New translations en.po (German)

[ci skip]

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+

.github/workflows/docker-images.yml

@@ -41,7 +41,7 @@ jobs:
           # henrygd/beszel-agent-nvidia
           - image: henrygd/beszel-agent-nvidia
             dockerfile: ./internal/dockerfile_agent_nvidia
-            platforms: linux/amd64
+            platforms: linux/amd64,linux/arm64
             registry: docker.io
             username_secret: DOCKERHUB_USERNAME
             password_secret: DOCKERHUB_TOKEN
@@ -52,6 +52,19 @@ jobs:
               type=semver,pattern={{major}}
               type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
 
+          # henrygd/beszel-agent-nvidia:slim
+          - image: henrygd/beszel-agent-nvidia
+            dockerfile: ./internal/dockerfile_agent_nvidia_slim
+            platforms: linux/amd64,linux/arm64
+            registry: docker.io
+            username_secret: DOCKERHUB_USERNAME
+            password_secret: DOCKERHUB_TOKEN
+            tags: |
+              type=raw,value=slim
+              type=semver,pattern={{version}}-slim
+              type=semver,pattern={{major}}.{{minor}}-slim
+              type=semver,pattern={{major}}-slim
+
           # henrygd/beszel-agent-intel
           - image: henrygd/beszel-agent-intel
             dockerfile: ./internal/dockerfile_agent_intel
@@ -96,7 +109,7 @@ jobs:
           # ghcr.io/henrygd/beszel-agent-nvidia
           - image: ghcr.io/${{ github.repository }}/beszel-agent-nvidia
             dockerfile: ./internal/dockerfile_agent_nvidia
-            platforms: linux/amd64
+            platforms: linux/amd64,linux/arm64
             registry: ghcr.io
             username: ${{ github.actor }}
             password_secret: GITHUB_TOKEN
@@ -107,6 +120,19 @@ jobs:
               type=semver,pattern={{major}}
               type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}
 
+          # ghcr.io/henrygd/beszel-agent-nvidia:slim
+          - image: ghcr.io/${{ github.repository }}/beszel-agent-nvidia
+            dockerfile: ./internal/dockerfile_agent_nvidia_slim
+            platforms: linux/amd64,linux/arm64
+            registry: ghcr.io
+            username: ${{ github.actor }}
+            password_secret: GITHUB_TOKEN
+            tags: |
+              type=raw,value=slim
+              type=semver,pattern={{version}}-slim
+              type=semver,pattern={{major}}.{{minor}}-slim
+              type=semver,pattern={{major}}-slim
+
           # ghcr.io/henrygd/beszel-agent-intel
           - image: ghcr.io/${{ github.repository }}/beszel-agent-intel
             dockerfile: ./internal/dockerfile_agent_intel
@@ -152,7 +178,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up bun
         uses: oven-sh/setup-bun@v2
@@ -164,14 +190,14 @@ jobs:
         run: bun run --cwd ./internal/site build
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Docker metadata
         id: metadata
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ${{ matrix.image }}
           tags: ${{ matrix.tags }}
@@ -181,7 +207,7 @@ jobs:
         env:
           password_secret_exists: ${{ secrets[matrix.password_secret] != '' && 'true' || 'false' }}
         if: github.event_name != 'pull_request' && env.password_secret_exists == 'true'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ matrix.username || secrets[matrix.username_secret] }}
           password: ${{ secrets[matrix.password_secret] }}
@@ -190,11 +216,13 @@ jobs:
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v7
         with:
           context: ./
           file: ${{ matrix.dockerfile }}
-          platforms: ${{ matrix.platforms || 'linux/amd64,linux/arm64,linux/arm/v7' }}
+          platforms: ${{ matrix.platforms || 'linux/amd64,linux/arm64,linux/arm/v6,linux/arm/v7' }}
           push: ${{ github.ref_type == 'tag' && secrets[matrix.password_secret] != '' }}
+          provenance: mode=max
+          sbom: true
           tags: ${{ steps.metadata.outputs.tags }}
           labels: ${{ steps.metadata.outputs.labels }}

