Radeon R9 200 Series
+67C0,	00,	AMD Radeon Pro WX 7100 Graphics
+67C0,	80,	AMD Radeon E9550
+67C2,	01,	AMD Radeon Pro V7350x2
+67C2,	02,	AMD Radeon Pro V7300X
+67C4,	00,	AMD Radeon Pro WX 7100 Graphics
+67C4,	80,	AMD Radeon E9560 / E9565 Graphics
+67C7,	00,	AMD Radeon Pro WX 5100 Graphics
+67C7,	80,	AMD Radeon E9390 Graphics
+67D0,	01,	AMD Radeon Pro V7350x2
+67D0,	02,	AMD Radeon Pro V7300X
+67DF,	C0,	AMD Radeon Pro 580X
+67DF,	C1,	AMD Radeon RX 580 Series
+67DF,	C2,	AMD Radeon RX 570 Series
+67DF,	C3,	AMD Radeon RX 580 Series
+67DF,	C4,	AMD Radeon RX 480 Graphics
+67DF,	C5,	AMD Radeon RX 470 Graphics
+67DF,	C6,	AMD Radeon RX 570 Series
+67DF,	C7,	AMD Radeon RX 480 Graphics
+67DF,	CF,	AMD Radeon RX 470 Graphics
+67DF,	D7,	AMD Radeon RX 470 Graphics
+67DF,	E0,	AMD Radeon RX 470 Series
+67DF,	E1,	AMD Radeon RX 590 Series
+67DF,	E3,	AMD Radeon RX Series
+67DF,	E7,	AMD Radeon RX 580 Series
+67DF,	EB,	AMD Radeon Pro 580X
+67DF,	EF,	AMD Radeon RX 570 Series
+67DF,	F7,	AMD Radeon RX P30PH
+67DF,	FF,	AMD Radeon RX 470 Series
+67E0,	00,	AMD Radeon Pro WX Series
+67E3,	00,	AMD Radeon Pro WX 4100
+67E8,	00,	AMD Radeon Pro WX Series
+67E8,	01,	AMD Radeon Pro WX Series
+67E8,	80,	AMD Radeon E9260 Graphics
+67EB,	00,	AMD Radeon Pro V5300X
+67EF,	C0,	AMD Radeon RX Graphics
+67EF,	C1,	AMD Radeon RX 460 Graphics
+67EF,	C2,	AMD Radeon Pro Series
+67EF,	C3,	AMD Radeon RX Series
+67EF,	C5,	AMD Radeon RX 460 Graphics
+67EF,	C7,	AMD Radeon RX Graphics
+67EF,	CF,	AMD Radeon RX 460 Graphics
+67EF,	E0,	AMD Radeon RX 560 Series
+67EF,	E1,	AMD Radeon RX Series
+67EF,	E2,	AMD Radeon RX 560X
+67EF,	E3,	AMD Radeon RX Series
+67EF,	E5,	AMD Radeon RX 560 Series
+67EF,	E7,	AMD Radeon RX 560 Series
+67EF,	EF,	AMD Radeon 550 Series
+67EF,	FF,	AMD Radeon RX 460 Graphics
+67FF,	C0,	AMD Radeon Pro 465
+67FF,	C1,	AMD Radeon RX 560 Series
+67FF,	CF,	AMD Radeon RX 560 Series
+67FF,	EF,	AMD Radeon RX 560 Series
+67FF,	FF,	AMD Radeon RX 550 Series
+6800,	00,	AMD Radeon HD 7970M
+6801,	00,	AMD Radeon HD 8970M
+6806,	00,	AMD Radeon R9 M290X
+6808,	00,	AMD FirePro W7000
+6808,	00,	ATI FirePro V (FireGL V) Graphics Adapter
+6809,	00,	ATI FirePro W5000
+6810,	00,	AMD Radeon R9 200 Series
+6810,	81,	AMD Radeon R9 370 Series
+6811,	00,	AMD Radeon R9 200 Series
+6811,	81,	AMD Radeon R7 370 Series
+6818,	00,	AMD Radeon HD 7800 Series
+6819,	00,	AMD Radeon HD 7800 Series
+6820,	00,	AMD Radeon R9 M275X
+6820,	81,	AMD Radeon R9 M375
+6820,	83,	AMD Radeon R9 M375X
+6821,	00,	AMD Radeon R9 M200X Series
+6821,	83,	AMD Radeon R9 M370X
+6821,	87,	AMD Radeon R7 M380
+6822,	00,	AMD Radeon E8860
+6823,	00,	AMD Radeon R9 M200X Series
+6825,	00,	AMD Radeon HD 7800M Series
+6826,	00,	AMD Radeon HD 7700M Series
+6827,	00,	AMD Radeon HD 7800M Series
+6828,	00,	AMD FirePro W600
+682B,	00,	AMD Radeon HD 8800M Series
+682B,	87,	AMD Radeon R9 M360
+682C,	00,	AMD FirePro W4100
+682D,	00,	AMD Radeon HD 7700M Series
+682F,	00,	AMD Radeon HD 7700M Series
+6830,	00,	AMD Radeon 7800M Series
+6831,	00,	AMD Radeon 7700M Series
+6835,	00,	AMD Radeon R7 Series / HD 9000 Series
+6837,	00,	AMD Radeon HD 7700 Series
+683D,	00,	AMD Radeon HD 7700 Series
+683F,	00,	AMD Radeon HD 7700 Series
+684C,	00,	ATI FirePro V (FireGL V) Graphics Adapter
+6860,	00,	AMD Radeon Instinct MI25
+6860,	01,	AMD Radeon Instinct MI25
+6860,	02,	AMD Radeon Instinct MI25
+6860,	03,	AMD Radeon Pro V340
+6860,	04,	AMD Radeon Instinct MI25x2
+6860,	07,	AMD Radeon Pro V320
+6861,	00,	AMD Radeon Pro WX 9100
+6862,	00,	AMD Radeon Pro SSG
+6863,	00,	AMD Radeon Vega Frontier Edition
+6864,	03,	AMD Radeon Pro V340
+6864,	04,	AMD Radeon Instinct MI25x2
+6864,	05,	AMD Radeon Pro V340
+6868,	00,	AMD Radeon Pro WX 8200
+686C,	00,	AMD Radeon Instinct MI25 MxGPU
+686C,	01,	AMD Radeon Instinct MI25 MxGPU
+686C,	02,	AMD Radeon Instinct MI25 MxGPU
+686C,	03,	AMD Radeon Pro V340 MxGPU
+686C,	04,	AMD Radeon Instinct MI25x2 MxGPU
+686C,	05,	AMD Radeon Pro V340L MxGPU
+686C,	06,	AMD Radeon Instinct MI25 MxGPU
+687F,	01,	AMD Radeon RX Vega
+687F,	C0,	AMD Radeon RX Vega
+687F,	C1,	AMD Radeon RX Vega
+687F,	C3,	AMD Radeon RX Vega
+687F,	C7,	AMD Radeon RX Vega
+6900,	00,	AMD Radeon R7 M260
+6900,	81,	AMD Radeon R7 M360
+6900,	83,	AMD Radeon R7 M340
+6900,	C1,	AMD Radeon R5 M465 Series
+6900,	C3,	AMD Radeon R5 M445 Series
+6900,	D1,	AMD Radeon 530 Series
+6900,	D3,	AMD Radeon 530 Series
+6901,	00,	AMD Radeon R5 M255
+6902,	00,	AMD Radeon Series
+6907,	00,	AMD Radeon R5 M255
+6907,	87,	AMD Radeon R5 M315
+6920,	00,	AMD Radeon R9 M395X
+6920,	01,	AMD Radeon R9 M390X
+6921,	00,	AMD Radeon R9 M390X
+6929,	00,	AMD FirePro S7150
+6929,	01,	AMD FirePro S7100X
+692B,	00,	AMD FirePro W7100
+6938,	00,	AMD Radeon R9 200 Series
+6938,	F0,	AMD Radeon R9 200 Series
+6938,	F1,	AMD Radeon R9 380 Series
+6939,	00,	AMD Radeon R9 200 Series
+6939,	F0,	AMD Radeon R9 200 Series
+6939,	F1,	AMD Radeon R9 380 Series
+694C,	C0,	AMD Radeon RX Vega M GH Graphics
+694E,	C0,	AMD Radeon RX Vega M GL Graphics
+6980,	00,	AMD Radeon Pro WX 3100
+6981,	00,	AMD Radeon Pro WX 3200 Series
+6981,	01,	AMD Radeon Pro WX 3200 Series
+6981,	10,	AMD Radeon Pro WX 3200 Series
+6985,	00,	AMD Radeon Pro WX 3100
+6986,	00,	AMD Radeon Pro WX 2100
+6987,	80,	AMD Embedded Radeon E9171
+6987,	C0,	AMD Radeon 550X Series
+6987,	C1,	AMD Radeon RX 640
+6987,	C3,	AMD Radeon 540X Series
+6987,	C7,	AMD Radeon 540
+6995,	00,	AMD Radeon Pro WX 2100
+6997,	00,	AMD Radeon Pro WX 2100
+699F,	81,	AMD Embedded Radeon E9170 Series
+699F,	C0,	AMD Radeon 500 Series
+699F,	C1,	AMD Radeon 540 Series
+699F,	C3,	AMD Radeon 500 Series
+699F,	C7,	AMD Radeon RX 550 / 550 Series
+699F,	C9,	AMD Radeon 540
+6FDF,	E7,	AMD Radeon RX 590 GME
+6FDF,	EF,	AMD Radeon RX 580 2048SP
+7300,	C1,	AMD FirePro S9300 x2
+7300,	C8,	AMD Radeon R9 Fury Series
+7300,	C9,	AMD Radeon Pro Duo
+7300,	CA,	AMD Radeon R9 Fury Series
+7300,	CB,	AMD Radeon R9 Fury Series
+7312,	00,	AMD Radeon Pro W5700
+731E,	C6,	AMD Radeon RX 5700XTB
+731E,	C7,	AMD Radeon RX 5700B
+731F,	C0,	AMD Radeon RX 5700 XT 50th Anniversary
+731F,	C1,	AMD Radeon RX 5700 XT
+731F,	C2,	AMD Radeon RX 5600M
+731F,	C3,	AMD Radeon RX 5700M
+731F,	C4,	AMD Radeon RX 5700
+731F,	C5,	AMD Radeon RX 5700 XT
+731F,	CA,	AMD Radeon RX 5600 XT
+731F,	CB,	AMD Radeon RX 5600 OEM
+7340,	C1,	AMD Radeon RX 5500M
+7340,	C3,	AMD Radeon RX 5300M
+7340,	C5,	AMD Radeon RX 5500 XT
+7340,	C7,	AMD Radeon RX 5500
+7340,	C9,	AMD Radeon RX 5500XTB
+7340,	CF,	AMD Radeon RX 5300
+7341,	00,	AMD Radeon Pro W5500
+7347,	00,	AMD Radeon Pro W5500M
+7360,	41,	AMD Radeon Pro 5600M
+7360,	C3,	AMD Radeon Pro V520
+7362,	C1,	AMD Radeon Pro V540
+7362,	C3,	AMD Radeon Pro V520
+738C,	01,	AMD Instinct MI100
+73A1,	00,	AMD Radeon Pro V620
+73A3,	00,	AMD Radeon Pro W6800
+73A5,	C0,	AMD Radeon RX 6950 XT
+73AE,	00,	AMD Radeon Pro V620 MxGPU
+73AF,	C0,	AMD Radeon RX 6900 XT
+73BF,	C0,	AMD Radeon RX 6900 XT
+73BF,	C1,	AMD Radeon RX 6800 XT
+73BF,	C3,	AMD Radeon RX 6800
+73DF,	C0,	AMD Radeon RX 6750 XT
+73DF,	C1,	AMD Radeon RX 6700 XT
+73DF,	C2,	AMD Radeon RX 6800M
+73DF,	C3,	AMD Radeon RX 6800M
+73DF,	C5,	AMD Radeon RX 6700 XT
+73DF,	CF,	AMD Radeon RX 6700M
+73DF,	D5,	AMD Radeon RX 6750 GRE 12GB
+73DF,	D7,	AMD TDC-235
+73DF,	DF,	AMD Radeon RX 6700
+73DF,	E5,	AMD Radeon RX 6750 GRE 12GB
+73DF,	FF,	AMD Radeon RX 6700
+73E0,	00,	AMD Radeon RX 6600M
+73E1,	00,	AMD Radeon Pro W6600M
+73E3,	00,	AMD Radeon Pro W6600
+73EF,	C0,	AMD Radeon RX 6800S
+73EF,	C1,	AMD Radeon RX 6650 XT
+73EF,	C2,	AMD Radeon RX 6700S
+73EF,	C3,	AMD Radeon RX 6650M
+73EF,	C4,	AMD Radeon RX 6650M XT
+73FF,	C1,	AMD Radeon RX 6600 XT
+73FF,	C3,	AMD Radeon RX 6600M
+73FF,	C7,	AMD Radeon RX 6600
+73FF,	CB,	AMD Radeon RX 6600S
+73FF,	CF,	AMD Radeon RX 6600 LE
+73FF,	DF,	AMD Radeon RX 6750 GRE 10GB
+7408,	00,	AMD Instinct MI250X
+740C,	01,	AMD Instinct MI250X / MI250
+740F,	02,	AMD Instinct MI210
+7421,	00,	AMD Radeon Pro W6500M
+7422,	00,	AMD Radeon Pro W6400
+7423,	00,	AMD Radeon Pro W6300M
+7423,	01,	AMD Radeon Pro W6300
+7424,	00,	AMD Radeon RX 6300
+743F,	C1,	AMD Radeon RX 6500 XT
+743F,	C3,	AMD Radeon RX 6500
+743F,	C3,	AMD Radeon RX 6500M
+743F,	C7,	AMD Radeon RX 6400
+743F,	C8,	AMD Radeon RX 6500M
+743F,	CC,	AMD Radeon 6550S
+743F,	CE,	AMD Radeon RX 6450M
+743F,	CF,	AMD Radeon RX 6300M
+743F,	D3,	AMD Radeon RX 6550M
+743F,	D7,	AMD Radeon RX 6400
+7448,	00,	AMD Radeon Pro W7900
+7449,	00,	AMD Radeon Pro W7800 48GB
+744A,	00,	AMD Radeon Pro W7900 Dual Slot
+744B,	00,	AMD Radeon Pro W7900D
+744C,	C8,	AMD Radeon RX 7900 XTX
+744C,	CC,	AMD Radeon RX 7900 XT
+744C,	CE,	AMD Radeon RX 7900 GRE
+744C,	CF,	AMD Radeon RX 7900M
+745E,	CC,	AMD Radeon Pro W7800
+7460,	00,	AMD Radeon Pro V710
+7461,	00,	AMD Radeon Pro V710 MxGPU
+7470,	00,	AMD Radeon Pro W7700
+747E,	C8,	AMD Radeon RX 7800 XT
+747E,	D8,	AMD Radeon RX 7800M
+747E,	DB,	AMD Radeon RX 7700
+747E,	FF,	AMD Radeon RX 7700 XT
+7480,	00,	AMD Radeon Pro W7600
+7480,	C0,	AMD Radeon RX 7600 XT
+7480,	C1,	AMD Radeon RX 7700S
+7480,	C2,	AMD Radeon RX 7650 GRE
+7480,	C3,	AMD Radeon RX 7600S
+7480,	C7,	AMD Radeon RX 7600M XT
+7480,	CF,	AMD Radeon RX 7600
+7481,   C7,     AMD Steam Machine
+7483,	CF,	AMD Radeon RX 7600M
+7489,	00,	AMD Radeon Pro W7500
+7499,	00,	AMD Radeon Pro W7400
+7499,	C0,	AMD Radeon RX 7400
+7499,	C1,	AMD Radeon RX 7300
+74A0,	00,	AMD Instinct MI300A
+74A1,	00,	AMD Instinct MI300X
+74A2,	00,	AMD Instinct MI308X
+74A5,	00,	AMD Instinct MI325X
+74A8,	00,	AMD Instinct MI308X HF
+74A9,	00,	AMD Instinct MI300X HF
+74B5,	00,	AMD Instinct MI300X VF
+74B6,	00,	AMD Instinct MI308X
+74BD,	00,	AMD Instinct MI300X HF
+7550,	C0,	AMD Radeon RX 9070 XT
+7550,	C2,	AMD Radeon RX 9070 GRE
+7550,	C3,	AMD Radeon RX 9070
+7551,	C0,	AMD Radeon AI PRO R9700
+7590,	C0,	AMD Radeon RX 9060 XT
+7590,	C7,	AMD Radeon RX 9060
+75A0,	C0,	AMD Instinct MI350X
+75A3,	C0,	AMD Instinct MI355X
+75B0,	C0,	AMD Instinct MI350X VF
+75B3,	C0,	AMD Instinct MI355X VF
+9830,	00,	AMD Radeon HD 8400 / R3 Series
+9831,	00,	AMD Radeon HD 8400E
+9832,	00,	AMD Radeon HD 8330
+9833,	00,	AMD Radeon HD 8330E
+9834,	00,	AMD Radeon HD 8210
+9835,	00,	AMD Radeon HD 8210E
+9836,	00,	AMD Radeon HD 8200 / R3 Series
+9837,	00,	AMD Radeon HD 8280E
+9838,	00,	AMD Radeon HD 8200 / R3 series
+9839,	00,	AMD Radeon HD 8180
+983D,	00,	AMD Radeon HD 8250
+9850,	00,	AMD Radeon R3 Graphics
+9850,	03,	AMD Radeon R3 Graphics
+9850,	40,	AMD Radeon R2 Graphics
+9850,	45,	AMD Radeon R3 Graphics
+9851,	00,	AMD Radeon R4 Graphics
+9851,	01,	AMD Radeon R5E Graphics
+9851,	05,	AMD Radeon R5 Graphics
+9851,	06,	AMD Radeon R5E Graphics
+9851,	40,	AMD Radeon R4 Graphics
+9851,	45,	AMD Radeon R5 Graphics
+9852,	00,	AMD Radeon R2 Graphics
+9852,	40,	AMD Radeon E1 Graphics
+9853,	00,	AMD Radeon R2 Graphics
+9853,	01,	AMD Radeon R4E Graphics
+9853,	03,	AMD Radeon R2 Graphics
+9853,	05,	AMD Radeon R1E Graphics
+9853,	06,	AMD Radeon R1E Graphics
+9853,	07,	AMD Radeon R1E Graphics
+9853,	08,	AMD Radeon R1E Graphics
+9853,	40,	AMD Radeon R2 Graphics
+9854,	00,	AMD Radeon R3 Graphics
+9854,	01,	AMD Radeon R3E Graphics
+9854,	02,	AMD Radeon R3 Graphics
+9854,	05,	AMD Radeon R2 Graphics
+9854,	06,	AMD Radeon R4 Graphics
+9854,	07,	AMD Radeon R3 Graphics
+9855,	02,	AMD Radeon R6 Graphics
+9855,	05,	AMD Radeon R4 Graphics
+9856,	00,	AMD Radeon R2 Graphics
+9856,	01,	AMD Radeon R2E Graphics
+9856,	02,	AMD Radeon R2 Graphics
+9856,	05,	AMD Radeon R1E Graphics
+9856,	06,	AMD Radeon R2 Graphics
+9856,	07,	AMD Radeon R1E Graphics
+9856,	08,	AMD Radeon R1E Graphics
+9856,	13,	AMD Radeon R1E Graphics
+9874,	81,	AMD Radeon R6 Graphics
+9874,	84,	AMD Radeon R7 Graphics
+9874,	85,	AMD Radeon R6 Graphics
+9874,	87,	AMD Radeon R5 Graphics
+9874,	88,	AMD Radeon R7E Graphics
+9874,	89,	AMD Radeon R6E Graphics
+9874,	C4,	AMD Radeon R7 Graphics
+9874,	C5,	AMD Radeon R6 Graphics
+9874,	C6,	AMD Radeon R6 Graphics
+9874,	C7,	AMD Radeon R5 Graphics
+9874,	C8,	AMD Radeon R7 Graphics
+9874,	C9,	AMD Radeon R7 Graphics
+9874,	CA,	AMD Radeon R5 Graphics
+9874,	CB,	AMD Radeon R5 Graphics
+9874,	CC,	AMD Radeon R7 Graphics
+9874,	CD,	AMD Radeon R7 Graphics
+9874,	CE,	AMD Radeon R5 Graphics
+9874,	E1,	AMD Radeon R7 Graphics
+9874,	E2,	AMD Radeon R7 Graphics
+9874,	E3,	AMD Radeon R7 Graphics
+9874,	E4,	AMD Radeon R7 Graphics
+9874,	E5,	AMD Radeon R5 Graphics
+9874,	E6,	AMD Radeon R5 Graphics
+98E4,	80,	AMD Radeon R5E Graphics
+98E4,	81,	AMD Radeon R4E Graphics
+98E4,	83,	AMD Radeon R2E Graphics
+98E4,	84,	AMD Radeon R2E Graphics
+98E4,	86,	AMD Radeon R1E Graphics
+98E4,	C0,	AMD Radeon R4 Graphics
+98E4,	C1,	AMD Radeon R5 Graphics
+98E4,	C2,	AMD Radeon R4 Graphics
+98E4,	C4,	AMD Radeon R5 Graphics
+98E4,	C6,	AMD Radeon R5 Graphics
+98E4,	C8,	AMD Radeon R4 Graphics
+98E4,	C9,	AMD Radeon R4 Graphics
+98E4,	CA,	AMD Radeon R5 Graphics
+98E4,	D0,	AMD Radeon R2 Graphics
+98E4,	D1,	AMD Radeon R2 Graphics
+98E4,	D2,	AMD Radeon R2 Graphics
+98E4,	D4,	AMD Radeon R2 Graphics
+98E4,	D9,	AMD Radeon R5 Graphics
+98E4,	DA,	AMD Radeon R5 Graphics
+98E4,	DB,	AMD Radeon R3 Graphics
+98E4,	E1,	AMD Radeon R3 Graphics
+98E4,	E2,	AMD Radeon R3 Graphics
+98E4,	E9,	AMD Radeon R4 Graphics
+98E4,	EA,	AMD Radeon R4 Graphics
+98E4,	EB,	AMD Radeon R3 Graphics
+98E4,	EB,	AMD Radeon R4 Graphics

