updates

# Conflicts:
#	agent/connection_manager.go

.github/dependabot.yml

@@ -1,12 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: gomod
-    directory: /
-    schedule:
-      interval: weekly
-
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-

.github/workflows/docker-images.yml

@@ -41,7 +41,7 @@ jobs:
           # henrygd/beszel-agent-nvidia
           - image: henrygd/beszel-agent-nvidia
             dockerfile: ./internal/dockerfile_agent_nvidia
-            platforms: linux/amd64,linux/arm64
+            platforms: linux/amd64
             registry: docker.io
             username_secret: DOCKERHUB_USERNAME
             password_secret: DOCKERHUB_TOKEN
@@ -52,19 +52,6 @@ jobs:
               type=semver,pattern={{major}}
               type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
 
-          # henrygd/beszel-agent-nvidia:slim
-          - image: henrygd/beszel-agent-nvidia
-            dockerfile: ./internal/dockerfile_agent_nvidia_slim
-            platforms: linux/amd64,linux/arm64
-            registry: docker.io
-            username_secret: DOCKERHUB_USERNAME
-            password_secret: DOCKERHUB_TOKEN
-            tags: |
-              type=raw,value=slim
-              type=semver,pattern={{version}}-slim
-              type=semver,pattern={{major}}.{{minor}}-slim
-              type=semver,pattern={{major}}-slim
-
           # henrygd/beszel-agent-intel
           - image: henrygd/beszel-agent-intel
             dockerfile: ./internal/dockerfile_agent_intel
@@ -109,7 +96,7 @@ jobs:
           # ghcr.io/henrygd/beszel-agent-nvidia
           - image: ghcr.io/${{ github.repository }}/beszel-agent-nvidia
             dockerfile: ./internal/dockerfile_agent_nvidia
-            platforms: linux/amd64,linux/arm64
+            platforms: linux/amd64
             registry: ghcr.io
             username: ${{ github.actor }}
             password_secret: GITHUB_TOKEN
@@ -120,19 +107,6 @@ jobs:
               type=semver,pattern={{major}}
               type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
 
-          # ghcr.io/henrygd/beszel-agent-nvidia:slim
-          - image: ghcr.io/${{ github.repository }}/beszel-agent-nvidia
-            dockerfile: ./internal/dockerfile_agent_nvidia_slim
-            platforms: linux/amd64,linux/arm64
-            registry: ghcr.io
-            username: ${{ github.actor }}
-            password_secret: GITHUB_TOKEN
-            tags: |
-              type=raw,value=slim
-              type=semver,pattern={{version}}-slim
-              type=semver,pattern={{major}}.{{minor}}-slim
-              type=semver,pattern={{major}}-slim
-
           # ghcr.io/henrygd/beszel-agent-intel
           - image: ghcr.io/${{ github.repository }}/beszel-agent-intel
             dockerfile: ./internal/dockerfile_agent_intel
@@ -178,7 +152,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
 
       - name: Set up bun
         uses: oven-sh/setup-bun@v2
@@ -190,14 +164,14 @@ jobs:
         run: bun run --cwd ./internal/site build
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
       - name: Docker metadata
         id: metadata
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v5
         with:
           images: ${{ matrix.image }}
           tags: ${{ matrix.tags }}
@@ -207,7 +181,7 @@ jobs:
         env:
           password_secret_exists: ${{ secrets[matrix.password_secret] != '' && 'true' || 'false' }}
         if: github.event_name != 'pull_request' && env.password_secret_exists == 'true'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
         with:
           username: ${{ matrix.username || secrets[matrix.username_secret] }}
           password: ${{ secrets[matrix.password_secret] }}
@@ -216,13 +190,11 @@ jobs:
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
         with:
           context: ./
           file: ${{ matrix.dockerfile }}
-          platforms: ${{ matrix.platforms || 'linux/amd64,linux/arm64,linux/arm/v6,linux/arm/v7' }}
+          platforms: ${{ matrix.platforms || 'linux/amd64,linux/arm64,linux/arm/v7' }}
           push: ${{ github.ref_type == 'tag' && secrets[matrix.password_secret] != '' }}
-          provenance: mode=max
-          sbom: true
           tags: ${{ steps.metadata.outputs.tags }}
           labels: ${{ steps.metadata.outputs.labels }}

.github/workflows/inactivity-actions.yml

@@ -15,7 +15,7 @@ jobs:
     name: Lock Inactive Issues
     runs-on: ubuntu-24.04
     steps:
-      - uses: klaasnicolaas/action-inactivity-lock@v2.0.1
+      - uses: klaasnicolaas/action-inactivity-lock@v1.1.3
         id: lock
         with:
           days-inactive-issues: 14
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Close Stale Issues
-        uses: actions/stale@v11
+        uses: actions/stale@v10
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/release.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
@@ -27,12 +27,12 @@ jobs:
         run: bun run --cwd ./internal/site build
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v5
         with:
           go-version: "^1.22.1"
 
       - name: Set up .NET
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@v4
         with:
           dotnet-version: "9.0.x"
 
@@ -42,7 +42,7 @@ jobs:
         shell: bash
 
       - name: GoReleaser beszel
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@v6
         with:
           workdir: ./
           distribution: goreleaser

.github/workflows/vulncheck.yml

@@ -19,11 +19,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
-          go-version: stable
+          go-version: 1.26.x
           # cached: false
       - name: Get official govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest

.goreleaser.yml

@@ -22,9 +22,6 @@ builds:
       - amd64
       - arm64
       - arm
-    goarm:
-      - "6"
-      - "7"
     ignore:
       - goos: windows
         goarch: arm64
@@ -34,8 +31,6 @@ builds:
         goarch: arm64
       - goos: freebsd
         goarch: arm
-      - goos: darwin
-        goarch: arm
 
   - id: beszel-agent
     binary: beszel-agent
@@ -57,10 +52,6 @@ builds:
       - mipsle
       - mips
       - ppc64le
-    goarm:
-      - "5"
-      - "6"
-      - "7"
     gomips:
       - hardfloat
       - softfloat
@@ -80,8 +71,6 @@ builds:
         gomips: hardfloat
       - goos: windows
         goarch: arm
-      - goos: darwin
-        goarch: arm
       - goos: darwin
         goarch: riscv64
       - goos: windows

Makefile

@@ -52,7 +52,7 @@ lint:
 	golangci-lint run
 
 test:
-	go test -tags='testing no_ui' ./...
+	go test -tags=testing ./...
 
 tidy:
 	go mod tidy

agent/agent.go

@@ -48,6 +48,7 @@ type Agent struct {
 	keys                      []gossh.PublicKey                                     // SSH public keys
 	smartManager              *SmartManager                                         // Manages SMART data
 	systemdManager            *systemdManager                                       // Manages systemd services
+	probeManager              *ProbeManager                                         // Manages network probes
 }
 
 // NewAgent creates a new agent with the given data directory for persisting data.
@@ -121,6 +122,9 @@ func NewAgent(dataDir ...string) (agent *Agent, err error) {
 	// initialize handler registry
 	agent.handlerRegistry = NewHandlerRegistry()
 
+	// initialize probe manager
+	agent.probeManager = newProbeManager()
+
 	// initialize disk info
 	agent.initializeDiskInfo()
 
@@ -178,6 +182,11 @@ func (a *Agent) gatherStats(options common.DataRequestOptions) *system.CombinedD
 		}
 	}
 
+	if a.probeManager != nil {
+		data.Probes = a.probeManager.GetResults(cacheTimeMs)
+		slog.Debug("Probes", "data", data.Probes)
+	}
+
 	// skip updating systemd services if cache time is not the default 60sec interval
 	if a.systemdManager != nil && cacheTimeMs == defaultDataCacheTimeMs {
 		totalCount := uint16(a.systemdManager.getServiceStatsCount())

agent/battery/battery.go

@@ -1,13 +1,6 @@
-// Package battery provides battery information for the host and connected devices.
+// Package battery provides functions to check if the system has a battery and return the charge state and percentage.
 package battery
 
-import (
-	"errors"
-	"sort"
-	"strconv"
-	"strings"
-)
-
 const (
 	stateUnknown uint8 = iota
 	stateEmpty
@@ -16,55 +9,3 @@ const (
 	stateDischarging
 	stateIdle
 )
-
-// Battery is a readable battery reported by the operating system.
-type Battery struct {
-	Name                  string
-	Percent               uint8
-	State                 uint8
-	FullChargeCapacity    uint64
-	HasFullChargeCapacity bool
-	System                bool
-}
-
-var errNoBatteries = errors.New("no readable batteries")
-
-// normalizeBatteries supplies stable fallback names and disambiguates duplicates.
-func normalizeBatteries(batteries []Battery) []Battery {
-	nameCounts := make(map[string]int, len(batteries))
-	for i := range batteries {
-		name := strings.TrimSpace(batteries[i].Name)
-		if name == "" {
-			name = "Battery " + strconv.Itoa(i+1)
-		}
-		nameCounts[name]++
-		if nameCounts[name] > 1 {
-			name += " (" + strconv.Itoa(nameCounts[name]) + ")"
-		}
-		batteries[i].Name = name
-	}
-	return batteries
-}
-
-// Primary returns the representative battery. Reported full-charge capacity wins,
-// then system-scoped devices, then name for deterministic ties.
-func Primary(batteries []Battery) (Battery, bool) {
-	if len(batteries) == 0 {
-		return Battery{}, false
-	}
-	ordered := append([]Battery(nil), batteries...)
-	sort.SliceStable(ordered, func(i, j int) bool {
-		a, b := ordered[i], ordered[j]
-		if a.HasFullChargeCapacity != b.HasFullChargeCapacity {
-			return a.HasFullChargeCapacity
-		}
-		if a.HasFullChargeCapacity && a.FullChargeCapacity != b.FullChargeCapacity {
-			return a.FullChargeCapacity > b.FullChargeCapacity
-		}
-		if a.System != b.System {
-			return a.System
-		}
-		return a.Name < b.Name
-	})
-	return ordered[0], true
-}

agent/battery/battery_darwin.go

@@ -3,7 +3,11 @@
 package battery
 
 import (
+	"errors"
+	"log/slog"
+	"math"
 	"os/exec"
+	"sync"
 
 	"howett.net/plist"
 )
@@ -31,46 +35,62 @@ func readMacBatteries() ([]macBattery, error) {
 	return batteries, nil
 }
 
-func HasReadableBattery() bool {
-	batteries, _ := GetBatteryStats()
-	return len(batteries) > 0
-}
-
-// GetBatteryStats returns every readable battery reported by macOS.
-func GetBatteryStats() ([]Battery, error) {
+// HasReadableBattery checks if the system has a battery and returns true if it does.
+var HasReadableBattery = sync.OnceValue(func() bool {
+	systemHasBattery := false
 	batteries, err := readMacBatteries()
-	if err != nil {
-		return nil, err
-	}
-	if len(batteries) == 0 {
-		return nil, errNoBatteries
-	}
-	result := make([]Battery, 0, len(batteries))
+	slog.Debug("Batteries", "batteries", batteries, "err", err)
 	for _, bat := range batteries {
-		if bat.MaxCapacity <= 0 {
+		if bat.MaxCapacity > 0 {
+			systemHasBattery = true
+			break
+		}
+	}
+	return systemHasBattery
+})
+
+// GetBatteryStats returns the current battery percent and charge state.
+// Uses CurrentCapacity/MaxCapacity to match the value macOS displays.
+func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
+	if !HasReadableBattery() {
+		return batteryPercent, batteryState, errors.ErrUnsupported
+	}
+	batteries, err := readMacBatteries()
+	if len(batteries) == 0 {
+		return batteryPercent, batteryState, errors.New("no batteries")
+	}
+
+	totalCapacity := 0
+	totalCharge := 0
+	batteryState = math.MaxUint8
+
+	for _, bat := range batteries {
+		if bat.MaxCapacity == 0 {
 			// skip ghost batteries with 0 capacity
 			// https://github.com/distatus/battery/issues/34
 			continue
 		}
-		percent := min(max(float64(bat.CurrentCapacity)/float64(bat.MaxCapacity)*100, 0), 100)
-		state := stateUnknown
+		totalCapacity += bat.MaxCapacity
+		totalCharge += min(bat.CurrentCapacity, bat.MaxCapacity)
+
 		switch {
 		case !bat.ExternalConnected:
-			state = stateDischarging
+			batteryState = stateDischarging
 		case bat.IsCharging:
-			state = stateCharging
+			batteryState = stateCharging
 		case bat.CurrentCapacity == 0:
-			state = stateEmpty
+			batteryState = stateEmpty
 		case !bat.FullyCharged:
-			state = stateIdle
+			batteryState = stateIdle
 		default:
-			state = stateFull
+			batteryState = stateFull
 		}
-		result = append(result, Battery{Name: "Primary", Percent: uint8(percent), State: state,
-			FullChargeCapacity: uint64(bat.MaxCapacity), HasFullChargeCapacity: true, System: true})
 	}
-	if len(result) == 0 {
-		return nil, errNoBatteries
+
+	if totalCapacity == 0 || batteryState == math.MaxUint8 {
+		return batteryPercent, batteryState, errors.New("no battery capacity")
 	}
-	return normalizeBatteries(result), nil
+
+	batteryPercent = uint8(float64(totalCharge) / float64(totalCapacity) * 100)
+	return batteryPercent, batteryState, nil
 }

agent/battery/battery_linux.go

@@ -3,19 +3,58 @@
 package battery
 
 import (
+	"errors"
+	"log/slog"
+	"math"
 	"os"
 	"path/filepath"
 	"strconv"
+	"sync"
 
 	"github.com/henrygd/beszel/agent/utils"
 )
 
-var batteryRoot = "/sys/class/power_supply"
+// getBatteryPaths returns the paths of all batteries in /sys/class/power_supply
+var getBatteryPaths func() ([]string, error)
 
-// HasReadableBattery reports whether collection currently finds a readable battery.
-func HasReadableBattery() bool {
-	batteries, _ := GetBatteryStats()
-	return len(batteries) > 0
+// HasReadableBattery checks if the system has a battery and returns true if it does.
+var HasReadableBattery func() bool
+
+func init() {
+	resetBatteryState("/sys/class/power_supply")
+}
+
+// resetBatteryState resets the sync.Once functions to a fresh state.
+// Tests call this after swapping sysfsPowerSupply so the new path is picked up.
+func resetBatteryState(sysfsPowerSupplyPath string) {
+	getBatteryPaths = sync.OnceValues(func() ([]string, error) {
+		entries, err := os.ReadDir(sysfsPowerSupplyPath)
+		if err != nil {
+			return nil, err
+		}
+		var paths []string
+		for _, e := range entries {
+			path := filepath.Join(sysfsPowerSupplyPath, e.Name())
+			if utils.ReadStringFile(filepath.Join(path, "type")) == "Battery" {
+				paths = append(paths, path)
+			}
+		}
+		return paths, nil
+	})
+	HasReadableBattery = sync.OnceValue(func() bool {
+		systemHasBattery := false
+		paths, err := getBatteryPaths()
+		for _, path := range paths {
+			if _, ok := utils.ReadStringFileOK(filepath.Join(path, "capacity")); ok {
+				systemHasBattery = true
+				break
+			}
+		}
+		if !systemHasBattery {
+			slog.Debug("No battery found", "err", err)
+		}
+		return systemHasBattery
+	})
 }
 
 func parseSysfsState(status string) uint8 {
@@ -35,18 +74,26 @@ func parseSysfsState(status string) uint8 {
 	}
 }
 
-// GetBatteryStats re-enumerates power supplies and returns every readable battery.
-func GetBatteryStats() ([]Battery, error) {
-	entries, err := os.ReadDir(batteryRoot)
-	if err != nil {
-		return nil, err
+// GetBatteryStats returns the current battery percent and charge state.
+// Reads /sys/class/power_supply/*/capacity directly so the kernel-reported
+// value is used, which is always 0-100 and matches what the OS displays.
+func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
+	if !HasReadableBattery() {
+		return batteryPercent, batteryState, errors.ErrUnsupported
 	}
-	batteries := make([]Battery, 0, len(entries))
-	for _, entry := range entries {
-		path := filepath.Join(batteryRoot, entry.Name())
-		if utils.ReadStringFile(filepath.Join(path, "type")) != "Battery" {
-			continue
-		}
+	paths, err := getBatteryPaths()
+	if err != nil {
+		return batteryPercent, batteryState, err
+	}
+	if len(paths) == 0 {
+		return batteryPercent, batteryState, errors.New("no batteries")
+	}
+
+	batteryState = math.MaxUint8
+	totalPercent := 0
+	count := 0
+
+	for _, path := range paths {
 		capStr, ok := utils.ReadStringFileOK(filepath.Join(path, "capacity"))
 		if !ok {
 			continue
@@ -55,31 +102,19 @@ func GetBatteryStats() ([]Battery, error) {
 		if parseErr != nil {
 			continue
 		}
-		cap = min(max(cap, 0), 100)
-		name := utils.ReadStringFile(filepath.Join(path, "model_name"))
-		if name == "" {
-			name = utils.ReadStringFile(filepath.Join(path, "model"))
+		totalPercent += cap
+		count++
+
+		state := parseSysfsState(utils.ReadStringFile(filepath.Join(path, "status")))
+		if state != stateUnknown {
+			batteryState = state
 		}
-		if name == "" {
-			name = entry.Name()
-		}
-		battery := Battery{
-			Name:    name,
-			Percent: uint8(cap),
-			State:   parseSysfsState(utils.ReadStringFile(filepath.Join(path, "status"))),
-			System:  utils.ReadStringFile(filepath.Join(path, "scope")) != "Device",
-		}
-		for _, fullName := range []string{"charge_full", "energy_full"} {
-			if parsed, ok := utils.ReadUintFile(filepath.Join(path, fullName)); ok && parsed > 0 {
-				battery.FullChargeCapacity = parsed
-				battery.HasFullChargeCapacity = true
-				break
-			}
-		}
-		batteries = append(batteries, battery)
 	}
-	if len(batteries) == 0 {
-		return nil, errNoBatteries
+
+	if count == 0 || batteryState == math.MaxUint8 {
+		return batteryPercent, batteryState, errors.New("no battery capacity")
 	}
-	return normalizeBatteries(batteries), nil
+
+	batteryPercent = uint8(totalPercent / count)
+	return batteryPercent, batteryState, nil
 }

agent/battery/battery_linux_test.go

@@ -8,102 +8,194 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
-type fakeBattery struct{ id, name, capacity, status, full, scope string }
-
-func setupFakeSysfs(t *testing.T) (string, func(fakeBattery)) {
+// setupFakeSysfs creates a temporary sysfs-like tree under t.TempDir(),
+// swaps sysfsPowerSupply, resets the sync.Once caches, and restores
+// everything on cleanup. Returns a helper to create battery directories.
+func setupFakeSysfs(t *testing.T) (tmpDir string, addBattery func(name, capacity, status string)) {
 	t.Helper()
-	root := t.TempDir()
-	previousRoot := batteryRoot
-	batteryRoot = root
-	t.Cleanup(func() { batteryRoot = previousRoot })
-	write := func(path, value string) {
+
+	tmp := t.TempDir()
+	resetBatteryState(tmp)
+
+	write := func(path, content string) {
 		t.Helper()
-		require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
-		require.NoError(t, os.WriteFile(path, []byte(value), 0o644))
-	}
-	add := func(b fakeBattery) {
-		t.Helper()
-		dir := filepath.Join(root, b.id)
-		write(filepath.Join(dir, "type"), "Battery")
-		if b.capacity != "" {
-			write(filepath.Join(dir, "capacity"), b.capacity)
+		dir := filepath.Dir(path)
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			t.Fatal(err)
 		}
-		write(filepath.Join(dir, "status"), b.status)
-		if b.name != "" {
-			write(filepath.Join(dir, "model_name"), b.name)
-		}
-		if b.full != "" {
-			write(filepath.Join(dir, "energy_full"), b.full)
-		}
-		if b.scope != "" {
-			write(filepath.Join(dir, "scope"), b.scope)
+		if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+			t.Fatal(err)
 		}
 	}
-	return root, add
+
+	addBattery = func(name, capacity, status string) {
+		t.Helper()
+		batDir := filepath.Join(tmp, name)
+		write(filepath.Join(batDir, "type"), "Battery")
+		write(filepath.Join(batDir, "capacity"), capacity)
+		write(filepath.Join(batDir, "status"), status)
+	}
+
+	return tmp, addBattery
 }
 
 func TestParseSysfsState(t *testing.T) {
-	assert.Equal(t, stateEmpty, parseSysfsState("Empty"))
-	assert.Equal(t, stateFull, parseSysfsState("Full"))
-	assert.Equal(t, stateCharging, parseSysfsState("Charging"))
-	assert.Equal(t, stateDischarging, parseSysfsState("Discharging"))
-	assert.Equal(t, stateIdle, parseSysfsState("Not charging"))
-	assert.Equal(t, stateUnknown, parseSysfsState("SomethingElse"))
+	tests := []struct {
+		input string
+		want  uint8
+	}{
+		{"Empty", stateEmpty},
+		{"Full", stateFull},
+		{"Charging", stateCharging},
+		{"Discharging", stateDischarging},
+		{"Not charging", stateIdle},
+		{"", stateUnknown},
+		{"SomethingElse", stateUnknown},
+	}
+	for _, tt := range tests {
+		assert.Equal(t, tt.want, parseSysfsState(tt.input), "parseSysfsState(%q)", tt.input)
+	}
 }
 
-func TestGetBatteryStatsMultipleNamedAndPrimary(t *testing.T) {
-	_, add := setupFakeSysfs(t)
-	add(fakeBattery{id: "BAT0", name: "Primary", capacity: "105", status: "Charging", full: "5000", scope: "System"})
-	add(fakeBattery{id: "hidpp_battery_0", name: "MX Keys S", capacity: "55", status: "Unknown", full: "900", scope: "Device"})
-	batteries, err := GetBatteryStats()
-	require.NoError(t, err)
-	require.Len(t, batteries, 2)
-	assert.Equal(t, "Primary", batteries[0].Name)
-	assert.Equal(t, uint8(100), batteries[0].Percent)
-	assert.Equal(t, stateUnknown, batteries[1].State)
-	primary, ok := Primary(batteries)
-	require.True(t, ok)
-	assert.Equal(t, "Primary", primary.Name)
+func TestGetBatteryStats_SingleBattery(t *testing.T) {
+	_, addBattery := setupFakeSysfs(t)
+	addBattery("BAT0", "72", "Discharging")
+
+	pct, state, err := GetBatteryStats()
+	assert.NoError(t, err)
+	assert.Equal(t, uint8(72), pct)
+	assert.Equal(t, stateDischarging, state)
 }
 
-func TestGetBatteryStatsFallbackDuplicatesAndUnreadable(t *testing.T) {
-	root, add := setupFakeSysfs(t)
-	add(fakeBattery{id: "BAT0", name: "Keyboard", capacity: "80", status: "Discharging"})
-	add(fakeBattery{id: "BAT1", name: "Keyboard", capacity: "-4", status: "SomethingWeird"})
-	add(fakeBattery{id: "BAT2", capacity: "not-a-number", status: "Charging"})
-	add(fakeBattery{id: "BAT3", capacity: "42", status: "Full"})
-	ac := filepath.Join(root, "AC0")
-	require.NoError(t, os.MkdirAll(ac, 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(ac, "type"), []byte("Mains"), 0o644))
-	batteries, err := GetBatteryStats()
-	require.NoError(t, err)
-	require.Len(t, batteries, 3)
-	assert.Equal(t, "Keyboard", batteries[0].Name)
-	assert.Equal(t, "Keyboard (2)", batteries[1].Name)
-	assert.Equal(t, uint8(0), batteries[1].Percent)
-	assert.Equal(t, "BAT3", batteries[2].Name)
+func TestGetBatteryStats_MultipleBatteries(t *testing.T) {
+	_, addBattery := setupFakeSysfs(t)
+	addBattery("BAT0", "80", "Charging")
+	addBattery("BAT1", "40", "Charging")
+
+	pct, state, err := GetBatteryStats()
+	assert.NoError(t, err)
+	// average of 80 and 40 = 60
+	assert.EqualValues(t, 60, pct)
+	assert.Equal(t, stateCharging, state)
 }
 
-func TestGetBatteryStatsHotPlugReenumerates(t *testing.T) {
-	_, add := setupFakeSysfs(t)
-	_, err := GetBatteryStats()
+func TestGetBatteryStats_FullBattery(t *testing.T) {
+	_, addBattery := setupFakeSysfs(t)
+	addBattery("BAT0", "100", "Full")
+
+	pct, state, err := GetBatteryStats()
+	assert.NoError(t, err)
+	assert.Equal(t, uint8(100), pct)
+	assert.Equal(t, stateFull, state)
+}
+
+func TestGetBatteryStats_EmptyBattery(t *testing.T) {
+	_, addBattery := setupFakeSysfs(t)
+	addBattery("BAT0", "0", "Empty")
+
+	pct, state, err := GetBatteryStats()
+	assert.NoError(t, err)
+	assert.Equal(t, uint8(0), pct)
+	assert.Equal(t, stateEmpty, state)
+}
+
+func TestGetBatteryStats_NotCharging(t *testing.T) {
+	_, addBattery := setupFakeSysfs(t)
+	addBattery("BAT0", "80", "Not charging")
+
+	pct, state, err := GetBatteryStats()
+	assert.NoError(t, err)
+	assert.Equal(t, uint8(80), pct)
+	assert.Equal(t, stateIdle, state)
+}
+
+func TestGetBatteryStats_NoBatteries(t *testing.T) {
+	setupFakeSysfs(t) // empty directory, no batteries
+
+	_, _, err := GetBatteryStats()
 	assert.Error(t, err)
-	assert.False(t, HasReadableBattery())
-	add(fakeBattery{id: "BAT0", capacity: "64", status: "Discharging"})
-	batteries, err := GetBatteryStats()
-	require.NoError(t, err)
+}
+
+func TestGetBatteryStats_NonBatterySupplyIgnored(t *testing.T) {
+	tmp, addBattery := setupFakeSysfs(t)
+
+	// Add a real battery
+	addBattery("BAT0", "55", "Charging")
+
+	// Add an AC adapter (type != Battery) - should be ignored
+	acDir := filepath.Join(tmp, "AC0")
+	if err := os.MkdirAll(acDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(acDir, "type"), []byte("Mains"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	pct, state, err := GetBatteryStats()
+	assert.NoError(t, err)
+	assert.Equal(t, uint8(55), pct)
+	assert.Equal(t, stateCharging, state)
+}
+
+func TestGetBatteryStats_InvalidCapacitySkipped(t *testing.T) {
+	tmp, addBattery := setupFakeSysfs(t)
+
+	// One battery with valid capacity
+	addBattery("BAT0", "90", "Discharging")
+
+	// Another with invalid capacity text
+	badDir := filepath.Join(tmp, "BAT1")
+	if err := os.MkdirAll(badDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(badDir, "type"), []byte("Battery"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(badDir, "capacity"), []byte("not-a-number"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(badDir, "status"), []byte("Discharging"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	pct, _, err := GetBatteryStats()
+	assert.NoError(t, err)
+	// Only BAT0 counted
+	assert.Equal(t, uint8(90), pct)
+}
+
+func TestGetBatteryStats_UnknownStatusOnly(t *testing.T) {
+	_, addBattery := setupFakeSysfs(t)
+	addBattery("BAT0", "50", "SomethingWeird")
+
+	_, _, err := GetBatteryStats()
+	assert.Error(t, err)
+}
+
+func TestHasReadableBattery_True(t *testing.T) {
+	_, addBattery := setupFakeSysfs(t)
+	addBattery("BAT0", "50", "Charging")
+
 	assert.True(t, HasReadableBattery())
-	require.Len(t, batteries, 1)
-	assert.Equal(t, uint8(64), batteries[0].Percent)
 }
 
-func TestGetBatteryStatsNoReadableCapacity(t *testing.T) {
-	_, add := setupFakeSysfs(t)
-	add(fakeBattery{id: "BAT0", status: "Charging"})
-	_, err := GetBatteryStats()
-	assert.Error(t, err)
+func TestHasReadableBattery_False(t *testing.T) {
+	setupFakeSysfs(t) // no batteries
+
+	assert.False(t, HasReadableBattery())
+}
+
+func TestHasReadableBattery_NoCapacityFile(t *testing.T) {
+	tmp, _ := setupFakeSysfs(t)
+
+	// Battery dir with type file but no capacity file
+	batDir := filepath.Join(tmp, "BAT0")
+	err := os.MkdirAll(batDir, 0o755)
+	assert.NoError(t, err)
+	err = os.WriteFile(filepath.Join(batDir, "type"), []byte("Battery"), 0o644)
+	assert.NoError(t, err)
+
 	assert.False(t, HasReadableBattery())
 }

agent/battery/battery_stub.go

@@ -8,6 +8,6 @@ func HasReadableBattery() bool {
 	return false
 }
 
-func GetBatteryStats() ([]Battery, error) {
-	return nil, errors.ErrUnsupported
+func GetBatteryStats() (uint8, uint8, error) {
+	return 0, 0, errors.ErrUnsupported
 }

agent/battery/battery_test.go

@@ -1,35 +0,0 @@
-package battery
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestPrimarySelection(t *testing.T) {
-	tests := []struct {
-		name string
-		bats []Battery
-		want string
-	}{
-		{"largest reported capacity", []Battery{{Name: "Small", FullChargeCapacity: 20, HasFullChargeCapacity: true, System: true}, {Name: "Large", FullChargeCapacity: 80, HasFullChargeCapacity: true}}, "Large"},
-		{"reported ranks over missing", []Battery{{Name: "Unknown", System: true}, {Name: "Known", FullChargeCapacity: 1, HasFullChargeCapacity: true}}, "Known"},
-		{"system wins capacity tie", []Battery{{Name: "Peripheral", FullChargeCapacity: 50, HasFullChargeCapacity: true}, {Name: "System", FullChargeCapacity: 50, HasFullChargeCapacity: true, System: true}}, "System"},
-		{"name resolves final tie", []Battery{{Name: "Zed"}, {Name: "Alpha"}}, "Alpha"},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, ok := Primary(tt.bats)
-			require.True(t, ok)
-			assert.Equal(t, tt.want, got.Name)
-		})
-	}
-	_, ok := Primary(nil)
-	assert.False(t, ok)
-}
-
-func TestNormalizeBatteriesFallbackNames(t *testing.T) {
-	bats := normalizeBatteries([]Battery{{}, {}, {Name: "Mouse"}, {Name: "Mouse"}})
-	assert.Equal(t, []string{"Battery 1", "Battery 2", "Mouse", "Mouse (2)"}, []string{bats[0].Name, bats[1].Name, bats[2].Name, bats[3].Name})
-}

agent/battery/battery_windows.go

@@ -7,6 +7,9 @@ package battery
 
 import (
 	"errors"
+	"log/slog"
+	"math"
+	"sync"
 	"syscall"
 	"unsafe"
 
@@ -76,7 +79,7 @@ var (
 	setupDiDestroyDeviceInfoList     = setupapi.NewProc("SetupDiDestroyDeviceInfoList")
 )
 
-// winBatteryGet reads one battery by index.
+// winBatteryGet reads one battery by index. Returns (fullCapacity, currentCapacity, state, error).
 // Returns error == errNotFound when there are no more batteries.
 var errNotFound = errors.New("no more batteries")
 
@@ -119,7 +122,7 @@ func readWinBatteryState(powerState uint32) uint8 {
 	}
 }
 
-func winBatteryGet(idx int) (Battery, error) {
+func winBatteryGet(idx int) (full, current uint32, state uint8, err error) {
 	hdev, err := setupDiSetup(
 		setupDiGetClassDevsW,
 		4,
@@ -129,7 +132,7 @@ func winBatteryGet(idx int) (Battery, error) {
 		0, 0,
 	)
 	if err != nil {
-		return Battery{}, err
+		return 0, 0, stateUnknown, err
 	}
 	defer syscall.SyscallN(setupDiDestroyDeviceInfoList.Addr(), hdev)
 
@@ -145,10 +148,10 @@ func winBatteryGet(idx int) (Battery, error) {
 		0,
 	)
 	if errno == 259 { // ERROR_NO_MORE_ITEMS
-		return Battery{}, errNotFound
+		return 0, 0, stateUnknown, errNotFound
 	}
 	if errno != 0 {
-		return Battery{}, errno
+		return 0, 0, stateUnknown, errno
 	}
 
 	var cbRequired uint32
@@ -162,7 +165,7 @@ func winBatteryGet(idx int) (Battery, error) {
 		0,
 	)
 	if errno != 0 && errno != 122 { // ERROR_INSUFFICIENT_BUFFER
-		return Battery{}, errno
+		return 0, 0, stateUnknown, errno
 	}
 	didd := make([]uint16, cbRequired/2)
 	cbSize := (*uint32)(unsafe.Pointer(&didd[0]))
@@ -182,7 +185,7 @@ func winBatteryGet(idx int) (Battery, error) {
 		0,
 	)
 	if errno != 0 {
-		return Battery{}, errno
+		return 0, 0, stateUnknown, errno
 	}
 	devicePath := &didd[2:][0]
 
@@ -196,7 +199,7 @@ func winBatteryGet(idx int) (Battery, error) {
 		0,
 	)
 	if err != nil {
-		return Battery{}, err
+		return 0, 0, stateUnknown, err
 	}
 	defer windows.CloseHandle(handle)
 
@@ -213,7 +216,7 @@ func winBatteryGet(idx int) (Battery, error) {
 		&dwOut, nil,
 	)
 	if err != nil || bqi.BatteryTag == 0 {
-		return Battery{}, errors.New("battery tag not returned")
+		return 0, 0, stateUnknown, errors.New("battery tag not returned")
 	}
 
 	var bi batteryInformation
@@ -226,21 +229,7 @@ func winBatteryGet(idx int) (Battery, error) {
 		uint32(unsafe.Sizeof(bi)),
 		&dwOut, nil,
 	); err != nil {
-		return Battery{}, err
-	}
-
-	// BatteryDeviceName is optional, so retain the deterministic fallback on error.
-	name := ""
-	nameQuery := bqi
-	nameQuery.InformationLevel = 4 // BatteryDeviceName
-	nameBuffer := make([]uint16, 128)
-	if err := windows.DeviceIoControl(
-		handle, 2703428,
-		(*byte)(unsafe.Pointer(&nameQuery)), uint32(unsafe.Sizeof(nameQuery)),
-		(*byte)(unsafe.Pointer(&nameBuffer[0])), uint32(len(nameBuffer)*2),
-		&dwOut, nil,
-	); err == nil {
-		name = windows.UTF16ToString(nameBuffer)
+		return 0, 0, stateUnknown, err
 	}
 
 	bws := batteryWaitStatus{BatteryTag: bqi.BatteryTag}
@@ -254,38 +243,56 @@ func winBatteryGet(idx int) (Battery, error) {
 		uint32(unsafe.Sizeof(bs)),
 		&dwOut, nil,
 	); err != nil {
-		return Battery{}, err
+		return 0, 0, stateUnknown, err
 	}
 
-	if bs.Capacity == 0xffffffff || bi.FullChargedCapacity == 0 || bi.FullChargedCapacity == 0xffffffff {
-		return Battery{}, errors.New("battery capacity unknown")
+	if bs.Capacity == 0xffffffff { // BATTERY_UNKNOWN_CAPACITY
+		return 0, 0, stateUnknown, errors.New("battery capacity unknown")
 	}
-	percent := min(float64(bs.Capacity)/float64(bi.FullChargedCapacity)*100, 100)
-	return Battery{Name: name, Percent: uint8(percent), State: readWinBatteryState(bs.PowerState),
-		FullChargeCapacity: uint64(bi.FullChargedCapacity), HasFullChargeCapacity: true, System: true}, nil
+
+	return bi.FullChargedCapacity, bs.Capacity, readWinBatteryState(bs.PowerState), nil
 }
 
 // HasReadableBattery checks if the system has a battery and returns true if it does.
-func HasReadableBattery() bool {
-	batteries, _ := GetBatteryStats()
-	return len(batteries) > 0
-}
+var HasReadableBattery = sync.OnceValue(func() bool {
+	systemHasBattery := false
+	full, _, _, err := winBatteryGet(0)
+	if err == nil && full > 0 {
+		systemHasBattery = true
+	}
+	if !systemHasBattery {
+		slog.Debug("No battery found", "err", err)
+	}
+	return systemHasBattery
+})
+
+// GetBatteryStats returns the current battery percent and charge state.
+func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
+	if !HasReadableBattery() {
+		return batteryPercent, batteryState, errors.ErrUnsupported
+	}
+
+	totalFull := uint32(0)
+	totalCurrent := uint32(0)
+	batteryState = math.MaxUint8
 
-// GetBatteryStats returns every readable battery reported by Windows.
-func GetBatteryStats() ([]Battery, error) {
-	batteries := make([]Battery, 0, 2)
 	for i := 0; ; i++ {
-		battery, bErr := winBatteryGet(i)
+		full, current, state, bErr := winBatteryGet(i)
 		if errors.Is(bErr, errNotFound) {
 			break
 		}
-		if bErr != nil {
+		if bErr != nil || full == 0 {
 			continue
 		}
-		batteries = append(batteries, battery)
+		totalFull += full
+		totalCurrent += min(current, full)
+		batteryState = state
 	}
-	if len(batteries) == 0 {
-		return nil, errNoBatteries
+
+	if totalFull == 0 || batteryState == math.MaxUint8 {
+		return batteryPercent, batteryState, errors.New("no battery capacity")
 	}
-	return normalizeBatteries(batteries), nil
+
+	batteryPercent = uint8(float64(totalCurrent) / float64(totalFull) * 100)
+	return batteryPercent, batteryState, nil
 }

agent/client.go

@@ -53,8 +53,8 @@ func newWebSocketClient(agent *Agent) (client *WebSocketClient, err error) {
 	client = &WebSocketClient{}
 
 	client.hubURL, err = url.Parse(hubURLStr)
-	if err != nil || client.hubURL.Host == "" {
-		return nil, fmt.Errorf("invalid HUB_URL %q: must include scheme and host (e.g. http://hub.example.com:8090)", hubURLStr)
+	if err != nil {
+		return nil, errors.New("invalid hub URL")
 	}
 	// get registration token
 	client.token, err = getToken()

agent/client_test.go

@@ -51,18 +51,11 @@ func TestNewWebSocketClient(t *testing.T) {
 			errorMsg:    "HUB_URL environment variable not set",
 		},
 		{
-			name:        "malformed URL",
+			name:        "invalid URL",
 			hubURL:      "ht\ttp://invalid",
 			token:       "test-token",
 			expectError: true,
-			errorMsg:    "invalid HUB_URL",
-		},
-		{
-			name:        "URL without host",
-			hubURL:      "http:/api",
-			token:       "test-token",
-			expectError: true,
-			errorMsg:    "invalid HUB_URL",
+			errorMsg:    "invalid hub URL",
 		},
 		{
 			name:        "missing token",

agent/connection_manager.go

@@ -141,6 +141,7 @@ func (c *ConnectionManager) Start(serverOptions ServerOptions) error {
 //	}
 func (c *ConnectionManager) stop() error {
 	_ = c.agent.StopServer()
+	c.agent.probeManager.Stop()
 	c.closeWebSocket()
 	return health.CleanUp()
 }

agent/docker.go

@@ -65,6 +65,7 @@ type dockerManager struct {
 	dockerVersionChecked bool                        // Whether a version probe has completed successfully
 	isWindows            bool                        // Whether the Docker Engine API is running on Windows
 	buf                  *bytes.Buffer               // Buffer to store and read response bodies
+	decoder              *json.Decoder               // Reusable JSON decoder that reads from buf
 	apiStats             *container.ApiStats         // Reusable API stats object
 	excludeContainers    []string                    // Patterns to exclude containers by name
 	usingPodman          bool                        // Whether the Docker Engine API is running on Podman
@@ -373,26 +374,16 @@ func convertContainerPortsToString(ctr *container.ApiInfo) string {
 		return ""
 	}
 	sort.Slice(ctr.Ports, func(i, j int) bool {
-		if ctr.Ports[i].PublicPort != ctr.Ports[j].PublicPort {
-			return ctr.Ports[i].PublicPort < ctr.Ports[j].PublicPort
-		}
-		return ctr.Ports[i].IP < ctr.Ports[j].IP
+		return ctr.Ports[i].PublicPort < ctr.Ports[j].PublicPort
 	})
 	var builder strings.Builder
-	seen := make(map[string]struct{})
+	seenPorts := make(map[uint16]struct{})
 	for _, p := range ctr.Ports {
-		if p.PublicPort == 0 {
+		_, ok := seenPorts[p.PublicPort]
+		if p.PublicPort == 0 || ok {
 			continue
 		}
-		keyIP := p.IP
-		if keyIP == "0.0.0.0" || keyIP == "::" {
-			keyIP = ""
-		}
-		key := keyIP + ":" + strconv.Itoa(int(p.PublicPort))
-		if _, ok := seen[key]; ok {
-			continue
-		}
-		seen[key] = struct{}{}
+		seenPorts[p.PublicPort] = struct{}{}
 		if builder.Len() > 0 {
 			builder.WriteString(", ")
 		}
@@ -756,18 +747,20 @@ func (dm *dockerManager) applyDockerVersionInfo(serverHeader string, versionInfo
 	}
 }
 
-// Decodes a Docker API JSON response using a reusable buffer. Not thread safe.
+// Decodes Docker API JSON response using a reusable buffer and decoder. Not thread safe.
 func (dm *dockerManager) decode(resp *http.Response, d any) error {
 	if dm.buf == nil {
 		// initialize buffer with 256kb starting size
 		dm.buf = bytes.NewBuffer(make([]byte, 0, 1024*256))
+		dm.decoder = json.NewDecoder(dm.buf)
 	}
 	defer resp.Body.Close()
 	defer dm.buf.Reset()
-	if _, err := dm.buf.ReadFrom(resp.Body); err != nil {
+	_, err := dm.buf.ReadFrom(resp.Body)
+	if err != nil {
 		return err
 	}
-	return json.Unmarshal(dm.buf.Bytes(), d)
+	return dm.decoder.Decode(d)
 }
 
 // Test docker / podman sockets and return if one exists

agent/docker_test.go

@@ -804,24 +804,6 @@ func TestGetDockerStatsRetriesVersionCheckUntilSuccess(t *testing.T) {
 	assert.Equal(t, 2, requestCounts["/version"])
 }
 