.github/workflows/helm-charts.yml

@@ -0,0 +1,109 @@
+name: Helm charts
+
+on:
+  pull_request:
+    paths:
+      - "supplemental/helm/**"
+  push:
+    branches:
+      - main
+    paths:
+      - "supplemental/helm/**"
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  OCI_REGISTRY: ghcr.io/henrygd/beszel-charts
+
+jobs:
+  changes:
+    name: Detect changed charts
+    runs-on: ubuntu-latest
+    outputs:
+      charts: ${{ steps.changes.outputs.charts }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Detect changed charts
+        id: changes
+        env:
+          BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          charts=()
+
+          for name in beszel-agent beszel-hub; do
+            path="supplemental/helm/$name"
+            if ! git diff --quiet "$BASE_SHA" "$GITHUB_SHA" -- "$path"; then
+              charts+=("$name|$path")
+            fi
+          done
+
+          printf '%s\n' "${charts[@]}" \
+            | jq -Rsc 'split("\n") | map(select(length > 0) | split("|") | {name: .[0], path: .[1]})' \
+            | xargs -0 printf 'charts=%s\n' >> "$GITHUB_OUTPUT"
+
+  validate-and-publish:
+    name: ${{ github.event_name == 'push' && 'Publish' || 'Validate' }} ${{ matrix.chart.name }}
+    needs: changes
+    if: needs.changes.outputs.charts != '[]'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        chart: ${{ fromJSON(needs.changes.outputs.charts) }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v5
+
+      - name: Lint chart
+        run: helm lint "${{ matrix.chart.path }}" --set env.KEY=ci-placeholder
+
+      - name: Render chart
+        run: helm template "${{ matrix.chart.name }}" "${{ matrix.chart.path }}" --set env.KEY=ci-placeholder > /dev/null
+
+      - name: Package chart
+        id: package
+        env:
+          CHART_NAME: ${{ matrix.chart.name }}
+          CHART_PATH: ${{ matrix.chart.path }}
+        run: |
+          version=$(awk '/^version:/ { print $2 }' "$CHART_PATH/Chart.yaml")
+          test -n "$version"
+
+          mkdir -p .helm-packages
+          helm package "$CHART_PATH" --destination .helm-packages
+
+          package=".helm-packages/${CHART_NAME}-${version}.tgz"
+          test -f "$package"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "package=$package" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to GHCR
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: echo "$GITHUB_TOKEN" | helm registry login ghcr.io --username "$GITHUB_ACTOR" --password-stdin
+
+      - name: Check chart version is unpublished
+        env:
+          CHART_NAME: ${{ matrix.chart.name }}
+          CHART_VERSION: ${{ steps.package.outputs.version }}
+        run: |
+          chart="oci://${OCI_REGISTRY}/${CHART_NAME}"
+          if helm show chart "$chart" --version "$CHART_VERSION" > /dev/null 2>&1; then
+            echo "${CHART_NAME} ${CHART_VERSION} is already published. Bump version in Chart.yaml." >&2
+            exit 1
+          fi
+
+      - name: Publish chart
+        if: github.event_name == 'push'
+        run: helm push "${{ steps.package.outputs.package }}" "oci://${OCI_REGISTRY}"

.github/workflows/inactivity-actions.yml

@@ -15,7 +15,7 @@ jobs:
     name: Lock Inactive Issues
     runs-on: ubuntu-24.04
     steps:
-      - uses: klaasnicolaas/action-inactivity-lock@v1.1.3
+      - uses: klaasnicolaas/action-inactivity-lock@v2.0.1
         id: lock
         with:
           days-inactive-issues: 14
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Close Stale Issues
-        uses: actions/stale@v10
+        uses: actions/stale@v11
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/release.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -27,12 +27,12 @@ jobs:
         run: bun run --cwd ./internal/site build
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
-          go-version: "^1.22.1"
+          go-version: stable
 
       - name: Set up .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: "9.0.x"
 
@@ -42,7 +42,7 @@ jobs:
         shell: bash
 
       - name: GoReleaser beszel
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@v7
         with:
           workdir: ./
           distribution: goreleaser