agent/test-data/container.json

@@ -0,0 +1,24 @@
+{
+	"cpu_stats": {
+		"cpu_usage": {
+			"total_usage": 312055276000
+		},
+		"system_cpu_usage": 1366399830000000
+	},
+	"memory_stats": {
+		"usage": 507400192,
+		"stats": {
+			"inactive_file": 165130240
+		}
+	},
+	"networks": {
+		"eth0": {
+			"tx_bytes": 20376558,
+			"rx_bytes": 537029455
+		},
+		"eth1": {
+			"tx_bytes": 2003766,
+			"rx_bytes": 6241
+		}
+	}
+}

agent/test-data/container2.json

@@ -0,0 +1,24 @@
+{
+	"cpu_stats": {
+		"cpu_usage": {
+			"total_usage": 314891801000
+		},
+		"system_cpu_usage": 1368474900000000
+	},
+	"memory_stats": {
+		"usage": 507400192,
+		"stats": {
+			"inactive_file": 165130240
+		}
+	},
+	"networks": {
+		"eth0": {
+			"tx_bytes": 20376558,
+			"rx_bytes": 537029455
+		},
+		"eth1": {
+			"tx_bytes": 2003766,
+			"rx_bytes": 6241
+		}
+	}
+}

agent/test-data/nvtop.json

@@ -0,0 +1,34 @@
+[
+  {
+   "device_name": "NVIDIA GeForce RTX 3050 Ti Laptop GPU",
+   "gpu_clock": "1485MHz",
+   "mem_clock": "6001MHz",
+   "temp": "48C",
+   "fan_speed": null,
+   "power_draw": "13W",
+   "gpu_util": "5%",
+   "encode": "0%",
+   "decode": "0%",
+   "mem_util": "8%",
+   "mem_total": "4294967296",
+   "mem_used": "349372416",
+   "mem_free": "3945594880",
+   "processes" : []
+  },
+  {
+   "device_name": "AMD Radeon 680M",
+   "gpu_clock": "2200MHz",
+   "mem_clock": "2400MHz",
+   "temp": "48C",
+   "fan_speed": "CPU Fan",
+   "power_draw": "9W",
+   "gpu_util": "12%",
+   "encode": null,
+   "decode": "0%",
+   "mem_util": "7%",
+   "mem_total": "16929173504",
+   "mem_used": "1213784064",
+   "mem_free": "15715389440",
+   "processes" : []
+  }
+]

agent/test-data/smart/nvme0.json

@@ -0,0 +1,272 @@
+{
+  "json_format_version": [
+    1,
+    0
+  ],
+  "smartctl": {
+    "version": [
+      7,
+      5
+    ],
+    "pre_release": false,
+    "svn_revision": "5714",
+    "platform_info": "x86_64-linux-6.17.1-2-cachyos",
+    "build_info": "(local build)",
+    "argv": [
+      "smartctl",
+      "-aj",
+      "/dev/nvme0"
+    ],
+    "exit_status": 0
+  },
+  "local_time": {
+    "time_t": 1761507494,
+    "asctime": "Sun Oct 26 15:38:14 2025 EDT"
+  },
+  "device": {
+    "name": "/dev/nvme0",
+    "info_name": "/dev/nvme0",
+    "type": "nvme",
+    "protocol": "NVMe"
+  },
+  "model_name": "PELADN 512GB",
+  "serial_number": "2024031600129",
+  "firmware_version": "VC2S038E",
+  "nvme_pci_vendor": {
+    "id": 4332,
+    "subsystem_id": 4332
+  },
+  "nvme_ieee_oui_identifier": 57420,
+  "nvme_controller_id": 1,
+  "nvme_version": {
+    "string": "1.4",
+    "value": 66560
+  },
+  "nvme_number_of_namespaces": 1,
+  "nvme_namespaces": [
+    {
+      "id": 1,
+      "size": {
+        "blocks": 1000215216,
+        "bytes": 512110190592
+      },
+      "capacity": {
+        "blocks": 1000215216,
+        "bytes": 512110190592
+      },
+      "utilization": {
+        "blocks": 1000215216,
+        "bytes": 512110190592
+      },
+      "formatted_lba_size": 512,
+      "eui64": {
+        "oui": 57420,
+        "ext_id": 112094110470
+      },
+      "features": {
+        "value": 0,
+        "thin_provisioning": false,
+        "na_fields": false,
+        "dealloc_or_unwritten_block_error": false,
+        "uid_reuse": false,
+        "np_fields": false,
+        "other": 0
+      },
+      "lba_formats": [
+        {
+          "formatted": true,
+          "data_bytes": 512,
+          "metadata_bytes": 0,
+          "relative_performance": 0
+        }
+      ]
+    }
+  ],
+  "user_capacity": {
+    "blocks": 1000215216,
+    "bytes": 512110190592
+  },
+  "logical_block_size": 512,
+  "smart_support": {
+    "available": true,
+    "enabled": true
+  },
+  "nvme_firmware_update_capabilities": {
+    "value": 2,
+    "slots": 1,
+    "first_slot_is_read_only": false,
+    "activiation_without_reset": false,
+    "multiple_update_detection": false,
+    "other": 0
+  },
+  "nvme_optional_admin_commands": {
+    "value": 23,
+    "security_send_receive": true,
+    "format_nvm": true,
+    "firmware_download": true,
+    "namespace_management": false,
+    "self_test": true,
+    "directives": false,
+    "mi_send_receive": false,
+    "virtualization_management": false,
+    "doorbell_buffer_config": false,
+    "get_lba_status": false,
+    "command_and_feature_lockdown": false,
+    "other": 0
+  },
+  "nvme_optional_nvm_commands": {
+    "value": 94,
+    "compare": false,
+    "write_uncorrectable": true,
+    "dataset_management": true,
+    "write_zeroes": true,
+    "save_select_feature_nonzero": true,
+    "reservations": false,
+    "timestamp": true,
+    "verify": false,
+    "copy": false,
+    "other": 0
+  },
+  "nvme_log_page_attributes": {
+    "value": 2,
+    "smart_health_per_namespace": false,
+    "commands_effects_log": true,
+    "extended_get_log_page_cmd": false,
+    "telemetry_log": false,
+    "persistent_event_log": false,
+    "supported_log_pages_log": false,
+    "telemetry_data_area_4": false,
+    "other": 0
+  },
+  "nvme_maximum_data_transfer_pages": 32,
+  "nvme_composite_temperature_threshold": {
+    "warning": 100,
+    "critical": 110
+  },
+  "temperature": {
+    "op_limit_max": 100,
+    "critical_limit_max": 110,
+    "current": 61
+  },
+  "nvme_power_states": [
+    {
+      "non_operational_state": false,
+      "relative_read_latency": 0,
+      "relative_read_throughput": 0,
+      "relative_write_latency": 0,
+      "relative_write_throughput": 0,
+      "entry_latency_us": 230000,
+      "exit_latency_us": 50000,
+      "max_power": {
+        "value": 800,
+        "scale": 2,
+        "units_per_watt": 100
+      }
+    },
+    {
+      "non_operational_state": false,
+      "relative_read_latency": 1,
+      "relative_read_throughput": 1,
+      "relative_write_latency": 1,
+      "relative_write_throughput": 1,
+      "entry_latency_us": 4000,
+      "exit_latency_us": 50000,
+      "max_power": {
+        "value": 400,
+        "scale": 2,
+        "units_per_watt": 100
+      }
+    },
+    {
+      "non_operational_state": false,
+      "relative_read_latency": 2,
+      "relative_read_throughput": 2,
+      "relative_write_latency": 2,
+      "relative_write_throughput": 2,
+      "entry_latency_us": 4000,
+      "exit_latency_us": 250000,
+      "max_power": {
+        "value": 300,
+        "scale": 2,
+        "units_per_watt": 100
+      }
+    },
+    {
+      "non_operational_state": true,
+      "relative_read_latency": 3,
+      "relative_read_throughput": 3,
+      "relative_write_latency": 3,
+      "relative_write_throughput": 3,
+      "entry_latency_us": 5000,
+      "exit_latency_us": 10000,
+      "max_power": {
+        "value": 300,
+        "scale": 1,
+        "units_per_watt": 10000
+      }
+    },
+    {
+      "non_operational_state": true,
+      "relative_read_latency": 4,
+      "relative_read_throughput": 4,
+      "relative_write_latency": 4,
+      "relative_write_throughput": 4,
+      "entry_latency_us": 54000,
+      "exit_latency_us": 45000,
+      "max_power": {
+        "value": 50,
+        "scale": 1,
+        "units_per_watt": 10000
+      }
+    }
+  ],
+  "smart_status": {
+    "passed": true,
+    "nvme": {
+      "value": 0
+    }
+  },
+  "nvme_smart_health_information_log": {
+    "nsid": -1,
+    "critical_warning": 0,
+    "temperature": 61,
+    "available_spare": 100,
+    "available_spare_threshold": 32,
+    "percentage_used": 0,
+    "data_units_read": 6573104,
+    "data_units_written": 16040567,
+    "host_reads": 63241130,
+    "host_writes": 253050006,
+    "controller_busy_time": 0,
+    "power_cycles": 430,
+    "power_on_hours": 4399,
+    "unsafe_shutdowns": 44,
+    "media_errors": 0,
+    "num_err_log_entries": 0,
+    "warning_temp_time": 0,
+    "critical_comp_time": 0
+  },
+  "spare_available": {
+    "current_percent": 100,
+    "threshold_percent": 32
+  },
+  "endurance_used": {
+    "current_percent": 0
+  },
+  "power_cycle_count": 430,
+  "power_on_time": {
+    "hours": 4399
+  },
+  "nvme_error_information_log": {
+    "size": 8,
+    "read": 8,
+    "unread": 0
+  },
+  "nvme_self_test_log": {
+    "nsid": -1,
+    "current_self_test_operation": {
+      "value": 0,
+      "string": "No self-test in progress"
+    }
+  }
+}