-// A failed decode must not break later decodes. Previously the reused json.Decoder
-// stayed desynced after one truncated response, breaking decode until restart.
-func TestDecodeRecoversFromError(t *testing.T) {
-	dm := &dockerManager{}
-
-	// truncated JSON: body reads fine, decode fails
-	var bad []container.ApiInfo
-	err := dm.decode(&http.Response{Body: io.NopCloser(strings.NewReader(`[{"Id":"abc`))}, &bad)
-	require.Error(t, err)
-
-	// the next decode must still succeed
-	var good []container.ApiInfo
-	err = dm.decode(&http.Response{Body: io.NopCloser(strings.NewReader(`[{"Id":"abcdef012345","Names":["/ok"]}]`))}, &good)
-	require.NoError(t, err)
-	require.Len(t, good, 1)
-	assert.Equal(t, "abcdef012345", good[0].Id)
-}
-
 func TestCycleCpuDeltas(t *testing.T) {
 	dm := &dockerManager{
 		lastCpuContainer: map[uint16]map[string]uint64{
@@ -1021,44 +1003,6 @@ func TestCpuPercentageCalculationWithRealData(t *testing.T) {
 	assert.InDelta(t, expectedPct, actualPct, 0.01)
 }
 
-func TestCpuPercentageHandlesCounterRollback(t *testing.T) {
-	// If a stats response is processed after a newer one for the same container,
-	// or an accounting counter resets, the current total can be lower than the
-	// stored previous value. Unsigned subtraction wraps to ~2^64 instead of
-	// going negative, so the percentage explodes, validateCpuPercentage rejects
-	// the sample, and the whole collection is discarded - network stats too.
-	stats := &container.ApiStats{
-		CPUStats: container.CPUStats{
-			CPUUsage:    container.CPUUsage{TotalUsage: 1_000_000},
-			SystemUsage: 20_000_000,
-		},
-	}
-
-	// Container counter went backwards.
-	assert.Equal(t, 0.0, stats.CalculateCpuPercentLinux(2_000_000, 10_000_000))
-	// System counter went backwards.
-	assert.Equal(t, 0.0, stats.CalculateCpuPercentLinux(500_000, 30_000_000))
-	// A normal forward sample is unaffected: 500000 / 10000000 * 100 = 5%.
-	assert.InDelta(t, 5.0, stats.CalculateCpuPercentLinux(500_000, 10_000_000), 0.001)
-}
-
-func TestCpuPercentageWindowsHandlesCounterRollback(t *testing.T) {
-	now := time.Now()
-	stats := &container.ApiStats{
-		Read:     now,
-		NumProcs: 4,
-		CPUStats: container.CPUStats{
-			CPUUsage: container.CPUUsage{TotalUsage: 1_000_000},
-		},
-	}
-	prevRead := now.Add(-time.Second)
-
-	// Container counter went backwards.
-	assert.Equal(t, 0.0, stats.CalculateCpuPercentWindows(2_000_000, prevRead))
-	// A normal forward sample is unaffected.
-	assert.Greater(t, stats.CalculateCpuPercentWindows(500_000, prevRead), 0.0)
-}
-
 func TestNetworkStatsCalculationWithRealData(t *testing.T) {
 	// Create synthetic test data to avoid timing issues
 	apiStats1 := &container.ApiStats{
@@ -1920,14 +1864,6 @@ func TestConvertContainerPortsToString(t *testing.T) {
 			},
 			expected: "80, 443",
 		},
-		{
-			name: "ipv4 and ipv6 wildcard bindings are deduplicated",
-			ports: []port{
-				{PublicPort: 80, IP: "0.0.0.0"},
-				{PublicPort: 80, IP: "::"},
-			},
-			expected: "80",
-		},
 		{
 			name: "multiple ports with different IPs",
 			ports: []port{
@@ -1936,22 +1872,6 @@ func TestConvertContainerPortsToString(t *testing.T) {
 			},
 			expected: "80, 1.2.3.4:443",
 		},
-		{
-			name: "same port bound to multiple IPs shows all entries",
-			ports: []port{
-				{PublicPort: 65533, IP: "172.16.151.72"},
-				{PublicPort: 65533, IP: "172.16.156.25"},
-			},
-			expected: "172.16.151.72:65533, 172.16.156.25:65533",
-		},
-		{
-			name: "same port bound to IPv4 and IPv6",
-			ports: []port{
-				{PublicPort: 65534, IP: "172.16.151.72"},
-				{PublicPort: 65534, IP: "fd04:38e2:98c6:3fd::72"},
-			},
-			expected: "172.16.151.72:65534, fd04:38e2:98c6:3fd::72:65534",
-		},
 		{
 			name: "ports slice is nilled after call",
 			ports: []port{

agent/fans.go

@@ -1,101 +0,0 @@
-package agent
-
-import (
-	"log/slog"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-
-	"github.com/henrygd/beszel/agent/utils"
-	"github.com/henrygd/beszel/internal/entities/system"
-)
-
-type fanSensor struct {
-	key, path string
-}
-
-var getFanSensors = newFanSensorCache(hwmonRoot)
-
-func newFanSensorCache(root string) func() ([]fanSensor, error) {
-	return sync.OnceValues(func() ([]fanSensor, error) {
-		return discoverHwmonFans(root)
-	})
-}
-
-// updateFans populates systemStats.Fans from the host's hwmon sysfs tree.
-// No-op on platforms where hwmon isn't available (see fans_other.go).
-func (a *Agent) updateFans(systemStats *system.Stats) {
-	if hwmonRoot == "" {
-		return
-	}
-	sensors, err := getFanSensors()
-	if err != nil {
-		slog.Debug("Error reading fans", "err", err)
-		return
-	}
-	fans := readFanSensors(sensors)
-	if len(fans) == 0 {
-		return
-	}
-	systemStats.Fans = fans
-	// Note: Commented out because we don't currently use this value in the UI.
-	// Compute the single "dashboard" value used by the FanSpeed alert.
-	// Per-sensor RPMs live in Stats.Fans and drive the multi-line FanChart
-	// in the UI; the alert path only needs one number to compare against
-	// the user's threshold, so we use the highest RPM across all fans
-	// a.systemInfo.DashboardFan = 0
-	// for _, rpm := range fans {
-	// 	if rpm > a.systemInfo.DashboardFan {
-	// 		a.systemInfo.DashboardFan = rpm
-	// 	}
-	// }
-}
-
-// readHwmonFans walks the given hwmon root (typically /sys/class/hwmon) and
-// returns a map of "<chip>_<label-or-fan-idx>" → RPM for every fan*_input
-// file it finds. Zero RPM is retained because it can represent a real fan that
-// has stopped; negative and malformed readings are ignored.
-func readHwmonFans(root string) (map[string]uint16, error) {
-	sensors, err := discoverHwmonFans(root)
-	if err != nil {
-		return nil, err
-	}
-	return readFanSensors(sensors), nil
-}
-
-func discoverHwmonFans(root string) ([]fanSensor, error) {
-	entries, err := os.ReadDir(root)
-	if err != nil {
-		return nil, err
-	}
-	var sensors []fanSensor
-	for _, entry := range entries {
-		chipDir := filepath.Join(root, entry.Name())
-		chipName := utils.ReadStringFile(filepath.Join(chipDir, "name"))
-		if chipName == "" {
-			chipName = entry.Name()
-		}
-		inputs, _ := filepath.Glob(filepath.Join(chipDir, "fan*_input"))
-		for _, inputPath := range inputs {
-			base := strings.TrimSuffix(filepath.Base(inputPath), "_input")
-			label := utils.ReadStringFile(filepath.Join(chipDir, base+"_label"))
-			key := chipName + "_" + base
-			if label != "" {
-				key = chipName + "_" + label
-			}
-			sensors = append(sensors, fanSensor{key, inputPath})
-		}
-	}
-	return sensors, nil
-}
-
-func readFanSensors(sensors []fanSensor) map[string]uint16 {
-	fans := make(map[string]uint16, len(sensors))
-	for _, sensor := range sensors {
-		if rpm, ok := utils.ReadUintFile(sensor.path); ok {
-			fans[sensor.key] = uint16(rpm)
-		}
-	}
-	return fans
-}

agent/fans_linux.go

@@ -1,8 +0,0 @@
-//go:build linux
-
-package agent
-
-// hwmonRoot is the sysfs entry point for hardware monitor chips. Each
-// subdirectory (hwmon0, hwmon1, …) is one chip; fan*_input files inside it
-// expose RPM readings.
-const hwmonRoot = "/sys/class/hwmon"

agent/fans_other.go

@@ -1,7 +0,0 @@
-//go:build !linux
-
-package agent
-
-// hwmonRoot is empty on non-Linux platforms — fan RPM reporting via sysfs
-// hwmon is Linux-specific. updateFans() short-circuits when this is empty.
-const hwmonRoot = ""

agent/fans_test.go

@@ -1,87 +0,0 @@
-//go:build testing
-
-package agent
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// writeFile creates path with parents and writes contents.
-func writeFile(t *testing.T, path, contents string) {
-	t.Helper()
-	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
-	require.NoError(t, os.WriteFile(path, []byte(contents), 0o644))
-}
-
-// TestReadHwmonFans verifies the /sys/class/hwmon walker:
-//   - picks up fan*_input from every chip,
-//   - keys entries by chip name + sensor label (or fan idx if no label),
-//   - retains 0 RPM for stopped fans,
-//   - tolerates chips with no fan files at all.
-func TestReadHwmonFans(t *testing.T) {
-	root := t.TempDir()
-
-	// hwmon0: Raspberry Pi 5 active cooler — one fan, no label.
-	writeFile(t, filepath.Join(root, "hwmon0", "name"), "pwmfan\n")
-	writeFile(t, filepath.Join(root, "hwmon0", "fan1_input"), "6500\n")
-
-	// hwmon1: a thermal-only chip, no fan files. Must not error.
-	writeFile(t, filepath.Join(root, "hwmon1", "name"), "cpu_thermal\n")
-	writeFile(t, filepath.Join(root, "hwmon1", "temp1_input"), "55000\n")
-
-	// hwmon2: two fans — one stopped (0 RPM) and one labeled "chassis".
-	writeFile(t, filepath.Join(root, "hwmon2", "name"), "nct6798\n")
-	writeFile(t, filepath.Join(root, "hwmon2", "fan1_input"), "0\n")
-	writeFile(t, filepath.Join(root, "hwmon2", "fan2_input"), "1200\n")
-	writeFile(t, filepath.Join(root, "hwmon2", "fan2_label"), "chassis\n")
-
-	fans, err := readHwmonFans(root)
-	require.NoError(t, err)
-
-	assert.Equal(t, map[string]uint16{
-		"pwmfan_fan1":     6500,
-		"nct6798_fan1":    0,
-		"nct6798_chassis": 1200,
-	}, fans)
-}
-
-// TestReadHwmonFansMissingRoot returns an error rather than panicking when the
-// hwmon root doesn't exist (e.g. running on a kernel without hwmon support).
-func TestReadHwmonFansMissingRoot(t *testing.T) {
-	_, err := readHwmonFans(filepath.Join(t.TempDir(), "does-not-exist"))
-	assert.Error(t, err)
-}
-
-// TestReadHwmonFansEmpty returns an empty map (not nil error) when the root
-// exists but contains no chips at all.
-func TestReadHwmonFansEmpty(t *testing.T) {
-	root := t.TempDir()
-	fans, err := readHwmonFans(root)
-	require.NoError(t, err)
-	assert.Empty(t, fans)
-}
-
-func TestFanDiscoveryCache(t *testing.T) {
-	root := t.TempDir()
-	input := filepath.Join(root, "hwmon0", "fan1_input")
-	writeFile(t, filepath.Join(root, "hwmon0", "name"), "chip\n")
-	writeFile(t, input, "1000\n")
-
-	getSensors := newFanSensorCache(root)
-	sensors, err := getSensors()
-	require.NoError(t, err)
-	fans := readFanSensors(sensors)
-	assert.Equal(t, uint16(1000), fans["chip_fan1"])
-
-	writeFile(t, input, "1200\n")
-	writeFile(t, filepath.Join(root, "hwmon0", "fan1_label"), "case\n")
-	sensors, err = getSensors()
-	require.NoError(t, err)
-	fans = readFanSensors(sensors)
-	assert.Equal(t, map[string]uint16{"chip_fan1": 1200}, fans)
-}

agent/gpu.go

@@ -48,8 +48,6 @@ type GPUManager struct {
 	// Per-cache-key tracking for delta calculations
 	// cacheKey -> gpuId -> snapshot of last count/usage/power values
 	lastSnapshots map[uint16]map[string]*gpuSnapshot
-	// Per-card energy snapshots for Intel sysfs power calculation.
-	intelSysfsEnergySnapshots map[string]intelSysfsEnergySnapshot
 }
 
 // gpuSnapshot stores the last observed incremental values for delta tracking
@@ -92,7 +90,6 @@ const (
 	collectorSourceNVML         collectorSource = "nvml"
 	collectorSourceNvidiaSMI    collectorSource = collectorSource(nvidiaSmiCmd)
 	collectorSourceIntelGpuTop  collectorSource = collectorSource(intelGpuStatsCmd)
-	collectorSourceIntelSysfs   collectorSource = "intel_sysfs"
 	collectorSourceAmdSysfs     collectorSource = "amd_sysfs"
 	collectorSourceRocmSMI      collectorSource = collectorSource(rocmSmiCmd)
 	collectorSourceMacmon       collectorSource = collectorSource(macmonCmd)
@@ -109,7 +106,6 @@ func isValidCollectorSource(source collectorSource) bool {
 		collectorSourceNVML,
 		collectorSourceNvidiaSMI,
 		collectorSourceIntelGpuTop,
-		collectorSourceIntelSysfs,
 		collectorSourceAmdSysfs,
 		collectorSourceRocmSMI,
 		collectorSourceMacmon,
@@ -126,8 +122,6 @@ type gpuCapabilities struct {
 	hasAmdSysfs     bool
 	hasTegrastats   bool
 	hasIntelGpuTop  bool
-	hasXe           bool
-	hasIntelSysfs   bool
 	hasNvtop        bool
 	hasMacmon       bool
 	hasPowermetrics bool
@@ -375,13 +369,12 @@ func (gm *GPUManager) calculateGPUAverage(id string, gpu *system.GPUData, cacheK
 
 	gpuAvg.Power = utils.TwoDecimals(deltaPower / float64(deltaCount))
 
-	gpuAvg.PowerPkg = utils.TwoDecimals(deltaPowerPkg / float64(deltaCount))
-
 	if gpu.Engines != nil {
 		// make fresh map for averaged engine metrics to avoid mutating
 		// the accumulator map stored in gm.GpuDataMap
 		gpuAvg.Engines = make(map[string]float64, len(gpu.Engines))
 		gpuAvg.Usage = gm.calculateIntelGPUUsage(&gpuAvg, gpu, lastSnapshot, deltaCount)
+		gpuAvg.PowerPkg = utils.TwoDecimals(deltaPowerPkg / float64(deltaCount))
 	} else {
 		gpuAvg.Usage = utils.TwoDecimals(deltaUsage / float64(deltaCount))
 	}
@@ -451,8 +444,6 @@ func (gm *GPUManager) storeSnapshot(id string, gpu *system.GPUData, cacheKey uin
 func (gm *GPUManager) discoverGpuCapabilities() gpuCapabilities {
 	caps := gpuCapabilities{
 		hasAmdSysfs: gm.hasAmdSysfs(),
-		hasXe:       gm.hasXe(),
-		hasIntelSysfs: gm.hasIntelSysfs(),
 	}
 	if _, err := exec.LookPath(nvidiaSmiCmd); err == nil {
 		caps.hasNvidiaSmi = true
@@ -481,7 +472,7 @@ func (gm *GPUManager) discoverGpuCapabilities() gpuCapabilities {
 }
 
 func hasAnyGpuCollector(caps gpuCapabilities) bool {
-	return caps.hasNvidiaSmi || caps.hasRocmSmi || caps.hasAmdSysfs || caps.hasTegrastats || caps.hasIntelGpuTop || caps.hasIntelSysfs || caps.hasNvtop || caps.hasMacmon || caps.hasPowermetrics
+	return caps.hasNvidiaSmi || caps.hasRocmSmi || caps.hasAmdSysfs || caps.hasTegrastats || caps.hasIntelGpuTop || caps.hasNvtop || caps.hasMacmon || caps.hasPowermetrics
 }
 
 func (gm *GPUManager) startIntelCollector() {
@@ -572,13 +563,6 @@ func (gm *GPUManager) collectorDefinitions(caps gpuCapabilities) map[collectorSo
 				return true
 			},
 		},
-		collectorSourceIntelSysfs: {
-			group:     collectorGroupIntel,
-			available: caps.hasIntelSysfs,
-			start: func(_ func()) bool {
-				return gm.startIntelSysfsCollector()
-			},
-		},
 		collectorSourceAmdSysfs: {
 			group:     collectorGroupAmd,
 			available: caps.hasAmdSysfs,
@@ -721,12 +705,9 @@ func (gm *GPUManager) resolveLegacyCollectorPriority(caps gpuCapabilities) []col
 		priorities = append(priorities, collectorSourceAmdSysfs)
 	}
 
-	if caps.hasIntelGpuTop && !caps.hasXe {
+	if caps.hasIntelGpuTop {
 		priorities = append(priorities, collectorSourceIntelGpuTop)
 	}
-	if caps.hasIntelSysfs {
-		priorities = append(priorities, collectorSourceIntelSysfs)
-	}
 
 	// Apple collectors are currently opt-in only for testing.
 	// Enable them with GPU_COLLECTOR=macmon or GPU_COLLECTOR=powermetrics.

agent/gpu_intel_sysfs_linux.go

@@ -1,280 +0,0 @@
-//go:build linux
-
-package agent
-
-import (
-	"fmt"
-	"log/slog"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/henrygd/beszel/agent/utils"
-	"github.com/henrygd/beszel/internal/entities/system"
-)
-
-var (
-	drmSysfsRoot  = "/sys/class/drm"
-	intelSysfsNow = time.Now
-)
-
-type intelSysfsEnergySnapshot struct {
-	microjoules uint64
-	timestamp   time.Time
-}
-
-type intelSysfsCard struct {
-	cardPath string
-	hwmonDir string
-}
-
-// hasIntelSysfs returns true if any Intel DRM card exposes an hwmon energy counter.
-func (gm *GPUManager) hasIntelSysfs() bool {
-	cards, err := discoverIntelSysfsCards()
-	return err == nil && len(cards) > 0
-}
-
-// startIntelSysfsCollector starts Intel GPU collection via sysfs.
-func (gm *GPUManager) startIntelSysfsCollector() bool {
-	go func() {
-		if err := gm.collectIntelSysfsStats(); err != nil {
-			slog.Warn("Error collecting Intel GPU data via sysfs", "err", err)
-		}
-	}()
-	return true
-}
-
-// collectIntelSysfsStats collects Intel GPU metrics directly from DRM sysfs / hwmon.
-func (gm *GPUManager) collectIntelSysfsStats() error {
-	sysfsPollInterval := 3000 * time.Millisecond
-	cards, err := discoverIntelSysfsCards()
-	if err != nil {
-		return err
-	}
-	if len(cards) == 0 {
-		return errNoValidData
-	}
-
-	slog.Debug("Using sysfs for Intel GPU data collection", "cards", len(cards))
-	for _, card := range cards {
-		slog.Debug("Intel sysfs card detected", "card", filepath.Base(card.cardPath), "hwmon", card.hwmonDir)
-	}
-
-	failures := 0
-	for {
-		hasData := false
-		for _, card := range cards {
-			if gm.updateIntelSysfsGpuData(card.cardPath, card.hwmonDir) {
-				hasData = true
-			}
-		}
-		if !hasData {
-			failures++
-			if failures > maxFailureRetries {
-				return errNoValidData
-			}
-			slog.Warn("No Intel GPU data from sysfs", "failures", failures)
-			time.Sleep(retryWaitTime)
-			continue
-		}
-		failures = 0
-		time.Sleep(sysfsPollInterval)
-	}
-}
-
-func discoverIntelSysfsCards() ([]intelSysfsCard, error) {
-	paths, err := filepath.Glob(filepath.Join(drmSysfsRoot, "card*"))
-	if err != nil {
-		return nil, err
-	}
-
-	var cards []intelSysfsCard
-	for _, cardPath := range paths {
-		if strings.Contains(filepath.Base(cardPath), "-") || !isIntelGpu(cardPath) {
-			continue
-		}
-		hwmonDir := findIntelEnergyHwmon(filepath.Join(cardPath, "device"))
-		if hwmonDir == "" {
-			continue
-		}
-		cards = append(cards, intelSysfsCard{cardPath: cardPath, hwmonDir: hwmonDir})
-	}
-	return cards, nil
-}
-
-func isIntelGpu(cardPath string) bool {
-	vendor, err := utils.ReadStringFileLimited(filepath.Join(cardPath, "device/vendor"), 64)
-	if err != nil {
-		return false
-	}
-	return strings.EqualFold(strings.TrimSpace(vendor), "0x8086")
-}
-
-func findIntelEnergyHwmon(devicePath string) string {
-	hwmons, _ := filepath.Glob(filepath.Join(devicePath, "hwmon/hwmon*"))
-	var fallback string
-	for _, hwmonDir := range hwmons {
-		if !sysfsFileExists(filepath.Join(hwmonDir, "energy1_input")) {
-			continue
-		}
-		if name, err := utils.ReadStringFileLimited(filepath.Join(hwmonDir, "name"), 64); err == nil && strings.EqualFold(strings.TrimSpace(name), "xe") {
-			return hwmonDir
-		}
-		if fallback == "" {
-			fallback = hwmonDir
-		}
-	}
-	return fallback
-}
-
-func sysfsFileExists(path string) bool {
-	_, err := utils.ReadStringFileLimited(path, 1)
-	return err == nil
-}
-
-// updateIntelSysfsGpuData reads GPU metrics from sysfs and updates the GPU data map.
-// Returns true if the required energy counter was read successfully.
-func (gm *GPUManager) updateIntelSysfsGpuData(cardPath, hwmonDir string) bool {
-	devicePath := filepath.Join(cardPath, "device")
-	id := filepath.Base(cardPath)
-
-	energy, err := readSysfsUint(filepath.Join(hwmonDir, "energy1_input"))
-	if err != nil {
-		return false
-	}
-
-	now := intelSysfsNow()
-	power, hasPower := gm.calculateIntelSysfsPower(id, energy, now)
-	powerPkg, hasPowerPkg := gm.readIntelSysfsPowerPkg(id, hwmonDir, now)
-	temp := readIntelSysfsTemperature(hwmonDir)
-	usage, usageErr := readOptionalSysfsFloat(filepath.Join(devicePath, "gpu_busy_percent"))
-	memUsed, memUsedErr := readFirstOptionalSysfsFloat(
-		filepath.Join(devicePath, "mem_info_vram_used"),
-		filepath.Join(devicePath, "mem_info_lmem_used"),
-		filepath.Join(devicePath, "mem_info_local_mem_used"),
-	)
-	memTotal, memTotalErr := readFirstOptionalSysfsFloat(
-		filepath.Join(devicePath, "mem_info_vram_total"),
-		filepath.Join(devicePath, "mem_info_lmem_total"),
-		filepath.Join(devicePath, "mem_info_local_mem_total"),
-	)
-
-	gm.Lock()
-	defer gm.Unlock()
-
-	gpu, ok := gm.GpuDataMap[id]
-	if !ok {
-		gpu = &system.GPUData{Name: getIntelSysfsGpuName(cardPath)}
-		gm.GpuDataMap[id] = gpu
-	}
-
-	if usageErr == nil {
-		gpu.Usage += usage
-	}
-	if memUsedErr == nil {
-		gpu.MemoryUsed = utils.BytesToMegabytes(memUsed)
-	}
-	if memTotalErr == nil {
-		gpu.MemoryTotal = utils.BytesToMegabytes(memTotal)
-	}
-	if temp > 0 {
-		gpu.Temperature = temp
-	}
-	if hasPower {
-		gpu.Power += power
-		slog.Debug("Computed Intel sysfs GPU power", "card", id, "watts", power)
-	}
-	if hasPowerPkg {
-		gpu.PowerPkg += powerPkg
-	}
-	gpu.Count++
-	return true
-}
-
-func (gm *GPUManager) calculateIntelSysfsPower(cardID string, microjoules uint64, timestamp time.Time) (float64, bool) {
-	if gm.intelSysfsEnergySnapshots == nil {
-		gm.intelSysfsEnergySnapshots = make(map[string]intelSysfsEnergySnapshot)
-	}
-
-	last, ok := gm.intelSysfsEnergySnapshots[cardID]
-	gm.intelSysfsEnergySnapshots[cardID] = intelSysfsEnergySnapshot{microjoules: microjoules, timestamp: timestamp}
-	if !ok {
-		return 0, false
-	}
-	if microjoules < last.microjoules {
-		slog.Debug("Intel sysfs energy counter reset", "card", cardID)
-		return 0, false
-	}
-	elapsed := timestamp.Sub(last.timestamp).Seconds()
-	if elapsed <= 0 {
-		return 0, false
-	}
-	delta := microjoules - last.microjoules
-	return float64(delta) / 1_000_000.0 / elapsed, true
-}
-
-func (gm *GPUManager) readIntelSysfsPowerPkg(cardID, hwmonDir string, timestamp time.Time) (float64, bool) {
-	energyPaths, _ := filepath.Glob(filepath.Join(hwmonDir, "energy*_input"))
-	for _, path := range energyPaths {
-		if filepath.Base(path) == "energy1_input" {
-			continue
-		}
-		energy, err := readSysfsUint(path)
-		if err != nil {
-			continue
-		}
-		return gm.calculateIntelSysfsPower(cardID+":"+filepath.Base(path), energy, timestamp)
-	}
-	return 0, false
-}
-
-func readIntelSysfsTemperature(hwmonDir string) float64 {
-	tempPaths, _ := filepath.Glob(filepath.Join(hwmonDir, "temp*_input"))
-	for _, path := range tempPaths {
-		temp, err := readSysfsFloat(path)
-		if err == nil && temp > 0 {
-			return temp / 1000.0
-		}
-	}
-	return 0
-}
-
-func readSysfsUint(path string) (uint64, error) {
-	val, err := utils.ReadStringFileLimited(path, 64)
-	if err != nil {
-		slog.Debug("Failed to read sysfs value", "path", path, "error", err)
-		return 0, err
-	}
-	return strconv.ParseUint(strings.TrimSpace(val), 10, 64)
-}
-
-func readOptionalSysfsFloat(path string) (float64, error) {
-	val, err := os.ReadFile(path)
-	if err != nil {
-		return 0, err
-	}
-	return strconv.ParseFloat(strings.TrimSpace(string(val)), 64)
-}
-
-func readFirstOptionalSysfsFloat(paths ...string) (float64, error) {
-	for _, path := range paths {
-		val, err := readOptionalSysfsFloat(path)
-		if err == nil {
-			return val, nil
-		}
-	}
-	return 0, fmt.Errorf("no sysfs values found")
-}
-
-func getIntelSysfsGpuName(cardPath string) string {
-	devicePath := filepath.Join(cardPath, "device")
-	if product, err := utils.ReadStringFileLimited(filepath.Join(devicePath, "product_name"), 128); err == nil && strings.TrimSpace(product) != "" {
-		return strings.TrimSpace(product)
-	}
-	if name, err := utils.ReadStringFileLimited(filepath.Join(devicePath, "name"), 128); err == nil && strings.TrimSpace(name) != "" {
-		return strings.TrimSpace(name)
-	}
-	return fmt.Sprintf("Intel GPU %s", filepath.Base(cardPath))
-}

agent/gpu_intel_sysfs_linux_test.go

@@ -1,217 +0,0 @@
-//go:build linux
-
-package agent
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/henrygd/beszel/agent/utils"
-	"github.com/henrygd/beszel/internal/entities/system"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func setupIntelSysfsTest(t *testing.T) (root, cardPath, hwmonPath string) {
-	t.Helper()
-	root = t.TempDir()
-	oldRoot := drmSysfsRoot
-	drmSysfsRoot = root
-	t.Cleanup(func() {
-		drmSysfsRoot = oldRoot
-	})
-
-	cardPath = filepath.Join(root, "card0")
-	devicePath := filepath.Join(cardPath, "device")
-	hwmonPath = filepath.Join(devicePath, "hwmon", "hwmon0")
-	require.NoError(t, os.MkdirAll(hwmonPath, 0o755))
-	return root, cardPath, hwmonPath
-}
-
-func writeIntelSysfsFile(t *testing.T, basePath, name, content string) {
-	t.Helper()
-	require.NoError(t, os.WriteFile(filepath.Join(basePath, name), []byte(content), 0o644))
-}
-
-func setIntelSysfsTime(t *testing.T, now time.Time) {
-	t.Helper()
-	oldNow := intelSysfsNow
-	intelSysfsNow = func() time.Time { return now }
-	t.Cleanup(func() {
-		intelSysfsNow = oldNow
-	})
-}
-
-func TestIntelSysfsDetectsIntelCardWithEnergy(t *testing.T) {
-	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
-	devicePath := filepath.Join(cardPath, "device")
-	writeIntelSysfsFile(t, devicePath, "vendor", "0x8086\n")
-	writeIntelSysfsFile(t, hwmonPath, "name", "xe\n")
-	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "1000000\n")
-
-	gm := &GPUManager{}
-	assert.True(t, gm.hasIntelSysfs())
-
-	cards, err := discoverIntelSysfsCards()
-	require.NoError(t, err)
-	require.Len(t, cards, 1)
-	assert.Equal(t, cardPath, cards[0].cardPath)
-	assert.Equal(t, hwmonPath, cards[0].hwmonDir)
-}
-
-func TestIntelSysfsRejectsNonIntelCard(t *testing.T) {
-	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
-	devicePath := filepath.Join(cardPath, "device")
-	writeIntelSysfsFile(t, devicePath, "vendor", "0x1002\n")
-	writeIntelSysfsFile(t, hwmonPath, "name", "xe\n")
-	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "1000000\n")
-
-	gm := &GPUManager{}
-	assert.False(t, gm.hasIntelSysfs())
-}
-
-func TestIntelSysfsRequiresEnergyInput(t *testing.T) {
-	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
-	devicePath := filepath.Join(cardPath, "device")
-	writeIntelSysfsFile(t, devicePath, "vendor", "0x8086\n")
-	writeIntelSysfsFile(t, hwmonPath, "name", "xe\n")
-
-	gm := &GPUManager{}
-	assert.False(t, gm.hasIntelSysfs())
-}
-
-func TestIntelSysfsFirstSampleInitializesWithoutBogusPower(t *testing.T) {
-	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
-	devicePath := filepath.Join(cardPath, "device")
-	writeIntelSysfsFile(t, devicePath, "vendor", "0x8086\n")
-	writeIntelSysfsFile(t, hwmonPath, "name", "xe\n")
-	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "1000000\n")
-	setIntelSysfsTime(t, time.Unix(100, 0))
-
-	gm := &GPUManager{GpuDataMap: make(map[string]*system.GPUData)}
-	ok := gm.updateIntelSysfsGpuData(cardPath, hwmonPath)
-	require.True(t, ok)
-
-	gpu := gm.GpuDataMap["card0"]
-	require.NotNil(t, gpu)
-	assert.Equal(t, "Intel GPU card0", gpu.Name)
-	assert.Equal(t, 0.0, gpu.Power)
-	assert.Equal(t, 1.0, gpu.Count)
-}
-
-func TestIntelSysfsSecondSampleComputesWatts(t *testing.T) {
-	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
-	devicePath := filepath.Join(cardPath, "device")
-	writeIntelSysfsFile(t, devicePath, "vendor", "0x8086\n")
-	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "1000000\n")
-
-	gm := &GPUManager{GpuDataMap: make(map[string]*system.GPUData)}
-	oldNow := intelSysfsNow
-	intelSysfsNow = func() time.Time { return time.Unix(100, 0) }
-	t.Cleanup(func() { intelSysfsNow = oldNow })
-	require.True(t, gm.updateIntelSysfsGpuData(cardPath, hwmonPath))
-
-	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "6000000\n")
-	intelSysfsNow = func() time.Time { return time.Unix(102, 0) }
-	require.True(t, gm.updateIntelSysfsGpuData(cardPath, hwmonPath))
-
-	gpu := gm.GpuDataMap["card0"]
-	require.NotNil(t, gpu)
-	assert.Equal(t, 2.5, gpu.Power)
-	assert.Equal(t, 2.0, gpu.Count)
-}
-
-func TestIntelSysfsSecondEnergyCounterMapsToPowerPkg(t *testing.T) {
-	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
-	devicePath := filepath.Join(cardPath, "device")
-	writeIntelSysfsFile(t, devicePath, "vendor", "0x8086\n")
-	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "1000000\n")
-	writeIntelSysfsFile(t, hwmonPath, "energy2_input", "2000000\n")
-
-	oldNow := intelSysfsNow
-	t.Cleanup(func() { intelSysfsNow = oldNow })
-	gm := &GPUManager{GpuDataMap: make(map[string]*system.GPUData)}
-	intelSysfsNow = func() time.Time { return time.Unix(100, 0) }
-	require.True(t, gm.updateIntelSysfsGpuData(cardPath, hwmonPath))
-
-	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "2000000\n")
-	writeIntelSysfsFile(t, hwmonPath, "energy2_input", "8000000\n")
-	intelSysfsNow = func() time.Time { return time.Unix(102, 0) }
-	require.True(t, gm.updateIntelSysfsGpuData(cardPath, hwmonPath))
-
-	gpu := gm.GpuDataMap["card0"]
-	require.NotNil(t, gpu)
-	assert.Equal(t, 0.5, gpu.Power)
-	assert.Equal(t, 3.0, gpu.PowerPkg)
-}
-
-func TestIntelSysfsCounterResetSkipsOneSample(t *testing.T) {
-	gm := &GPUManager{}
-	power, ok := gm.calculateIntelSysfsPower("card0", 5000000, time.Unix(100, 0))
-	assert.False(t, ok)
-	assert.Equal(t, 0.0, power)
-
-	power, ok = gm.calculateIntelSysfsPower("card0", 1000000, time.Unix(101, 0))
-	assert.False(t, ok)
-	assert.Equal(t, 0.0, power)
-
-	power, ok = gm.calculateIntelSysfsPower("card0", 3000000, time.Unix(103, 0))
-	assert.True(t, ok)
-	assert.Equal(t, 1.0, power)
-}
-
-func TestIntelSysfsTempInputMapsToCelsius(t *testing.T) {
-	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
-	devicePath := filepath.Join(cardPath, "device")
-	writeIntelSysfsFile(t, devicePath, "vendor", "0x8086\n")
-	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "1000000\n")
-	writeIntelSysfsFile(t, hwmonPath, "temp1_input", "43500\n")
-	setIntelSysfsTime(t, time.Unix(100, 0))
-
-	gm := &GPUManager{GpuDataMap: make(map[string]*system.GPUData)}
-	require.True(t, gm.updateIntelSysfsGpuData(cardPath, hwmonPath))
-
-	gpu := gm.GpuDataMap["card0"]
-	require.NotNil(t, gpu)
-	assert.Equal(t, 43.5, gpu.Temperature)
-}
-
-func TestIntelSysfsMissingOptionalFilesDoNotFail(t *testing.T) {
-	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
-	devicePath := filepath.Join(cardPath, "device")
-	writeIntelSysfsFile(t, devicePath, "vendor", "0x8086\n")
-	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "1000000\n")
-	setIntelSysfsTime(t, time.Unix(100, 0))
-
-	gm := &GPUManager{GpuDataMap: make(map[string]*system.GPUData)}
-	require.True(t, gm.updateIntelSysfsGpuData(cardPath, hwmonPath))
-
-	gpu := gm.GpuDataMap["card0"]
-	require.NotNil(t, gpu)
-	assert.Equal(t, 0.0, gpu.Usage)
-	assert.Equal(t, 0.0, gpu.MemoryUsed)
-	assert.Equal(t, 0.0, gpu.MemoryTotal)
-	assert.Equal(t, 0.0, gpu.Temperature)
-}
-
-func TestIntelSysfsMapsOpportunisticMemoryAndUsage(t *testing.T) {
-	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
-	devicePath := filepath.Join(cardPath, "device")
-	writeIntelSysfsFile(t, devicePath, "vendor", "0x8086\n")
-	writeIntelSysfsFile(t, devicePath, "gpu_busy_percent", "37\n")
-	writeIntelSysfsFile(t, devicePath, "mem_info_lmem_used", "1073741824\n")
-	writeIntelSysfsFile(t, devicePath, "mem_info_lmem_total", "2147483648\n")
-	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "1000000\n")
-	setIntelSysfsTime(t, time.Unix(100, 0))
-
-	gm := &GPUManager{GpuDataMap: make(map[string]*system.GPUData)}
-	require.True(t, gm.updateIntelSysfsGpuData(cardPath, hwmonPath))
-
-	gpu := gm.GpuDataMap["card0"]
-	require.NotNil(t, gpu)
-	assert.Equal(t, 37.0, gpu.Usage)
-	assert.Equal(t, utils.BytesToMegabytes(1073741824), gpu.MemoryUsed)
-	assert.Equal(t, utils.BytesToMegabytes(2147483648), gpu.MemoryTotal)
-}

agent/gpu_intel_sysfs_unsupported.go

@@ -1,13 +0,0 @@
-//go:build !linux
-
-package agent
-
-type intelSysfsEnergySnapshot struct{}
-
-func (gm *GPUManager) hasIntelSysfs() bool {
-	return false
-}
-
-func (gm *GPUManager) startIntelSysfsCollector() bool {
-	return false
-}

agent/gpu_nvtop.go

@@ -5,7 +5,6 @@ import (
 	"io"
 	"log/slog"
 	"os/exec"
-	"path/filepath"
 	"strconv"
 	"strings"
 	"time"
@@ -49,14 +48,9 @@ func (gm *GPUManager) updateNvtopSnapshots(snapshots []nvtopSnapshot) bool {
 
 	valid := false
 	usedIDs := make(map[string]struct{}, len(snapshots))
-	var xeName string
 	for i, sample := range snapshots {
-		// nvtop leaves device_name unset on xe devices.
 		if sample.DeviceName == "" {
-			if xeName == "" {
-				xeName = xeGpuName()
-			}
-			sample.DeviceName = xeName
+			continue
 		}
 		indexID := "n" + strconv.Itoa(i)
 		id := indexID
@@ -164,38 +158,3 @@ func (gm *GPUManager) startNvtopCollector(interval string, onFailure func()) {
 		}
 	}()
 }
-
-// xeDevicePath returns the sysfs device path of the first xe GPU, or "".
-func xeDevicePath() string {
-	cards, err := filepath.Glob("/sys/class/drm/card*")
-	if err != nil {
-		return ""
-	}
-	for _, card := range cards {
-		if strings.Contains(filepath.Base(card), "-") {
-			continue
-		}
-		if uevent, err := utils.ReadStringFileLimited(filepath.Join(card, "device", "uevent"), 4096); err == nil && strings.Contains(uevent, "DRIVER=xe") {
-			return filepath.Join(card, "device")
-		}
-	}
-	return ""
-}
-
-func (gm *GPUManager) hasXe() bool {
-	return xeDevicePath() != ""
-}
-
-// xeGpuName names an xe GPU from its PCI device id; nvtop leaves device_name unset on xe.
-func xeGpuName() string {
-	devicePath := xeDevicePath()
-	if devicePath == "" {
-		return "GPU"
-	}
-	id, err := utils.ReadStringFileLimited(filepath.Join(devicePath, "device"), 64)
-	if err != nil {
-		return "GPU"
-	}
-	id = strings.ToLower(strings.TrimSpace(strings.TrimPrefix(id, "0x")))
-	return "Intel GPU (" + id + ")"
-}

agent/gpu_test.go

@@ -332,12 +332,11 @@ func TestUpdateNvtopSnapshotsKeepsDeviceAssociationWhenOrderChanges(t *testing.T
 }
 
 func TestParseCollectorPriority(t *testing.T) {
-	got := parseCollectorPriority(" nvml, nvidia-smi, intel_gpu_top, intel_sysfs, amd_sysfs, nvtop, rocm-smi, bad ")
+	got := parseCollectorPriority(" nvml, nvidia-smi, intel_gpu_top, amd_sysfs, nvtop, rocm-smi, bad ")
 	want := []collectorSource{
 		collectorSourceNVML,
 		collectorSourceNvidiaSMI,
 		collectorSourceIntelGpuTop,
-		collectorSourceIntelSysfs,
 		collectorSourceAmdSysfs,
 		collectorSourceNVTop,
 		collectorSourceRocmSMI,

agent/handlers.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/fxamacker/cbor/v2"
 	"github.com/henrygd/beszel/internal/common"
+	"github.com/henrygd/beszel/internal/entities/probe"
 	"github.com/henrygd/beszel/internal/entities/smart"
 
 	"log/slog"
@@ -51,6 +52,7 @@ func NewHandlerRegistry() *HandlerRegistry {
 	registry.Register(common.GetContainerInfo, &GetContainerInfoHandler{})
 	registry.Register(common.GetSmartData, &GetSmartDataHandler{})
 	registry.Register(common.GetSystemdInfo, &GetSystemdInfoHandler{})
+	registry.Register(common.SyncNetworkProbes, &SyncNetworkProbesHandler{})
 
 	return registry
 }
@@ -166,16 +168,14 @@ type GetSmartDataHandler struct{}
 
 func (h *GetSmartDataHandler) Handle(hctx *HandlerContext) error {
 	if hctx.Agent.smartManager == nil {
-		return hctx.SendResponse(smart.SmartDataResponse{Data: map[string]smart.SmartData{}}, hctx.RequestID)
+		// return empty map to indicate no data
+		return hctx.SendResponse(map[string]smart.SmartData{}, hctx.RequestID)
 	}
-	complete, err := hctx.Agent.smartManager.Refresh(false)
-	if err != nil {
+	if err := hctx.Agent.smartManager.Refresh(false); err != nil {
 		slog.Debug("smart refresh failed", "err", err)
 	}
-	return hctx.SendResponse(smart.SmartDataResponse{
-		Data:     hctx.Agent.smartManager.GetCurrentData(),
-		Complete: complete,
-	}, hctx.RequestID)
+	data := hctx.Agent.smartManager.GetCurrentData()
+	return hctx.SendResponse(data, hctx.RequestID)
 }
 
 ////////////////////////////////////////////////////////////////////////////
@@ -205,3 +205,21 @@ func (h *GetSystemdInfoHandler) Handle(hctx *HandlerContext) error {
 
 	return hctx.SendResponse(details, hctx.RequestID)
 }
+
+////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////
+
+// SyncNetworkProbesHandler handles probe configuration sync from hub
+type SyncNetworkProbesHandler struct{}
+
+func (h *SyncNetworkProbesHandler) Handle(hctx *HandlerContext) error {
+	var req probe.SyncRequest
+	if err := cbor.Unmarshal(hctx.Request.Data, &req); err != nil {
+		return err
+	}
+	resp, err := hctx.Agent.probeManager.HandleSyncRequest(req)
+	if err != nil {
+		return err
+	}
+	return hctx.SendResponse(resp, hctx.RequestID)
+}

agent/handlers_test.go

@@ -7,7 +7,6 @@ import (
 
 	"github.com/fxamacker/cbor/v2"
 	"github.com/henrygd/beszel/internal/common"
-	"github.com/henrygd/beszel/internal/entities/smart"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -18,18 +17,6 @@ type MockHandler struct {
 	handleFunc           func(ctx *HandlerContext) error
 }
 