.github/workflows/update-helm-charts.yml

@@ -0,0 +1,101 @@
+name: Update Helm charts
+
+on:
+  release:
+    types:
+      - published
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: update-helm-charts
+  cancel-in-progress: false
+
+jobs:
+  update:
+    name: Propose chart update
+    if: ${{ github.repository_owner == 'henrygd' && startsWith(github.event.release.tag_name, 'v') && !github.event.release.prerelease }}
+    runs-on: ubuntu-latest
+    env:
+      BRANCH: automation/update-helm-app-version
+      RELEASE_TAG: ${{ github.event.release.tag_name }}
+      AUTOMATION_TOKEN: ${{ secrets.CR_TOKEN || github.token }}
+
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v7
+        with:
+          ref: main
+          token: ${{ env.AUTOMATION_TOKEN }}
+
+      - name: Update chart versions
+        id: update
+        run: |
+          version="${RELEASE_TAG#v}"
+          if [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Unsupported software release version: $version" >&2
+            exit 1
+          fi
+
+          changed=false
+          for chart in supplemental/helm/beszel-agent supplemental/helm/beszel-hub; do
+            current_app_version=$(awk -F '"' '/^appVersion:/ { print $2 }' "$chart/Chart.yaml")
+            if [[ "$current_app_version" == "$version" ]]; then
+              echo "$chart already uses appVersion $version"
+              continue
+            fi
+
+            newest_version=$(printf '%s\n' "$current_app_version" "$version" | sort -V | tail -n 1)
+            if [[ "$newest_version" != "$version" ]]; then
+              echo "Skipping stale update of $chart from $current_app_version to $version"
+              continue
+            fi
+
+            chart_version=$(awk '/^version:/ { print $2 }' "$chart/Chart.yaml")
+            if [[ ! "$chart_version" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+              echo "Unsupported chart version in $chart/Chart.yaml: $chart_version" >&2
+              exit 1
+            fi
+            next_chart_version="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.$((BASH_REMATCH[3] + 1))"
+
+            NEW_APP_VERSION="$version" NEW_CHART_VERSION="$next_chart_version" \
+              perl -pi -e 's/^appVersion:.*$/appVersion: "$ENV{NEW_APP_VERSION}"/; s/^version:.*$/version: $ENV{NEW_CHART_VERSION}/' \
+              "$chart/Chart.yaml"
+            OLD_APP_VERSION="$current_app_version" NEW_APP_VERSION="$version" \
+              perl -pi -e 's/\Q$ENV{OLD_APP_VERSION}\E/$ENV{NEW_APP_VERSION}/g' "$chart/README.md"
+
+            echo "$chart: appVersion $current_app_version -> $version, chart $chart_version -> $next_chart_version"
+            changed=true
+          done
+
+          echo "changed=$changed" >> "$GITHUB_OUTPUT"
+
+      - name: Open or update pull request
+        if: steps.update.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ env.AUTOMATION_TOKEN }}
+        run: |
+          version="${RELEASE_TAG#v}"
+          title="chore(helm): update app version to ${version}"
+          body="Updates the Helm charts for [Beszel ${version}](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/tag/${RELEASE_TAG}) and bumps their chart patch versions. Merging this pull request publishes the updated charts to GHCR."
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -B "$BRANCH"
+          git add supplemental/helm/beszel-agent/Chart.yaml \
+            supplemental/helm/beszel-agent/README.md \
+            supplemental/helm/beszel-hub/Chart.yaml \
+            supplemental/helm/beszel-hub/README.md
+          git commit -m "$title"
+
+          git fetch origin "$BRANCH" || true
+          git push --force-with-lease origin "HEAD:refs/heads/${BRANCH}"
+
+          pr_number=$(gh pr list --head "$BRANCH" --base main --state open --json number --jq '.[0].number')
+          if [[ -n "$pr_number" ]]; then
+            gh pr edit "$pr_number" --title "$title" --body "$body"
+          else
+            gh pr create --base main --head "$BRANCH" --title "$title" --body "$body"
+          fi

.github/workflows/vulncheck.yml

@@ -2,10 +2,6 @@
 
 name: VulnCheck
 on:
-  pull_request:
-    branches:
-      - main
-
   push:
     branches:
       - main
@@ -19,11 +15,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
         with:
-          go-version: 1.26.x
+          go-version: stable
           # cached: false
       - name: Get official govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest

.gitignore

@@ -3,7 +3,6 @@ pb_data
 data
 temp
 .vscode
-beszel-agent
 beszel_data
 beszel_data*
 dist
@@ -21,3 +20,5 @@ __debug_*
 agent/lhm/obj
 agent/lhm/bin
 dockerfile_agent_dev
+.cr-release-packages
+.tmp

.goreleaser.yml

@@ -31,12 +31,16 @@ builds:
         goarch: arm64
       - goos: freebsd
         goarch: arm
+      - goos: darwin
+        goarch: arm
 
   - id: beszel-agent
     binary: beszel-agent
     main: internal/cmd/agent/agent.go
     env:
       - CGO_ENABLED=0
+    ldflags:
+      - -s -w -X github.com/henrygd/beszel/internal/ghupdate.buildGOARM={{ .Arm }}
     goos:
       - linux
       - darwin
@@ -52,6 +56,10 @@ builds:
       - mipsle
       - mips
       - ppc64le
+    goarm:
+      - "5"
+      - "6"
+      - "7"
     gomips:
       - hardfloat
       - softfloat
@@ -71,6 +79,8 @@ builds:
         gomips: hardfloat
       - goos: windows
         goarch: arm
+      - goos: darwin
+        goarch: arm
       - goos: darwin
         goarch: riscv64
       - goos: windows
@@ -97,6 +107,7 @@ archives:
       {{ .Binary }}_
       {{- .Os }}_
       {{- .Arch }}
+      {{- if ne .Arm "6" }}{{ with .Arm }}v{{ . }}{{ end }}{{ end }}
     format_overrides:
       - goos: windows
         formats: [zip]