agent/test-data/smart/scan.json

@@ -0,0 +1,36 @@
+{
+  "json_format_version": [
+    1,
+    0
+  ],
+  "smartctl": {
+    "version": [
+      7,
+      5
+    ],
+    "pre_release": false,
+    "svn_revision": "5714",
+    "platform_info": "x86_64-linux-6.17.1-2-cachyos",
+    "build_info": "(local build)",
+    "argv": [
+      "smartctl",
+      "--scan",
+      "-j"
+    ],
+    "exit_status": 0
+  },
+  "devices": [
+    {
+      "name": "/dev/sda",
+      "info_name": "/dev/sda [SAT]",
+      "type": "sat",
+      "protocol": "ATA"
+    },
+    {
+      "name": "/dev/nvme0",
+      "info_name": "/dev/nvme0",
+      "type": "nvme",
+      "protocol": "NVMe"
+    }
+  ]
+}

agent/test-data/smart/scsi.json

@@ -0,0 +1,125 @@
+{
+   "json_format_version": [
+      1,
+      0
+   ],
+   "smartctl": {
+      "version": [
+         7,
+         3
+      ],
+      "svn_revision": "5338",
+      "platform_info": "x86_64-linux-6.12.43+deb12-amd64",
+      "build_info": "(local build)",
+      "argv": [
+         "smartctl",
+         "-aj",
+         "/dev/sde"
+      ],
+      "exit_status": 0
+   },
+   "local_time": {
+      "time_t": 1761502142,
+      "asctime": "Sun Oct 21 21:09:02 2025 MSK"
+   },
+   "device": {
+      "name": "/dev/sde",
+      "info_name": "/dev/sde",
+      "type": "scsi",
+      "protocol": "SCSI"
+   },
+   "scsi_vendor": "YADRO",
+   "scsi_product": "WUH721414AL4204",
+   "scsi_model_name": "YADRO WUH721414AL4204",
+   "scsi_revision": "C240",
+   "scsi_version": "SPC-4",
+   "user_capacity": {
+      "blocks": 3418095616,
+      "bytes": 14000519643136
+   },
+   "logical_block_size": 4096,
+   "scsi_lb_provisioning": {
+      "name": "fully provisioned",
+      "value": 0,
+      "management_enabled": {
+         "name": "LBPME",
+         "value": 0
+      },
+      "read_zeros": {
+         "name": "LBPRZ",
+         "value": 0
+      }
+   },
+   "rotation_rate": 7200,
+   "form_factor": {
+      "scsi_value": 2,
+      "name": "3.5 inches"
+   },
+   "logical_unit_id": "0x5000cca29063dc00",
+   "serial_number": "9YHSDH9B",
+   "device_type": {
+      "scsi_terminology": "Peripheral Device Type [PDT]",
+      "scsi_value": 0,
+      "name": "disk"
+   },
+   "scsi_transport_protocol": {
+      "name": "SAS (SPL-4)",
+      "value": 6
+   },
+   "smart_support": {
+      "available": true,
+      "enabled": true
+   },
+   "temperature_warning": {
+      "enabled": true
+   },
+   "smart_status": {
+      "passed": true
+   },
+   "temperature": {
+      "current": 34,
+      "drive_trip": 85
+   },
+   "power_on_time": {
+      "hours": 458,
+      "minutes": 25
+   },
+   "scsi_start_stop_cycle_counter": {
+      "year_of_manufacture": "2022",
+      "week_of_manufacture": "41",
+      "specified_cycle_count_over_device_lifetime": 50000,
+      "accumulated_start_stop_cycles": 2,
+      "specified_load_unload_count_over_device_lifetime": 600000,
+      "accumulated_load_unload_cycles": 418
+   },
+   "scsi_grown_defect_list": 0,
+   "scsi_error_counter_log": {
+      "read": {
+         "errors_corrected_by_eccfast": 0,
+         "errors_corrected_by_eccdelayed": 0,
+         "errors_corrected_by_rereads_rewrites": 0,
+         "total_errors_corrected": 0,
+         "correction_algorithm_invocations": 346,
+         "gigabytes_processed": "3,641",
+         "total_uncorrected_errors": 0
+      },
+      "write": {
+         "errors_corrected_by_eccfast": 0,
+         "errors_corrected_by_eccdelayed": 0,
+         "errors_corrected_by_rereads_rewrites": 0,
+         "total_errors_corrected": 0,
+         "correction_algorithm_invocations": 4052,
+         "gigabytes_processed": "2124,590",
+         "total_uncorrected_errors": 0
+      },
+      "verify": {
+         "errors_corrected_by_eccfast": 0,
+         "errors_corrected_by_eccdelayed": 0,
+         "errors_corrected_by_rereads_rewrites": 0,
+         "total_errors_corrected": 0,
+         "correction_algorithm_invocations": 223,
+         "gigabytes_processed": "0,000",
+         "total_uncorrected_errors": 0
+      }
+   }
+}

agent/test-data/system_info.json

@@ -0,0 +1,17 @@
+{
+  "ID": "7TRN:IPZB:QYBB:VPBQ:UMPP:KARE:6ZNR:XE6T:7EWV:PKF4:ZOJD:TPYS",
+  "Containers": 14,
+  "ContainersRunning": 3,
+  "ContainersPaused": 1,
+  "ContainersStopped": 10,
+  "Images": 508,
+  "Driver": "overlay2",
+  "KernelVersion": "6.8.0-31-generic",
+  "OperatingSystem": "Ubuntu 24.04 LTS",
+  "OSVersion": "24.04",
+  "OSType": "linux",
+  "Architecture": "x86_64",
+  "NCPU": 4,
+  "MemTotal": 2095882240,
+  "ServerVersion": "27.0.1"
+}

agent/tools/fetchsmartctl/main.go

@@ -0,0 +1,130 @@
+package main
+
+import (
+	"crypto/sha1"
+	"crypto/sha256"
+	"encoding/hex"
+	"flag"
+	"fmt"
+	"hash"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+// Download smartctl.exe from the given URL and save it to the given destination.
+// This is used to embed smartctl.exe in the Windows build.
+
+func main() {
+	url := flag.String("url", "", "URL to download smartctl.exe from (required)")
+	out := flag.String("out", "", "Destination path for smartctl.exe (required)")
+	sha := flag.String("sha", "", "Optional SHA1/SHA256 checksum for integrity validation")
+	force := flag.Bool("force", false, "Force re-download even if destination exists")
+	flag.Parse()
+
+	if *url == "" || *out == "" {
+		fatalf("-url and -out are required")
+	}
+
+	if !*force {
+		if info, err := os.Stat(*out); err == nil && info.Size() > 0 {
+			fmt.Println("smartctl.exe already present, skipping download")
+			return
+		}
+	}
+
+	if err := downloadFile(*url, *out, *sha); err != nil {
+		fatalf("download failed: %v", err)
+	}
+}
+
+func downloadFile(url, dest, shaHex string) error {
+	// Prepare destination
+	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
+		return fmt.Errorf("create dir: %w", err)
+	}
+
+	// HTTP client
+	client := &http.Client{Timeout: 60 * time.Second}
+	req, err := http.NewRequest(http.MethodGet, url, nil)
+	if err != nil {
+		return fmt.Errorf("new request: %w", err)
+	}
+	req.Header.Set("User-Agent", "beszel-fetchsmartctl/1.0")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return fmt.Errorf("http get: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("unexpected HTTP status: %s", resp.Status)
+	}
+
+	tmp := dest + ".tmp"
+	f, err := os.OpenFile(tmp, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o644)
+	if err != nil {
+		return fmt.Errorf("open tmp: %w", err)
+	}
+
+	// Determine hash algorithm based on length (SHA1=40, SHA256=64)
+	var hasher hash.Hash
+	if shaHex := strings.TrimSpace(shaHex); shaHex != "" {
+		cleanSha := strings.ToLower(strings.ReplaceAll(shaHex, " ", ""))
+		switch len(cleanSha) {
+		case 40:
+			hasher = sha1.New()
+		case 64:
+			hasher = sha256.New()
+		default:
+			f.Close()
+			os.Remove(tmp)
+			return fmt.Errorf("unsupported hash length: %d (expected 40 for SHA1 or 64 for SHA256)", len(cleanSha))
+		}
+	}
+
+	var mw io.Writer = f
+	if hasher != nil {
+		mw = io.MultiWriter(f, hasher)
+	}
+	if _, err := io.Copy(mw, resp.Body); err != nil {
+		f.Close()
+		os.Remove(tmp)
+		return fmt.Errorf("write tmp: %w", err)
+	}
+	if err := f.Close(); err != nil {
+		os.Remove(tmp)
+		return fmt.Errorf("close tmp: %w", err)
+	}
+
+	if hasher != nil && shaHex != "" {
+		cleanSha := strings.ToLower(strings.ReplaceAll(strings.TrimSpace(shaHex), " ", ""))
+		got := strings.ToLower(hex.EncodeToString(hasher.Sum(nil)))
+		if got != cleanSha {
+			os.Remove(tmp)
+			return fmt.Errorf("hash mismatch: got %s want %s", got, cleanSha)
+		}
+	}
+
+	// Make executable and move into place
+	if err := os.Chmod(tmp, 0o755); err != nil {
+		os.Remove(tmp)
+		return fmt.Errorf("chmod: %w", err)
+	}
+	if err := os.Rename(tmp, dest); err != nil {
+		os.Remove(tmp)
+		return fmt.Errorf("rename: %w", err)
+	}
+
+	fmt.Println("smartctl.exe downloaded to", dest)
+	return nil
+}
+
+func fatalf(format string, a ...any) {
+	fmt.Fprintf(os.Stderr, format+"\n", a...)
+	os.Exit(1)
+}

agent/update.go

@@ -1,12 +1,10 @@
 package agent
 
 import (
-	"fmt"
 	"log"
 	"os"
 	"os/exec"
 	"runtime"
-	"strings"
 
 	"github.com/henrygd/beszel/internal/ghupdate"
 )
@@ -30,21 +28,22 @@ func (s *systemdRestarter) Restart() error {
 type openRCRestarter struct{ cmd string }
 
 func (o *openRCRestarter) Restart() error {
-	if err := exec.Command(o.cmd, "status", "beszel-agent").Run(); err != nil {
+	if err := exec.Command(o.cmd, "beszel-agent", "status").Run(); err != nil {
 		return nil
 	}
 	ghupdate.ColorPrint(ghupdate.ColorYellow, "Restarting beszel-agent via OpenRC…")
-	return exec.Command(o.cmd, "restart", "beszel-agent").Run()
+	return exec.Command(o.cmd, "beszel-agent", "restart").Run()
 }
 
 type openWRTRestarter struct{ cmd string }
 
 func (w *openWRTRestarter) Restart() error {
-	if err := exec.Command(w.cmd, "running", "beszel-agent").Run(); err != nil {
+	// https://openwrt.org/docs/guide-user/base-system/managing_services?s[]=service
+	if err := exec.Command("/etc/init.d/beszel-agent", "running").Run(); err != nil {
 		return nil
 	}
 	ghupdate.ColorPrint(ghupdate.ColorYellow, "Restarting beszel-agent via procd…")
-	return exec.Command(w.cmd, "restart", "beszel-agent").Run()
+	return exec.Command("/etc/init.d/beszel-agent", "restart").Run()
 }
 
 type freeBSDRestarter struct{ cmd string }
@@ -64,11 +63,13 @@ func detectRestarter() restarter {
 	if path, err := exec.LookPath("rc-service"); err == nil {
 		return &openRCRestarter{cmd: path}
 	}
+	if path, err := exec.LookPath("procd"); err == nil {
+		return &openWRTRestarter{cmd: path}
+	}
 	if path, err := exec.LookPath("service"); err == nil {
 		if runtime.GOOS == "freebsd" {
 			return &freeBSDRestarter{cmd: path}
 		}
-		return &openWRTRestarter{cmd: path}
 	}
 	return nil
 }
@@ -78,7 +79,7 @@ func detectRestarter() restarter {
 func Update(useMirror bool) error {
 	exePath, _ := os.Executable()
 
-	dataDir, err := getDataDir()
+	dataDir, err := GetDataDir()
 	if err != nil {
 		dataDir = os.TempDir()
 	}
@@ -105,12 +106,12 @@ func Update(useMirror bool) error {
 		}
 	}
 
-	// 6) Fix SELinux context if necessary
+	// Fix SELinux context if necessary
-	if err := handleSELinuxContext(exePath); err != nil {
+	if err := ghupdate.HandleSELinuxContext(exePath); err != nil {
 		ghupdate.ColorPrintf(ghupdate.ColorYellow, "Warning: SELinux context handling: %v", err)
 	}
 
-	// 7) Restart service if running under a recognised init system
+	// Restart service if running under a recognised init system
 	if r := detectRestarter(); r != nil {
 		if err := r.Restart(); err != nil {
 			ghupdate.ColorPrintf(ghupdate.ColorYellow, "Warning: failed to restart service: %v", err)
@@ -124,42 +125,3 @@ func Update(useMirror bool) error {
 
 	return nil
 }
-
-// handleSELinuxContext restores or applies the correct SELinux label to the binary.
-func handleSELinuxContext(path string) error {
-	out, err := exec.Command("getenforce").Output()
-	if err != nil {
-		// SELinux not enabled or getenforce not available
-		return nil
-	}
-	state := strings.TrimSpace(string(out))
-	if state == "Disabled" {
-		return nil
-	}
-
-	ghupdate.ColorPrint(ghupdate.ColorYellow, "SELinux is enabled; applying context…")
-	var errs []string
-
-	// Try persistent context via semanage+restorecon
-	if semanagePath, err := exec.LookPath("semanage"); err == nil {
-		if err := exec.Command(semanagePath, "fcontext", "-a", "-t", "bin_t", path).Run(); err != nil {
-			errs = append(errs, "semanage fcontext failed: "+err.Error())
-		} else if restoreconPath, err := exec.LookPath("restorecon"); err == nil {
-			if err := exec.Command(restoreconPath, "-v", path).Run(); err != nil {
-				errs = append(errs, "restorecon failed: "+err.Error())
-			}
-		}
-	}
-
-	// Fallback to temporary context via chcon
-	if chconPath, err := exec.LookPath("chcon"); err == nil {
-		if err := exec.Command(chconPath, "-t", "bin_t", path).Run(); err != nil {
-			errs = append(errs, "chcon failed: "+err.Error())
-		}
-	}
-
-	if len(errs) > 0 {
-		return fmt.Errorf("SELinux context errors: %s", strings.Join(errs, "; "))
-	}
-	return nil
-}

beszel.go

@@ -6,10 +6,13 @@ import "github.com/blang/semver"
 
 const (
 	// Version is the current version of the application.
-	Version = "0.12.9"
+	Version = "0.18.4"
 	// AppName is the name of the application.
 	AppName = "beszel"
 )
 