-func TestNewAgentResponseSmartData(t *testing.T) {
-	response := newAgentResponse(smart.SmartDataResponse{
-		Data: map[string]smart.SmartData{
-			"AAA": {SerialNumber: "AAA"},
-		},
-		Complete: true,
-	}, nil)
-
-	assert.Equal(t, "AAA", response.SmartData["AAA"].SerialNumber)
-	assert.True(t, response.SmartComplete)
-}
-
 func (m *MockHandler) Handle(ctx *HandlerContext) error {
 	if m.handleFunc != nil {
 		return m.handleFunc(ctx)

agent/mdraid_linux.go

@@ -180,13 +180,8 @@ func mdraidSmartStatus(health mdraidHealth) string {
 	if health.degraded > 0 {
 		return "FAILED"
 	}
-	if health.mismatchCnt > 0 {
-		return "WARNING"
-	}
-	// "check" scans for consistency problems without repairing mismatches.
-	// With no mismatches, keep it green while reporting progress attributes.
 	switch syncAction {
-	case "repair":
+	case "check", "repair":
 		return "WARNING"
 	}
 	switch state {

agent/mdraid_linux_test.go

@@ -94,18 +94,6 @@ func TestMdraidSmartStatus(t *testing.T) {
 	if got := mdraidSmartStatus(mdraidHealth{arrayState: "active", syncAction: "recover"}); got != "WARNING" {
 		t.Fatalf("mdraidSmartStatus(recover) = %q, want WARNING", got)
 	}
-	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", syncAction: "check"}); got != "PASSED" {
-		t.Fatalf("mdraidSmartStatus(clean+check) = %q, want PASSED", got)
-	}
-	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", syncAction: "check", mismatchCnt: 1}); got != "WARNING" {
-		t.Fatalf("mdraidSmartStatus(clean+check+mismatch) = %q, want WARNING", got)
-	}
-	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", mismatchCnt: 1}); got != "WARNING" {
-		t.Fatalf("mdraidSmartStatus(clean+mismatch) = %q, want WARNING", got)
-	}
-	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", syncAction: "repair"}); got != "WARNING" {
-		t.Fatalf("mdraidSmartStatus(repair) = %q, want WARNING", got)
-	}
 	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean"}); got != "PASSED" {
 		t.Fatalf("mdraidSmartStatus(clean) = %q, want PASSED", got)
 	}

agent/probe.go

@@ -0,0 +1,538 @@
+package agent
+
+import (
+	"errors"
+	"fmt"
+	"math"
+	"math/rand"
+	"net"
+	"net/http"
+
+	// "strconv"
+	"sync"
+	"time"
+
+	"log/slog"
+
+	"github.com/henrygd/beszel/internal/entities/probe"
+)
+
+// Probes run at user-defined intervals (e.g., every 10s).
+// To keep memory usage low and constant, data is stored in two layers:
+// 1. Raw samples: The most recent individual results (kept for probeRawRetention).
+// 2. Minute buckets: A ring buffer of 61 buckets, each representing one
+//    wall-clock minute. Samples collected within the same minute are aggregated
+//    (sum, min, max, count) into a single bucket.
+//
+// Short-term requests (<= 70s) use raw samples.
+// Long-term requests (up to 1h) use the minute buckets to avoid storing thousands
+// of individual data points.
+
+const (
+	// probeRawRetention is the duration to keep individual samples
+	probeRawRetention = 61 * time.Second
+	// probeMinuteBucketLen is the number of 1-minute buckets to keep (1 hour + 1 for partials)
+	probeMinuteBucketLen int32 = 61
+)
+
+// ProbeManager manages network probe tasks.
+type ProbeManager struct {
+	mu         sync.RWMutex
+	probes     map[string]*probeTask // key = probe.Config.Key()
+	httpClient *http.Client
+}
+
+// probeTask owns retention buffers and cancellation for a single probe config.
+type probeTask struct {
+	config  probe.Config
+	cancel  chan struct{}
+	mu      sync.Mutex
+	samples []probeSample
+	buckets [probeMinuteBucketLen]probeBucket
+}
+
+// probeSample stores one probe attempt and its collection time.
+type probeSample struct {
+	responseUs int64 // -1 means loss
+	timestamp  time.Time
+}
+
+// probeBucket stores one minute of aggregated probe data.
+type probeBucket struct {
+	minute int32
+	filled bool
+	stats  probeAggregate
+}
+
+// probeAggregate accumulates successful response stats and total sample counts.
+type probeAggregate struct {
+	sumUs        int64
+	minUs        int64
+	maxUs        int64
+	totalCount   int64
+	successCount int64
+}
+
+func newProbeManager() *ProbeManager {
+	return &ProbeManager{
+		probes:     make(map[string]*probeTask),
+		httpClient: &http.Client{Timeout: 10 * time.Second},
+	}
+}
+
+func newProbeTask(config probe.Config) *probeTask {
+	return &probeTask{
+		config:  config,
+		cancel:  make(chan struct{}),
+		samples: make([]probeSample, 0, 64),
+	}
+}
+
+func newProbeTaskFromExisting(config probe.Config, existing *probeTask) *probeTask {
+	task := newProbeTask(config)
+	if existing == nil {
+		return task
+	}
+
+	existing.mu.Lock()
+	defer existing.mu.Unlock()
+	task.samples = append(task.samples, existing.samples...)
+	task.buckets = existing.buckets
+	return task
+}
+
+// newProbeAggregate initializes an aggregate with an unset minimum value.
+func newProbeAggregate() probeAggregate {
+	return probeAggregate{minUs: math.MaxInt64}
+}
+
+// addResponse folds a single probe sample into the aggregate.
+func (agg *probeAggregate) addResponse(responseUs int64) {
+	agg.totalCount++
+	if responseUs < 0 {
+		return
+	}
+	agg.successCount++
+	agg.sumUs += responseUs
+	if responseUs < agg.minUs {
+		agg.minUs = responseUs
+	}
+	if responseUs > agg.maxUs {
+		agg.maxUs = responseUs
+	}
+}
+
+// addAggregate merges another aggregate into this one.
+func (agg *probeAggregate) addAggregate(other probeAggregate) {
+	if other.totalCount == 0 {
+		return
+	}
+	agg.totalCount += other.totalCount
+	agg.successCount += other.successCount
+	agg.sumUs += other.sumUs
+	if other.successCount == 0 {
+		return
+	}
+	if agg.minUs == math.MaxInt64 || other.minUs < agg.minUs {
+		agg.minUs = other.minUs
+	}
+	if other.maxUs > agg.maxUs {
+		agg.maxUs = other.maxUs
+	}
+}
+
+// hasData reports whether the aggregate contains any samples.
+func (agg probeAggregate) hasData() bool {
+	return agg.totalCount > 0
+}
+
+// result converts the aggregate into the probe result format.
+func (agg probeAggregate) result() probe.Result {
+	avg := agg.avgResponse()
+	result := probe.Result{
+		AvgResponse: avg,
+		MinResponse: agg.minUs,
+		MaxResponse: agg.maxUs,
+		PacketLoss:  agg.lossPercentage(),
+	}
+	if agg.successCount == 0 {
+		result.MinResponse, result.MaxResponse = 0, 0
+	}
+	return result
+}
+
+// avgResponse returns the rounded average of successful samples.
+func (agg probeAggregate) avgResponse() int64 {
+	if agg.successCount == 0 {
+		return 0
+	}
+	return agg.sumUs / agg.successCount
+
+}
+
+// lossPercentage returns the rounded failure rate for the aggregate.
+func (agg probeAggregate) lossPercentage() float64 {
+	if agg.totalCount == 0 {
+		return 0
+	}
+	return math.Round(float64(agg.totalCount-agg.successCount)/float64(agg.totalCount)*10000) / 100
+}
+
+// SyncProbes replaces all probe tasks with the given configs.
+func (pm *ProbeManager) SyncProbes(configs []probe.Config) {
+	pm.mu.Lock()
+	defer pm.mu.Unlock()
+
+	// Build set of new keys
+	newKeys := make(map[string]probe.Config, len(configs))
+	for _, cfg := range configs {
+		if cfg.ID == "" {
+			continue
+		}
+		newKeys[cfg.ID] = cfg
+	}
+
+	// Stop removed probes
+	for key, task := range pm.probes {
+		if _, exists := newKeys[key]; !exists {
+			close(task.cancel)
+			delete(pm.probes, key)
+		}
+	}
+
+	// Start new probes and restart tasks whose config changed.
+	for key, cfg := range newKeys {
+		task, exists := pm.probes[key]
+		if exists && task.config == cfg {
+			continue
+		}
+		if exists {
+			close(task.cancel)
+		}
+		task = newProbeTaskFromExisting(cfg, task)
+		pm.probes[key] = task
+		go pm.runProbe(task, false)
+	}
+}
+
+// HandleSyncRequest applies a full or incremental probe sync request.
+func (pm *ProbeManager) HandleSyncRequest(req probe.SyncRequest) (probe.SyncResponse, error) {
+	switch req.Action {
+	case probe.SyncActionReplace:
+		pm.SyncProbes(req.Configs)
+		return probe.SyncResponse{}, nil
+	case probe.SyncActionUpsert:
+		result, err := pm.UpsertProbe(req.Config, req.RunNow)
+		if err != nil {
+			return probe.SyncResponse{}, err
+		}
+		if result == nil {
+			return probe.SyncResponse{}, nil
+		}
+		return probe.SyncResponse{Result: *result}, nil
+	case probe.SyncActionDelete:
+		if req.Config.ID == "" {
+			return probe.SyncResponse{}, errors.New("missing probe ID for delete")
+		}
+		pm.DeleteProbe(req.Config.ID)
+		return probe.SyncResponse{}, nil
+	default:
+		return probe.SyncResponse{}, fmt.Errorf("unknown probe sync action: %d", req.Action)
+	}
+}
+
+// UpsertProbe creates or replaces a single probe task.
+func (pm *ProbeManager) UpsertProbe(config probe.Config, runNow bool) (*probe.Result, error) {
+	if config.ID == "" {
+		return nil, errors.New("missing probe ID")
+	}
+
+	pm.mu.Lock()
+	task, exists := pm.probes[config.ID]
+	startTask := false
+	if exists && task.config == config {
+		pm.mu.Unlock()
+		if !runNow {
+			return nil, nil
+		}
+		return pm.runProbeNow(task), nil
+	}
+	if exists {
+		close(task.cancel)
+	}
+	task = newProbeTaskFromExisting(config, task)
+	pm.probes[config.ID] = task
+	startTask = true
+	pm.mu.Unlock()
+
+	if runNow {
+		result := pm.runProbeNow(task)
+		if startTask {
+			go pm.runProbe(task, false)
+		}
+		return result, nil
+	}
+	if startTask {
+		go pm.runProbe(task, false)
+	}
+	return nil, nil
+}
+
+// DeleteProbe stops and removes a single probe task.
+func (pm *ProbeManager) DeleteProbe(id string) {
+	if id == "" {
+		return
+	}
+	pm.mu.Lock()
+	defer pm.mu.Unlock()
+	if task, exists := pm.probes[id]; exists {
+		close(task.cancel)
+		delete(pm.probes, id)
+	}
+}
+
+// GetResults returns aggregated results for all probes over the last supplied duration in ms.
+func (pm *ProbeManager) GetResults(durationMs uint16) map[string]probe.Result {
+	pm.mu.RLock()
+	defer pm.mu.RUnlock()
+
+	results := make(map[string]probe.Result, len(pm.probes))
+	now := time.Now()
+	duration := time.Duration(durationMs) * time.Millisecond
+
+	for _, task := range pm.probes {
+		task.mu.Lock()
+		result, ok := task.resultLocked(duration, now)
+		task.mu.Unlock()
+
+		if !ok {
+			continue
+		}
+		results[task.config.ID] = result
+	}
+
+	return results
+}
+
+// Stop stops all probe tasks.
+func (pm *ProbeManager) Stop() {
+	pm.mu.Lock()
+	defer pm.mu.Unlock()
+	for key, task := range pm.probes {
+		close(task.cancel)
+		delete(pm.probes, key)
+	}
+}
+
+// runProbe executes a single probe task in a loop.
+func (pm *ProbeManager) runProbe(task *probeTask, runNow bool) {
+	interval := time.Duration(task.config.Interval) * time.Second
+	if interval < time.Second {
+		interval = 30 * time.Second
+	}
+
+	stagger := getStagger(interval.Milliseconds())
+
+	slog.Debug("starting probe task", "target", task.config.Target, "delay", stagger.String(), "interval", interval.String())
+
+	if runNow {
+		pm.executeProbe(task)
+	}
+
+	select {
+	case <-task.cancel:
+		// slog.Info("removed probe", "target", task.config.Target)
+		return
+	case <-time.After(stagger):
+		pm.executeProbe(task)
+	}
+
+	ticker := time.Tick(interval)
+
+	for {
+		select {
+		case <-task.cancel:
+			// slog.Info("removed probe", "target", task.config.Target)
+			return
+		case <-ticker:
+			pm.executeProbe(task)
+		}
+	}
+}
+
+// getStagger returns a random duration between intervalSeconds/2 and intervalSeconds to stagger initial probe executions
+func getStagger(intervalMilli int64) time.Duration {
+	intervalMilliInt := int(intervalMilli)
+	randomDelayInt := rand.Intn(intervalMilliInt)
+	if randomDelayInt < intervalMilliInt/2 {
+		randomDelayInt += intervalMilliInt / 2
+	}
+	return time.Duration(randomDelayInt) * time.Millisecond
+}
+
+func (pm *ProbeManager) runProbeNow(task *probeTask) *probe.Result {
+	pm.executeProbe(task)
+	task.mu.Lock()
+	defer task.mu.Unlock()
+	result, ok := task.resultLocked(time.Minute, time.Now())
+	if !ok {
+		return nil
+	}
+	return &result
+}
+
+// resultLocked returns the aggregated probe result for the requested duration along with a bool indicating whether any data was available.
+func (task *probeTask) resultLocked(duration time.Duration, now time.Time) (probe.Result, bool) {
+	agg := task.aggregateLocked(duration, now)
+	hourAgg := task.aggregateLocked(time.Hour, now)
+	if !agg.hasData() {
+		return probe.Result{}, false
+	}
+
+	result := agg.result()
+
+	result.AvgResponse1h = hourAgg.avgResponse()
+	result.MinResponse1h = hourAgg.minUs
+	result.MaxResponse1h = hourAgg.maxUs
+	result.PacketLoss1h = hourAgg.lossPercentage()
+
+	if hourAgg.successCount == 0 {
+		result.MinResponse1h, result.MaxResponse1h = 0, 0
+	}
+	return result, true
+}
+
+// aggregateLocked collects probe data for the requested time window.
+func (task *probeTask) aggregateLocked(duration time.Duration, now time.Time) probeAggregate {
+	cutoff := now.Add(-duration)
+	// Keep short windows exact; longer windows read from minute buckets to avoid raw-sample retention.
+	if duration <= probeRawRetention {
+		return aggregateSamplesSince(task.samples, cutoff)
+	}
+	return aggregateBucketsSince(task.buckets[:], cutoff, now)
+}
+
+// aggregateSamplesSince aggregates raw samples newer than the cutoff.
+func aggregateSamplesSince(samples []probeSample, cutoff time.Time) probeAggregate {
+	agg := newProbeAggregate()
+	for _, sample := range samples {
+		if sample.timestamp.Before(cutoff) {
+			continue
+		}
+		agg.addResponse(sample.responseUs)
+	}
+	return agg
+}
+
+// aggregateBucketsSince aggregates minute buckets overlapping the requested window.
+func aggregateBucketsSince(buckets []probeBucket, cutoff, now time.Time) probeAggregate {
+	agg := newProbeAggregate()
+	startMinute := int32(cutoff.Unix() / 60)
+	endMinute := int32(now.Unix() / 60)
+	for _, bucket := range buckets {
+		if !bucket.filled || bucket.minute < startMinute || bucket.minute > endMinute {
+			continue
+		}
+		agg.addAggregate(bucket.stats)
+	}
+	return agg
+}
+
+// addSampleLocked stores a fresh sample in both raw and per-minute retention buffers.
+func (task *probeTask) addSampleLocked(sample probeSample) {
+	cutoff := sample.timestamp.Add(-probeRawRetention)
+	start := 0
+	for i := range task.samples {
+		if !task.samples[i].timestamp.Before(cutoff) {
+			start = i
+			break
+		}
+		if i == len(task.samples)-1 {
+			start = len(task.samples)
+		}
+	}
+	if start > 0 {
+		size := copy(task.samples, task.samples[start:])
+		task.samples = task.samples[:size]
+	}
+	task.samples = append(task.samples, sample)
+
+	minute := int32(sample.timestamp.Unix() / 60)
+	// Each slot stores one wall-clock minute, so the ring stays fixed-size at ~1h per probe.
+	bucket := &task.buckets[minute%probeMinuteBucketLen]
+	if !bucket.filled || bucket.minute != minute {
+		bucket.minute = minute
+		bucket.filled = true
+		bucket.stats = newProbeAggregate()
+	}
+	bucket.stats.addResponse(sample.responseUs)
+}
+
+// executeProbe runs the configured probe and records the sample.
+func (pm *ProbeManager) executeProbe(task *probeTask) {
+	// slog.Info("running probe", "id", task.config.ID, "interval", task.config.Interval)
+	var responseUs int64
+	var err error
+
+	switch task.config.Protocol {
+	case "icmp":
+		responseUs, err = probeICMP(task.config.Target)
+	case "tcp":
+		responseUs, err = probeTCP(task.config.Target, task.config.Port)
+	case "http":
+		responseUs, err = probeHTTP(pm.httpClient, task.config.Target)
+	default:
+		slog.Warn("unknown probe protocol", "protocol", task.config.Protocol)
+		return
+	}
+
+	if err != nil {
+		slog.Warn("probe failed", "err", err, "target", task.config.Target, "protocol", task.config.Protocol)
+	}
+
+	sample := probeSample{
+		responseUs: responseUs,
+		timestamp:  time.Now(),
+	}
+
+	task.mu.Lock()
+	task.addSampleLocked(sample)
+	task.mu.Unlock()
+}
+
+// probeTCP measures pure TCP handshake response (excluding DNS resolution).
+// Returns -1 and an error on failure.
+func probeTCP(target string, port uint16) (int64, error) {
+	// Resolve DNS first, outside the timing window
+	ips, err := net.LookupHost(target)
+	if err != nil || len(ips) == 0 {
+		return -1, err
+	}
+	addr := net.JoinHostPort(ips[0], fmt.Sprintf("%d", port))
+
+	// Measure only the TCP handshake
+	start := time.Now()
+	conn, err := net.DialTimeout("tcp", addr, 3*time.Second)
+	if err != nil {
+		return -1, err
+	}
+	conn.Close()
+	return time.Since(start).Microseconds(), nil
+}
+
+// probeHTTP measures HTTP GET request response in microseconds. Returns -1 and an error on failure.
+func probeHTTP(client *http.Client, url string) (int64, error) {
+	if client == nil {
+		client = http.DefaultClient
+	}
+	start := time.Now()
+	resp, err := client.Get(url)
+	if err != nil {
+		return -1, err
+	}
+	resp.Body.Close()
+	if resp.StatusCode >= 400 {
+		return -1, fmt.Errorf("HTTP error: %s", resp.Status)
+	}
+	return time.Since(start).Microseconds(), nil
+}

agent/probe_ping.go

@@ -0,0 +1,241 @@
+package agent
+
+import (
+	"errors"
+	"math"
+	"net"
+	"os"
+	"os/exec"
+	"regexp"
+	"runtime"
+	"strconv"
+	"sync"
+	"time"
+
+	"golang.org/x/net/icmp"
+	"golang.org/x/net/ipv4"
+	"golang.org/x/net/ipv6"
+
+	"log/slog"
+)
+
+var pingTimeRegex = regexp.MustCompile(`time[=<]([\d.]+)\s*ms`)
+
+type icmpPacketConn interface {
+	Close() error
+}
+
+// icmpMethod tracks which ICMP approach to use. Once a method succeeds or
+// all native methods fail, the choice is cached so subsequent probes skip
+// the trial-and-error overhead.
+type icmpMethod uint8
+
+const (
+	icmpUntried      icmpMethod = iota // haven't tried yet
+	icmpRaw                            // privileged raw socket
+	icmpDatagram                       // unprivileged datagram socket
+	icmpExecFallback                   // shell out to system ping command
+)
+
+// icmpFamily holds the network parameters and cached detection result for one address family.
+type icmpFamily struct {
+	rawNetwork   string    // e.g. "ip4:icmp" or "ip6:ipv6-icmp"
+	dgramNetwork string    // e.g. "udp4" or "udp6"
+	listenAddr   string    // "0.0.0.0" or "::"
+	echoType     icmp.Type // outgoing echo request type
+	replyType    icmp.Type // expected echo reply type
+	proto        int       // IANA protocol number for parsing replies
+	isIPv6       bool
+	mode         icmpMethod // cached detection result (guarded by icmpModeMu)
+}
+
+var (
+	icmpV4 = icmpFamily{
+		rawNetwork:   "ip4:icmp",
+		dgramNetwork: "udp4",
+		listenAddr:   "0.0.0.0",
+		echoType:     ipv4.ICMPTypeEcho,
+		replyType:    ipv4.ICMPTypeEchoReply,
+		proto:        1,
+	}
+	icmpV6 = icmpFamily{
+		rawNetwork:   "ip6:ipv6-icmp",
+		dgramNetwork: "udp6",
+		listenAddr:   "::",
+		echoType:     ipv6.ICMPTypeEchoRequest,
+		replyType:    ipv6.ICMPTypeEchoReply,
+		proto:        58,
+		isIPv6:       true,
+	}
+	icmpModeMu sync.Mutex
+	icmpListen = func(network, listenAddr string) (icmpPacketConn, error) {
+		return icmp.ListenPacket(network, listenAddr)
+	}
+)
+
+// probeICMP sends an ICMP echo request and measures round-trip response.
+// Supports both IPv4 and IPv6 targets. The ICMP method (raw socket,
+// unprivileged datagram, or exec fallback) is detected once per address
+// family and cached for subsequent probes.
+// Returns response in microseconds, or -1 and an error on failure.
+func probeICMP(target string) (int64, error) {
+	family, ip, err := resolveICMPTarget(target)
+	if err != nil {
+		return -1, err
+	}
+
+	icmpModeMu.Lock()
+	if family.mode == icmpUntried {
+		family.mode = detectICMPMode(family, icmpListen)
+	}
+	mode := family.mode
+	icmpModeMu.Unlock()
+
+	switch mode {
+	case icmpRaw:
+		return probeICMPNative(family.rawNetwork, family, &net.IPAddr{IP: ip})
+	case icmpDatagram:
+		return probeICMPNative(family.dgramNetwork, family, &net.UDPAddr{IP: ip})
+	case icmpExecFallback:
+		return probeICMPExec(target, family.isIPv6)
+	default:
+		return -1, errors.New("unsupported ICMP mode")
+	}
+}
+
+// resolveICMPTarget resolves a target hostname or IP to determine the address
+// family and concrete IP address. Prefers IPv4 for dual-stack hostnames.
+func resolveICMPTarget(target string) (*icmpFamily, net.IP, error) {
+	if ip := net.ParseIP(target); ip != nil {
+		if ip.To4() != nil {
+			return &icmpV4, ip.To4(), nil
+		}
+		return &icmpV6, ip, nil
+	}
+
+	ips, err := net.LookupIP(target)
+	if err != nil || len(ips) == 0 {
+		return nil, nil, err
+	}
+	for _, ip := range ips {
+		if v4 := ip.To4(); v4 != nil {
+			return &icmpV4, v4, nil
+		}
+	}
+	return &icmpV6, ips[0], nil
+}
+
+func detectICMPMode(family *icmpFamily, listen func(network, listenAddr string) (icmpPacketConn, error)) icmpMethod {
+	label := "IPv4"
+	if family.isIPv6 {
+		label = "IPv6"
+	}
+
+	conn, err := listen(family.rawNetwork, family.listenAddr)
+	slog.Debug("ICMP raw socket test", "family", label, "err", err)
+	if err == nil {
+		conn.Close()
+		return icmpRaw
+	}
+
+	conn, err = listen(family.dgramNetwork, family.listenAddr)
+	slog.Debug("ICMP datagram socket test", "family", label, "err", err)
+	if err == nil {
+		conn.Close()
+		return icmpDatagram
+	}
+
+	return icmpExecFallback
+}
+
+// probeICMPNative sends an ICMP echo request using Go's x/net/icmp package.
+func probeICMPNative(network string, family *icmpFamily, dst net.Addr) (int64, error) {
+	conn, err := icmp.ListenPacket(network, family.listenAddr)
+	if err != nil {
+		return -1, err
+	}
+	defer conn.Close()
+
+	// Build ICMP echo request
+	msg := &icmp.Message{
+		Type: family.echoType,
+		Code: 0,
+		Body: &icmp.Echo{
+			ID:   os.Getpid() & 0xffff,
+			Seq:  1,
+			Data: []byte("beszel-probe"),
+		},
+	}
+	msgBytes, err := msg.Marshal(nil)
+	if err != nil {
+		return -1, err
+	}
+
+	// Set deadline before sending
+	conn.SetDeadline(time.Now().Add(3 * time.Second))
+
+	start := time.Now()
+	if _, err := conn.WriteTo(msgBytes, dst); err != nil {
+		return -1, err
+	}
+
+	// Read reply
+	buf := make([]byte, 1500)
+	for {
+		n, _, err := conn.ReadFrom(buf)
+		if err != nil {
+			return -1, err
+		}
+
+		reply, err := icmp.ParseMessage(family.proto, buf[:n])
+		if err != nil {
+			return -1, err
+		}
+
+		if reply.Type == family.replyType {
+			return time.Since(start).Microseconds(), nil
+		}
+		// Ignore non-echo-reply messages (e.g. destination unreachable) and keep reading
+	}
+}
+
+// probeICMPExec falls back to the system ping command. Returns -1 and an error on failure.
+func probeICMPExec(target string, isIPv6 bool) (int64, error) {
+	var cmd *exec.Cmd
+	switch runtime.GOOS {
+	case "windows":
+		if isIPv6 {
+			cmd = exec.Command("ping", "-6", "-n", "1", "-w", "3000", target)
+		} else {
+			cmd = exec.Command("ping", "-n", "1", "-w", "3000", target)
+		}
+	default:
+		if isIPv6 {
+			cmd = exec.Command("ping", "-6", "-c", "1", "-W", "3", target)
+		} else {
+			cmd = exec.Command("ping", "-c", "1", "-W", "3", target)
+		}
+	}
+
+	start := time.Now()
+	output, err := cmd.Output()
+	if err != nil {
+		// If ping fails but we got output, still try to parse
+		if len(output) == 0 {
+			return -1, err
+		}
+	}
+
+	matches := pingTimeRegex.FindSubmatch(output)
+	if len(matches) >= 2 {
+		if ms, err := strconv.ParseFloat(string(matches[1]), 64); err == nil {
+			return int64(math.Round(ms * 1000)), nil
+		}
+	}
+
+	// Fallback: use wall clock time if ping succeeded but parsing failed
+	if err == nil {
+		return time.Since(start).Microseconds(), nil
+	}
+	return -1, err
+}

agent/probe_ping_test.go

@@ -0,0 +1,121 @@
+//go:build testing
+
+package agent
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type testICMPPacketConn struct{}
+
+func (testICMPPacketConn) Close() error { return nil }
+
+func TestDetectICMPMode(t *testing.T) {
+	tests := []struct {
+		name         string
+		family       *icmpFamily
+		rawErr       error
+		udpErr       error
+		want         icmpMethod
+		wantNetworks []string
+	}{
+		{
+			name:         "IPv4 prefers raw socket when available",
+			family:       &icmpV4,
+			want:         icmpRaw,
+			wantNetworks: []string{"ip4:icmp"},
+		},
+		{
+			name:         "IPv4 uses datagram when raw unavailable",
+			family:       &icmpV4,
+			rawErr:       errors.New("operation not permitted"),
+			want:         icmpDatagram,
+			wantNetworks: []string{"ip4:icmp", "udp4"},
+		},
+		{
+			name:         "IPv4 falls back to exec when both unavailable",
+			family:       &icmpV4,
+			rawErr:       errors.New("operation not permitted"),
+			udpErr:       errors.New("protocol not supported"),
+			want:         icmpExecFallback,
+			wantNetworks: []string{"ip4:icmp", "udp4"},
+		},
+		{
+			name:         "IPv6 prefers raw socket when available",
+			family:       &icmpV6,
+			want:         icmpRaw,
+			wantNetworks: []string{"ip6:ipv6-icmp"},
+		},
+		{
+			name:         "IPv6 uses datagram when raw unavailable",
+			family:       &icmpV6,
+			rawErr:       errors.New("operation not permitted"),
+			want:         icmpDatagram,
+			wantNetworks: []string{"ip6:ipv6-icmp", "udp6"},
+		},
+		{
+			name:         "IPv6 falls back to exec when both unavailable",
+			family:       &icmpV6,
+			rawErr:       errors.New("operation not permitted"),
+			udpErr:       errors.New("protocol not supported"),
+			want:         icmpExecFallback,
+			wantNetworks: []string{"ip6:ipv6-icmp", "udp6"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			calls := make([]string, 0, 2)
+			listen := func(network, listenAddr string) (icmpPacketConn, error) {
+				require.Equal(t, tt.family.listenAddr, listenAddr)
+				calls = append(calls, network)
+				switch network {
+				case tt.family.rawNetwork:
+					if tt.rawErr != nil {
+						return nil, tt.rawErr
+					}
+				case tt.family.dgramNetwork:
+					if tt.udpErr != nil {
+						return nil, tt.udpErr
+					}
+				default:
+					t.Fatalf("unexpected network %q", network)
+				}
+				return testICMPPacketConn{}, nil
+			}
+
+			assert.Equal(t, tt.want, detectICMPMode(tt.family, listen))
+			assert.Equal(t, tt.wantNetworks, calls)
+		})
+	}
+}
+
+func TestResolveICMPTarget(t *testing.T) {
+	t.Run("IPv4 literal", func(t *testing.T) {
+		family, ip, err := resolveICMPTarget("127.0.0.1")
+		require.NoError(t, err)
+		require.NotNil(t, family)
+		assert.False(t, family.isIPv6)
+		assert.Equal(t, "127.0.0.1", ip.String())
+	})
+
+	t.Run("IPv6 literal", func(t *testing.T) {
+		family, ip, err := resolveICMPTarget("::1")
+		require.NoError(t, err)
+		require.NotNil(t, family)
+		assert.True(t, family.isIPv6)
+		assert.Equal(t, "::1", ip.String())
+	})
+
+	t.Run("IPv4-mapped IPv6 resolves as IPv4", func(t *testing.T) {
+		family, ip, err := resolveICMPTarget("::ffff:127.0.0.1")
+		require.NoError(t, err)
+		require.NotNil(t, family)
+		assert.False(t, family.isIPv6)
+		assert.Equal(t, "127.0.0.1", ip.String())
+	})
+}

agent/probe_test.go

@@ -0,0 +1,356 @@
+package agent
+
+import (
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/henrygd/beszel/internal/entities/probe"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestProbeTaskAggregateLockedUsesRawSamplesForShortWindows(t *testing.T) {
+	now := time.Date(2026, time.April, 21, 12, 0, 0, 0, time.UTC)
+	task := &probeTask{}
+
+	task.addSampleLocked(probeSample{responseUs: 10, timestamp: now.Add(-90 * time.Second)})
+	task.addSampleLocked(probeSample{responseUs: 20, timestamp: now.Add(-30 * time.Second)})
+	task.addSampleLocked(probeSample{responseUs: -1, timestamp: now.Add(-10 * time.Second)})
+
+	agg := task.aggregateLocked(time.Minute, now)
+	require.True(t, agg.hasData())
+	assert.Equal(t, int64(2), agg.totalCount)
+	assert.Equal(t, int64(1), agg.successCount)
+	result := agg.result()
+	assert.Equal(t, int64(20), result.AvgResponse)
+	assert.Equal(t, int64(20), result.MinResponse)
+	assert.Equal(t, int64(20), result.MaxResponse)
+	assert.Equal(t, 50.0, result.PacketLoss)
+}
+
+func TestProbeTaskAggregateLockedUsesMinuteBucketsForLongWindows(t *testing.T) {
+	now := time.Date(2026, time.April, 21, 12, 0, 30, 0, time.UTC)
+	task := &probeTask{}
+
+	task.addSampleLocked(probeSample{responseUs: 10, timestamp: now.Add(-11 * time.Minute)})
+	task.addSampleLocked(probeSample{responseUs: 20, timestamp: now.Add(-9 * time.Minute)})
+	task.addSampleLocked(probeSample{responseUs: 40, timestamp: now.Add(-5 * time.Minute)})
+	task.addSampleLocked(probeSample{responseUs: -1, timestamp: now.Add(-90 * time.Second)})
+	task.addSampleLocked(probeSample{responseUs: 30, timestamp: now.Add(-30 * time.Second)})
+
+	agg := task.aggregateLocked(10*time.Minute, now)
+	require.True(t, agg.hasData())
+	assert.Equal(t, int64(4), agg.totalCount)
+	assert.Equal(t, int64(3), agg.successCount)
+	result := agg.result()
+	assert.Equal(t, int64(30), result.AvgResponse)
+	assert.Equal(t, int64(20), result.MinResponse)
+	assert.Equal(t, int64(40), result.MaxResponse)
+	assert.Equal(t, 25.0, result.PacketLoss)
+}
+
+func TestProbeTaskAddSampleLockedTrimsRawSamplesButKeepsBucketHistory(t *testing.T) {
+	now := time.Date(2026, time.April, 21, 12, 0, 0, 0, time.UTC)
+	task := &probeTask{}
+
+	task.addSampleLocked(probeSample{responseUs: 10, timestamp: now.Add(-10 * time.Minute)})
+	task.addSampleLocked(probeSample{responseUs: 20, timestamp: now})
+
+	require.Len(t, task.samples, 1)
+	assert.Equal(t, int64(20), task.samples[0].responseUs)
+
+	agg := task.aggregateLocked(10*time.Minute, now)
+	require.True(t, agg.hasData())
+	assert.Equal(t, int64(2), agg.totalCount)
+	assert.Equal(t, int64(2), agg.successCount)
+	result := agg.result()
+	assert.Equal(t, int64(15), result.AvgResponse)
+	assert.Equal(t, int64(10), result.MinResponse)
+	assert.Equal(t, int64(20), result.MaxResponse)
+	assert.Equal(t, 0.0, result.PacketLoss)
+}
+
+func TestProbeManagerGetResultsIncludesHourResponseRange(t *testing.T) {
+	now := time.Now().UTC()
+	task := &probeTask{config: probe.Config{ID: "probe-1"}}
+	task.addSampleLocked(probeSample{responseUs: 10, timestamp: now.Add(-30 * time.Minute)})
+	task.addSampleLocked(probeSample{responseUs: 20, timestamp: now.Add(-9 * time.Minute)})
+	task.addSampleLocked(probeSample{responseUs: 40, timestamp: now.Add(-5 * time.Minute)})
+	task.addSampleLocked(probeSample{responseUs: 30, timestamp: now.Add(-50 * time.Second)})
+	task.addSampleLocked(probeSample{responseUs: -1, timestamp: now.Add(-30 * time.Second)})
+
+	pm := &ProbeManager{probes: map[string]*probeTask{"icmp:example.com": task}}
+
+	results := pm.GetResults(uint16(time.Minute / time.Millisecond))
+	result, ok := results["probe-1"]
+	require.True(t, ok)
+	assert.Equal(t, int64(30), result.AvgResponse)
+	assert.Equal(t, int64(25), result.AvgResponse1h)
+	assert.Equal(t, int64(30), result.MinResponse)
+	assert.Equal(t, int64(10), result.MinResponse1h)
+	assert.Equal(t, int64(30), result.MaxResponse)
+	assert.Equal(t, int64(40), result.MaxResponse1h)
+	assert.Equal(t, 50.0, result.PacketLoss)
+	assert.Equal(t, 20.0, result.PacketLoss1h)
+}
+
+func TestProbeManagerGetResultsIncludesLossOnlyHourData(t *testing.T) {
+	now := time.Now().UTC()
+	task := &probeTask{config: probe.Config{ID: "probe-1"}}
+	task.addSampleLocked(probeSample{responseUs: -1, timestamp: now.Add(-30 * time.Second)})
+	task.addSampleLocked(probeSample{responseUs: -1, timestamp: now.Add(-10 * time.Second)})
+
+	pm := &ProbeManager{probes: map[string]*probeTask{"icmp:example.com": task}}
+
+	results := pm.GetResults(uint16(time.Minute / time.Millisecond))
+	result, ok := results["probe-1"]
+	require.True(t, ok)
+	assert.Equal(t, int64(0), result.AvgResponse)
+	assert.Equal(t, int64(0), result.AvgResponse1h)
+	assert.Equal(t, int64(0), result.MinResponse)
+	assert.Equal(t, int64(0), result.MinResponse1h)
+	assert.Equal(t, int64(0), result.MaxResponse)
+	assert.Equal(t, int64(0), result.MaxResponse1h)
+	assert.Equal(t, 100.0, result.PacketLoss)
+	assert.Equal(t, 100.0, result.PacketLoss1h)
+}
+
+func TestProbeConfigResultKeyUsesSyncedID(t *testing.T) {
+	cfg := probe.Config{ID: "probe-1", Target: "1.1.1.1", Protocol: "icmp", Interval: 10}
+	assert.Equal(t, "probe-1", cfg.ID)
+}
+
+func TestProbeManagerSyncProbesSkipsConfigsWithoutStableID(t *testing.T) {
+	validCfg := probe.Config{ID: "probe-1", Target: "ignored", Protocol: "noop", Interval: 10}
+	invalidCfg := probe.Config{Target: "ignored", Protocol: "noop", Interval: 10}
+
+	pm := newProbeManager()
+	pm.SyncProbes([]probe.Config{validCfg, invalidCfg})
+	defer pm.Stop()
+
+	_, validExists := pm.probes[validCfg.ID]
+	_, invalidExists := pm.probes[invalidCfg.ID]
+	assert.True(t, validExists)
+	assert.False(t, invalidExists)
+}
+
+func TestProbeManagerSyncProbesStopsRemovedTasksButKeepsExisting(t *testing.T) {
+	keepCfg := probe.Config{ID: "probe-1", Target: "ignored", Protocol: "noop", Interval: 10}
+	removeCfg := probe.Config{ID: "probe-2", Target: "ignored", Protocol: "noop", Interval: 10}
+
+	keptTask := &probeTask{config: keepCfg, cancel: make(chan struct{})}
+	removedTask := &probeTask{config: removeCfg, cancel: make(chan struct{})}
+	pm := &ProbeManager{
+		probes: map[string]*probeTask{
+			keepCfg.ID:   keptTask,
+			removeCfg.ID: removedTask,
+		},
+	}
+
+	pm.SyncProbes([]probe.Config{keepCfg})
+
+	assert.Same(t, keptTask, pm.probes[keepCfg.ID])
+	_, exists := pm.probes[removeCfg.ID]
+	assert.False(t, exists)
+
+	select {
+	case <-removedTask.cancel:
+	default:
+		t.Fatal("expected removed probe task to be cancelled")
+	}
+
+	select {
+	case <-keptTask.cancel:
+		t.Fatal("expected existing probe task to remain active")
+	default:
+	}
+}
+
+func TestProbeManagerSyncProbesRestartsChangedConfig(t *testing.T) {
+	originalCfg := probe.Config{ID: "probe-1", Target: "ignored-a", Protocol: "noop", Interval: 10}
+	updatedCfg := probe.Config{ID: "probe-1", Target: "ignored-b", Protocol: "noop", Interval: 10}
+	originalTask := &probeTask{config: originalCfg, cancel: make(chan struct{})}
+	pm := &ProbeManager{
+		probes: map[string]*probeTask{
+			originalCfg.ID: originalTask,
+		},
+	}
+
+	pm.SyncProbes([]probe.Config{updatedCfg})
+	defer pm.Stop()
+
+	restartedTask := pm.probes[updatedCfg.ID]
+	assert.NotSame(t, originalTask, restartedTask)
+	assert.Equal(t, updatedCfg, restartedTask.config)
+
+	select {
+	case <-originalTask.cancel:
+	default:
+		t.Fatal("expected changed probe task to be cancelled")
+	}
+}
+
+func TestProbeManagerApplySyncUpsertRunsImmediatelyAndReturnsResult(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer server.Close()
+
+	pm := &ProbeManager{
+		probes:     make(map[string]*probeTask),
+		httpClient: server.Client(),
+	}
+
+	resp, err := pm.HandleSyncRequest(probe.SyncRequest{
+		Action: probe.SyncActionUpsert,
+		Config: probe.Config{ID: "probe-1", Target: server.URL, Protocol: "http", Interval: 10},
+		RunNow: true,
+	})
+	defer pm.Stop()
+
+	require.NoError(t, err)
+	assert.GreaterOrEqual(t, resp.Result.AvgResponse, int64(0))
+	assert.Equal(t, 0.0, resp.Result.PacketLoss)
+	assert.Equal(t, 0.0, resp.Result.PacketLoss1h)
+
+	task := pm.probes["probe-1"]
+	require.NotNil(t, task)
+	task.mu.Lock()
+	defer task.mu.Unlock()
+	require.Len(t, task.samples, 1)
+}
+
+func TestProbeManagerUpsertProbeKeepsHistoryWhenOnlyIntervalChanges(t *testing.T) {
+	originalCfg := probe.Config{ID: "probe-1", Target: "1.1.1.1", Protocol: "icmp", Interval: 10}
+	updatedCfg := probe.Config{ID: "probe-1", Target: "1.1.1.1", Protocol: "icmp", Interval: 30}
+	now := time.Now().UTC()
+
+	existingTask := &probeTask{config: originalCfg, cancel: make(chan struct{})}
+	existingTask.addSampleLocked(probeSample{responseUs: 12, timestamp: now.Add(-50 * time.Minute)})
+	existingTask.addSampleLocked(probeSample{responseUs: 24, timestamp: now.Add(-30 * time.Second)})
+
+	pm := &ProbeManager{
+		probes: map[string]*probeTask{originalCfg.ID: existingTask},
+	}
+
+	result, err := pm.UpsertProbe(updatedCfg, false)
+	defer pm.Stop()
+
+	require.NoError(t, err)
+	assert.Nil(t, result)
+
+	updatedTask := pm.probes[updatedCfg.ID]
+	require.NotNil(t, updatedTask)
+	assert.NotSame(t, existingTask, updatedTask)
+	assert.Equal(t, updatedCfg, updatedTask.config)
+
+	updatedTask.mu.Lock()
+	defer updatedTask.mu.Unlock()
+	require.Len(t, updatedTask.samples, 1)
+	assert.Equal(t, int64(24), updatedTask.samples[0].responseUs)
+
+	agg := updatedTask.aggregateLocked(time.Hour, now)
+	require.True(t, agg.hasData())
+	assert.Equal(t, int64(2), agg.totalCount)
+	assert.Equal(t, int64(2), agg.successCount)
+	assert.Equal(t, int64(18), agg.avgResponse())
+
+	select {
+	case <-existingTask.cancel:
+	default:
+		t.Fatal("expected original probe task to be cancelled")
+	}
+}
+
+func TestProbeManagerApplySyncDeleteRemovesTask(t *testing.T) {
+	config := probe.Config{ID: "probe-1", Target: "1.1.1.1", Protocol: "icmp", Interval: 10}
+	task := &probeTask{config: config, cancel: make(chan struct{})}
+	pm := &ProbeManager{
+		probes: map[string]*probeTask{config.ID: task},
+	}
+
+	_, err := pm.HandleSyncRequest(probe.SyncRequest{
+		Action: probe.SyncActionDelete,
+		Config: probe.Config{ID: config.ID},
+	})
+
+	require.NoError(t, err)
+	_, exists := pm.probes[config.ID]
+	assert.False(t, exists)
+
+	select {
+	case <-task.cancel:
+	default:
+		t.Fatal("expected deleted probe task to be cancelled")
+	}
+}
+
+func TestProbeManagerGetRandomDelay(t *testing.T) {
+	for i := 1000; i < 360_000; i += 1000 {
+		delay := getStagger(int64(i))
+		assert.GreaterOrEqual(t, delay, time.Duration(i/2)*time.Millisecond)
+		assert.LessOrEqual(t, delay, time.Duration(i)*time.Millisecond)
+	}
+}
+
+func TestProbeHTTP(t *testing.T) {
+	t.Run("success", func(t *testing.T) {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.WriteHeader(http.StatusNoContent)
+		}))
+		defer server.Close()
+
+		responseUs, err := probeHTTP(server.Client(), server.URL)
+		require.NoError(t, err)
+		assert.GreaterOrEqual(t, responseUs, int64(0))
+	})
+
+	t.Run("server error", func(t *testing.T) {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			http.Error(w, "boom", http.StatusInternalServerError)
+		}))
+		defer server.Close()
+
+		responseUs, err := probeHTTP(server.Client(), server.URL)
+		assert.Equal(t, int64(-1), responseUs)
+		require.Error(t, err)
+	})
+}
+
+func TestProbeTCP(t *testing.T) {
+	t.Run("success", func(t *testing.T) {
+		listener, err := net.Listen("tcp", "127.0.0.1:0")
+		require.NoError(t, err)
+		defer listener.Close()
+
+		accepted := make(chan struct{})
+		go func() {
+			defer close(accepted)
+			conn, err := listener.Accept()
+			if err == nil {
+				_ = conn.Close()
+			}
+		}()
+
+		port := uint16(listener.Addr().(*net.TCPAddr).Port)
+		responseUs, err := probeTCP("127.0.0.1", port)
+		require.NoError(t, err)
+		assert.GreaterOrEqual(t, responseUs, int64(0))
+		<-accepted
+	})
+
+	t.Run("connection failure", func(t *testing.T) {
+		listener, err := net.Listen("tcp", "127.0.0.1:0")
+		require.NoError(t, err)
+
+		port := uint16(listener.Addr().(*net.TCPAddr).Port)
+		require.NoError(t, listener.Close())
+
+		responseUs, err := probeTCP("127.0.0.1", port)
+		assert.Equal(t, int64(-1), responseUs)
+		require.Error(t, err)
+	})
+}

agent/response.go

@@ -21,9 +21,6 @@ func newAgentResponse(data any, requestID *uint32) common.AgentResponse {
 		response.String = &v
 	case map[string]smart.SmartData:
 		response.SmartData = v
-	case smart.SmartDataResponse:
-		response.SmartData = v.Data
-		response.SmartComplete = v.Complete
 	case systemd.ServiceDetails:
 		response.ServiceInfo = v
 	default:

agent/server.go

@@ -29,6 +29,9 @@ type ServerOptions struct {
 	Keys    []gossh.PublicKey // SSH public keys for authentication
 }
 