Makefile

@@ -52,7 +52,7 @@ lint:
 	golangci-lint run
 
 test:
-	go test -tags=testing ./...
+	go test -tags='testing no_ui' ./...
 
 tidy:
 	go mod tidy

SECURITY.md

@@ -2,6 +2,8 @@
 
 ## Reporting a Vulnerability
 
-If you find a vulnerability in the latest version, please [submit a private advisory](https://github.com/henrygd/beszel/security/advisories/new).
+**PLEASE ONLY USE SECURITY ADVISORIES FOR REAL HIGH SEVERITY VULNERABILITIES.**
 
-If it's low severity (use best judgement) you may open an issue instead of an advisory.
+If you find a vulnerability in the latest version, and it is not high severity, open an issue instead of an advisory.
+
+I am overwhelmed with advisories, often erroneous, which are clearly found and written by AI. I don't have the capacity to review all of them.

agent/agent.go

@@ -48,6 +48,7 @@ type Agent struct {
 	keys                      []gossh.PublicKey                                     // SSH public keys
 	smartManager              *SmartManager                                         // Manages SMART data
 	systemdManager            *systemdManager                                       // Manages systemd services
+	storagePoolManager        *StoragePoolManager                                   // Manages storage pool and dataset data
 }
 
 // NewAgent creates a new agent with the given data directory for persisting data.
@@ -121,6 +122,19 @@ func NewAgent(dataDir ...string) (agent *Agent, err error) {
 	// initialize handler registry
 	agent.handlerRegistry = NewHandlerRegistry()
 
+	agent.storagePoolManager = newStoragePoolManager()
+
+	// Retain ZFS_INTERVAL for the shared storage pool detail refresh interval.
+	if zfsIntervalEnv, exists := utils.GetEnv("ZFS_INTERVAL"); exists {
+		if duration, err := time.ParseDuration(zfsIntervalEnv); err == nil && duration > 0 {
+			agent.storagePoolManager.detailInterval = duration
+			agent.systemDetails.ZfsInterval = duration
+			slog.Info("ZFS_INTERVAL", "duration", duration)
+		} else {
+			slog.Warn("Invalid ZFS_INTERVAL", "err", err)
+		}
+	}
+
 	// initialize disk info
 	agent.initializeDiskInfo()
 
@@ -187,13 +201,25 @@ func (a *Agent) gatherStats(options common.DataRequestOptions) *system.CombinedD
 		}
 		if a.systemdManager.hasFreshStats {
 			data.SystemdServices = a.systemdManager.getServiceStats(nil, false)
+			data.SystemdServicesUpdated = true
+			// Preserve an explicit zero count so the hub can distinguish a fresh
+			// empty snapshot from a response that omitted systemd data.
+			if totalCount == 0 {
+				data.Info.Services = []uint16{0, 0}
+			}
 		}
 	}
 
 	data.Stats.ExtraFs = make(map[string]*system.FsStats)
 	data.Info.ExtraFsPct = make(map[string]float64)
 	for name, stats := range a.fsStats {
-		if !stats.Root && stats.DiskTotal > 0 {
+		if stats.Root {
+			if stats.Name != "" {
+				data.Info.RootDiskName = stats.Name
+			}
+			continue
+		}
+		if stats.DiskTotal > 0 {
 			// Use custom name if available, otherwise use device name
 			key := name
 			if stats.Name != "" {

agent/battery/battery.go

@@ -1,6 +1,13 @@
-// Package battery provides functions to check if the system has a battery and return the charge state and percentage.
+// Package battery provides battery information for the host and connected devices.
 package battery
 