 // MinVersionCbor is the minimum supported version for CBOR compatibility.
 var MinVersionCbor = semver.MustParse("0.12.0")
+
+// MinVersionAgentResponse is the minimum supported version for AgentResponse compatibility.
+var MinVersionAgentResponse = semver.MustParse("0.13.0")

go.mod

@@ -1,27 +1,27 @@
 module github.com/henrygd/beszel
 
-go 1.25.1
+go 1.26.0
-
-// lock shoutrrr to specific version to allow review before updating
-replace github.com/nicholas-fedor/shoutrrr => github.com/nicholas-fedor/shoutrrr v0.8.8
 
 require (
 	github.com/blang/semver v3.5.1+incompatible
+	github.com/coreos/go-systemd/v22 v22.7.0
 	github.com/distatus/battery v0.11.0
+	github.com/ebitengine/purego v0.9.1
 	github.com/fxamacker/cbor/v2 v2.9.0
 	github.com/gliderlabs/ssh v0.3.8
 	github.com/google/uuid v1.6.0
 	github.com/lxzan/gws v1.8.9
-	github.com/nicholas-fedor/shoutrrr v0.8.17
+	github.com/nicholas-fedor/shoutrrr v0.13.2
-	github.com/pocketbase/dbx v1.11.0
+	github.com/pocketbase/dbx v1.12.0
-	github.com/pocketbase/pocketbase v0.29.3
+	github.com/pocketbase/pocketbase v0.36.4
-	github.com/shirou/gopsutil/v4 v4.25.6
+	github.com/shirou/gopsutil/v4 v4.26.1
-	github.com/spf13/cast v1.9.2
+	github.com/spf13/cast v1.10.0
-	github.com/spf13/cobra v1.9.1
+	github.com/spf13/cobra v1.10.2
-	github.com/spf13/pflag v1.0.7
+	github.com/spf13/pflag v1.0.10
-	github.com/stretchr/testify v1.11.0
+	github.com/stretchr/testify v1.11.1
-	golang.org/x/crypto v0.41.0
+	golang.org/x/crypto v0.48.0
-	golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b
+	golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa
+	golang.org/x/sys v0.41.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -33,37 +33,36 @@ require (
 	github.com/dolthub/maphash v0.1.0 // indirect
 	github.com/domodwyer/mailyak/v3 v3.6.2 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/ebitengine/purego v0.8.4 // indirect
 	github.com/fatih/color v1.18.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.9 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
 	github.com/ganigeorgiev/fexpr v0.5.0 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
 	github.com/go-ozzo/ozzo-validation/v4 v4.3.0 // indirect
 	github.com/go-sql-driver/mysql v1.9.1 // indirect
-	github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
+	github.com/godbus/dbus/v5 v5.2.2 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/klauspost/compress v1.18.4 // indirect
-	github.com/lufia/plan9stats v0.0.0-20250821153705-5981dea3221d // indirect
+	github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/ncruces/go-strftime v0.1.9 // indirect
+	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/tklauser/go-sysconf v0.3.15 // indirect
+	github.com/tklauser/go-sysconf v0.3.16 // indirect
-	github.com/tklauser/numcpus v0.10.0 // indirect
+	github.com/tklauser/numcpus v0.11.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	golang.org/x/image v0.30.0 // indirect
+	golang.org/x/image v0.36.0 // indirect
-	golang.org/x/net v0.43.0 // indirect
+	golang.org/x/net v0.50.0 // indirect
-	golang.org/x/oauth2 v0.30.0 // indirect
+	golang.org/x/oauth2 v0.35.0 // indirect
-	golang.org/x/sync v0.16.0 // indirect
+	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.35.0 // indirect
+	golang.org/x/term v0.40.0 // indirect
-	golang.org/x/text v0.28.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
-	gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 // indirect
 	howett.net/plist v1.0.1 // indirect
-	modernc.org/libc v1.66.3 // indirect
+	modernc.org/libc v1.67.6 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
-	modernc.org/sqlite v1.38.2 // indirect
+	modernc.org/sqlite v1.45.0 // indirect
 )

go.sum

@@ -1,5 +1,7 @@
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/asaskevich/govalidator v0.0.0-20200108200545-475eaeb16496/go.mod h1:oGkLhpf+kjZl6xBf758TQhh5XrAeiJv/7FRz/2spLIg=
@@ -7,6 +9,8 @@ github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3d
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
 github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
+github.com/coreos/go-systemd/v22 v22.7.0 h1:LAEzFkke61DFROc7zNLX/WA2i5J8gYqe0rSj9KI28KA=
+github.com/coreos/go-systemd/v22 v22.7.0/go.mod h1:xNUYtjHu2EDXbsxz1i41wouACIwT7Ybq9o0BQhMwD0w=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -21,22 +25,22 @@ github.com/domodwyer/mailyak/v3 v3.6.2 h1:x3tGMsyFhTCaxp6ycgR0FE/bu5QiNp+hetUuCO
 github.com/domodwyer/mailyak/v3 v3.6.2/go.mod h1:lOm/u9CyCVWHeaAmHIdF4RiKVxKUT/H5XX10lIKAL6c=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/ebitengine/purego v0.8.4 h1:CF7LEKg5FFOsASUj0+QwaXf8Ht6TlFxg09+S9wz0omw=
+github.com/ebitengine/purego v0.9.1 h1:a/k2f2HQU3Pi399RPW1MOaZyhKJL9w/xFpKAg4q1s0A=
-github.com/ebitengine/purego v0.8.4/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/ebitengine/purego v0.9.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
 github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
 github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/gabriel-vasile/mimetype v1.4.9 h1:5k+WDwEsD9eTLL8Tz3L0VnmVh9QxGjRmjBvAG7U/oYY=
+github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
-github.com/gabriel-vasile/mimetype v1.4.9/go.mod h1:WnSQhFKJuBlRyLiKohA/2DtIlPFAbguNaG7QCHcyGok=
+github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/ganigeorgiev/fexpr v0.5.0 h1:XA9JxtTE/Xm+g/JFI6RfZEHSiQlk+1glLvRK1Lpv/Tk=
 github.com/ganigeorgiev/fexpr v0.5.0/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
 github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
@@ -47,49 +51,53 @@ github.com/go-sql-driver/mysql v1.9.1 h1:FrjNGn/BsJQjVRuSa8CBrM5BWA9BWoXXat3KrtS
 github.com/go-sql-driver/mysql v1.9.1/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
-github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
+github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
-github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
+github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc=
-github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
+github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/jarcoal/httpmock v1.4.0 h1:BvhqnH0JAYbNudL2GMJKgOHe2CtKlzJ/5rWKyp+hc2k=
+github.com/jarcoal/httpmock v1.4.1 h1:0Ju+VCFuARfFlhVXFc2HxlcQkfB+Xq12/EotHko+x2A=
-github.com/jarcoal/httpmock v1.4.0/go.mod h1:ftW1xULwo+j0R0JJkJIIi7UKigZUXCLLanykgjwBXL0=
+github.com/jarcoal/httpmock v1.4.1/go.mod h1:ftW1xULwo+j0R0JJkJIIi7UKigZUXCLLanykgjwBXL0=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
+github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/lufia/plan9stats v0.0.0-20250821153705-5981dea3221d h1:vFzYZc8yji+9DmNRhpEbs8VBK4CgV/DPfGzeVJSSp/8=
+github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88 h1:PTw+yKnXcOFCR6+8hHTyWBeQ/P4Nb7dd4/0ohEcWQuM=
-github.com/lufia/plan9stats v0.0.0-20250821153705-5981dea3221d/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
+github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
 github.com/lxzan/gws v1.8.9 h1:VU3SGUeWlQrEwfUSfokcZep8mdg/BrUF+y73YYshdBM=
 github.com/lxzan/gws v1.8.9/go.mod h1:d9yHaR1eDTBHagQC6KY7ycUOaz5KWeqQtP3xu7aMK8Y=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
+github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
-github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/nicholas-fedor/shoutrrr v0.8.8 h1:F/oyoatWK5cbHPPgkjRZrA0262TP7KWuUQz9KskRtR8=
+github.com/nicholas-fedor/shoutrrr v0.13.2 h1:hfsYBIqSFYGg92pZP5CXk/g7/OJIkLYmiUnRl+AD1IA=
-github.com/nicholas-fedor/shoutrrr v0.8.8/go.mod h1:T30Y+eoZFEjDk4HtOItcHQioZSOe3Z6a6aNfSz6jc5c=
+github.com/nicholas-fedor/shoutrrr v0.13.2/go.mod h1:ZqzV3gY/Wj6AvWs1etlO7+yKbh4iptSbeL8avBpMQbA=
-github.com/onsi/ginkgo/v2 v2.23.4 h1:ktYTpKJAVZnDT4VjxSbiBenUjmlL/5QkBEocaWXiQus=
+github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
-github.com/onsi/ginkgo/v2 v2.23.4/go.mod h1:Bt66ApGPBFzHyR+JO10Zbt0Gsp4uWxu5mIOTusL46e8=
+github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
-github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y=
+github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
-github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0=
+github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pocketbase/dbx v1.11.0 h1:LpZezioMfT3K4tLrqA55wWFw1EtH1pM4tzSVa7kgszU=
+github.com/pocketbase/dbx v1.12.0 h1:/oLErM+A0b4xI0PWTGPqSDVjzix48PqI/bng2l0PzoA=
-github.com/pocketbase/dbx v1.11.0/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
+github.com/pocketbase/dbx v1.12.0/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
-github.com/pocketbase/pocketbase v0.29.3 h1:Mj8o5awsbVJIdIoTuQNhfC2oL/c4aImQ3RyfFZlzFVg=
+github.com/pocketbase/pocketbase v0.36.4 h1:zTjRZbp2WfTOJJfb+pFRWa200UaQwxZYt8RzkFMlAZ4=
-github.com/pocketbase/pocketbase v0.29.3/go.mod h1:oGpT67LObxCFK4V2fSL7J9YnPbBnnshOpJ5v3zcneww=
+github.com/pocketbase/pocketbase v0.36.4/go.mod h1:9CiezhRudd9FZGa5xZa53QZBTNxc5vvw/FGG+diAECI=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
@@ -97,86 +105,88 @@ github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qq
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/shirou/gopsutil/v4 v4.25.6 h1:kLysI2JsKorfaFPcYmcJqbzROzsBWEOAtw6A7dIfqXs=
+github.com/shirou/gopsutil/v4 v4.26.1 h1:TOkEyriIXk2HX9d4isZJtbjXbEjf5qyKPAzbzY0JWSo=
-github.com/shirou/gopsutil/v4 v4.25.6/go.mod h1:PfybzyydfZcN+JMMjkF6Zb8Mq1A/VcogFFg7hj50W9c=
+github.com/shirou/gopsutil/v4 v4.26.1/go.mod h1:medLI9/UNAb0dOI9Q3/7yWSqKkj00u+1tgY8nvv41pc=
-github.com/spf13/cast v1.9.2 h1:SsGfm7M8QOFtEzumm7UZrZdLLquNdzFYfIbEXntcFbE=
+github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
-github.com/spf13/cast v1.9.2/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
+github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.11.0 h1:ib4sjIrwZKxE5u/Japgo/7SJV3PvgjGiRNAvTVGqQl8=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.0/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/tklauser/go-sysconf v0.3.15 h1:VE89k0criAymJ/Os65CSn1IXaol+1wrsFHEB8Ol49K4=
+github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
-github.com/tklauser/go-sysconf v0.3.15/go.mod h1:Dmjwr6tYFIseJw7a3dRLJfsHAMXZ3nEnL/aZY+0IuI4=
+github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
-github.com/tklauser/numcpus v0.10.0 h1:18njr6LDBk1zuna922MgdjQuJFjrdppsZG60sHGfjso=
+github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=
-github.com/tklauser/numcpus v0.10.0/go.mod h1:BiTKazU708GQTYF4mB+cmlpT2Is1gLk7XVuEeem8LsQ=
+github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
-golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
-golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b h1:DXr+pvt3nC887026GRP39Ej11UATqWDmWuS99x26cD0=
+golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa h1:Zt3DZoOFFYkKhDT3v7Lm9FDMEV06GpzjG2jrqW+QTE0=
-golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b/go.mod h1:4QTo5u+SEIbbKW1RacMZq1YEfOBqeXa19JeshGi+zc4=
+golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa/go.mod h1:K79w1Vqn7PoiZn+TkNpx3BUWUQksGO3JcVX6qIjytmA=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.30.0 h1:jD5RhkmVAnjqaCUXfbGBrn3lpxbknfN9w2UhHHU+5B4=
+golang.org/x/image v0.36.0 h1:Iknbfm1afbgtwPTmHnS2gTM/6PPZfH+z2EFuOkSbqwc=
-golang.org/x/image v0.30.0/go.mod h1:SAEUTxCCMWSrJcCy/4HwavEsfZZJlYxeHLc6tTiAe/c=
+golang.org/x/image v0.36.0/go.mod h1:YsWD2TyyGKiIX1kZlu9QfKIsQ4nAAK9bdgdrIsE7xy4=
-golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
-golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
-golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
+golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
-golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
-golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
+golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
-golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
-golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
+golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
-golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
+golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
-golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
 howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
-modernc.org/cc/v4 v4.26.2 h1:991HMkLjJzYBIfha6ECZdjrIYz2/1ayr+FL8GN+CNzM=
+modernc.org/cc/v4 v4.27.1 h1:9W30zRlYrefrDV2JE2O8VDtJ1yPGownxciz5rrbQZis=
-modernc.org/cc/v4 v4.26.2/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/cc/v4 v4.27.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
-modernc.org/ccgo/v4 v4.28.0 h1:rjznn6WWehKq7dG4JtLRKxb52Ecv8OUGah8+Z/SfpNU=
+modernc.org/ccgo/v4 v4.30.1 h1:4r4U1J6Fhj98NKfSjnPUN7Ze2c6MnAdL0hWw6+LrJpc=
-modernc.org/ccgo/v4 v4.28.0/go.mod h1:JygV3+9AV6SmPhDasu4JgquwU81XAKLd3OKTUDNOiKE=
+modernc.org/ccgo/v4 v4.30.1/go.mod h1:bIOeI1JL54Utlxn+LwrFyjCx2n2RDiYEaJVSrgdrRfM=
-modernc.org/fileutil v1.3.8 h1:qtzNm7ED75pd1C7WgAGcK4edm4fvhtBsEiI/0NQ54YM=
+modernc.org/fileutil v1.3.40 h1:ZGMswMNc9JOCrcrakF1HrvmergNLAmxOPjizirpfqBA=
-modernc.org/fileutil v1.3.8/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
+modernc.org/fileutil v1.3.40/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/gc/v3 v3.1.1 h1:k8T3gkXWY9sEiytKhcgyiZ2L0DTyCQ/nvX+LoCljoRE=
+modernc.org/gc/v3 v3.1.1/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.66.3 h1:cfCbjTUcdsKyyZZfEUKfoHcP3S0Wkvz3jgSzByEWVCQ=
+modernc.org/libc v1.67.6 h1:eVOQvpModVLKOdT+LvBPjdQqfrZq+pC39BygcT+E7OI=
-modernc.org/libc v1.66.3/go.mod h1:XD9zO8kt59cANKvHPXpx7yS2ELPheAey0vjIuZOhOU8=
+modernc.org/libc v1.67.6/go.mod h1:JAhxUVlolfYDErnwiqaLvUqc8nfb2r6S6slAgZOnaiE=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
@@ -185,8 +195,8 @@ modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
 modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.38.2 h1:Aclu7+tgjgcQVShZqim41Bbw9Cho0y/7WzYptXqkEek=
+modernc.org/sqlite v1.45.0 h1:r51cSGzKpbptxnby+EIIz5fop4VuE4qFoVEjNvWoObs=
-modernc.org/sqlite v1.38.2/go.mod h1:cPTJYSlgg3Sfg046yBShXENNtPrWrDX8bsbAQBzgQ5E=
+modernc.org/sqlite v1.45.0/go.mod h1:CzbrU2lSB1DKUusvwGz7rqEKIq+NUd8GWuBBZDs9/nA=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

