deps: upgrade pocketbase

Co-authored-by: henrygd <hank@henrygd.me>

agent/battery/battery.go

@@ -1,84 +1,11 @@
-//go:build !freebsd
+// Package battery provides functions to check if the system has a battery and return the charge state and percentage.
-
-// Package battery provides functions to check if the system has a battery and to get the battery stats.
 package battery
 
-import (
+const (
-	"errors"
+	stateUnknown uint8 = iota
-	"log/slog"
+	stateEmpty
-	"math"
+	stateFull
-
+	stateCharging
-	"github.com/distatus/battery"
+	stateDischarging
+	stateIdle
 )
-
-var (
-	systemHasBattery   = false
-	haveCheckedBattery = false
-)
-
-// HasReadableBattery checks if the system has a battery and returns true if it does.
-func HasReadableBattery() bool {
-	if haveCheckedBattery {
-		return systemHasBattery
-	}
-	haveCheckedBattery = true
-	batteries, err := battery.GetAll()
-	for _, bat := range batteries {
-		if bat != nil && (bat.Full > 0 || bat.Design > 0) {
-			systemHasBattery = true
-			break
-		}
-	}
-	if !systemHasBattery {
-		slog.Debug("No battery found", "err", err)
-	}
-	return systemHasBattery
-}
-
-// GetBatteryStats returns the current battery percent and charge state
-// percent = (current charge of all batteries) / (sum of designed/full capacity of all batteries)
-func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
-	if !HasReadableBattery() {
-		return batteryPercent, batteryState, errors.ErrUnsupported
-	}
-	batteries, err := battery.GetAll()
-	// we'll handle errors later by skipping batteries with errors, rather
-	// than skipping everything because of the presence of some errors.
-	if len(batteries) == 0 {
-		return batteryPercent, batteryState, errors.New("no batteries")
-	}
-
-	totalCapacity := float64(0)
-	totalCharge := float64(0)
-	errs, partialErrs := err.(battery.Errors)
-
-	batteryState = math.MaxUint8
-
-	for i, bat := range batteries {
-		if partialErrs && errs[i] != nil {
-			// if there were some errors, like missing data, skip it
-			continue
-		}
-		if bat == nil || bat.Full == 0 {
-			// skip batteries with no capacity. Charge is unlikely to ever be zero, but
-			// we can't guarantee that, so don't skip based on charge.
-			continue
-		}
-		totalCapacity += bat.Full
-		totalCharge += min(bat.Current, bat.Full)
-		if bat.State.Raw >= 0 {
-			batteryState = uint8(bat.State.Raw)
-		}
-	}
-
-	if totalCapacity == 0 || batteryState == math.MaxUint8 {
-		// for macs there's sometimes a ghost battery with 0 capacity
-		// https://github.com/distatus/battery/issues/34
-		// Instead of skipping over those batteries, we'll check for total 0 capacity
-		// and return an error. This also prevents a divide by zero.
-		return batteryPercent, batteryState, errors.New("no battery capacity")
-	}
-
-	batteryPercent = uint8(totalCharge / totalCapacity * 100)
-	return batteryPercent, batteryState, nil
-}

agent/battery/battery_darwin.go

@@ -0,0 +1,96 @@
+//go:build darwin
+
+package battery
+
+import (
+	"errors"
+	"log/slog"
+	"math"
+	"os/exec"
+	"sync"
+
+	"howett.net/plist"
+)
+
+type macBattery struct {
+	CurrentCapacity   int  `plist:"CurrentCapacity"`
+	MaxCapacity       int  `plist:"MaxCapacity"`
+	FullyCharged      bool `plist:"FullyCharged"`
+	IsCharging        bool `plist:"IsCharging"`
+	ExternalConnected bool `plist:"ExternalConnected"`
+}
+
+func readMacBatteries() ([]macBattery, error) {
+	out, err := exec.Command("ioreg", "-n", "AppleSmartBattery", "-r", "-a").Output()
+	if err != nil {
+		return nil, err
+	}
+	if len(out) == 0 {
+		return nil, nil
+	}
+	var batteries []macBattery
+	if _, err := plist.Unmarshal(out, &batteries); err != nil {
+		return nil, err
+	}
+	return batteries, nil
+}
+
+// HasReadableBattery checks if the system has a battery and returns true if it does.
+var HasReadableBattery = sync.OnceValue(func() bool {
+	systemHasBattery := false
+	batteries, err := readMacBatteries()
+	slog.Debug("Batteries", "batteries", batteries, "err", err)
+	for _, bat := range batteries {
+		if bat.MaxCapacity > 0 {
+			systemHasBattery = true
+			break
+		}
+	}
+	return systemHasBattery
+})
+
+// GetBatteryStats returns the current battery percent and charge state.
+// Uses CurrentCapacity/MaxCapacity to match the value macOS displays.
+func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
+	if !HasReadableBattery() {
+		return batteryPercent, batteryState, errors.ErrUnsupported
+	}
+	batteries, err := readMacBatteries()
+	if len(batteries) == 0 {
+		return batteryPercent, batteryState, errors.New("no batteries")
+	}
+
+	totalCapacity := 0
+	totalCharge := 0
+	batteryState = math.MaxUint8
+
+	for _, bat := range batteries {
+		if bat.MaxCapacity == 0 {
+			// skip ghost batteries with 0 capacity
+			// https://github.com/distatus/battery/issues/34
+			continue
+		}
+		totalCapacity += bat.MaxCapacity
+		totalCharge += min(bat.CurrentCapacity, bat.MaxCapacity)
+
+		switch {
+		case !bat.ExternalConnected:
+			batteryState = stateDischarging
+		case bat.IsCharging:
+			batteryState = stateCharging
+		case bat.CurrentCapacity == 0:
+			batteryState = stateEmpty
+		case !bat.FullyCharged:
+			batteryState = stateIdle
+		default:
+			batteryState = stateFull
+		}
+	}
+
+	if totalCapacity == 0 || batteryState == math.MaxUint8 {
+		return batteryPercent, batteryState, errors.New("no battery capacity")
+	}
+
+	batteryPercent = uint8(float64(totalCharge) / float64(totalCapacity) * 100)
+	return batteryPercent, batteryState, nil
+}

agent/battery/battery_linux.go

@@ -0,0 +1,117 @@
+//go:build linux
+
+package battery
+
+import (
+	"errors"
+	"log/slog"
+	"math"
+	"os"
+	"path/filepath"
+	"strconv"
+	"sync"
+
+	"github.com/henrygd/beszel/agent/utils"
+)
+
+// getBatteryPaths returns the paths of all batteries in /sys/class/power_supply
+var getBatteryPaths func() ([]string, error)
+
+// HasReadableBattery checks if the system has a battery and returns true if it does.
+var HasReadableBattery func() bool
+
+func init() {
+	resetBatteryState("/sys/class/power_supply")
+}
+
+// resetBatteryState resets the sync.Once functions to a fresh state.
+// Tests call this after swapping sysfsPowerSupply so the new path is picked up.
+func resetBatteryState(sysfsPowerSupplyPath string) {
+	getBatteryPaths = sync.OnceValues(func() ([]string, error) {
+		entries, err := os.ReadDir(sysfsPowerSupplyPath)
+		if err != nil {
+			return nil, err
+		}
+		var paths []string
+		for _, e := range entries {
+			path := filepath.Join(sysfsPowerSupplyPath, e.Name())
+			if utils.ReadStringFile(filepath.Join(path, "type")) == "Battery" {
+				paths = append(paths, path)
+			}
+		}
+		return paths, nil
+	})
+	HasReadableBattery = sync.OnceValue(func() bool {
+		systemHasBattery := false
+		paths, err := getBatteryPaths()
+		for _, path := range paths {
+			if _, ok := utils.ReadStringFileOK(filepath.Join(path, "capacity")); ok {
+				systemHasBattery = true
+				break
+			}
+		}
+		if !systemHasBattery {
+			slog.Debug("No battery found", "err", err)
+		}
+		return systemHasBattery
+	})
+}
+
+func parseSysfsState(status string) uint8 {
+	switch status {
+	case "Empty":
+		return stateEmpty
+	case "Full":
+		return stateFull
+	case "Charging":
+		return stateCharging
+	case "Discharging":
+		return stateDischarging
+	case "Not charging":
+		return stateIdle
+	default:
+		return stateUnknown
+	}
+}
+
+// GetBatteryStats returns the current battery percent and charge state.
+// Reads /sys/class/power_supply/*/capacity directly so the kernel-reported
+// value is used, which is always 0-100 and matches what the OS displays.
+func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
+	if !HasReadableBattery() {
+		return batteryPercent, batteryState, errors.ErrUnsupported
+	}
+	paths, err := getBatteryPaths()
+	if len(paths) == 0 {
+		return batteryPercent, batteryState, errors.New("no batteries")
+	}
+
+	batteryState = math.MaxUint8
+	totalPercent := 0
+	count := 0
+
+	for _, path := range paths {
+		capStr, ok := utils.ReadStringFileOK(filepath.Join(path, "capacity"))
+		if !ok {
+			continue
+		}
+		cap, parseErr := strconv.Atoi(capStr)
+		if parseErr != nil {
+			continue
+		}
+		totalPercent += cap
+		count++
+
+		state := parseSysfsState(utils.ReadStringFile(filepath.Join(path, "status")))
+		if state != stateUnknown {
+			batteryState = state
+		}
+	}
+
+	if count == 0 || batteryState == math.MaxUint8 {
+		return batteryPercent, batteryState, errors.New("no battery capacity")
+	}
+
+	batteryPercent = uint8(totalPercent / count)
+	return batteryPercent, batteryState, nil
+}

agent/battery/battery_linux_test.go

@@ -0,0 +1,201 @@
+//go:build testing && linux
+
+package battery
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// setupFakeSysfs creates a temporary sysfs-like tree under t.TempDir(),
+// swaps sysfsPowerSupply, resets the sync.Once caches, and restores
+// everything on cleanup. Returns a helper to create battery directories.
+func setupFakeSysfs(t *testing.T) (tmpDir string, addBattery func(name, capacity, status string)) {
+	t.Helper()
+
+	tmp := t.TempDir()
+	resetBatteryState(tmp)
+
+	write := func(path, content string) {
+		t.Helper()
+		dir := filepath.Dir(path)
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	addBattery = func(name, capacity, status string) {
+		t.Helper()
+		batDir := filepath.Join(tmp, name)
+		write(filepath.Join(batDir, "type"), "Battery")
+		write(filepath.Join(batDir, "capacity"), capacity)
+		write(filepath.Join(batDir, "status"), status)
+	}
+
+	return tmp, addBattery
+}
+
+func TestParseSysfsState(t *testing.T) {
+	tests := []struct {
+		input string
+		want  uint8
+	}{
+		{"Empty", stateEmpty},
+		{"Full", stateFull},
+		{"Charging", stateCharging},
+		{"Discharging", stateDischarging},
+		{"Not charging", stateIdle},
+		{"", stateUnknown},
+		{"SomethingElse", stateUnknown},
+	}
+	for _, tt := range tests {
+		assert.Equal(t, tt.want, parseSysfsState(tt.input), "parseSysfsState(%q)", tt.input)
+	}
+}
+
+func TestGetBatteryStats_SingleBattery(t *testing.T) {
+	_, addBattery := setupFakeSysfs(t)
+	addBattery("BAT0", "72", "Discharging")
+
+	pct, state, err := GetBatteryStats()
+	assert.NoError(t, err)
+	assert.Equal(t, uint8(72), pct)
+	assert.Equal(t, stateDischarging, state)
+}
+
+func TestGetBatteryStats_MultipleBatteries(t *testing.T) {
+	_, addBattery := setupFakeSysfs(t)
+	addBattery("BAT0", "80", "Charging")
+	addBattery("BAT1", "40", "Charging")
+
+	pct, state, err := GetBatteryStats()
+	assert.NoError(t, err)
+	// average of 80 and 40 = 60
+	assert.EqualValues(t, 60, pct)
+	assert.Equal(t, stateCharging, state)
+}
+
+func TestGetBatteryStats_FullBattery(t *testing.T) {
+	_, addBattery := setupFakeSysfs(t)
+	addBattery("BAT0", "100", "Full")
+
+	pct, state, err := GetBatteryStats()
+	assert.NoError(t, err)
+	assert.Equal(t, uint8(100), pct)
+	assert.Equal(t, stateFull, state)
+}
+
+func TestGetBatteryStats_EmptyBattery(t *testing.T) {
+	_, addBattery := setupFakeSysfs(t)
+	addBattery("BAT0", "0", "Empty")
+
+	pct, state, err := GetBatteryStats()
+	assert.NoError(t, err)
+	assert.Equal(t, uint8(0), pct)
+	assert.Equal(t, stateEmpty, state)
+}
+
+func TestGetBatteryStats_NotCharging(t *testing.T) {
+	_, addBattery := setupFakeSysfs(t)
+	addBattery("BAT0", "80", "Not charging")
+
+	pct, state, err := GetBatteryStats()
+	assert.NoError(t, err)
+	assert.Equal(t, uint8(80), pct)
+	assert.Equal(t, stateIdle, state)
+}
+
+func TestGetBatteryStats_NoBatteries(t *testing.T) {
+	setupFakeSysfs(t) // empty directory, no batteries
+
+	_, _, err := GetBatteryStats()
+	assert.Error(t, err)
+}
+
+func TestGetBatteryStats_NonBatterySupplyIgnored(t *testing.T) {
+	tmp, addBattery := setupFakeSysfs(t)
+
+	// Add a real battery
+	addBattery("BAT0", "55", "Charging")
+
+	// Add an AC adapter (type != Battery) - should be ignored
+	acDir := filepath.Join(tmp, "AC0")
+	if err := os.MkdirAll(acDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(acDir, "type"), []byte("Mains"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	pct, state, err := GetBatteryStats()
+	assert.NoError(t, err)
+	assert.Equal(t, uint8(55), pct)
+	assert.Equal(t, stateCharging, state)
+}
+
+func TestGetBatteryStats_InvalidCapacitySkipped(t *testing.T) {
+	tmp, addBattery := setupFakeSysfs(t)
+
+	// One battery with valid capacity
+	addBattery("BAT0", "90", "Discharging")
+
+	// Another with invalid capacity text
+	badDir := filepath.Join(tmp, "BAT1")
+	if err := os.MkdirAll(badDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(badDir, "type"), []byte("Battery"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(badDir, "capacity"), []byte("not-a-number"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(badDir, "status"), []byte("Discharging"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	pct, _, err := GetBatteryStats()
+	assert.NoError(t, err)
+	// Only BAT0 counted
+	assert.Equal(t, uint8(90), pct)
+}
+
+func TestGetBatteryStats_UnknownStatusOnly(t *testing.T) {
+	_, addBattery := setupFakeSysfs(t)
+	addBattery("BAT0", "50", "SomethingWeird")
+
+	_, _, err := GetBatteryStats()
+	assert.Error(t, err)
+}
+
+func TestHasReadableBattery_True(t *testing.T) {
+	_, addBattery := setupFakeSysfs(t)
+	addBattery("BAT0", "50", "Charging")
+
+	assert.True(t, HasReadableBattery())
+}
+
+func TestHasReadableBattery_False(t *testing.T) {
+	setupFakeSysfs(t) // no batteries
+
+	assert.False(t, HasReadableBattery())
+}
+
+func TestHasReadableBattery_NoCapacityFile(t *testing.T) {
+	tmp, _ := setupFakeSysfs(t)
+
+	// Battery dir with type file but no capacity file
+	batDir := filepath.Join(tmp, "BAT0")
+	err := os.MkdirAll(batDir, 0o755)
+	assert.NoError(t, err)
+	err = os.WriteFile(filepath.Join(batDir, "type"), []byte("Battery"), 0o644)
+	assert.NoError(t, err)
+
+	assert.False(t, HasReadableBattery())
+}

agent/battery/battery_stub.go

@@ -1,4 +1,4 @@
-//go:build freebsd
+//go:build !darwin && !linux && !windows
 
 package battery
 

agent/battery/battery_windows.go

@@ -0,0 +1,298 @@
+//go:build windows
+
+// Most of the Windows battery code is based on
+// distatus/battery by Karol 'Kenji Takahashi' Woźniak
+
+package battery
+
+import (
+	"errors"
+	"log/slog"
+	"math"
+	"sync"
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+type batteryQueryInformation struct {
+	BatteryTag       uint32
+	InformationLevel int32
+	AtRate           int32
+}
+
+type batteryInformation struct {
+	Capabilities        uint32
+	Technology          uint8
+	Reserved            [3]uint8
+	Chemistry           [4]uint8
+	DesignedCapacity    uint32
+	FullChargedCapacity uint32
+	DefaultAlert1       uint32
+	DefaultAlert2       uint32
+	CriticalBias        uint32
+	CycleCount          uint32
+}
+
+type batteryWaitStatus struct {
+	BatteryTag   uint32
+	Timeout      uint32
+	PowerState   uint32
+	LowCapacity  uint32
+	HighCapacity uint32
+}
+
+type batteryStatus struct {
+	PowerState uint32
+	Capacity   uint32
+	Voltage    uint32
+	Rate       int32
+}
+
+type winGUID struct {
+	Data1 uint32
+	Data2 uint16
+	Data3 uint16
+	Data4 [8]byte
+}
+
+type spDeviceInterfaceData struct {
+	cbSize             uint32
+	InterfaceClassGuid winGUID
+	Flags              uint32
+	Reserved           uint
+}
+
+var guidDeviceBattery = winGUID{
+	0x72631e54,
+	0x78A4,
+	0x11d0,
+	[8]byte{0xbc, 0xf7, 0x00, 0xaa, 0x00, 0xb7, 0xb3, 0x2a},
+}
+
+var (
+	setupapi                         = &windows.LazyDLL{Name: "setupapi.dll", System: true}
+	setupDiGetClassDevsW             = setupapi.NewProc("SetupDiGetClassDevsW")
+	setupDiEnumDeviceInterfaces      = setupapi.NewProc("SetupDiEnumDeviceInterfaces")
+	setupDiGetDeviceInterfaceDetailW = setupapi.NewProc("SetupDiGetDeviceInterfaceDetailW")
+	setupDiDestroyDeviceInfoList     = setupapi.NewProc("SetupDiDestroyDeviceInfoList")
+)
+
+// winBatteryGet reads one battery by index. Returns (fullCapacity, currentCapacity, state, error).
+// Returns error == errNotFound when there are no more batteries.
+var errNotFound = errors.New("no more batteries")
+
+func setupDiSetup(proc *windows.LazyProc, nargs, a1, a2, a3, a4, a5, a6 uintptr) (uintptr, error) {
+	_ = nargs
+	r1, _, errno := syscall.SyscallN(proc.Addr(), a1, a2, a3, a4, a5, a6)
+	if windows.Handle(r1) == windows.InvalidHandle {
+		if errno != 0 {
+			return 0, error(errno)
+		}
+		return 0, syscall.EINVAL
+	}
+	return r1, nil
+}
+
+func setupDiCall(proc *windows.LazyProc, nargs, a1, a2, a3, a4, a5, a6 uintptr) syscall.Errno {
+	_ = nargs
+	r1, _, errno := syscall.SyscallN(proc.Addr(), a1, a2, a3, a4, a5, a6)
+	if r1 == 0 {
+		if errno != 0 {
+			return errno
+		}
+		return syscall.EINVAL
+	}
+	return 0
+}
+
+func readWinBatteryState(powerState uint32) uint8 {
+	switch {
+	case powerState&0x00000004 != 0:
+		return stateCharging
+	case powerState&0x00000008 != 0:
+		return stateEmpty
+	case powerState&0x00000002 != 0:
+		return stateDischarging
+	case powerState&0x00000001 != 0:
+		return stateFull
+	default:
+		return stateUnknown
+	}
+}
+
+func winBatteryGet(idx int) (full, current uint32, state uint8, err error) {
+	hdev, err := setupDiSetup(
+		setupDiGetClassDevsW,
+		4,
+		uintptr(unsafe.Pointer(&guidDeviceBattery)),
+		0, 0,
+		2|16, // DIGCF_PRESENT|DIGCF_DEVICEINTERFACE
+		0, 0,
+	)
+	if err != nil {
+		return 0, 0, stateUnknown, err
+	}
+	defer syscall.SyscallN(setupDiDestroyDeviceInfoList.Addr(), hdev)
+
+	var did spDeviceInterfaceData
+	did.cbSize = uint32(unsafe.Sizeof(did))
+	errno := setupDiCall(
+		setupDiEnumDeviceInterfaces,
+		5,
+		hdev, 0,
+		uintptr(unsafe.Pointer(&guidDeviceBattery)),
+		uintptr(idx),
+		uintptr(unsafe.Pointer(&did)),
+		0,
+	)
+	if errno == 259 { // ERROR_NO_MORE_ITEMS
+		return 0, 0, stateUnknown, errNotFound
+	}
+	if errno != 0 {
+		return 0, 0, stateUnknown, errno
+	}
+
+	var cbRequired uint32
+	errno = setupDiCall(
+		setupDiGetDeviceInterfaceDetailW,
+		6,
+		hdev,
+		uintptr(unsafe.Pointer(&did)),
+		0, 0,
+		uintptr(unsafe.Pointer(&cbRequired)),
+		0,
+	)
+	if errno != 0 && errno != 122 { // ERROR_INSUFFICIENT_BUFFER
+		return 0, 0, stateUnknown, errno
+	}
+	didd := make([]uint16, cbRequired/2)
+	cbSize := (*uint32)(unsafe.Pointer(&didd[0]))
+	if unsafe.Sizeof(uint(0)) == 8 {
+		*cbSize = 8
+	} else {
+		*cbSize = 6
+	}
+	errno = setupDiCall(
+		setupDiGetDeviceInterfaceDetailW,
+		6,
+		hdev,
+		uintptr(unsafe.Pointer(&did)),
+		uintptr(unsafe.Pointer(&didd[0])),
+		uintptr(cbRequired),
+		uintptr(unsafe.Pointer(&cbRequired)),
+		0,
+	)
+	if errno != 0 {
+		return 0, 0, stateUnknown, errno
+	}
+	devicePath := &didd[2:][0]
+
+	handle, err := windows.CreateFile(
+		devicePath,
+		windows.GENERIC_READ|windows.GENERIC_WRITE,
+		windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE,
+		nil,
+		windows.OPEN_EXISTING,
+		windows.FILE_ATTRIBUTE_NORMAL,
+		0,
+	)
+	if err != nil {
+		return 0, 0, stateUnknown, err
+	}
+	defer windows.CloseHandle(handle)
+
+	var dwOut uint32
+	var dwWait uint32
+	var bqi batteryQueryInformation
+	err = windows.DeviceIoControl(
+		handle,
+		2703424, // IOCTL_BATTERY_QUERY_TAG
+		(*byte)(unsafe.Pointer(&dwWait)),
+		uint32(unsafe.Sizeof(dwWait)),
+		(*byte)(unsafe.Pointer(&bqi.BatteryTag)),
+		uint32(unsafe.Sizeof(bqi.BatteryTag)),
+		&dwOut, nil,
+	)
+	if err != nil || bqi.BatteryTag == 0 {
+		return 0, 0, stateUnknown, errors.New("battery tag not returned")
+	}
+
+	var bi batteryInformation
+	if err = windows.DeviceIoControl(
+		handle,
+		2703428, // IOCTL_BATTERY_QUERY_INFORMATION
+		(*byte)(unsafe.Pointer(&bqi)),
+		uint32(unsafe.Sizeof(bqi)),
+		(*byte)(unsafe.Pointer(&bi)),
+		uint32(unsafe.Sizeof(bi)),
+		&dwOut, nil,
+	); err != nil {
+		return 0, 0, stateUnknown, err
+	}
+
+	bws := batteryWaitStatus{BatteryTag: bqi.BatteryTag}
+	var bs batteryStatus
+	if err = windows.DeviceIoControl(
+		handle,
+		2703436, // IOCTL_BATTERY_QUERY_STATUS
+		(*byte)(unsafe.Pointer(&bws)),
+		uint32(unsafe.Sizeof(bws)),
+		(*byte)(unsafe.Pointer(&bs)),
+		uint32(unsafe.Sizeof(bs)),
+		&dwOut, nil,
+	); err != nil {
+		return 0, 0, stateUnknown, err
+	}
+
+	if bs.Capacity == 0xffffffff { // BATTERY_UNKNOWN_CAPACITY
+		return 0, 0, stateUnknown, errors.New("battery capacity unknown")
+	}
+
+	return bi.FullChargedCapacity, bs.Capacity, readWinBatteryState(bs.PowerState), nil
+}
+
+// HasReadableBattery checks if the system has a battery and returns true if it does.
+var HasReadableBattery = sync.OnceValue(func() bool {
+	systemHasBattery := false
+	full, _, _, err := winBatteryGet(0)
+	if err == nil && full > 0 {
+		systemHasBattery = true
+	}
+	if !systemHasBattery {
+		slog.Debug("No battery found", "err", err)
+	}
+	return systemHasBattery
+})
+
+// GetBatteryStats returns the current battery percent and charge state.
+func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
+	if !HasReadableBattery() {
+		return batteryPercent, batteryState, errors.ErrUnsupported
+	}
+
+	totalFull := uint32(0)
+	totalCurrent := uint32(0)
+	batteryState = math.MaxUint8
+
+	for i := 0; ; i++ {
+		full, current, state, bErr := winBatteryGet(i)
+		if errors.Is(bErr, errNotFound) {
+			break
+		}
+		if bErr != nil || full == 0 {
+			continue
+		}
+		totalFull += full
+		totalCurrent += min(current, full)
+		batteryState = state
+	}
+
+	if totalFull == 0 || batteryState == math.MaxUint8 {
+		return batteryPercent, batteryState, errors.New("no battery capacity")
+	}
+
+	batteryPercent = uint8(float64(totalCurrent) / float64(totalFull) * 100)
+	return batteryPercent, batteryState, nil
+}

agent/disk.go

@@ -34,6 +34,34 @@ type diskDiscovery struct {
 	ctx            fsRegistrationContext
 }
 