+import (
+	"errors"
+	"sort"
+	"strconv"
+	"strings"
+)
+
 const (
 	stateUnknown uint8 = iota
 	stateEmpty
@@ -9,3 +16,58 @@ const (
 	stateDischarging
 	stateIdle
 )
+
+// Battery is a readable battery reported by the operating system.
+type Battery struct {
+	Name                  string
+	Percent               uint8
+	State                 uint8
+	FullChargeCapacity    uint64
+	HasFullChargeCapacity bool
+	System                bool
+}
+
+var errNoBatteries = errors.New("no readable batteries")
+
+// normalizeBatteries supplies stable fallback names and disambiguates duplicates.
+func normalizeBatteries(batteries []Battery) []Battery {
+	nameCounts := make(map[string]int, len(batteries))
+	for i := range batteries {
+		// Names come from firmware (e.g. sysfs model_name) and are not guaranteed to
+		// be valid UTF-8. Invalid bytes are rejected when the hub decodes the CBOR
+		// payload, which drops every metric for the system, so strip them here.
+		name := strings.TrimSpace(strings.ToValidUTF8(batteries[i].Name, ""))
+		if name == "" {
+			name = "Battery " + strconv.Itoa(i+1)
+		}
+		nameCounts[name]++
+		if nameCounts[name] > 1 {
+			name += " (" + strconv.Itoa(nameCounts[name]) + ")"
+		}
+		batteries[i].Name = name
+	}
+	return batteries
+}
+
+// Primary returns the representative battery. Reported full-charge capacity wins,
+// then system-scoped devices, then name for deterministic ties.
+func Primary(batteries []Battery) (Battery, bool) {
+	if len(batteries) == 0 {
+		return Battery{}, false
+	}
+	ordered := append([]Battery(nil), batteries...)
+	sort.SliceStable(ordered, func(i, j int) bool {
+		a, b := ordered[i], ordered[j]
+		if a.HasFullChargeCapacity != b.HasFullChargeCapacity {
+			return a.HasFullChargeCapacity
+		}
+		if a.HasFullChargeCapacity && a.FullChargeCapacity != b.FullChargeCapacity {
+			return a.FullChargeCapacity > b.FullChargeCapacity
+		}
+		if a.System != b.System {
+			return a.System
+		}
+		return a.Name < b.Name
+	})
+	return ordered[0], true
+}

agent/battery/battery_darwin.go

@@ -3,11 +3,7 @@
 package battery
 
 import (
-	"errors"
-	"log/slog"
-	"math"
 	"os/exec"
-	"sync"
 
 	"howett.net/plist"
 )
@@ -35,62 +31,46 @@ func readMacBatteries() ([]macBattery, error) {
 	return batteries, nil
 }
 
-// HasReadableBattery checks if the system has a battery and returns true if it does.
-var HasReadableBattery = sync.OnceValue(func() bool {
-	systemHasBattery := false
-	batteries, err := readMacBatteries()
-	slog.Debug("Batteries", "batteries", batteries, "err", err)
-	for _, bat := range batteries {
-		if bat.MaxCapacity > 0 {
-			systemHasBattery = true
-			break
-		}
-	}
-	return systemHasBattery
-})
+func HasReadableBattery() bool {
+	batteries, _ := GetBatteryStats()
+	return len(batteries) > 0
+}
 
-// GetBatteryStats returns the current battery percent and charge state.
-// Uses CurrentCapacity/MaxCapacity to match the value macOS displays.
-func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
-	if !HasReadableBattery() {
-		return batteryPercent, batteryState, errors.ErrUnsupported
-	}
+// GetBatteryStats returns every readable battery reported by macOS.
+func GetBatteryStats() ([]Battery, error) {
 	batteries, err := readMacBatteries()
+	if err != nil {
+		return nil, err
+	}
 	if len(batteries) == 0 {
-		return batteryPercent, batteryState, errors.New("no batteries")
+		return nil, errNoBatteries
 	}
-
-	totalCapacity := 0
-	totalCharge := 0
-	batteryState = math.MaxUint8
-
+	result := make([]Battery, 0, len(batteries))
 	for _, bat := range batteries {
-		if bat.MaxCapacity == 0 {
+		if bat.MaxCapacity <= 0 {
 			// skip ghost batteries with 0 capacity
 			// https://github.com/distatus/battery/issues/34
 			continue
 		}
-		totalCapacity += bat.MaxCapacity
-		totalCharge += min(bat.CurrentCapacity, bat.MaxCapacity)
-
+		percent := min(max(float64(bat.CurrentCapacity)/float64(bat.MaxCapacity)*100, 0), 100)
+		state := stateUnknown
 		switch {
 		case !bat.ExternalConnected:
-			batteryState = stateDischarging
+			state = stateDischarging
 		case bat.IsCharging:
-			batteryState = stateCharging
+			state = stateCharging
 		case bat.CurrentCapacity == 0:
-			batteryState = stateEmpty
+			state = stateEmpty
 		case !bat.FullyCharged:
-			batteryState = stateIdle
+			state = stateIdle
 		default:
-			batteryState = stateFull
+			state = stateFull
 		}
+		result = append(result, Battery{Name: "Primary", Percent: uint8(percent), State: state,
+			FullChargeCapacity: uint64(bat.MaxCapacity), HasFullChargeCapacity: true, System: true})
 	}
-
-	if totalCapacity == 0 || batteryState == math.MaxUint8 {
-		return batteryPercent, batteryState, errors.New("no battery capacity")
+	if len(result) == 0 {
+		return nil, errNoBatteries
 	}
-
-	batteryPercent = uint8(float64(totalCharge) / float64(totalCapacity) * 100)
-	return batteryPercent, batteryState, nil
+	return normalizeBatteries(result), nil
 }

agent/battery/battery_linux.go

@@ -3,58 +3,19 @@
 package battery
 
 import (
-	"errors"
-	"log/slog"
-	"math"
 	"os"
 	"path/filepath"
 	"strconv"
-	"sync"
 