internal/alerts/alerts.go

@@ -28,6 +28,7 @@ type AlertManager struct {
 
 type AlertMessageData struct {
 	UserID   string
+	SystemID string
 	Title    string
 	Message  string
 	Link     string
@@ -45,8 +46,14 @@ type SystemAlertStats struct {
 	Disk         float64                       `json:"dp"`
 	NetSent      float64                       `json:"ns"`
 	NetRecv      float64                       `json:"nr"`
+	GPU          map[string]SystemAlertGPUData `json:"g"`
 	Temperatures map[string]float32            `json:"t"`
 	LoadAvg      [3]float64                    `json:"la"`
+	Battery      [2]uint8                      `json:"bat"`
+}
+
+type SystemAlertGPUData struct {
+	Usage float64 `json:"u"`
 }
 
 type SystemAlertData struct {
@@ -72,7 +79,6 @@ var supportsTitle = map[string]struct{}{
 	"ifttt":      {},
 	"join":       {},
 	"lark":       {},
-	"matrix":     {},
 	"ntfy":       {},
 	"opsgenie":   {},
 	"pushbullet": {},
@@ -99,10 +105,84 @@ func NewAlertManager(app hubLike) *AlertManager {
 func (am *AlertManager) bindEvents() {
 	am.hub.OnRecordAfterUpdateSuccess("alerts").BindFunc(updateHistoryOnAlertUpdate)
 	am.hub.OnRecordAfterDeleteSuccess("alerts").BindFunc(resolveHistoryOnAlertDelete)
+	am.hub.OnRecordAfterUpdateSuccess("smart_devices").BindFunc(am.handleSmartDeviceAlert)
+}
+
+// IsNotificationSilenced checks if a notification should be silenced based on configured quiet hours
+func (am *AlertManager) IsNotificationSilenced(userID, systemID string) bool {
+	// Query for quiet hours windows that match this user and system
+	// Include both global windows (system is null/empty) and system-specific windows
+	var filter string
+	var params dbx.Params
+
+	if systemID == "" {
+		// If no systemID provided, only check global windows
+		filter = "user={:user} AND system=''"
+		params = dbx.Params{"user": userID}
+	} else {
+		// Check both global and system-specific windows
+		filter = "user={:user} AND (system='' OR system={:system})"
+		params = dbx.Params{
+			"user":   userID,
+			"system": systemID,
+		}
+	}
+
+	quietHourWindows, err := am.hub.FindAllRecords("quiet_hours", dbx.NewExp(filter, params))
+	if err != nil || len(quietHourWindows) == 0 {
+		return false
+	}
+
+	now := time.Now().UTC()
+
+	for _, window := range quietHourWindows {
+		windowType := window.GetString("type")
+		start := window.GetDateTime("start").Time()
+		end := window.GetDateTime("end").Time()
+
+		if windowType == "daily" {
+			// For daily recurring windows, extract just the time portion and compare
+			// The start/end are stored as full datetime but we only care about HH:MM
+			startHour, startMin, _ := start.Clock()
+			endHour, endMin, _ := end.Clock()
+			nowHour, nowMin, _ := now.Clock()
+
+			// Convert to minutes since midnight for easier comparison
+			startMinutes := startHour*60 + startMin
+			endMinutes := endHour*60 + endMin
+			nowMinutes := nowHour*60 + nowMin
+
+			// Handle case where window crosses midnight
+			if endMinutes < startMinutes {
+				// Window crosses midnight (e.g., 23:00 - 01:00)
+				if nowMinutes >= startMinutes || nowMinutes < endMinutes {
+					return true
+				}
+			} else {
+				// Normal case (e.g., 09:00 - 17:00)
+				if nowMinutes >= startMinutes && nowMinutes < endMinutes {
+					return true
+				}
+			}
+		} else {
+			// One-time window: check if current time is within the date range
+			if (now.After(start) || now.Equal(start)) && now.Before(end) {
+				return true
+			}
+		}
+	}
+
+	return false
 }
 
 // SendAlert sends an alert to the user
 func (am *AlertManager) SendAlert(data AlertMessageData) error {
+	// Check if alert is silenced
+	if am.IsNotificationSilenced(data.UserID, data.SystemID) {
+		am.hub.Logger().Info("Notification silenced", "user", data.UserID, "system", data.SystemID, "title", data.Title)
+		return nil
+	}
+
 	// get user settings
 	record, err := am.hub.FindFirstRecordByFilter(
 		"user_settings", "user={:user}",

internal/alerts/alerts_battery_test.go

@@ -0,0 +1,386 @@
+//go:build testing
+
+package alerts_test
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+	beszelTests "github.com/henrygd/beszel/internal/tests"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestBatteryAlertLogic tests that battery alerts trigger when value drops BELOW threshold
+// (opposite of other alerts like CPU, Memory, etc. which trigger when exceeding threshold)
+func TestBatteryAlertLogic(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	// Create a system
+	systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
+	require.NoError(t, err)
+	systemRecord := systems[0]
+
+	// Create a battery alert with threshold of 20% and min of 1 minute (immediate trigger)
+	batteryAlert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
+		"name":   "Battery",
+		"system": systemRecord.Id,
+		"user":   user.Id,
+		"value":  20, // threshold: 20%
+		"min":    1,  // 1 minute (immediate trigger for testing)
+	})
+	require.NoError(t, err)
+
+	// Verify alert is not triggered initially
+	assert.False(t, batteryAlert.GetBool("triggered"), "Alert should not be triggered initially")
+
+	// Create system stats with battery at 50% (above threshold - should NOT trigger)
+	statsHigh := system.Stats{
+		Cpu:     10,
+		MemPct:  30,
+		DiskPct: 40,
+		Battery: [2]uint8{50, 1}, // 50% battery, discharging
+	}
+	statsHighJSON, _ := json.Marshal(statsHigh)
+	_, err = beszelTests.CreateRecord(hub, "system_stats", map[string]any{
+		"system": systemRecord.Id,
+		"type":   "1m",
+		"stats":  string(statsHighJSON),
+	})
+	require.NoError(t, err)
+
+	// Create CombinedData for the alert handler
+	combinedDataHigh := &system.CombinedData{
+		Stats: statsHigh,
+		Info: system.Info{
+			AgentVersion: "0.12.0",
+			Cpu:          10,
+			MemPct:       30,
+			DiskPct:      40,
+		},
+	}
+
+	// Simulate system update time
+	systemRecord.Set("updated", time.Now().UTC())
+	err = hub.SaveNoValidate(systemRecord)
+	require.NoError(t, err)
+
+	// Handle system alerts with high battery
+	am := hub.GetAlertManager()
+	err = am.HandleSystemAlerts(systemRecord, combinedDataHigh)
+	require.NoError(t, err)
+
+	// Verify alert is still NOT triggered (battery 50% is above threshold 20%)
+	batteryAlert, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": batteryAlert.Id})
+	require.NoError(t, err)
+	assert.False(t, batteryAlert.GetBool("triggered"), "Alert should NOT be triggered when battery (50%%) is above threshold (20%%)")
+
+	// Now create stats with battery at 15% (below threshold - should trigger)
+	statsLow := system.Stats{
+		Cpu:     10,
+		MemPct:  30,
+		DiskPct: 40,
+		Battery: [2]uint8{15, 1}, // 15% battery, discharging
+	}
+	statsLowJSON, _ := json.Marshal(statsLow)
+	_, err = beszelTests.CreateRecord(hub, "system_stats", map[string]any{
+		"system": systemRecord.Id,
+		"type":   "1m",
+		"stats":  string(statsLowJSON),
+	})
+	require.NoError(t, err)
+
+	combinedDataLow := &system.CombinedData{
+		Stats: statsLow,
+		Info: system.Info{
+			AgentVersion: "0.12.0",
+			Cpu:          10,
+			MemPct:       30,
+			DiskPct:      40,
+		},
+	}
+
+	// Update system timestamp
+	systemRecord.Set("updated", time.Now().UTC())
+	err = hub.SaveNoValidate(systemRecord)
+	require.NoError(t, err)
+
+	// Handle system alerts with low battery
+	err = am.HandleSystemAlerts(systemRecord, combinedDataLow)
+	require.NoError(t, err)
+
+	// Wait for the alert to be processed
+	time.Sleep(20 * time.Millisecond)
+
+	// Verify alert IS triggered (battery 15% is below threshold 20%)
+	batteryAlert, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": batteryAlert.Id})
+	require.NoError(t, err)
+	assert.True(t, batteryAlert.GetBool("triggered"), "Alert SHOULD be triggered when battery (15%%) drops below threshold (20%%)")
+
+	// Now test resolution: battery goes back above threshold
+	statsRecovered := system.Stats{
+		Cpu:     10,
+		MemPct:  30,
+		DiskPct: 40,
+		Battery: [2]uint8{25, 1}, // 25% battery, discharging
+	}
+	statsRecoveredJSON, _ := json.Marshal(statsRecovered)
+	_, err = beszelTests.CreateRecord(hub, "system_stats", map[string]any{
+		"system": systemRecord.Id,
+		"type":   "1m",
+		"stats":  string(statsRecoveredJSON),
+	})
+	require.NoError(t, err)
+
+	combinedDataRecovered := &system.CombinedData{
+		Stats: statsRecovered,
+		Info: system.Info{
+			AgentVersion: "0.12.0",
+			Cpu:          10,
+			MemPct:       30,
+			DiskPct:      40,
+		},
+	}
+
+	// Update system timestamp
+	systemRecord.Set("updated", time.Now().UTC())
+	err = hub.SaveNoValidate(systemRecord)
+	require.NoError(t, err)
+
+	// Handle system alerts with recovered battery
+	err = am.HandleSystemAlerts(systemRecord, combinedDataRecovered)
+	require.NoError(t, err)
+
+	// Wait for the alert to be processed
+	time.Sleep(20 * time.Millisecond)
+
+	// Verify alert is now resolved (battery 25% is above threshold 20%)
+	batteryAlert, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": batteryAlert.Id})
+	require.NoError(t, err)
+	assert.False(t, batteryAlert.GetBool("triggered"), "Alert should be resolved when battery (25%%) goes above threshold (20%%)")
+}
+
+// TestBatteryAlertNoBattery verifies that systems without battery data don't trigger alerts
+func TestBatteryAlertNoBattery(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	// Create a system
+	systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
+	require.NoError(t, err)
+	systemRecord := systems[0]
+
+	// Create a battery alert
+	batteryAlert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
+		"name":   "Battery",
+		"system": systemRecord.Id,
+		"user":   user.Id,
+		"value":  20,
+		"min":    1,
+	})
+	require.NoError(t, err)
+
+	// Create stats with NO battery data (Battery[0] = 0)
+	statsNoBattery := system.Stats{
+		Cpu:     10,
+		MemPct:  30,
+		DiskPct: 40,
+		Battery: [2]uint8{0, 0}, // No battery
+	}
+
+	combinedData := &system.CombinedData{
+		Stats: statsNoBattery,
+		Info: system.Info{
+			AgentVersion: "0.12.0",
+			Cpu:          10,
+			MemPct:       30,
+			DiskPct:      40,
+		},
+	}
+
+	// Simulate system update time
+	systemRecord.Set("updated", time.Now().UTC())
+	err = hub.SaveNoValidate(systemRecord)
+	require.NoError(t, err)
+
+	// Handle system alerts
+	am := hub.GetAlertManager()
+	err = am.HandleSystemAlerts(systemRecord, combinedData)
+	require.NoError(t, err)
+
+	// Wait a moment for processing
+	time.Sleep(20 * time.Millisecond)
+
+	// Verify alert is NOT triggered (no battery data should skip the alert)
+	batteryAlert, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": batteryAlert.Id})
+	require.NoError(t, err)
+	assert.False(t, batteryAlert.GetBool("triggered"), "Alert should NOT be triggered when system has no battery")
+}
+
+// TestBatteryAlertAveragedSamples tests battery alerts with min > 1 (averaging multiple samples)
+// This ensures the inverted threshold logic works correctly across averaged time windows
+func TestBatteryAlertAveragedSamples(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	// Create a system
+	systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
+	require.NoError(t, err)
+	systemRecord := systems[0]
+
+	// Create a battery alert with threshold of 25% and min of 2 minutes (requires averaging)
+	batteryAlert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
+		"name":   "Battery",
+		"system": systemRecord.Id,
+		"user":   user.Id,
+		"value":  25, // threshold: 25%
+		"min":    2,  // 2 minutes - requires averaging
+	})
+	require.NoError(t, err)
+
+	// Verify alert is not triggered initially
+	assert.False(t, batteryAlert.GetBool("triggered"), "Alert should not be triggered initially")
+
+	am := hub.GetAlertManager()
+	now := time.Now().UTC()
+
+	// Create system_stats records with low battery (below threshold)
+	// The alert has min=2 minutes, so alert.time = now - 2 minutes
+	// For the alert to be valid, alert.time must be AFTER the oldest record's created time
+	// So we need records older than (now - 2 min), plus records within the window
+	// Records at: now-3min (oldest, before window), now-90s, now-60s, now-30s
+	recordTimes := []time.Duration{
+		-180 * time.Second, // 3 min ago - this makes the oldest record before alert.time
+		-90 * time.Second,
+		-60 * time.Second,
+		-30 * time.Second,
+	}
+
+	for _, offset := range recordTimes {
+		statsLow := system.Stats{
+			Cpu:     10,
+			MemPct:  30,
+			DiskPct: 40,
+			Battery: [2]uint8{15, 1}, // 15% battery (below 25% threshold)
+		}
+		statsLowJSON, _ := json.Marshal(statsLow)
+
+		recordTime := now.Add(offset)
+		record, err := beszelTests.CreateRecord(hub, "system_stats", map[string]any{
+			"system": systemRecord.Id,
+			"type":   "1m",
+			"stats":  string(statsLowJSON),
+		})
+		require.NoError(t, err)
+		// Update created time to simulate historical records - use SetRaw with formatted string
+		record.SetRaw("created", recordTime.Format(types.DefaultDateLayout))
+		err = hub.SaveNoValidate(record)
+		require.NoError(t, err)
+	}
+
+	// Create combined data with low battery
+	combinedDataLow := &system.CombinedData{
+		Stats: system.Stats{
+			Cpu:     10,
+			MemPct:  30,
+			DiskPct: 40,
+			Battery: [2]uint8{15, 1},
+		},
+		Info: system.Info{
+			AgentVersion: "0.12.0",
+			Cpu:          10,
+			MemPct:       30,
+			DiskPct:      40,
+		},
+	}
+
+	// Update system timestamp
+	systemRecord.Set("updated", now)
+	err = hub.SaveNoValidate(systemRecord)
+	require.NoError(t, err)
+
+	// Handle system alerts - should trigger because average battery is below threshold
+	err = am.HandleSystemAlerts(systemRecord, combinedDataLow)
+	require.NoError(t, err)
+
+	// Wait for alert processing
+	time.Sleep(20 * time.Millisecond)
+
+	// Verify alert IS triggered (average battery 15% is below threshold 25%)
+	batteryAlert, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": batteryAlert.Id})
+	require.NoError(t, err)
+	assert.True(t, batteryAlert.GetBool("triggered"),
+		"Alert SHOULD be triggered when average battery (15%%) is below threshold (25%%) over min period")
+
+	// Now add records with high battery to test resolution
+	// Use a new time window 2 minutes later
+	newNow := now.Add(2 * time.Minute)
+	// Records need to span before the alert time window (newNow - 2 min)
+	recordTimesHigh := []time.Duration{
+		-180 * time.Second, // 3 min before newNow - makes oldest record before alert.time
+		-90 * time.Second,
+		-60 * time.Second,
+		-30 * time.Second,
+	}
+
+	for _, offset := range recordTimesHigh {
+		statsHigh := system.Stats{
+			Cpu:     10,
+			MemPct:  30,
+			DiskPct: 40,
+			Battery: [2]uint8{50, 1}, // 50% battery (above 25% threshold)
+		}
+		statsHighJSON, _ := json.Marshal(statsHigh)
+
+		recordTime := newNow.Add(offset)
+		record, err := beszelTests.CreateRecord(hub, "system_stats", map[string]any{
+			"system": systemRecord.Id,
+			"type":   "1m",
+			"stats":  string(statsHighJSON),
+		})
+		require.NoError(t, err)
+		record.SetRaw("created", recordTime.Format(types.DefaultDateLayout))
+		err = hub.SaveNoValidate(record)
+		require.NoError(t, err)
+	}
+
+	// Create combined data with high battery
+	combinedDataHigh := &system.CombinedData{
+		Stats: system.Stats{
+			Cpu:     10,
+			MemPct:  30,
+			DiskPct: 40,
+			Battery: [2]uint8{50, 1},
+		},
+		Info: system.Info{
+			AgentVersion: "0.12.0",
+			Cpu:          10,
+			MemPct:       30,
+			DiskPct:      40,
+		},
+	}
+
+	// Update system timestamp to the new time window
+	systemRecord.Set("updated", newNow)
+	err = hub.SaveNoValidate(systemRecord)
+	require.NoError(t, err)
+
+	// Handle system alerts - should resolve because average battery is now above threshold
+	err = am.HandleSystemAlerts(systemRecord, combinedDataHigh)
+	require.NoError(t, err)
+
+	// Wait for alert processing
+	time.Sleep(20 * time.Millisecond)
+
+	// Verify alert is resolved (average battery 50% is above threshold 25%)
+	batteryAlert, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": batteryAlert.Id})
+	require.NoError(t, err)
+	assert.False(t, batteryAlert.GetBool("triggered"),
+		"Alert should be resolved when average battery (50%%) is above threshold (25%%) over min period")
+}