+// prevDisk stores previous per-device disk counters for a given cache interval
+type prevDisk struct {
+	readBytes  uint64
+	writeBytes uint64
+	readTime   uint64 // cumulative ms spent on reads (from ReadTime)
+	writeTime  uint64 // cumulative ms spent on writes (from WriteTime)
+	ioTime     uint64 // cumulative ms spent doing I/O (from IoTime)
+	weightedIO uint64 // cumulative weighted ms (queue-depth × ms, from WeightedIO)
+	readCount  uint64 // cumulative read operation count
+	writeCount uint64 // cumulative write operation count
+	at         time.Time
+}
+
+// prevDiskFromCounter creates a prevDisk snapshot from a disk.IOCountersStat at time t.
+func prevDiskFromCounter(d disk.IOCountersStat, t time.Time) prevDisk {
+	return prevDisk{
+		readBytes:  d.ReadBytes,
+		writeBytes: d.WriteBytes,
+		readTime:   d.ReadTime,
+		writeTime:  d.WriteTime,
+		ioTime:     d.IoTime,
+		weightedIO: d.WeightedIO,
+		readCount:  d.ReadCount,
+		writeCount: d.WriteCount,
+		at:         t,
+	}
+}
+
 // parseFilesystemEntry parses a filesystem entry in the format "device__customname"
 // Returns the device/filesystem part and the custom name part
 func parseFilesystemEntry(entry string) (device, customName string) {
@@ -239,9 +267,11 @@ func (d *diskDiscovery) addConfiguredExtraFilesystems(extraFilesystems string) {
 
 // addPartitionExtraFs registers partitions mounted under /extra-filesystems so
 // their display names can come from the folder name while their I/O keys still
-// prefer the underlying partition device.
+// prefer the underlying partition device. Only direct children are matched to
+// avoid registering nested virtual mounts (e.g. /proc, /sys) that are returned by
+// disk.Partitions(true) when the host root is bind-mounted in /extra-filesystems.
 func (d *diskDiscovery) addPartitionExtraFs(p disk.PartitionStat) {
-	if !strings.HasPrefix(p.Mountpoint, d.ctx.efPath) {
+	if filepath.Dir(p.Mountpoint) != d.ctx.efPath {
 		return
 	}
 	device, customName := extraFilesystemPartitionInfo(p)
@@ -579,16 +609,29 @@ func (a *Agent) updateDiskIo(cacheTimeMs uint16, systemStats *system.Stats) {
 			prev, hasPrev := a.diskPrev[cacheTimeMs][name]
 			if !hasPrev {
 				// Seed from agent-level fsStats if present, else seed from current
-				prev = prevDisk{readBytes: stats.TotalRead, writeBytes: stats.TotalWrite, at: stats.Time}
+				prev = prevDisk{
+					readBytes:  stats.TotalRead,
+					writeBytes: stats.TotalWrite,
+					readTime:   d.ReadTime,
+					writeTime:  d.WriteTime,
+					ioTime:     d.IoTime,
+					weightedIO: d.WeightedIO,
+					readCount:  d.ReadCount,
+					writeCount: d.WriteCount,
+					at:         stats.Time,
+				}
 				if prev.at.IsZero() {
-					prev = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
+					prev = prevDiskFromCounter(d, now)
 				}
 			}
 
 			msElapsed := uint64(now.Sub(prev.at).Milliseconds())
+
+			// Update per-interval snapshot
+			a.diskPrev[cacheTimeMs][name] = prevDiskFromCounter(d, now)
+
+			// Avoid division by zero or clock issues
 			if msElapsed < 100 {
-				// Avoid division by zero or clock issues; update snapshot and continue
-				a.diskPrev[cacheTimeMs][name] = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
 				continue
 			}
 
@@ -600,15 +643,38 @@ func (a *Agent) updateDiskIo(cacheTimeMs uint16, systemStats *system.Stats) {
 			// validate values
 			if readMbPerSecond > 50_000 || writeMbPerSecond > 50_000 {
 				slog.Warn("Invalid disk I/O. Resetting.", "name", d.Name, "read", readMbPerSecond, "write", writeMbPerSecond)
-				// Reset interval snapshot and seed from current
-				a.diskPrev[cacheTimeMs][name] = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
 				// also refresh agent baseline to avoid future negatives
 				a.initializeDiskIoStats(ioCounters)
 				continue
 			}
 
-			// Update per-interval snapshot
+			// These properties are calculated differently on different platforms,
-			a.diskPrev[cacheTimeMs][name] = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
+			// but generally represent cumulative time spent doing reads/writes on the device.
+			// This can surpass 100% if there are multiple concurrent I/O operations.
+			// Linux kernel docs:
+			// This is the total number of milliseconds spent by all reads (as
+			// measured from __make_request() to end_that_request_last()).
+			// https://www.kernel.org/doc/Documentation/iostats.txt (fields 4, 8)
+			diskReadTime := utils.TwoDecimals(float64(d.ReadTime-prev.readTime) / float64(msElapsed) * 100)
+			diskWriteTime := utils.TwoDecimals(float64(d.WriteTime-prev.writeTime) / float64(msElapsed) * 100)
+
+			// I/O utilization %: fraction of wall time the device had any I/O in progress (0-100).
+			diskIoUtilPct := utils.TwoDecimals(float64(d.IoTime-prev.ioTime) / float64(msElapsed) * 100)
+
+			// Weighted I/O: queue-depth weighted I/O time, normalized to interval (can exceed 100%).
+			// Linux kernel field 11: incremented by iops_in_progress × ms_since_last_update.
+			// Used to display queue depth. Multipled by 100 to increase accuracy of digit truncation (divided by 100 in UI).
+			diskWeightedIO := utils.TwoDecimals(float64(d.WeightedIO-prev.weightedIO) / float64(msElapsed) * 100)
+
+			// r_await / w_await: average time per read/write operation in milliseconds.
+			// Equivalent to r_await and w_await in iostat.
+			var rAwait, wAwait float64
+			if deltaReadCount := d.ReadCount - prev.readCount; deltaReadCount > 0 {
+				rAwait = utils.TwoDecimals(float64(d.ReadTime-prev.readTime) / float64(deltaReadCount))
+			}
+			if deltaWriteCount := d.WriteCount - prev.writeCount; deltaWriteCount > 0 {
+				wAwait = utils.TwoDecimals(float64(d.WriteTime-prev.writeTime) / float64(deltaWriteCount))
+			}
 
 			// Update global fsStats baseline for cross-interval correctness
 			stats.Time = now
@@ -618,20 +684,40 @@ func (a *Agent) updateDiskIo(cacheTimeMs uint16, systemStats *system.Stats) {
 			stats.DiskWritePs = writeMbPerSecond
 			stats.DiskReadBytes = diskIORead
 			stats.DiskWriteBytes = diskIOWrite
+			stats.DiskIoStats[0] = diskReadTime
+			stats.DiskIoStats[1] = diskWriteTime
+			stats.DiskIoStats[2] = diskIoUtilPct
+			stats.DiskIoStats[3] = rAwait
+			stats.DiskIoStats[4] = wAwait
+			stats.DiskIoStats[5] = diskWeightedIO
 
 			if stats.Root {
 				systemStats.DiskReadPs = stats.DiskReadPs
 				systemStats.DiskWritePs = stats.DiskWritePs
 				systemStats.DiskIO[0] = diskIORead
 				systemStats.DiskIO[1] = diskIOWrite
+				systemStats.DiskIoStats[0] = diskReadTime
+				systemStats.DiskIoStats[1] = diskWriteTime
+				systemStats.DiskIoStats[2] = diskIoUtilPct
+				systemStats.DiskIoStats[3] = rAwait
+				systemStats.DiskIoStats[4] = wAwait
+				systemStats.DiskIoStats[5] = diskWeightedIO
 			}
 		}
 	}
 }
 
-// getRootMountPoint returns the appropriate root mount point for the system
+// getRootMountPoint returns the appropriate root mount point for the system.
+// On Windows it returns the system drive (e.g. "C:").
 // For immutable systems like Fedora Silverblue, it returns /sysroot instead of /
 func (a *Agent) getRootMountPoint() string {
+	if runtime.GOOS == "windows" {
+		if sd := os.Getenv("SystemDrive"); sd != "" {
+			return sd
+		}
+		return "C:"
+	}
+
 	// 1. Check if /etc/os-release contains indicators of an immutable system
 	if osReleaseContent, err := os.ReadFile("/etc/os-release"); err == nil {
 		content := string(osReleaseContent)

agent/disk_test.go

@@ -530,6 +530,87 @@ func TestAddExtraFilesystemFolders(t *testing.T) {
 	})
 }
 
+func TestAddPartitionExtraFs(t *testing.T) {
+	makeDiscovery := func(agent *Agent) diskDiscovery {
+		return diskDiscovery{
+			agent: agent,
+			ctx: fsRegistrationContext{
+				isWindows: false,
+				efPath:    "/extra-filesystems",
+				diskIoCounters: map[string]disk.IOCountersStat{
+					"nvme0n1p1": {Name: "nvme0n1p1"},
+					"nvme1n1":   {Name: "nvme1n1"},
+				},
+			},
+		}
+	}
+
+	t.Run("registers direct child of extra-filesystems", func(t *testing.T) {
+		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
+		d := makeDiscovery(agent)
+
+		d.addPartitionExtraFs(disk.PartitionStat{
+			Device:     "/dev/nvme0n1p1",
+			Mountpoint: "/extra-filesystems/nvme0n1p1__caddy1-root",
+		})
+
+		stats, exists := agent.fsStats["nvme0n1p1"]
+		assert.True(t, exists)
+		assert.Equal(t, "/extra-filesystems/nvme0n1p1__caddy1-root", stats.Mountpoint)
+		assert.Equal(t, "caddy1-root", stats.Name)
+	})
+
+	t.Run("skips nested mount under extra-filesystem bind mount", func(t *testing.T) {
+		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
+		d := makeDiscovery(agent)
+
+		// These simulate the virtual mounts that appear when host / is bind-mounted
+		// with disk.Partitions(all=true) — e.g. /proc, /sys, /dev visible under the mount.
+		for _, nested := range []string{
+			"/extra-filesystems/nvme0n1p1__caddy1-root/proc",
+			"/extra-filesystems/nvme0n1p1__caddy1-root/sys",
+			"/extra-filesystems/nvme0n1p1__caddy1-root/dev",
+			"/extra-filesystems/nvme0n1p1__caddy1-root/run",
+		} {
+			d.addPartitionExtraFs(disk.PartitionStat{Device: "tmpfs", Mountpoint: nested})
+		}
+
+		assert.Empty(t, agent.fsStats)
+	})
+
+	t.Run("registers both direct children, skips their nested mounts", func(t *testing.T) {
+		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
+		d := makeDiscovery(agent)
+
+		partitions := []disk.PartitionStat{
+			{Device: "/dev/nvme0n1p1", Mountpoint: "/extra-filesystems/nvme0n1p1__caddy1-root"},
+			{Device: "/dev/nvme1n1", Mountpoint: "/extra-filesystems/nvme1n1__caddy1-docker"},
+			{Device: "proc", Mountpoint: "/extra-filesystems/nvme0n1p1__caddy1-root/proc"},
+			{Device: "sysfs", Mountpoint: "/extra-filesystems/nvme0n1p1__caddy1-root/sys"},
+			{Device: "overlay", Mountpoint: "/extra-filesystems/nvme0n1p1__caddy1-root/var/lib/docker"},
+		}
+		for _, p := range partitions {
+			d.addPartitionExtraFs(p)
+		}
+
+		assert.Len(t, agent.fsStats, 2)
+		assert.Equal(t, "caddy1-root", agent.fsStats["nvme0n1p1"].Name)
+		assert.Equal(t, "caddy1-docker", agent.fsStats["nvme1n1"].Name)
+	})
+
+	t.Run("skips partition not under extra-filesystems", func(t *testing.T) {
+		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
+		d := makeDiscovery(agent)
+
+		d.addPartitionExtraFs(disk.PartitionStat{
+			Device:     "/dev/nvme0n1p1",
+			Mountpoint: "/",
+		})
+
+		assert.Empty(t, agent.fsStats)
+	})
+}
+
 func TestFindIoDevice(t *testing.T) {
 	t.Run("matches by device name", func(t *testing.T) {
 		ioCounters := map[string]disk.IOCountersStat{

agent/lhm/beszel_lhm.csproj

@@ -8,6 +8,6 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="LibreHardwareMonitorLib" Version="0.9.5" />
+    <PackageReference Include="LibreHardwareMonitorLib" Version="0.9.6" />
   </ItemGroup>
 </Project>

agent/sensors.go

@@ -19,13 +19,20 @@ import (
 	"github.com/shirou/gopsutil/v4/sensors"
 )
 
+var errTemperatureFetchTimeout = errors.New("temperature collection timed out")
+
+// Matches sensors.TemperaturesWithContext to allow for panic recovery (gopsutil/issues/1832)
+type getTempsFn func(ctx context.Context) ([]sensors.TemperatureStat, error)
+
 type SensorConfig struct {
 	context        context.Context
 	sensors        map[string]struct{}
 	primarySensor  string
+	timeout        time.Duration
 	isBlacklist    bool
 	hasWildcards   bool
 	skipCollection bool
+	firstRun       bool
 }
 
 func (a *Agent) newSensorConfig() *SensorConfig {
@@ -33,25 +40,29 @@ func (a *Agent) newSensorConfig() *SensorConfig {
 	sysSensors, _ := utils.GetEnv("SYS_SENSORS")
 	sensorsEnvVal, sensorsSet := utils.GetEnv("SENSORS")
 	skipCollection := sensorsSet && sensorsEnvVal == ""
+	sensorsTimeout, _ := utils.GetEnv("SENSORS_TIMEOUT")
 
-	return a.newSensorConfigWithEnv(primarySensor, sysSensors, sensorsEnvVal, skipCollection)
+	return a.newSensorConfigWithEnv(primarySensor, sysSensors, sensorsEnvVal, sensorsTimeout, skipCollection)
 }
 
-// Matches sensors.TemperaturesWithContext to allow for panic recovery (gopsutil/issues/1832)
-type getTempsFn func(ctx context.Context) ([]sensors.TemperatureStat, error)
-
-var (
-	errTemperatureFetchTimeout = errors.New("temperature collection timed out")
-	temperatureFetchTimeout    = 2 * time.Second
-)
-
 // newSensorConfigWithEnv creates a SensorConfig with the provided environment variables
 // sensorsSet indicates if the SENSORS environment variable was explicitly set (even to empty string)
-func (a *Agent) newSensorConfigWithEnv(primarySensor, sysSensors, sensorsEnvVal string, skipCollection bool) *SensorConfig {
+func (a *Agent) newSensorConfigWithEnv(primarySensor, sysSensors, sensorsEnvVal, sensorsTimeout string, skipCollection bool) *SensorConfig {
+	timeout := 2 * time.Second
+	if sensorsTimeout != "" {
+		if d, err := time.ParseDuration(sensorsTimeout); err == nil {
+			timeout = d
+		} else {
+			slog.Warn("Invalid SENSORS_TIMEOUT", "value", sensorsTimeout)
+		}
+	}
+
 	config := &SensorConfig{
 		context:        context.Background(),
 		primarySensor:  primarySensor,
+		timeout:        timeout,
 		skipCollection: skipCollection,
+		firstRun:       true,
 		sensors:        make(map[string]struct{}),
 	}
 
@@ -167,6 +178,14 @@ func (a *Agent) getTempsWithTimeout(getTemps getTempsFn) ([]sensors.TemperatureS
 		err   error
 	}
 
+	// Use a longer timeout on the first run to allow for initialization
+	// (e.g. Windows LHM subprocess startup)
+	timeout := a.sensorConfig.timeout
+	if a.sensorConfig.firstRun {
+		a.sensorConfig.firstRun = false
+		timeout = 10 * time.Second
+	}
+
 	resultCh := make(chan result, 1)
 	go func() {
 		temps, err := a.getTempsWithPanicRecovery(getTemps)
@@ -176,7 +195,7 @@ func (a *Agent) getTempsWithTimeout(getTemps getTempsFn) ([]sensors.TemperatureS
 	select {
 	case res := <-resultCh:
 		return res.temps, res.err
-	case <-time.After(temperatureFetchTimeout):
+	case <-time.After(timeout):
 		return nil, errTemperatureFetchTimeout
 	}
 }

agent/sensors_test.go

@@ -168,6 +168,7 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 		primarySensor  string
 		sysSensors     string
 		sensors        string
+		sensorsTimeout string
 		skipCollection bool
 		expectedConfig *SensorConfig
 	}{
@@ -179,12 +180,37 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:        context.Background(),
 				primarySensor:  "",
+				timeout:        2 * time.Second,
 				sensors:        map[string]struct{}{},
 				isBlacklist:    false,
 				hasWildcards:   false,
 				skipCollection: false,
 			},
 		},
+		{
+			name:           "Custom timeout",
+			primarySensor:  "",
+			sysSensors:     "",
+			sensors:        "",
+			sensorsTimeout: "5s",
+			expectedConfig: &SensorConfig{
+				context: context.Background(),
+				timeout: 5 * time.Second,
+				sensors: map[string]struct{}{},
+			},
+		},
+		{
+			name:           "Invalid timeout falls back to default",
+			primarySensor:  "",
+			sysSensors:     "",
+			sensors:        "",
+			sensorsTimeout: "notaduration",
+			expectedConfig: &SensorConfig{
+				context: context.Background(),
+				timeout: 2 * time.Second,
+				sensors: map[string]struct{}{},
+			},
+		},
 		{
 			name:           "Explicitly set to empty string",
 			primarySensor:  "",
@@ -194,6 +220,7 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:        context.Background(),
 				primarySensor:  "",
+				timeout:        2 * time.Second,
 				sensors:        map[string]struct{}{},
 				isBlacklist:    false,
 				hasWildcards:   false,
@@ -208,6 +235,7 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:       context.Background(),
 				primarySensor: "cpu_temp",
+				timeout:       2 * time.Second,
 				sensors:       map[string]struct{}{},
 				isBlacklist:   false,
 				hasWildcards:  false,
@@ -221,6 +249,7 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:       context.Background(),
 				primarySensor: "cpu_temp",
+				timeout:       2 * time.Second,
 				sensors: map[string]struct{}{
 					"cpu_temp": {},
 					"gpu_temp": {},
@@ -237,6 +266,7 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:       context.Background(),
 				primarySensor: "cpu_temp",
+				timeout:       2 * time.Second,
 				sensors: map[string]struct{}{
 					"cpu_temp": {},
 					"gpu_temp": {},
@@ -253,6 +283,7 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:       context.Background(),
 				primarySensor: "cpu_temp",
+				timeout:       2 * time.Second,
 				sensors: map[string]struct{}{
 					"cpu_*":    {},
 					"gpu_temp": {},
@@ -269,6 +300,7 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:       context.Background(),
 				primarySensor: "cpu_temp",
+				timeout:       2 * time.Second,
 				sensors: map[string]struct{}{
 					"cpu_*":    {},
 					"gpu_temp": {},
@@ -284,6 +316,7 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			sensors:       "cpu_temp",
 			expectedConfig: &SensorConfig{
 				primarySensor: "cpu_temp",
+				timeout:       2 * time.Second,
 				sensors: map[string]struct{}{
 					"cpu_temp": {},
 				},
@@ -295,7 +328,7 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result := agent.newSensorConfigWithEnv(tt.primarySensor, tt.sysSensors, tt.sensors, tt.skipCollection)
+			result := agent.newSensorConfigWithEnv(tt.primarySensor, tt.sysSensors, tt.sensors, tt.sensorsTimeout, tt.skipCollection)
 
 			// Check primary sensor
 			assert.Equal(t, tt.expectedConfig.primarySensor, result.primarySensor)
@@ -314,6 +347,7 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			// Check flags
 			assert.Equal(t, tt.expectedConfig.isBlacklist, result.isBlacklist)
 			assert.Equal(t, tt.expectedConfig.hasWildcards, result.hasWildcards)
+			assert.Equal(t, tt.expectedConfig.timeout, result.timeout)
 
 			// Check context
 			if tt.sysSensors != "" {
@@ -333,12 +367,14 @@ func TestNewSensorConfig(t *testing.T) {
 	t.Setenv("BESZEL_AGENT_PRIMARY_SENSOR", "test_primary")
 	t.Setenv("BESZEL_AGENT_SYS_SENSORS", "/test/path")
 	t.Setenv("BESZEL_AGENT_SENSORS", "test_sensor1,test_*,test_sensor3")
+	t.Setenv("BESZEL_AGENT_SENSORS_TIMEOUT", "7s")
 
 	agent := &Agent{}
 	result := agent.newSensorConfig()
 
 	// Verify results
 	assert.Equal(t, "test_primary", result.primarySensor)
+	assert.Equal(t, 7*time.Second, result.timeout)
 	assert.NotNil(t, result.sensors)
 	assert.Equal(t, 3, len(result.sensors))
 	assert.True(t, result.hasWildcards)
@@ -532,15 +568,10 @@ func TestGetTempsWithTimeout(t *testing.T) {
 	agent := &Agent{
 		sensorConfig: &SensorConfig{
 			context: context.Background(),
+			timeout: 10 * time.Millisecond,
 		},
 	}
 