 	"github.com/henrygd/beszel/agent/utils"
 )
 
-// getBatteryPaths returns the paths of all batteries in /sys/class/power_supply
-var getBatteryPaths func() ([]string, error)
+var batteryRoot = "/sys/class/power_supply"
 
-// HasReadableBattery checks if the system has a battery and returns true if it does.
-var HasReadableBattery func() bool
-
-func init() {
-	resetBatteryState("/sys/class/power_supply")
-}
-
-// resetBatteryState resets the sync.Once functions to a fresh state.
-// Tests call this after swapping sysfsPowerSupply so the new path is picked up.
-func resetBatteryState(sysfsPowerSupplyPath string) {
-	getBatteryPaths = sync.OnceValues(func() ([]string, error) {
-		entries, err := os.ReadDir(sysfsPowerSupplyPath)
-		if err != nil {
-			return nil, err
-		}
-		var paths []string
-		for _, e := range entries {
-			path := filepath.Join(sysfsPowerSupplyPath, e.Name())
-			if utils.ReadStringFile(filepath.Join(path, "type")) == "Battery" {
-				paths = append(paths, path)
-			}
-		}
-		return paths, nil
-	})
-	HasReadableBattery = sync.OnceValue(func() bool {
-		systemHasBattery := false
-		paths, err := getBatteryPaths()
-		for _, path := range paths {
-			if _, ok := utils.ReadStringFileOK(filepath.Join(path, "capacity")); ok {
-				systemHasBattery = true
-				break
-			}
-		}
-		if !systemHasBattery {
-			slog.Debug("No battery found", "err", err)
-		}
-		return systemHasBattery
-	})
+// HasReadableBattery reports whether collection currently finds a readable battery.
+func HasReadableBattery() bool {
+	batteries, _ := GetBatteryStats()
+	return len(batteries) > 0
 }
 
 func parseSysfsState(status string) uint8 {
@@ -74,26 +35,18 @@ func parseSysfsState(status string) uint8 {
 	}
 }
 
-// GetBatteryStats returns the current battery percent and charge state.
-// Reads /sys/class/power_supply/*/capacity directly so the kernel-reported
-// value is used, which is always 0-100 and matches what the OS displays.
-func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
-	if !HasReadableBattery() {
-		return batteryPercent, batteryState, errors.ErrUnsupported
-	}
-	paths, err := getBatteryPaths()
+// GetBatteryStats re-enumerates power supplies and returns every readable battery.
+func GetBatteryStats() ([]Battery, error) {
+	entries, err := os.ReadDir(batteryRoot)
 	if err != nil {
-		return batteryPercent, batteryState, err
+		return nil, err
 	}
-	if len(paths) == 0 {
-		return batteryPercent, batteryState, errors.New("no batteries")
-	}
-
-	batteryState = math.MaxUint8
-	totalPercent := 0
-	count := 0
-
-	for _, path := range paths {
+	batteries := make([]Battery, 0, len(entries))
+	for _, entry := range entries {
+		path := filepath.Join(batteryRoot, entry.Name())
+		if utils.ReadStringFile(filepath.Join(path, "type")) != "Battery" {
+			continue
+		}
 		capStr, ok := utils.ReadStringFileOK(filepath.Join(path, "capacity"))
 		if !ok {
 			continue
@@ -102,19 +55,31 @@ func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
 		if parseErr != nil {
 			continue
 		}
-		totalPercent += cap
-		count++
-
-		state := parseSysfsState(utils.ReadStringFile(filepath.Join(path, "status")))
-		if state != stateUnknown {
-			batteryState = state
+		cap = min(max(cap, 0), 100)
+		name := utils.ReadStringFile(filepath.Join(path, "model_name"))
+		if name == "" {
+			name = utils.ReadStringFile(filepath.Join(path, "model"))
 		}
+		if name == "" {
+			name = entry.Name()
+		}
+		battery := Battery{
+			Name:    name,
+			Percent: uint8(cap),
+			State:   parseSysfsState(utils.ReadStringFile(filepath.Join(path, "status"))),
+			System:  utils.ReadStringFile(filepath.Join(path, "scope")) != "Device",
+		}
+		for _, fullName := range []string{"charge_full", "energy_full"} {
+			if parsed, ok := utils.ReadUintFile(filepath.Join(path, fullName)); ok && parsed > 0 {
+				battery.FullChargeCapacity = parsed
+				battery.HasFullChargeCapacity = true
+				break
+			}
+		}
+		batteries = append(batteries, battery)
 	}
-
-	if count == 0 || batteryState == math.MaxUint8 {
-		return batteryPercent, batteryState, errors.New("no battery capacity")
+	if len(batteries) == 0 {
+		return nil, errNoBatteries
 	}
-
-	batteryPercent = uint8(totalPercent / count)
-	return batteryPercent, batteryState, nil
+	return normalizeBatteries(batteries), nil
 }