internal/alerts/alerts_quiet_hours_test.go

@@ -0,0 +1,425 @@
+//go:build testing
+
+package alerts_test
+
+import (
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/henrygd/beszel/internal/alerts"
+	beszelTests "github.com/henrygd/beszel/internal/tests"
+
+	"github.com/pocketbase/dbx"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAlertSilencedOneTime(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	// Create a system
+	systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
+	assert.NoError(t, err)
+	system := systems[0]
+
+	// Create an alert
+	alert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
+		"name":   "CPU",
+		"system": system.Id,
+		"user":   user.Id,
+		"value":  80,
+		"min":    1,
+	})
+	assert.NoError(t, err)
+
+	// Create a one-time quiet hours window (current time - 1 hour to current time + 1 hour)
+	now := time.Now().UTC()
+	startTime := now.Add(-1 * time.Hour)
+	endTime := now.Add(1 * time.Hour)
+
+	_, err = beszelTests.CreateRecord(hub, "quiet_hours", map[string]any{
+		"user":   user.Id,
+		"system": system.Id,
+		"type":   "one-time",
+		"start":  startTime,
+		"end":    endTime,
+	})
+	assert.NoError(t, err)
+
+	// Get alert manager
+	am := alerts.NewAlertManager(hub)
+	defer am.StopWorker()
+
+	// Test that alert is silenced
+	silenced := am.IsNotificationSilenced(user.Id, system.Id)
+	assert.True(t, silenced, "Alert should be silenced during active one-time window")
+
+	// Create a window that has already ended
+	pastStart := now.Add(-3 * time.Hour)
+	pastEnd := now.Add(-2 * time.Hour)
+
+	_, err = beszelTests.CreateRecord(hub, "quiet_hours", map[string]any{
+		"user":   user.Id,
+		"system": system.Id,
+		"type":   "one-time",
+		"start":  pastStart,
+		"end":    pastEnd,
+	})
+	assert.NoError(t, err)
+
+	// Should still be silenced because of the first window
+	silenced = am.IsNotificationSilenced(user.Id, system.Id)
+	assert.True(t, silenced, "Alert should still be silenced (past window doesn't affect active window)")
+
+	// Clear all windows and create a future window
+	_, err = hub.DB().NewQuery("DELETE FROM quiet_hours").Execute()
+	assert.NoError(t, err)
+
+	futureStart := now.Add(2 * time.Hour)
+	futureEnd := now.Add(3 * time.Hour)
+
+	_, err = beszelTests.CreateRecord(hub, "quiet_hours", map[string]any{
+		"user":   user.Id,
+		"system": system.Id,
+		"type":   "one-time",
+		"start":  futureStart,
+		"end":    futureEnd,
+	})
+	assert.NoError(t, err)
+
+	// Alert should NOT be silenced (window hasn't started yet)
+	silenced = am.IsNotificationSilenced(user.Id, system.Id)
+	assert.False(t, silenced, "Alert should not be silenced (window hasn't started)")
+
+	_ = alert
+}
+
+func TestAlertSilencedDaily(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	// Create a system
+	systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
+	assert.NoError(t, err)
+	system := systems[0]
+
+	// Get alert manager
+	am := alerts.NewAlertManager(hub)
+	defer am.StopWorker()
+
+	// Get current hour and create a window that includes current time
+	now := time.Now().UTC()
+	currentHour := now.Hour()
+	currentMin := now.Minute()
+
+	// Create a window from 1 hour ago to 1 hour from now
+	startHour := (currentHour - 1 + 24) % 24
+	endHour := (currentHour + 1) % 24
+
+	// Create times with just the hours/minutes we want (date doesn't matter for daily)
+	startTime := time.Date(2000, 1, 1, startHour, currentMin, 0, 0, time.UTC)
+	endTime := time.Date(2000, 1, 1, endHour, currentMin, 0, 0, time.UTC)
+
+	_, err = beszelTests.CreateRecord(hub, "quiet_hours", map[string]any{
+		"user":   user.Id,
+		"system": system.Id,
+		"type":   "daily",
+		"start":  startTime,
+		"end":    endTime,
+	})
+	assert.NoError(t, err)
+
+	// Alert should be silenced (current time is within the daily window)
+	silenced := am.IsNotificationSilenced(user.Id, system.Id)
+	assert.True(t, silenced, "Alert should be silenced during active daily window")
+
+	// Clear windows and create one that doesn't include current time
+	_, err = hub.DB().NewQuery("DELETE FROM quiet_hours").Execute()
+	assert.NoError(t, err)
+
+	// Create a window from 6-12 hours from now
+	futureStartHour := (currentHour + 6) % 24
+	futureEndHour := (currentHour + 12) % 24
+
+	startTime = time.Date(2000, 1, 1, futureStartHour, 0, 0, 0, time.UTC)
+	endTime = time.Date(2000, 1, 1, futureEndHour, 0, 0, 0, time.UTC)
+
+	_, err = beszelTests.CreateRecord(hub, "quiet_hours", map[string]any{
+		"user":   user.Id,
+		"system": system.Id,
+		"type":   "daily",
+		"start":  startTime,
+		"end":    endTime,
+	})
+	assert.NoError(t, err)
+
+	// Alert should NOT be silenced
+	silenced = am.IsNotificationSilenced(user.Id, system.Id)
+	assert.False(t, silenced, "Alert should not be silenced (outside daily window)")
+}
+
+func TestAlertSilencedDailyMidnightCrossing(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	// Create a system
+	systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
+	assert.NoError(t, err)
+	system := systems[0]
+
+	// Get alert manager
+	am := alerts.NewAlertManager(hub)
+	defer am.StopWorker()
+
+	// Create a window that crosses midnight: 22:00 - 02:00
+	startTime := time.Date(2000, 1, 1, 22, 0, 0, 0, time.UTC)
+	endTime := time.Date(2000, 1, 1, 2, 0, 0, 0, time.UTC)
+
+	_, err = beszelTests.CreateRecord(hub, "quiet_hours", map[string]any{
+		"user":   user.Id,
+		"system": system.Id,
+		"type":   "daily",
+		"start":  startTime,
+		"end":    endTime,
+	})
+	assert.NoError(t, err)
+
+	// Test with a time at 23:00 (should be silenced)
+	// We can't control the actual current time, but we can verify the logic
+	// by checking if the window was created correctly
+	windows, err := hub.FindAllRecords("quiet_hours", dbx.HashExp{
+		"user":   user.Id,
+		"system": system.Id,
+	})
+	assert.NoError(t, err)
+	assert.Len(t, windows, 1, "Should have created 1 window")
+
+	window := windows[0]
+	assert.Equal(t, "daily", window.GetString("type"))
+	assert.Equal(t, 22, window.GetDateTime("start").Time().Hour())
+	assert.Equal(t, 2, window.GetDateTime("end").Time().Hour())
+}
+
+func TestAlertSilencedGlobal(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	// Create multiple systems
+	systems, err := beszelTests.CreateSystems(hub, 3, user.Id, "up")
+	assert.NoError(t, err)
+
+	// Get alert manager
+	am := alerts.NewAlertManager(hub)
+	defer am.StopWorker()
+
+	// Create a global quiet hours window (no system specified)
+	now := time.Now().UTC()
+	startTime := now.Add(-1 * time.Hour)
+	endTime := now.Add(1 * time.Hour)
+
+	_, err = beszelTests.CreateRecord(hub, "quiet_hours", map[string]any{
+		"user":  user.Id,
+		"type":  "one-time",
+		"start": startTime,
+		"end":   endTime,
+		// system field is empty/null for global windows
+	})
+	assert.NoError(t, err)
+
+	// All systems should be silenced
+	for _, system := range systems {
+		silenced := am.IsNotificationSilenced(user.Id, system.Id)
+		assert.True(t, silenced, "Alert should be silenced for system %s (global window)", system.Id)
+	}
+
+	// Even with a systemID that doesn't exist, should be silenced
+	silenced := am.IsNotificationSilenced(user.Id, "nonexistent-system")
+	assert.True(t, silenced, "Alert should be silenced for any system (global window)")
+}
+
+func TestAlertSilencedSystemSpecific(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	// Create multiple systems
+	systems, err := beszelTests.CreateSystems(hub, 2, user.Id, "up")
+	assert.NoError(t, err)
+	system1 := systems[0]
+	system2 := systems[1]
+
+	// Get alert manager
+	am := alerts.NewAlertManager(hub)
+	defer am.StopWorker()
+
+	// Create a system-specific quiet hours window for system1 only
+	now := time.Now().UTC()
+	startTime := now.Add(-1 * time.Hour)
+	endTime := now.Add(1 * time.Hour)
+
+	_, err = beszelTests.CreateRecord(hub, "quiet_hours", map[string]any{
+		"user":   user.Id,
+		"system": system1.Id,
+		"type":   "one-time",
+		"start":  startTime,
+		"end":    endTime,
+	})
+	assert.NoError(t, err)
+
+	// System1 should be silenced
+	silenced := am.IsNotificationSilenced(user.Id, system1.Id)
+	assert.True(t, silenced, "Alert should be silenced for system1")
+
+	// System2 should NOT be silenced
+	silenced = am.IsNotificationSilenced(user.Id, system2.Id)
+	assert.False(t, silenced, "Alert should not be silenced for system2")
+}
+
+func TestAlertSilencedMultiUser(t *testing.T) {
+	hub, _ := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	// Create two users
+	user1, err := beszelTests.CreateUser(hub, "user1@example.com", "password")
+	assert.NoError(t, err)
+
+	user2, err := beszelTests.CreateUser(hub, "user2@example.com", "password")
+	assert.NoError(t, err)
+
+	// Create a system accessible to both users
+	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "shared-system",
+		"users": []string{user1.Id, user2.Id},
+		"host":  "127.0.0.1",
+	})
+	assert.NoError(t, err)
+
+	// Get alert manager
+	am := alerts.NewAlertManager(hub)
+	defer am.StopWorker()
+
+	// Create a quiet hours window for user1 only
+	now := time.Now().UTC()
+	startTime := now.Add(-1 * time.Hour)
+	endTime := now.Add(1 * time.Hour)
+
+	_, err = beszelTests.CreateRecord(hub, "quiet_hours", map[string]any{
+		"user":   user1.Id,
+		"system": system.Id,
+		"type":   "one-time",
+		"start":  startTime,
+		"end":    endTime,
+	})
+	assert.NoError(t, err)
+
+	// User1 should be silenced
+	silenced := am.IsNotificationSilenced(user1.Id, system.Id)
+	assert.True(t, silenced, "Alert should be silenced for user1")
+
+	// User2 should NOT be silenced
+	silenced = am.IsNotificationSilenced(user2.Id, system.Id)
+	assert.False(t, silenced, "Alert should not be silenced for user2")
+}
+
+func TestAlertSilencedWithActualAlert(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		hub, user := beszelTests.GetHubWithUser(t)
+		defer hub.Cleanup()
+
+		// Create a system
+		systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
+		assert.NoError(t, err)
+		system := systems[0]
+
+		// Create a status alert
+		_, err = beszelTests.CreateRecord(hub, "alerts", map[string]any{
+			"name":   "Status",
+			"system": system.Id,
+			"user":   user.Id,
+			"min":    1,
+		})
+		assert.NoError(t, err)
+
+		// Create user settings with email
+		userSettings, err := hub.FindFirstRecordByFilter("user_settings", "user={:user}", dbx.Params{"user": user.Id})
+		if err != nil || userSettings == nil {
+			userSettings, err = beszelTests.CreateRecord(hub, "user_settings", map[string]any{
+				"user": user.Id,
+				"settings": map[string]any{
+					"emails": []string{"test@example.com"},
+				},
+			})
+			assert.NoError(t, err)
+		}
+
+		// Create a quiet hours window
+		now := time.Now().UTC()
+		startTime := now.Add(-1 * time.Hour)
+		endTime := now.Add(1 * time.Hour)
+
+		_, err = beszelTests.CreateRecord(hub, "quiet_hours", map[string]any{
+			"user":   user.Id,
+			"system": system.Id,
+			"type":   "one-time",
+			"start":  startTime,
+			"end":    endTime,
+		})
+		assert.NoError(t, err)
+
+		// Get initial email count
+		initialEmailCount := hub.TestMailer.TotalSend()
+
+		// Trigger an alert by setting system to down
+		system.Set("status", "down")
+		err = hub.SaveNoValidate(system)
+		assert.NoError(t, err)
+
+		// Wait for the alert to be processed (1 minute + buffer)
+		time.Sleep(time.Second * 75)
+		synctest.Wait()
+
+		// Check that no email was sent (because alert is silenced)
+		finalEmailCount := hub.TestMailer.TotalSend()
+		assert.Equal(t, initialEmailCount, finalEmailCount, "No emails should be sent when alert is silenced")
+
+		// Clear quiet hours windows
+		_, err = hub.DB().NewQuery("DELETE FROM quiet_hours").Execute()
+		assert.NoError(t, err)
+
+		// Reset system to up, then down again
+		system.Set("status", "up")
+		err = hub.SaveNoValidate(system)
+		assert.NoError(t, err)
+		time.Sleep(100 * time.Millisecond)
+
+		system.Set("status", "down")
+		err = hub.SaveNoValidate(system)
+		assert.NoError(t, err)
+
+		// Wait for the alert to be processed
+		time.Sleep(time.Second * 75)
+		synctest.Wait()
+
+		// Now an email should be sent
+		newEmailCount := hub.TestMailer.TotalSend()
+		assert.Greater(t, newEmailCount, finalEmailCount, "Email should be sent when not silenced")
+	})
+}
+
+func TestAlertSilencedNoWindows(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	// Create a system
+	systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
+	assert.NoError(t, err)
+	system := systems[0]
+
+	// Get alert manager
+	am := alerts.NewAlertManager(hub)
+	defer am.StopWorker()
+
+	// Without any quiet hours windows, alert should NOT be silenced
+	silenced := am.IsNotificationSilenced(user.Id, system.Id)
+	assert.False(t, silenced, "Alert should not be silenced when no windows exist")
+}