-	originalTimeout := temperatureFetchTimeout
-	t.Cleanup(func() {
-		temperatureFetchTimeout = originalTimeout
-	})
-	temperatureFetchTimeout = 10 * time.Millisecond
-
 	t.Run("returns temperatures before timeout", func(t *testing.T) {
 		temps, err := agent.getTempsWithTimeout(func(ctx context.Context) ([]sensors.TemperatureStat, error) {
 			return []sensors.TemperatureStat{{SensorKey: "cpu_temp", Temperature: 42}}, nil
@@ -567,15 +598,13 @@ func TestUpdateTemperaturesSkipsOnTimeout(t *testing.T) {
 		systemInfo: system.Info{DashboardTemp: 99},
 		sensorConfig: &SensorConfig{
 			context: context.Background(),
+			timeout: 10 * time.Millisecond,
 		},
 	}
 
-	originalTimeout := temperatureFetchTimeout
 	t.Cleanup(func() {
-		temperatureFetchTimeout = originalTimeout
 		getSensorTemps = sensors.TemperaturesWithContext
 	})
-	temperatureFetchTimeout = 10 * time.Millisecond
 	getSensorTemps = func(ctx context.Context) ([]sensors.TemperatureStat, error) {
 		time.Sleep(50 * time.Millisecond)
 		return nil, nil

agent/smart.go

@@ -25,12 +25,15 @@ import (
 // SmartManager manages data collection for SMART devices
 type SmartManager struct {
 	sync.Mutex
-	SmartDataMap    map[string]*smart.SmartData
+	SmartDataMap       map[string]*smart.SmartData
-	SmartDevices    []*DeviceInfo
+	SmartDevices       []*DeviceInfo
-	refreshMutex    sync.Mutex
+	refreshMutex       sync.Mutex
-	lastScanTime    time.Time
+	lastScanTime       time.Time
-	smartctlPath    string
+	smartctlPath       string
-	excludedDevices map[string]struct{}
+	excludedDevices    map[string]struct{}
+	darwinNvmeOnce     sync.Once
+	darwinNvmeCapacity map[string]uint64      // serial → bytes cache, written once via darwinNvmeOnce
+	darwinNvmeProvider func() ([]byte, error) // overridable for testing
 }
 
 type scanOutput struct {
@@ -1033,6 +1036,52 @@ func parseScsiGigabytesProcessed(value string) int64 {
 	return parsed
 }
 
+// lookupDarwinNvmeCapacity returns the capacity in bytes for a given NVMe serial number on Darwin.
+// It uses system_profiler SPNVMeDataType to get capacity since Apple SSDs don't report user_capacity
+// via smartctl. Results are cached after the first call via sync.Once.
+func (sm *SmartManager) lookupDarwinNvmeCapacity(serial string) uint64 {
+	sm.darwinNvmeOnce.Do(func() {
+		sm.darwinNvmeCapacity = make(map[string]uint64)
+
+		provider := sm.darwinNvmeProvider
+		if provider == nil {
+			provider = func() ([]byte, error) {
+				ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+				defer cancel()
+				return exec.CommandContext(ctx, "system_profiler", "SPNVMeDataType", "-json").Output()
+			}
+		}
+
+		out, err := provider()
+		if err != nil {
+			slog.Debug("system_profiler NVMe lookup failed", "err", err)
+			return
+		}
+
+		var result struct {
+			SPNVMeDataType []struct {
+				Items []struct {
+					DeviceSerial string `json:"device_serial"`
+					SizeInBytes  uint64 `json:"size_in_bytes"`
+				} `json:"_items"`
+			} `json:"SPNVMeDataType"`
+		}
+		if err := json.Unmarshal(out, &result); err != nil {
+			slog.Debug("system_profiler NVMe parse failed", "err", err)
+			return
+		}
+
+		for _, controller := range result.SPNVMeDataType {
+			for _, item := range controller.Items {
+				if item.DeviceSerial != "" && item.SizeInBytes > 0 {
+					sm.darwinNvmeCapacity[item.DeviceSerial] = item.SizeInBytes
+				}
+			}
+		}
+	})
+	return sm.darwinNvmeCapacity[serial]
+}
+
 // parseSmartForNvme parses the output of smartctl --all -j /dev/nvmeX and updates the SmartDataMap
 // Returns hasValidData and exitStatus
 func (sm *SmartManager) parseSmartForNvme(output []byte) (bool, int) {
@@ -1069,6 +1118,9 @@ func (sm *SmartManager) parseSmartForNvme(output []byte) (bool, int) {
 	smartData.SerialNumber = data.SerialNumber
 	smartData.FirmwareVersion = data.FirmwareVersion
 	smartData.Capacity = data.UserCapacity.Bytes
+	if smartData.Capacity == 0 && (runtime.GOOS == "darwin" || sm.darwinNvmeProvider != nil) {
+		smartData.Capacity = sm.lookupDarwinNvmeCapacity(data.SerialNumber)
+	}
 	smartData.Temperature = data.NVMeSmartHealthInformationLog.Temperature
 	smartData.SmartStatus = getSmartStatus(smartData.Temperature, data.SmartStatus.Passed)
 	smartData.DiskName = data.Device.Name

agent/smart_test.go

@@ -1199,3 +1199,81 @@ func TestIsNvmeControllerPath(t *testing.T) {
 		})
 	}
 }
+
+func TestParseSmartForNvmeAppleSSD(t *testing.T) {
+	// Apple SSDs don't report user_capacity via smartctl; capacity should be fetched
+	// from system_profiler via the darwinNvmeProvider fallback.
+	fixturePath := filepath.Join("test-data", "smart", "apple_nvme.json")
+	data, err := os.ReadFile(fixturePath)
+	require.NoError(t, err)
+
+	providerCalls := 0
+	fakeProvider := func() ([]byte, error) {
+		providerCalls++
+		return []byte(`{
+			"SPNVMeDataType": [{
+				"_items": [{
+					"device_serial": "0ba0147940253c15",
+					"size_in_bytes": 251000193024
+				}]
+			}]
+		}`), nil
+	}
+
+	sm := &SmartManager{
+		SmartDataMap:       make(map[string]*smart.SmartData),
+		darwinNvmeProvider: fakeProvider,
+	}
+
+	hasData, _ := sm.parseSmartForNvme(data)
+	require.True(t, hasData)
+
+	deviceData, ok := sm.SmartDataMap["0ba0147940253c15"]
+	require.True(t, ok)
+	assert.Equal(t, "APPLE SSD AP0256Q", deviceData.ModelName)
+	assert.Equal(t, uint64(251000193024), deviceData.Capacity)
+	assert.Equal(t, uint8(42), deviceData.Temperature)
+	assert.Equal(t, "PASSED", deviceData.SmartStatus)
+	assert.Equal(t, 1, providerCalls, "system_profiler should be called once")
+
+	// Second parse: provider should NOT be called again (cache hit)
+	_, _ = sm.parseSmartForNvme(data)
+	assert.Equal(t, 1, providerCalls, "system_profiler should not be called again after caching")
+}
+
+func TestLookupDarwinNvmeCapacityMultipleDisks(t *testing.T) {
+	fakeProvider := func() ([]byte, error) {
+		return []byte(`{
+			"SPNVMeDataType": [
+				{
+					"_items": [
+						{"device_serial": "serial-disk0", "size_in_bytes": 251000193024},
+						{"device_serial": "serial-disk1", "size_in_bytes": 1000204886016}
+					]
+				},
+				{
+					"_items": [
+						{"device_serial": "serial-disk2", "size_in_bytes": 512110190592}
+					]
+				}
+			]
+		}`), nil
+	}
+
+	sm := &SmartManager{darwinNvmeProvider: fakeProvider}
+	assert.Equal(t, uint64(251000193024), sm.lookupDarwinNvmeCapacity("serial-disk0"))
+	assert.Equal(t, uint64(1000204886016), sm.lookupDarwinNvmeCapacity("serial-disk1"))
+	assert.Equal(t, uint64(512110190592), sm.lookupDarwinNvmeCapacity("serial-disk2"))
+	assert.Equal(t, uint64(0), sm.lookupDarwinNvmeCapacity("unknown-serial"))
+}
+
+func TestLookupDarwinNvmeCapacityProviderError(t *testing.T) {
+	fakeProvider := func() ([]byte, error) {
+		return nil, errors.New("system_profiler not found")
+	}
+
+	sm := &SmartManager{darwinNvmeProvider: fakeProvider}
+	assert.Equal(t, uint64(0), sm.lookupDarwinNvmeCapacity("any-serial"))
+	// Cache should be initialized even on error so we don't retry (Once already fired)
+	assert.NotNil(t, sm.darwinNvmeCapacity)
+}

agent/system.go

@@ -8,7 +8,6 @@ import (
 	"os"
 	"runtime"
 	"strings"
-	"time"
 
 	"github.com/henrygd/beszel"
 	"github.com/henrygd/beszel/agent/battery"
@@ -23,13 +22,6 @@ import (
 	"github.com/shirou/gopsutil/v4/mem"
 )
 
-// prevDisk stores previous per-device disk counters for a given cache interval
-type prevDisk struct {
-	readBytes  uint64
-	writeBytes uint64
-	at         time.Time
-}
-
 // Sets initial / non-changing values about the host system
 func (a *Agent) refreshSystemDetails() {
 	a.systemInfo.AgentVersion = beszel.Version

agent/test-data/smart/apple_nvme.json

@@ -0,0 +1,51 @@
+{
+  "json_format_version": [1, 0],
+  "smartctl": {
+    "version": [7, 4],
+    "argv": ["smartctl", "-aix", "-j", "IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/ans@77400000/AppleASCWrapV4/iop-ans-nub/RTBuddy(ANS2)/RTBuddyService/AppleANS3NVMeController/NS_01@1"],
+    "exit_status": 4
+  },
+  "device": {
+    "name": "IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/ans@77400000/AppleASCWrapV4/iop-ans-nub/RTBuddy(ANS2)/RTBuddyService/AppleANS3NVMeController/NS_01@1",
+    "info_name": "IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/ans@77400000/AppleASCWrapV4/iop-ans-nub/RTBuddy(ANS2)/RTBuddyService/AppleANS3NVMeController/NS_01@1",
+    "type": "nvme",
+    "protocol": "NVMe"
+  },
+  "model_name": "APPLE SSD AP0256Q",
+  "serial_number": "0ba0147940253c15",
+  "firmware_version": "555",
+  "smart_support": {
+    "available": true,
+    "enabled": true
+  },
+  "smart_status": {
+    "passed": true,
+    "nvme": {
+      "value": 0
+    }
+  },
+  "nvme_smart_health_information_log": {
+    "critical_warning": 0,
+    "temperature": 42,
+    "available_spare": 100,
+    "available_spare_threshold": 99,
+    "percentage_used": 1,
+    "data_units_read": 270189386,
+    "data_units_written": 166753862,
+    "host_reads": 7543766995,
+    "host_writes": 3761621926,
+    "controller_busy_time": 0,
+    "power_cycles": 366,
+    "power_on_hours": 2850,
+    "unsafe_shutdowns": 195,
+    "media_errors": 0,
+    "num_err_log_entries": 0
+  },
+  "temperature": {
+    "current": 42
+  },
+  "power_cycle_count": 366,
+  "power_on_time": {
+    "hours": 2850
+  }
+}

go.mod

@@ -5,7 +5,6 @@ go 1.26.1
 require (
 	github.com/blang/semver v3.5.1+incompatible
 	github.com/coreos/go-systemd/v22 v22.7.0
-	github.com/distatus/battery v0.11.0
 	github.com/ebitengine/purego v0.10.0
 	github.com/fxamacker/cbor/v2 v2.9.0
 	github.com/gliderlabs/ssh v0.3.8
@@ -13,8 +12,8 @@ require (
 	github.com/lxzan/gws v1.9.1
 	github.com/nicholas-fedor/shoutrrr v0.14.1
 	github.com/pocketbase/dbx v1.12.0
-	github.com/pocketbase/pocketbase v0.36.7
+	github.com/pocketbase/pocketbase v0.36.8
-	github.com/shirou/gopsutil/v4 v4.26.2
+	github.com/shirou/gopsutil/v4 v4.26.3
 	github.com/spf13/cast v1.10.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
@@ -23,6 +22,7 @@ require (
 	golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90
 	golang.org/x/sys v0.42.0
 	gopkg.in/yaml.v3 v3.0.1
+	howett.net/plist v1.0.1
 )
 
 require (
@@ -61,9 +61,8 @@ require (
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/term v0.41.0 // indirect
 	golang.org/x/text v0.35.0 // indirect
-	howett.net/plist v1.0.1 // indirect
 	modernc.org/libc v1.70.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
-	modernc.org/sqlite v1.46.2 // indirect
+	modernc.org/sqlite v1.48.0 // indirect
 )

go.sum

@@ -17,8 +17,6 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/disintegration/imaging v1.6.2 h1:w1LecBlG2Lnp8B3jk5zSuNqd7b4DXhcjwek1ei82L+c=
 github.com/disintegration/imaging v1.6.2/go.mod h1:44/5580QXChDfwIclfc/PCwrr44amcmDAg8hxG0Ewe4=
-github.com/distatus/battery v0.11.0 h1:KJk89gz90Iq/wJtbjjM9yUzBXV+ASV/EG2WOOL7N8lc=
-github.com/distatus/battery v0.11.0/go.mod h1:KmVkE8A8hpIX4T78QRdMktYpEp35QfOL8A8dwZBxq2k=
 github.com/domodwyer/mailyak/v3 v3.6.2 h1:x3tGMsyFhTCaxp6ycgR0FE/bu5QiNp+hetUuCOBXMn8=
 github.com/domodwyer/mailyak/v3 v3.6.2/go.mod h1:lOm/u9CyCVWHeaAmHIdF4RiKVxKUT/H5XX10lIKAL6c=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
@@ -98,8 +96,8 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pocketbase/dbx v1.12.0 h1:/oLErM+A0b4xI0PWTGPqSDVjzix48PqI/bng2l0PzoA=
 github.com/pocketbase/dbx v1.12.0/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
-github.com/pocketbase/pocketbase v0.36.7 h1:MrViB7BptPYrf2Nt25pJEYBqUdFjuhRKu1p5GTrkvPA=
+github.com/pocketbase/pocketbase v0.36.8 h1:gCNqoesZ44saYOD3J7edhi5nDwUWKyQG7boM/kVwz2c=
-github.com/pocketbase/pocketbase v0.36.7/go.mod h1:qX4HuVjoKXtEg41fSJVM0JLfGWXbBmHxVv/FaE446r4=
+github.com/pocketbase/pocketbase v0.36.8/go.mod h1:OY4WaXbP0WnF/EXoBbboWJK+ZSZ1A85tiA0sjrTKxTA=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
@@ -107,8 +105,8 @@ github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qq
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/shirou/gopsutil/v4 v4.26.2 h1:X8i6sicvUFih4BmYIGT1m2wwgw2VG9YgrDTi7cIRGUI=
+github.com/shirou/gopsutil/v4 v4.26.3 h1:2ESdQt90yU3oXF/CdOlRCJxrP+Am1aBYubTMTfxJ1qc=
-github.com/shirou/gopsutil/v4 v4.26.2/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
+github.com/shirou/gopsutil/v4 v4.26.3/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
 github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
@@ -199,8 +197,8 @@ modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
 modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.46.2 h1:gkXQ6R0+AjxFC/fTDaeIVLbNLNrRoOK7YYVz5BKhTcE=
+modernc.org/sqlite v1.48.0 h1:ElZyLop3Q2mHYk5IFPPXADejZrlHu7APbpB0sF78bq4=
-modernc.org/sqlite v1.46.2/go.mod h1:hWjRO6Tj/5Ik8ieqxQybiEOUXy0NJFNp2tpvVpKlvig=
+modernc.org/sqlite v1.48.0/go.mod h1:hWjRO6Tj/5Ik8ieqxQybiEOUXy0NJFNp2tpvVpKlvig=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

internal/alerts/alerts_status.go

@@ -109,6 +109,18 @@ func (am *AlertManager) cancelPendingAlert(alertID string) bool {
 	return true
 }
 
+// CancelPendingStatusAlerts cancels all pending status alert timers for a given system.
+// This is called when a system is paused to prevent delayed alerts from firing.
+func (am *AlertManager) CancelPendingStatusAlerts(systemID string) {
+	am.pendingAlerts.Range(func(key, value any) bool {
+		info := value.(*alertInfo)
+		if info.alertData.SystemID == systemID {
+			am.cancelPendingAlert(key.(string))
+		}
+		return true
+	})
+}
+
 // processPendingAlert sends a "down" alert if the pending alert has expired and the system is still down.
 func (am *AlertManager) processPendingAlert(alertID string) {
 	value, loaded := am.pendingAlerts.LoadAndDelete(alertID)

internal/alerts/alerts_status_test.go

@@ -941,3 +941,68 @@ func TestStatusAlertClearedBeforeSend(t *testing.T) {
 		assert.EqualValues(t, 0, alertHistoryCount, "Should have no unresolved alert history records since alert never triggered")
 	})
 }
+
+func TestCancelPendingStatusAlertsClearsAllAlertsForSystem(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	userSettings, err := hub.FindFirstRecordByFilter("user_settings", "user={:user}", map[string]any{"user": user.Id})
+	require.NoError(t, err)
+	userSettings.Set("settings", `{"emails":["test@example.com"],"webhooks":[]}`)
+	require.NoError(t, hub.Save(userSettings))
+
+	systemCollection, err := hub.FindCollectionByNameOrId("systems")
+	require.NoError(t, err)
+
+	system1 := core.NewRecord(systemCollection)
+	system1.Set("name", "system-1")
+	system1.Set("status", "up")
+	system1.Set("host", "127.0.0.1")
+	system1.Set("users", []string{user.Id})
+	require.NoError(t, hub.Save(system1))
+
+	system2 := core.NewRecord(systemCollection)
+	system2.Set("name", "system-2")
+	system2.Set("status", "up")
+	system2.Set("host", "127.0.0.2")
+	system2.Set("users", []string{user.Id})
+	require.NoError(t, hub.Save(system2))
+
+	alertCollection, err := hub.FindCollectionByNameOrId("alerts")
+	require.NoError(t, err)
+
+	alert1 := core.NewRecord(alertCollection)
+	alert1.Set("user", user.Id)
+	alert1.Set("system", system1.Id)
+	alert1.Set("name", "Status")
+	alert1.Set("triggered", false)
+	alert1.Set("min", 5)
+	require.NoError(t, hub.Save(alert1))
+
+	alert2 := core.NewRecord(alertCollection)
+	alert2.Set("user", user.Id)
+	alert2.Set("system", system2.Id)
+	alert2.Set("name", "Status")
+	alert2.Set("triggered", false)
+	alert2.Set("min", 5)
+	require.NoError(t, hub.Save(alert2))
+
+	am := alerts.NewTestAlertManagerWithoutWorker(hub)
+	initialEmailCount := hub.TestMailer.TotalSend()
+
+	// Both systems go down
+	require.NoError(t, am.HandleStatusAlerts("down", system1))
+	require.NoError(t, am.HandleStatusAlerts("down", system2))
+	assert.Equal(t, 2, am.GetPendingAlertsCount(), "both systems should have pending alerts")
+
+	// System 1 is paused — cancel its pending alerts
+	am.CancelPendingStatusAlerts(system1.Id)
+	assert.Equal(t, 1, am.GetPendingAlertsCount(), "only system2 alert should remain pending after pausing system1")
+
+	// Expire and process remaining alerts — only system2 should fire
+	am.ForceExpirePendingAlerts()
+	processed, err := am.ProcessPendingAlerts()
+	require.NoError(t, err)
+	assert.Len(t, processed, 1, "only the non-paused system's alert should be processed")
+	assert.Equal(t, initialEmailCount+1, hub.TestMailer.TotalSend(), "only system2 should send a down notification")
+}

internal/entities/system/system.go

@@ -48,6 +48,8 @@ type Stats struct {
 	MaxDiskIO         [2]uint64            `json:"diom,omitzero" cbor:"-"`                      // [max read bytes, max write bytes]
 	CpuBreakdown      []float64            `json:"cpub,omitempty" cbor:"33,keyasint,omitempty"` // [user, system, iowait, steal, idle]
 	CpuCoresUsage     Uint8Slice           `json:"cpus,omitempty" cbor:"34,keyasint,omitempty"` // per-core busy usage [CPU0..]
+	DiskIoStats       [6]float64           `json:"dios,omitzero" cbor:"35,keyasint,omitzero"`   // [read time %, write time %, io utilization %, r_await ms, w_await ms, weighted io %]
+	MaxDiskIoStats    [6]float64           `json:"diosm,omitzero" cbor:"-"`                     // max values for DiskIoStats
 }
 
 // Uint8Slice wraps []uint8 to customize JSON encoding while keeping CBOR efficient.
@@ -93,10 +95,12 @@ type FsStats struct {
 	MaxDiskReadPS  float64   `json:"rm,omitempty" cbor:"-"`
 	MaxDiskWritePS float64   `json:"wm,omitempty" cbor:"-"`
 	// TODO: remove DiskReadPs and DiskWritePs in future release in favor of DiskReadBytes and DiskWriteBytes
-	DiskReadBytes     uint64 `json:"rb" cbor:"6,keyasint,omitempty"`
+	DiskReadBytes     uint64     `json:"rb" cbor:"6,keyasint,omitempty"`
-	DiskWriteBytes    uint64 `json:"wb" cbor:"7,keyasint,omitempty"`
+	DiskWriteBytes    uint64     `json:"wb" cbor:"7,keyasint,omitempty"`
-	MaxDiskReadBytes  uint64 `json:"rbm,omitempty" cbor:"-"`
+	MaxDiskReadBytes  uint64     `json:"rbm,omitempty" cbor:"-"`
-	MaxDiskWriteBytes uint64 `json:"wbm,omitempty" cbor:"-"`
+	MaxDiskWriteBytes uint64     `json:"wbm,omitempty" cbor:"-"`
+	DiskIoStats       [6]float64 `json:"dios,omitzero" cbor:"8,keyasint,omitzero"` // [read time %, write time %, io utilization %, r_await ms, w_await ms, weighted io %]
+	MaxDiskIoStats    [6]float64 `json:"diosm,omitzero" cbor:"-"`                  // max values for DiskIoStats
 }
 
 type NetIoStats struct {

internal/hub/api.go

@@ -3,6 +3,7 @@ package hub
 import (
 	"context"
 	"net/http"
+	"regexp"
 	"strings"
 	"time"
 