agent/battery/battery_linux_test.go

@@ -8,194 +8,102 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
-// setupFakeSysfs creates a temporary sysfs-like tree under t.TempDir(),
-// swaps sysfsPowerSupply, resets the sync.Once caches, and restores
-// everything on cleanup. Returns a helper to create battery directories.
-func setupFakeSysfs(t *testing.T) (tmpDir string, addBattery func(name, capacity, status string)) {
+type fakeBattery struct{ id, name, capacity, status, full, scope string }
+
+func setupFakeSysfs(t *testing.T) (string, func(fakeBattery)) {
 	t.Helper()
-
-	tmp := t.TempDir()
-	resetBatteryState(tmp)
-
-	write := func(path, content string) {
+	root := t.TempDir()
+	previousRoot := batteryRoot
+	batteryRoot = root
+	t.Cleanup(func() { batteryRoot = previousRoot })
+	write := func(path, value string) {
 		t.Helper()
-		dir := filepath.Dir(path)
-		if err := os.MkdirAll(dir, 0o755); err != nil {
-			t.Fatal(err)
+		require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
+		require.NoError(t, os.WriteFile(path, []byte(value), 0o644))
+	}
+	add := func(b fakeBattery) {
+		t.Helper()
+		dir := filepath.Join(root, b.id)
+		write(filepath.Join(dir, "type"), "Battery")
+		if b.capacity != "" {
+			write(filepath.Join(dir, "capacity"), b.capacity)
 		}
-		if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
-			t.Fatal(err)
+		write(filepath.Join(dir, "status"), b.status)
+		if b.name != "" {
+			write(filepath.Join(dir, "model_name"), b.name)
+		}
+		if b.full != "" {
+			write(filepath.Join(dir, "energy_full"), b.full)
+		}
+		if b.scope != "" {
+			write(filepath.Join(dir, "scope"), b.scope)
 		}
 	}
-
-	addBattery = func(name, capacity, status string) {
-		t.Helper()
-		batDir := filepath.Join(tmp, name)
-		write(filepath.Join(batDir, "type"), "Battery")
-		write(filepath.Join(batDir, "capacity"), capacity)
-		write(filepath.Join(batDir, "status"), status)
-	}
-
-	return tmp, addBattery
+	return root, add
 }
 
 func TestParseSysfsState(t *testing.T) {
-	tests := []struct {
-		input string
-		want  uint8
-	}{
-		{"Empty", stateEmpty},
-		{"Full", stateFull},
-		{"Charging", stateCharging},
-		{"Discharging", stateDischarging},
-		{"Not charging", stateIdle},
-		{"", stateUnknown},
-		{"SomethingElse", stateUnknown},
-	}
-	for _, tt := range tests {
-		assert.Equal(t, tt.want, parseSysfsState(tt.input), "parseSysfsState(%q)", tt.input)
-	}
+	assert.Equal(t, stateEmpty, parseSysfsState("Empty"))
+	assert.Equal(t, stateFull, parseSysfsState("Full"))
+	assert.Equal(t, stateCharging, parseSysfsState("Charging"))
+	assert.Equal(t, stateDischarging, parseSysfsState("Discharging"))
+	assert.Equal(t, stateIdle, parseSysfsState("Not charging"))
+	assert.Equal(t, stateUnknown, parseSysfsState("SomethingElse"))
 }
 
-func TestGetBatteryStats_SingleBattery(t *testing.T) {
-	_, addBattery := setupFakeSysfs(t)
-	addBattery("BAT0", "72", "Discharging")
-
-	pct, state, err := GetBatteryStats()
-	assert.NoError(t, err)
-	assert.Equal(t, uint8(72), pct)
-	assert.Equal(t, stateDischarging, state)
+func TestGetBatteryStatsMultipleNamedAndPrimary(t *testing.T) {
+	_, add := setupFakeSysfs(t)
+	add(fakeBattery{id: "BAT0", name: "Primary", capacity: "105", status: "Charging", full: "5000", scope: "System"})
+	add(fakeBattery{id: "hidpp_battery_0", name: "MX Keys S", capacity: "55", status: "Unknown", full: "900", scope: "Device"})
+	batteries, err := GetBatteryStats()
+	require.NoError(t, err)
+	require.Len(t, batteries, 2)
+	assert.Equal(t, "Primary", batteries[0].Name)
+	assert.Equal(t, uint8(100), batteries[0].Percent)
+	assert.Equal(t, stateUnknown, batteries[1].State)
+	primary, ok := Primary(batteries)
+	require.True(t, ok)
+	assert.Equal(t, "Primary", primary.Name)
 }
 