internal/alerts/alerts_smart.go

@@ -0,0 +1,107 @@
+package alerts
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/pocketbase/pocketbase/core"
+)
+
+// handleSmartDeviceAlert sends alerts when a SMART device state worsens into WARNING/FAILED.
+// This is automatic and does not require user opt-in.
+func (am *AlertManager) handleSmartDeviceAlert(e *core.RecordEvent) error {
+	oldState := e.Record.Original().GetString("state")
+	newState := e.Record.GetString("state")
+
+	if !shouldSendSmartDeviceAlert(oldState, newState) {
+		return e.Next()
+	}
+
+	systemID := e.Record.GetString("system")
+	if systemID == "" {
+		return e.Next()
+	}
+
+	// Fetch the system record to get the name and users
+	systemRecord, err := e.App.FindRecordById("systems", systemID)
+	if err != nil {
+		e.App.Logger().Error("Failed to find system for SMART alert", "err", err, "systemID", systemID)
+		return e.Next()
+	}
+
+	systemName := systemRecord.GetString("name")
+	deviceName := e.Record.GetString("name")
+	model := e.Record.GetString("model")
+	statusLabel := smartStateLabel(newState)
+
+	// Build alert message
+	title := fmt.Sprintf("SMART %s on %s: %s %s", statusLabel, systemName, deviceName, smartStateEmoji(newState))
+	var message string
+	if model != "" {
+		message = fmt.Sprintf("Disk %s (%s) SMART status changed to %s", deviceName, model, newState)
+	} else {
+		message = fmt.Sprintf("Disk %s SMART status changed to %s", deviceName, newState)
+	}
+
+	// Get users associated with the system
+	userIDs := systemRecord.GetStringSlice("users")
+	if len(userIDs) == 0 {
+		return e.Next()
+	}
+
+	// Send alert to each user
+	for _, userID := range userIDs {
+		if err := am.SendAlert(AlertMessageData{
+			UserID:   userID,
+			SystemID: systemID,
+			Title:    title,
+			Message:  message,
+			Link:     am.hub.MakeLink("system", systemID),
+			LinkText: "View " + systemName,
+		}); err != nil {
+			e.App.Logger().Error("Failed to send SMART alert", "err", err, "userID", userID)
+		}
+	}
+
+	return e.Next()
+}
+
+func shouldSendSmartDeviceAlert(oldState, newState string) bool {
+	oldSeverity := smartStateSeverity(oldState)
+	newSeverity := smartStateSeverity(newState)
+
+	// Ignore unknown states and recoveries; only alert on worsening transitions
+	// from known-good/degraded states into WARNING/FAILED.
+	return oldSeverity >= 1 && newSeverity > oldSeverity
+}
+
+func smartStateSeverity(state string) int {
+	switch state {
+	case "PASSED":
+		return 1
+	case "WARNING":
+		return 2
+	case "FAILED":
+		return 3
+	default:
+		return 0
+	}
+}
+
+func smartStateEmoji(state string) string {
+	switch state {
+	case "WARNING":
+		return "\U0001F7E0"
+	default:
+		return "\U0001F534"
+	}
+}
+
+func smartStateLabel(state string) string {
+	switch state {
+	case "FAILED":
+		return "failure"
+	default:
+		return strings.ToLower(state)
+	}
+}

internal/alerts/alerts_smart_test.go

@@ -0,0 +1,264 @@
+//go:build testing
+
+package alerts_test
+
+import (
+	"testing"
+	"time"
+
+	beszelTests "github.com/henrygd/beszel/internal/tests"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSmartDeviceAlert(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	// Create a system for the user
+	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "test-system",
+		"users": []string{user.Id},
+		"host":  "127.0.0.1",
+	})
+	assert.NoError(t, err)
+
+	// Create a smart_device with state PASSED
+	smartDevice, err := beszelTests.CreateRecord(hub, "smart_devices", map[string]any{
+		"system": system.Id,
+		"name":   "/dev/sda",
+		"model":  "Samsung SSD 970 EVO",
+		"state":  "PASSED",
+	})
+	assert.NoError(t, err)
+
+	// Verify no emails sent initially
+	assert.Zero(t, hub.TestMailer.TotalSend(), "should have 0 emails sent initially")
+
+	// Re-fetch the record so PocketBase can properly track original values
+	smartDevice, err = hub.FindRecordById("smart_devices", smartDevice.Id)
+	assert.NoError(t, err)
+
+	// Update the smart device state to FAILED
+	smartDevice.Set("state", "FAILED")
+	err = hub.Save(smartDevice)
+	assert.NoError(t, err)
+
+	// Wait for the alert to be processed
+	time.Sleep(50 * time.Millisecond)
+
+	// Verify that an email was sent
+	assert.EqualValues(t, 1, hub.TestMailer.TotalSend(), "should have 1 email sent after state changed to FAILED")
+
+	// Check the email content
+	lastMessage := hub.TestMailer.LastMessage()
+	assert.Contains(t, lastMessage.Subject, "SMART failure on test-system")
+	assert.Contains(t, lastMessage.Subject, "/dev/sda")
+	assert.Contains(t, lastMessage.Text, "Samsung SSD 970 EVO")
+	assert.Contains(t, lastMessage.Text, "FAILED")
+}
+
+func TestSmartDeviceAlertPassedToWarning(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "test-system",
+		"users": []string{user.Id},
+		"host":  "127.0.0.1",
+	})
+	assert.NoError(t, err)
+
+	smartDevice, err := beszelTests.CreateRecord(hub, "smart_devices", map[string]any{
+		"system": system.Id,
+		"name":   "/dev/mmcblk0",
+		"model":  "eMMC",
+		"state":  "PASSED",
+	})
+	assert.NoError(t, err)
+
+	smartDevice, err = hub.FindRecordById("smart_devices", smartDevice.Id)
+	assert.NoError(t, err)
+
+	smartDevice.Set("state", "WARNING")
+	err = hub.Save(smartDevice)
+	assert.NoError(t, err)
+
+	time.Sleep(50 * time.Millisecond)
+
+	assert.EqualValues(t, 1, hub.TestMailer.TotalSend(), "should have 1 email sent after state changed to WARNING")
+	lastMessage := hub.TestMailer.LastMessage()
+	assert.Contains(t, lastMessage.Subject, "SMART warning on test-system")
+	assert.Contains(t, lastMessage.Text, "WARNING")
+}
+
+func TestSmartDeviceAlertWarningToFailed(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "test-system",
+		"users": []string{user.Id},
+		"host":  "127.0.0.1",
+	})
+	assert.NoError(t, err)
+
+	smartDevice, err := beszelTests.CreateRecord(hub, "smart_devices", map[string]any{
+		"system": system.Id,
+		"name":   "/dev/mmcblk0",
+		"model":  "eMMC",
+		"state":  "WARNING",
+	})
+	assert.NoError(t, err)
+
+	smartDevice, err = hub.FindRecordById("smart_devices", smartDevice.Id)
+	assert.NoError(t, err)
+
+	smartDevice.Set("state", "FAILED")
+	err = hub.Save(smartDevice)
+	assert.NoError(t, err)
+
+	time.Sleep(50 * time.Millisecond)
+
+	assert.EqualValues(t, 1, hub.TestMailer.TotalSend(), "should have 1 email sent after state changed from WARNING to FAILED")
+	lastMessage := hub.TestMailer.LastMessage()
+	assert.Contains(t, lastMessage.Subject, "SMART failure on test-system")
+	assert.Contains(t, lastMessage.Text, "FAILED")
+}
+
+func TestSmartDeviceAlertNoAlertOnNonPassedToFailed(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	// Create a system for the user
+	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "test-system",
+		"users": []string{user.Id},
+		"host":  "127.0.0.1",
+	})
+	assert.NoError(t, err)
+
+	// Create a smart_device with state UNKNOWN
+	smartDevice, err := beszelTests.CreateRecord(hub, "smart_devices", map[string]any{
+		"system": system.Id,
+		"name":   "/dev/sda",
+		"model":  "Samsung SSD 970 EVO",
+		"state":  "UNKNOWN",
+	})
+	assert.NoError(t, err)
+
+	// Re-fetch the record so PocketBase can properly track original values
+	smartDevice, err = hub.FindRecordById("smart_devices", smartDevice.Id)
+	assert.NoError(t, err)
+
+	// Update the state from UNKNOWN to FAILED - should NOT trigger alert.
+	// We only alert from known healthy/degraded states.
+	smartDevice.Set("state", "FAILED")
+	err = hub.Save(smartDevice)
+	assert.NoError(t, err)
+
+	time.Sleep(50 * time.Millisecond)
+
+	// Verify no email was sent (only PASSED -> FAILED triggers alert)
+	assert.Zero(t, hub.TestMailer.TotalSend(), "should have 0 emails when changing from UNKNOWN to FAILED")
+
+	// Re-fetch the record again
+	smartDevice, err = hub.FindRecordById("smart_devices", smartDevice.Id)
+	assert.NoError(t, err)
+
+	// Update state from FAILED to PASSED - should NOT trigger alert
+	smartDevice.Set("state", "PASSED")
+	err = hub.Save(smartDevice)
+	assert.NoError(t, err)
+
+	time.Sleep(50 * time.Millisecond)
+
+	// Verify no email was sent
+	assert.Zero(t, hub.TestMailer.TotalSend(), "should have 0 emails when changing from FAILED to PASSED")
+}
+
+func TestSmartDeviceAlertMultipleUsers(t *testing.T) {
+	hub, user1 := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	// Create a second user
+	user2, err := beszelTests.CreateUser(hub, "test2@example.com", "password")
+	assert.NoError(t, err)
+
+	// Create user settings for the second user
+	_, err = beszelTests.CreateRecord(hub, "user_settings", map[string]any{
+		"user":     user2.Id,
+		"settings": `{"emails":["test2@example.com"],"webhooks":[]}`,
+	})
+	assert.NoError(t, err)
+
+	// Create a system with both users
+	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "shared-system",
+		"users": []string{user1.Id, user2.Id},
+		"host":  "127.0.0.1",
+	})
+	assert.NoError(t, err)
+
+	// Create a smart_device with state PASSED
+	smartDevice, err := beszelTests.CreateRecord(hub, "smart_devices", map[string]any{
+		"system": system.Id,
+		"name":   "/dev/nvme0n1",
+		"model":  "WD Black SN850",
+		"state":  "PASSED",
+	})
+	assert.NoError(t, err)
+
+	// Re-fetch the record so PocketBase can properly track original values
+	smartDevice, err = hub.FindRecordById("smart_devices", smartDevice.Id)
+	assert.NoError(t, err)
+
+	// Update the smart device state to FAILED
+	smartDevice.Set("state", "FAILED")
+	err = hub.Save(smartDevice)
+	assert.NoError(t, err)
+
+	time.Sleep(50 * time.Millisecond)
+
+	// Verify that two emails were sent (one for each user)
+	assert.EqualValues(t, 2, hub.TestMailer.TotalSend(), "should have 2 emails sent for 2 users")
+}
+
+func TestSmartDeviceAlertWithoutModel(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	// Create a system for the user
+	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "test-system",
+		"users": []string{user.Id},
+		"host":  "127.0.0.1",
+	})
+	assert.NoError(t, err)
+
+	// Create a smart_device with state PASSED but no model
+	smartDevice, err := beszelTests.CreateRecord(hub, "smart_devices", map[string]any{
+		"system": system.Id,
+		"name":   "/dev/sdb",
+		"state":  "PASSED",
+	})
+	assert.NoError(t, err)
+
+	// Re-fetch the record so PocketBase can properly track original values
+	smartDevice, err = hub.FindRecordById("smart_devices", smartDevice.Id)
+	assert.NoError(t, err)
+
+	// Update the smart device state to FAILED
+	smartDevice.Set("state", "FAILED")
+	err = hub.Save(smartDevice)
+	assert.NoError(t, err)
+
+	time.Sleep(50 * time.Millisecond)
+
+	// Verify that an email was sent
+	assert.EqualValues(t, 1, hub.TestMailer.TotalSend(), "should have 1 email sent")
+
+	// Check that the email doesn't have empty parentheses for missing model
+	lastMessage := hub.TestMailer.LastMessage()
+	assert.NotContains(t, lastMessage.Text, "()", "should not have empty parentheses for missing model")
+	assert.Contains(t, lastMessage.Text, "/dev/sdb")
+}

internal/alerts/alerts_status.go

@@ -161,19 +161,15 @@ func (am *AlertManager) sendStatusAlert(alertStatus string, systemName string, a
 	title := fmt.Sprintf("Connection to %s is %s %v", systemName, alertStatus, emoji)
 	message := strings.TrimSuffix(title, emoji)
 
-	// if errs := am.hub.ExpandRecord(alertRecord, []string{"user"}, nil); len(errs) > 0 {
+	// Get system ID for the link
-	// 	return errs["user"]
+	systemID := alertRecord.GetString("system")
-	// }
-	// user := alertRecord.ExpandedOne("user")
-	// if user == nil {
-	// 	return nil
-	// }
 
 	return am.SendAlert(AlertMessageData{
 		UserID:   alertRecord.GetString("user"),
+		SystemID: systemID,
 		Title:    title,
 		Message:  message,
-		Link:     am.hub.MakeLink("system", systemName),
+		Link:     am.hub.MakeLink("system", systemID),
 		LinkText: "View " + systemName,
 	})
 }

internal/alerts/alerts_system.go

@@ -64,18 +64,33 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 		case "LoadAvg15":
 			val = data.Info.LoadAvg[2]
 			unit = ""
+		case "GPU":
+			val = data.Info.GpuPct
+		case "Battery":
+			if data.Stats.Battery[0] == 0 {
+				continue
+			}
+			val = float64(data.Stats.Battery[0])
 		}
 
 		triggered := alertRecord.GetBool("triggered")
 		threshold := alertRecord.GetFloat("value")
 
+		// Battery alert has inverted logic: trigger when value is BELOW threshold
+		lowAlert := isLowAlert(name)
+
 		// CONTINUE
-		// IF alert is not triggered and curValue is less than threshold
+		// For normal alerts: IF not triggered and curValue <= threshold, OR triggered and curValue > threshold
-		// OR alert is triggered and curValue is greater than threshold
+		// For low alerts (Battery): IF not triggered and curValue >= threshold, OR triggered and curValue < threshold
-		if (!triggered && val <= threshold) || (triggered && val > threshold) {
+		if lowAlert {
-			// log.Printf("Skipping alert %s: val %f | threshold %f | triggered %v\n", name, val, threshold, triggered)
+			if (!triggered && val >= threshold) || (triggered && val < threshold) {
 				continue
 			}
+		} else {
+			if (!triggered && val <= threshold) || (triggered && val > threshold) {
+				continue
+			}
+		}
 
 		min := max(1, cast.ToUint8(alertRecord.Get("min")))
 
@@ -92,7 +107,11 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 
 		// send alert immediately if min is 1 - no need to sum up values.
 		if min == 1 {
+			if lowAlert {
+				alert.triggered = val < threshold
+			} else {
 				alert.triggered = val > threshold
+			}
 			go am.sendSystemAlert(alert)
 			continue
 		}
@@ -206,6 +225,19 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 				alert.val += stats.LoadAvg[1]
 			case "LoadAvg15":
 				alert.val += stats.LoadAvg[2]
+			case "GPU":
+				if len(stats.GPU) == 0 {
+					continue
+				}
+				maxUsage := 0.0
+				for _, gpu := range stats.GPU {
+					if gpu.Usage > maxUsage {
+						maxUsage = gpu.Usage
+					}
+				}
+				alert.val += maxUsage
+			case "Battery":
+				alert.val += float64(stats.Battery[0])
 			default:
 				continue
 			}
@@ -243,6 +275,17 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 		// log.Printf("%s: val %f | count %d | min-count %f | threshold %f\n", alert.name, alert.val, alert.count, minCount, alert.threshold)
 		// pass through alert if count is greater than or equal to minCount
 		if float32(alert.count) >= minCount {
+			// Battery alert has inverted logic: trigger when value is BELOW threshold
+			lowAlert := isLowAlert(alert.name)
+			if lowAlert {
+				if !alert.triggered && alert.val < alert.threshold {
+					alert.triggered = true
+					go am.sendSystemAlert(alert)
+				} else if alert.triggered && alert.val >= alert.threshold {
+					alert.triggered = false
+					go am.sendSystemAlert(alert)
+				}
+			} else {
 				if !alert.triggered && alert.val > alert.threshold {
 					alert.triggered = true
 					go am.sendSystemAlert(alert)
@@ -252,6 +295,7 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 				}
 			}
 		}
+	}
 	return nil
 }
 