+// hubVersions caches hub versions by session ID to avoid repeated parsing.
+var hubVersions map[string]semver.Version
+
 // StartServer starts the SSH server with the provided options.
 // It configures the server with secure defaults, sets up authentication,
 // and begins listening for connections. Returns an error if the server
@@ -96,15 +99,24 @@ func (a *Agent) StartServer(opts ServerOptions) error {
 	return a.server.Serve(ln)
 }
 
-// getHubVersion extracts the hub version from the SSH client version string
-// for a given session. Returns a zero version if parsing fails.
-func (a *Agent) getHubVersion(sessionCtx ssh.Context) semver.Version {
-	clientVersion := sessionCtx.Value(ssh.ContextKeyClientVersion)
-	if versionStr, ok := clientVersion.(string); ok {
-		hubVersion, _ := extractHubVersion(versionStr)
+// getHubVersion retrieves and caches the hub version for a given session.
+// It extracts the version from the SSH client version string and caches
+// it to avoid repeated parsing. Returns a zero version if parsing fails.
+func (a *Agent) getHubVersion(sessionId string, sessionCtx ssh.Context) semver.Version {
+	if hubVersions == nil {
+		hubVersions = make(map[string]semver.Version, 1)
+	}
+	hubVersion, ok := hubVersions[sessionId]
+	if ok {
 		return hubVersion
 	}
-	return semver.Version{}
+	// Extract hub version from SSH client version
+	clientVersion := sessionCtx.Value(ssh.ContextKeyClientVersion)
+	if versionStr, ok := clientVersion.(string); ok {
+		hubVersion, _ = extractHubVersion(versionStr)
+	}
+	hubVersions[sessionId] = hubVersion
+	return hubVersion
 }
 
 // handleSession handles an incoming SSH session by gathering system statistics
@@ -115,8 +127,9 @@ func (a *Agent) handleSession(s ssh.Session) {
 	a.connectionManager.eventChan <- SSHConnect
 
 	sessionCtx := s.Context()
+	sessionID := sessionCtx.SessionID()
 
-	hubVersion := a.getHubVersion(sessionCtx)
+	hubVersion := a.getHubVersion(sessionID, sessionCtx)
 
 	// Legacy one-shot behavior for older hubs
 	if hubVersion.LT(beszel.MinVersionAgentResponse) {

agent/server_test.go

@@ -404,23 +404,27 @@ func TestGetHubVersion(t *testing.T) {
 		clientVersion: "SSH-2.0-beszel_0.12.0",
 	}
 
-	// Test first call - should extract version
-	version := agent.getHubVersion(mockCtx)
+	// Test first call - should extract and cache version
+	version := agent.getHubVersion("test-session-123", mockCtx)
 	assert.Equal(t, "0.12.0", version.String())
 
-	// Test that version reflects the current client version (no stale caching)
-	mockCtx.clientVersion = "SSH-2.0-beszel_0.11.0"
-	version = agent.getHubVersion(mockCtx)
+	// Test second call - should return cached version
+	mockCtx.clientVersion = "SSH-2.0-beszel_0.11.0" // Change version but should still return cached
+	version = agent.getHubVersion("test-session-123", mockCtx)
+	assert.Equal(t, "0.12.0", version.String()) // Should still be cached version
+
+	// Test different session - should extract new version
+	version = agent.getHubVersion("different-session", mockCtx)
 	assert.Equal(t, "0.11.0", version.String())
 
 	// Test with invalid version string (non-beszel client)
 	mockCtx.clientVersion = "SSH-2.0-OpenSSH_8.0"
-	version = agent.getHubVersion(mockCtx)
+	version = agent.getHubVersion("invalid-session", mockCtx)
 	assert.Equal(t, "0.0.0", version.String()) // Should be empty version for non-beszel clients
 
 	// Test with no client version
 	mockCtx.clientVersion = ""
-	version = agent.getHubVersion(mockCtx)
+	version = agent.getHubVersion("no-version-session", mockCtx)
 	assert.True(t, version.EQ(semver.Version{})) // Should be empty version
 }
 
@@ -497,6 +501,9 @@ func TestWriteToSessionEncoding(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			// Reset the global hubVersions map to ensure clean state for each test
+			hubVersions = nil
+
 			agent, err := NewAgent("")
 			require.NoError(t, err)
 
@@ -578,28 +585,39 @@ func createTestCombinedData() *system.CombinedData {
 	}
 }
 
-// TestGetHubVersionConcurrent guards against a regression of the
-// "concurrent map writes" panic previously caused by a shared, unsynchronized
-// hubVersions cache (see https://github.com/henrygd/beszel/issues/2128).
-// getHubVersion no longer shares mutable state between sessions, so calling
-// it concurrently from many goroutines must be safe under `go test -race`.
-func TestGetHubVersionConcurrent(t *testing.T) {
+func TestHubVersionCaching(t *testing.T) {
+	// Reset the global hubVersions map to ensure clean state
+	hubVersions = nil
+
 	agent, err := NewAgent("")
 	require.NoError(t, err)
 
-	const goroutines = 50
-	var wg sync.WaitGroup
-	wg.Add(goroutines)
-	for i := 0; i < goroutines; i++ {
-		go func(i int) {
-			defer wg.Done()
-			ctx := &mockSSHContext{
-				sessionID:     fmt.Sprintf("session-%d", i),
-				clientVersion: "SSH-2.0-beszel_0.12.0",
-			}
-			version := agent.getHubVersion(ctx)
-			assert.Equal(t, "0.12.0", version.String())
-		}(i)
+	ctx1 := &mockSSHContext{
+		sessionID:     "session1",
+		clientVersion: "SSH-2.0-beszel_0.12.0",
 	}
-	wg.Wait()
+	ctx2 := &mockSSHContext{
+		sessionID:     "session2",
+		clientVersion: "SSH-2.0-beszel_0.11.0",
+	}
+
+	// First calls should cache the versions
+	v1 := agent.getHubVersion("session1", ctx1)
+	v2 := agent.getHubVersion("session2", ctx2)
+
+	assert.Equal(t, "0.12.0", v1.String())
+	assert.Equal(t, "0.11.0", v2.String())
+
+	// Verify caching by changing context but keeping same session ID
+	ctx1.clientVersion = "SSH-2.0-beszel_0.10.0"
+	v1Cached := agent.getHubVersion("session1", ctx1)
+	assert.Equal(t, "0.12.0", v1Cached.String()) // Should still be cached version
+
+	// New session should get new version
+	ctx3 := &mockSSHContext{
+		sessionID:     "session3",
+		clientVersion: "SSH-2.0-beszel_0.13.0",
+	}
+	v3 := agent.getHubVersion("session3", ctx3)
+	assert.Equal(t, "0.13.0", v3.String())
 }

agent/smart.go

@@ -55,11 +55,6 @@ type DeviceInfo struct {
 	typeVerified bool
 	// parserType holds the parser type (nvme, sat, scsi) that last succeeded.
 	parserType string
-	// explicitType reports whether Type came from an explicit ":type" hint in
-	// SMART_DEVICES. Such a type is a deliberate user override and must always be
-	// passed to smartctl via -d, even for scsi/ata where a scan-detected type is
-	// otherwise left off (see smartctlArgs and issue #1345).
-	explicitType bool
 }
 
 // deviceKey is a composite key for a device, used to identify a device uniquely.
@@ -70,9 +65,8 @@ type deviceKey struct {
 
 var errNoValidSmartData = fmt.Errorf("no valid SMART data found") // Error for missing data
 
-// Refresh updates SMART data for all known devices and reports whether every
-// discovered device was collected successfully.
-func (sm *SmartManager) Refresh(forceScan bool) (bool, error) {
+// Refresh updates SMART data for all known devices
+func (sm *SmartManager) Refresh(forceScan bool) error {
 	sm.refreshMutex.Lock()
 	defer sm.refreshMutex.Unlock()
 
@@ -93,7 +87,7 @@ func (sm *SmartManager) Refresh(forceScan bool) (bool, error) {
 		}
 	}
 
-	return scanErr == nil && collectErr == nil, sm.resolveRefreshError(scanErr, collectErr)
+	return sm.resolveRefreshError(scanErr, collectErr)
 }
 
 // devicesSnapshot returns a copy of the current device slice to avoid iterating
@@ -257,9 +251,8 @@ func (sm *SmartManager) parseConfiguredDevices(config string) ([]*DeviceInfo, er
 		}
 
 		devices = append(devices, &DeviceInfo{
-			Name:         name,
-			Type:         devType,
-			explicitType: devType != "",
+			Name: name,
+			Type: devType,
 		})
 	}
 
@@ -565,9 +558,7 @@ func (sm *SmartManager) smartctlArgs(deviceInfo *DeviceInfo, includeStandby bool
 		deviceType = strings.ToLower(deviceInfo.Type)
 		parserType = strings.ToLower(deviceInfo.parserType)
 		// types sometimes misidentified in scan; see github.com/henrygd/beszel/issues/1345
-		// An explicit SMART_DEVICES ":type" hint is a deliberate override, so always
-		// pass it through; otherwise scsi/ata are left off so smartctl can auto-detect.
-		if deviceType != "" && (deviceInfo.explicitType || (deviceType != "scsi" && deviceType != "ata")) {
+		if deviceType != "" && deviceType != "scsi" && deviceType != "ata" {
 			args = append(args, "-d", deviceInfo.Type)
 		}
 	}
@@ -672,9 +663,6 @@ func mergeDeviceLists(existing, scanned, configured []*DeviceInfo) []*DeviceInfo
 		target.Type = prev.Type
 		target.typeVerified = true
 		target.parserType = prev.parserType
-		if prev.explicitType {
-			target.explicitType = true
-		}
 	}
 
 	// applyConfiguredMetadata updates a matched device with any configured
@@ -688,9 +676,6 @@ func mergeDeviceLists(existing, scanned, configured []*DeviceInfo) []*DeviceInfo
 			existingDev.typeVerified = false
 			existingDev.parserType = normalizeParserType(newType)
 		}
-		if configuredDev.explicitType {
-			existingDev.explicitType = true
-		}
 		if configuredDev.InfoName != "" {
 			existingDev.InfoName = configuredDev.InfoName
 		}

agent/smart_test.go

@@ -392,81 +392,6 @@ func TestSmartctlArgs(t *testing.T) {
 	)
 }
 
-// TestSmartctlArgsExplicitType verifies that an explicit SMART_DEVICES type hint
-// is always passed to smartctl via -d, while a scan-detected scsi/ata type is
-// still left off so smartctl can auto-detect it (see issue #1345).
-func TestSmartctlArgsExplicitType(t *testing.T) {
-	sm := &SmartManager{}
-
-	// Scan-detected scsi: -d is intentionally omitted.
-	scanScsi := &DeviceInfo{Name: "/dev/sda", Type: "scsi"}
-	assert.Equal(t,
-		[]string{"-a", "--json=c", "/dev/sda"},
-		sm.smartctlArgs(scanScsi, false),
-	)
-
-	// Explicit scsi from SMART_DEVICES: -d scsi must be passed.
-	explicitScsi := &DeviceInfo{Name: "/dev/sda", Type: "scsi", explicitType: true}
-	assert.Equal(t,
-		[]string{"-d", "scsi", "-a", "--json=c", "/dev/sda"},
-		sm.smartctlArgs(explicitScsi, false),
-	)
-
-	// Explicit ata from SMART_DEVICES: -d ata must be passed (devstat still added).
-	explicitAta := &DeviceInfo{Name: "/dev/sdb", Type: "ata", explicitType: true}
-	assert.Equal(t,
-		[]string{"-d", "ata", "-a", "--json=c", "-l", "devstat", "/dev/sdb"},
-		sm.smartctlArgs(explicitAta, false),
-	)
-}
-
-// TestSmartDevicesExplicitTypeFlowsToSmartctlArgs is a regression test for
-// issue #2072: an explicit SMART_DEVICES type (e.g. /dev/sda:scsi) must win over
-// a wrong scan-detected type (sat) and be handed to smartctl as -d scsi.
-func TestSmartDevicesExplicitTypeFlowsToSmartctlArgs(t *testing.T) {
-	sm := &SmartManager{}
-
-	configured, err := sm.parseConfiguredDevices("/dev/sda:scsi")
-	require.NoError(t, err)
-	require.Len(t, configured, 1)
-	assert.True(t, configured[0].explicitType)
-
-	// smartctl --scan misreports this USB drive as sat, which fails on it.
-	scanned := []*DeviceInfo{
-		{Name: "/dev/sda", Type: "sat", Protocol: "ATA"},
-	}
-
-	merged := mergeDeviceLists(nil, scanned, configured)
-	require.Len(t, merged, 1)
-
-	device := merged[0]
-	assert.Equal(t, "scsi", device.Type, "configured type should win over scan-detected sat")
-	assert.True(t, device.explicitType, "explicit hint must survive the merge")
-
-	assert.Equal(t,
-		[]string{"-d", "scsi", "-a", "--json=c", "/dev/sda"},
-		sm.smartctlArgs(device, false),
-		"explicit scsi type must be passed to smartctl, not dropped",
-	)
-}
-
-// TestMergeDeviceListsPreservesExplicitTypeAcrossRescan ensures a verified,
-// explicitly-typed device keeps its explicit flag when a later scan re-reports
-// it with a different auto-detected type.
-func TestMergeDeviceListsPreservesExplicitTypeAcrossRescan(t *testing.T) {
-	existing := []*DeviceInfo{
-		{Name: "/dev/sda", Type: "scsi", parserType: "scsi", typeVerified: true, explicitType: true},
-	}
-	scanned := []*DeviceInfo{
-		{Name: "/dev/sda", Type: "sat"},
-	}
-
-	merged := mergeDeviceLists(existing, scanned, nil)
-	require.Len(t, merged, 1)
-	assert.Equal(t, "scsi", merged[0].Type)
-	assert.True(t, merged[0].explicitType, "explicit type flag should survive a rescan")
-}
-
 func TestResolveRefreshError(t *testing.T) {
 	scanErr := errors.New("scan failed")
 	collectErr := errors.New("collect failed")

agent/system.go

@@ -132,14 +132,9 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 	var systemStats system.Stats
 
 	// battery
-	if batteries, err := battery.GetBatteryStats(); err == nil {
-		systemStats.Batteries = make(map[string]uint8, len(batteries))
-		for _, device := range batteries {
-			systemStats.Batteries[device.Name] = device.Percent
-		}
-		if primary, ok := battery.Primary(batteries); ok {
-			systemStats.Battery = [2]uint8{primary.Percent, primary.State}
-		}
+	if batteryPercent, batteryState, err := battery.GetBatteryStats(); err == nil {
+		systemStats.Battery[0] = batteryPercent
+		systemStats.Battery[1] = batteryState
 	}
 
 	// cpu metrics
@@ -174,11 +169,21 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 
 	// memory
 	if v, err := mem.VirtualMemory(); err == nil {
-		used, cacheBuff, swapUsed := calculateHostMemoryUsage(v, a.memCalc == "htop")
 		// swap
 		systemStats.Swap = utils.BytesToGigabytes(v.SwapTotal)
-		systemStats.SwapUsed = utils.BytesToGigabytes(swapUsed)
-		v.Used = used
+		systemStats.SwapUsed = utils.BytesToGigabytes(v.SwapTotal - v.SwapFree - v.SwapCached)
+		// cache + buffers value for default mem calculation
+		// note: gopsutil automatically adds SReclaimable to v.Cached
+		cacheBuff := v.Cached + v.Buffers - v.Shared
+		if cacheBuff <= 0 {
+			cacheBuff = max(v.Total-v.Free-v.Used, 0)
+		}
+		// htop memory calculation overrides (likely outdated as of mid 2025)
+		if a.memCalc == "htop" {
+			// cacheBuff = v.Cached + v.Buffers - v.Shared
+			v.Used = v.Total - (v.Free + cacheBuff)
+			v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
+		}
 		// if a.memCalc == "legacy" {
 		// 	v.Used = v.Total - v.Free - v.Buffers - v.Cached
 		// 	cacheBuff = v.Total - v.Free - v.Used
@@ -188,14 +193,10 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 		if a.zfs {
 			if arcSize, _ := zfs.ARCSize(); arcSize > 0 && arcSize < v.Used {
 				v.Used = v.Used - arcSize
+				v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
 				systemStats.MemZfsArc = utils.BytesToGigabytes(arcSize)
 			}
 		}
-		if v.Total > 0 {
-			v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
-		} else {
-			v.UsedPercent = 0
-		}
 		systemStats.Mem = utils.BytesToGigabytes(v.Total)
 		systemStats.MemBuffCache = utils.BytesToGigabytes(cacheBuff)
 		systemStats.MemUsed = utils.BytesToGigabytes(v.Used)
@@ -215,9 +216,6 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 	// TODO: maybe refactor to methods on systemStats
 	a.updateTemperatures(&systemStats)
 
-	// fan speeds (Linux-only; sysfs hwmon)
-	a.updateFans(&systemStats)
-
 	// GPU data
 	if a.gpuManager != nil {
 		// reset high gpu percent
@@ -265,38 +263,6 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 	return systemStats
 }
 
-// calculateHostMemoryUsage derives counters defensively because /proc/meminfo may
-// change while gopsutil reads it. Invalid unsigned subtractions saturate at zero.
-func calculateHostMemoryUsage(v *mem.VirtualMemoryStat, htop bool) (used, cacheBuff, swapUsed uint64) {
-	used = v.Used
-	if used > v.Total {
-		used = saturatingSub(v.Total, v.Available)
-	}
-
-	// gopsutil automatically adds SReclaimable to Cached.
-	cacheBuff = min(v.Cached, v.Total)
-	cacheBuff += min(v.Buffers, v.Total-cacheBuff)
-	cacheBuff = saturatingSub(cacheBuff, min(v.Shared, v.Total))
-	if v.Cached == 0 && v.Buffers == 0 {
-		cacheBuff = saturatingSub(v.Total, v.Free, used)
-	}
-	if htop {
-		used = saturatingSub(v.Total, v.Free, cacheBuff)
-	}
-	return used, cacheBuff, saturatingSub(v.SwapTotal, v.SwapFree, v.SwapCached)
-}
-
-// saturatingSub subtracts each value, returning zero on underflow.
-func saturatingSub(value uint64, subtrahends ...uint64) uint64 {
-	for _, subtrahend := range subtrahends {
-		if subtrahend > value {
-			return 0
-		}
-		value -= subtrahend
-	}
-	return value
-}
-
 // getOsPrettyName attempts to get the pretty OS name from /etc/os-release on Linux systems
 func getOsPrettyName() (string, error) {
 	file, err := os.Open("/etc/os-release")

agent/system_test.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/henrygd/beszel/internal/common"
 	"github.com/henrygd/beszel/internal/entities/system"
-	"github.com/shirou/gopsutil/v4/mem"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -34,59 +33,6 @@ func TestGatherStatsDoesNotAttachDetailsToCachedRequests(t *testing.T) {
 	assert.Nil(t, secondResponse.Details)
 }
 
-func TestCalculateHostMemoryUsage(t *testing.T) {
-	tests := []struct {
-		name                      string
-		memory                    mem.VirtualMemoryStat
-		htop                      bool
-		used, cacheBuff, swapUsed uint64
-	}{
-		{
-			name:      "normal",
-			memory:    mem.VirtualMemoryStat{Total: 100, Available: 40, Used: 60, Free: 20, Cached: 25, Buffers: 10, Shared: 5, SwapTotal: 20, SwapFree: 8, SwapCached: 2},
-			used:      60,
-			cacheBuff: 30,
-			swapUsed:  10,
-		},
-		{
-			name:      "inconsistent counters saturate",
-			memory:    mem.VirtualMemoryStat{Total: 100, Available: 110, Used: ^uint64(0) - 9, Free: 90, Cached: 5, Buffers: 10, Shared: 20, SwapTotal: 10, SwapFree: 9, SwapCached: 2},
-			used:      0,
-			cacheBuff: 0,
-			swapUsed:  0,
-		},
-		{
-			name:      "htop subtraction saturates",
-			memory:    mem.VirtualMemoryStat{Total: 100, Available: 20, Used: 80, Free: 90, Cached: 20, Buffers: 5, SwapTotal: 30, SwapFree: 10, SwapCached: 5},
-			htop:      true,
-			used:      0,
-			cacheBuff: 25,
-			swapUsed:  15,
-		},
-		{
-			name:      "zero cache from shared cancellation does not fall back",
-			memory:    mem.VirtualMemoryStat{Total: 100, Used: 60, Free: 10, Cached: 20, Buffers: 10, Shared: 30},
-			used:      60,
-			cacheBuff: 0,
-		},
-		{
-			name:      "absent cache counters use fallback",
-			memory:    mem.VirtualMemoryStat{Total: 100, Used: 60, Free: 10},
-			used:      60,
-			cacheBuff: 30,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			used, cacheBuff, swapUsed := calculateHostMemoryUsage(&tt.memory, tt.htop)
-			assert.Equal(t, tt.used, used)
-			assert.Equal(t, tt.cacheBuff, cacheBuff)
-			assert.Equal(t, tt.swapUsed, swapUsed)
-		})
-	}
-}
-
 func TestUpdateSystemDetailsMarksDetailsDirty(t *testing.T) {
 	agent := &Agent{}
 

go.mod

@@ -1,27 +1,27 @@
 module github.com/henrygd/beszel
 
-go 1.26.6
+go 1.26.1
 
 require (
 	github.com/blang/semver v3.5.1+incompatible
 	github.com/coreos/go-systemd/v22 v22.7.0
-	github.com/ebitengine/purego v0.10.2
-	github.com/fxamacker/cbor/v2 v2.9.2
+	github.com/ebitengine/purego v0.10.0
+	github.com/fxamacker/cbor/v2 v2.9.0
 	github.com/gliderlabs/ssh v0.3.8
 	github.com/google/uuid v1.6.0
-	github.com/lxzan/gws v1.10.1
-	github.com/nicholas-fedor/shoutrrr v0.17.0
+	github.com/lxzan/gws v1.9.1
+	github.com/nicholas-fedor/shoutrrr v0.14.3
 	github.com/pocketbase/dbx v1.12.0
-	github.com/pocketbase/pocketbase v0.39.10
-	github.com/shirou/gopsutil/v4 v4.26.7
+	github.com/pocketbase/pocketbase v0.36.8
+	github.com/shirou/gopsutil/v4 v4.26.3
 	github.com/spf13/cast v1.10.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
-	golang.org/x/crypto v0.55.0
-	golang.org/x/exp v0.0.0-20260811152304-ee035b5b010f
-	golang.org/x/net v0.57.0
-	golang.org/x/sys v0.47.0
+	golang.org/x/crypto v0.49.0
+	golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90
+	golang.org/x/net v0.52.0
+	golang.org/x/sys v0.42.0
 	gopkg.in/yaml.v3 v3.0.1
 	howett.net/plist v1.0.1
 )
@@ -35,35 +35,34 @@ require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/eclipse/paho.golang v0.23.0 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/fsnotify/fsnotify v1.10.1 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.15 // indirect
-	github.com/ganigeorgiev/fexpr v0.6.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
+	github.com/ganigeorgiev/fexpr v0.5.0 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
+	github.com/go-ozzo/ozzo-validation/v4 v4.3.0 // indirect
 	github.com/go-sql-driver/mysql v1.9.1 // indirect
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/klauspost/compress v1.19.2 // indirect
-	github.com/lufia/plan9stats v0.0.0-20260802145828-341c2f0c90b5 // indirect
-	github.com/mattn/go-colorable v0.1.15 // indirect
-	github.com/mattn/go-isatty v0.0.24 // indirect
+	github.com/klauspost/compress v1.18.5 // indirect
+	github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/pocketbase/ozzo-validation/v4 v4.3.0 // indirect
-	github.com/power-devops/perfstat v0.0.0-20260805114148-88456608a4f6 // indirect
+	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/tklauser/go-sysconf v0.4.0 // indirect
-	github.com/tklauser/numcpus v0.12.0 // indirect
+	github.com/tklauser/go-sysconf v0.3.16 // indirect
+	github.com/tklauser/numcpus v0.11.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	golang.org/x/image v0.45.0 // indirect
+	golang.org/x/image v0.38.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/term v0.45.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
-	modernc.org/libc v1.74.1 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/term v0.41.0 // indirect
+	golang.org/x/text v0.35.0 // indirect
+	modernc.org/libc v1.70.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.12.0 // indirect
-	modernc.org/sqlite v1.55.0 // indirect
+	modernc.org/memory v1.11.0 // indirect
+	modernc.org/sqlite v1.48.0 // indirect
 )

go.sum

@@ -1,7 +1,7 @@
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
-github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
-github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/asaskevich/govalidator v0.0.0-20200108200545-475eaeb16496/go.mod h1:oGkLhpf+kjZl6xBf758TQhh5XrAeiJv/7FRz/2spLIg=
@@ -21,29 +21,29 @@ github.com/domodwyer/mailyak/v3 v3.6.2 h1:x3tGMsyFhTCaxp6ycgR0FE/bu5QiNp+hetUuCO
 github.com/domodwyer/mailyak/v3 v3.6.2/go.mod h1:lOm/u9CyCVWHeaAmHIdF4RiKVxKUT/H5XX10lIKAL6c=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/ebitengine/purego v0.10.2 h1:W809HbnvzAxgdm+aOvlSekrM16wGCdT/e76+9tS7gzE=
-github.com/ebitengine/purego v0.10.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/ebitengine/purego v0.10.0 h1:QIw4xfpWT6GWTzaW5XEKy3HXoqrJGx1ijYHzTF0/ISU=
+github.com/ebitengine/purego v0.10.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/eclipse/paho.golang v0.23.0 h1:KHgl2wz6EJo7cMBmkuhpt7C576vP+kpPv7jjvSyR6Mk=
 github.com/eclipse/paho.golang v0.23.0/go.mod h1:nQRhTkoZv8EAiNs5UU0/WdQIx2NrnWUpL9nsGJTQN04=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
-github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
-github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78=
-github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/gabriel-vasile/mimetype v1.4.15 h1:05iP/CYtZ/w455R/KZM6rZ5ieAdh99UPtd+d3YzLmaI=
-github.com/gabriel-vasile/mimetype v1.4.15/go.mod h1:azpTcoLcDZRNgFou5j+APrqQx9HqVPWa6ijYQIIVswQ=
-github.com/ganigeorgiev/fexpr v0.6.0 h1:Fza3O/QMBKEudUvxV862qe6GjxM60GJjjKytdp+VQus=
-github.com/ganigeorgiev/fexpr v0.6.0/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
+github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
+github.com/ganigeorgiev/fexpr v0.5.0 h1:XA9JxtTE/Xm+g/JFI6RfZEHSiQlk+1glLvRK1Lpv/Tk=
+github.com/ganigeorgiev/fexpr v0.5.0/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
-github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
-github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
 github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
+github.com/go-ozzo/ozzo-validation/v4 v4.3.0 h1:byhDUpfEwjsVQb1vBunvIjh2BHQ9ead57VkAEY4V+Es=
+github.com/go-ozzo/ozzo-validation/v4 v4.3.0/go.mod h1:2NKgrcHl3z6cJs+3Oo940FPRiTzuqKbvfrL2RxCj6Ew=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.9.1 h1:FrjNGn/BsJQjVRuSa8CBrM5BWA9BWoXXat3KrtSb/iI=
 github.com/go-sql-driver/mysql v1.9.1/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
@@ -56,8 +56,8 @@ github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArs
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
-github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
+github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc h1:VBbFa1lDYWEeV5FZKUiYKYT0VxCp9twUmmaq9eb8sXw=
+github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
@@ -66,49 +66,47 @@ github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/jarcoal/httpmock v1.4.2 h1:dKwiP/9zITCPfBLsDn3kchbSOu16JrnxtVEmL0fPRcI=
-github.com/jarcoal/httpmock v1.4.2/go.mod h1:ftW1xULwo+j0R0JJkJIIi7UKigZUXCLLanykgjwBXL0=
+github.com/jarcoal/httpmock v1.4.1 h1:0Ju+VCFuARfFlhVXFc2HxlcQkfB+Xq12/EotHko+x2A=
+github.com/jarcoal/httpmock v1.4.1/go.mod h1:ftW1xULwo+j0R0JJkJIIi7UKigZUXCLLanykgjwBXL0=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
-github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8=
-github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/lufia/plan9stats v0.0.0-20260802145828-341c2f0c90b5 h1:eveIIGn4BGM3qknO74omf6HYr30/exH+eVUTuAgwjZ0=
-github.com/lufia/plan9stats v0.0.0-20260802145828-341c2f0c90b5/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
-github.com/lxzan/gws v1.10.1 h1:1xG+tDOV0lgDeVPf0wNT74u3cn0K3LpcavRrTPTrMwQ=
-github.com/lxzan/gws v1.10.1/go.mod h1:gXHSCPmTGryWJ4icuqy8Yho32E4YIMHH0fkDRYJRbdc=
-github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
-github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
-github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749 h1:Qj3hTcdWH8uMZDI41HNuTuJN525C7NBrbtH5kSO6fPk=
+github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
+github.com/lxzan/gws v1.9.1 h1:4lbIp4cW0hOLP3ejFHR/uWRy741AURx7oKkNNi2OT9o=
+github.com/lxzan/gws v1.9.1/go.mod h1:gXHSCPmTGryWJ4icuqy8Yho32E4YIMHH0fkDRYJRbdc=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/nicholas-fedor/shoutrrr v0.17.0 h1:xfp3z5QbE8jXvUhUEwWDk47SJ/b912VoB8MJJDU+q4E=
-github.com/nicholas-fedor/shoutrrr v0.17.0/go.mod h1:s4ldyLs6uwBy9lIjYrY+8lyTqJtPvZSrILw0CyMLock=
-github.com/onsi/ginkgo/v2 v2.32.0 h1:Hw7s2pVrQo/8Yz5N77qdnpHaoc+c6cC9WIV1Jce+J6E=
-github.com/onsi/ginkgo/v2 v2.32.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
-github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
-github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
+github.com/nicholas-fedor/shoutrrr v0.14.3 h1:aBX2iw9a7jl5wfHd3bi9LnS5ucoYIy6KcLH9XVF+gig=
+github.com/nicholas-fedor/shoutrrr v0.14.3/go.mod h1:U7IywBkLpBV7rgn8iLbQ9/LklJG1gm24bFv5cXXsDKs=
+github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
+github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
+github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
+github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pocketbase/dbx v1.12.0 h1:/oLErM+A0b4xI0PWTGPqSDVjzix48PqI/bng2l0PzoA=
 github.com/pocketbase/dbx v1.12.0/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
-github.com/pocketbase/ozzo-validation/v4 v4.3.0 h1:uKBDVma7bZqgR2a6AwE+k9hkuDFfiZMpBHQdZ1z3iQs=
-github.com/pocketbase/ozzo-validation/v4 v4.3.0/go.mod h1:6XNjSTw/Jb2F8LOkKO3oyzIWExbrGiYoS4uVxVwz90g=
-github.com/pocketbase/pocketbase v0.39.10 h1:2j8TDJRuo3aAC8Y8F9WFux0SwYcxeDCgEYQxxdWkwGE=
-github.com/pocketbase/pocketbase v0.39.10/go.mod h1:tSX3anHQ7Ul6dPV9WhlEc6No1DtklGF69iwnVNW3BEE=
-github.com/power-devops/perfstat v0.0.0-20260805114148-88456608a4f6 h1:jL3a8soXdzuTCcRnKhOmtcsVOObdDTFf4O2B403HPRU=
-github.com/power-devops/perfstat v0.0.0-20260805114148-88456608a4f6/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
+github.com/pocketbase/pocketbase v0.36.8 h1:gCNqoesZ44saYOD3J7edhi5nDwUWKyQG7boM/kVwz2c=
+github.com/pocketbase/pocketbase v0.36.8/go.mod h1:OY4WaXbP0WnF/EXoBbboWJK+ZSZ1A85tiA0sjrTKxTA=
+github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
+github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/shirou/gopsutil/v4 v4.26.7 h1:IXzpHz/dkMRYAhKkOXr1HB6SuzWU3eoyyeWe7g3bNZc=
-github.com/shirou/gopsutil/v4 v4.26.7/go.mod h1:5O9FjBiXoTDFatIWjZZosqj4pV0DRtLx598xGbBehzM=
+github.com/shirou/gopsutil/v4 v4.26.3 h1:2ESdQt90yU3oXF/CdOlRCJxrP+Am1aBYubTMTfxJ1qc=
+github.com/shirou/gopsutil/v4 v4.26.3/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
 github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
@@ -122,51 +120,51 @@ github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+Q
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/tklauser/go-sysconf v0.4.0 h1:7H0uAN+7RkwWRaxhYXDLqa5V3LPrJeV8wmD9dRUgPQU=
-github.com/tklauser/go-sysconf v0.4.0/go.mod h1:8mTNWyog7H+MpKijp4VmKJAd2bbYQ2zuUwkYRbUArPI=
-github.com/tklauser/numcpus v0.12.0 h1:NR85qdvHA9pFse3x3weVZ0r0ST8R6l5RHbZrlRaqob4=
-github.com/tklauser/numcpus v0.12.0/go.mod h1:ABHeXzJnr/qqwguhClkZKT1/8VABcYrsyUiUGobwWJg=
+github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
+github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
+github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=
+github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
-go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
-golang.org/x/exp v0.0.0-20260811152304-ee035b5b010f h1:iXpLj9sdDH/RLYsnOMpbETK6KWtrHwvegcc4psWJHV8=
-golang.org/x/exp v0.0.0-20260811152304-ee035b5b010f/go.mod h1:EdfpwwqSu+0Li0mzskwHU6FWDV3t9Q+RZDo3QMUtL3Q=
+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
+golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 h1:jiDhWWeC7jfWqR9c/uplMOqJ0sbNlNWv0UkzE0vX1MA=
+golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90/go.mod h1:xE1HEv6b+1SCZ5/uscMRjUBKtIxworgEcEi+/n9NQDQ=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.45.0 h1:FMb1nTbH5H9vF55SriQHgFw5GnNL9Jg6L25BwXKzhB0=
-golang.org/x/image v0.45.0/go.mod h1:n62x/7RqlwXDvGsSU4u6IUTUf6KghUZ9Bt7cG/T9Fx4=
-golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
-golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
+golang.org/x/image v0.38.0 h1:5l+q+Y9JDC7mBOMjo4/aPhMDcxEptsX+Tt3GgRQRPuE=
+golang.org/x/image v0.38.0/go.mod h1:/3f6vaXC+6CEanU4KJxbcUZyEePbyKbaLoDOe4ehFYY=
+golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
+golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
+golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
+golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
+golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
+golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
-golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
+golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
+golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -177,30 +175,30 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
 howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
-modernc.org/cc/v4 v4.29.0 h1:CXgwL8cvxmyzBQZzbSl/6xFtMCryb6u8IOqDci39cgc=
-modernc.org/cc/v4 v4.29.0/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v4 v4.34.6 h1:sBgfIwyN0TQ9C5hwIeuqyeAKyMWnbvj2fvpF4L11uzU=
-modernc.org/ccgo/v4 v4.34.6/go.mod h1:SZ8YcN9NG7XVsQYdm6jYBvi8PQP1qi+kqB6OhjqI3Fk=
+modernc.org/cc/v4 v4.27.1 h1:9W30zRlYrefrDV2JE2O8VDtJ1yPGownxciz5rrbQZis=
+modernc.org/cc/v4 v4.27.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.32.0 h1:hjG66bI/kqIPX1b2yT6fr/jt+QedtP2fqojG2VrFuVw=
+modernc.org/ccgo/v4 v4.32.0/go.mod h1:6F08EBCx5uQc38kMGl+0Nm0oWczoo1c7cgpzEry7Uc0=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.4 h1:2g65LGVSmFQrXeITAw97x7hCRvZFcyE1uDP+7Vng7JI=
-modernc.org/gc/v3 v3.1.4/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
+modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.74.1 h1:bdR4VTKFMC4966QSNZ05XLGI/VwzVa2kTUX51Dm0riQ=
-modernc.org/libc v1.74.1/go.mod h1:uH4t5bOx3G3g9Xcmj10YKlTcVISlRDwv8VoQJG9n8Os=
+modernc.org/libc v1.70.0 h1:U58NawXqXbgpZ/dcdS9kMshu08aiA6b7gusEusqzNkw=
+modernc.org/libc v1.70.0/go.mod h1:OVmxFGP1CI/Z4L3E0Q3Mf1PDE0BucwMkcXjjLntvHJo=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.12.0 h1:twkmYNkGXCvtYWzoux02jtK6eovjZbdI0uHFUYp6kuU=
-modernc.org/memory v1.12.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
-modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
-modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.55.0 h1:hIFh0MCH0rGinQ/4KYb5/UbCkRkb+UP+OkLCVWa5MTM=
-modernc.org/sqlite v1.55.0/go.mod h1:4ntCLuNmnH8+GNqjka1wNg7KJd5/Hi5FYp8K+XQ7GZw=
+modernc.org/sqlite v1.48.0 h1:ElZyLop3Q2mHYk5IFPPXADejZrlHu7APbpB0sF78bq4=
+modernc.org/sqlite v1.48.0/go.mod h1:hWjRO6Tj/5Ik8ieqxQybiEOUXy0NJFNp2tpvVpKlvig=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

internal/alerts/alerts.go

@@ -55,7 +55,6 @@ type SystemAlertStats struct {
 	Temperatures map[string]float32            `json:"t"`
 	LoadAvg      [3]float64                    `json:"la"`
 	Battery      [2]uint8                      `json:"bat"`
-	Batteries    map[string]uint8              `json:"bats"`
 	ExtraFs      map[string]SystemAlertFsStats `json:"efs"`
 }
 

internal/alerts/alerts_quiet_hours_test.go

@@ -322,9 +322,8 @@ func TestAlertSilencedMultiUser(t *testing.T) {
 }
 
 func TestAlertSilencedWithActualAlert(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-
 	synctest.Test(t, func(t *testing.T) {
+		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		// Create a system

internal/alerts/alerts_status_test.go

@@ -29,9 +29,8 @@ func setStatusAlertEmail(t *testing.T, hub core.App, userID, email string) {
 }
 
 func TestStatusAlerts(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-
 	synctest.Test(t, func(t *testing.T) {
+		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		systems, err := beszelTests.CreateSystems(hub, 4, user.Id, "paused")
@@ -235,9 +234,8 @@ func TestHandleStatusAlertsDoesNotSendRecoveryWhileDownIsOnlyPending(t *testing.
 }
 
 func TestStatusAlertTimerCancellationPreventsBoundaryDelivery(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-
 	synctest.Test(t, func(t *testing.T) {
+		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		userSettings, err := hub.FindFirstRecordByFilter("user_settings", "user={:user}", map[string]any{"user": user.Id})
@@ -338,9 +336,8 @@ func TestStatusAlertDownFiresAfterDelayExpires(t *testing.T) {
 }
 
 func TestStatusAlertMultipleUsersRespectDifferentMinutes(t *testing.T) {
-	hub, user1 := beszelTests.GetHubWithUser(t)
-
 	synctest.Test(t, func(t *testing.T) {
+		hub, user1 := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		setStatusAlertEmail(t, hub, user1.Id, "user1@example.com")
@@ -426,9 +423,8 @@ func TestStatusAlertMultipleUsersRespectDifferentMinutes(t *testing.T) {
 }
 
 func TestStatusAlertMultipleUsersRecoveryBetweenMinutesOnlyAlertsEarlierUser(t *testing.T) {
-	hub, user1 := beszelTests.GetHubWithUser(t)
-
 	synctest.Test(t, func(t *testing.T) {
+		hub, user1 := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		setStatusAlertEmail(t, hub, user1.Id, "user1@example.com")
@@ -820,9 +816,8 @@ func TestResolveStatusAlerts(t *testing.T) {
 }
 
 func TestAlertsHistoryStatus(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-
 	synctest.Test(t, func(t *testing.T) {
+		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		// Create a system
@@ -887,9 +882,8 @@ func TestAlertsHistoryStatus(t *testing.T) {
 }
 
 func TestStatusAlertClearedBeforeSend(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-
 	synctest.Test(t, func(t *testing.T) {
+		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		// Create a system

internal/alerts/alerts_system.go

@@ -63,7 +63,7 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 		case "GPU":
 			val = data.Info.GpuPct
 		case "Battery":
-			if !hasRepresentativeBattery(data.Stats.Battery, data.Stats.Batteries) {
+			if data.Stats.Battery[0] == 0 {
 				continue
 			}
 			val = float64(data.Stats.Battery[0])
@@ -167,7 +167,6 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 		stat := systemStats[i]
 		// subtract 10 seconds to give a small time buffer
 		systemStatsCreation := stat.Created.Time().Add(-time.Second * 10)
-		stats = SystemAlertStats{}
 		if err := json.Unmarshal(stat.Stats, &stats); err != nil {
 			return err
 		}
@@ -236,9 +235,6 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 				}
 				alert.val += maxUsage
 			case "Battery":
-				if !hasRepresentativeBattery(stats.Battery, stats.Batteries) {
-					continue
-				}
 				alert.val += float64(stats.Battery[0])
 			default:
 				continue
@@ -301,10 +297,6 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 	return nil
 }
 