@@ -25,6 +26,32 @@ type UpdateInfo struct {
 	Url       string `json:"url"`
 }
 
+var containerIDPattern = regexp.MustCompile(`^[a-fA-F0-9]{12,64}$`)
+
+// Middleware to allow only admin role users
+var requireAdminRole = customAuthMiddleware(func(e *core.RequestEvent) bool {
+	return e.Auth.GetString("role") == "admin"
+})
+
+// Middleware to exclude readonly users
+var excludeReadOnlyRole = customAuthMiddleware(func(e *core.RequestEvent) bool {
+	return e.Auth.GetString("role") != "readonly"
+})
+
+// customAuthMiddleware handles boilerplate for custom authentication middlewares. fn should
+// return true if the request is allowed, false otherwise. e.Auth is guaranteed to be non-nil.
+func customAuthMiddleware(fn func(*core.RequestEvent) bool) func(*core.RequestEvent) error {
+	return func(e *core.RequestEvent) error {
+		if e.Auth == nil {
+			return e.UnauthorizedError("The request requires valid record authorization token.", nil)
+		}
+		if !fn(e) {
+			return e.ForbiddenError("The authorized record is not allowed to perform this action.", nil)
+		}
+		return e.Next()
+	}
+}
+
 // registerMiddlewares registers custom middlewares
 func (h *Hub) registerMiddlewares(se *core.ServeEvent) {
 	// authorizes request with user matching the provided email
@@ -33,7 +60,7 @@ func (h *Hub) registerMiddlewares(se *core.ServeEvent) {
 			return e.Next()
 		}
 		isAuthRefresh := e.Request.URL.Path == "/api/collections/users/auth-refresh" && e.Request.Method == http.MethodPost
-		e.Auth, err = e.App.FindFirstRecordByData("users", "email", email)
+		e.Auth, err = e.App.FindAuthRecordByEmail("users", email)
 		if err != nil || !isAuthRefresh {
 			return e.Next()
 		}
@@ -84,19 +111,19 @@ func (h *Hub) registerApiRoutes(se *core.ServeEvent) error {
 	// send test notification
 	apiAuth.POST("/test-notification", h.SendTestNotification)
 	// heartbeat status and test
-	apiAuth.GET("/heartbeat-status", h.getHeartbeatStatus)
+	apiAuth.GET("/heartbeat-status", h.getHeartbeatStatus).BindFunc(requireAdminRole)
-	apiAuth.POST("/test-heartbeat", h.testHeartbeat)
+	apiAuth.POST("/test-heartbeat", h.testHeartbeat).BindFunc(requireAdminRole)
 	// get config.yml content
-	apiAuth.GET("/config-yaml", config.GetYamlConfig)
+	apiAuth.GET("/config-yaml", config.GetYamlConfig).BindFunc(requireAdminRole)
 	// handle agent websocket connection
 	apiNoAuth.GET("/agent-connect", h.handleAgentConnect)
 	// get or create universal tokens
-	apiAuth.GET("/universal-token", h.getUniversalToken)
+	apiAuth.GET("/universal-token", h.getUniversalToken).BindFunc(excludeReadOnlyRole)
 	// update / delete user alerts
 	apiAuth.POST("/user-alerts", alerts.UpsertUserAlerts)
 	apiAuth.DELETE("/user-alerts", alerts.DeleteUserAlerts)
 	// refresh SMART devices for a system
-	apiAuth.POST("/smart/refresh", h.refreshSmartData)
+	apiAuth.POST("/smart/refresh", h.refreshSmartData).BindFunc(excludeReadOnlyRole)
 	// get systemd service details
 	apiAuth.GET("/systemd/info", h.getSystemdInfo)
 	// /containers routes
@@ -153,6 +180,10 @@ func (info *UpdateInfo) getUpdate(e *core.RequestEvent) error {
 
 // GetUniversalToken handles the universal token API endpoint (create, read, delete)
 func (h *Hub) getUniversalToken(e *core.RequestEvent) error {
+	if e.Auth.IsSuperuser() {
+		return e.ForbiddenError("Superusers cannot use universal tokens", nil)
+	}
+
 	tokenMap := universalTokenMap.GetMap()
 	userID := e.Auth.Id
 	query := e.Request.URL.Query()
@@ -246,9 +277,6 @@ func (h *Hub) getUniversalToken(e *core.RequestEvent) error {
 
 // getHeartbeatStatus returns current heartbeat configuration and whether it's enabled
 func (h *Hub) getHeartbeatStatus(e *core.RequestEvent) error {
-	if e.Auth.GetString("role") != "admin" {
-		return e.ForbiddenError("Requires admin role", nil)
-	}
 	if h.hb == nil {
 		return e.JSON(http.StatusOK, map[string]any{
 			"enabled": false,
@@ -266,9 +294,6 @@ func (h *Hub) getHeartbeatStatus(e *core.RequestEvent) error {
 
 // testHeartbeat triggers a single heartbeat ping and returns the result
 func (h *Hub) testHeartbeat(e *core.RequestEvent) error {
-	if e.Auth.GetString("role") != "admin" {
-		return e.ForbiddenError("Requires admin role", nil)
-	}
 	if h.hb == nil {
 		return e.JSON(http.StatusOK, map[string]any{
 			"err": "Heartbeat not configured. Set HEARTBEAT_URL environment variable.",
@@ -285,21 +310,18 @@ func (h *Hub) containerRequestHandler(e *core.RequestEvent, fetchFunc func(*syst
 	systemID := e.Request.URL.Query().Get("system")
 	containerID := e.Request.URL.Query().Get("container")
 
-	if systemID == "" || containerID == "" {
+	if systemID == "" || containerID == "" || !containerIDPattern.MatchString(containerID) {
-		return e.JSON(http.StatusBadRequest, map[string]string{"error": "system and container parameters are required"})
+		return e.BadRequestError("Invalid system or container parameter", nil)
-	}
-	if !containerIDPattern.MatchString(containerID) {
-		return e.JSON(http.StatusBadRequest, map[string]string{"error": "invalid container parameter"})
 	}
 
 	system, err := h.sm.GetSystem(systemID)
-	if err != nil {
+	if err != nil || !system.HasUser(e.App, e.Auth.Id) {
-		return e.JSON(http.StatusNotFound, map[string]string{"error": "system not found"})
+		return e.NotFoundError("", nil)
 	}
 
 	data, err := fetchFunc(system, containerID)
 	if err != nil {
-		return e.JSON(http.StatusNotFound, map[string]string{"error": err.Error()})
+		return e.InternalServerError("", err)
 	}
 
 	return e.JSON(http.StatusOK, map[string]string{responseKey: data})
@@ -325,15 +347,23 @@ func (h *Hub) getSystemdInfo(e *core.RequestEvent) error {
 	serviceName := query.Get("service")
 
 	if systemID == "" || serviceName == "" {
-		return e.JSON(http.StatusBadRequest, map[string]string{"error": "system and service parameters are required"})
+		return e.BadRequestError("Invalid system or service parameter", nil)
 	}
 	system, err := h.sm.GetSystem(systemID)
+	if err != nil || !system.HasUser(e.App, e.Auth.Id) {
+		return e.NotFoundError("", nil)
+	}
+	// verify service exists before fetching details
+	_, err = e.App.FindFirstRecordByFilter("systemd_services", "system = {:system} && name = {:name}", dbx.Params{
+		"system": systemID,
+		"name":   serviceName,
+	})
 	if err != nil {
-		return e.JSON(http.StatusNotFound, map[string]string{"error": "system not found"})
+		return e.NotFoundError("", err)
 	}
 	details, err := system.FetchSystemdInfoFromAgent(serviceName)
 	if err != nil {
-		return e.JSON(http.StatusNotFound, map[string]string{"error": err.Error()})
+		return e.InternalServerError("", err)
 	}
 	e.Response.Header().Set("Cache-Control", "public, max-age=60")
 	return e.JSON(http.StatusOK, map[string]any{"details": details})
@@ -344,17 +374,16 @@ func (h *Hub) getSystemdInfo(e *core.RequestEvent) error {
 func (h *Hub) refreshSmartData(e *core.RequestEvent) error {
 	systemID := e.Request.URL.Query().Get("system")
 	if systemID == "" {
-		return e.JSON(http.StatusBadRequest, map[string]string{"error": "system parameter is required"})
+		return e.BadRequestError("Invalid system parameter", nil)
 	}
 
 	system, err := h.sm.GetSystem(systemID)
-	if err != nil {
+	if err != nil || !system.HasUser(e.App, e.Auth.Id) {
-		return e.JSON(http.StatusNotFound, map[string]string{"error": "system not found"})
+		return e.NotFoundError("", nil)
 	}
 
-	// Fetch and save SMART devices
 	if err := system.FetchAndSaveSmartDevices(); err != nil {
-		return e.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
+		return e.InternalServerError("", err)
 	}
 
 	return e.JSON(http.StatusOK, map[string]string{"status": "ok"})

internal/hub/api_test.go

@@ -3,6 +3,7 @@ package hub_test
 import (
 	"bytes"
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"testing"
@@ -25,33 +26,33 @@ func jsonReader(v any) io.Reader {
 }
 
 func TestApiRoutesAuthentication(t *testing.T) {
-	hub, _ := beszelTests.NewTestHub(t.TempDir())
+	hub, user := beszelTests.GetHubWithUser(t)
 	defer hub.Cleanup()
 
-	hub.StartHub()
-
-	// Create test user and get auth token
-	user, err := beszelTests.CreateUser(hub, "testuser@example.com", "password123")
-	require.NoError(t, err, "Failed to create test user")
-
-	adminUser, err := beszelTests.CreateRecord(hub, "users", map[string]any{
-		"email":    "admin@example.com",
-		"password": "password123",
-		"role":     "admin",
-	})
-	require.NoError(t, err, "Failed to create admin user")
-	adminUserToken, err := adminUser.NewAuthToken()
-
-	// superUser, err := beszelTests.CreateRecord(hub, core.CollectionNameSuperusers, map[string]any{
-	// 	"email":    "superuser@example.com",
-	// 	"password": "password123",
-	// })
-	// require.NoError(t, err, "Failed to create superuser")
-
 	userToken, err := user.NewAuthToken()
 	require.NoError(t, err, "Failed to create auth token")
 
-	// Create test system for user-alerts endpoints
+	// Create test user and get auth token
+	user2, err := beszelTests.CreateUser(hub, "testuser@example.com", "password123")
+	require.NoError(t, err, "Failed to create test user")
+	user2Token, err := user2.NewAuthToken()
+	require.NoError(t, err, "Failed to create user2 auth token")
+
+	adminUser, err := beszelTests.CreateUserWithRole(hub, "admin@example.com", "password123", "admin")
+	require.NoError(t, err, "Failed to create admin user")
+	adminUserToken, err := adminUser.NewAuthToken()
+
+	readOnlyUser, err := beszelTests.CreateUserWithRole(hub, "readonly@example.com", "password123", "readonly")
+	require.NoError(t, err, "Failed to create readonly user")
+	readOnlyUserToken, err := readOnlyUser.NewAuthToken()
+	require.NoError(t, err, "Failed to create readonly user auth token")
+
+	superuser, err := beszelTests.CreateSuperuser(hub, "superuser@example.com", "password123")
+	require.NoError(t, err, "Failed to create superuser")
+	superuserToken, err := superuser.NewAuthToken()
+	require.NoError(t, err, "Failed to create superuser auth token")
+
+	// Create test system
 	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
 		"name":  "test-system",
 		"users": []string{user.Id},
@@ -106,7 +107,7 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  403,
-			ExpectedContent: []string{"Requires admin"},
+			ExpectedContent: []string{"The authorized record is not allowed to perform this action."},
 			TestAppFactory:  testAppFactory,
 		},
 		{
@@ -136,7 +137,7 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  403,
-			ExpectedContent: []string{"Requires admin role"},
+			ExpectedContent: []string{"The authorized record is not allowed to perform this action."},
 			TestAppFactory:  testAppFactory,
 		},
 		{
@@ -158,7 +159,7 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  403,
-			ExpectedContent: []string{"Requires admin role"},
+			ExpectedContent: []string{"The authorized record is not allowed to perform this action."},
 			TestAppFactory:  testAppFactory,
 		},
 		{
@@ -202,6 +203,74 @@ func TestApiRoutesAuthentication(t *testing.T) {
 			ExpectedContent: []string{"\"permanent\":true", "permanent-token-123"},
 			TestAppFactory:  testAppFactory,
 		},
+		{
+			Name:   "GET /universal-token - superuser should fail",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/universal-token",
+			Headers: map[string]string{
+				"Authorization": superuserToken,
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{"Superusers cannot use universal tokens"},
+			TestAppFactory: func(t testing.TB) *pbTests.TestApp {
+				return hub.TestApp
+			},
+		},
+		{
+			Name:   "GET /universal-token - with readonly auth should fail",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/universal-token",
+			Headers: map[string]string{
+				"Authorization": readOnlyUserToken,
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{"The authorized record is not allowed to perform this action."},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "POST /smart/refresh - missing system should fail 400 with user auth",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/smart/refresh",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"Invalid", "system", "parameter"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "POST /smart/refresh - with readonly auth should fail",
+			Method: http.MethodPost,
+			URL:    fmt.Sprintf("/api/beszel/smart/refresh?system=%s", system.Id),
+			Headers: map[string]string{
+				"Authorization": readOnlyUserToken,
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{"The authorized record is not allowed to perform this action."},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "POST /smart/refresh - non-user system should fail",
+			Method: http.MethodPost,
+			URL:    fmt.Sprintf("/api/beszel/smart/refresh?system=%s", system.Id),
+			Headers: map[string]string{
+				"Authorization": user2Token,
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{"The requested resource wasn't found."},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "POST /smart/refresh - good user should pass validation",
+			Method: http.MethodPost,
+			URL:    fmt.Sprintf("/api/beszel/smart/refresh?system=%s", system.Id),
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  500,
+			ExpectedContent: []string{"Something went wrong while processing your request."},
+			TestAppFactory:  testAppFactory,
+		},
 		{
 			Name:            "POST /user-alerts - no auth should fail",
 			Method:          http.MethodPost,
@@ -273,20 +342,42 @@ func TestApiRoutesAuthentication(t *testing.T) {
 		{
 			Name:            "GET /containers/logs - no auth should fail",
 			Method:          http.MethodGet,
-			URL:             "/api/beszel/containers/logs?system=test-system&container=test-container",
+			URL:             "/api/beszel/containers/logs?system=test-system&container=abababababab",
 			ExpectedStatus:  401,
 			ExpectedContent: []string{"requires valid"},
 			TestAppFactory:  testAppFactory,
 		},
+		{
+			Name:            "GET /containers/logs - request for valid non-user system should fail",
+			Method:          http.MethodGet,
+			URL:             fmt.Sprintf("/api/beszel/containers/logs?system=%s&container=abababababab", system.Id),
+			ExpectedStatus:  404,
+			ExpectedContent: []string{"The requested resource wasn't found."},
+			TestAppFactory:  testAppFactory,
+			Headers: map[string]string{
+				"Authorization": user2Token,
+			},
+		},
+		{
+			Name:            "GET /containers/info - request for valid non-user system should fail",
+			Method:          http.MethodGet,
+			URL:             fmt.Sprintf("/api/beszel/containers/info?system=%s&container=abababababab", system.Id),
+			ExpectedStatus:  404,
+			ExpectedContent: []string{"The requested resource wasn't found."},
+			TestAppFactory:  testAppFactory,
+			Headers: map[string]string{
+				"Authorization": user2Token,
+			},
+		},
 		{
 			Name:   "GET /containers/logs - with auth but missing system param should fail",
 			Method: http.MethodGet,
-			URL:    "/api/beszel/containers/logs?container=test-container",
+			URL:    "/api/beszel/containers/logs?container=abababababab",
 			Headers: map[string]string{
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  400,
-			ExpectedContent: []string{"system and container parameters are required"},
+			ExpectedContent: []string{"Invalid", "parameter"},
 			TestAppFactory:  testAppFactory,
 		},
 		{
@@ -297,7 +388,7 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  400,
-			ExpectedContent: []string{"system and container parameters are required"},
+			ExpectedContent: []string{"Invalid", "parameter"},
 			TestAppFactory:  testAppFactory,
 		},
 		{
@@ -308,7 +399,7 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  404,
-			ExpectedContent: []string{"system not found"},
+			ExpectedContent: []string{"The requested resource wasn't found."},
 			TestAppFactory:  testAppFactory,
 		},
 		{
@@ -319,7 +410,7 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  400,
-			ExpectedContent: []string{"invalid container parameter"},
+			ExpectedContent: []string{"Invalid", "parameter"},
 			TestAppFactory:  testAppFactory,
 		},
 		{
@@ -330,7 +421,7 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  400,
-			ExpectedContent: []string{"invalid container parameter"},
+			ExpectedContent: []string{"Invalid", "parameter"},
 			TestAppFactory:  testAppFactory,
 		},
 		{
@@ -341,9 +432,114 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"Authorization": userToken,
 			},
 			ExpectedStatus:  400,
-			ExpectedContent: []string{"invalid container parameter"},
+			ExpectedContent: []string{"Invalid", "parameter"},
 			TestAppFactory:  testAppFactory,
 		},
+		{
+			Name:   "GET /containers/logs - good user should pass validation",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/containers/logs?system=" + system.Id + "&container=0123456789ab",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  500,
+			ExpectedContent: []string{"Something went wrong while processing your request."},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /containers/info - good user should pass validation",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/containers/info?system=" + system.Id + "&container=0123456789ab",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  500,
+			ExpectedContent: []string{"Something went wrong while processing your request."},
+			TestAppFactory:  testAppFactory,
+		},
+		// /systemd routes
+		{
+			Name:            "GET /systemd/info - no auth should fail",
+			Method:          http.MethodGet,
+			URL:             fmt.Sprintf("/api/beszel/systemd/info?system=%s&service=nginx.service", system.Id),
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:            "GET /systemd/info - request for valid non-user system should fail",
+			Method:          http.MethodGet,
+			URL:             fmt.Sprintf("/api/beszel/systemd/info?system=%s&service=nginx.service", system.Id),
+			ExpectedStatus:  404,
+			ExpectedContent: []string{"The requested resource wasn't found."},
+			TestAppFactory:  testAppFactory,
+			Headers: map[string]string{
+				"Authorization": user2Token,
+			},
+		},
+		{
+			Name:   "GET /systemd/info - with auth but missing system param should fail",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/systemd/info?service=nginx.service",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"Invalid", "parameter"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /systemd/info - with auth but missing service param should fail",
+			Method: http.MethodGet,
+			URL:    fmt.Sprintf("/api/beszel/systemd/info?system=%s", system.Id),
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"Invalid", "parameter"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /systemd/info - with auth but invalid system should fail",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/systemd/info?system=invalid-system&service=nginx.service",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{"The requested resource wasn't found."},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /systemd/info - service not in systemd_services collection should fail",
+			Method: http.MethodGet,
+			URL:    fmt.Sprintf("/api/beszel/systemd/info?system=%s&service=notregistered.service", system.Id),
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{"The requested resource wasn't found."},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /systemd/info - with auth and existing service record should pass validation",
+			Method: http.MethodGet,
+			URL:    fmt.Sprintf("/api/beszel/systemd/info?system=%s&service=nginx.service", system.Id),
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  500,
+			ExpectedContent: []string{"Something went wrong while processing your request."},
+			TestAppFactory:  testAppFactory,
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.CreateRecord(app, "systemd_services", map[string]any{
+					"system": system.Id,
+					"name":   "nginx.service",
+					"state":  0,
+					"sub":    1,
+				})
+			},
+		},
 
 		// Auth Optional Routes - Should work without authentication
 		{

internal/hub/config/config.go

@@ -279,9 +279,6 @@ func createFingerprintRecord(app core.App, systemID, token string) error {
 
 // Returns the current config.yml file as a JSON object
 func GetYamlConfig(e *core.RequestEvent) error {
-	if e.Auth.GetString("role") != "admin" {
-		return e.ForbiddenError("Requires admin role", nil)
-	}
 	configContent, err := generateYAML(e.App)
 	if err != nil {
 		return err

internal/hub/hub.go

@@ -9,7 +9,6 @@ import (
 	"net/url"
 	"os"
 	"path"
-	"regexp"
 	"strings"
 
 	"github.com/henrygd/beszel/internal/alerts"
@@ -38,8 +37,6 @@ type Hub struct {
 	appURL string
 }
 
-var containerIDPattern = regexp.MustCompile(`^[a-fA-F0-9]{12,64}$`)
-
 // NewHub creates a new Hub instance with default configuration
 func NewHub(app core.App) *Hub {
 	hub := &Hub{App: app}

internal/hub/server_development.go

@@ -5,7 +5,6 @@ package hub
 import (
 	"fmt"
 	"io"
-	"log/slog"
 	"net/http"
 	"net/http/httputil"
 	"net/url"
@@ -62,7 +61,6 @@ func (rm *responseModifier) modifyHTML(html string) string {
 
 // startServer sets up the development server for Beszel
 func (h *Hub) startServer(se *core.ServeEvent) error {
-	slog.Info("starting server", "appURL", h.appURL)
 	proxy := httputil.NewSingleHostReverseProxy(&url.URL{
 		Scheme: "http",
 		Host:   "localhost:5173",

internal/hub/systems/system.go

@@ -8,6 +8,7 @@ import (
 	"hash/fnv"
 	"math/rand"
 	"net"
+	"slices"
 	"strings"
 	"sync/atomic"
 	"time"
@@ -184,7 +185,7 @@ func (sys *System) handlePaused() {
 
 // createRecords updates the system record and adds system_stats and container_stats records
 func (sys *System) createRecords(data *system.CombinedData) (*core.Record, error) {
-	systemRecord, err := sys.getRecord()
+	systemRecord, err := sys.getRecord(sys.manager.hub)
 	if err != nil {
 		return nil, err
 	}
@@ -343,8 +344,8 @@ func createContainerRecords(app core.App, data []*container.Stats, systemId stri
 
 // getRecord retrieves the system record from the database.
 // If the record is not found, it removes the system from the manager.
-func (sys *System) getRecord() (*core.Record, error) {
+func (sys *System) getRecord(app core.App) (*core.Record, error) {
-	record, err := sys.manager.hub.FindRecordById("systems", sys.Id)
+	record, err := app.FindRecordById("systems", sys.Id)
 	if err != nil || record == nil {
 		_ = sys.manager.RemoveSystem(sys.Id)
 		return nil, err
@@ -352,6 +353,16 @@ func (sys *System) getRecord() (*core.Record, error) {
 	return record, nil
 }
 
+// HasUser checks if the given user ID is in the system's users list.
+func (sys *System) HasUser(app core.App, userID string) bool {
+	record, err := sys.getRecord(app)
+	if err != nil {
+		return false
+	}
+	users := record.GetStringSlice("users")
+	return slices.Contains(users, userID)
+}
+
 // setDown marks a system as down in the database.
 // It takes the original error that caused the system to go down and returns any error
 // encountered during the process of updating the system status.
@@ -359,7 +370,7 @@ func (sys *System) setDown(originalError error) error {
 	if sys.Status == down || sys.Status == paused {
 		return nil
 	}
-	record, err := sys.getRecord()
+	record, err := sys.getRecord(sys.manager.hub)
 	if err != nil {
 		return err
 	}

internal/hub/systems/system_manager.go

@@ -54,6 +54,7 @@ type hubLike interface {
 	GetSSHKey(dataDir string) (ssh.Signer, error)
 	HandleSystemAlerts(systemRecord *core.Record, data *system.CombinedData) error
 	HandleStatusAlerts(status string, systemRecord *core.Record) error
+	CancelPendingStatusAlerts(systemID string)
 }
 
 // NewSystemManager creates a new SystemManager instance with the provided hub.
@@ -189,6 +190,7 @@ func (sm *SystemManager) onRecordAfterUpdateSuccess(e *core.RecordEvent) error {
 			system.closeSSHConnection()
 		}
 		_ = deactivateAlerts(e.App, e.Record.Id)
+		sm.hub.CancelPendingStatusAlerts(e.Record.Id)
 		return e.Next()
 	case pending:
 		// Resume monitoring, preferring existing WebSocket connection

internal/records/records.go

@@ -230,6 +230,9 @@ func (rm *RecordManager) AverageSystemStats(db dbx.Builder, records RecordIds) *
 		sum.Bandwidth[1] += stats.Bandwidth[1]
 		sum.DiskIO[0] += stats.DiskIO[0]
 		sum.DiskIO[1] += stats.DiskIO[1]
+		for i := range stats.DiskIoStats {
+			sum.DiskIoStats[i] += stats.DiskIoStats[i]
+		}
 		batterySum += int(stats.Battery[0])
 		sum.Battery[1] = stats.Battery[1]
 