@@ -268,18 +312,27 @@ func (am *AlertManager) sendSystemAlert(alert SystemAlertData) {
 		alert.name = after + "m Load"
 	}
 
-	// make title alert name lowercase if not CPU
+	// make title alert name lowercase if not CPU or GPU
 	titleAlertName := alert.name
-	if titleAlertName != "CPU" {
+	if titleAlertName != "CPU" && titleAlertName != "GPU" {
 		titleAlertName = strings.ToLower(titleAlertName)
 	}
 
 	var subject string
+	lowAlert := isLowAlert(alert.name)
 	if alert.triggered {
+		if lowAlert {
+			subject = fmt.Sprintf("%s %s below threshold", systemName, titleAlertName)
+		} else {
+			subject = fmt.Sprintf("%s %s above threshold", systemName, titleAlertName)
+		}
+	} else {
+		if lowAlert {
 			subject = fmt.Sprintf("%s %s above threshold", systemName, titleAlertName)
 		} else {
 			subject = fmt.Sprintf("%s %s below threshold", systemName, titleAlertName)
 		}
+	}
 	minutesLabel := "minute"
 	if alert.min > 1 {
 		minutesLabel += "s"
@@ -296,9 +349,14 @@ func (am *AlertManager) sendSystemAlert(alert SystemAlertData) {
 	}
 	am.SendAlert(AlertMessageData{
 		UserID:   alert.alertRecord.GetString("user"),
+		SystemID: alert.systemRecord.Id,
 		Title:    subject,
 		Message:  body,
-		Link:     am.hub.MakeLink("system", systemName),
+		Link:     am.hub.MakeLink("system", alert.systemRecord.Id),
 		LinkText: "View " + systemName,
 	})
 }
+
+func isLowAlert(name string) bool {
+	return name == "Battery"
+}

internal/alerts/alerts_test.go

@@ -1,5 +1,4 @@
 //go:build testing
-// +build testing
 
 package alerts_test
 

internal/alerts/alerts_test_helpers.go

@@ -1,5 +1,4 @@
 //go:build testing
-// +build testing
 
 package alerts
 

internal/cmd/agent/agent.go

@@ -17,9 +17,8 @@ import (
 type cmdOptions struct {
 	key    string // key is the public key(s) for SSH authentication.
 	listen string // listen is the address or port to listen on.
-	// TODO: add hubURL and token
+	hubURL string // hubURL is the URL of the Beszel hub.
-	// hubURL string // hubURL is the URL of the hub to use.
+	token  string // token is the token to use for authentication.
-	// token  string // token is the token to use for authentication.
 }
 
 // parse parses the command line flags and populates the config struct.
@@ -32,9 +31,6 @@ func (opts *cmdOptions) parse() bool {
 
 	// Subcommands that don't require any pflag parsing
 	switch subcommand {
-	case "-v", "version":
-		fmt.Println(beszel.AppName+"-agent", beszel.Version)
-		return true
 	case "health":
 		err := health.Check()
 		if err != nil {
@@ -42,18 +38,22 @@ func (opts *cmdOptions) parse() bool {
 		}
 		fmt.Print("ok")
 		return true
+	case "fingerprint":
+		handleFingerprint()
+		return true
 	}
 
 	// pflag.CommandLine.ParseErrorsWhitelist.UnknownFlags = true
 	pflag.StringVarP(&opts.key, "key", "k", "", "Public key(s) for SSH authentication")
 	pflag.StringVarP(&opts.listen, "listen", "l", "", "Address or port to listen on")
-	// pflag.StringVarP(&opts.hubURL, "hub-url", "u", "", "URL of the hub to use")
+	pflag.StringVarP(&opts.hubURL, "url", "u", "", "URL of the Beszel hub")
-	// pflag.StringVarP(&opts.token, "token", "t", "", "Token to use for authentication")
+	pflag.StringVarP(&opts.token, "token", "t", "", "Token to use for authentication")
 	chinaMirrors := pflag.BoolP("china-mirrors", "c", false, "Use mirror for update (gh.beszel.dev) instead of GitHub")
+	version := pflag.BoolP("version", "v", false, "Show version information")
 	help := pflag.BoolP("help", "h", false, "Show this help message")
 
 	// Convert old single-dash long flags to double-dash for backward compatibility
-	flagsToConvert := []string{"key", "listen"}
+	flagsToConvert := []string{"key", "listen", "url", "token"}
 	for i, arg := range os.Args {
 		for _, flag := range flagsToConvert {
 			singleDash := "-" + flag
@@ -74,8 +74,8 @@ func (opts *cmdOptions) parse() bool {
 		builder.WriteString(os.Args[0])
 		builder.WriteString(" [command] [flags]\n")
 		builder.WriteString("\nCommands:\n")
+		builder.WriteString("  fingerprint  View or reset the agent fingerprint\n")
 		builder.WriteString("  health       Check if the agent is running\n")
-		// builder.WriteString("  help      Display this help message\n")
 		builder.WriteString("  update       Update to the latest version\n")
 		builder.WriteString("\nFlags:\n")
 		fmt.Print(builder.String())
@@ -87,6 +87,9 @@ func (opts *cmdOptions) parse() bool {
 
 	// Must run after pflag.Parse()
 	switch {
+	case *version:
+		fmt.Println(beszel.AppName+"-agent", beszel.Version)
+		return true
 	case *help || subcommand == "help":
 		pflag.Usage()
 		return true
@@ -95,6 +98,13 @@ func (opts *cmdOptions) parse() bool {
 		return true
 	}
 
+	// Set environment variables from CLI flags (if provided)
+	if opts.hubURL != "" {
+		os.Setenv("HUB_URL", opts.hubURL)
+	}
+	if opts.token != "" {
+		os.Setenv("TOKEN", opts.token)
+	}
 	return false
 }
 
@@ -127,6 +137,38 @@ func (opts *cmdOptions) getAddress() string {
 	return agent.GetAddress(opts.listen)
 }
 
+// handleFingerprint handles the "fingerprint" command with subcommands "view" and "reset".
+func handleFingerprint() {
+	subCmd := ""
+	if len(os.Args) > 2 {
+		subCmd = os.Args[2]
+	}
+
+	switch subCmd {
+	case "", "view":
+		dataDir, _ := agent.GetDataDir()
+		fp := agent.GetFingerprint(dataDir, "", "")
+		fmt.Println(fp)
+	case "help", "-h", "--help":
+		fmt.Print(fingerprintUsage())
+	case "reset":
+		dataDir, err := agent.GetDataDir()
+		if err != nil {
+			log.Fatal(err)
+		}
+		if err := agent.DeleteFingerprint(dataDir); err != nil {
+			log.Fatal(err)
+		}
+		fmt.Println("Fingerprint reset. A new one will be generated on next start.")
+	default:
+		log.Fatalf("Unknown command: %q\n\n%s", subCmd, fingerprintUsage())
+	}
+}
+
+func fingerprintUsage() string {
+	return fmt.Sprintf("Usage: %s fingerprint [view|reset]\n\nCommands:\n  view   Print fingerprint (default)\n  reset  Reset saved fingerprint\n", os.Args[0])
+}
+
 func main() {
 	var opts cmdOptions
 	subcommandHandled := opts.parse()

internal/common/common-ws.go

@@ -1,22 +1,48 @@
 package common
 
-type WebSocketAction = uint8
+import (
+	"github.com/fxamacker/cbor/v2"
+	"github.com/henrygd/beszel/internal/entities/smart"
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/henrygd/beszel/internal/entities/systemd"
+)
 
-// Not implemented yet
+type WebSocketAction = uint8
-// type AgentError = uint8
 
 const (
 	// Request system data from agent
 	GetData WebSocketAction = iota
 	// Check the fingerprint of the agent
 	CheckFingerprint
+	// Request container logs from agent
+	GetContainerLogs
+	// Request container info from agent
+	GetContainerInfo
+	// Request SMART data from agent
+	GetSmartData
+	// Request detailed systemd service info from agent
+	GetSystemdInfo
+	// Add new actions here...
 )
 
 // HubRequest defines the structure for requests sent from hub to agent.
 type HubRequest[T any] struct {
 	Action WebSocketAction `cbor:"0,keyasint"`
 	Data   T               `cbor:"1,keyasint,omitempty,omitzero"`
-	// Error  AgentError      `cbor:"error,omitempty,omitzero"`
+	Id     *uint32         `cbor:"2,keyasint,omitempty"`
+}
+
+// AgentResponse defines the structure for responses sent from agent to hub.
+type AgentResponse struct {
+	Id          *uint32                    `cbor:"0,keyasint,omitempty"`
+	SystemData  *system.CombinedData       `cbor:"1,keyasint,omitempty,omitzero"` // Legacy (<= 0.17)
+	Fingerprint *FingerprintResponse       `cbor:"2,keyasint,omitempty,omitzero"` // Legacy (<= 0.17)
+	Error       string                     `cbor:"3,keyasint,omitempty,omitzero"`
+	String      *string                    `cbor:"4,keyasint,omitempty,omitzero"` // Legacy (<= 0.17)
+	SmartData   map[string]smart.SmartData `cbor:"5,keyasint,omitempty,omitzero"` // Legacy (<= 0.17)
+	ServiceInfo systemd.ServiceDetails     `cbor:"6,keyasint,omitempty,omitzero"` // Legacy (<= 0.17)
+	// Data is the generic response payload for new endpoints (0.18+)
+	Data cbor.RawMessage `cbor:"7,keyasint,omitempty,omitzero"`
 }
 
 type FingerprintRequest struct {
@@ -27,6 +53,24 @@ type FingerprintRequest struct {
 type FingerprintResponse struct {
 	Fingerprint string `cbor:"0,keyasint"`
 	// Optional system info for universal token system creation
-	Hostname string `cbor:"1,keyasint,omitempty,omitzero"`
+	Hostname string `cbor:"1,keyasint,omitzero"`
-	Port     string `cbor:"2,keyasint,omitempty,omitzero"`
+	Port     string `cbor:"2,keyasint,omitzero"`
+	Name     string `cbor:"3,keyasint,omitzero"`
+}
+
+type DataRequestOptions struct {
+	CacheTimeMs    uint16 `cbor:"0,keyasint"`
+	IncludeDetails bool   `cbor:"1,keyasint"`
+}
+
+type ContainerLogsRequest struct {
+	ContainerID string `cbor:"0,keyasint"`
+}
+
+type ContainerInfoRequest struct {
+	ContainerID string `cbor:"0,keyasint"`
+}
+
+type SystemdInfoRequest struct {
+	ServiceName string `cbor:"0,keyasint"`
 }

internal/dockerfile_agent

@@ -23,4 +23,10 @@ COPY --from=builder /agent /agent
 # this is so we don't need to create the /tmp directory in the scratch container
 COPY --from=builder /tmp /tmp
 
+# AMD GPU name lookup (used by agent on Linux when /usr/share/libdrm/amdgpu.ids is read)
+COPY --from=builder /app/agent/test-data/amdgpu.ids /usr/share/libdrm/amdgpu.ids
+
+# Ensure data persistence across container recreations
+VOLUME ["/var/lib/beszel-agent"]
+
 ENTRYPOINT ["/agent"]

internal/dockerfile_agent_alpine

@@ -0,0 +1,31 @@
+FROM --platform=$BUILDPLATFORM golang:alpine AS builder
+
+WORKDIR /app
+
+COPY ../go.mod ../go.sum ./
+RUN go mod download
+
+# Copy source files
+COPY . ./
+
+# Build
+ARG TARGETOS TARGETARCH
+RUN CGO_ENABLED=0 GOGC=75 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags "-w -s" -o /agent ./internal/cmd/agent
+
+RUN rm -rf /tmp/*
+
+# --------------------------
+# Final image: default scratch-based agent
+# --------------------------
+FROM alpine:3.23
+COPY --from=builder /agent /agent
+
+# AMD GPU name lookup (used by agent on Linux when /usr/share/libdrm/amdgpu.ids is read)
+COPY --from=builder /app/agent/test-data/amdgpu.ids /usr/share/libdrm/amdgpu.ids
+
+RUN apk add --no-cache smartmontools
+
+# Ensure data persistence across container recreations
+VOLUME ["/var/lib/beszel-agent"]
+
+ENTRYPOINT ["/agent"]

internal/dockerfile_agent_intel

@@ -0,0 +1,28 @@
+FROM --platform=$BUILDPLATFORM golang:alpine AS builder
+
+WORKDIR /app
+
+COPY ../go.mod ../go.sum ./
+RUN go mod download
+
+# Copy source files
+COPY . ./
+
+# Build
+ARG TARGETOS TARGETARCH
+RUN CGO_ENABLED=0 GOGC=75 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags "-w -s" -o /agent ./internal/cmd/agent
+
+# --------------------------
+# Final image
+# Note: must cap_add: [CAP_PERFMON] and mount /dev/dri/ as volume
+# --------------------------
+FROM alpine:3.23
+
+COPY --from=builder /agent /agent
+
+RUN apk add --no-cache -X https://dl-cdn.alpinelinux.org/alpine/edge/testing igt-gpu-tools smartmontools
+
+# Ensure data persistence across container recreations
+VOLUME ["/var/lib/beszel-agent"]
+
+ENTRYPOINT ["/agent"]

internal/dockerfile_agent_nvidia

@@ -1,8 +1,7 @@
-FROM --platform=$BUILDPLATFORM golang:alpine AS builder
+FROM --platform=$BUILDPLATFORM golang:bookworm AS builder
 
 WORKDIR /app
 
-
 COPY ../go.mod ../go.sum ./
 RUN go mod download
 
@@ -11,9 +10,26 @@ COPY . ./
 
 # Build
 ARG TARGETOS TARGETARCH
-RUN CGO_ENABLED=0 GOGC=75 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags "-w -s" -o /agent ./internal/cmd/agent
+RUN CGO_ENABLED=0 GOGC=75 GOOS=$TARGETOS GOARCH=$TARGETARCH go build -tags glibc -ldflags "-w -s" -o /agent ./internal/cmd/agent
 
-RUN rm -rf /tmp/*
+# --------------------------
+# Smartmontools builder stage
+# --------------------------
+FROM nvidia/cuda:12.2.2-base-ubuntu22.04 AS smartmontools-builder
+
+RUN apt-get update && apt-get install -y \
+  wget \
+  build-essential \
+  && wget https://downloads.sourceforge.net/project/smartmontools/smartmontools/7.5/smartmontools-7.5.tar.gz \
+  && tar zxvf smartmontools-7.5.tar.gz \
+  && cd smartmontools-7.5 \
+  && ./configure --prefix=/usr --sysconfdir=/etc \
+  && make \
+  && make install \
+  && rm -rf /smartmontools-7.5* \
+  && apt-get remove -y wget build-essential \
+  && apt-get autoremove -y \
+  && rm -rf /var/lib/apt/lists/*
 
 # --------------------------
 # Final image: GPU-enabled agent with nvidia-smi
@@ -21,7 +37,13 @@ RUN rm -rf /tmp/*
 FROM nvidia/cuda:12.2.2-base-ubuntu22.04
 COPY --from=builder /agent /agent
 
-# this is so we don't need to create the /tmp directory in the scratch container
+# AMD GPU name lookup (used by agent on hybrid laptops when /usr/share/libdrm/amdgpu.ids is read)
-COPY --from=builder /tmp /tmp
+COPY --from=builder /app/agent/test-data/amdgpu.ids /usr/share/libdrm/amdgpu.ids
+
+# Copy smartmontools binaries and config files
+COPY --from=smartmontools-builder /usr/sbin/smartctl /usr/sbin/smartctl
+
+# Ensure data persistence across container recreations
+VOLUME ["/var/lib/beszel-agent"]
 
 ENTRYPOINT ["/agent"]