-func hasRepresentativeBattery(legacy [2]uint8, batteries map[string]uint8) bool {
-	return legacy != [2]uint8{} || len(batteries) > 0
-}
-
 func (am *AlertManager) sendSystemAlert(alert SystemAlertData) {
 	// log.Printf("Sending alert %s: val %f | count %d | threshold %f\n", alert.name, alert.val, alert.count, alert.threshold)
 	systemName := alert.systemRecord.GetString("name")

internal/alerts/alerts_system_test.go

@@ -95,10 +95,11 @@ func waitForSystemAlert(d time.Duration) {
 
 func testOneMinuteSystemAlert[T any](t *testing.T, alertName string, threshold float64, setValue systemAlertValueSetter[T], triggerValue, resolveValue T) {
 	t.Helper()
-	fixture := newSystemAlertTestFixture(t, alertName, 1, threshold)
-	defer fixture.cleanup()
 
 	synctest.Test(t, func(t *testing.T) {
+		fixture := newSystemAlertTestFixture(t, alertName, 1, threshold)
+		defer fixture.cleanup()
+
 		submitValue(fixture, t, triggerValue, setValue)
 		waitForSystemAlert(time.Second)
 
@@ -117,10 +118,11 @@ func testOneMinuteSystemAlert[T any](t *testing.T, alertName string, threshold f
 
 func testMultiMinuteSystemAlert[T any](t *testing.T, alertName string, threshold float64, min int, setValue systemAlertValueSetter[T], baselineValue, triggerValue, resolveValue T) {
 	t.Helper()
-	fixture := newSystemAlertTestFixture(t, alertName, min, threshold)
-	defer fixture.cleanup()
 
 	synctest.Test(t, func(t *testing.T) {
+		fixture := newSystemAlertTestFixture(t, alertName, min, threshold)
+		defer fixture.cleanup()
+
 		submitValue(fixture, t, baselineValue, setValue)
 		waitForSystemAlert(time.Minute + time.Second)
 		fixture.assertTriggered(t, false, "Alert should not be triggered yet")
@@ -199,7 +201,7 @@ func TestSystemAlertsOneMin(t *testing.T) {
 	testOneMinuteSystemAlert(t, "LoadAvg1", 4, setLoadAvgAlertValue, [3]float64{4.1, 0, 0}, [3]float64{3.9, 0, 0})
 	testOneMinuteSystemAlert(t, "LoadAvg5", 4, setLoadAvgAlertValue, [3]float64{0, 4.1, 0}, [3]float64{0, 3.9, 0})
 	testOneMinuteSystemAlert(t, "LoadAvg15", 4, setLoadAvgAlertValue, [3]float64{0, 0, 4.1}, [3]float64{0, 0, 3.9})
-	testOneMinuteSystemAlert(t, "Battery", 20, setBatteryAlertValue, [2]uint8{0, 1}, [2]uint8{21, 0})
+	testOneMinuteSystemAlert(t, "Battery", 20, setBatteryAlertValue, [2]uint8{19, 0}, [2]uint8{21, 0})
 }
 
 func TestSystemAlertsTwoMin(t *testing.T) {

internal/alerts/alerts_test.go

@@ -15,9 +15,8 @@ import (
 )
 
 func TestAlertsHistory(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-
 	synctest.Test(t, func(t *testing.T) {
+		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		// Create systems and alerts

internal/common/common-ws.go

@@ -22,6 +22,8 @@ const (
 	GetSmartData
 	// Request detailed systemd service info from agent
 	GetSystemdInfo
+	// Sync network probe configuration to agent
+	SyncNetworkProbes
 	// Add new actions here...
 )
 
@@ -42,8 +44,7 @@ type AgentResponse struct {
 	SmartData   map[string]smart.SmartData `cbor:"5,keyasint,omitempty,omitzero"` // Legacy (<= 0.17)
 	ServiceInfo systemd.ServiceDetails     `cbor:"6,keyasint,omitempty,omitzero"` // Legacy (<= 0.17)
 	// Data is the generic response payload for new endpoints (0.18+)
-	Data          cbor.RawMessage `cbor:"7,keyasint,omitempty,omitzero"`
-	SmartComplete bool            `cbor:"8,keyasint,omitempty,omitzero"`
+	Data cbor.RawMessage `cbor:"7,keyasint,omitempty,omitzero"`
 }
 
 type FingerprintRequest struct {

internal/dockerfile_agent_intel

@@ -20,7 +20,7 @@ FROM alpine:3.23
 
 COPY --from=builder /agent /agent
 
-RUN apk add --no-cache -X https://dl-cdn.alpinelinux.org/alpine/edge/testing igt-gpu-tools nvtop smartmontools
+RUN apk add --no-cache -X https://dl-cdn.alpinelinux.org/alpine/edge/testing igt-gpu-tools smartmontools
 
 # Ensure data persistence across container recreations
 VOLUME ["/var/lib/beszel-agent"]

internal/dockerfile_agent_nvidia_slim

@@ -1,90 +0,0 @@
-FROM --platform=$BUILDPLATFORM golang:bookworm AS builder
-
-WORKDIR /app
-
-COPY ../go.mod ../go.sum ./
-RUN go mod download
-
-# Copy source files
-COPY . ./
-
-# Build
-ARG TARGETOS=linux
-ARG TARGETARCH
-ARG TARGETVARIANT
-
-RUN set -eux; \
-  if [ "$TARGETARCH" = "arm" ] && [ -n "$TARGETVARIANT" ]; then \
-    export GOARM="${TARGETVARIANT#v}"; \
-  fi; \
-  CGO_ENABLED=0 GOGC=75 GOOS=$TARGETOS GOARCH=$TARGETARCH \
-    go build -tags glibc -ldflags "-w -s" -o /agent ./internal/cmd/agent
-
-# --------------------------
-# Smartmontools builder stage
-# --------------------------
-FROM --platform=$TARGETPLATFORM debian:bookworm-slim AS smartmontools-builder
-
-# Keep smartmontools 7.5 built from source to match the current NVIDIA agent image behavior.
-# A simpler Debian package based approach is also possible:
-#
-#   RUN apt-get update && apt-get install -y --no-install-recommends \
-#       smartmontools \
-#     && rm -rf /var/lib/apt/lists/*
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-  wget \
-  ca-certificates \
-  build-essential \
-  make \
-  g++ \
-  && wget https://downloads.sourceforge.net/project/smartmontools/smartmontools/7.5/smartmontools-7.5.tar.gz \
-  && tar zxvf smartmontools-7.5.tar.gz \
-  && cd smartmontools-7.5 \
-  && ./configure --prefix=/usr --sysconfdir=/etc \
-  && make \
-  && make install \
-  && rm -rf /smartmontools-7.5* \
-  && apt-get remove -y wget build-essential \
-  && apt-get autoremove -y \
-  && rm -rf /var/lib/apt/lists/*
-
-# Copy smartmontools binary, data files, and required runtime libraries
-RUN set -eux; \
-  mkdir -p /out/rootfs/usr/share /out/rootfs/lib /out/rootfs/lib64 /out/rootfs/usr/lib; \
-  if [ -d /usr/share/smartmontools ]; then \
-    cp -a /usr/share/smartmontools /out/rootfs/usr/share/; \
-  fi; \
-  ldd /usr/sbin/smartctl \
-    | awk '{print $3}' \
-    | grep '^/' \
-    | xargs -r -I '{}' sh -c 'mkdir -p "/out/rootfs$(dirname "{}")"; cp -v "{}" "/out/rootfs{}"'; \
-  interp="$(ldd /usr/sbin/smartctl | awk "/ld-linux/ {print \$1}")"; \
-  if [ -n "$interp" ] && [ -e "$interp" ]; then \
-    mkdir -p "/out/rootfs$(dirname "$interp")"; \
-    cp -v "$interp" "/out/rootfs$interp"; \
-  fi
-
-# --------------------------
-# Final image: lightweight multi-arch NVIDIA agent (slim)
-# --------------------------
-FROM --platform=$TARGETPLATFORM gcr.io/distroless/base-debian12
-COPY --from=builder /agent /agent
-
-# AMD GPU name lookup (used by agent on hybrid laptops when /usr/share/libdrm/amdgpu.ids is read)
-COPY --from=builder /app/agent/test-data/amdgpu.ids /usr/share/libdrm/amdgpu.ids
-
-# Copy smartmontools binaries and config files
-COPY --from=smartmontools-builder /usr/sbin/smartctl /usr/sbin/smartctl
-COPY --from=smartmontools-builder /out/rootfs/ /
-
-# nvidia-smi is intentionally not bundled.
-# Mount the host binary instead, for example:
-# - /usr/bin/nvidia-smi:/usr/bin/nvidia-smi:ro
-
-# Ensure data persistence across container recreations
-VOLUME ["/var/lib/beszel-agent"]
-
-WORKDIR /var/lib/beszel-agent
-
-ENTRYPOINT ["/agent"]

internal/entities/container/container.go

@@ -52,17 +52,6 @@ type HostInfo struct {
 }
 
 func (s *ApiStats) CalculateCpuPercentLinux(prevCpuContainer uint64, prevCpuSystem uint64) float64 {
-	// A counter can read lower than the stored previous value when a stats
-	// response is processed after a newer one for the same container, or when an
-	// accounting counter resets. Unsigned subtraction wraps to ~2^64 instead of
-	// going negative: on the container counter that surfaces as an absurd
-	// percentage the caller rejects, discarding the whole sample; on the system
-	// counter it inflates the divisor and silently reports near-zero CPU.
-	// Treat either direction as a new baseline.
-	if s.CPUStats.CPUUsage.TotalUsage < prevCpuContainer || s.CPUStats.SystemUsage < prevCpuSystem {
-		return 0.0
-	}
-
 	cpuDelta := s.CPUStats.CPUUsage.TotalUsage - prevCpuContainer
 	systemDelta := s.CPUStats.SystemUsage - prevCpuSystem
 
@@ -81,11 +70,7 @@ func (s *ApiStats) CalculateCpuPercentWindows(prevCpuUsage uint64, prevRead time
 	possIntervals /= 100                // Convert to number of 100ns intervals
 	possIntervals *= uint64(s.NumProcs) // Multiple by the number of processors
 
-	// Intervals used. Same rollback guard as the Linux path: an out-of-order or
-	// reset counter would wrap the subtraction to ~2^64.
-	if s.CPUStats.CPUUsage.TotalUsage < prevCpuUsage {
-		return 0.0
-	}
+	// Intervals used
 	intervalsUsed := s.CPUStats.CPUUsage.TotalUsage - prevCpuUsage
 
 	// Percentage avoiding divide-by-zero

internal/entities/probe/probe.go

@@ -0,0 +1,83 @@
+package probe
+
+type SyncAction uint8
+
+const (
+	// SyncActionReplace indicates a full sync where the provided configs should replace all existing probes for the system.
+	SyncActionReplace SyncAction = iota
+	// SyncActionUpsert indicates an incremental sync where the provided config should be added or updated.
+	SyncActionUpsert
+	// SyncActionDelete indicates an incremental sync where the provided config should be removed.
+	SyncActionDelete
+)
+
+// Config defines a network probe task sent from hub to agent.
+type Config struct {
+	// ID is the stable network_probes record ID generated by the hub.
+	ID       string `cbor:"0,keyasint"`
+	Target   string `cbor:"1,keyasint"`
+	Protocol string `cbor:"2,keyasint"` // "icmp", "tcp", or "http"
+	Port     uint16 `cbor:"3,keyasint,omitempty"`
+	Interval uint16 `cbor:"4,keyasint"` // seconds
+}
+
+// SyncRequest defines an incremental or full probe sync request sent to the agent.
+type SyncRequest struct {
+	Action  SyncAction `cbor:"0,keyasint"`
+	Config  Config     `cbor:"1,keyasint,omitempty"`
+	Configs []Config   `cbor:"2,keyasint,omitempty"`
+	RunNow  bool       `cbor:"3,keyasint,omitempty"`
+}
+
+// SyncResponse returns the immediate result for an upsert when requested.
+type SyncResponse struct {
+	Result Result `cbor:"0,keyasint,omitempty"`
+}
+
+// Result holds aggregated probe results for a single target.
+//
+// 0: avg response in microseconds
+//
+// 1: 1h average response in microseconds
+//
+// 2: min response in microseconds
+//
+// 3: 1h min response in microseconds
+//
+// 4: max response in microseconds
+//
+// 5: 1h max response in microseconds
+//
+// 6: packet loss percentage (0-100)
+//
+// 7: 1h packet loss percentage (0-100)
+type Result struct {
+	AvgResponse   int64   `cbor:"0,keyasint,omitempty"`
+	AvgResponse1h int64   `cbor:"1,keyasint,omitempty"`
+	MinResponse   int64   `cbor:"2,keyasint,omitempty"`
+	MinResponse1h int64   `cbor:"3,keyasint,omitempty"`
+	MaxResponse   int64   `cbor:"4,keyasint,omitempty"`
+	MaxResponse1h int64   `cbor:"5,keyasint,omitempty"`
+	PacketLoss    float64 `cbor:"6,keyasint,omitempty"`
+	PacketLoss1h  float64 `cbor:"7,keyasint,omitempty"`
+}
+
+// Stats holds only 1m values for a single target, which are used for charts.
+//
+// 0: avg response in microseconds
+//
+// 1: min response in microseconds
+//
+// 2: max response in microseconds
+//
+// 3: packet loss percentage (0-100)
+type Stats []float64
+
+func (s Stats) FromResult(result Result) Stats {
+	return Stats{
+		float64(result.AvgResponse),
+		float64(result.MinResponse),
+		float64(result.MaxResponse),
+		result.PacketLoss,
+	}
+}

internal/entities/smart/smart.go

@@ -494,7 +494,7 @@ type SmartInfoForNvme struct {
 	FirmwareVersion string           `json:"firmware_version"`
 	// NVMePCIVendor                 NVMePCIVendor                 `json:"nvme_pci_vendor"`
 	// NVMeIEEEOUIIdentifier         uint32                        `json:"nvme_ieee_oui_identifier"`
-	NVMeTotalCapacity uint64 `json:"nvme_total_capacity"`
+	NVMeTotalCapacity             uint64                        `json:"nvme_total_capacity"`
 	// NVMeUnallocatedCapacity       uint64                        `json:"nvme_unallocated_capacity"`
 	// NVMeControllerID              uint16                        `json:"nvme_controller_id"`
 	// NVMeVersion                   VersionStringInfo             `json:"nvme_version"`
@@ -531,13 +531,6 @@ type SmartData struct {
 	Attributes      []*SmartAttribute `json:"a,omitempty" cbor:"9,keyasint,omitempty"`
 }
 
-// SmartDataResponse contains the collected data and whether every discovered
-// device was collected. Older agents omit Complete, so hubs must not prune from it.
-type SmartDataResponse struct {
-	Data     map[string]SmartData `json:"data" cbor:"0,keyasint"`
-	Complete bool                 `json:"complete" cbor:"1,keyasint,omitempty"` // Whether every discovered device was collected
-}
-
 type SmartAttribute struct {
 	ID         uint16 `json:"id,omitempty" cbor:"0,keyasint,omitempty"`
 	Name       string `json:"n" cbor:"1,keyasint"`

internal/entities/system/system.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/henrygd/beszel/internal/entities/container"
+	"github.com/henrygd/beszel/internal/entities/probe"
 	"github.com/henrygd/beszel/internal/entities/systemd"
 )
 
@@ -33,8 +34,6 @@ type Stats struct {
 	MaxNetworkSent float64             `json:"nsm,omitempty" cbor:"-"`
 	MaxNetworkRecv float64             `json:"nrm,omitempty" cbor:"-"`
 	Temperatures   map[string]float64  `json:"t,omitempty" cbor:"20,keyasint,omitempty"`
-	Fans           map[string]uint16   `json:"f,omitempty" cbor:"36,keyasint,omitempty"`
-	Batteries      map[string]uint8    `json:"bats,omitempty" cbor:"37,keyasint,omitempty"`
 	ExtraFs        map[string]*FsStats `json:"efs,omitempty" cbor:"21,keyasint,omitempty"`
 	GPUData        map[string]GPUData  `json:"g,omitempty" cbor:"22,keyasint,omitempty"`
 	// LoadAvg1       float64             `json:"l1,omitempty" cbor:"23,keyasint,omitempty"`
@@ -44,7 +43,7 @@ type Stats struct {
 	MaxBandwidth [2]uint64 `json:"bm,omitzero" cbor:"-"`                   // [sent bytes, recv bytes]
 	// TODO: remove other load fields in future release in favor of load avg array
 	LoadAvg           [3]float64           `json:"la,omitempty" cbor:"28,keyasint"`
-	Battery           [2]uint8             `json:"bat,omitzero" cbor:"29,keyasint,omitzero"`    // [percent, charge state]
+	Battery           [2]uint8             `json:"bat,omitzero" cbor:"29,keyasint,omitzero"`    // [percent, charge state, current]
 	NetworkInterfaces map[string][4]uint64 `json:"ni,omitempty" cbor:"31,keyasint,omitempty"`   // [upload bytes, download bytes, total upload, total download]
 	DiskIO            [2]uint64            `json:"dio,omitzero" cbor:"32,keyasint,omitzero"`    // [read bytes, write bytes]
 	MaxDiskIO         [2]uint64            `json:"diom,omitzero" cbor:"-"`                      // [max read bytes, max write bytes]
@@ -176,9 +175,10 @@ type Details struct {
 
 // Final data structure to return to the hub
 type CombinedData struct {
-	Stats           Stats              `json:"stats" cbor:"0,keyasint"`
-	Info            Info               `json:"info" cbor:"1,keyasint"`
-	Containers      []*container.Stats `json:"container" cbor:"2,keyasint"`
-	SystemdServices []*systemd.Service `json:"systemd,omitempty" cbor:"3,keyasint,omitempty"`
-	Details         *Details           `cbor:"4,keyasint,omitempty"`
+	Stats           Stats                   `json:"stats" cbor:"0,keyasint"`
+	Info            Info                    `json:"info" cbor:"1,keyasint"`
+	Containers      []*container.Stats      `json:"container" cbor:"2,keyasint"`
+	SystemdServices []*systemd.Service      `json:"systemd,omitempty" cbor:"3,keyasint,omitempty"`
+	Details         *Details                `cbor:"4,keyasint,omitempty"`
+	Probes          map[string]probe.Result `cbor:"5,keyasint,omitempty"`
 }

internal/entities/system/system_test.go

@@ -1,37 +0,0 @@
-package system
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/fxamacker/cbor/v2"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestStatsBatteryTransport(t *testing.T) {
-	stats := Stats{Battery: [2]uint8{0, 1}, Batteries: map[string]uint8{"Primary": 0, "Mouse": 75}}
-
-	jsonData, err := json.Marshal(stats)
-	require.NoError(t, err)
-	var jsonPayload map[string]any
-	require.NoError(t, json.Unmarshal(jsonData, &jsonPayload))
-	assert.Equal(t, []any{float64(0), float64(1)}, jsonPayload["bat"])
-	assert.Equal(t, map[string]any{"Primary": float64(0), "Mouse": float64(75)}, jsonPayload["bats"])
-
-	cborData, err := cbor.Marshal(stats)
-	require.NoError(t, err)
-	var decoded Stats
-	require.NoError(t, cbor.Unmarshal(cborData, &decoded))
-	assert.Equal(t, stats.Battery, decoded.Battery)
-	assert.Equal(t, stats.Batteries, decoded.Batteries)
-}
-
-func TestStatsLegacyBatteryPayload(t *testing.T) {
-	data, err := json.Marshal(Stats{Battery: [2]uint8{50, 4}})
-	require.NoError(t, err)
-	var payload map[string]any
-	require.NoError(t, json.Unmarshal(data, &payload))
-	assert.Contains(t, payload, "bat")
-	assert.NotContains(t, payload, "bats")
-}

internal/ghupdate/checksum.go

@@ -1,43 +0,0 @@
-package ghupdate
-
-import (
-	"bytes"
-	"crypto/sha256"
-	"encoding/hex"
-	"fmt"
-	"io"
-	"os"
-	"strings"
-)
-
-func verifyAssetChecksum(path, digest string) error {
-	algorithm, expectedHex, ok := strings.Cut(digest, ":")
-	if !ok || algorithm == "" || expectedHex == "" {
-		return fmt.Errorf("invalid release digest %q", digest)
-	}
-	if !strings.EqualFold(algorithm, "sha256") {
-		return fmt.Errorf("unsupported release digest algorithm %q", algorithm)
-	}
-
-	expected, err := hex.DecodeString(expectedHex)
-	if err != nil || len(expected) != sha256.Size {
-		return fmt.Errorf("invalid SHA-256 release digest %q", digest)
-	}
-
-	file, err := os.Open(path)
-	if err != nil {
-		return fmt.Errorf("failed to open release for checksum verification: %w", err)
-	}
-	defer file.Close()
-
-	hash := sha256.New()
-	if _, err := io.Copy(hash, file); err != nil {
-		return fmt.Errorf("failed to calculate release checksum: %w", err)
-	}
-	actual := hash.Sum(nil)
-	if !bytes.Equal(actual, expected) {
-		return fmt.Errorf("release checksum mismatch: expected %s, got %s", expectedHex, hex.EncodeToString(actual))
-	}
-
-	return nil
-}

internal/ghupdate/checksum_test.go

@@ -1,57 +0,0 @@
-package ghupdate
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestVerifyAssetChecksum(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "asset")
-	if err := os.WriteFile(path, []byte("beszel release asset"), 0600); err != nil {
-		t.Fatal(err)
-	}
-
-	tests := []struct {
-		name    string
-		digest  string
-		wantErr string
-	}{
-		{
-			name:   "valid",
-			digest: "sha256:2316f86af2c3af2f0ef595ad5359cdd19b329d4829a5425460ca9ffbf92671ab",
-		},
-		{
-			name:    "mismatch",
-			digest:  "sha256:0316f86af2c3af2f0ef595ad5359cdd19b329d4829a5425460ca9ffbf92671ab",
-			wantErr: "checksum mismatch",
-		},
-		{
-			name:    "malformed",
-			digest:  "sha256:not-a-checksum",
-			wantErr: "invalid SHA-256",
-		},
-		{
-			name:    "missing",
-			wantErr: "invalid release digest",
-		},
-		{
-			name:    "unsupported algorithm",
-			digest:  "sha512:2316f86af2c3af2f0ef595ad5359cdd19b329d4829a5425460ca9ffbf92671ab",
-			wantErr: "unsupported",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := verifyAssetChecksum(path, tt.digest)
-			if tt.wantErr == "" && err != nil {
-				t.Fatalf("expected checksum to verify, got %v", err)
-			}
-			if tt.wantErr != "" && (err == nil || !strings.Contains(err.Error(), tt.wantErr)) {
-				t.Fatalf("expected error containing %q, got %v", tt.wantErr, err)
-			}
-		})
-	}
-}

internal/ghupdate/extract.go

@@ -46,23 +46,18 @@ func extractTarGz(srcPath, destDir string) error {
 			return err
 		}
 
-		path, err := archivePath(destDir, header.Name)
-		if err != nil {
-			return err
-		}
-
 		if header.Typeflag == tar.TypeDir {
-			if err := os.MkdirAll(path, 0755); err != nil {
+			if err := os.MkdirAll(filepath.Join(destDir, header.Name), 0755); err != nil {
 				return err
 			}
 			continue
 		}
 
-		if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+		if err := os.MkdirAll(filepath.Dir(filepath.Join(destDir, header.Name)), 0755); err != nil {
 			return err
 		}
 
-		outFile, err := os.Create(path)
+		outFile, err := os.Create(filepath.Join(destDir, header.Name))
 		if err != nil {
 			return err
 		}
@@ -77,14 +72,6 @@ func extractTarGz(srcPath, destDir string) error {
 	return nil
 }
 
-// archivePath returns a path within destDir, rejecting path traversal entries.
-func archivePath(destDir, name string) (string, error) {
-	if !filepath.IsLocal(name) {
-		return "", fmt.Errorf("invalid file path: %q", name)
-	}
-	return filepath.Join(destDir, name), nil
-}
-
 // extractZip extracts the zip archive at "src" to "dest".
 //
 // Note that only dirs and regular files will be extracted.
@@ -97,6 +84,9 @@ func extractZip(src, dest string) error {
 	}
 	defer zr.Close()
 
+	// normalize dest path to check later for Zip Slip
+	dest = filepath.Clean(dest) + string(os.PathSeparator)
+
 	for _, f := range zr.File {
 		err := extractFile(f, dest)
 		if err != nil {
@@ -110,9 +100,11 @@ func extractZip(src, dest string) error {
 // extractFile extracts the provided zipFile into "basePath/zipFileName" path,
 // creating all the necessary path directories.
 func extractFile(zipFile *zip.File, basePath string) error {
-	path, err := archivePath(basePath, zipFile.Name)
-	if err != nil {
-		return err
+	path := filepath.Join(basePath, zipFile.Name)
+
+	// check for Zip Slip
+	if !strings.HasPrefix(path, basePath) {
+		return fmt.Errorf("invalid file path: %s", path)
 	}
 
 	r, err := zipFile.Open()

internal/ghupdate/ghupdate.go

@@ -135,33 +135,21 @@ func (p *updater) update() (updated bool, err error) {
 		return false, err
 	}
 
-	if err := os.MkdirAll(p.config.DataDir, 0755); err != nil {
-		return false, fmt.Errorf("failed to create update data directory: %w", err)
-	}
-	releaseDir, err := os.MkdirTemp(p.config.DataDir, ".beszel_update-")
-	if err != nil {
-		return false, fmt.Errorf("failed to create update directory: %w", err)
-	}
+	releaseDir := filepath.Join(p.config.DataDir, ".beszel_update")
 	defer os.RemoveAll(releaseDir)
 
 	ColorPrintf(ColorYellow, "Downloading %s...", asset.Name)
 
 	// download the release asset
-	assetPath, err := archivePath(releaseDir, asset.Name)
-	if err != nil {
-		return false, err
-	}
+	assetPath := filepath.Join(releaseDir, asset.Name)
 	if err := downloadFile(p.config.Context, p.config.HttpClient, asset.DownloadUrl, assetPath, p.config.UseMirror); err != nil {
 		return false, err
 	}
-	ColorPrint(ColorYellow, "Verifying checksum...")
-	if err := verifyAssetChecksum(assetPath, asset.Digest); err != nil {
-		return false, err
-	}
 
 	ColorPrintf(ColorYellow, "Extracting %s...", asset.Name)
 
-	extractDir := filepath.Join(releaseDir, "extracted")
+	extractDir := filepath.Join(releaseDir, "extracted_"+asset.Name)
+	defer os.RemoveAll(extractDir)
 
 	// Extract the archive (automatically detects format)
 	if err := extract(assetPath, extractDir); err != nil {

internal/ghupdate/ghupdate_test.go

@@ -1,9 +1,6 @@
 package ghupdate
 
 import (
-	"archive/tar"
-	"compress/gzip"
-	"os"
 	"path/filepath"
 	"testing"
 )
@@ -46,59 +43,3 @@ func TestExtractFailure(t *testing.T) {
 		t.Fatal("Expected Extract to fail due to missing tar.gz file")
 	}
 }
-
-func TestArchivePath(t *testing.T) {
-	destDir := t.TempDir()
-	for _, name := range []string{
-		"",
-		"..",
-		filepath.Join("..", "file"),
-		filepath.Join("dir", "..", "..", "file"),
-		string(os.PathSeparator) + filepath.Join("tmp", "file"),
-	} {
-		if _, err := archivePath(destDir, name); err == nil {
-			t.Errorf("expected %q to be rejected", name)
-		}
-	}
-
-	name := filepath.Join("dir", "file")
-	if path, err := archivePath(destDir, name); err != nil || path != filepath.Join(destDir, name) {
-		t.Errorf("archivePath(%q) = %q, %v", name, path, err)
-	}
-}
-
-func TestExtractTarGzRejectsPathTraversal(t *testing.T) {
-	testDir := t.TempDir()
-	archivePath := filepath.Join(testDir, "malicious.tar.gz")
-	destDir := filepath.Join(testDir, "extract")
-	escapedPath := filepath.Join(testDir, "escaped")
-
-	archive, err := os.Create(archivePath)
-	if err != nil {
-		t.Fatal(err)
-	}
-	gz := gzip.NewWriter(archive)
-	tw := tar.NewWriter(gz)
-	if err := tw.WriteHeader(&tar.Header{Name: "../escaped", Mode: 0600, Size: 1}); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := tw.Write([]byte("x")); err != nil {
-		t.Fatal(err)
-	}
-	if err := tw.Close(); err != nil {
-		t.Fatal(err)
-	}
-	if err := gz.Close(); err != nil {
-		t.Fatal(err)
-	}
-	if err := archive.Close(); err != nil {
-		t.Fatal(err)
-	}
-
-	if err := extract(archivePath, destDir); err == nil {
-		t.Fatal("expected path traversal archive to be rejected")
-	}
-	if _, err := os.Stat(escapedPath); !os.IsNotExist(err) {
-		t.Fatalf("path traversal wrote %s", escapedPath)
-	}
-}

internal/ghupdate/release.go

@@ -8,7 +8,6 @@ import (
 type releaseAsset struct {
 	Name        string `json:"name"`
 	DownloadUrl string `json:"browser_download_url"`
-	Digest      string `json:"digest"`
 	Id          int    `json:"id"`
 	Size        int    `json:"size"`
 }

internal/hub/agent_connect.go

@@ -317,9 +317,6 @@ func getRealIP(r *http.Request) string {
 	if ip := r.Header.Get("CF-Connecting-IP"); ip != "" {
 		return ip
 	}
-	if ip := r.Header.Get("X-Real-IP"); ip != "" {
-		return ip
-	}
 	if ip := r.Header.Get("X-Forwarded-For"); ip != "" {
 		// X-Forwarded-For can contain a comma-separated list: "client_ip, proxy1, proxy2"
 		// Take the first one

internal/hub/agent_connect_test.go

@@ -1796,24 +1796,6 @@ func TestGetRealIP(t *testing.T) {
 			remoteAddr: "127.0.0.1:12345",
 			expectedIP: "192.168.1.8",
 		},
-		{
-			name:       "X-Real-IP header",
-			headers:    map[string]string{"X-Real-IP": "10.8.0.4"},
-			remoteAddr: "172.21.0.1:12345",
-			expectedIP: "10.8.0.4",
-		},
-		{
-			name:       "X-Real-IP takes precedence over X-Forwarded-For",
-			headers:    map[string]string{"X-Real-IP": "10.8.0.4", "X-Forwarded-For": "10.8.0.5"},
-			remoteAddr: "172.21.0.1:12345",
-			expectedIP: "10.8.0.4",
-		},
-		{
-			name:       "CF-Connecting-IP takes precedence over X-Real-IP",
-			headers:    map[string]string{"CF-Connecting-IP": "1.2.3.4", "X-Real-IP": "10.8.0.4"},
-			remoteAddr: "172.21.0.1:12345",
-			expectedIP: "1.2.3.4",
-		},
 	}
 
 	for _, tc := range testCases {

internal/hub/collections.go

@@ -78,7 +78,7 @@ func setCollectionAuthSettings(app core.App) error {
 		return err
 	}
 
-	if err := applyCollectionRules(app, []string{"containers", "container_stats", "system_stats", "systemd_services"}, collectionRules{
+	if err := applyCollectionRules(app, []string{"containers", "container_stats", "system_stats", "systemd_services", "network_probe_stats"}, collectionRules{
 		list: &systemScopedReadRule,
 	}); err != nil {
 		return err
@@ -92,7 +92,7 @@ func setCollectionAuthSettings(app core.App) error {
 		return err
 	}
 
-	if err := applyCollectionRules(app, []string{"fingerprints"}, collectionRules{
+	if err := applyCollectionRules(app, []string{"fingerprints", "network_probes"}, collectionRules{
 		list:   &systemScopedReadRule,
 		view:   &systemScopedReadRule,
 		create: &systemScopedWriteRule,

internal/hub/config/config_test.go

@@ -64,7 +64,7 @@ func createConfigTestFingerprint(app core.App, systemID, token, fingerprint stri
 
 // TestConfigSyncWithTokens tests the config.SyncSystems function with various token scenarios
 func TestConfigSyncWithTokens(t *testing.T) {
-	testHub, err := tests.NewTestHub(t.TempDir())
+	testHub, err := tests.NewTestHub()
 	require.NoError(t, err)
 	defer testHub.Cleanup()
 

internal/hub/hub.go

@@ -81,6 +81,7 @@ func (h *Hub) StartHub() error {
 		}
 		// register middlewares
 		h.registerMiddlewares(e)
+		// bind events that aren't set up in different
 		// register api routes
 		if err := h.registerApiRoutes(e); err != nil {
 			return err
@@ -109,6 +110,8 @@ func (h *Hub) StartHub() error {
 	h.App.OnRecordCreate("users").BindFunc(h.um.InitializeUserRole)
 	h.App.OnRecordCreate("user_settings").BindFunc(h.um.InitializeUserSettings)
 
+	bindNetworkProbesEvents(h)
+
 	pb, ok := h.App.(*pocketbase.PocketBase)
 	if !ok {
 		return errors.New("not a pocketbase app")

internal/hub/probes.go

@@ -0,0 +1,155 @@
+package hub
+
+import (
+	"strconv"
+	"time"
+
+	"github.com/henrygd/beszel/internal/entities/probe"
+	"github.com/henrygd/beszel/internal/hub/systems"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/types"
+)
+
+// generateProbeID creates a stable hash ID for a probe based on its configuration and the system it belongs to.
+func generateProbeID(systemId string, config probe.Config) string {
+	args := []string{systemId, config.Target, config.Protocol}
+	// only use port for TCP probes, since for other protocols it's not relevant as standalone value
+	if config.Protocol == "tcp" {
+		args = append(args, strconv.FormatUint(uint64(config.Port), 10))
+	}
+	return systems.MakeStableHashId(args...)
+}
+
+// bindNetworkProbesEvents keeps probe records and agent probe state in sync.
+func bindNetworkProbesEvents(hub *Hub) {
+	// on create, make sure the id is set to a stable hash
+	hub.OnRecordCreate("network_probes").BindFunc(func(e *core.RecordEvent) error {
+		systemID := e.Record.GetString("system")
+		config := probeConfigFromRecord(e.Record)
+		id := generateProbeID(systemID, *config)
+		e.Record.Set("id", id)
+		return e.Next()
+	})
+
+	// sync probe to agent on creation and persist the first result immediately when available
+	hub.OnRecordAfterCreateSuccess("network_probes").BindFunc(func(e *core.RecordEvent) error {
+		err := e.Next()
+		if err != nil {
+			return err
+		}
+		if !e.Record.GetBool("enabled") {
+			return nil
+		}
+		// if system connected, run the probe immediately
+		// if not, return and wait for the system to connect and sync probes on reg schedule
+		system, err := hub.sm.GetSystem(e.Record.GetString("system"))
+		if err == nil && system.Status == "up" {
+			go hub.upsertNetworkProbe(e.Record, true)
+		}
+		return err
+	})
+
+	// On API update requests, if the probe config changed in a way that requires a new ID, create a new
+	// record with the new ID and delete the old one. Otherwise, just update the existing probe on the agent.
+	hub.OnRecordUpdateRequest("network_probes").BindFunc(func(e *core.RecordRequestEvent) error {
+		systemID := e.Record.GetString("system")
+		// only tcp uses port - set other protocols port to zero
+		if e.Record.GetString("protocol") != "tcp" {
+			e.Record.Set("port", 0)
+		}
+		ID := generateProbeID(systemID, *probeConfigFromRecord(e.Record))
+		if ID != e.Record.Id {
+			newRecord := copyProbeToNewRecord(e.Record, ID)
+			if err := e.App.Save(newRecord); err != nil {
+				return err
+			}
+			if err := e.App.Delete(e.Record); err != nil {
+				return err
+			}
+			return nil
+		}
+		err := e.Next()
+		if e.Record.GetBool("enabled") {
+			// if the probe is enabled, sync the updated config to the agent now
+			runNow := !e.Record.Original().GetBool("enabled")
+			err = hub.upsertNetworkProbe(e.Record, runNow)
+		} else {
+			// if the probe is paused, remove it from the agent
+			err = hub.deleteNetworkProbe(e.Record)
+		}
+		if err != nil {
+			hub.Logger().Warn("failed to sync updated probe", "system", systemID, "probe", e.Record.Id, "err", err)
+		}
+		return nil
+	})
+
+	// sync probe to agent on delete
+	hub.OnRecordAfterDeleteSuccess("network_probes").BindFunc(func(e *core.RecordEvent) error {
+		if err := hub.deleteNetworkProbe(e.Record); err != nil {
+			hub.Logger().Warn("failed to delete probe on agent", "system", e.Record.GetString("system"), "probe", e.Record.Id, "err", err)
+		}
+		return e.Next()
+	})
+}
+
+// probeConfigFromRecord builds a probe config from a network_probes record.
+func probeConfigFromRecord(record *core.Record) *probe.Config {
+	return &probe.Config{
+		ID:       record.Id,
+		Target:   record.GetString("target"),
+		Protocol: record.GetString("protocol"),
+		Port:     uint16(record.GetInt("port")),
+		Interval: uint16(record.GetInt("interval")),
+	}
+}
+
+// setProbeResultFields stores the latest probe result values on the record.
+func setProbeResultFields(record *core.Record, result probe.Result) {
+	nowString := time.Now().UTC().Format(types.DefaultDateLayout)
+	record.Set("res", result.AvgResponse)
+	record.Set("resAvg1h", result.AvgResponse1h)
+	record.Set("resMin1h", result.MinResponse1h)
+	record.Set("resMax1h", result.MaxResponse1h)
+	record.Set("loss1h", result.PacketLoss1h)
+	record.Set("updated", nowString)
+}
+
+// copyProbeToNewRecord creates a new record with the same field values as the old one.
+// This is used when the probe config changes in a way that requires a new ID, so we need
+// to create a new record with the new ID and delete the old one.
+func copyProbeToNewRecord(oldRecord *core.Record, newID string) *core.Record {
+	collection := oldRecord.Collection()
+	newRecord := core.NewRecord(collection)
+	newRecord.Id = newID
+	fields := []string{"system", "name", "target", "protocol", "port", "interval", "enabled"}
+	for _, field := range fields {
+		newRecord.Set(field, oldRecord.Get(field))
+	}
+	return newRecord
+}
+
+// upsertNetworkProbe creates or updates the record's probe on the target system. If runNow
+// is true, it will also trigger an immediate probe run and update the record with the result.
+func (h *Hub) upsertNetworkProbe(record *core.Record, runNow bool) error {
+	systemID := record.GetString("system")
+	system, err := h.sm.GetSystem(systemID)
+	if err != nil {
+		return err
+	}
+	result, err := system.UpsertNetworkProbe(*probeConfigFromRecord(record), runNow)
+	if err != nil || result == nil {
+		return err
+	}
+	setProbeResultFields(record, *result)
+	return h.App.SaveNoValidate(record)
+}
+
+// deleteNetworkProbe removes the record's probe from the target system.
+func (h *Hub) deleteNetworkProbe(record *core.Record) error {
+	systemID := record.GetString("system")
+	system, err := h.sm.GetSystem(systemID)
+	if err != nil {
+		return err
+	}
+	return system.DeleteNetworkProbe(record.Id)
+}

internal/hub/probes_test.go

@@ -0,0 +1,155 @@
+package hub
+
+import (
+	"testing"
+
+	"github.com/henrygd/beszel/internal/entities/probe"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGenerateProbeID(t *testing.T) {
+	tests := []struct {
+		name     string
+		systemID string
+		config   probe.Config
+		expected string
+	}{
+		{
+			name:     "HTTP probe on example.com",
+			systemID: "sys123",
+			config: probe.Config{
+				Protocol: "http",
+				Target:   "example.com",
+				Port:     0,
+				Interval: 60,
+			},
+			expected: "a20a5827",
+		},
+		{
+			name:     "HTTP probe on example.com with different port",
+			systemID: "sys123",
+			config: probe.Config{
+				Protocol: "http",
+				Target:   "example.com",
+				Port:     8080,
+				Interval: 60,
+			},
+			expected: "a20a5827",
+		},
+		{
+			name:     "HTTP probe on example.com with different system ID",
+			systemID: "sys1234",
+			config: probe.Config{
+				Protocol: "http",
+				Target:   "example.com",
+				Port:     80,
+				Interval: 60,
+			},
+			expected: "ab602ae7",
+		},
+		{
+			name:     "Same probe, different interval",
+			systemID: "sys1234",
+			config: probe.Config{
+				Protocol: "http",
+				Target:   "example.com",
+				Port:     80,
+				Interval: 120,
+			},
+			expected: "ab602ae7",
+		},
+		{
+			name:     "ICMP probe on 1.1.1.1",
+			systemID: "sys456",
+			config: probe.Config{
+				Protocol: "icmp",
+				Target:   "1.1.1.1",
+				Port:     0,
+				Interval: 10,
+			},
+			expected: "6d13a4a4",
+		}, {
+			name:     "ICMP probe on 1.1.1.1 with different system ID",
+			systemID: "sys4567",
+			config: probe.Config{
+				Protocol: "icmp",
+				Target:   "1.1.1.1",
+				Port:     0,
+				Interval: 10,
+			},
+			expected: "ddd6c81",
+		},
+		{
+			name:     "TCP probe on example.com with port 443",
+			systemID: "sys789",
+			config: probe.Config{
+				Protocol: "tcp",
+				Target:   "example.com",
+				Port:     443,
+				Interval: 30,
+			},
+			expected: "677b991",
+		},
+		{
+			name:     "TCP probe on example.com with port 8443",
+			systemID: "sys789",
+			config: probe.Config{
+				Protocol: "tcp",
+				Target:   "example.com",
+				Port:     8443,
+				Interval: 30,
+			},
+			expected: "84167969",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := generateProbeID(tt.systemID, tt.config)
+			assert.Equal(t, tt.expected, got, "generateProbeID() = %v, want %v", got, tt.expected)
+		})
+	}
+}
+
+func TestCopyProbeToNewRecordDropsResultFields(t *testing.T) {
+	hub, testApp, err := createTestHub(t)
+	require.NoError(t, err)
+	defer cleanupTestHub(hub, testApp)
+
+	collection, err := hub.FindCachedCollectionByNameOrId("network_probes")
+	require.NoError(t, err)
+
+	oldRecord := core.NewRecord(collection)
+	oldRecord.Load(map[string]any{
+		"system":   "sys123",
+		"name":     "Example",
+		"target":   "https://example.com",
+		"protocol": "http",
+		"port":     443,
+		"interval": 60,
+		"enabled":  true,
+		"res":      1200,
+		"resAvg1h": 1300,
+		"resMin1h": 900,
+		"resMax1h": 1600,
+		"loss1h":   5,
+		"updated":  "2026-04-29 12:00:00.000Z",
+	})
+
+	newRecord := copyProbeToNewRecord(oldRecord, "next12345")
+
+	assert.Equal(t, "next12345", newRecord.Id)
+	assert.Equal(t, "Example", newRecord.GetString("name"))
+	assert.Equal(t, "https://example.com", newRecord.GetString("target"))
+	assert.Equal(t, "http", newRecord.GetString("protocol"))
+	assert.Equal(t, 443, newRecord.GetInt("port"))
+	assert.True(t, newRecord.GetBool("enabled"))
+	assert.Zero(t, newRecord.GetFloat("res"))
+	assert.Zero(t, newRecord.GetFloat("resAvg1h"))
+	assert.Zero(t, newRecord.GetFloat("resMin1h"))
+	assert.Zero(t, newRecord.GetFloat("resMax1h"))
+	assert.Zero(t, newRecord.GetFloat("loss1h"))
+	assert.Equal(t, "", newRecord.GetString("updated"))
+}

internal/hub/systems/ssh_timeout_test.go

@@ -1,56 +0,0 @@
-//go:build testing
-
-package systems
-
-import (
-	"errors"
-	"testing"
-	"testing/synctest"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// TestRunWithTimeout covers the guard added for issue #2041: the per-system SSH
-// data exchange must never block the updater indefinitely on a dead connection.
-func TestRunWithTimeout(t *testing.T) {
-	t.Run("returns the operation result when it completes before the timeout", func(t *testing.T) {
-		synctest.Test(t, func(t *testing.T) {
-			wantErr := errors.New("boom")
-			onTimeoutCalled := false
-
-			retry, err := runWithTimeout(10*time.Second, func() (bool, error) {
-				return true, wantErr
-			}, func() { onTimeoutCalled = true })
-
-			assert.True(t, retry, "should return the operation's retry value")
-			assert.Equal(t, wantErr, err, "should return the operation's error")
-			assert.False(t, onTimeoutCalled, "onTimeout must not fire when the op completes")
-		})
-	})
-
-	t.Run("times out and tears down the connection when the op blocks", func(t *testing.T) {
-		synctest.Test(t, func(t *testing.T) {
-			// unblock simulates a half-open connection: the op is stuck reading a
-			// response that never arrives until the connection is torn down.
-			unblock := make(chan struct{})
-			onTimeoutCalled := false
-			start := time.Now()
-
-			retry, err := runWithTimeout(5*time.Second, func() (bool, error) {
-				<-unblock
-				return false, nil
-			}, func() {
-				onTimeoutCalled = true
-				close(unblock) // tearing down the connection releases the blocked read
-			})
-
-			assert.Equal(t, 5*time.Second, time.Since(start), "should return exactly at the timeout")
-			assert.True(t, retry, "a timeout should be retryable so the next tick re-dials")
-			assert.Error(t, err, "a timeout must surface an error so the system is set down")
-			assert.True(t, onTimeoutCalled, "onTimeout must fire so the dead connection is closed")
-
-			synctest.Wait() // ensure the released op goroutine exits cleanly
-		})
-	})
-}

internal/hub/systems/system.go

@@ -18,6 +18,7 @@ import (
 	"github.com/henrygd/beszel/internal/hub/ws"
 