@@ -254,6 +257,9 @@ func (rm *RecordManager) AverageSystemStats(db dbx.Builder, records RecordIds) *
 		sum.MaxBandwidth[1] = max(sum.MaxBandwidth[1], stats.MaxBandwidth[1], stats.Bandwidth[1])
 		sum.MaxDiskIO[0] = max(sum.MaxDiskIO[0], stats.MaxDiskIO[0], stats.DiskIO[0])
 		sum.MaxDiskIO[1] = max(sum.MaxDiskIO[1], stats.MaxDiskIO[1], stats.DiskIO[1])
+		for i := range stats.DiskIoStats {
+			sum.MaxDiskIoStats[i] = max(sum.MaxDiskIoStats[i], stats.MaxDiskIoStats[i], stats.DiskIoStats[i])
+		}
 
 		// Accumulate network interfaces
 		if sum.NetworkInterfaces == nil {
@@ -299,6 +305,10 @@ func (rm *RecordManager) AverageSystemStats(db dbx.Builder, records RecordIds) *
 				fs.DiskWriteBytes += value.DiskWriteBytes
 				fs.MaxDiskReadBytes = max(fs.MaxDiskReadBytes, value.MaxDiskReadBytes, value.DiskReadBytes)
 				fs.MaxDiskWriteBytes = max(fs.MaxDiskWriteBytes, value.MaxDiskWriteBytes, value.DiskWriteBytes)
+				for i := range value.DiskIoStats {
+					fs.DiskIoStats[i] += value.DiskIoStats[i]
+					fs.MaxDiskIoStats[i] = max(fs.MaxDiskIoStats[i], value.MaxDiskIoStats[i], value.DiskIoStats[i])
+				}
 			}
 		}
 
@@ -350,6 +360,9 @@ func (rm *RecordManager) AverageSystemStats(db dbx.Builder, records RecordIds) *
 		sum.DiskWritePs = twoDecimals(sum.DiskWritePs / count)
 		sum.DiskIO[0] = sum.DiskIO[0] / uint64(count)
 		sum.DiskIO[1] = sum.DiskIO[1] / uint64(count)
+		for i := range sum.DiskIoStats {
+			sum.DiskIoStats[i] = twoDecimals(sum.DiskIoStats[i] / count)
+		}
 		sum.NetworkSent = twoDecimals(sum.NetworkSent / count)
 		sum.NetworkRecv = twoDecimals(sum.NetworkRecv / count)
 		sum.LoadAvg[0] = twoDecimals(sum.LoadAvg[0] / count)
@@ -388,6 +401,9 @@ func (rm *RecordManager) AverageSystemStats(db dbx.Builder, records RecordIds) *
 				fs.DiskReadPs = twoDecimals(fs.DiskReadPs / count)
 				fs.DiskReadBytes = fs.DiskReadBytes / uint64(count)
 				fs.DiskWriteBytes = fs.DiskWriteBytes / uint64(count)
+				for i := range fs.DiskIoStats {
+					fs.DiskIoStats[i] = twoDecimals(fs.DiskIoStats[i] / count)
+				}
 			}
 		}
 

internal/site/bun.lock

@@ -41,7 +41,7 @@
         "recharts": "^2.15.4",
         "shiki": "^3.13.0",
         "tailwind-merge": "^3.3.1",
-        "valibot": "^0.42.1",
+        "valibot": "^1.3.1",
       },
       "devDependencies": {
         "@biomejs/biome": "2.2.4",
@@ -927,7 +927,7 @@
 
     "util-deprecate": ["util-deprecate@1.0.2", "", {}, "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw=="],
 
-    "valibot": ["valibot@0.42.1", "", { "peerDependencies": { "typescript": ">=5" } }, "sha512-3keXV29Ar5b//Hqi4MbSdV7lfVp6zuYLZuA9V1PvQUsXqogr+u5lvLPLk3A4f74VUXDnf/JfWMN6sB+koJ/FFw=="],
+    "valibot": ["valibot@1.3.1", "", { "peerDependencies": { "typescript": ">=5" }, "optionalPeers": ["typescript"] }, "sha512-sfdRir/QFM0JaF22hqTroPc5xy4DimuGQVKFrzF1YfGwaS1nJot3Y8VqMdLO2Lg27fMzat2yD3pY5PbAYO39Gg=="],
 
     "vfile": ["vfile@6.0.3", "", { "dependencies": { "@types/unist": "^3.0.0", "vfile-message": "^4.0.0" } }, "sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q=="],
 

internal/site/package-lock.json

@@ -1,12 +1,12 @@
 {
 	"name": "beszel",
-	"version": "0.18.3",
+	"version": "0.18.6",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "beszel",
-			"version": "0.18.3",
+			"version": "0.18.6",
 			"dependencies": {
 				"@henrygd/queue": "^1.0.7",
 				"@henrygd/semaphore": "^0.0.2",
@@ -44,7 +44,7 @@
 				"recharts": "^2.15.4",
 				"shiki": "^3.13.0",
 				"tailwind-merge": "^3.3.1",
-				"valibot": "^0.42.1"
+				"valibot": "^1.3.1"
 			},
 			"devDependencies": {
 				"@biomejs/biome": "2.2.4",
@@ -986,29 +986,6 @@
 			"integrity": "sha512-N3W7MKwTRmAxOjeG0NAT18oe2Xn3KdjkpMR6crbkF1UDamMGPjyigqEsefiv+qTaxibtc1a+zXCVzb9YXANVqw==",
 			"license": "MIT"
 		},
-		"node_modules/@isaacs/balanced-match": {
-			"version": "4.0.1",
-			"resolved": "https://registry.npmjs.org/@isaacs/balanced-match/-/balanced-match-4.0.1.tgz",
-			"integrity": "sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ==",
-			"dev": true,
-			"license": "MIT",
-			"engines": {
-				"node": "20 || >=22"
-			}
-		},
-		"node_modules/@isaacs/brace-expansion": {
-			"version": "5.0.0",
-			"resolved": "https://registry.npmjs.org/@isaacs/brace-expansion/-/brace-expansion-5.0.0.tgz",
-			"integrity": "sha512-ZT55BDLV0yv0RBm2czMiZ+SqCGO7AvmOM3G/w2xhVPH+te0aKgFjmBvGlL1dH+ql2tgGO3MVrbb3jCKyvpgnxA==",
-			"dev": true,
-			"license": "MIT",
-			"dependencies": {
-				"@isaacs/balanced-match": "^4.0.1"
-			},
-			"engines": {
-				"node": "20 || >=22"
-			}
-		},
 		"node_modules/@isaacs/cliui": {
 			"version": "8.0.2",
 			"resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
@@ -1243,9 +1220,9 @@
 			}
 		},
 		"node_modules/@lingui/cli/node_modules/picomatch": {
-			"version": "2.3.1",
+			"version": "2.3.2",
-			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-			"integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+			"integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {
@@ -2408,9 +2385,9 @@
 			"license": "MIT"
 		},
 		"node_modules/@rollup/rollup-android-arm-eabi": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.60.1.tgz",
-			"integrity": "sha512-rGmb8qoG/zdmKoYELCBwu7vt+9HxZ7Koos3pD0+sH5fR3u3Wb/jGcpnqxcnWsPEKDUyzeLSqksN8LJtgXjqBYw==",
+			"integrity": "sha512-d6FinEBLdIiK+1uACUttJKfgZREXrF0Qc2SmLII7W2AD8FfiZ9Wjd+rD/iRuf5s5dWrr1GgwXCvPqOuDquOowA==",
 			"cpu": [
 				"arm"
 			],
@@ -2422,9 +2399,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-android-arm64": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.60.1.tgz",
-			"integrity": "sha512-4e9WtTxrk3gu1DFE+imNJr4WsL13nWbD/Y6wQcyku5qadlKHY3OQ3LJ/INrrjngv2BJIHnIzbqMk1GTAC2P8yQ==",
+			"integrity": "sha512-YjG/EwIDvvYI1YvYbHvDz/BYHtkY4ygUIXHnTdLhG+hKIQFBiosfWiACWortsKPKU/+dUwQQCKQM3qrDe8c9BA==",
 			"cpu": [
 				"arm64"
 			],
@@ -2436,9 +2413,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-darwin-arm64": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.60.1.tgz",
-			"integrity": "sha512-+XjmyChHfc4TSs6WUQGmVf7Hkg8ferMAE2aNYYWjiLzAS/T62uOsdfnqv+GHRjq7rKRnYh4mwWb4Hz7h/alp8A==",
+			"integrity": "sha512-mjCpF7GmkRtSJwon+Rq1N8+pI+8l7w5g9Z3vWj4T7abguC4Czwi3Yu/pFaLvA3TTeMVjnu3ctigusqWUfjZzvw==",
 			"cpu": [
 				"arm64"
 			],
@@ -2450,9 +2427,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-darwin-x64": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.60.1.tgz",
-			"integrity": "sha512-upGEY7Ftw8M6BAJyGwnwMw91rSqXTcOKZnnveKrVWsMTF8/k5mleKSuh7D4v4IV1pLxKAk3Tbs0Lo9qYmii5mQ==",
+			"integrity": "sha512-haZ7hJ1JT4e9hqkoT9R/19XW2QKqjfJVv+i5AGg57S+nLk9lQnJ1F/eZloRO3o9Scy9CM3wQ9l+dkXtcBgN5Ew==",
 			"cpu": [
 				"x64"
 			],
@@ -2464,9 +2441,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-freebsd-arm64": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.60.1.tgz",
-			"integrity": "sha512-P9ViWakdoynYFUOZhqq97vBrhuvRLAbN/p2tAVJvhLb8SvN7rbBnJQcBu8e/rQts42pXGLVhfsAP0k9KXWa3nQ==",
+			"integrity": "sha512-czw90wpQq3ZsAVBlinZjAYTKduOjTywlG7fEeWKUA7oCmpA8xdTkxZZlwNJKWqILlq0wehoZcJYfBvOyhPTQ6w==",
 			"cpu": [
 				"arm64"
 			],
@@ -2478,9 +2455,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-freebsd-x64": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.60.1.tgz",
-			"integrity": "sha512-VLKIwIpnBya5/saccM8JshpbxfyJt0Dsli0PjXozHwbSVaHTvWXJH1bbCwPXxnMzU4zVEfgD1HpW3VQHomi2AQ==",
+			"integrity": "sha512-KVB2rqsxTHuBtfOeySEyzEOB7ltlB/ux38iu2rBQzkjbwRVlkhAGIEDiiYnO2kFOkJp+Z7pUXKyrRRFuFUKt+g==",
 			"cpu": [
 				"x64"
 			],
@@ -2492,9 +2469,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.60.1.tgz",
-			"integrity": "sha512-3zEuZsXfKaw8n/yF7t8N6NNdhyFw3s8xJTqjbTDXlipwrEHo4GtIKcMJr5Ed29leLpB9AugtAQpAHW0jvtKKaQ==",
+			"integrity": "sha512-L+34Qqil+v5uC0zEubW7uByo78WOCIrBvci69E7sFASRl0X7b/MB6Cqd1lky/CtcSVTydWa2WZwFuWexjS5o6g==",
 			"cpu": [
 				"arm"
 			],
@@ -2506,9 +2483,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-arm-musleabihf": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.60.1.tgz",
-			"integrity": "sha512-leo9tOIlKrcBmmEypzunV/2w946JeLbTdDlwEZ7OnnsUyelZ72NMnT4B2vsikSgwQifjnJUbdXzuW4ToN1wV+Q==",
+			"integrity": "sha512-n83O8rt4v34hgFzlkb1ycniJh7IR5RCIqt6mz1VRJD6pmhRi0CXdmfnLu9dIUS6buzh60IvACM842Ffb3xd6Gg==",
 			"cpu": [
 				"arm"
 			],
@@ -2520,9 +2497,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-arm64-gnu": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.60.1.tgz",
-			"integrity": "sha512-Vy/WS4z4jEyvnJm+CnPfExIv5sSKqZrUr98h03hpAMbE2aI0aD2wvK6GiSe8Gx2wGp3eD81cYDpLLBqNb2ydwQ==",
+			"integrity": "sha512-Nql7sTeAzhTAja3QXeAI48+/+GjBJ+QmAH13snn0AJSNL50JsDqotyudHyMbO2RbJkskbMbFJfIJKWA6R1LCJQ==",
 			"cpu": [
 				"arm64"
 			],
@@ -2534,9 +2511,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-arm64-musl": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.60.1.tgz",
-			"integrity": "sha512-x5Kzn7XTwIssU9UYqWDB9VpLpfHYuXw5c6bJr4Mzv9kIv242vmJHbI5PJJEnmBYitUIfoMCODDhR7KoZLot2VQ==",
+			"integrity": "sha512-+pUymDhd0ys9GcKZPPWlFiZ67sTWV5UU6zOJat02M1+PiuSGDziyRuI/pPue3hoUwm2uGfxdL+trT6Z9rxnlMA==",
 			"cpu": [
 				"arm64"
 			],
@@ -2547,10 +2524,24 @@
 				"linux"
 			]
 		},
-		"node_modules/@rollup/rollup-linux-loongarch64-gnu": {
+		"node_modules/@rollup/rollup-linux-loong64-gnu": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loongarch64-gnu/-/rollup-linux-loongarch64-gnu-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.60.1.tgz",
-			"integrity": "sha512-yzCaBbwkkWt/EcgJOKDUdUpMHjhiZT/eDktOPWvSRpqrVE04p0Nd6EGV4/g7MARXXeOqstflqsKuXVM3H9wOIQ==",
+			"integrity": "sha512-VSvgvQeIcsEvY4bKDHEDWcpW4Yw7BtlKG1GUT4FzBUlEKQK0rWHYBqQt6Fm2taXS+1bXvJT6kICu5ZwqKCnvlQ==",
+			"cpu": [
+				"loong64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"linux"
+			]
+		},
+		"node_modules/@rollup/rollup-linux-loong64-musl": {
+			"version": "4.60.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.60.1.tgz",
+			"integrity": "sha512-4LqhUomJqwe641gsPp6xLfhqWMbQV04KtPp7/dIp0nzPxAkNY1AbwL5W0MQpcalLYk07vaW9Kp1PBhdpZYYcEw==",
 			"cpu": [
 				"loong64"
 			],
@@ -2562,9 +2553,23 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-ppc64-gnu": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.60.1.tgz",
-			"integrity": "sha512-UK0WzWUjMAJccHIeOpPhPcKBqax7QFg47hwZTp6kiMhQHeOYJeaMwzeRZe1q5IiTKsaLnHu9s6toSYVUlZ2QtQ==",
+			"integrity": "sha512-tLQQ9aPvkBxOc/EUT6j3pyeMD6Hb8QF2BTBnCQWP/uu1lhc9AIrIjKnLYMEroIz/JvtGYgI9dF3AxHZNaEH0rw==",
+			"cpu": [
+				"ppc64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"linux"
+			]
+		},
+		"node_modules/@rollup/rollup-linux-ppc64-musl": {
+			"version": "4.60.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.60.1.tgz",
+			"integrity": "sha512-RMxFhJwc9fSXP6PqmAz4cbv3kAyvD1etJFjTx4ONqFP9DkTkXsAMU4v3Vyc5BgzC+anz7nS/9tp4obsKfqkDHg==",
 			"cpu": [
 				"ppc64"
 			],
@@ -2576,9 +2581,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-riscv64-gnu": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.60.1.tgz",
-			"integrity": "sha512-3NADEIlt+aCdCbWVZ7D3tBjBX1lHpXxcvrLt/kdXTiBrOds8APTdtk2yRL2GgmnSVeX4YS1JIf0imFujg78vpw==",
+			"integrity": "sha512-QKgFl+Yc1eEk6MmOBfRHYF6lTxiiiV3/z/BRrbSiW2I7AFTXoBFvdMEyglohPj//2mZS4hDOqeB0H1ACh3sBbg==",
 			"cpu": [
 				"riscv64"
 			],
@@ -2590,9 +2595,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-riscv64-musl": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.60.1.tgz",
-			"integrity": "sha512-euuwm/QTXAMOcyiFCcrx0/S2jGvFlKJ2Iro8rsmYL53dlblp3LkUQVFzEidHhvIPPvcIsxDhl2wkBE+I6YVGzA==",
+			"integrity": "sha512-RAjXjP/8c6ZtzatZcA1RaQr6O1TRhzC+adn8YZDnChliZHviqIjmvFwHcxi4JKPSDAt6Uhf/7vqcBzQJy0PDJg==",
 			"cpu": [
 				"riscv64"
 			],
@@ -2604,9 +2609,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-s390x-gnu": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.60.1.tgz",
-			"integrity": "sha512-w8mULUjmPdWLJgmTYJx/W6Qhln1a+yqvgwmGXcQl2vFBkWsKGUBRbtLRuKJUln8Uaimf07zgJNxOhHOvjSQmBQ==",
+			"integrity": "sha512-wcuocpaOlaL1COBYiA89O6yfjlp3RwKDeTIA0hM7OpmhR1Bjo9j31G1uQVpDlTvwxGn2nQs65fBFL5UFd76FcQ==",
 			"cpu": [
 				"s390x"
 			],
@@ -2618,9 +2623,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-x64-gnu": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.60.1.tgz",
-			"integrity": "sha512-90taWXCWxTbClWuMZD0DKYohY1EovA+W5iytpE89oUPmT5O1HFdf8cuuVIylE6vCbrGdIGv85lVRzTcpTRZ+kA==",
+			"integrity": "sha512-77PpsFQUCOiZR9+LQEFg9GClyfkNXj1MP6wRnzYs0EeWbPcHs02AXu4xuUbM1zhwn3wqaizle3AEYg5aeoohhg==",
 			"cpu": [
 				"x64"
 			],
@@ -2632,9 +2637,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-linux-x64-musl": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.60.1.tgz",
-			"integrity": "sha512-2Gu29SkFh1FfTRuN1GR1afMuND2GKzlORQUP3mNMJbqdndOg7gNsa81JnORctazHRokiDzQ5+MLE5XYmZW5VWg==",
+			"integrity": "sha512-5cIATbk5vynAjqqmyBjlciMJl1+R/CwX9oLk/EyiFXDWd95KpHdrOJT//rnUl4cUcskrd0jCCw3wpZnhIHdD9w==",
 			"cpu": [
 				"x64"
 			],
@@ -2645,10 +2650,38 @@
 				"linux"
 			]
 		},
+		"node_modules/@rollup/rollup-openbsd-x64": {
+			"version": "4.60.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.60.1.tgz",
+			"integrity": "sha512-cl0w09WsCi17mcmWqqglez9Gk8isgeWvoUZ3WiJFYSR3zjBQc2J5/ihSjpl+VLjPqjQ/1hJRcqBfLjssREQILw==",
+			"cpu": [
+				"x64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"openbsd"
+			]
+		},
+		"node_modules/@rollup/rollup-openharmony-arm64": {
+			"version": "4.60.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.60.1.tgz",
+			"integrity": "sha512-4Cv23ZrONRbNtbZa37mLSueXUCtN7MXccChtKpUnQNgF010rjrjfHx3QxkS2PI7LqGT5xXyYs1a7LbzAwT0iCA==",
+			"cpu": [
+				"arm64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"openharmony"
+			]
+		},
 		"node_modules/@rollup/rollup-win32-arm64-msvc": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.60.1.tgz",
-			"integrity": "sha512-6kQFR1WuAO50bxkIlAVeIYsz3RUx+xymwhTo9j94dJ+kmHe9ly7muH23sdfWduD0BA8pD9/yhonUvAjxGh34jQ==",
+			"integrity": "sha512-i1okWYkA4FJICtr7KpYzFpRTHgy5jdDbZiWfvny21iIKky5YExiDXP+zbXzm3dUcFpkEeYNHgQ5fuG236JPq0g==",
 			"cpu": [
 				"arm64"
 			],
@@ -2660,9 +2693,9 @@
 			]
 		},
 		"node_modules/@rollup/rollup-win32-ia32-msvc": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.60.1.tgz",
-			"integrity": "sha512-RUyZZ/mga88lMI3RlXFs4WQ7n3VyU07sPXmMG7/C1NOi8qisUg57Y7LRarqoGoAiopmGmChUhSwfpvQ3H5iGSQ==",
+			"integrity": "sha512-u09m3CuwLzShA0EYKMNiFgcjjzwqtUMLmuCJLeZWjjOYA3IT2Di09KaxGBTP9xVztWyIWjVdsB2E9goMjZvTQg==",
 			"cpu": [
 				"ia32"
 			],
@@ -2673,10 +2706,24 @@
 				"win32"
 			]
 		},
+		"node_modules/@rollup/rollup-win32-x64-gnu": {
+			"version": "4.60.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.60.1.tgz",
+			"integrity": "sha512-k+600V9Zl1CM7eZxJgMyTUzmrmhB/0XZnF4pRypKAlAgxmedUA+1v9R+XOFv56W4SlHEzfeMtzujLJD22Uz5zg==",
+			"cpu": [
+				"x64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"win32"
+			]
+		},
 		"node_modules/@rollup/rollup-win32-x64-msvc": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.60.1.tgz",
-			"integrity": "sha512-8a/caCUN4vkTChxkaIJcMtwIVcBhi4X2PQRoT+yCK3qRYaZ7cURrmJFL5Ux9H9RaMIXj9RuihckdmkBX3zZsgg==",
+			"integrity": "sha512-lWMnixq/QzxyhTV6NjQJ4SFo1J6PvOX8vUx5Wb4bBPsEb+8xZ89Bz6kOXpfXj9ak9AHTQVQzlgzBEc1SyM27xQ==",
 			"cpu": [
 				"x64"
 			],
@@ -3235,6 +3282,66 @@
 				"node": ">=14.0.0"
 			}
 		},
+		"node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
+			"version": "1.4.5",
+			"dev": true,
+			"inBundle": true,
+			"license": "MIT",
+			"optional": true,
+			"dependencies": {
+				"@emnapi/wasi-threads": "1.0.4",
+				"tslib": "^2.4.0"
+			}
+		},
+		"node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
+			"version": "1.4.5",
+			"dev": true,
+			"inBundle": true,
+			"license": "MIT",
+			"optional": true,
+			"dependencies": {
+				"tslib": "^2.4.0"
+			}
+		},
+		"node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
+			"version": "1.0.4",
+			"dev": true,
+			"inBundle": true,
+			"license": "MIT",
+			"optional": true,
+			"dependencies": {
+				"tslib": "^2.4.0"
+			}
+		},
+		"node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+			"version": "0.2.12",
+			"dev": true,
+			"inBundle": true,
+			"license": "MIT",
+			"optional": true,
+			"dependencies": {
+				"@emnapi/core": "^1.4.3",
+				"@emnapi/runtime": "^1.4.3",
+				"@tybys/wasm-util": "^0.10.0"
+			}
+		},
+		"node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
+			"version": "0.10.0",
+			"dev": true,
+			"inBundle": true,
+			"license": "MIT",
+			"optional": true,
+			"dependencies": {
+				"tslib": "^2.4.0"
+			}
+		},
+		"node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
+			"version": "2.8.0",
+			"dev": true,
+			"inBundle": true,
+			"license": "0BSD",
+			"optional": true
+		},
 		"node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
 			"version": "4.1.12",
 			"resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.1.12.tgz",
@@ -3589,9 +3696,9 @@
 			}
 		},
 		"node_modules/anymatch/node_modules/picomatch": {
-			"version": "2.3.1",
+			"version": "2.3.2",
-			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-			"integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+			"integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {
@@ -3620,6 +3727,16 @@
 				"node": ">=10"
 			}
 		},
+		"node_modules/balanced-match": {
+			"version": "4.0.4",
+			"resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+			"integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+			"dev": true,
+			"license": "MIT",
+			"engines": {
+				"node": "18 || 20 || >=22"
+			}
+		},
 		"node_modules/base64-js": {
 			"version": "1.5.1",
 			"resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
@@ -3666,6 +3783,19 @@
 				"readable-stream": "^3.4.0"
 			}
 		},
+		"node_modules/brace-expansion": {
+			"version": "5.0.5",
+			"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
+			"integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"balanced-match": "^4.0.2"
+			},
+			"engines": {
+				"node": "18 || 20 || >=22"
+			}
+		},
 		"node_modules/braces": {
 			"version": "3.0.3",
 			"resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
@@ -5072,9 +5202,9 @@
 			"license": "MIT"
 		},
 		"node_modules/lodash": {
-			"version": "4.17.23",
+			"version": "4.18.1",
-			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
+			"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
-			"integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
+			"integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
 			"license": "MIT"
 		},
 		"node_modules/lodash.sortby": {
@@ -5267,9 +5397,9 @@
 			}
 		},
 		"node_modules/micromatch/node_modules/picomatch": {
-			"version": "2.3.1",
+			"version": "2.3.2",
-			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-			"integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+			"integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {
@@ -5290,16 +5420,16 @@
 			}
 		},
 		"node_modules/minimatch": {
-			"version": "10.1.1",
+			"version": "10.2.5",
-			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.1.1.tgz",
+			"resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
-			"integrity": "sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ==",
+			"integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
 			"dev": true,
 			"license": "BlueOak-1.0.0",
 			"dependencies": {
-				"@isaacs/brace-expansion": "^5.0.0"
+				"brace-expansion": "^5.0.5"
 			},
 			"engines": {
-				"node": "20 || >=22"
+				"node": "18 || 20 || >=22"
 			},
 			"funding": {
 				"url": "https://github.com/sponsors/isaacs"
@@ -5575,9 +5705,9 @@
 			"license": "ISC"
 		},
 		"node_modules/picomatch": {
-			"version": "4.0.3",
+			"version": "4.0.4",
-			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
+			"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-			"integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+			"integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
 			"dev": true,
 			"license": "MIT",
 			"engines": {
@@ -5956,9 +6086,9 @@
 			"license": "ISC"
 		},
 		"node_modules/rollup": {
-			"version": "4.48.1",
+			"version": "4.60.1",
-			"resolved": "https://registry.npmjs.org/rollup/-/rollup-4.48.1.tgz",
+			"resolved": "https://registry.npmjs.org/rollup/-/rollup-4.60.1.tgz",
-			"integrity": "sha512-jVG20NvbhTYDkGAty2/Yh7HK6/q3DGSRH4o8ALKGArmMuaauM9kLfoMZ+WliPwA5+JHr2lTn3g557FxBV87ifg==",
+			"integrity": "sha512-VmtB2rFU/GroZ4oL8+ZqXgSA38O6GR8KSIvWmEFv63pQ0G6KaBH9s07PO8XTXP4vI+3UJUEypOfjkGfmSBBR0w==",
 			"dev": true,
 			"license": "MIT",
 			"dependencies": {
@@ -5972,26 +6102,31 @@
 				"npm": ">=8.0.0"
 			},
 			"optionalDependencies": {
-				"@rollup/rollup-android-arm-eabi": "4.48.1",
+				"@rollup/rollup-android-arm-eabi": "4.60.1",
-				"@rollup/rollup-android-arm64": "4.48.1",
+				"@rollup/rollup-android-arm64": "4.60.1",
-				"@rollup/rollup-darwin-arm64": "4.48.1",
+				"@rollup/rollup-darwin-arm64": "4.60.1",
-				"@rollup/rollup-darwin-x64": "4.48.1",
+				"@rollup/rollup-darwin-x64": "4.60.1",
-				"@rollup/rollup-freebsd-arm64": "4.48.1",
+				"@rollup/rollup-freebsd-arm64": "4.60.1",
-				"@rollup/rollup-freebsd-x64": "4.48.1",
+				"@rollup/rollup-freebsd-x64": "4.60.1",
-				"@rollup/rollup-linux-arm-gnueabihf": "4.48.1",
+				"@rollup/rollup-linux-arm-gnueabihf": "4.60.1",
-				"@rollup/rollup-linux-arm-musleabihf": "4.48.1",
+				"@rollup/rollup-linux-arm-musleabihf": "4.60.1",
-				"@rollup/rollup-linux-arm64-gnu": "4.48.1",
+				"@rollup/rollup-linux-arm64-gnu": "4.60.1",
-				"@rollup/rollup-linux-arm64-musl": "4.48.1",
+				"@rollup/rollup-linux-arm64-musl": "4.60.1",
-				"@rollup/rollup-linux-loongarch64-gnu": "4.48.1",
+				"@rollup/rollup-linux-loong64-gnu": "4.60.1",
-				"@rollup/rollup-linux-ppc64-gnu": "4.48.1",
+				"@rollup/rollup-linux-loong64-musl": "4.60.1",
-				"@rollup/rollup-linux-riscv64-gnu": "4.48.1",
+				"@rollup/rollup-linux-ppc64-gnu": "4.60.1",
-				"@rollup/rollup-linux-riscv64-musl": "4.48.1",
+				"@rollup/rollup-linux-ppc64-musl": "4.60.1",
-				"@rollup/rollup-linux-s390x-gnu": "4.48.1",
+				"@rollup/rollup-linux-riscv64-gnu": "4.60.1",
-				"@rollup/rollup-linux-x64-gnu": "4.48.1",
+				"@rollup/rollup-linux-riscv64-musl": "4.60.1",
-				"@rollup/rollup-linux-x64-musl": "4.48.1",
+				"@rollup/rollup-linux-s390x-gnu": "4.60.1",
-				"@rollup/rollup-win32-arm64-msvc": "4.48.1",
+				"@rollup/rollup-linux-x64-gnu": "4.60.1",
-				"@rollup/rollup-win32-ia32-msvc": "4.48.1",
+				"@rollup/rollup-linux-x64-musl": "4.60.1",
-				"@rollup/rollup-win32-x64-msvc": "4.48.1",
+				"@rollup/rollup-openbsd-x64": "4.60.1",
+				"@rollup/rollup-openharmony-arm64": "4.60.1",
+				"@rollup/rollup-win32-arm64-msvc": "4.60.1",
+				"@rollup/rollup-win32-ia32-msvc": "4.60.1",
+				"@rollup/rollup-win32-x64-gnu": "4.60.1",
+				"@rollup/rollup-win32-x64-msvc": "4.60.1",
 				"fsevents": "~2.3.2"
 			}
 		},
@@ -6290,9 +6425,9 @@
 			}
 		},
 		"node_modules/tar": {
-			"version": "7.5.7",
+			"version": "7.5.13",
-			"resolved": "https://registry.npmjs.org/tar/-/tar-7.5.7.tgz",
+			"resolved": "https://registry.npmjs.org/tar/-/tar-7.5.13.tgz",
-			"integrity": "sha512-fov56fJiRuThVFXD6o6/Q354S7pnWMJIVlDBYijsTNx6jKSE4pvrDTs6lUnmGvNyfJwFQQwWy3owKz1ucIhveQ==",
+			"integrity": "sha512-tOG/7GyXpFevhXVh8jOPJrmtRpOTsYqUIkVdVooZYJS/z8WhfQUX8RJILmeuJNinGAMSu1veBr4asSHFt5/hng==",
 			"dev": true,
 			"license": "BlueOak-1.0.0",
 			"dependencies": {
@@ -6559,9 +6694,9 @@
 			"license": "MIT"
 		},
 		"node_modules/valibot": {
-			"version": "0.42.1",
+			"version": "1.3.1",
-			"resolved": "https://registry.npmjs.org/valibot/-/valibot-0.42.1.tgz",
+			"resolved": "https://registry.npmjs.org/valibot/-/valibot-1.3.1.tgz",
-			"integrity": "sha512-3keXV29Ar5b//Hqi4MbSdV7lfVp6zuYLZuA9V1PvQUsXqogr+u5lvLPLk3A4f74VUXDnf/JfWMN6sB+koJ/FFw==",
+			"integrity": "sha512-sfdRir/QFM0JaF22hqTroPc5xy4DimuGQVKFrzF1YfGwaS1nJot3Y8VqMdLO2Lg27fMzat2yD3pY5PbAYO39Gg==",
 			"license": "MIT",
 			"peerDependencies": {
 				"typescript": ">=5"