 	"github.com/henrygd/beszel/internal/entities/container"
+	"github.com/henrygd/beszel/internal/entities/probe"
 	"github.com/henrygd/beszel/internal/entities/smart"
 	"github.com/henrygd/beszel/internal/entities/system"
 	"github.com/henrygd/beszel/internal/entities/systemd"
@@ -29,6 +30,8 @@ import (
 	"github.com/lxzan/gws"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/security"
+	"github.com/pocketbase/pocketbase/tools/types"
 	"golang.org/x/crypto/ssh"
 )
 
@@ -238,6 +241,12 @@ func (sys *System) createRecords(data *system.CombinedData) (*core.Record, error
 			}
 		}
 
+		if data.Probes != nil {
+			if err := updateNetworkProbesRecords(txApp, data.Probes, sys.Id); err != nil {
+				return err
+			}
+		}
+
 		// update system record (do this last because it triggers alerts and we need above records to be inserted first)
 		systemRecord.Set("status", up)
 		systemRecord.Set("info", data.Info)
@@ -289,7 +298,7 @@ func createSystemdStatsRecords(app core.App, data []*systemd.Service, systemId s
 	for i, service := range data {
 		suffix := fmt.Sprintf("%d", i)
 		valueStrings = append(valueStrings, fmt.Sprintf("({:id%[1]s}, {:system}, {:name%[1]s}, {:state%[1]s}, {:sub%[1]s}, {:cpu%[1]s}, {:cpuPeak%[1]s}, {:memory%[1]s}, {:memPeak%[1]s}, {:updated})", suffix))
-		params["id"+suffix] = makeStableHashId(systemId, service.Name)
+		params["id"+suffix] = MakeStableHashId(systemId, service.Name)
 		params["name"+suffix] = service.Name
 		params["state"+suffix] = service.State
 		params["sub"+suffix] = service.Sub
@@ -306,6 +315,97 @@ func createSystemdStatsRecords(app core.App, data []*systemd.Service, systemId s
 	return err
 }
 
+func updateNetworkProbesRecords(app core.App, probeResults map[string]probe.Result, systemId string) error {
+	if len(probeResults) == 0 {
+		return nil
+	}
+	var err error
+	const probeCollectionName = "network_probes"
+
+	// If realtime updates are active, we save via PocketBase records to trigger realtime events.
+	// Otherwise we can do a more efficient direct update via SQL
+	realtimeActive := utils.RealtimeActiveForCollection(app, probeCollectionName, func(filterQuery string) bool {
+		return !strings.Contains(filterQuery, "system") || strings.Contains(filterQuery, systemId)
+	})
+
+	now := time.Now().UTC()
+	nowMilli := now.UnixMilli()
+	nowString := now.Format(types.DefaultDateLayout)
+	var db dbx.Builder
+	var updateQuery *dbx.Query
+	if !realtimeActive {
+		db = app.DB()
+		probeFields := []string{"res", "resMin1h", "resMax1h", "resAvg1h", "loss1h", "updated"}
+		setClauses := make([]string, len(probeFields))
+		for i, f := range probeFields {
+			setClauses[i] = fmt.Sprintf("%s={:%s}", f, f)
+		}
+		queryString := fmt.Sprintf("UPDATE %s SET %s WHERE id={:id}", probeCollectionName, strings.Join(setClauses, ", "))
+		updateQuery = db.NewQuery(queryString)
+	}
+
+	// update network_probes records
+	for id, result := range probeResults {
+		probeData := map[string]any{
+			"id":       id,
+			"res":      result.AvgResponse,
+			"resAvg1h": result.AvgResponse1h,
+			"resMin1h": result.MinResponse1h,
+			"resMax1h": result.MaxResponse1h,
+			"loss1h":   result.PacketLoss1h,
+			"updated":  nowString,
+		}
+		switch realtimeActive {
+		case true:
+			var record *core.Record
+			record, err = app.FindRecordById(probeCollectionName, id)
+			if err == nil {
+				record.Load(probeData)
+				err = app.SaveNoValidate(record)
+			}
+		default:
+			_, err = updateQuery.Bind(dbx.Params(probeData)).Execute()
+		}
+		if err != nil {
+			app.Logger().Warn("Failed to update probe", "system", systemId, "probe", id, "err", err)
+		}
+	}
+
+	// handle stats collection as well
+	const statsCollectionName = "network_probe_stats"
+
+	// we don't need the hour values for the stats collection
+	stats := make(map[string]probe.Stats, len(probeResults))
+	for key, result := range probeResults {
+		stats[key] = probe.Stats{}.FromResult(result)
+	}
+
+	statsRecordData := map[string]any{
+		"system":  systemId,
+		"type":    "1m",
+		"created": nowMilli,
+	}
+	var statsJson types.JSONRaw
+	if err = statsJson.Scan(stats); err == nil {
+		statsRecordData["stats"] = statsJson
+		switch realtimeActive {
+		case true:
+			collection, _ := app.FindCachedCollectionByNameOrId(statsCollectionName)
+			record := core.NewRecord(collection)
+			record.Load(statsRecordData)
+			err = app.SaveNoValidate(record)
+		default:
+			statsRecordData["id"] = security.PseudorandomStringWithAlphabet(10, core.DefaultIdAlphabet)
+			_, err = db.Insert(statsCollectionName, dbx.Params(statsRecordData)).Execute()
+		}
+	}
+	if err != nil {
+		app.Logger().Error("Failed to update probe stats", "system", systemId, "err", err)
+	}
+
+	return nil
+}
+
 // createContainerRecords creates container records
 func createContainerRecords(app core.App, data []*container.Stats, systemId string) error {
 	if len(data) == 0 {
@@ -348,9 +448,6 @@ func (sys *System) getRecord(app core.App) (*core.Record, error) {
 	record, err := app.FindRecordById("systems", sys.Id)
 	if err != nil || record == nil {
 		_ = sys.manager.RemoveSystem(sys.Id)
-		if err == nil {
-			err = fmt.Errorf("system record %s not found", sys.Id)
-		}
 		return nil, err
 	}
 	return record, nil
@@ -380,16 +477,10 @@ func (sys *System) HasUser(app core.App, user *core.Record) bool {
 // setDown marks a system as down in the database.
 // It takes the original error that caused the system to go down and returns any error
 // encountered during the process of updating the system status.
-// It is a no-op if the system's context has been cancelled.
 func (sys *System) setDown(originalError error) error {
 	if sys.Status == down || sys.Status == paused {
 		return nil
 	}
-	// the updater can race shutdown, and the app may already be disposed by the
-	// time we get here, so don't touch the database once the context is cancelled
-	if sys.ctx != nil && sys.ctx.Err() != nil {
-		return sys.ctx.Err()
-	}
 	record, err := sys.getRecord(sys.manager.hub)
 	if err != nil {
 		return err
@@ -397,7 +488,6 @@ func (sys *System) setDown(originalError error) error {
 	if originalError != nil {
 		sys.manager.hub.Logger().Error("System down", "system", record.GetString("name"), "err", originalError)
 	}
-	sys.detailsFetched.Store(false)
 	record.Set("status", down)
 	return sys.manager.hub.SaveNoValidate(record)
 }
@@ -541,21 +631,16 @@ func (sys *System) FetchSystemdInfoFromAgent(serviceName string) (systemd.Servic
 	return result, err
 }
 
-// FetchSmartDataFromAgent fetches SMART data from the agent.
-func (sys *System) FetchSmartDataFromAgent() (smart.SmartDataResponse, error) {
+// FetchSmartDataFromAgent fetches SMART data from the agent
+func (sys *System) FetchSmartDataFromAgent() (map[string]smart.SmartData, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
 	defer cancel()
-	if sys.agentVersion.LT(beszel.MinVersionAgentResponse) {
-		var data map[string]smart.SmartData
-		err := sys.request(ctx, common.GetSmartData, nil, &data)
-		return smart.SmartDataResponse{Data: data}, err
-	}
-	var result smart.SmartDataResponse
+	var result map[string]smart.SmartData
 	err := sys.request(ctx, common.GetSmartData, nil, &result)
 	return result, err
 }
 
-func makeStableHashId(strings ...string) string {
+func MakeStableHashId(strings ...string) string {
 	hash := fnv.New32a()
 	for _, str := range strings {
 		hash.Write([]byte(str))
@@ -638,17 +723,10 @@ func (sys *System) runSSHOperation(timeout time.Duration, retries int, operation
 			continue
 		}
 
-		// Bound the whole operation. A half-open TCP connection (a dead peer that
-		// never sends RST/FIN) or a wedged agent that accepts the session but
-		// never writes a response would otherwise block the read forever. Because
-		// StartUpdater runs update() synchronously on its ticker, that stalls the
-		// per-system updater indefinitely with no error and no re-dial until the
-		// hub is restarted (issue #2041). On timeout we tear down the connection
-		// so the blocked read unwinds and the system is re-dialed on the next tick.
-		retry, opErr := runWithTimeout(sshOperationTimeout, func() (bool, error) {
+		retry, opErr := func() (bool, error) {
 			defer session.Close()
 			return operation(session)
-		}, sys.closeSSHConnection)
+		}()
 
 		if opErr == nil {
 			return nil
@@ -667,43 +745,6 @@ func (sys *System) runSSHOperation(timeout time.Duration, retries int, operation
 	return fmt.Errorf("ssh operation failed")
 }
 
-// sshOperationTimeout bounds a single SSH data exchange (send request, read
-// response, wait for the remote command to exit). It is more generous than the
-// session-creation timeout to tolerate briefly slow agents, but is kept well
-// under the collection interval so a stalled connection is detected and
-// re-dialed within one cycle (see issue #2041).
-const sshOperationTimeout = 20 * time.Second
-
-// runWithTimeout runs op in a goroutine and returns its result, or, if op does
-// not finish within timeout, calls onTimeout (used to tear down the connection
-// so a blocked op can unwind) and returns a retryable timeout error. This
-// guarantees the caller can never block indefinitely on a dead SSH connection.
-func runWithTimeout(timeout time.Duration, op func() (bool, error), onTimeout func()) (retry bool, err error) {
-	type opResult struct {
-		retry bool
-		err   error
-	}
-	// Buffered so the op goroutine never leaks even when we return on timeout.
-	done := make(chan opResult, 1)
-	go func() {
-		r, e := op()
-		done <- opResult{retry: r, err: e}
-	}()
-
-	timer := time.NewTimer(timeout)
-	defer timer.Stop()
-
-	select {
-	case res := <-done:
-		return res.retry, res.err
-	case <-timer.C:
-		if onTimeout != nil {
-			onTimeout()
-		}
-		return true, fmt.Errorf("ssh operation timed out after %s", timeout)
-	}
-}
-
 // createSSHClient creates a new SSH client for the system
 func (s *System) createSSHClient() error {
 	if s.manager.sshConfig == nil {
@@ -719,7 +760,7 @@ func (s *System) createSSHClient() error {
 		host = net.JoinHostPort(host, s.Port)
 	}
 	var err error
-	s.client, err = dialSSHWithKeepAlive(network, host, s.manager.sshConfig)
+	s.client, err = ssh.Dial(network, host, s.manager.sshConfig)
 	if err != nil {
 		return err
 	}
@@ -728,34 +769,6 @@ func (s *System) createSSHClient() error {
 	return nil
 }
 
-// sshKeepAliveInterval is the TCP keep-alive idle interval for SSH connections
-// to agents. Enabling OS-level keep-alives lets the hub eventually detect a
-// dead peer on an otherwise idle connection instead of trusting it forever.
-// This is a backstop for genuine network death; an application-level wedge
-// (agent process hung while its kernel keeps ACKing) is caught by the
-// per-operation timeout in runSSHOperation instead (see issue #2041).
-const sshKeepAliveInterval = 30 * time.Second
-
-// dialSSHWithKeepAlive dials an SSH connection like ssh.Dial, but enables TCP
-// keep-alive on the underlying connection so half-open connections are
-// eventually detected by the operating system.
-func dialSSHWithKeepAlive(network, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
-	dialer := net.Dialer{
-		Timeout:   config.Timeout,
-		KeepAlive: sshKeepAliveInterval,
-	}
-	conn, err := dialer.Dial(network, addr)
-	if err != nil {
-		return nil, err
-	}
-	sshConn, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
-	if err != nil {
-		_ = conn.Close()
-		return nil, err
-	}
-	return ssh.NewClient(sshConn, chans, reqs), nil
-}
-
 // createSessionWithTimeout creates a new SSH session with a timeout to avoid hanging
 // in case of network issues
 func (sys *System) createSessionWithTimeout(timeout time.Duration) (*ssh.Session, error) {

internal/hub/systems/system_manager.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/henrygd/beszel/internal/hub/ws"
 
+	"github.com/henrygd/beszel/internal/entities/probe"
 	"github.com/henrygd/beszel/internal/entities/system"
 	"github.com/henrygd/beszel/internal/hub/expirymap"
 
@@ -15,6 +16,7 @@ import (
 	"github.com/henrygd/beszel"
 
 	"github.com/blang/semver"
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/store"
 	"golang.org/x/crypto/ssh"
@@ -317,6 +319,17 @@ func (sm *SystemManager) AddWebSocketSystem(systemId string, agentVersion semver
 	if err := sm.AddRecord(systemRecord, system); err != nil {
 		return err
 	}
+
+	// Sync network probes to the newly connected agent
+	go func() {
+		configs := sm.GetProbeConfigsForSystem(systemId)
+		if len(configs) > 0 {
+			if err := system.SyncNetworkProbes(configs); err != nil {
+				sm.hub.Logger().Warn("failed to sync probes to agent", "system", systemId, "err", err)
+			}
+		}
+	}()
+
 	return nil
 }
 
@@ -329,6 +342,16 @@ func (sm *SystemManager) resetFailedSmartFetchState(systemID string) {
 	}
 }
 
+// GetProbeConfigsForSystem returns all enabled probe configs for a system.
+func (sm *SystemManager) GetProbeConfigsForSystem(systemID string) []probe.Config {
+	var configs []probe.Config
+	_ = sm.hub.DB().
+		NewQuery("SELECT id, target, protocol, port, interval FROM network_probes WHERE system = {:system} AND enabled = true").
+		Bind(dbx.Params{"system": systemID}).
+		All(&configs)
+	return configs
+}
+
 // createSSHClientConfig initializes the SSH client configuration for connecting to an agent's server
 func (sm *SystemManager) createSSHClientConfig() error {
 	privateKey, err := sm.hub.GetSSHKey("")

internal/hub/systems/system_probes.go

@@ -0,0 +1,48 @@
+package systems
+
+import (
+	"context"
+	"time"
+
+	"github.com/henrygd/beszel/internal/common"
+	"github.com/henrygd/beszel/internal/entities/probe"
+)
+
+// SyncNetworkProbes sends probe configurations to the agent.
+func (sys *System) SyncNetworkProbes(configs []probe.Config) error {
+	_, err := sys.syncNetworkProbes(probe.SyncRequest{Action: probe.SyncActionReplace, Configs: configs})
+	return err
+}
+
+// UpsertNetworkProbe sends a single probe configuration change to the agent.
+func (sys *System) UpsertNetworkProbe(config probe.Config, runNow bool) (*probe.Result, error) {
+	resp, err := sys.syncNetworkProbes(probe.SyncRequest{
+		Action: probe.SyncActionUpsert,
+		Config: config,
+		RunNow: runNow,
+	})
+	if err != nil {
+		return nil, err
+	}
+	if resp.Result == (probe.Result{}) {
+		return nil, nil
+	}
+	result := resp.Result
+	return &result, nil
+}
+
+// DeleteNetworkProbe removes a single probe task from the agent.
+func (sys *System) DeleteNetworkProbe(id string) error {
+	_, err := sys.syncNetworkProbes(probe.SyncRequest{
+		Action: probe.SyncActionDelete,
+		Config: probe.Config{ID: id},
+	})
+	return err
+}
+
+func (sys *System) syncNetworkProbes(req probe.SyncRequest) (probe.SyncResponse, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var result probe.SyncResponse
+	return result, sys.request(ctx, common.SyncNetworkProbes, req, &result)
+}

internal/hub/systems/system_smart.go

@@ -7,7 +7,6 @@ import (
 	"time"
 
 	"github.com/henrygd/beszel/internal/entities/smart"
-	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 )
 
@@ -18,13 +17,13 @@ type smartFetchState struct {
 
 // FetchAndSaveSmartDevices fetches SMART data from the agent and saves it to the database
 func (sys *System) FetchAndSaveSmartDevices() error {
-	response, err := sys.FetchSmartDataFromAgent()
+	smartData, err := sys.FetchSmartDataFromAgent()
 	if err != nil {
 		sys.recordSmartFetchResult(err, 0)
 		return err
 	}
-	err = sys.saveSmartDevices(response.Data, response.Complete)
-	sys.recordSmartFetchResult(err, len(response.Data))
+	err = sys.saveSmartDevices(smartData)
+	sys.recordSmartFetchResult(err, len(smartData))
 	return err
 }
 
@@ -62,9 +61,8 @@ func (sys *System) smartFetchInterval() time.Duration {
 	return time.Hour
 }
 
-// saveSmartDevices saves SMART device data and, after a complete refresh,
-// removes rows for devices that are no longer reported.
-func (sys *System) saveSmartDevices(smartData map[string]smart.SmartData, complete bool) error {
+// saveSmartDevices saves SMART device data to the smart_devices collection
+func (sys *System) saveSmartDevices(smartData map[string]smart.SmartData) error {
 	if len(smartData) == 0 {
 		return nil
 	}
@@ -75,49 +73,20 @@ func (sys *System) saveSmartDevices(smartData map[string]smart.SmartData, comple
 		return err
 	}
 
-	currentIDs := make(map[string]struct{}, len(smartData))
-	for deviceKey := range smartData {
-		currentIDs[makeStableHashId(sys.Id, deviceKey)] = struct{}{}
+	for deviceKey, device := range smartData {
+		if err := sys.upsertSmartDeviceRecord(collection, deviceKey, device); err != nil {
+			return err
+		}
 	}
 
-	err = hub.RunInTransaction(func(txApp core.App) error {
-		if complete {
-			existing, err := txApp.FindRecordsByFilter(
-				collection,
-				"system = {:system}",
-				"",
-				0,
-				0,
-				dbx.Params{"system": sys.Id},
-			)
-			if err != nil {
-				return err
-			}
-			for _, record := range existing {
-				if _, ok := currentIDs[record.Id]; ok {
-					continue
-				}
-				if err := txApp.Delete(record); err != nil {
-					return err
-				}
-			}
-		}
-
-		for deviceKey, device := range smartData {
-			if err := sys.upsertSmartDeviceRecord(txApp, collection, deviceKey, device); err != nil {
-				return err
-			}
-		}
-
-		return nil
-	})
-	return err
+	return nil
 }
 
-func (sys *System) upsertSmartDeviceRecord(app core.App, collection *core.Collection, deviceKey string, device smart.SmartData) error {
-	recordID := makeStableHashId(sys.Id, deviceKey)
+func (sys *System) upsertSmartDeviceRecord(collection *core.Collection, deviceKey string, device smart.SmartData) error {
+	hub := sys.manager.hub
+	recordID := MakeStableHashId(sys.Id, deviceKey)
 
-	record, err := app.FindRecordById(collection, recordID)
+	record, err := hub.FindRecordById(collection, recordID)
 	if err != nil {
 		if !errors.Is(err, sql.ErrNoRows) {
 			return err
@@ -145,7 +114,7 @@ func (sys *System) upsertSmartDeviceRecord(app core.App, collection *core.Collec
 	record.Set("cycles", powerCycles)
 	record.Set("attributes", device.Attributes)
 
-	return app.SaveNoValidate(record)
+	return hub.SaveNoValidate(record)
 }
 
 // extractPowerMetrics extracts power on hours and power cycles from SMART attributes

internal/hub/systems/system_smart_test.go

@@ -7,53 +7,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/henrygd/beszel/internal/entities/smart"
-	esystem "github.com/henrygd/beszel/internal/entities/system"
 	"github.com/henrygd/beszel/internal/hub/expirymap"
-	_ "github.com/henrygd/beszel/internal/migrations"
-
-	"github.com/pocketbase/pocketbase/core"
-	pbtests "github.com/pocketbase/pocketbase/tests"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/crypto/ssh"
 )
 
-// stubHub implements hubLike using a plain pocketbase test app, so
-// smart-device DB tests can run in-package without an import cycle to
-// internal/hub (which imports this package).
-type stubHub struct{ core.App }
-
-func (stubHub) GetSSHKey(dataDir string) (ssh.Signer, error) { return nil, nil }
-func (stubHub) HandleSystemAlerts(systemRecord *core.Record, data *esystem.CombinedData) error {
-	return nil
-}
-func (stubHub) HandleStatusAlerts(status string, systemRecord *core.Record) error { return nil }
-func (stubHub) CancelPendingStatusAlerts(systemID string)                         {}
-
-// newTestSystemWithHub creates a System backed by a real (temp) database, along
-// with a matching "systems" record, for tests that need to exercise DB reads/writes.
-func newTestSystemWithHub(t *testing.T) (*System, *pbtests.TestApp) {
-	t.Helper()
-	testApp, err := pbtests.NewTestApp(t.TempDir())
-	require.NoError(t, err)
-	t.Cleanup(testApp.Cleanup)
-
-	sm := &SystemManager{hub: stubHub{testApp}, smartFetchMap: expirymap.New[smartFetchState](time.Hour)}
-	t.Cleanup(sm.smartFetchMap.StopCleaner)
-
-	col, err := testApp.FindCachedCollectionByNameOrId("systems")
-	require.NoError(t, err)
-	systemRecord := core.NewRecord(col)
-	systemRecord.Set("name", "test-system")
-	systemRecord.Set("host", "127.0.0.1")
-	systemRecord.Set("port", "45876")
-	require.NoError(t, testApp.SaveNoValidate(systemRecord))
-
-	sys := &System{Id: systemRecord.Id, manager: sm}
-	return sys, testApp
-}
-
 func TestRecordSmartFetchResult(t *testing.T) {
 	sm := &SystemManager{smartFetchMap: expirymap.New[smartFetchState](time.Hour)}
 	t.Cleanup(sm.smartFetchMap.StopCleaner)
@@ -135,95 +92,3 @@ func TestResetFailedSmartFetchState(t *testing.T) {
 	_, ok = sm.smartFetchMap.GetOk("system-1")
 	assert.True(t, ok, "expected successful smart fetch state to be preserved")
 }
-
-// countSmartDeviceRecords returns the number of smart_devices rows for the given system.
-func countSmartDeviceRecords(t *testing.T, app core.App, systemID string) []*core.Record {
-	t.Helper()
-	records, err := app.FindAllRecords("smart_devices", nil)
-	require.NoError(t, err)
-	var forSystem []*core.Record
-	for _, r := range records {
-		if r.GetString("system") == systemID {
-			forSystem = append(forSystem, r)
-		}
-	}
-	return forSystem
-}
-
-func TestSaveSmartDevices_RemovesStaleDevices(t *testing.T) {
-	sys, testApp := newTestSystemWithHub(t)
-
-	// first fetch reports two devices: sda (serial AAA) and sdb (serial BBB)
-	err := sys.saveSmartDevices(map[string]smart.SmartData{
-		"AAA": {SerialNumber: "AAA", DiskName: "sda", ModelName: "Disk A"},
-		"BBB": {SerialNumber: "BBB", DiskName: "sdb", ModelName: "Disk B"},
-	}, true)
-	require.NoError(t, err)
-
-	records := countSmartDeviceRecords(t, testApp, sys.Id)
-	require.Len(t, records, 2, "expected both devices to be saved")
-
-	var recordA *core.Record
-	for _, r := range records {
-		if r.GetString("serial") == "AAA" {
-			recordA = r
-		}
-	}
-	require.NotNil(t, recordA, "expected to find device AAA")
-	originalID := recordA.Id
-
-	deleteEvents := 0
-	testApp.OnRecordAfterDeleteSuccess("smart_devices").BindFunc(func(e *core.RecordEvent) error {
-		deleteEvents++
-		return e.Next()
-	})
-
-	// A complete refresh confirms that BBB is gone, so remove it through
-	// PocketBase and notify realtime subscribers.
-	err = sys.saveSmartDevices(map[string]smart.SmartData{
-		"AAA": {SerialNumber: "AAA", DiskName: "sda", ModelName: "Disk A", Temperature: 42},
-	}, true)
-	require.NoError(t, err)
-
-	records = countSmartDeviceRecords(t, testApp, sys.Id)
-	require.Len(t, records, 1, "expected stale device BBB to be removed")
-	assert.Equal(t, "AAA", records[0].GetString("serial"))
-	assert.Equal(t, originalID, records[0].Id, "expected existing device to be updated in place, not recreated")
-	assert.EqualValues(t, 42, records[0].GetInt("temp"))
-	assert.Equal(t, 1, deleteEvents, "expected PocketBase delete hooks to run")
-}
-
-func TestSaveSmartDevices_IncompleteDataDoesNotRemoveDevices(t *testing.T) {
-	sys, testApp := newTestSystemWithHub(t)
-
-	require.NoError(t, sys.saveSmartDevices(map[string]smart.SmartData{
-		"AAA": {SerialNumber: "AAA", DiskName: "sda"},
-		"BBB": {SerialNumber: "BBB", DiskName: "sdb"},
-	}, true))
-
-	// AAA was collected but BBB failed. The response is useful for updating AAA,
-	// but it is not authoritative enough to remove BBB.
-	require.NoError(t, sys.saveSmartDevices(map[string]smart.SmartData{
-		"AAA": {SerialNumber: "AAA", DiskName: "sda", Temperature: 42},
-	}, false))
-
-	assert.Len(t, countSmartDeviceRecords(t, testApp, sys.Id), 2)
-	recordA, err := testApp.FindRecordById("smart_devices", makeStableHashId(sys.Id, "AAA"))
-	require.NoError(t, err)
-	assert.EqualValues(t, 42, recordA.GetInt("temp"))
-}
-
-func TestSaveSmartDevices_EmptyDataIsNoop(t *testing.T) {
-	sys, testApp := newTestSystemWithHub(t)
-
-	err := sys.saveSmartDevices(map[string]smart.SmartData{
-		"AAA": {SerialNumber: "AAA", DiskName: "sda"},
-	}, true)
-	require.NoError(t, err)
-
-	err = sys.saveSmartDevices(map[string]smart.SmartData{}, true)
-	require.NoError(t, err)
-
-	records := countSmartDeviceRecords(t, testApp, sys.Id)
-	assert.Len(t, records, 1, "empty fetch result should not delete existing devices")
-}

internal/hub/systems/system_systemd_test.go

@@ -14,9 +14,9 @@ func TestGetSystemdServiceId(t *testing.T) {
 		serviceName := "nginx.service"
 
 		// Call multiple times and ensure same result
-		id1 := makeStableHashId(systemId, serviceName)
-		id2 := makeStableHashId(systemId, serviceName)
-		id3 := makeStableHashId(systemId, serviceName)
+		id1 := MakeStableHashId(systemId, serviceName)
+		id2 := MakeStableHashId(systemId, serviceName)
+		id3 := MakeStableHashId(systemId, serviceName)
 
 		assert.Equal(t, id1, id2)
 		assert.Equal(t, id2, id3)
@@ -29,10 +29,10 @@ func TestGetSystemdServiceId(t *testing.T) {
 		serviceName1 := "nginx.service"
 		serviceName2 := "apache.service"
 
-		id1 := makeStableHashId(systemId1, serviceName1)
-		id2 := makeStableHashId(systemId2, serviceName1)
-		id3 := makeStableHashId(systemId1, serviceName2)
-		id4 := makeStableHashId(systemId2, serviceName2)
+		id1 := MakeStableHashId(systemId1, serviceName1)
+		id2 := MakeStableHashId(systemId2, serviceName1)
+		id3 := MakeStableHashId(systemId1, serviceName2)
+		id4 := MakeStableHashId(systemId2, serviceName2)
 
 		// All IDs should be different
 		assert.NotEqual(t, id1, id2)
@@ -56,14 +56,14 @@ func TestGetSystemdServiceId(t *testing.T) {
 		}
 
 		for _, tc := range testCases {
-			id := makeStableHashId(tc.systemId, tc.serviceName)
+			id := MakeStableHashId(tc.systemId, tc.serviceName)
 			// FNV-32 produces 8 hex characters
 			assert.Len(t, id, 8, "ID should be 8 characters for systemId='%s', serviceName='%s'", tc.systemId, tc.serviceName)
 		}
 	})
 
 	t.Run("hexadecimal output", func(t *testing.T) {
-		id := makeStableHashId("test-system", "test-service")
+		id := MakeStableHashId("test-system", "test-service")
 		assert.NotEmpty(t, id)
 
 		// Should only contain hexadecimal characters

internal/hub/systems/system_test.go

@@ -3,7 +3,6 @@
 package systems
 
 import (
-	"context"
 	"testing"
 
 	"github.com/henrygd/beszel/internal/entities/system"
@@ -158,17 +157,3 @@ func TestCombinedData_MigrateDeprecatedFields(t *testing.T) {
 		}
 	})
 }
-
-func TestSetDownAfterContextCancelled(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	// manager is nil on purpose: setDown must bail out before touching the app
-	sys := &System{Status: up, ctx: ctx}
-
-	if err := sys.setDown(nil); err != context.Canceled {
-		t.Fatalf("expected context.Canceled, got %v", err)
-	}
-	if sys.Status != up {
-		t.Fatalf("status should be untouched, got %q", sys.Status)
-	}
-}

internal/hub/transport/transport.go

@@ -88,23 +88,15 @@ func unmarshalLegacyResponse(resp common.AgentResponse, action common.WebSocketA
 		*d = *resp.String
 		return nil
 	case common.GetSmartData:
-		switch d := dest.(type) {
-		case *map[string]smart.SmartData:
-			if resp.SmartData == nil {
-				return errors.New("no SMART data in response")
-			}
-			*d = resp.SmartData
-			return nil
-		case *smart.SmartDataResponse:
-			if resp.SmartData == nil {
-				return errors.New("no SMART data in response")
-			}
-			d.Data = resp.SmartData
-			d.Complete = resp.SmartComplete
-			return nil
-		default:
+		d, ok := dest.(*map[string]smart.SmartData)
+		if !ok {
 			return fmt.Errorf("unexpected dest type for GetSmartData: %T", dest)
 		}
+		if resp.SmartData == nil {
+			return errors.New("no SMART data in response")
+		}
+		*d = resp.SmartData
+		return nil
 	case common.GetSystemdInfo:
 		d, ok := dest.(*systemd.ServiceDetails)
 		if !ok {

internal/hub/transport/transport_test.go

@@ -1,33 +0,0 @@
-package transport
-
-import (
-	"testing"
-
-	"github.com/henrygd/beszel/internal/common"
-	"github.com/henrygd/beszel/internal/entities/smart"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestUnmarshalSmartDataResponse(t *testing.T) {
-	for _, test := range []struct {
-		name     string
-		complete bool
-	}{
-		{name: "complete response", complete: true},
-		{name: "older agent defaults to incomplete", complete: false},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			response := common.AgentResponse{
-				SmartData: map[string]smart.SmartData{
-					"AAA": {SerialNumber: "AAA"},
-				},
-				SmartComplete: test.complete,
-			}
-			var result smart.SmartDataResponse
-			require.NoError(t, UnmarshalResponse(response, common.GetSmartData, &result))
-			assert.Equal(t, test.complete, result.Complete)
-			assert.Equal(t, "AAA", result.Data["AAA"].SerialNumber)
-		})
-	}
-}

internal/hub/utils/utils.go

@@ -1,7 +1,11 @@
 // Package utils provides utility functions for the hub.
 package utils
 
-import "os"
+import (
+	"os"
+
+	"github.com/pocketbase/pocketbase/core"
+)
 
 // GetEnv retrieves an environment variable with a "BESZEL_HUB_" prefix, or falls back to the unprefixed key.
 func GetEnv(key string) (value string, exists bool) {
@@ -10,3 +14,26 @@ func GetEnv(key string) (value string, exists bool) {
 	}
 	return os.LookupEnv(key)
 }
+
+// realtimeActiveForCollection checks if there are active WebSocket subscriptions for the given collection.
+func RealtimeActiveForCollection(app core.App, collectionName string, validateFn func(filterQuery string) bool) bool {
+	broker := app.SubscriptionsBroker()
+	if broker.TotalClients() == 0 {
+		return false
+	}
+	for _, client := range broker.Clients() {
+		subs := client.Subscriptions(collectionName)
+		if len(subs) > 0 {
+			if validateFn == nil {
+				return true
+			}
+			for k := range subs {
+				filter := subs[k].Query["filter"]
+				if validateFn(filter) {
+					return true
+				}
+			}
+		}
+	}
+	return false
+}

internal/migrations/0_collections_snapshot_0_19_0_dev_2.go

@@ -1699,6 +1699,288 @@ func init() {
 		"type": "base",
 		"updateRule": null,
 		"viewRule": null
+	},
+	{
+		"createRule": null,
+		"deleteRule": null,
+		"fields": [
+			{
+				"autogeneratePattern": "[a-z0-9]{10}",
+				"hidden": false,
+				"id": "text3208210256",
+				"max": 10,
+				"min": 6,
+				"name": "id",
+				"pattern": "^[a-z0-9]+$",
+				"presentable": false,
+				"primaryKey": true,
+				"required": true,
+				"system": true,
+				"type": "text"
+			},
+			{
+				"cascadeDelete": true,
+				"collectionId": "2hz5ncl8tizk5nx",
+				"hidden": false,
+				"id": "np_system",
+				"maxSelect": 1,
+				"minSelect": 0,
+				"name": "system",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "relation"
+			},
+			{
+				"autogeneratePattern": "",
+				"hidden": false,
+				"id": "np_name",
+				"max": 200,
+				"min": 0,
+				"name": "name",
+				"pattern": "",
+				"presentable": false,
+				"primaryKey": false,
+				"required": false,
+				"system": false,
+				"type": "text"
+			},
+			{
+				"autogeneratePattern": "",
+				"hidden": false,
+				"id": "np_target",
+				"max": 500,
+				"min": 1,
+				"name": "target",
+				"pattern": "",
+				"presentable": false,
+				"primaryKey": false,
+				"required": true,
+				"system": false,
+				"type": "text"
+			},
+			{
+				"hidden": false,
+				"id": "np_protocol",
+				"maxSelect": 1,
+				"name": "protocol",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "select",
+				"values": [
+					"icmp",
+					"tcp",
+					"http"
+				]
+			},
+			{
+				"hidden": false,
+				"id": "np_port",
+				"max": 65535,
+				"min": 0,
+				"name": "port",
+				"onlyInt": true,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "np_interval",
+				"max": 3600,
+				"min": 1,
+				"name": "interval",
+				"onlyInt": true,
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "number926446584",
+				"max": null,
+				"min": null,
+				"name": "res",
+				"onlyInt": false,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "number1006954605",
+				"max": null,
+				"min": null,
+				"name": "resAvg1h",
+				"onlyInt": false,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "number4267669802",
+				"max": null,
+				"min": null,
+				"name": "resMin1h",
+				"onlyInt": false,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "number591433223",
+				"max": null,
+				"min": null,
+				"name": "resMax1h",
+				"onlyInt": false,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "number3726709001",
+				"max": null,
+				"min": null,
+				"name": "loss1h",
+				"onlyInt": false,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "np_enabled",
+				"name": "enabled",
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "bool"
+			},
+			{
+				"hidden": false,
+				"id": "autodate2990389176",
+				"name": "created",
+				"onCreate": true,
+				"onUpdate": false,
+				"presentable": false,
+				"system": false,
+				"type": "autodate"
+			},
+			{
+				"hidden": false,
+				"id": "date3332085495",
+				"max": "",
+				"min": "",
+				"name": "updated",
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "date"
+			}
+		],
+		"id": "np_probes_001",
+		"indexes": [
+			"CREATE INDEX ` + "`" + `idx_np_system_enabled` + "`" + ` ON ` + "`" + `network_probes` + "`" + ` (` + "`" + `system` + "`" + `)"
+		],
+		"listRule": null,
+		"name": "network_probes",
+		"system": false,
+		"type": "base",
+		"updateRule": null,
+		"viewRule": null
+	},
+	{
+		"createRule": null,
+		"deleteRule": null,
+		"fields": [
+			{
+				"autogeneratePattern": "[a-z0-9]{10}",
+				"hidden": false,
+				"id": "text3208210256",
+				"max": 10,
+				"min": 10,
+				"name": "id",
+				"pattern": "^[a-z0-9]+$",
+				"presentable": false,
+				"primaryKey": true,
+				"required": true,
+				"system": true,
+				"type": "text"
+			},
+			{
+				"cascadeDelete": true,
+				"collectionId": "2hz5ncl8tizk5nx",
+				"hidden": false,
+				"id": "nps_system",
+				"maxSelect": 1,
+				"minSelect": 0,
+				"name": "system",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "relation"
+			},
+			{
+				"hidden": false,
+				"id": "nps_stats",
+				"maxSize": 2000000,
+				"name": "stats",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "json"
+			},
+			{
+				"hidden": false,
+				"id": "nps_type",
+				"maxSelect": 1,
+				"name": "type",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "select",
+				"values": [
+					"1m",
+					"10m",
+					"20m",
+					"120m",
+					"480m"
+				]
+			},
+			{
+				"hidden": false,
+				"id": "number2990389176",
+				"max": null,
+				"min": null,
+				"name": "created",
+				"onlyInt": false,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			}
+		],
+		"id": "np_stats_001",
+		"indexes": [
+			"CREATE INDEX ` + "`" + `idx_nps_system_type_created` + "`" + ` ON ` + "`" + `network_probe_stats` + "`" + ` (\n  ` + "`" + `system` + "`" + `,\n  ` + "`" + `type` + "`" + `,\n  ` + "`" + `created` + "`" + `\n)"
+		],
+		"listRule": null,
+		"name": "network_probe_stats",
+		"system": false,
+		"type": "base",
+		"updateRule": null,
+		"viewRule": null
 	}
 ]`
 

internal/records/probe_averaging_test.go

@@ -0,0 +1,57 @@
+//go:build testing
+
+package records_test
+
+import (
+	"testing"
+
+	"github.com/henrygd/beszel/internal/records"
+	"github.com/henrygd/beszel/internal/tests"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAverageProbeStats(t *testing.T) {
+	hub, err := tests.NewTestHub(t.TempDir())
+	require.NoError(t, err)
+	defer hub.Cleanup()
+
+	rm := records.NewRecordManager(hub)
+	user, err := tests.CreateUser(hub, "probe-avg@example.com", "testtesttest")
+	require.NoError(t, err)
+	system, err := tests.CreateRecord(hub, "systems", map[string]any{
+		"name":   "probe-avg-system",
+		"host":   "localhost",
+		"port":   "45876",
+		"status": "up",
+		"users":  []string{user.Id},
+	})
+	require.NoError(t, err)
+
+	recordA, err := tests.CreateRecord(hub, "network_probe_stats", map[string]any{
+		"system": system.Id,
+		"type":   "1m",
+		"stats":  `{"icmp:1.1.1.1":[10,5,20,1.5]}`,
+	})
+	require.NoError(t, err)
+	recordB, err := tests.CreateRecord(hub, "network_probe_stats", map[string]any{
+		"system": system.Id,
+		"type":   "1m",
+		"stats":  `{"icmp:1.1.1.1":[22.5,10,60,0]}`,
+	})
+	require.NoError(t, err)
+
+	result := rm.AverageProbeStats(hub.DB(), records.RecordIds{
+		{Id: recordA.Id},
+		{Id: recordB.Id},
+	})
+
+	stats, ok := result["icmp:1.1.1.1"]
+	require.True(t, ok)
+	require.Len(t, stats, 4)
+	assert.InDelta(t, 16.25, stats[0], 0.001) // avg of avg
+	assert.InDelta(t, 5, stats[1], 0.001)     // min of mins
+	assert.InDelta(t, 60, stats[2], 0.001)    // max of maxes
+	assert.InDelta(t, 0.75, stats[3], 0.001)  // avg of packet loss
+}

internal/records/records.go

@@ -3,15 +3,17 @@ package records
 
 import (
 	"encoding/json"
-	"log/slog"
+	"log"
 	"math"
 	"time"
 