internal/site/package.json

@@ -52,7 +52,7 @@
 		"recharts": "^2.15.4",
 		"shiki": "^3.13.0",
 		"tailwind-merge": "^3.3.1",
-		"valibot": "^0.42.1"
+		"valibot": "^1.3.1"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "2.2.4",

internal/site/src/components/alerts/alert-button.tsx

@@ -20,7 +20,7 @@ export default memo(function AlertsButton({ system }: { system: SystemRecord })
 				<SheetTrigger asChild>
 					<Button variant="ghost" size="icon" aria-label={t`Alerts`} data-nolink onClick={() => setOpened(true)}>
 						<BellIcon
-							className={cn("h-[1.2em] w-[1.2em] pointer-events-none", {
+							className={cn("size-[1.2em] pointer-events-none", {
 								"fill-primary": hasSystemAlert,
 							})}
 						/>

internal/site/src/components/alerts/alerts-sheet.tsx

@@ -2,11 +2,13 @@ import { t } from "@lingui/core/macro"
 import { Plural, Trans } from "@lingui/react/macro"
 import { useStore } from "@nanostores/react"
 import { getPagePath } from "@nanostores/router"
-import { GlobeIcon, ServerIcon } from "lucide-react"
+import { ChevronDownIcon, GlobeIcon, ServerIcon } from "lucide-react"
 import { lazy, memo, Suspense, useMemo, useState } from "react"
 import { $router, Link } from "@/components/router"
+import { Button } from "@/components/ui/button"
 import { Checkbox } from "@/components/ui/checkbox"
 import { DialogDescription, DialogHeader, DialogTitle } from "@/components/ui/dialog"
+import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigger } from "@/components/ui/dropdown-menu"
 import { Input } from "@/components/ui/input"
 import { Switch } from "@/components/ui/switch"
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs"
@@ -64,11 +66,57 @@ const deleteAlerts = debounce(async ({ name, systems }: { name: string; systems:
 
 export const AlertDialogContent = memo(function AlertDialogContent({ system }: { system: SystemRecord }) {
 	const alerts = useStore($alerts)
+	const systems = useStore($systems)
 	const [overwriteExisting, setOverwriteExisting] = useState<boolean | "indeterminate">(false)
 	const [currentTab, setCurrentTab] = useState("system")
+	// copyKey is used to force remount AlertContent components with
+	// new alert data after copying alerts from another system
+	const [copyKey, setCopyKey] = useState(0)
 
 	const systemAlerts = alerts[system.id] ?? new Map()
 
+	// Systems that have at least one alert configured (excluding the current system)
+	const systemsWithAlerts = useMemo(
+		() => systems.filter((s) => s.id !== system.id && alerts[s.id]?.size),
+		[systems, alerts, system.id]
+	)
+
+	async function copyAlertsFromSystem(sourceSystemId: string) {
+		const sourceAlerts = $alerts.get()[sourceSystemId]
+		if (!sourceAlerts?.size) return
+		try {
+			const currentTargetAlerts = $alerts.get()[system.id] ?? new Map()
+			// Alert names present on target but absent from source should be deleted
+			const namesToDelete = Array.from(currentTargetAlerts.keys()).filter((name) => !sourceAlerts.has(name))
+			await Promise.all([
+				...Array.from(sourceAlerts.values()).map(({ name, value, min }) =>
+					pb.send<{ success: boolean }>(endpoint, {
+						method: "POST",
+						body: { name, value, min, systems: [system.id], overwrite: true },
+						requestKey: name,
+					})
+				),
+				...namesToDelete.map((name) =>
+					pb.send<{ success: boolean }>(endpoint, {
+						method: "DELETE",
+						body: { name, systems: [system.id] },
+						requestKey: name,
+					})
+				),
+			])
+			// Optimistically update the store so components re-mount with correct data
+			// before the realtime subscription event arrives.
+			const newSystemAlerts = new Map<string, AlertRecord>()
+			for (const alert of sourceAlerts.values()) {
+				newSystemAlerts.set(alert.name, { ...alert, system: system.id, triggered: false })
+			}
+			$alerts.setKey(system.id, newSystemAlerts)
+			setCopyKey((k) => k + 1)
+		} catch (error) {
+			failedUpdateToast(error)
+		}
+	}
+
 	// We need to keep a copy of alerts when we switch to global tab. If we always compare to
 	// current alerts, it will only be updated when first checked, then won't be updated because
 	// after that it exists.
@@ -93,18 +141,37 @@ export const AlertDialogContent = memo(function AlertDialogContent({ system }: {
 				</DialogDescription>
 			</DialogHeader>
 			<Tabs defaultValue="system" onValueChange={setCurrentTab}>
-				<TabsList className="mb-1 -mt-0.5">
+				<div className="flex items-center justify-between mb-1 -mt-0.5">
-					<TabsTrigger value="system">
+					<TabsList>
-						<ServerIcon className="me-2 h-3.5 w-3.5" />
+						<TabsTrigger value="system">
-						<span className="truncate max-w-60">{system.name}</span>
+							<ServerIcon className="me-2 h-3.5 w-3.5" />
-					</TabsTrigger>
+							<span className="truncate max-w-60">{system.name}</span>
-					<TabsTrigger value="global">
+						</TabsTrigger>
-						<GlobeIcon className="me-1.5 h-3.5 w-3.5" />
+						<TabsTrigger value="global">
-						<Trans>All Systems</Trans>
+							<GlobeIcon className="me-1.5 h-3.5 w-3.5" />
-					</TabsTrigger>
+							<Trans>All Systems</Trans>
-				</TabsList>
+						</TabsTrigger>
+					</TabsList>
+					{systemsWithAlerts.length > 0 && currentTab === "system" && (
+						<DropdownMenu>
+							<DropdownMenuTrigger asChild>
+								<Button variant="ghost" size="sm" className="text-muted-foreground text-xs gap-1.5">
+									<Trans context="Copy alerts from another system">Copy from</Trans>
+									<ChevronDownIcon className="h-3.5 w-3.5" />
+								</Button>
+							</DropdownMenuTrigger>
+							<DropdownMenuContent align="end" className="max-h-100 overflow-auto">
+								{systemsWithAlerts.map((s) => (
+									<DropdownMenuItem key={s.id} className="min-w-44" onSelect={() => copyAlertsFromSystem(s.id)}>
+										{s.name}
+									</DropdownMenuItem>
+								))}
+							</DropdownMenuContent>
+						</DropdownMenu>
+					)}
+				</div>
 				<TabsContent value="system">
-					<div className="grid gap-3">
+					<div key={copyKey} className="grid gap-3">
 						{alertKeys.map((name) => (
 							<AlertContent
 								key={name}

internal/site/src/components/charts/area-chart.tsx

@@ -41,8 +41,8 @@ export default function AreaChartDefault({
 	hideYAxis = false,
 	filter,
 	truncate = false,
-}: // logRender = false,
+	chartProps,
-{
+}: {
 	chartData: ChartData
 	// biome-ignore lint/suspicious/noExplicitAny: accepts different data source types (systemStats or containerData)
 	customData?: any[]
@@ -62,7 +62,7 @@ export default function AreaChartDefault({
 	hideYAxis?: boolean
 	filter?: string
 	truncate?: boolean
-	// logRender?: boolean
+	chartProps?: Omit<React.ComponentProps<typeof AreaChart>, "data" | "margin">
 }) {
 	const { yAxisWidth, updateYAxisWidth } = useYAxisWidth()
 	const { isIntersecting, ref } = useIntersectionObserver({ freeze: false })
@@ -131,6 +131,7 @@ export default function AreaChartDefault({
 					accessibilityLayer
 					data={displayData}
 					margin={hideYAxis ? { ...chartMargin, left: 5 } : chartMargin}
+					{...chartProps}
 				>
 					<CartesianGrid vertical={false} />
 					{!hideYAxis && (

internal/site/src/components/charts/line-chart.tsx

@@ -40,8 +40,8 @@ export default function LineChartDefault({
 	hideYAxis = false,
 	filter,
 	truncate = false,
-}: // logRender = false,
+	chartProps,
-{
+}: {
 	chartData: ChartData
 	// biome-ignore lint/suspicious/noExplicitAny: accepts different data source types (systemStats or containerData)
 	customData?: any[]
@@ -61,7 +61,7 @@ export default function LineChartDefault({
 	hideYAxis?: boolean
 	filter?: string
 	truncate?: boolean
-	// logRender?: boolean
+	chartProps?: Omit<React.ComponentProps<typeof LineChart>, "data" | "margin">
 }) {
 	const { yAxisWidth, updateYAxisWidth } = useYAxisWidth()
 	const { isIntersecting, ref } = useIntersectionObserver({ freeze: false })
@@ -130,6 +130,7 @@ export default function LineChartDefault({
 					accessibilityLayer
 					data={displayData}
 					margin={hideYAxis ? { ...chartMargin, left: 5 } : chartMargin}
+					{...chartProps}
 				>
 					<CartesianGrid vertical={false} />
 					{!hideYAxis && (

internal/site/src/components/navbar.tsx

@@ -63,7 +63,7 @@ export default function Navbar() {
 				className="p-2 ps-0 me-3 group"
 				onMouseEnter={runOnce(() => import("@/components/routes/home"))}
 			>
-				<Logo className="h-[1.1rem] md:h-5 fill-foreground" />
+				<Logo className="h-[1.2rem] md:h-5 fill-foreground" />
 			</Link>
 			<Button
 				variant="outline"
@@ -125,15 +125,17 @@ export default function Navbar() {
 									<DropdownMenuSubContent>{AdminLinks}</DropdownMenuSubContent>
 								</DropdownMenuSub>
 							)}
-							<DropdownMenuItem
+							{!isReadOnlyUser() && (
-								className="flex items-center"
+								<DropdownMenuItem
-								onSelect={() => {
+									className="flex items-center"
-									setAddSystemDialogOpen(true)
+									onSelect={() => {
-								}}
+										setAddSystemDialogOpen(true)
-							>
+									}}
-								<PlusIcon className="h-4 w-4 me-2.5" />
+								>
-								<Trans>Add {{ foo: systemTranslation }}</Trans>
+									<PlusIcon className="h-4 w-4 me-2.5" />
-							</DropdownMenuItem>
+									<Trans>Add {{ foo: systemTranslation }}</Trans>
+								</DropdownMenuItem>
+							)}
 						</DropdownMenuGroup>
 						<DropdownMenuSeparator />
 						<DropdownMenuGroup>
@@ -217,10 +219,12 @@ export default function Navbar() {
 						</DropdownMenuItem>
 					</DropdownMenuContent>
 				</DropdownMenu>
-				<Button variant="outline" className="flex gap-1 ms-2" onClick={() => setAddSystemDialogOpen(true)}>
+				{!isReadOnlyUser() && (
-					<PlusIcon className="h-4 w-4 -ms-1" />
+					<Button variant="outline" className="flex gap-1 ms-2" onClick={() => setAddSystemDialogOpen(true)}>
-					<Trans>Add {{ foo: systemTranslation }}</Trans>
+						<PlusIcon className="h-4 w-4 -ms-1" />
-				</Button>
+						<Trans>Add {{ foo: systemTranslation }}</Trans>
+					</Button>
+				)}
 			</div>
 		</div>
 	)

internal/site/src/components/routes/system.tsx

@@ -1,18 +1,16 @@
 import { memo, useState } from "react"
 import { Trans } from "@lingui/react/macro"
 import { compareSemVer, parseSemVer } from "@/lib/utils"
-
 import type { GPUData } from "@/types"
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs"
 import InfoBar from "./system/info-bar"
 import { useSystemData } from "./system/use-system-data"
 import { CpuChart, ContainerCpuChart } from "./system/charts/cpu-charts"
 import { MemoryChart, ContainerMemoryChart, SwapChart } from "./system/charts/memory-charts"
-import { DiskCharts } from "./system/charts/disk-charts"
+import { RootDiskCharts, ExtraFsCharts } from "./system/charts/disk-charts"
 import { BandwidthChart, ContainerNetworkChart } from "./system/charts/network-charts"
 import { TemperatureChart, BatteryChart } from "./system/charts/sensor-charts"
 import { GpuPowerChart, GpuDetailCharts } from "./system/charts/gpu-charts"
-import { ExtraFsCharts } from "./system/charts/extra-fs-charts"
 import { LazyContainersTable, LazySmartTable, LazySystemdTable } from "./system/lazy-tables"
 import { LoadAverageChart } from "./system/charts/load-average-chart"
 import { ContainerIcon, CpuIcon, HardDriveIcon, TerminalSquareIcon } from "lucide-react"
@@ -24,6 +22,8 @@ const SEMVER_0_14_0 = parseSemVer("0.14.0")
 const SEMVER_0_15_0 = parseSemVer("0.15.0")
 
 export default memo(function SystemDetail({ id }: { id: string }) {
+	const systemData = useSystemData(id)
+
 	const {
 		system,
 		systemStats,
@@ -48,7 +48,7 @@ export default memo(function SystemDetail({ id }: { id: string }) {
 		hasGpuData,
 		hasGpuEnginesData,
 		hasGpuPowerData,
-	} = useSystemData(id)
+	} = systemData
 
 	// extra margin to add to bottom of page, specifically for temperature chart,
 	// where the tooltip can go past the bottom of the page if lots of sensors
@@ -103,7 +103,7 @@ export default memo(function SystemDetail({ id }: { id: string }) {
 						/>
 					)}
 
-					<DiskCharts {...coreProps} systemStats={systemStats} />
+					<RootDiskCharts systemData={systemData} />
 
 					<BandwidthChart {...coreProps} systemStats={systemStats} />
 
@@ -138,7 +138,7 @@ export default memo(function SystemDetail({ id }: { id: string }) {
 					/>
 				)}
 
-				<ExtraFsCharts {...coreProps} systemStats={systemStats} />
+				<ExtraFsCharts systemData={systemData} />
 
 				{maybeHasSmartData && <LazySmartTable systemId={system.id} />}
 
@@ -188,6 +188,7 @@ export default memo(function SystemDetail({ id }: { id: string }) {
 						<LoadAverageChart chartData={chartData} grid={grid} dataEmpty={dataEmpty} />
 						<BandwidthChart {...coreProps} systemStats={systemStats} />
 						<TemperatureChart {...coreProps} setPageBottomExtraMargin={setPageBottomExtraMargin} />
+						<BatteryChart {...coreProps} />
 						<SwapChart chartData={chartData} grid={grid} dataEmpty={dataEmpty} systemStats={systemStats} />
 						{pageBottomExtraMargin > 0 && <div style={{ marginBottom: pageBottomExtraMargin }}></div>}
 					</div>
@@ -197,9 +198,9 @@ export default memo(function SystemDetail({ id }: { id: string }) {
 					{mountedTabs.has("disk") && (
 						<>
 							<div className="grid xl:grid-cols-2 gap-4">
-								<DiskCharts {...coreProps} systemStats={systemStats} />
+								<RootDiskCharts systemData={systemData} />
 							</div>
-							<ExtraFsCharts {...coreProps} systemStats={systemStats} />
+							<ExtraFsCharts systemData={systemData} />
 							{maybeHasSmartData && <LazySmartTable systemId={system.id} />}
 						</>
 					)}

internal/site/src/components/routes/system/charts/disk-charts.tsx

@@ -1,106 +1,280 @@
 import { t } from "@lingui/core/macro"
 import AreaChartDefault from "@/components/charts/area-chart"
-import { $userSettings } from "@/lib/stores"
 import { decimalString, formatBytes, toFixedFloat } from "@/lib/utils"
-import type { ChartData, SystemStatsRecord } from "@/types"
+import type { SystemStatsRecord } from "@/types"
 import { ChartCard, SelectAvgMax } from "../chart-card"
 import { Unit } from "@/lib/enums"
+import { pinnedAxisDomain } from "@/components/ui/chart"
+import DiskIoSheet from "../disk-io-sheet"
+import type { SystemData } from "../use-system-data"
+import { useStore } from "@nanostores/react"
+import { $userSettings } from "@/lib/stores"
 
-export function DiskCharts({
+// Helpers for indexed dios/diosm access
-	chartData,
+const dios =
-	grid,
+	(i: number) =>
-	dataEmpty,
+	({ stats }: SystemStatsRecord) =>
-	showMax,
+		stats?.dios?.[i] ?? 0
-	isLongerChart,
+const diosMax =
-	maxValues,
+	(i: number) =>
-}: {
+	({ stats }: SystemStatsRecord) =>
-	chartData: ChartData
+		stats?.diosm?.[i] ?? 0
-	grid: boolean
+const extraDios =
-	dataEmpty: boolean
+	(name: string, i: number) =>
-	showMax: boolean
+	({ stats }: SystemStatsRecord) =>
-	isLongerChart: boolean
+		stats?.efs?.[name]?.dios?.[i] ?? 0
-	maxValues: boolean
+const extraDiosMax =
-	systemStats: SystemStatsRecord[]
+	(name: string, i: number) =>
-}) {
+	({ stats }: SystemStatsRecord) =>
-	const maxValSelect = isLongerChart ? <SelectAvgMax max={maxValues} /> : null
+		stats?.efs?.[name]?.diosm?.[i] ?? 0
-	const userSettings = $userSettings.get()
+
+export const diskDataFns = {
+	// usage
+	usage: ({ stats }: SystemStatsRecord) => stats?.du ?? 0,
+	extraUsage:
+		(name: string) =>
+		({ stats }: SystemStatsRecord) =>
+			stats?.efs?.[name]?.du ?? 0,
+	// throughput
+	read: ({ stats }: SystemStatsRecord) => stats?.dio?.[0] ?? (stats?.dr ?? 0) * 1024 * 1024,
+	readMax: ({ stats }: SystemStatsRecord) => stats?.diom?.[0] ?? (stats?.drm ?? 0) * 1024 * 1024,
+	write: ({ stats }: SystemStatsRecord) => stats?.dio?.[1] ?? (stats?.dw ?? 0) * 1024 * 1024,
+	writeMax: ({ stats }: SystemStatsRecord) => stats?.diom?.[1] ?? (stats?.dwm ?? 0) * 1024 * 1024,
+	// extra fs throughput
+	extraRead:
+		(name: string) =>
+		({ stats }: SystemStatsRecord) =>
+			stats?.efs?.[name]?.rb ?? (stats?.efs?.[name]?.r ?? 0) * 1024 * 1024,
+	extraReadMax:
+		(name: string) =>
+		({ stats }: SystemStatsRecord) =>
+			stats?.efs?.[name]?.rbm ?? (stats?.efs?.[name]?.rm ?? 0) * 1024 * 1024,
+	extraWrite:
+		(name: string) =>
+		({ stats }: SystemStatsRecord) =>
+			stats?.efs?.[name]?.wb ?? (stats?.efs?.[name]?.w ?? 0) * 1024 * 1024,
+	extraWriteMax:
+		(name: string) =>
+		({ stats }: SystemStatsRecord) =>
+			stats?.efs?.[name]?.wbm ?? (stats?.efs?.[name]?.wm ?? 0) * 1024 * 1024,
+	// read/write time
+	readTime: dios(0),
+	readTimeMax: diosMax(0),
+	extraReadTime: (name: string) => extraDios(name, 0),
+	extraReadTimeMax: (name: string) => extraDiosMax(name, 0),
+	writeTime: dios(1),
+	writeTimeMax: diosMax(1),
+	extraWriteTime: (name: string) => extraDios(name, 1),
+	extraWriteTimeMax: (name: string) => extraDiosMax(name, 1),
+	// utilization (IoTime-based, 0-100%)
+	util: dios(2),
+	utilMax: diosMax(2),
+	extraUtil: (name: string) => extraDios(name, 2),
+	extraUtilMax: (name: string) => extraDiosMax(name, 2),
+	// r_await / w_await: average service time per read/write operation (ms)
+	rAwait: dios(3),
+	rAwaitMax: diosMax(3),
+	extraRAwait: (name: string) => extraDios(name, 3),
+	extraRAwaitMax: (name: string) => extraDiosMax(name, 3),
+	wAwait: dios(4),
+	wAwaitMax: diosMax(4),
+	extraWAwait: (name: string) => extraDios(name, 4),
+	extraWAwaitMax: (name: string) => extraDiosMax(name, 4),
+	// average queue depth: stored as queue_depth * 100 in Go, divided here
+	weightedIO: ({ stats }: SystemStatsRecord) => (stats?.dios?.[5] ?? 0) / 100,
+	weightedIOMax: ({ stats }: SystemStatsRecord) => (stats?.diosm?.[5] ?? 0) / 100,
+	extraWeightedIO:
+		(name: string) =>
+		({ stats }: SystemStatsRecord) =>
+			(stats?.efs?.[name]?.dios?.[5] ?? 0) / 100,
+	extraWeightedIOMax:
+		(name: string) =>
+		({ stats }: SystemStatsRecord) =>
+			(stats?.efs?.[name]?.diosm?.[5] ?? 0) / 100,
+}
+
+export function RootDiskCharts({ systemData }: { systemData: SystemData }) {
+	return (
+		<>
+			<DiskUsageChart systemData={systemData} />
+			<DiskIOChart systemData={systemData} />
+		</>
+	)
+}
+
+export function DiskUsageChart({ systemData, extraFsName }: { systemData: SystemData; extraFsName?: string }) {
+	const { chartData, grid, dataEmpty } = systemData
 
 	let diskSize = chartData.systemStats?.at(-1)?.stats.d ?? NaN
+	if (extraFsName) {
+		diskSize = chartData.systemStats?.at(-1)?.stats.efs?.[extraFsName]?.d ?? NaN
+	}
 	// round to nearest GB
 	if (diskSize >= 100) {
 		diskSize = Math.round(diskSize)
 	}
 
-	return (
+	const title = extraFsName ? `${extraFsName} ${t`Usage`}` : t`Disk Usage`
-		<>
+	const description = extraFsName ? t`Disk usage of ${extraFsName}` : t`Usage of root partition`
-			<ChartCard empty={dataEmpty} grid={grid} title={t`Disk Usage`} description={t`Usage of root partition`}>
-				<AreaChartDefault
-					chartData={chartData}
-					domain={[0, diskSize]}
-					tickFormatter={(val) => {
-						const { value, unit } = formatBytes(val * 1024, false, Unit.Bytes, true)
-						return `${toFixedFloat(value, value >= 10 ? 0 : 1)} ${unit}`
-					}}
-					contentFormatter={({ value }) => {
-						const { value: convertedValue, unit } = formatBytes(value * 1024, false, Unit.Bytes, true)
-						return `${decimalString(convertedValue)} ${unit}`
-					}}
-					dataPoints={[
-						{
-							label: t`Disk Usage`,
-							color: 4,
-							opacity: 0.4,
-							dataKey: ({ stats }) => stats?.du,
-						},
-					]}
-				></AreaChartDefault>
-			</ChartCard>
 
-			<ChartCard
+	return (
-				empty={dataEmpty}
+		<ChartCard empty={dataEmpty} grid={grid} title={title} description={description}>
-				grid={grid}
+			<AreaChartDefault
-				title={t`Disk I/O`}
+				chartData={chartData}
-				description={t`Throughput of root filesystem`}
+				domain={[0, diskSize]}
-				cornerEl={maxValSelect}
+				tickFormatter={(val) => {
-			>
+					const { value, unit } = formatBytes(val * 1024, false, Unit.Bytes, true)
-				<AreaChartDefault
+					return `${toFixedFloat(value, value >= 10 ? 0 : 1)} ${unit}`
-					chartData={chartData}
+				}}
-					maxToggled={showMax}
+				contentFormatter={({ value }) => {
-					dataPoints={[
+					const { value: convertedValue, unit } = formatBytes(value * 1024, false, Unit.Bytes, true)
-						{
+					return `${decimalString(convertedValue)} ${unit}`
-							label: t({ message: "Write", comment: "Disk write" }),
+				}}
-							dataKey: ({ stats }: SystemStatsRecord) => {
+				dataPoints={[
-								if (showMax) {
+					{
-									return stats?.dio?.[1] ?? (stats?.dwm ?? 0) * 1024 * 1024
+						label: t`Disk Usage`,
-								}
+						color: 4,
-								return stats?.dio?.[1] ?? (stats?.dw ?? 0) * 1024 * 1024
+						opacity: 0.4,
-							},
+						dataKey: extraFsName ? diskDataFns.extraUsage(extraFsName) : diskDataFns.usage,
-							color: 3,
+					},
-							opacity: 0.3,
+				]}
-						},
+			></AreaChartDefault>
-						{
+		</ChartCard>
-							label: t({ message: "Read", comment: "Disk read" }),
+	)
-							dataKey: ({ stats }: SystemStatsRecord) => {
+}
-								if (showMax) {
+
-									return stats?.diom?.[0] ?? (stats?.drm ?? 0) * 1024 * 1024
+export function DiskIOChart({ systemData, extraFsName }: { systemData: SystemData; extraFsName?: string }) {
-								}
+	const { chartData, grid, dataEmpty, showMax, isLongerChart, maxValues } = systemData
-								return stats?.dio?.[0] ?? (stats?.dr ?? 0) * 1024 * 1024
+	const maxValSelect = isLongerChart ? <SelectAvgMax max={maxValues} /> : null
-							},
+	const userSettings = useStore($userSettings)
-							color: 1,
+
-							opacity: 0.3,
+	if (!chartData.systemStats?.length) {
-						},
+		return null
-					]}
+	}
-					tickFormatter={(val) => {
+
-						const { value, unit } = formatBytes(val, true, userSettings.unitDisk, false)
+	const title = extraFsName ? t`${extraFsName} I/O` : t`Disk I/O`
-						return `${toFixedFloat(value, value >= 10 ? 0 : 1)} ${unit}`
+	const description = extraFsName ? t`Throughput of ${extraFsName}` : t`Throughput of root filesystem`
-					}}
+
-					contentFormatter={({ value }) => {
+	const hasMoreIOMetrics = chartData.systemStats?.some((record) => record.stats?.dios?.at(0))
-						const { value: convertedValue, unit } = formatBytes(value, true, userSettings.unitDisk, false)
+
-						return `${decimalString(convertedValue, convertedValue >= 100 ? 1 : 2)} ${unit}`
+	let CornerEl = maxValSelect
-					}}
+	if (hasMoreIOMetrics) {
-					showTotal={true}
+		CornerEl = (
-				/>
+			<div className="flex gap-2">
-			</ChartCard>
+				{maxValSelect}
-		</>
+				<DiskIoSheet systemData={systemData} extraFsName={extraFsName} title={title} description={description} />
+			</div>
+		)
+	}
+
+	let readFn = showMax ? diskDataFns.readMax : diskDataFns.read
+	let writeFn = showMax ? diskDataFns.writeMax : diskDataFns.write
+	if (extraFsName) {
+		readFn = showMax ? diskDataFns.extraReadMax(extraFsName) : diskDataFns.extraRead(extraFsName)
+		writeFn = showMax ? diskDataFns.extraWriteMax(extraFsName) : diskDataFns.extraWrite(extraFsName)
+	}
+
+	return (
+		<ChartCard empty={dataEmpty} grid={grid} title={title} description={description} cornerEl={CornerEl}>
+			<AreaChartDefault
+				chartData={chartData}
+				maxToggled={showMax}
+				// domain={pinnedAxisDomain(true)}
+				showTotal={true}
+				dataPoints={[
+					{
+						label: t({ message: "Write", comment: "Disk write" }),
+						dataKey: writeFn,
+						color: 3,
+						opacity: 0.3,
+					},
+					{
+						label: t({ message: "Read", comment: "Disk read" }),
+						dataKey: readFn,
+						color: 1,
+						opacity: 0.3,
+					},
+				]}
+				tickFormatter={(val) => {
+					const { value, unit } = formatBytes(val, true, userSettings.unitDisk, false)
+					return `${toFixedFloat(value, value >= 10 ? 0 : 1)} ${unit}`
+				}}
+				contentFormatter={({ value }) => {
+					const { value: convertedValue, unit } = formatBytes(value, true, userSettings.unitDisk, false)
+					return `${decimalString(convertedValue, convertedValue >= 100 ? 1 : 2)} ${unit}`
+				}}
+			/>
+		</ChartCard>
+	)
+}
+
+export function DiskUtilizationChart({ systemData, extraFsName }: { systemData: SystemData; extraFsName?: string }) {
+	const { chartData, grid, dataEmpty, showMax, isLongerChart, maxValues } = systemData
+	const maxValSelect = isLongerChart ? <SelectAvgMax max={maxValues} /> : null
+
+	if (!chartData.systemStats?.length) {
+		return null
+	}
+
+	let utilFn = showMax ? diskDataFns.utilMax : diskDataFns.util
+	if (extraFsName) {
+		utilFn = showMax ? diskDataFns.extraUtilMax(extraFsName) : diskDataFns.extraUtil(extraFsName)
+	}
+	return (
+		<ChartCard
+			cornerEl={maxValSelect}
+			empty={dataEmpty}
+			grid={grid}
+			title={t`I/O Utilization`}
+			description={t`Percent of time the disk is busy with I/O`}
+			// legend={true}
+			className="min-h-auto"
+		>
+			<AreaChartDefault
+				chartData={chartData}
+				domain={pinnedAxisDomain()}
+				tickFormatter={(val) => `${toFixedFloat(val, 2)}%`}
+				contentFormatter={({ value }) => `${decimalString(value)}%`}
+				maxToggled={showMax}
+				chartProps={{ syncId: "io" }}
+				dataPoints={[
+					{
+						label: t`Utilization`,
+						dataKey: utilFn,
+						color: 1,
+						opacity: 0.4,
+					},
+				]}
+			/>
+		</ChartCard>
+	)
+}
+
+export function ExtraFsCharts({ systemData }: { systemData: SystemData }) {
+	const { systemStats } = systemData.chartData
+
+	const extraFs = systemStats?.at(-1)?.stats.efs
+
+	if (!extraFs || Object.keys(extraFs).length === 0) {
+		return null
+	}
+
+	return (
+		<div className="grid xl:grid-cols-2 gap-4">
+			{Object.keys(extraFs).map((extraFsName) => {
+				let diskSize = systemStats.at(-1)?.stats.efs?.[extraFsName].d ?? NaN
+				// round to nearest GB
+				if (diskSize >= 100) {
+					diskSize = Math.round(diskSize)
+				}
+				return (
+					<div key={extraFsName} className="contents">
+						<DiskUsageChart systemData={systemData} extraFsName={extraFsName} />
+
+						<DiskIOChart systemData={systemData} extraFsName={extraFsName} />
+					</div>
+				)
+			})}
+		</div>
 	)
 }

internal/site/src/components/routes/system/charts/extra-fs-charts.tsx

@@ -1,120 +0,0 @@
-import { t } from "@lingui/core/macro"
-import AreaChartDefault from "@/components/charts/area-chart"
-import { $userSettings } from "@/lib/stores"
-import { decimalString, formatBytes, toFixedFloat } from "@/lib/utils"
-import type { ChartData, SystemStatsRecord } from "@/types"
-import { ChartCard, SelectAvgMax } from "../chart-card"
-import { Unit } from "@/lib/enums"
-
-export function ExtraFsCharts({
-	chartData,
-	grid,
-	dataEmpty,
-	showMax,
-	isLongerChart,
-	maxValues,
-	systemStats,
-}: {
-	chartData: ChartData
-	grid: boolean
-	dataEmpty: boolean
-	showMax: boolean
-	isLongerChart: boolean
-	maxValues: boolean
-	systemStats: SystemStatsRecord[]
-}) {
-	const maxValSelect = isLongerChart ? <SelectAvgMax max={maxValues} /> : null
-	const userSettings = $userSettings.get()
-	const extraFs = systemStats.at(-1)?.stats.efs
-	if (!extraFs || Object.keys(extraFs).length === 0) {
-		return null
-	}
-
-	return (
-		<div className="grid xl:grid-cols-2 gap-4">
-			{Object.keys(extraFs).map((extraFsName) => {
-				let diskSize = systemStats.at(-1)?.stats.efs?.[extraFsName].d ?? NaN
-				// round to nearest GB
-				if (diskSize >= 100) {
-					diskSize = Math.round(diskSize)
-				}
-				return (
-					<div key={extraFsName} className="contents">
-						<ChartCard
-							empty={dataEmpty}
-							grid={grid}
-							title={`${extraFsName} ${t`Usage`}`}
-							description={t`Disk usage of ${extraFsName}`}
-						>
-							<AreaChartDefault
-								chartData={chartData}
-								domain={[0, diskSize]}
-								tickFormatter={(val) => {
-									const { value, unit } = formatBytes(val * 1024, false, Unit.Bytes, true)
-									return `${toFixedFloat(value, value >= 10 ? 0 : 1)} ${unit}`
-								}}
-								contentFormatter={({ value }) => {
-									const { value: convertedValue, unit } = formatBytes(value * 1024, false, Unit.Bytes, true)
-									return `${decimalString(convertedValue)} ${unit}`
-								}}
-								dataPoints={[
-									{
-										label: t`Disk Usage`,
-										color: 4,
-										opacity: 0.4,
-										dataKey: ({ stats }) => stats?.efs?.[extraFsName]?.du,
-									},
-								]}
-							></AreaChartDefault>
-						</ChartCard>
-						<ChartCard
-							empty={dataEmpty}
-							grid={grid}
-							title={`${extraFsName} I/O`}
-							description={t`Throughput of ${extraFsName}`}
-							cornerEl={maxValSelect}
-						>
-							<AreaChartDefault
-								chartData={chartData}
-								showTotal={true}
-								dataPoints={[
-									{
-										label: t`Write`,
-										dataKey: ({ stats }) => {
-											if (showMax) {
-												return stats?.efs?.[extraFsName]?.wbm || (stats?.efs?.[extraFsName]?.wm ?? 0) * 1024 * 1024
-											}
-											return stats?.efs?.[extraFsName]?.wb || (stats?.efs?.[extraFsName]?.w ?? 0) * 1024 * 1024
-										},
-										color: 3,
-										opacity: 0.3,
-									},
-									{
-										label: t`Read`,
-										dataKey: ({ stats }) => {
-											if (showMax) {
-												return stats?.efs?.[extraFsName]?.rbm ?? (stats?.efs?.[extraFsName]?.rm ?? 0) * 1024 * 1024
-											}
-											return stats?.efs?.[extraFsName]?.rb ?? (stats?.efs?.[extraFsName]?.r ?? 0) * 1024 * 1024
-										},
-										color: 1,
-										opacity: 0.3,
-									},
-								]}
-								maxToggled={showMax}
-								tickFormatter={(val) => {
-									const { value, unit } = formatBytes(val, true, userSettings.unitDisk, false)
-									return `${toFixedFloat(value, value >= 10 ? 0 : 1)} ${unit}`
-								}}
-								contentFormatter={({ value }) => {
-									const { value: convertedValue, unit } = formatBytes(value, true, userSettings.unitDisk, false)
-									return `${decimalString(convertedValue, convertedValue >= 100 ? 1 : 2)} ${unit}`
-								}}
-							/>
-						</ChartCard>
-					</div>
-				)
-			})}
-		</div>
-	)
-}