 	"github.com/henrygd/beszel/internal/entities/container"
+	"github.com/henrygd/beszel/internal/entities/probe"
 	"github.com/henrygd/beszel/internal/entities/system"
 
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/types"
 )
 
 type RecordManager struct {
@@ -39,7 +41,7 @@ type StatsRecord struct {
 
 // Create longer records by averaging shorter records
 func (rm *RecordManager) CreateLongerRecords() {
-	// start := time.Now()
+	now := time.Now().UTC()
 	longerRecordData := []LongerRecordData{
 		{
 			shorterType: "1m",
@@ -68,18 +70,20 @@ func (rm *RecordManager) CreateLongerRecords() {
 		},
 	}
 	// wrap the operations in a transaction
-	// Pocketbase cron does not handle errors, log them here.
 	rm.app.RunInTransaction(func(txApp core.App) error {
 		var err error
-		collections := [2]*core.Collection{}
+
+		collections := [3]*core.Collection{}
 		collections[0], err = txApp.FindCachedCollectionByNameOrId("system_stats")
 		if err != nil {
-			slog.Error("Error finding cached collection using system stats:", "err", err)
 			return err
 		}
 		collections[1], err = txApp.FindCachedCollectionByNameOrId("container_stats")
 		if err != nil {
-			slog.Error("Error finding cached collection using container stats:", "err", err)
+			return err
+		}
+		collections[2], err = txApp.FindCachedCollectionByNameOrId("network_probe_stats")
+		if err != nil {
 			return err
 		}
 		var systems RecordIds
@@ -94,58 +98,74 @@ func (rm *RecordManager) CreateLongerRecords() {
 				recordData := longerRecordData[i]
 				// log.Println("processing longer record type", recordData.longerType)
 				// add one minute padding for longer records because they are created slightly later than the job start time
-				longerRecordPeriod := time.Now().UTC().Add(recordData.longerTimeDuration + time.Minute)
+				longerRecordPeriod := now.Add(recordData.longerTimeDuration + time.Minute)
 				// shorter records are created independently of longer records, so we shouldn't need to add padding
-				shorterRecordPeriod := time.Now().UTC().Add(recordData.longerTimeDuration)
+				shorterRecordPeriod := now.Add(recordData.longerTimeDuration)
 				// loop through both collections
 				for _, collection := range collections {
 					// check creation time of last longer record if not 10m, since 10m is created every run
 					if recordData.longerType != "10m" {
-						count, err := txApp.CountRecords(
-							collection.Id,
-							dbx.NewExp(
-								"system = {:system} AND type = {:type} AND created > {:created}",
-								dbx.Params{"type": recordData.longerType, "system": system.Id, "created": longerRecordPeriod},
-							),
-						)
+						var existingRecord struct {
+							Id string
+						}
+
+						params := dbx.Params{
+							"type":    recordData.longerType,
+							"system":  system.Id,
+							"created": getCreatedTimeField(collection.Name, longerRecordPeriod),
+						}
+
+						_ = db.Select("id").
+							From(collection.Name).
+							Where(dbx.NewExp("system = {:system} AND type = {:type} AND created > {:created}", params)).
+							Limit(1).
+							One(&existingRecord)
+
 						// continue if longer record exists
-						if err != nil || count > 0 {
+						if existingRecord.Id != "" {
 							continue
 						}
 					}
 					// get shorter records from the past x minutes
 					var recordIds RecordIds
 
-					err := txApp.DB().
+					params := dbx.Params{
+						"type":    recordData.shorterType,
+						"system":  system.Id,
+						"created": getCreatedTimeField(collection.Name, shorterRecordPeriod),
+					}
+
+					_ = txApp.DB().
 						Select("id").
 						From(collection.Name).
-						AndWhere(dbx.NewExp(
+						Where(dbx.NewExp(
 							"system={:system} AND type={:type} AND created > {:created}",
-							dbx.Params{
-								"type":    recordData.shorterType,
-								"system":  system.Id,
-								"created": shorterRecordPeriod,
-							},
+							params,
 						)).
 						All(&recordIds)
 
 					// continue if not enough shorter records
-					if err != nil || len(recordIds) < recordData.minShorterRecords {
+					if len(recordIds) < recordData.minShorterRecords {
 						continue
 					}
 					// average the shorter records and create longer record
 					longerRecord := core.NewRecord(collection)
 					longerRecord.Set("system", system.Id)
 					longerRecord.Set("type", recordData.longerType)
+					// network_probe_stats uses created as unix timestamp in milliseconds, so we need to set it manually here instead of relying on the default created field
+					if collection.Name == "network_probe_stats" {
+						longerRecord.Set("created", now.UnixMilli())
+					}
 					switch collection.Name {
 					case "system_stats":
 						longerRecord.Set("stats", rm.AverageSystemStats(db, recordIds))
 					case "container_stats":
-
 						longerRecord.Set("stats", rm.AverageContainerStats(db, recordIds))
+					case "network_probe_stats":
+						longerRecord.Set("stats", rm.AverageProbeStats(db, recordIds))
 					}
 					if err := txApp.SaveNoValidate(longerRecord); err != nil {
-						slog.Error("failed to save longer record", "err", err)
+						log.Println("failed to save longer record", "err", err)
 					}
 				}
 			}
@@ -154,7 +174,14 @@ func (rm *RecordManager) CreateLongerRecords() {
 		return nil
 	})
 
-	// log.Println("finished creating longer records", "time (ms)", time.Since(start).Milliseconds())
+	// slog.Info("finished creating longer records", "time (ms)", time.Since(now).Milliseconds())
+}
+
+func getCreatedTimeField(collectionName string, period time.Time) any {
+	if collectionName == "network_probe_stats" {
+		return period.UnixMilli()
+	}
+	return period.Format(types.DefaultDateLayout)
 }
 
 // Calculate the average stats of a list of system_stats records without reflect
@@ -186,16 +213,11 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 
 	// necessary because uint8 is not big enough for the sum
 	batterySum := 0
-	batteryCount := 0
-	batterySums := make(map[string]uint64)
-	batteryCounts := make(map[string]uint64)
 	// accumulate per-core usage across records
 	var cpuCoresSums []uint64
 	// accumulate cpu breakdown [user, system, iowait, steal, idle]
 	var cpuBreakdownSums []float64
 	tempCount := float64(0)
-	var fanSums map[string]uint64
-	fanCount := uint64(0)
 
 	// Accumulate totals
 	for i := range records {
@@ -235,15 +257,8 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 		for i := range stats.DiskIoStats {
 			sum.DiskIoStats[i] += stats.DiskIoStats[i]
 		}
-		if hasBattery(stats.Battery, stats.Batteries) {
-			batterySum += int(stats.Battery[0])
-			batteryCount++
-			sum.Battery[1] = stats.Battery[1]
-		}
-		for name, percent := range stats.Batteries {
-			batterySums[name] += uint64(percent)
-			batteryCounts[name]++
-		}
+		batterySum += int(stats.Battery[0])
+		sum.Battery[1] = stats.Battery[1]
 
 		// accumulate per-core usage if present
 		if stats.CpuCoresUsage != nil {
@@ -294,17 +309,6 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 			}
 		}
 
-		// Accumulate fan speeds
-		if stats.Fans != nil {
-			if fanSums == nil {
-				fanSums = make(map[string]uint64, len(stats.Fans))
-			}
-			fanCount++
-			for key, value := range stats.Fans {
-				fanSums[key] += uint64(value)
-			}
-		}
-
 		// Accumulate extra filesystem stats
 		if stats.ExtraFs != nil {
 			if sum.ExtraFs == nil {
@@ -389,15 +393,7 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 	sum.LoadAvg[2] = twoDecimals(sum.LoadAvg[2] / count)
 	sum.Bandwidth[0] = sum.Bandwidth[0] / uint64(count)
 	sum.Bandwidth[1] = sum.Bandwidth[1] / uint64(count)
-	if batteryCount > 0 {
-		sum.Battery[0] = uint8(batterySum / batteryCount)
-	}
-	if len(batterySums) > 0 {
-		sum.Batteries = make(map[string]uint8, len(batterySums))
-		for name, total := range batterySums {
-			sum.Batteries[name] = uint8(total / batteryCounts[name])
-		}
-	}
+	sum.Battery[0] = uint8(batterySum / int(count))
 
 	// Average network interfaces
 	if sum.NetworkInterfaces != nil {
@@ -418,14 +414,6 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 		}
 	}
 
-	// Average fan speeds
-	if fanSums != nil && fanCount > 0 {
-		sum.Fans = make(map[string]uint16, len(fanSums))
-		for key, value := range fanSums {
-			sum.Fans[key] = uint16(value / fanCount)
-		}
-	}
-
 	// Average extra filesystem stats
 	if sum.ExtraFs != nil {
 		for key := range sum.ExtraFs {
@@ -485,10 +473,6 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 	return sum
 }
 
-func hasBattery(legacy [2]uint8, batteries map[string]uint8) bool {
-	return legacy != [2]uint8{} || len(batteries) > 0
-}
-
 // Calculate the average stats of a list of container_stats records
 func (rm *RecordManager) AverageContainerStats(db dbx.Builder, records RecordIds) []container.Stats {
 	allStats := make([][]container.Stats, 0, len(records))
@@ -546,6 +530,80 @@ func AverageContainerStatsSlice(records [][]container.Stats) []container.Stats {
 	return result
 }
 
+// AverageProbeStats averages probe stats across multiple records.
+// For each probe key: avg of average fields, min of mins, and max of maxes.
+func (rm *RecordManager) AverageProbeStats(db dbx.Builder, records RecordIds) map[string]probe.Stats {
+	type probeValues struct {
+		sums   probe.Stats
+		counts []int
+	}
+
+	query := db.NewQuery("SELECT stats FROM network_probe_stats WHERE id = {:id}")
+
+	// accumulate sums for each probe key across records
+	sums := make(map[string]*probeValues)
+	var row StatsRecord
+	for _, rec := range records {
+		row.Stats = row.Stats[:0]
+		query.Bind(dbx.Params{"id": rec.Id}).One(&row)
+		var rawStats map[string]probe.Stats
+		if err := json.Unmarshal(row.Stats, &rawStats); err != nil {
+			continue
+		}
+		for key, vals := range rawStats {
+			s, ok := sums[key]
+			if !ok {
+				s = &probeValues{sums: make(probe.Stats, len(vals)), counts: make([]int, len(vals))}
+				sums[key] = s
+			}
+			if len(vals) > len(s.sums) {
+				expandedSums := make(probe.Stats, len(vals))
+				copy(expandedSums, s.sums)
+				s.sums = expandedSums
+
+				expandedCounts := make([]int, len(vals))
+				copy(expandedCounts, s.counts)
+				s.counts = expandedCounts
+			}
+			for i := range vals {
+				switch i {
+				case 1: // min fields
+					if s.counts[i] == 0 || vals[i] < s.sums[i] {
+						s.sums[i] = vals[i]
+					}
+				case 2: // max fields
+					if s.counts[i] == 0 || vals[i] > s.sums[i] {
+						s.sums[i] = vals[i]
+					}
+				default: // average fields
+					s.sums[i] += vals[i]
+				}
+				s.counts[i]++
+			}
+		}
+	}
+
+	// compute final averages
+	result := make(map[string]probe.Stats, len(sums))
+	for key, s := range sums {
+		if len(s.counts) == 0 {
+			continue
+		}
+		for i := range s.sums {
+			switch i {
+			case 1, 2: // min and max fields should not be averaged
+				continue
+			default:
+				if s.counts[i] > 0 {
+					s.sums[i] = twoDecimals(s.sums[i] / float64(s.counts[i]))
+				}
+			}
+		}
+		result[key] = s.sums
+	}
+	return result
+}
+
 /* Round float to two decimals */
 func twoDecimals(value float64) float64 {
 	return math.Round(value*100) / 100

internal/records/records_averaging_test.go

@@ -291,28 +291,6 @@ func TestAverageSystemStatsSlice_Temperatures(t *testing.T) {
 	assert.Equal(t, 80.0, result.Temperatures["gpu"])
 }
 
-// Tests that fan speeds are averaged and records without fan data are excluded.
-func TestAverageSystemStatsSlice_Fans(t *testing.T) {
-	input := []system.Stats{
-		{
-			Fans: map[string]uint16{"cpu": 60_000, "case": 1_000},
-		},
-		{
-			Fans: map[string]uint16{"cpu": 50_000, "case": 2_000},
-		},
-		{
-			// No fan data - should not affect fan averaging
-			Cpu: 30.0,
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.Fans)
-	assert.Equal(t, uint16(55_000), result.Fans["cpu"])
-	assert.Equal(t, uint16(1_500), result.Fans["case"])
-}
-
 func TestAverageSystemStatsSlice_NetworkInterfaces(t *testing.T) {
 	input := []system.Stats{
 		{
@@ -602,28 +580,6 @@ func TestAverageSystemStatsSlice_BatteryLastChargeState(t *testing.T) {
 	assert.Equal(t, uint8(0), result.Battery[1]) // last record's charge state
 }
 
-func TestAverageSystemStatsSlice_BatteriesIndependentSamples(t *testing.T) {
-	input := []system.Stats{
-		{Battery: [2]uint8{80, 4}, Batteries: map[string]uint8{"Primary": 80, "Mouse": 0}},
-		{Battery: [2]uint8{60, 3}, Batteries: map[string]uint8{"Primary": 60}},
-		{Battery: [2]uint8{30, 4}, Batteries: map[string]uint8{"Mouse": 40}},
-		{},
-	}
-	result := records.AverageSystemStatsSlice(input)
-	assert.Equal(t, map[string]uint8{"Primary": 70, "Mouse": 20}, result.Batteries)
-	assert.Equal(t, uint8(56), result.Battery[0], "representative battery excludes absent samples")
-	assert.Equal(t, uint8(4), result.Battery[1], "representative state comes from its latest sample")
-}
-
-func TestAverageSystemStatsSlice_ZeroRepresentativeBattery(t *testing.T) {
-	result := records.AverageSystemStatsSlice([]system.Stats{
-		{Battery: [2]uint8{0, 1}, Batteries: map[string]uint8{"Primary": 0}},
-		{},
-	})
-	assert.Equal(t, [2]uint8{0, 1}, result.Battery)
-	assert.Equal(t, map[string]uint8{"Primary": 0}, result.Batteries)
-}
-
 func TestAverageSystemStatsSlice_ThreeRecordsRounding(t *testing.T) {
 	input := []system.Stats{
 		{Cpu: 10.0, Mem: 8.0},

internal/records/records_deletion.go

@@ -3,7 +3,6 @@ package records
 import (
 	"fmt"
 	"log/slog"
-	"strings"
 	"time"
 
 	"github.com/pocketbase/dbx"
@@ -12,7 +11,6 @@ import (
 
 // Delete old records
 func (rm *RecordManager) DeleteOldRecords() {
-	// Pocketbase cron does not handle errors, log them here.
 	rm.app.RunInTransaction(func(txApp core.App) error {
 		err := deleteOldSystemStats(txApp)
 		if err != nil {
@@ -60,7 +58,7 @@ func deleteOldAlertsHistory(app core.App, countToKeep, countBeforeDeletion int)
 // Deletes system_stats records older than what is displayed in the UI
 func deleteOldSystemStats(app core.App) error {
 	// Collections to process
-	collections := [2]string{"system_stats", "container_stats"}
+	collections := [3]string{"system_stats", "container_stats", "network_probe_stats"}
 
 	// Record types and their retention periods
 	type RecordDeletionData struct {
@@ -76,24 +74,17 @@ func deleteOldSystemStats(app core.App) error {
 	}
 
 	now := time.Now().UTC()
+	db := app.DB()
 
 	for _, collection := range collections {
-		// Build the WHERE clause
-		var conditionParts []string
-		var params dbx.Params = make(map[string]any)
-		for i := range recordData {
-			rd := recordData[i]
-			// Create parameterized condition for this record type
-			dateParam := fmt.Sprintf("date%d", i)
-			conditionParts = append(conditionParts, fmt.Sprintf("(type = '%s' AND created < {:%s})", rd.recordType, dateParam))
-			params[dateParam] = now.Add(-rd.retention)
-		}
-		// Combine conditions with OR
-		conditionStr := strings.Join(conditionParts, " OR ")
-		// Construct and execute the full raw query
-		rawQuery := fmt.Sprintf("DELETE FROM %s WHERE %s", collection, conditionStr)
-		if _, err := app.DB().NewQuery(rawQuery).Bind(params).Execute(); err != nil {
-			return fmt.Errorf("failed to delete from %s: %v", collection, err)
+		query := db.Delete(collection, dbx.NewExp("type={:type} AND created<{:created}"))
+		for _, rd := range recordData {
+			if _, err := query.Bind(dbx.Params{
+				"type":    rd.recordType,
+				"created": getCreatedTimeField(collection, now.Add(-rd.retention)),
+			}).Execute(); err != nil {
+				return fmt.Errorf("failed to delete from %s: %v", collection, err)
+			}
 		}
 	}
 	return nil

internal/site/package.json

@@ -9,7 +9,11 @@
 		"preview": "vite preview",
 		"sync": "lingui extract --overwrite && lingui compile",
 		"sync_no_compile": "lingui extract --overwrite --clean",
-		"sync_and_purge": "lingui extract --overwrite --clean && lingui compile"
+		"sync_and_purge": "lingui extract --overwrite --clean && lingui compile",
+		"format": "biome format --write .",
+		"lint": "biome lint .",
+		"check": "biome check .",
+		"check:fix": "biome check --fix ."
 	},
 	"dependencies": {
 		"@henrygd/queue": "^1.0.7",

internal/site/src/components/charts/area-chart.tsx

@@ -66,7 +66,7 @@ export default function AreaChartDefault({
 }) {
 	const { yAxisWidth, updateYAxisWidth } = useYAxisWidth()
 	const { isIntersecting, ref } = useIntersectionObserver({ freeze: false })
-	const sourceData = customData ?? chartData.systemStats
+	const sourceData = customData ?? chartData.systemStats ?? []
 	const [displayData, setDisplayData] = useState(sourceData)
 	const [displayMaxToggled, setDisplayMaxToggled] = useState(maxToggled)
 
@@ -111,6 +111,8 @@ export default function AreaChartDefault({
 		})
 	}, [areasKey, displayMaxToggled])
 
+	const XAxis = xAxis(chartData.chartTime, displayData.at(-1)?.created)
+
 	return useMemo(() => {
 		if (displayData.length === 0) {
 			return null
@@ -146,7 +148,7 @@ export default function AreaChartDefault({
 							axisLine={false}
 						/>
 					)}
-					{xAxis(chartData)}
+					{XAxis}
 					<ChartTooltip
 						animationEasing="ease-out"
 						animationDuration={150}
@@ -167,5 +169,5 @@ export default function AreaChartDefault({
 				</AreaChart>
 			</ChartContainer>
 		)
-	}, [displayData, yAxisWidth, filter, Areas])
+	}, [displayData, yAxisWidth, filter, Areas, XAxis])
 }

internal/site/src/components/charts/line-chart.tsx

@@ -22,6 +22,7 @@ export type DataPoint<T = SystemStatsRecord> = {
 	order?: number
 	strokeOpacity?: number
 	activeDot?: boolean
+	dot?: boolean
 }
 
 export default function LineChartDefault({
@@ -41,6 +42,7 @@ export default function LineChartDefault({
 	filter,
 	truncate = false,
 	chartProps,
+	connectNulls,
 }: {
 	chartData: ChartData
 	// biome-ignore lint/suspicious/noExplicitAny: accepts different data source types (systemStats or containerData)
@@ -62,10 +64,11 @@ export default function LineChartDefault({
 	filter?: string
 	truncate?: boolean
 	chartProps?: Omit<React.ComponentProps<typeof LineChart>, "data" | "margin">
+	connectNulls?: boolean
 }) {
 	const { yAxisWidth, updateYAxisWidth } = useYAxisWidth()
 	const { isIntersecting, ref } = useIntersectionObserver({ freeze: false })
-	const sourceData = customData ?? chartData.systemStats
+	const sourceData = customData ?? chartData.systemStats ?? []
 	const [displayData, setDisplayData] = useState(sourceData)
 	const [displayMaxToggled, setDisplayMaxToggled] = useState(maxToggled)
 
@@ -83,7 +86,9 @@ export default function LineChartDefault({
 	}, [displayData, displayMaxToggled, isIntersecting, maxToggled, sourceData])
 
 	// Use a stable key derived from data point identities and visual properties
-	const linesKey = dataPoints?.map((d) => `${d.label}:${d.strokeOpacity ?? ""}`).join("\0")
+	const linesKey = dataPoints?.map((d) => `${d.label}:${d.strokeOpacity}${d.dot}`).join("\0")
+
+	const XAxis = xAxis(chartData.chartTime, displayData.at(-1)?.created)
 
 	const Lines = useMemo(() => {
 		return dataPoints?.map((dataPoint, i) => {
@@ -97,7 +102,7 @@ export default function LineChartDefault({
 					dataKey={dataPoint.dataKey}
 					name={dataPoint.label}
 					type="monotoneX"
-					dot={false}
+					dot={dataPoint.dot || false}
 					strokeWidth={1.5}
 					stroke={color}
 					strokeOpacity={dataPoint.strokeOpacity}
@@ -105,6 +110,7 @@ export default function LineChartDefault({
 					// stackId={dataPoint.stackId}
 					order={dataPoint.order || i}
 					activeDot={dataPoint.activeDot ?? true}
+					connectNulls={connectNulls}
 				/>
 			)
 		})
@@ -145,7 +151,7 @@ export default function LineChartDefault({
 							axisLine={false}
 						/>
 					)}
-					{xAxis(chartData)}
+					{XAxis}
 					<ChartTooltip
 						animationEasing="ease-out"
 						animationDuration={150}
@@ -166,5 +172,5 @@ export default function LineChartDefault({
 				</LineChart>
 			</ChartContainer>
 		)
-	}, [displayData, yAxisWidth, filter, Lines])
+	}, [displayData, yAxisWidth, filter, Lines, XAxis])
 }

internal/site/src/components/containers-table/containers-table-columns.tsx

@@ -15,7 +15,7 @@ import {
 import { EthernetIcon, HourglassIcon, SquareArrowRightEnterIcon } from "../ui/icons"
 import { Badge } from "../ui/badge"
 import { t } from "@lingui/core/macro"
-import { $allSystemsById, $longestSystemNameLen } from "@/lib/stores"
+import { $allSystemsById, $longestSystemName } from "@/lib/stores"
 import { useStore } from "@nanostores/react"
 import { Tooltip, TooltipContent, TooltipTrigger } from "../ui/tooltip"
 
@@ -63,10 +63,13 @@ export const containerChartCols: ColumnDef<ContainerRecord>[] = [
 		header: ({ column }) => <HeaderButton column={column} name={t`System`} Icon={ServerIcon} />,
 		cell: ({ getValue }) => {
 			const allSystems = useStore($allSystemsById)
-			const longestName = useStore($longestSystemNameLen)
+			const longestName = useStore($longestSystemName)
 			return (
-				<div className="ms-1 max-w-40 truncate" style={{ width: `${longestName / 1.05}ch` }}>
-					{allSystems[getValue() as string]?.name ?? ""}
+				<div className="ms-1 relative w-fit max-w-40">
+					<span className="invisible block whitespace-nowrap" aria-hidden="true">
+						{longestName}
+					</span>
+					<span className="absolute inset-0 truncate">{allSystems[getValue() as string]?.name ?? ""}</span>
 				</div>
 			)
 		},

internal/site/src/components/login/auth-form.tsx

@@ -17,7 +17,7 @@ import { toast } from "../ui/use-toast"
 import { OtpInputForm } from "./otp-forms"
 
 const honeypot = v.literal("")
-const emailSchema = v.pipe(v.string(), v.rfcEmail(t`Invalid email address.`))
+const emailSchema = v.pipe(v.string(), v.email(t`Invalid email address.`))
 const passwordSchema = v.pipe(
 	v.string(),
 	v.minLength(8, t`Password must be at least 8 characters.`),
@@ -175,8 +175,8 @@ export function UserAuthForm({
 	 */
 	function redirectToOauthProvider(provider: AuthProviderInfo) {
 		const url = new URL(provider.authURL)
-		url.searchParams.set("redirect_uri", `${window.location.origin}${basePath}`)
-		localStorage.setItem("provider", JSON.stringify(provider))
+		// url.searchParams.set("redirect_uri", `${window.location.origin}${basePath}`)
+		sessionStorage.setItem("provider", JSON.stringify(provider))
 		window.location.href = url.toString()
 	}
 
@@ -186,13 +186,12 @@ export function UserAuthForm({
 		const code = params.get("code")
 		if (code) {
 			const state = params.get("state")
-			const provider: AuthProviderInfo = JSON.parse(localStorage.getItem("provider") ?? "{}")
-		    localStorage.removeItem("provider")
-			window.history.replaceState({}, "", window.location.pathname)
+			const provider: AuthProviderInfo = JSON.parse(sessionStorage.getItem("provider") ?? "{}")
 			if (!state || provider.state !== state) {
 				showLoginFaliedToast()
 			} else {
 				setIsOauthLoading(true)
+				window.history.replaceState({}, "", window.location.pathname)
 				pb.collection("users")
 					.authWithOAuth2Code(provider.name, code, provider.codeVerifier, `${window.location.origin}${basePath}`)
 					.then(() => $authenticated.set(pb.authStore.isValid))
@@ -286,7 +285,7 @@ export function UserAuthForm({
 									{errors?.passwordConfirm && <p className="px-1 text-xs text-red-600">{errors.passwordConfirm}</p>}
 								</div>
 							)}
-							<div className="sr-only" aria-hidden="true">
+							<div className="sr-only">
 								{/* honeypot */}
 								<label htmlFor="website">Website</label>
 								<input
@@ -294,7 +293,6 @@ export function UserAuthForm({
 									type="text"
 									name="website"
 									tabIndex={-1}
-									readOnly
 									autoComplete="off"
 									data-1p-ignore
 									data-lpignore="true"

internal/site/src/components/navbar.tsx

@@ -8,6 +8,7 @@ import {
 	LogOutIcon,
 	LogsIcon,
 	MenuIcon,
+	NetworkIcon,
 	PlusIcon,
 	SearchIcon,
 	ServerIcon,
@@ -109,6 +110,10 @@ export default function Navbar() {
 								<HardDriveIcon className="h-4 w-4 me-2.5" strokeWidth={1.5} />
 								<span>S.M.A.R.T.</span>
 							</DropdownMenuItem>
+							<DropdownMenuItem onClick={() => navigate(getPagePath($router, "probes"))} className="flex items-center">
+								<NetworkIcon className="h-4 w-4 me-2.5" strokeWidth={1.5} />
+								<Trans>Network Probes</Trans>
+							</DropdownMenuItem>
 							<DropdownMenuItem
 								onClick={() => navigate(getPagePath($router, "settings", { name: "general" }))}
 								className="flex items-center"
@@ -180,6 +185,21 @@ export default function Navbar() {
 					</TooltipTrigger>
 					<TooltipContent>S.M.A.R.T.</TooltipContent>
 				</Tooltip>
+				<Tooltip>
+					<TooltipTrigger asChild>
+						<Link
+							href={getPagePath($router, "probes")}
+							className={cn("hidden md:grid", buttonVariants({ variant: "ghost", size: "icon" }))}
+							aria-label="Network Probes"
+							onMouseEnter={() => import("@/components/routes/probes")}
+						>
+							<NetworkIcon className="h-[1.2rem] w-[1.2rem]" strokeWidth={1.5} />
+						</Link>
+					</TooltipTrigger>
+					<TooltipContent>
+						<Trans>Network Probes</Trans>
+					</TooltipContent>
+				</Tooltip>
 				<LangToggle />
 				<ModeToggle />
 				<Tooltip>

internal/site/src/components/network-probes-table/network-probes-columns.tsx

@@ -0,0 +1,391 @@
+import type { CellContext, Column, ColumnDef } from "@tanstack/react-table"
+import { Button } from "@/components/ui/button"
+import { cn, copyToClipboard, decimalString, formatMicroseconds, hourWithSeconds } from "@/lib/utils"
+import {
+	GlobeIcon,
+	TimerIcon,
+	WifiOffIcon,
+	Trash2Icon,
+	ArrowLeftRightIcon,
+	MoreHorizontalIcon,
+	ServerIcon,
+	ClockIcon,
+	NetworkIcon,
+	RefreshCwIcon,
+	PenBoxIcon,
+	PauseCircleIcon,
+	PlayCircleIcon,
+	CopyIcon,
+} from "lucide-react"
+import { t } from "@lingui/core/macro"
+import type { NetworkProbeRecord, SystemRecord } from "@/types"
+import {
+	DropdownMenu,
+	DropdownMenuContent,
+	DropdownMenuItem,
+	DropdownMenuSeparator,
+	DropdownMenuTrigger,
+} from "@/components/ui/dropdown-menu"
+import { Trans } from "@lingui/react/macro"
+import { $allSystemsById, $longestSystemName } from "@/lib/stores"
+import { useStore } from "@nanostores/react"
+import { SystemStatus } from "@/lib/enums"
+import { Checkbox } from "@/components/ui/checkbox"
+import { useMemo } from "react"
+import { formatBulkProbeLine } from "@/components/network-probes-table/probe-dialog"
+import { Badge } from "../ui/badge"
+
+const protocolColors: Record<string, string> = {
+	icmp: "bg-blue-500/15! text-blue-600 dark:text-blue-400",
+	tcp: "bg-purple-500/15! text-purple-600 dark:text-purple-400",
+	http: "bg-green-500/15! text-green-700 dark:text-green-400",
+}
+
+const SYSTEM_STATUS_COLORS = {
+	[SystemStatus.Up]: "bg-green-500",
+	[SystemStatus.Down]: "bg-red-500",
+	[SystemStatus.Paused]: "bg-primary/40",
+	[SystemStatus.Pending]: "bg-yellow-500",
+} as const
+
+/**
+ * A probe is considered muted if it's disabled or if its associated system is not up.
+ */
+const isMuted = (record: NetworkProbeRecord, systemRecord: SystemRecord | undefined) =>
+	!record.enabled || systemRecord?.status !== SystemStatus.Up
+
+export function getProbeColumns(
+	longestName = "",
+	longestTarget = "",
+	{
+		onEdit,
+		onDelete,
+		onSetEnabled,
+	}: {
+		onEdit?: (probe: NetworkProbeRecord) => void
+		onDelete?: (probes: NetworkProbeRecord[]) => void | Promise<void>
+		onSetEnabled?: (probes: NetworkProbeRecord[], enabled: boolean) => void | Promise<void>
+	} = {}
+): ColumnDef<NetworkProbeRecord>[] {
+	return [
+		{
+			id: "select",
+			header: ({ table }) => (
+				<Checkbox
+					className="ms-2"
+					checked={table.getIsAllRowsSelected() || (table.getIsSomeRowsSelected() && "indeterminate")}
+					onClick={(event) => event.stopPropagation()}
+					onCheckedChange={(value) => table.toggleAllRowsSelected(!!value)}
+					aria-label={t`Select all`}
+				/>
+			),
+			cell: ({ row }) => (
+				<Checkbox
+					checked={row.getIsSelected()}
+					onClick={(event) => event.stopPropagation()}
+					onCheckedChange={(value) => row.toggleSelected(!!value)}
+					aria-label={t`Select row`}
+				/>
+			),
+			enableSorting: false,
+			enableHiding: false,
+			size: 44,
+		},
+		{
+			id: "name",
+			sortingFn: (a, b) => (a.original.name || a.original.target).localeCompare(b.original.name || b.original.target),
+			accessorFn: (record) => record.name || record.target,
+			header: ({ column }) => <HeaderButton column={column} name={t`Name`} Icon={NetworkIcon} />,
+			cell: ({ row, getValue }) => {
+				const probe = row.original
+				const { status } = useStore($allSystemsById)[probe.system] || {}
+
+				let color = "bg-green-500"
+				if (!probe.enabled || status === SystemStatus.Paused) {
+					color = "bg-primary/40"
+				} else if (status === SystemStatus.Down || status === SystemStatus.Pending) {
+					color = "bg-yellow-500"
+				}
+				return (
+					<div className="ms-1.5 max-w-40 flex gap-2 items-center tabular-nums">
+						<span className={cn("shrink-0 size-2 rounded-full", color)} />
+						<div className="relative w-fit min-w-0 max-w-full">
+							<span className="invisible block overflow-hidden whitespace-nowrap" aria-hidden="true">
+								{longestName}
+							</span>
+							<span className="absolute inset-0 truncate">{getValue() as string}</span>
+						</div>
+					</div>
+				)
+			},
+		},
+		{
+			id: "system",
+			accessorFn: (record) => record.system,
+			sortingFn: (a, b) => {
+				const allSystems = $allSystemsById.get()
+				const systemNameA = allSystems[a.original.system]?.name ?? ""
+				const systemNameB = allSystems[b.original.system]?.name ?? ""
+				const primary = systemNameA.localeCompare(systemNameB)
+				if (primary !== 0) {
+					return primary
+				}
+				return (a.original.name || a.original.target).localeCompare(b.original.name || b.original.target)
+			},
+			header: ({ column }) => <HeaderButton column={column} name={t`System`} Icon={ServerIcon} />,
+			cell: ({ getValue }) => {
+				const system = useStore($allSystemsById)[getValue() as string] as SystemRecord | undefined
+				const longestSystemName = useStore($longestSystemName)
+				const name = system?.name
+				const status = system?.status as SystemStatus // undefined val is fine but makes lsp mad
+
+				return useMemo(
+					() => (
+						<div className="ms-1.5 max-w-44 flex gap-2 items-center tabular-nums">
+							<span className={cn("shrink-0 size-2 rounded-full", SYSTEM_STATUS_COLORS[status])} />
+							<div className="relative w-fit min-w-0 max-w-full">
+								<span className="invisible block whitespace-nowrap" aria-hidden="true">
+									{longestSystemName}
+								</span>
+								<span className="absolute inset-0 truncate">{name}</span>
+							</div>
+						</div>
+					),
+					[status, name]
+				)
+			},
+		},
+		{
+			id: "target",
+			sortingFn: (a, b) => a.original.target.localeCompare(b.original.target),
+			accessorFn: (record) => record.target,
+			header: ({ column }) => <HeaderButton column={column} name={t`Target`} Icon={GlobeIcon} />,
+			cell: ({ getValue }) => (
+				<div className="ms-1.5 relative w-fit max-w-44 tabular-nums">
+					<span className="invisible block whitespace-nowrap" aria-hidden="true">
+						{longestTarget}
+					</span>
+					<span className="absolute inset-0 truncate">{getValue() as string}</span>
+				</div>
+			),
+		},
+		{
+			id: "protocol",
+			accessorFn: (record) => record.protocol,
+			header: ({ column }) => <HeaderButton column={column} name={t`Protocol`} Icon={ArrowLeftRightIcon} />,
+			cell: ({ getValue }) => {
+				const protocol = getValue() as string
+				return <Badge className={cn("uppercase", protocolColors[protocol])}>{protocol}</Badge>
+			},
+		},
+		{
+			id: "interval",
+			accessorFn: (record) => record.interval,
+			invertSorting: true,
+			header: ({ column }) => <HeaderButton column={column} name={t`Interval`} Icon={RefreshCwIcon} />,
+			cell: ({ getValue }) => <span className="ms-1.5 tabular-nums">{getValue() as number}s</span>,
+		},
+		{
+			id: "res",
+			accessorFn: (record) => record.res,
+			invertSorting: true,
+			header: ({ column }) => <HeaderButton column={column} name={t`Response`} Icon={TimerIcon} />,
+			cell: responseTimeCell,
+		},
+		{
+			id: "res1h",
+			accessorFn: (record) => record.resAvg1h,
+			invertSorting: true,
+			header: ({ column }) => <HeaderButton column={column} name={t`Avg 1h`} Icon={TimerIcon} />,
+			cell: responseTimeCell,
+		},
+		{
+			id: "max1h",
+			accessorFn: (record) => record.resMax1h,
+			invertSorting: true,
+			header: ({ column }) => <HeaderButton column={column} name={t`Max 1h`} Icon={TimerIcon} />,
+			cell: responseTimeCell,
+		},
+		{
+			id: "min1h",
+			accessorFn: (record) => record.resMin1h,
+			invertSorting: true,
+			header: ({ column }) => <HeaderButton column={column} name={t`Min 1h`} Icon={TimerIcon} />,
+			cell: responseTimeCell,
+		},
+		{
+			id: "loss",
+			accessorFn: (record) => record.loss1h,
+			invertSorting: true,
+			header: ({ column }) => <HeaderButton column={column} name={t`Loss 1h`} Icon={WifiOffIcon} />,
+			cell: ({ row }) => {
+				const { loss1h, res, system } = row.original
+				const systemRecord = useStore($allSystemsById)[system]
+
+				if (loss1h === undefined || (!res && !loss1h)) {
+					return <span className="ms-1.5 text-muted-foreground">-</span>
+				}
+
+				const muted = isMuted(row.original, systemRecord)
+				let color = "bg-green-500"
+				if (muted) {
+					color = "bg-muted-foreground/50"
+				} else if (loss1h) {
+					color = loss1h > 20 ? "bg-red-500" : "bg-yellow-500"
+				}
+				return (
+					<span className="ms-1.5 tabular-nums flex gap-2 items-center">
+						<span className={cn("shrink-0 size-2 rounded-full", color)} />
+						{loss1h === 100 ? loss1h : decimalString(loss1h, loss1h >= 10 ? 1 : 2)}%
+					</span>
+				)
+			},
+		},
+		{
+			id: "updated",
+			invertSorting: true,
+			accessorFn: (record) => record.updated,
+			header: ({ column }) => <HeaderButton column={column} name={t`Updated`} Icon={ClockIcon} />,
+			cell: ({ getValue }) => {
+				const timestamp = getValue() as number
+				if (!timestamp) {
+					return <span className="ms-1.5 text-muted-foreground">-</span>
+				}
+				return <span className="ms-1.5 tabular-nums">{hourWithSeconds(timestamp)}</span>
+			},
+		},
+		{
+			id: "actions",
+			enableSorting: false,
+			enableHiding: false,
+			header: () => null,
+			size: 40,
+			cell: ({ row, table }) => {
+				const selectedRows = table.getSelectedRowModel().rows
+				const actionRows =
+					row.getIsSelected() && selectedRows.length > 1
+						? selectedRows.map((selectedRow) => selectedRow.original)
+						: [row.original]
+				const isBulkAction = actionRows.length > 1
+				const shouldPause = actionRows.some((probe) => probe.enabled)
+				const bulkCopyContent = actionRows.map((probe) => formatBulkProbeLine(probe)).join("\n")
+				return (
+					<DropdownMenu>
+						<DropdownMenuTrigger asChild>
+							<Button variant="ghost" size="icon" className="size-10">
+								<span className="sr-only">
+									<Trans>Open menu</Trans>
+								</span>
+								<MoreHorizontalIcon className="w-5" />
+							</Button>
+						</DropdownMenuTrigger>
+						<DropdownMenuContent align="end" onClick={(event) => event.stopPropagation()}>
+							{!isBulkAction && (
+								<DropdownMenuItem
+									onClick={() => {
+										onEdit?.(row.original)
+									}}
+								>
+									<PenBoxIcon className="me-2.5 size-4" />
+									<Trans>Edit</Trans>
+								</DropdownMenuItem>
+							)}
+							<DropdownMenuItem
+								onClick={() => {
+									onSetEnabled?.(actionRows, !shouldPause)
+								}}
+							>
+								{shouldPause ? (
+									<>
+										<PauseCircleIcon className="me-2.5 size-4" />
+										<Trans>Pause</Trans>
+									</>
+								) : (
+									<>
+										<PlayCircleIcon className="me-2.5 size-4" />
+										<Trans>Resume</Trans>
+									</>
+								)}
+							</DropdownMenuItem>
+							<DropdownMenuItem
+								onClick={() => {
+									copyToClipboard(bulkCopyContent)
+								}}
+							>
+								<CopyIcon className="me-2.5 size-4" />
+								<Trans>Bulk copy</Trans>
+							</DropdownMenuItem>
+							<DropdownMenuSeparator />
+							<DropdownMenuItem
+								onClick={() => {
+									onDelete?.(actionRows)
+								}}
+							>
+								<Trash2Icon className="me-2.5 size-4" />
+								<Trans>Delete</Trans>
+							</DropdownMenuItem>
+						</DropdownMenuContent>
+					</DropdownMenu>
+				)
+			},
+		},
+	]
+}
+
+const responseTimeThresholds = {
+	http: { warning: 800_000, critical: 3_000_000 },
+	tcp: { warning: 500_000, critical: 2_000_000 },
+	icmp: { warning: 100_000, critical: 500_000 },
+}
+
+function responseTimeCell(cell: CellContext<NetworkProbeRecord, unknown>) {
+	const probe = cell.row.original
+	const systemRecord = useStore($allSystemsById)[probe.system]
+	const responseTime = cell.getValue() as number | undefined
+
+	if (!responseTime) {
+		return <span className="ms-1.5 text-muted-foreground">-</span>
+	}
+
+	const muted = isMuted(probe, systemRecord)
+	let color = "bg-green-500"
+	if (muted) {
+		color = "bg-muted-foreground/50"
+	} else if (responseTime > responseTimeThresholds[probe.protocol].warning) {
+		color = "bg-yellow-500"
+	}
+	if (!muted && responseTime > responseTimeThresholds[probe.protocol].critical) {
+		color = "bg-red-500"
+	}
+	return (
+		<span className="ms-1.5 tabular-nums flex gap-2 items-center">
+			<span className={cn("shrink-0 size-2 rounded-full", color)} />
+			{formatMicroseconds(responseTime)}
+		</span>
+	)
+}
+
+function HeaderButton({
+	column,
+	name,
+	Icon,
+}: {
+	column: Column<NetworkProbeRecord>
+	name: string
+	Icon: React.ElementType
+}) {
+	const isSorted = column.getIsSorted()
+	return (
+		<Button
+			className={cn(
+				"h-9 px-3 flex items-center gap-2 duration-50",
+				isSorted && "bg-accent/70 light:bg-accent text-accent-foreground/90"
+			)}
+			variant="ghost"
+			onClick={() => column.toggleSorting(column.getIsSorted() === "asc")}
+		>
+			{Icon && <Icon className="size-4" />}
+			{name}
+		</Button>
+	)
+}