internal/site/src/components/routes/system/disk-io-sheet.tsx

@@ -0,0 +1,257 @@
+import { t } from "@lingui/core/macro"
+import { useStore } from "@nanostores/react"
+import { MoreHorizontalIcon } from "lucide-react"
+import { memo, useRef, useState } from "react"
+import AreaChartDefault from "@/components/charts/area-chart"
+import ChartTimeSelect from "@/components/charts/chart-time-select"
+import { Button } from "@/components/ui/button"
+import { Sheet, SheetContent, SheetTrigger } from "@/components/ui/sheet"
+import { DialogTitle } from "@/components/ui/dialog"
+import { $userSettings } from "@/lib/stores"
+import { decimalString, formatBytes, toFixedFloat } from "@/lib/utils"
+import { ChartCard, SelectAvgMax } from "@/components/routes/system/chart-card"
+import type { SystemData } from "@/components/routes/system/use-system-data"
+import { diskDataFns, DiskUtilizationChart } from "./charts/disk-charts"
+import { pinnedAxisDomain } from "@/components/ui/chart"
+
+export default memo(function DiskIOSheet({
+	systemData,
+	extraFsName,
+	title,
+	description,
+}: {
+	systemData: SystemData
+	extraFsName?: string
+	title: string
+	description: string
+}) {
+	const { chartData, grid, dataEmpty, showMax, maxValues, isLongerChart } = systemData
+	const userSettings = useStore($userSettings)
+
+	const [sheetOpen, setSheetOpen] = useState(false)
+
+	const hasOpened = useRef(false)
+
+	if (sheetOpen && !hasOpened.current) {
+		hasOpened.current = true
+	}
+
+	// throughput functions, with extra fs variants if needed
+	let readFn = showMax ? diskDataFns.readMax : diskDataFns.read
+	let writeFn = showMax ? diskDataFns.writeMax : diskDataFns.write
+	if (extraFsName) {
+		readFn = showMax ? diskDataFns.extraReadMax(extraFsName) : diskDataFns.extraRead(extraFsName)
+		writeFn = showMax ? diskDataFns.extraWriteMax(extraFsName) : diskDataFns.extraWrite(extraFsName)
+	}
+
+	// read and write time functions, with extra fs variants if needed
+	let readTimeFn = showMax ? diskDataFns.readTimeMax : diskDataFns.readTime
+	let writeTimeFn = showMax ? diskDataFns.writeTimeMax : diskDataFns.writeTime
+	if (extraFsName) {
+		readTimeFn = showMax ? diskDataFns.extraReadTimeMax(extraFsName) : diskDataFns.extraReadTime(extraFsName)
+		writeTimeFn = showMax ? diskDataFns.extraWriteTimeMax(extraFsName) : diskDataFns.extraWriteTime(extraFsName)
+	}
+
+	// I/O await functions, with extra fs variants if needed
+	let rAwaitFn = showMax ? diskDataFns.rAwaitMax : diskDataFns.rAwait
+	let wAwaitFn = showMax ? diskDataFns.wAwaitMax : diskDataFns.wAwait
+	if (extraFsName) {
+		rAwaitFn = showMax ? diskDataFns.extraRAwaitMax(extraFsName) : diskDataFns.extraRAwait(extraFsName)
+		wAwaitFn = showMax ? diskDataFns.extraWAwaitMax(extraFsName) : diskDataFns.extraWAwait(extraFsName)
+	}
+
+	// weighted I/O function, with extra fs variant if needed
+	let weightedIOFn = showMax ? diskDataFns.weightedIOMax : diskDataFns.weightedIO
+	if (extraFsName) {
+		weightedIOFn = showMax ? diskDataFns.extraWeightedIOMax(extraFsName) : diskDataFns.extraWeightedIO(extraFsName)
+	}
+
+	// check for availability of I/O metrics
+	let hasUtilization = false
+	let hasAwait = false
+	let hasWeightedIO = false
+	for (const record of chartData.systemStats ?? []) {
+		const dios = record.stats?.dios
+		if ((dios?.at(2) ?? 0) > 0) hasUtilization = true
+		if ((dios?.at(3) ?? 0) > 0) hasAwait = true
+		if ((dios?.at(5) ?? 0) > 0) hasWeightedIO = true
+		if (hasUtilization && hasAwait && hasWeightedIO) {
+			break
+		}
+	}
+
+	const maxValSelect = isLongerChart ? <SelectAvgMax max={maxValues} /> : null
+
+	const chartProps = { syncId: "io" }
+
+	return (
+		<Sheet open={sheetOpen} onOpenChange={setSheetOpen}>
+			<DialogTitle className="sr-only">{title}</DialogTitle>
+			<SheetTrigger asChild>
+				<Button
+					title={t`View more`}
+					variant="outline"
+					size="icon"
+					className="shrink-0 max-sm:absolute max-sm:top-0 max-sm:end-0"
+				>
+					<MoreHorizontalIcon />
+				</Button>
+			</SheetTrigger>
+			{hasOpened.current && (
+				<SheetContent aria-describedby={undefined} className="overflow-auto w-200 !max-w-full p-4 sm:p-6">
+					<ChartTimeSelect className="w-[calc(100%-2em)] bg-card" agentVersion={chartData.agentVersion} />
+
+					<ChartCard
+						className="min-h-auto"
+						empty={dataEmpty}
+						grid={grid}
+						title={title}
+						description={description}
+						cornerEl={maxValSelect}
+						// legend={true}
+					>
+						<AreaChartDefault
+							chartData={chartData}
+							maxToggled={showMax}
+							chartProps={chartProps}
+							showTotal={true}
+							domain={pinnedAxisDomain()}
+							itemSorter={(a, b) => a.order - b.order}
+							reverseStackOrder={true}
+							dataPoints={[
+								{
+									label: t({ message: "Write", comment: "Disk write" }),
+									dataKey: writeFn,
+									color: 3,
+									opacity: 0.4,
+									stackId: 0,
+									order: 0,
+								},
+								{
+									label: t({ message: "Read", comment: "Disk read" }),
+									dataKey: readFn,
+									color: 1,
+									opacity: 0.4,
+									stackId: 0,
+									order: 1,
+								},
+							]}
+							tickFormatter={(val) => {
+								const { value, unit } = formatBytes(val, true, userSettings.unitDisk, false)
+								return `${toFixedFloat(value, value >= 10 ? 0 : 1)} ${unit}`
+							}}
+							contentFormatter={({ value }) => {
+								const { value: convertedValue, unit } = formatBytes(value, true, userSettings.unitDisk, false)
+								return `${decimalString(convertedValue, convertedValue >= 100 ? 1 : 2)} ${unit}`
+							}}
+						/>
+					</ChartCard>
+
+					{hasUtilization && <DiskUtilizationChart systemData={systemData} extraFsName={extraFsName} />}
+
+					<ChartCard
+						empty={dataEmpty}
+						grid={grid}
+						title={t`I/O Time`}
+						description={t`Total time spent on read/write (can exceed 100%)`}
+						className="min-h-auto"
+						cornerEl={maxValSelect}
+					>
+						<AreaChartDefault
+							chartData={chartData}
+							domain={pinnedAxisDomain()}
+							tickFormatter={(val) => `${toFixedFloat(val, 2)}%`}
+							contentFormatter={({ value }) => `${decimalString(value)}%`}
+							maxToggled={showMax}
+							chartProps={chartProps}
+							showTotal={true}
+							itemSorter={(a, b) => a.order - b.order}
+							reverseStackOrder={true}
+							dataPoints={[
+								{
+									label: t`Write`,
+									dataKey: writeTimeFn,
+									color: 3,
+									opacity: 0.4,
+									stackId: 0,
+									order: 0,
+								},
+								{
+									label: t`Read`,
+									dataKey: readTimeFn,
+									color: 1,
+									opacity: 0.4,
+									stackId: 0,
+									order: 1,
+								},
+							]}
+						/>
+					</ChartCard>
+
+					{hasWeightedIO && (
+						<ChartCard
+							empty={dataEmpty}
+							grid={grid}
+							title={t`Average Queue Depth`}
+							description={t`Average number of I/O operations waiting to be serviced`}
+							className="min-h-auto"
+							cornerEl={maxValSelect}
+						>
+							<AreaChartDefault
+								chartData={chartData}
+								domain={pinnedAxisDomain()}
+								tickFormatter={(val) => `${toFixedFloat(val, 2)}`}
+								contentFormatter={({ value }) => decimalString(value, value < 10 ? 3 : 2)}
+								maxToggled={showMax}
+								chartProps={chartProps}
+								dataPoints={[
+									{
+										label: t`Queue Depth`,
+										dataKey: weightedIOFn,
+										color: 1,
+										opacity: 0.4,
+									},
+								]}
+							/>
+						</ChartCard>
+					)}
+
+					{hasAwait && (
+						<ChartCard
+							empty={dataEmpty}
+							grid={grid}
+							title={t`I/O Await`}
+							description={t`Average service time per operation`}
+							className="min-h-auto"
+							cornerEl={maxValSelect}
+							// legend={true}
+						>
+							<AreaChartDefault
+								chartData={chartData}
+								domain={pinnedAxisDomain()}
+								tickFormatter={(val) => `${toFixedFloat(val, 2)} ms`}
+								contentFormatter={({ value }) => `${decimalString(value)} ms`}
+								maxToggled={showMax}
+								chartProps={chartProps}
+								dataPoints={[
+									{
+										label: t`Write`,
+										dataKey: wAwaitFn,
+										color: 3,
+										opacity: 0.3,
+									},
+									{
+										label: t`Read`,
+										dataKey: rAwaitFn,
+										color: 1,
+										opacity: 0.3,
+									},
+								]}
+							/>
+						</ChartCard>
+					)}
+				</SheetContent>
+			)}
+		</Sheet>
+	)
+})

internal/site/src/components/routes/system/smart-table.tsx

@@ -36,7 +36,7 @@ import { Input } from "@/components/ui/input"
 import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table"
 import { Badge } from "@/components/ui/badge"
 import { Button } from "@/components/ui/button"
-import { pb } from "@/lib/api"
+import { isReadOnlyUser, pb } from "@/lib/api"
 import type { SmartDeviceRecord, SmartAttribute } from "@/types"
 import {
 	formatBytes,
@@ -492,7 +492,7 @@ export default function DisksTable({ systemId }: { systemId?: string }) {
 	const tableColumns = useMemo(() => {
 		const columns = createColumns(longestName, longestModel, longestDevice)
 		const baseColumns = systemId ? columns.filter((col) => col.id !== "system") : columns
-		return [...baseColumns, actionColumn]
+		return isReadOnlyUser() ? baseColumns : [...baseColumns, actionColumn]
 	}, [systemId, actionColumn, longestName, longestModel, longestDevice])
 
 	const table = useReactTable({

internal/site/src/components/routes/system/use-system-data.ts

@@ -28,6 +28,8 @@ import type {
 import { $router, navigate } from "../../router"
 import { appendData, cache, getStats, getTimeData, makeContainerData, makeContainerPoint } from "./chart-data"
 
+export type SystemData = ReturnType<typeof useSystemData>
+
 export function useSystemData(id: string) {
 	const direction = useStore($direction)
 	const systems = useStore($systems)

internal/site/src/components/systems-table/systems-table.tsx

@@ -460,14 +460,14 @@ const SystemCard = memo(
 						}
 					)}
 				>
-					<CardHeader className="py-1 ps-5 pe-3 bg-muted/30 border-b border-border/60">
+					<CardHeader className="py-1 ps-4 pe-2 bg-muted/30 border-b border-border/60">
-						<div className="flex items-center gap-2 w-full overflow-hidden">
+						<div className="flex items-center gap-1 w-full overflow-hidden">
-							<CardTitle className="text-base tracking-normal text-primary/90 flex items-center min-w-0 flex-1 gap-2.5">
+							<h3 className="text-primary/90 min-w-0 flex-1 gap-2.5 font-semibold">
 								<div className="flex items-center gap-2.5 min-w-0 flex-1">
 									<IndicatorDot system={system} />
 									<span className="text-[.95em]/normal tracking-normal text-primary/90 truncate">{system.name}</span>
 								</div>
-							</CardTitle>
+							</h3>
 							{table.getColumn("actions")?.getIsVisible() && (
 								<div className="flex gap-1 shrink-0 relative z-10">
 									<AlertButton system={system} />

internal/site/src/components/ui/alert-dialog.tsx

@@ -43,7 +43,7 @@ const AlertDialogContent = React.forwardRef<
 AlertDialogContent.displayName = AlertDialogPrimitive.Content.displayName
 
 const AlertDialogHeader = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>) => (
-	<div className={cn("grid gap-2 text-center sm:text-start", className)} {...props} />
+	<div className={cn("grid gap-2 text-start", className)} {...props} />
 )
 AlertDialogHeader.displayName = "AlertDialogHeader"
 

internal/site/src/components/ui/card.tsx

@@ -18,11 +18,7 @@ CardHeader.displayName = "CardHeader"
 
 const CardTitle = React.forwardRef<HTMLParagraphElement, React.HTMLAttributes<HTMLHeadingElement>>(
 	({ className, ...props }, ref) => (
-		<h3
+		<h3 ref={ref} className={cn("text-card-title font-semibold leading-none tracking-tight", className)} {...props} />
-			ref={ref}
-			className={cn("text-[1.4em] sm:text-2xl font-semibold leading-none tracking-tight", className)}
-			{...props}
-		/>
 	)
 )
 CardTitle.displayName = "CardTitle"

internal/site/src/components/ui/dialog.tsx

@@ -52,7 +52,7 @@ const DialogContent = React.forwardRef<
 DialogContent.displayName = DialogPrimitive.Content.displayName
 
 const DialogHeader = ({ className, ...props }: React.HTMLAttributes<HTMLDivElement>) => (
-	<div className={cn("grid gap-1.5 text-center sm:text-start", className)} {...props} />
+	<div className={cn("grid gap-1.5 text-start", className)} {...props} />
 )
 DialogHeader.displayName = "DialogHeader"
 

internal/site/src/index.css

@@ -177,6 +177,10 @@
 	}
 }
 
+@utility text-card-title {
+	@apply text-[1.4rem] sm:text-2xl;
+}
+
 .recharts-tooltip-wrapper {
 	z-index: 51;
 	@apply tabular-nums;

internal/site/src/types.d.ts

@@ -124,6 +124,10 @@ export interface SystemStats {
 	dio?: [number, number]
 	/** max disk I/O bytes [read, write] */
 	diom?: [number, number]
+	/** disk io stats [read time factor, write time factor, io utilization %, r_await ms, w_await ms, weighted io %] */
+	dios?: [number, number, number, number, number, number]
+	/** max disk io stats */
+	diosm?: [number, number, number, number, number, number]
 	/** network sent (mb) */
 	ns: number
 	/** network received (mb) */
@@ -186,6 +190,10 @@ export interface ExtraFsStats {
 	rbm: number
 	/** max write per second (mb) */
 	wbm: number
+	/** disk io stats [read time factor, write time factor, io utilization %, r_await ms, w_await ms, weighted io %] */
+	dios?: [number, number, number, number, number, number]
+	/** max disk io stats */
+	diosm?: [number, number, number, number, number, number]
 }
 
 export interface ContainerStatsRecord extends RecordModel {
@@ -413,118 +421,118 @@ export interface SystemdRecord extends RecordModel {
 }
 
 export interface SystemdServiceDetails {
-	AccessSELinuxContext: string;
+	AccessSELinuxContext: string
-	ActivationDetails: any[];
+	ActivationDetails: any[]
-	ActiveEnterTimestamp: number;
+	ActiveEnterTimestamp: number
-	ActiveEnterTimestampMonotonic: number;
+	ActiveEnterTimestampMonotonic: number
-	ActiveExitTimestamp: number;
+	ActiveExitTimestamp: number
-	ActiveExitTimestampMonotonic: number;
+	ActiveExitTimestampMonotonic: number
-	ActiveState: string;
+	ActiveState: string
-	After: string[];
+	After: string[]
-	AllowIsolate: boolean;
+	AllowIsolate: boolean
-	AssertResult: boolean;
+	AssertResult: boolean
-	AssertTimestamp: number;
+	AssertTimestamp: number
-	AssertTimestampMonotonic: number;
+	AssertTimestampMonotonic: number
-	Asserts: any[];
+	Asserts: any[]
-	Before: string[];
+	Before: string[]
-	BindsTo: any[];
+	BindsTo: any[]
-	BoundBy: any[];
+	BoundBy: any[]
-	CPUUsageNSec: number;
+	CPUUsageNSec: number
-	CanClean: any[];
+	CanClean: any[]
-	CanFreeze: boolean;
+	CanFreeze: boolean
-	CanIsolate: boolean;
+	CanIsolate: boolean
-	CanLiveMount: boolean;
+	CanLiveMount: boolean
-	CanReload: boolean;
+	CanReload: boolean
-	CanStart: boolean;
+	CanStart: boolean
-	CanStop: boolean;
+	CanStop: boolean
-	CollectMode: string;
+	CollectMode: string
-	ConditionResult: boolean;
+	ConditionResult: boolean
-	ConditionTimestamp: number;
+	ConditionTimestamp: number
-	ConditionTimestampMonotonic: number;
+	ConditionTimestampMonotonic: number
-	Conditions: any[];
+	Conditions: any[]
-	ConflictedBy: any[];
+	ConflictedBy: any[]
-	Conflicts: string[];
+	Conflicts: string[]
-	ConsistsOf: any[];
+	ConsistsOf: any[]
-	DebugInvocation: boolean;
+	DebugInvocation: boolean
-	DefaultDependencies: boolean;
+	DefaultDependencies: boolean
-	Description: string;
+	Description: string
-	Documentation: string[];
+	Documentation: string[]
-	DropInPaths: any[];
+	DropInPaths: any[]
-	ExecMainPID: number;
+	ExecMainPID: number
-	FailureAction: string;
+	FailureAction: string
-	FailureActionExitStatus: number;
+	FailureActionExitStatus: number
-	Following: string;
+	Following: string
-	FragmentPath: string;
+	FragmentPath: string
-	FreezerState: string;
+	FreezerState: string
-	Id: string;
+	Id: string
-	IgnoreOnIsolate: boolean;
+	IgnoreOnIsolate: boolean
-	InactiveEnterTimestamp: number;
+	InactiveEnterTimestamp: number
-	InactiveEnterTimestampMonotonic: number;
+	InactiveEnterTimestampMonotonic: number
-	InactiveExitTimestamp: number;
+	InactiveExitTimestamp: number
-	InactiveExitTimestampMonotonic: number;
+	InactiveExitTimestampMonotonic: number
-	InvocationID: string;
+	InvocationID: string
-	Job: Array<number | string>;
+	Job: Array<number | string>
-	JobRunningTimeoutUSec: number;
+	JobRunningTimeoutUSec: number
-	JobTimeoutAction: string;
+	JobTimeoutAction: string
-	JobTimeoutRebootArgument: string;
+	JobTimeoutRebootArgument: string
-	JobTimeoutUSec: number;
+	JobTimeoutUSec: number
-	JoinsNamespaceOf: any[];
+	JoinsNamespaceOf: any[]
-	LoadError: string[];
+	LoadError: string[]
-	LoadState: string;
+	LoadState: string
-	MainPID: number;
+	MainPID: number
-	Markers: any[];
+	Markers: any[]
-	MemoryCurrent: number;
+	MemoryCurrent: number
-	MemoryLimit: number;
+	MemoryLimit: number
-	MemoryPeak: number;
+	MemoryPeak: number
-	NRestarts: number;
+	NRestarts: number
-	Names: string[];
+	Names: string[]
-	NeedDaemonReload: boolean;
+	NeedDaemonReload: boolean
-	OnFailure: any[];
+	OnFailure: any[]
-	OnFailureJobMode: string;
+	OnFailureJobMode: string
-	OnFailureOf: any[];
+	OnFailureOf: any[]
-	OnSuccess: any[];
+	OnSuccess: any[]
-	OnSuccessJobMode: string;
+	OnSuccessJobMode: string
-	OnSuccessOf: any[];
+	OnSuccessOf: any[]
-	PartOf: any[];
+	PartOf: any[]
-	Perpetual: boolean;
+	Perpetual: boolean
-	PropagatesReloadTo: any[];
+	PropagatesReloadTo: any[]
-	PropagatesStopTo: any[];
+	PropagatesStopTo: any[]
-	RebootArgument: string;
+	RebootArgument: string
-	Refs: any[];
+	Refs: any[]
-	RefuseManualStart: boolean;
+	RefuseManualStart: boolean
-	RefuseManualStop: boolean;
+	RefuseManualStop: boolean
-	ReloadPropagatedFrom: any[];
+	ReloadPropagatedFrom: any[]
-	RequiredBy: any[];
+	RequiredBy: any[]
-	Requires: string[];
+	Requires: string[]
-	RequiresMountsFor: any[];
+	RequiresMountsFor: any[]
-	Requisite: any[];
+	Requisite: any[]
-	RequisiteOf: any[];
+	RequisiteOf: any[]
-	Result: string;
+	Result: string
-	SliceOf: any[];
+	SliceOf: any[]
-	SourcePath: string;
+	SourcePath: string
-	StartLimitAction: string;
+	StartLimitAction: string
-	StartLimitBurst: number;
+	StartLimitBurst: number
-	StartLimitIntervalUSec: number;
+	StartLimitIntervalUSec: number
-	StateChangeTimestamp: number;
+	StateChangeTimestamp: number
-	StateChangeTimestampMonotonic: number;
+	StateChangeTimestampMonotonic: number
-	StopPropagatedFrom: any[];
+	StopPropagatedFrom: any[]
-	StopWhenUnneeded: boolean;
+	StopWhenUnneeded: boolean
-	SubState: string;
+	SubState: string
-	SuccessAction: string;
+	SuccessAction: string
-	SuccessActionExitStatus: number;
+	SuccessActionExitStatus: number
-	SurviveFinalKillSignal: boolean;
+	SurviveFinalKillSignal: boolean
-	TasksCurrent: number;
+	TasksCurrent: number
-	TasksMax: number;
+	TasksMax: number
-	Transient: boolean;
+	Transient: boolean
-	TriggeredBy: string[];
+	TriggeredBy: string[]
-	Triggers: any[];
+	Triggers: any[]
-	UnitFilePreset: string;
+	UnitFilePreset: string
-	UnitFileState: string;
+	UnitFileState: string
-	UpheldBy: any[];
+	UpheldBy: any[]
-	Upholds: any[];
+	Upholds: any[]
-	WantedBy: any[];
+	WantedBy: any[]
-	Wants: string[];
+	Wants: string[]
-	WantsMountsFor: any[];
+	WantsMountsFor: any[]
 }
 
 export interface BeszelInfo {

internal/tests/hub.go

@@ -77,6 +77,16 @@ func CreateUser(app core.App, email string, password string) (*core.Record, erro
 	return user, app.Save(user)
 }
 
+// Helper function to create a test superuser for config tests
+func CreateSuperuser(app core.App, email string, password string) (*core.Record, error) {
+	superusersCollection, _ := app.FindCachedCollectionByNameOrId(core.CollectionNameSuperusers)
+	superuser := core.NewRecord(superusersCollection)
+	superuser.Set("email", email)
+	superuser.Set("password", password)
+
+	return superuser, app.Save(superuser)
+}
+
 func CreateUserWithRole(app core.App, email string, password string, roleName string) (*core.Record, error) {
 	user, err := CreateUser(app, email, password)
 	if err != nil {

supplemental/scripts/install-agent.sh

@@ -12,6 +12,10 @@ is_freebsd() {
   [ "$(uname -s)" = "FreeBSD" ]
 }
 
+is_opnsense() {
+  [ -f /usr/local/sbin/opnsense-version ] || [ -f /usr/local/etc/opnsense-version ] || [ -f /etc/opnsense-release ]
+}
+
 is_glibc() {
   # Prefer glibc-enabled agent (NVML via purego) on linux/amd64 glibc systems.
   # Check common dynamic loader paths first (fast + reliable).
@@ -549,6 +553,7 @@ else
 fi
 
 # Create a dedicated user for the service if it doesn't exist
+AGENT_USER="beszel"
 echo "Configuring the dedicated user for the Beszel Agent service..."
 if is_alpine; then
   if ! id -u beszel >/dev/null 2>&1; then
@@ -590,13 +595,18 @@ elif is_openwrt; then
   fi
 
 elif is_freebsd; then
-  if ! id -u beszel >/dev/null 2>&1; then
+  if is_opnsense; then
-    pw user add beszel -d /nonexistent -s /usr/sbin/nologin -c "beszel user"
+    echo "OPNsense detected: skipping user creation (using daemon user instead)"
-  fi
+    AGENT_USER="daemon"
-  # Add the user to the wheel group to allow self-updates
+  else
-  if pw group show wheel >/dev/null 2>&1; then
+    if ! id -u beszel >/dev/null 2>&1; then
-    echo "Adding beszel to wheel group for self-updates"
+      pw user add beszel -d /nonexistent -s /usr/sbin/nologin -c "beszel user"
-    pw group mod wheel -m beszel
+    fi
+    # Add the user to the wheel group to allow self-updates
+    if pw group show wheel >/dev/null 2>&1; then
+      echo "Adding beszel to wheel group for self-updates"
+      pw group mod wheel -m beszel
+    fi
   fi
 
 else
@@ -620,7 +630,7 @@ fi
 if [ ! -d "$AGENT_DIR" ]; then
   echo "Creating the directory for the Beszel Agent..."
   mkdir -p "$AGENT_DIR"
-  chown beszel:beszel "$AGENT_DIR"
+  chown "${AGENT_USER}:${AGENT_USER}" "$AGENT_DIR"
   chmod 755 "$AGENT_DIR"
 fi
 
@@ -899,7 +909,7 @@ TOKEN=$TOKEN
 HUB_URL=$HUB_URL
 EOF
     chmod 640 "$AGENT_DIR/env"
-    chown root:beszel "$AGENT_DIR/env"
+    chown "root:${AGENT_USER}" "$AGENT_DIR/env"
   else
     echo "FreeBSD environment file already exists. Skipping creation."
   fi
@@ -917,6 +927,7 @@ EOF
   # Enable and start the service
   echo "Enabling and starting the agent service..."
   sysrc beszel_agent_enable="YES"
+  sysrc beszel_agent_user="${AGENT_USER}"
   service beszel-agent restart
   
   # Check if service started successfully