internal/site/src/components/network-probes-table/network-probes-table.tsx

@@ -0,0 +1,538 @@
+import { t } from "@lingui/core/macro"
+import { Trans } from "@lingui/react/macro"
+import {
+	type ColumnFiltersState,
+	flexRender,
+	getCoreRowModel,
+	getFilteredRowModel,
+	getSortedRowModel,
+	type Row,
+	type RowSelectionState,
+	type SortingState,
+	type Table as TableType,
+	useReactTable,
+	type VisibilityState,
+} from "@tanstack/react-table"
+import { useVirtualizer, type VirtualItem } from "@tanstack/react-virtual"
+import {
+	AlertDialog,
+	AlertDialogAction,
+	AlertDialogCancel,
+	AlertDialogContent,
+	AlertDialogDescription,
+	AlertDialogFooter,
+	AlertDialogHeader,
+	AlertDialogTitle,
+} from "@/components/ui/alert-dialog"
+import { Button, buttonVariants } from "@/components/ui/button"
+import { memo, useCallback, useMemo, useRef, useState } from "react"
+import { getProbeColumns } from "@/components/network-probes-table/network-probes-columns"
+import { Card, CardHeader, CardTitle } from "@/components/ui/card"
+import { Input } from "@/components/ui/input"
+import { TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table"
+import { useToast } from "@/components/ui/use-toast"
+import { isReadOnlyUser } from "@/lib/api"
+import { pb } from "@/lib/api"
+import { $allSystemsById, $chartTime, $direction } from "@/lib/stores"
+import { cn, isVisuallyLonger, useBrowserStorage } from "@/lib/utils"
+import type { NetworkProbeRecord } from "@/types"
+import { AddProbeDialog, EditProbeDialog } from "./probe-dialog"
+import { ArrowLeftRightIcon, EthernetPortIcon, GlobeIcon, ServerIcon, XIcon } from "lucide-react"
+import { Sheet, SheetContent, SheetDescription, SheetHeader, SheetTitle } from "@/components/ui/sheet"
+import ChartTimeSelect from "@/components/charts/chart-time-select"
+import { LossChart, AvgMinMaxResponseChart } from "@/components/routes/system/charts/probes-charts"
+import { useNetworkProbeStats } from "@/lib/use-network-probes"
+import { useStore } from "@nanostores/react"
+import type { ChartData } from "@/types"
+import { parseSemVer } from "@/lib/utils"
+import { Separator } from "../ui/separator"
+import { $router, Link } from "../router"
+import { getPagePath } from "@nanostores/router"
+
+export default function NetworkProbesTableNew({
+	systemId,
+	probes,
+}: {
+	systemId?: string
+	probes: NetworkProbeRecord[]
+}) {
+	const [sorting, setSorting] = useBrowserStorage<SortingState>(
+		`sort-np-${systemId ? 1 : 0}`,
+		[{ id: systemId ? "name" : "system", desc: false }],
+		sessionStorage
+	)
+	const [columnFilters, setColumnFilters] = useState<ColumnFiltersState>([])
+	const [columnVisibility, setColumnVisibility] = useState<VisibilityState>({})
+	const [rowSelection, setRowSelection] = useState<RowSelectionState>({})
+	const [globalFilter, setGlobalFilter] = useState("")
+	const [deleteOpen, setDeleteOpen] = useState(false)
+	const [pendingDeleteIds, setPendingDeleteIds] = useState<string[]>([])
+	const [editingProbe, setEditingProbe] = useState<NetworkProbeRecord>()
+	const { toast } = useToast()
+	const canManageProbes = !isReadOnlyUser()
+
+	const [longestName, longestTarget] = useMemo(() => {
+		let longestName = ""
+		let longestTarget = ""
+		for (const p of probes) {
+			const name = p.name || p.target
+			if (isVisuallyLonger(name, longestName)) {
+				longestName = name
+			}
+			if (isVisuallyLonger(p.target, longestTarget)) {
+				longestTarget = p.target
+			}
+		}
+		return [longestName, longestTarget]
+	}, [probes])
+
+	const runProbeBatch = useCallback(
+		async (ids: string[], enqueue: (batch: ReturnType<typeof pb.createBatch>, id: string) => void) => {
+			let batch = pb.createBatch()
+			let inBatch = 0
+			for (const id of ids) {
+				enqueue(batch, id)
+				if (++inBatch >= 20) {
+					await batch.send()
+					batch = pb.createBatch()
+					inBatch = 0
+				}
+			}
+			if (inBatch) {
+				await batch.send()
+			}
+		},
+		[]
+	)
+
+	const handleDeleteRequest = useCallback(
+		async (probesToDelete: NetworkProbeRecord[]) => {
+			if (!probesToDelete.length) {
+				return
+			}
+
+			const ids = probesToDelete.map((probe) => probe.id)
+			if (ids.length === 1) {
+				try {
+					await pb.collection("network_probes").delete(ids[0])
+				} catch (err: unknown) {
+					toast({
+						variant: "destructive",
+						title: t`Error`,
+						description: (err as Error)?.message || t`Failed to delete probes.`,
+					})
+				}
+				return
+			}
+
+			setPendingDeleteIds(ids)
+			setDeleteOpen(true)
+		},
+		[toast]
+	)
+
+	const handleBulkDelete = async () => {
+		setDeleteOpen(false)
+		if (!pendingDeleteIds.length) {
+			return
+		}
+
+		try {
+			await runProbeBatch(pendingDeleteIds, (batch, id) => batch.collection("network_probes").delete(id))
+			setPendingDeleteIds([])
+			setRowSelection({})
+		} catch (err: unknown) {
+			toast({
+				variant: "destructive",
+				title: t`Error`,
+				description: (err as Error)?.message || t`Failed to delete probes.`,
+			})
+		}
+	}
+
+	const handleSetEnabled = useCallback(
+		async (probesToUpdate: NetworkProbeRecord[], enabled: boolean) => {
+			if (!probesToUpdate.length) {
+				return
+			}
+
+			const pendingUpdates = probesToUpdate.filter((probe) => probe.enabled !== enabled)
+			if (!pendingUpdates.length) {
+				return
+			}
+
+			try {
+				if (pendingUpdates.length === 1) {
+					await pb.collection("network_probes").update(pendingUpdates[0].id, { enabled })
+					return
+				}
+				await runProbeBatch(
+					pendingUpdates.map((probe) => probe.id),
+					(batch, id) => batch.collection("network_probes").update(id, { enabled })
+				)
+				if (probesToUpdate.length > 1) {
+					setRowSelection({})
+				}
+			} catch (err: unknown) {
+				toast({
+					variant: "destructive",
+					title: t`Error`,
+					description: (err as Error)?.message || t`Failed to update probes.`,
+				})
+			}
+		},
+		[runProbeBatch, toast]
+	)
+
+	const columns = useMemo(() => {
+		let columns = getProbeColumns(longestName, longestTarget, {
+			onEdit: setEditingProbe,
+			onDelete: handleDeleteRequest,
+			onSetEnabled: handleSetEnabled,
+		})
+		columns = systemId ? columns.filter((col) => col.id !== "system") : columns
+		columns = canManageProbes ? columns : columns.filter((col) => col.id !== "actions")
+		return columns
+	}, [canManageProbes, handleDeleteRequest, handleSetEnabled, longestName, systemId, longestTarget])
+
+	const table = useReactTable({
+		data: probes,
+		columns,
+		getRowId: (row) => row.id,
+		getCoreRowModel: getCoreRowModel(),
+		getSortedRowModel: getSortedRowModel(),
+		getFilteredRowModel: getFilteredRowModel(),
+		onSortingChange: setSorting,
+		onColumnFiltersChange: setColumnFilters,
+		onColumnVisibilityChange: setColumnVisibility,
+		onRowSelectionChange: setRowSelection,
+		defaultColumn: {
+			sortUndefined: "last",
+			size: 900,
+			minSize: 0,
+		},
+		state: {
+			sorting,
+			columnFilters,
+			columnVisibility,
+			rowSelection,
+			globalFilter,
+		},
+		onGlobalFilterChange: setGlobalFilter,
+		globalFilterFn: (row, _columnId, filterValue) => {
+			const probe = row.original
+			const systemName = $allSystemsById.get()[probe.system]?.name ?? ""
+			const searchString = `${probe.name}${probe.target}${probe.protocol}${systemName}`.toLocaleLowerCase()
+			return (filterValue as string)
+				.toLowerCase()
+				.split(" ")
+				.every((term) => searchString.includes(term))
+		},
+	})
+
+	const rows = table.getRowModel().rows
+	const visibleColumns = table.getVisibleLeafColumns()
+
+	return (
+		<Card className="@container w-full px-3 py-5 sm:py-6 sm:px-6">
+			<CardHeader className="p-0 mb-3 sm:mb-4">
+				<div className="grid md:flex gap-x-5 gap-y-3 w-full items-end">
+					<div className="px-2 sm:px-1">
+						<CardTitle className="mb-2">
+							<Trans>Network Probes</Trans>
+						</CardTitle>
+						<div className="text-sm text-muted-foreground flex items-center flex-wrap">
+							<Trans>Response time monitoring from agents.</Trans>
+						</div>
+					</div>
+					<div className="md:ms-auto flex items-center gap-2">
+						{probes.length > 0 && (
+							<div className="relative">
+								<Input
+									placeholder={t`Filter...`}
+									value={globalFilter}
+									onChange={(e) => setGlobalFilter(e.target.value)}
+									className="ms-auto px-4 w-full max-w-full md:w-50"
+								/>
+								{globalFilter && (
+									<Button
+										type="button"
+										variant="ghost"
+										size="icon"
+										aria-label={t`Clear`}
+										className="absolute right-1 top-1/2 -translate-y-1/2 h-7 w-7 text-muted-foreground"
+										onClick={() => setGlobalFilter("")}
+									>
+										<XIcon className="h-4 w-4" />
+									</Button>
+								)}
+							</div>
+						)}
+						{canManageProbes ? <AddProbeDialog systemId={systemId} probes={probes} /> : null}
+						{canManageProbes ? (
+							<EditProbeDialog
+								systemId={systemId}
+								probe={editingProbe}
+								open={!!editingProbe}
+								setOpen={(open) => {
+									if (!open) {
+										setEditingProbe(undefined)
+									}
+								}}
+							/>
+						) : null}
+						<AlertDialog
+							open={deleteOpen}
+							onOpenChange={(open) => {
+								setDeleteOpen(open)
+								if (!open) {
+									setPendingDeleteIds([])
+								}
+							}}
+						>
+							<AlertDialogContent>
+								<AlertDialogHeader>
+									<AlertDialogTitle>
+										<Trans>Are you sure?</Trans>
+									</AlertDialogTitle>
+									<AlertDialogDescription>
+										<Trans>This will permanently delete all selected records from the database.</Trans>
+									</AlertDialogDescription>
+								</AlertDialogHeader>
+								<AlertDialogFooter>
+									<AlertDialogCancel>
+										<Trans>Cancel</Trans>
+									</AlertDialogCancel>
+									<AlertDialogAction
+										className={cn(buttonVariants({ variant: "destructive" }))}
+										onClick={handleBulkDelete}
+									>
+										<Trans>Continue</Trans>
+									</AlertDialogAction>
+								</AlertDialogFooter>
+							</AlertDialogContent>
+						</AlertDialog>
+					</div>
+				</div>
+			</CardHeader>
+			<div className="rounded-md">
+				<NetworkProbesTable table={table} rows={rows} colLength={visibleColumns.length} rowSelection={rowSelection} />
+			</div>
+		</Card>
+	)
+}
+
+const NetworkProbesTable = memo(function NetworkProbeTable({
+	table,
+	rows,
+	colLength,
+	rowSelection: _rowSelection,
+}: {
+	table: TableType<NetworkProbeRecord>
+	rows: Row<NetworkProbeRecord>[]
+	colLength: number
+	rowSelection: RowSelectionState
+}) {
+	// The virtualizer will need a reference to the scrollable container element
+	const scrollRef = useRef<HTMLDivElement>(null)
+	const [sheetOpen, setSheetOpen] = useState(false)
+	const [activeProbeId, setActiveProbeId] = useState<string | null>(null)
+	const activeProbe = activeProbeId ? table.options.data.find((probe) => probe.id === activeProbeId) : undefined
+	const openSheet = useCallback((probe: NetworkProbeRecord) => {
+		setActiveProbeId(probe.id)
+		setSheetOpen(true)
+	}, [])
+
+	const virtualizer = useVirtualizer<HTMLDivElement, HTMLTableRowElement>({
+		count: rows.length,
+		estimateSize: () => 54,
+		getScrollElement: () => scrollRef.current,
+		overscan: 5,
+	})
+	const virtualRows = virtualizer.getVirtualItems()
+
+	const paddingTop = Math.max(0, virtualRows[0]?.start ?? 0 - virtualizer.options.scrollMargin)
+	const paddingBottom = Math.max(0, virtualizer.getTotalSize() - (virtualRows[virtualRows.length - 1]?.end ?? 0))
+
+	return (
+		<div
+			className={cn(
+				"h-min max-h-[calc(100dvh-17rem)] max-w-full relative overflow-auto border rounded-md",
+				// don't set min height if there are less than 2 rows, do set if we need to display the empty state
+				(!rows.length || rows.length > 2) && "min-h-50"
+			)}
+			ref={scrollRef}
+		>
+			{/* add header height to table size */}
+			<div style={{ height: `${virtualizer.getTotalSize() + 48}px`, paddingTop, paddingBottom }}>
+				<table className="text-sm w-full h-full text-nowrap">
+					<NetworkProbeTableHead table={table} />
+					<TableBody>
+						{rows.length ? (
+							virtualRows.map((virtualRow) => {
+								const row = rows[virtualRow.index]
+								return (
+									<NetworkProbeTableRow
+										key={row.id}
+										row={row}
+										virtualRow={virtualRow}
+										isSelected={row.getIsSelected()}
+										openSheet={openSheet}
+									/>
+								)
+							})
+						) : (
+							<TableRow>
+								<TableCell colSpan={colLength} className="h-37 text-center pointer-events-none">
+									<Trans>No results.</Trans>
+								</TableCell>
+							</TableRow>
+						)}
+					</TableBody>
+				</table>
+			</div>
+			<NetworkProbeSheet
+				open={sheetOpen}
+				onOpenChange={(nextOpen) => {
+					setSheetOpen(nextOpen)
+				}}
+				probe={activeProbe}
+			/>
+		</div>
+	)
+})
+
+function NetworkProbeTableHead({ table }: { table: TableType<NetworkProbeRecord> }) {
+	return (
+		<TableHeader className="sticky top-0 z-50 w-full border-b-2">
+			{table.getHeaderGroups().map((headerGroup) => (
+				<tr key={headerGroup.id}>
+					{headerGroup.headers.map((header) => {
+						return (
+							<TableHead className="px-2" key={header.id}>
+								{header.isPlaceholder ? null : flexRender(header.column.columnDef.header, header.getContext())}
+							</TableHead>
+						)
+					})}
+				</tr>
+			))}
+		</TableHeader>
+	)
+}
+
+const NetworkProbeTableRow = memo(function NetworkProbeTableRow({
+	row,
+	virtualRow,
+	isSelected,
+	openSheet,
+}: {
+	row: Row<NetworkProbeRecord>
+	virtualRow: VirtualItem
+	isSelected: boolean
+	openSheet: (probe: NetworkProbeRecord) => void
+}) {
+	return (
+		<TableRow
+			data-state={isSelected && "selected"}
+			className="cursor-pointer transition-opacity"
+			onClick={() => openSheet(row.original)}
+		>
+			{row.getVisibleCells().map((cell) => (
+				<TableCell
+					key={cell.id}
+					className="py-0"
+					style={{
+						width: `${cell.column.getSize()}px`,
+						height: virtualRow.size,
+					}}
+				>
+					{flexRender(cell.column.columnDef.cell, cell.getContext())}
+				</TableCell>
+			))}
+		</TableRow>
+	)
+})
+
+function NetworkProbeSheet({
+	open,
+	onOpenChange,
+	probe,
+}: {
+	open: boolean
+	onOpenChange: (open: boolean) => void
+	probe?: NetworkProbeRecord
+}) {
+	if (!probe) {
+		return null
+	}
+
+	return <NetworkProbeSheetContent key={probe.system} open={open} onOpenChange={onOpenChange} probe={probe} />
+}
+
+function NetworkProbeSheetContent({
+	open,
+	onOpenChange,
+	probe,
+}: {
+	open: boolean
+	onOpenChange: (open: boolean) => void
+	probe: NetworkProbeRecord
+}) {
+	const chartTime = useStore($chartTime)
+	const direction = useStore($direction)
+	const system = useStore($allSystemsById)[probe.system]
+
+	const probeStats = useNetworkProbeStats({ systemId: probe.system, chartTime })
+
+	const chartData = useMemo<ChartData>(
+		() => ({
+			agentVersion: parseSemVer(system?.info?.v),
+			orientation: direction === "rtl" ? "right" : "left",
+			chartTime,
+		}),
+		[probeStats]
+	)
+	const hasProbeStats = probeStats.some((record) => record.stats?.[probe.id] != null)
+	const probeLabel = probe.name || probe.target
+
+	return (
+		<Sheet open={open} onOpenChange={onOpenChange}>
+			<SheetContent className="w-full sm:max-w-220 overflow-auto p-4 sm:p-6">
+				<SheetHeader className="mb-0 border-b p-0 pb-4">
+					<SheetTitle>{probeLabel}</SheetTitle>
+					<SheetDescription className="flex flex-wrap items-center gap-x-2 gap-y-1">
+						<ServerIcon className="size-3.5 text-muted-foreground" />
+						<Link className="hover:underline" href={getPagePath($router, "system", { id: system?.id ?? "" })}>
+							{system?.name ?? ""}
+						</Link>
+						<Separator orientation="vertical" className="h-2.5 bg-muted-foreground opacity-70" />
+						<ArrowLeftRightIcon className="size-3.5 text-muted-foreground" />
+						{probe.protocol.toUpperCase()}
+						<Separator orientation="vertical" className="h-2.5 bg-muted-foreground opacity-70" />
+						<GlobeIcon className="size-3.5 text-muted-foreground" />
+						{probe.target}
+						{probe.protocol === "tcp" && probe.port > 0 && (
+							<>
+								<Separator orientation="vertical" className="h-2.5 bg-muted-foreground opacity-70" />
+								<EthernetPortIcon className="size-3.5 text-muted-foreground" />
+								<span>{probe.port}</span>
+							</>
+						)}
+					</SheetDescription>
+				</SheetHeader>
+				<div className="grid gap-4">
+					<ChartTimeSelect className="bg-card" agentVersion={chartData.agentVersion} />
+					<AvgMinMaxResponseChart probeStats={probeStats} probe={probe} chartData={chartData} empty={!hasProbeStats} />
+					<LossChart
+						probeStats={probeStats}
+						grid={false}
+						probes={[probe]}
+						chartData={chartData}
+						empty={!hasProbeStats}
+						showFilter={false}
+					/>
+				</div>
+			</SheetContent>
+		</Sheet>
+	)
+}

internal/site/src/components/network-probes-table/probe-dialog.tsx

@@ -0,0 +1,613 @@
+import { useEffect, useRef, useState } from "react"
+import { Trans, useLingui } from "@lingui/react/macro"
+import { useStore } from "@nanostores/react"
+import { pb } from "@/lib/api"
+import {
+	Dialog,
+	DialogContent,
+	DialogDescription,
+	DialogFooter,
+	DialogHeader,
+	DialogTitle,
+} from "@/components/ui/dialog"
+import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigger } from "@/components/ui/dropdown-menu"
+import { Sheet, SheetContent, SheetDescription, SheetFooter, SheetHeader, SheetTitle } from "@/components/ui/sheet"
+import { Button } from "@/components/ui/button"
+import { Input } from "@/components/ui/input"
+import { Label } from "@/components/ui/label"
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select"
+import { Textarea } from "@/components/ui/textarea"
+import { ChevronDownIcon, ListIcon, ServerIcon } from "lucide-react"
+import { useToast } from "@/components/ui/use-toast"
+import { $systems } from "@/lib/stores"
+import type { NetworkProbeRecord } from "@/types"
+import * as v from "valibot"
+
+type ProbeProtocol = "icmp" | "tcp" | "http"
+
+type ProbeValues = {
+	system: string
+	target: string
+	protocol: ProbeProtocol
+	port: number
+	interval: string
+	name?: string
+}
+
+type NormalizedProbeValues = Omit<ProbeValues, "system" | "interval"> & {
+	interval: number
+}
+
+type BulkProbeLineSource = Pick<NetworkProbeRecord, "target" | "protocol" | "port" | "interval" | "name">
+
+const defaultInterval = 30
+
+const ProbeProtocolSchema = v.picklist(["icmp", "tcp", "http"])
+
+const ProbeIntervalSchema = v.pipe(v.string(), v.toNumber(), v.minValue(1), v.maxValue(3600))
+
+// Both the single-probe form and the bulk importer flow through this schema so
+// defaults and HTTP target normalization stay in one place.
+const NormalizedProbeValuesSchema = v.pipe(
+	v.object({
+		target: v.pipe(v.string(), v.trim(), v.nonEmpty("target is required")),
+		protocol: ProbeProtocolSchema,
+		port: v.number(),
+		interval: ProbeIntervalSchema,
+		name: v.optional(v.pipe(v.string(), v.trim())),
+	}),
+	v.transform((input): NormalizedProbeValues => {
+		let { protocol, port } = input
+		let httpTarget = input.target
+		if (protocol === "icmp" || protocol === "http") {
+			if (protocol === "http") {
+				httpTarget = normalizeHttpTarget(input.target, port)
+			}
+			port = 0
+		} else if (protocol === "tcp" && !port) {
+			port = 443
+		}
+		return {
+			// HTTP probes may be entered as bare hostnames, so normalize them to a
+			// scheme-bearing URL before the payload is sent to PocketBase.
+			target: protocol === "http" ? httpTarget : input.target,
+			protocol,
+			port,
+			interval: input.interval,
+			name: input.name || undefined,
+		}
+	}),
+	v.forward(
+		v.check((input) => {
+			if (input.protocol === "icmp" || input.protocol === "http") {
+				return input.port === 0
+			}
+
+			return Number.isInteger(input.port) && input.port >= 1 && input.port <= 65535
+		}, "Port must be between 1 and 65535"),
+		["port"]
+	)
+)
+
+// Bulk parsing only trims raw CSV fields. Inference, defaults, and protocol-
+// specific validation still go through the shared normalization schema above.
+const BulkProbeSchema = v.object({
+	target: v.pipe(v.string(), v.trim(), v.nonEmpty("target is required")),
+	protocol: v.optional(v.pipe(v.string(), v.trim())),
+	port: v.optional(v.pipe(v.string(), v.trim())),
+	interval: v.optional(v.pipe(v.string(), v.trim())),
+	name: v.optional(v.pipe(v.string(), v.trim())),
+})
+
+function normalizeHttpTarget(target: string, port = 0) {
+	const useExplicitPort = port > 0 && port !== 80 && port !== 443
+	const hasOriginOnlyTarget = /^https?:\/\/[^/?#]+$/i.test(target)
+	if (!/^https?:\/\//i.test(target)) {
+		const scheme = port === 80 ? "http" : "https"
+		return `${scheme}://${target}${useExplicitPort ? `:${port}` : ""}`
+	}
+
+	let parsedUrl: URL
+	try {
+		parsedUrl = new URL(target)
+	} catch {
+		return target
+	}
+
+	if (!parsedUrl.port && useExplicitPort) {
+		parsedUrl.port = `${port}`
+	}
+
+	// avoid converting "http://localhost:8090" to "http://localhost:8090/" - keep the original formatting if the URL is just an origin
+	if (hasOriginOnlyTarget && parsedUrl.pathname === "/" && !parsedUrl.search && !parsedUrl.hash) {
+		return parsedUrl.origin
+	}
+
+	return parsedUrl.toString()
+}
+
+function trimTrailingEmptyFields(fields: string[]) {
+	let lastValueIndex = fields.length - 1
+	while (lastValueIndex > 0 && !fields[lastValueIndex]) {
+		lastValueIndex--
+	}
+	return fields.slice(0, lastValueIndex + 1)
+}
+
+function buildProbePayload(values: ProbeValues, enabled = true) {
+	const normalizedValues = v.safeParse(NormalizedProbeValuesSchema, values)
+	if (!normalizedValues.success) {
+		throw new Error(normalizedValues.issues[0]?.message || "Invalid probe")
+	}
+
+	const payload = {
+		system: values.system,
+		enabled,
+		...normalizedValues.output,
+	}
+
+	const trimmedName = normalizedValues.output.name?.trim()
+	const targetName = normalizedValues.output.target.replace(/^https?:\/\//i, "")
+	if (trimmedName) {
+		payload.name = trimmedName
+	} else if (targetName !== normalizedValues.output.target) {
+		payload.name = targetName
+	} else {
+		payload.name = ""
+	}
+	return payload
+}
+
+type ProbeIdentity = Pick<ProbeValues, "system" | "target" | "protocol" | "port">
+function getProbeIdentityKey({ system, target, protocol, port }: ProbeIdentity) {
+	return `${system}${target}${protocol}${port}`
+}
+
+function parseBulkProbeLine(line: string, lineNumber: number, system: string) {
+	const [rawTarget = "", rawProtocol = "", rawPort = "", rawInterval = "", ...rawName] = line.split(",")
+	const parsed = v.safeParse(BulkProbeSchema, {
+		target: rawTarget,
+		protocol: rawProtocol,
+		port: rawPort,
+		interval: rawInterval,
+		name: rawName.join(","),
+	})
+	if (!parsed.success) {
+		throw new Error(`Line ${lineNumber}: ${parsed.issues[0]?.message || "invalid probe entry"}`)
+	}
+	const protocol = (parsed.output.protocol?.toLowerCase() ||
+		(/^https?:\/\//i.test(parsed.output.target) ? "http" : "icmp")) as ProbeProtocol
+
+	return buildProbePayload({
+		system,
+		target: parsed.output.target,
+		protocol,
+		port: parsed.output.port ? Number(parsed.output.port) : 0,
+		interval: parsed.output.interval || `${defaultInterval}`,
+		name: parsed.output.name || undefined,
+	})
+}
+
+export function formatBulkProbeLine(probe: BulkProbeLineSource) {
+	const port = probe.protocol !== "tcp" || probe.port === 443 ? "" : `${probe.port}`
+	const interval = probe.interval === defaultInterval ? "" : `${probe.interval}`
+	return trimTrailingEmptyFields([probe.target, probe.protocol, port, interval, probe.name?.trim() || ""]).join(",")
+}
+
+export function AddProbeDialog({ systemId, probes }: { systemId?: string; probes: NetworkProbeRecord[] }) {
+	const [open, setOpen] = useState(false)
+	const [bulkOpen, setBulkOpen] = useState(false)
+	const [bulkInput, setBulkInput] = useState("")
+	const [bulkLoading, setBulkLoading] = useState(false)
+	const [bulkSelectedSystemId, setBulkSelectedSystemId] = useState("")
+	const bulkFormRef = useRef<HTMLFormElement>(null)
+	const { toast } = useToast()
+	const { t } = useLingui()
+	const systems = useStore($systems)
+
+	const resetBulkForm = () => {
+		setBulkInput("")
+		// setBulkSelectedSystemId("")
+	}
+
+	const openBulkAdd = (selectedSystemId?: string) => {
+		if (!systemId && selectedSystemId) {
+			setBulkSelectedSystemId(selectedSystemId)
+		}
+		setOpen(false)
+		setBulkOpen(true)
+	}
+
+	const openAdd = () => {
+		setBulkOpen(false)
+		setOpen(true)
+	}
+
+	async function handleBulkSubmit(e: React.FormEvent) {
+		e.preventDefault()
+		setBulkLoading(true)
+		let closedForSubmit = false
+
+		try {
+			const system = systemId ?? bulkSelectedSystemId
+			if (!system) {
+				throw new Error("Select a system.")
+			}
+			const rawLines = bulkInput.split(/\r?\n/).filter((line) => line.trim())
+			if (!rawLines.length) {
+				throw new Error("Enter at least one probe.")
+			}
+
+			const payloads = rawLines.map((line, index) => parseBulkProbeLine(line, index + 1, system))
+			const existingProbeKeys = new Set(
+				probes.filter((probe) => probe.system === system).map((probe) => getProbeIdentityKey(probe))
+			)
+			const newPayloads = [] as typeof payloads
+
+			for (const payload of payloads) {
+				const probeKey = getProbeIdentityKey(payload)
+				if (existingProbeKeys.has(probeKey)) {
+					continue
+				}
+
+				existingProbeKeys.add(probeKey)
+				newPayloads.push(payload)
+			}
+
+			if (!newPayloads.length) {
+				throw new Error("No new probes. All entries exist.")
+			}
+
+			closedForSubmit = true
+			let batch = pb.createBatch()
+			let inBatch = 0
+			for (const payload of newPayloads) {
+				batch.collection("network_probes").create(payload)
+				inBatch++
+				if (inBatch > 20) {
+					await batch.send()
+					batch = pb.createBatch()
+					inBatch = 0
+				}
+			}
+			if (inBatch) {
+				await batch.send()
+			}
+
+			resetBulkForm()
+			toast({ title: t`Probes created`, description: `${newPayloads.length} probe(s) added.` })
+		} catch (err: unknown) {
+			if (closedForSubmit) {
+				setBulkOpen(true)
+			}
+			toast({ variant: "destructive", title: t`Error`, description: (err as Error)?.message })
+		} finally {
+			setBulkLoading(false)
+		}
+	}
+
+	return (
+		<>
+			<div className="flex gap-0 rounded-lg">
+				<Button variant="outline" onClick={openAdd} className="rounded-e-none grow">
+					{/* <PlusIcon className="size-4 me-1" /> */}
+					<Trans>Add {{ foo: t`Probe` }}</Trans>
+				</Button>
+				<div className="w-px h-full bg-muted"></div>
+				<DropdownMenu>
+					<DropdownMenuTrigger asChild>
+						<Button variant="outline" className="px-2 rounded-s-none border-s-0" aria-label={t`More probe actions`}>
+							<ChevronDownIcon className="size-4" />
+						</Button>
+					</DropdownMenuTrigger>
+					<DropdownMenuContent align="end">
+						<DropdownMenuItem onClick={() => openBulkAdd(systemId)}>
+							<ListIcon className="size-4 me-2" />
+							<Trans>Bulk Add</Trans>
+						</DropdownMenuItem>
+					</DropdownMenuContent>
+				</DropdownMenu>
+			</div>
+			<Dialog
+				open={open}
+				onOpenChange={(nextOpen) => {
+					setOpen(nextOpen)
+				}}
+			>
+				<ProbeDialogContent open={open} setOpen={setOpen} systemId={systemId} onOpenBulkAdd={openBulkAdd} />
+			</Dialog>
+
+			<Sheet
+				open={bulkOpen}
+				onOpenChange={(nextOpen) => {
+					setBulkOpen(nextOpen)
+					if (!nextOpen) {
+						resetBulkForm()
+					}
+				}}
+			>
+				<SheetContent className="w-full sm:max-w-xl gap-0">
+					<SheetHeader className="border-b">
+						<SheetTitle>
+							<Trans>Bulk Add {{ foo: t`Network Probes` }}</Trans>
+						</SheetTitle>
+						<SheetDescription>target[,protocol[,port[,interval[,name]]]]</SheetDescription>
+					</SheetHeader>
+					<form ref={bulkFormRef} onSubmit={handleBulkSubmit} className="flex h-full flex-col overflow-hidden">
+						<div className="flex-1 flex flex-col space-y-4 overflow-auto p-4">
+							{!systemId && (
+								<div className="grid gap-2">
+									<Label className="sr-only">
+										<Trans>System</Trans>
+									</Label>
+									<Select value={bulkSelectedSystemId} onValueChange={setBulkSelectedSystemId} required>
+										<SelectTrigger className="relative ps-10 pe-5 bg-card">
+											<ServerIcon className="size-3.5 absolute start-4 top-1/2 -translate-y-1/2 opacity-85" />
+											<SelectValue placeholder={t`Select a system`} />
+										</SelectTrigger>
+										<SelectContent>
+											{systems.map((sys) => (
+												<SelectItem key={sys.id} value={sys.id}>
+													{sys.name}
+												</SelectItem>
+											))}
+										</SelectContent>
+									</Select>
+								</div>
+							)}
+							<div className="grow flex flex-col gap-2">
+								<Label htmlFor="bulk-probes" className="sr-only">
+									Entries
+								</Label>
+								<Textarea
+									id="bulk-probes"
+									value={bulkInput}
+									onChange={(e) => setBulkInput(e.target.value)}
+									onKeyDown={(e) => {
+										if (e.key === "Enter" && (e.ctrlKey || e.metaKey)) {
+											e.preventDefault()
+											bulkFormRef.current?.requestSubmit()
+										}
+									}}
+									className="font-mono grow text-sm bg-card"
+									placeholder={["1.1.1.1", "example.com,tcp", "https://example.com,http,,60,Example"].join("\n")}
+									required
+								/>
+								<p className="text-xs text-muted-foreground">target[,protocol[,port[,interval[,name]]]]</p>
+							</div>
+						</div>
+						<SheetFooter className="border-t">
+							<Button type="submit" disabled={bulkLoading || (!systemId && !bulkSelectedSystemId)}>
+								<Trans>Add {{ foo: t`Network Probes` }}</Trans>
+							</Button>
+						</SheetFooter>
+					</form>
+				</SheetContent>
+			</Sheet>
+		</>
+	)
+}
+
+export function EditProbeDialog({
+	open,
+	setOpen,
+	systemId,
+	probe,
+}: {
+	open: boolean
+	setOpen: (open: boolean) => void
+	systemId?: string
+	probe?: NetworkProbeRecord
+}) {
+	const hasOpened = useRef(false)
+	if (!probe && !hasOpened.current) {
+		return null
+	}
+	hasOpened.current = true
+	return (
+		<Dialog open={open} onOpenChange={setOpen}>
+			<ProbeDialogContent open={open} setOpen={setOpen} systemId={systemId} probe={probe} />
+		</Dialog>
+	)
+}
+
+function ProbeDialogContent({
+	open,
+	setOpen,
+	systemId,
+	probe,
+	onOpenBulkAdd,
+}: {
+	open: boolean
+	setOpen: (open: boolean) => void
+	systemId?: string
+	probe?: NetworkProbeRecord
+	onOpenBulkAdd?: (selectedSystemId?: string) => void
+}) {
+	const [protocol, setProtocol] = useState<ProbeProtocol>(probe?.protocol ?? "icmp")
+	const [target, setTarget] = useState(probe?.target ?? "")
+	const [port, setPort] = useState(probe?.protocol === "tcp" && probe.port ? String(probe.port) : "")
+	const [probeInterval, setProbeInterval] = useState(String(probe?.interval ?? defaultInterval))
+	const [name, setName] = useState(probe?.name ?? "")
+	const [loading, setLoading] = useState(false)
+	const [selectedSystemId, setSelectedSystemId] = useState(probe?.system ?? "")
+	const systems = useStore($systems)
+	const { toast } = useToast()
+	const { t } = useLingui()
+	const isEditing = !!probe
+	const targetName = target.replace(/^https?:\/\//, "")
+
+	// When the dialog is opened, initialize form fields with probe values (if editing) or defaults (if adding).
+	useEffect(() => {
+		if (!open) {
+			return
+		}
+
+		setProtocol(probe?.protocol ?? "icmp")
+		setTarget(probe?.target ?? "")
+		setPort(probe?.protocol === "tcp" && probe.port ? String(probe.port) : "")
+		setProbeInterval(String(probe?.interval ?? defaultInterval))
+		setName(probe?.name ?? "")
+		setSelectedSystemId(probe?.system ?? "")
+		setLoading(false)
+	}, [open, probe])
+
+	async function handleSubmit(e: React.FormEvent) {
+		e.preventDefault()
+		setLoading(true)
+
+		try {
+			const selectedSystem = systemId ?? selectedSystemId
+			if (!selectedSystem) {
+				throw new Error("Select a system.")
+			}
+			const payload = buildProbePayload(
+				{
+					system: selectedSystem,
+					target,
+					protocol,
+					port: protocol === "tcp" ? Number(port) : 0,
+					interval: probeInterval,
+					name,
+				},
+				probe ? probe.enabled : true
+			)
+			if (probe) {
+				await pb.collection("network_probes").update(probe.id, payload)
+			} else {
+				await pb.collection("network_probes").create(payload)
+			}
+			setOpen(false)
+		} catch (err: unknown) {
+			toast({ variant: "destructive", title: t`Error`, description: (err as Error)?.message })
+		} finally {
+			setLoading(false)
+		}
+	}
+
+	return (
+		<DialogContent className="max-w-md">
+			<DialogHeader>
+				<DialogTitle>
+					{isEditing ? <Trans>Edit {{ foo: t`Network Probe` }}</Trans> : <Trans>Add {{ foo: t`Network Probe` }}</Trans>}
+				</DialogTitle>
+				<DialogDescription>
+					<Trans>Configure response monitoring from this agent.</Trans>
+				</DialogDescription>
+			</DialogHeader>
+			<form onSubmit={handleSubmit} className="grid gap-4 tabular-nums">
+				{!systemId && (
+					<div className="grid gap-2">
+						<Label>
+							<Trans>System</Trans>
+						</Label>
+						<Select value={selectedSystemId} onValueChange={setSelectedSystemId} required>
+							<SelectTrigger>
+								<SelectValue placeholder={t`Select a system`} />
+							</SelectTrigger>
+							<SelectContent>
+								{systems.map((sys) => (
+									<SelectItem key={sys.id} value={sys.id}>
+										{sys.name}
+									</SelectItem>
+								))}
+							</SelectContent>
+						</Select>
+					</div>
+				)}
+				<div className="grid gap-2">
+					<Label>
+						<Trans>Target</Trans>
+					</Label>
+					<Input
+						value={target}
+						onChange={(e) => setTarget(e.target.value)}
+						placeholder={protocol === "http" ? "http://localhost:8090" : "1.1.1.1"}
+						required
+					/>
+				</div>
+				<div className="grid gap-2">
+					<Label>
+						<Trans>Protocol</Trans>
+					</Label>
+
+					<Select value={protocol} onValueChange={(value) => setProtocol(value as ProbeProtocol)}>
+						<SelectTrigger>
+							<SelectValue />
+						</SelectTrigger>
+						<SelectContent>
+							<SelectItem value="icmp">ICMP</SelectItem>
+							<SelectItem value="tcp">TCP</SelectItem>
+							<SelectItem value="http">HTTP</SelectItem>
+						</SelectContent>
+					</Select>
+				</div>
+				{protocol === "tcp" && (
+					<div className="grid gap-2">
+						<Label>
+							<Trans>Port</Trans>
+						</Label>
+						<Input
+							type="number"
+							value={port}
+							onChange={(e) => setPort(e.target.value)}
+							placeholder="443"
+							min={1}
+							max={65535}
+						/>
+					</div>
+				)}
+				<div className="grid gap-2">
+					<Label>
+						<Trans>Interval (seconds)</Trans>
+					</Label>
+					<Input
+						type="number"
+						value={probeInterval}
+						onChange={(e) => setProbeInterval(e.target.value)}
+						min={1}
+						max={3600}
+						required
+					/>
+				</div>
+				<div className="grid gap-2">
+					<Label>
+						<Trans>Name (optional)</Trans>
+					</Label>
+					<Input
+						value={name}
+						onChange={(e) => setName(e.target.value)}
+						placeholder={targetName || t`e.g. Cloudflare DNS`}
+					/>
+				</div>
+				<DialogFooter>
+					{!isEditing && onOpenBulkAdd && (
+						<Button
+							type="button"
+							variant="outline"
+							onClick={() => onOpenBulkAdd(selectedSystemId)}
+							disabled={loading}
+							className="me-auto"
+						>
+							<ListIcon className="size-4 me-2" />
+							<Trans>Bulk Add</Trans>
+						</Button>
+					)}
+					<Button type="submit" disabled={loading || (!systemId && !selectedSystemId)}>
+						{loading ? (
+							isEditing ? (
+								<Trans>Saving...</Trans>
+							) : (
+								<Trans>Creating...</Trans>
+							)
+						) : isEditing ? (
+							<Trans>Save {{ foo: t`Probe` }}</Trans>
+						) : (
+							<Trans>Add {{ foo: t`Probe` }}</Trans>
+						)}
+					</Button>
+				</DialogFooter>
+			</form>
+		</DialogContent>
+	)
+}

internal/site/src/components/router.tsx

@@ -4,6 +4,7 @@ const routes = {
 	home: "/",
 	containers: "/containers",
 	smart: "/smart",
+	probes: "/probes",
 	system: `/system/:id`,
 	settings: `/settings/:name?`,
 	forgot_password: `/forgot-password`,