-func TestGetBatteryStats_MultipleBatteries(t *testing.T) {
-	_, addBattery := setupFakeSysfs(t)
-	addBattery("BAT0", "80", "Charging")
-	addBattery("BAT1", "40", "Charging")
-
-	pct, state, err := GetBatteryStats()
-	assert.NoError(t, err)
-	// average of 80 and 40 = 60
-	assert.EqualValues(t, 60, pct)
-	assert.Equal(t, stateCharging, state)
+func TestGetBatteryStatsFallbackDuplicatesAndUnreadable(t *testing.T) {
+	root, add := setupFakeSysfs(t)
+	add(fakeBattery{id: "BAT0", name: "Keyboard", capacity: "80", status: "Discharging"})
+	add(fakeBattery{id: "BAT1", name: "Keyboard", capacity: "-4", status: "SomethingWeird"})
+	add(fakeBattery{id: "BAT2", capacity: "not-a-number", status: "Charging"})
+	add(fakeBattery{id: "BAT3", capacity: "42", status: "Full"})
+	ac := filepath.Join(root, "AC0")
+	require.NoError(t, os.MkdirAll(ac, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(ac, "type"), []byte("Mains"), 0o644))
+	batteries, err := GetBatteryStats()
+	require.NoError(t, err)
+	require.Len(t, batteries, 3)
+	assert.Equal(t, "Keyboard", batteries[0].Name)
+	assert.Equal(t, "Keyboard (2)", batteries[1].Name)
+	assert.Equal(t, uint8(0), batteries[1].Percent)
+	assert.Equal(t, "BAT3", batteries[2].Name)
 }
 
-func TestGetBatteryStats_FullBattery(t *testing.T) {
-	_, addBattery := setupFakeSysfs(t)
-	addBattery("BAT0", "100", "Full")
-
-	pct, state, err := GetBatteryStats()
-	assert.NoError(t, err)
-	assert.Equal(t, uint8(100), pct)
-	assert.Equal(t, stateFull, state)
-}
-
-func TestGetBatteryStats_EmptyBattery(t *testing.T) {
-	_, addBattery := setupFakeSysfs(t)
-	addBattery("BAT0", "0", "Empty")
-
-	pct, state, err := GetBatteryStats()
-	assert.NoError(t, err)
-	assert.Equal(t, uint8(0), pct)
-	assert.Equal(t, stateEmpty, state)
-}
-
-func TestGetBatteryStats_NotCharging(t *testing.T) {
-	_, addBattery := setupFakeSysfs(t)
-	addBattery("BAT0", "80", "Not charging")
-
-	pct, state, err := GetBatteryStats()
-	assert.NoError(t, err)
-	assert.Equal(t, uint8(80), pct)
-	assert.Equal(t, stateIdle, state)
-}
-
-func TestGetBatteryStats_NoBatteries(t *testing.T) {
-	setupFakeSysfs(t) // empty directory, no batteries
-
-	_, _, err := GetBatteryStats()
+func TestGetBatteryStatsHotPlugReenumerates(t *testing.T) {
+	_, add := setupFakeSysfs(t)
+	_, err := GetBatteryStats()
 	assert.Error(t, err)
-}
-
-func TestGetBatteryStats_NonBatterySupplyIgnored(t *testing.T) {
-	tmp, addBattery := setupFakeSysfs(t)
-
-	// Add a real battery
-	addBattery("BAT0", "55", "Charging")
-
-	// Add an AC adapter (type != Battery) - should be ignored
-	acDir := filepath.Join(tmp, "AC0")
-	if err := os.MkdirAll(acDir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(acDir, "type"), []byte("Mains"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	pct, state, err := GetBatteryStats()
-	assert.NoError(t, err)
-	assert.Equal(t, uint8(55), pct)
-	assert.Equal(t, stateCharging, state)
-}
-
-func TestGetBatteryStats_InvalidCapacitySkipped(t *testing.T) {
-	tmp, addBattery := setupFakeSysfs(t)
-
-	// One battery with valid capacity
-	addBattery("BAT0", "90", "Discharging")
-
-	// Another with invalid capacity text
-	badDir := filepath.Join(tmp, "BAT1")
-	if err := os.MkdirAll(badDir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(badDir, "type"), []byte("Battery"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(badDir, "capacity"), []byte("not-a-number"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(badDir, "status"), []byte("Discharging"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	pct, _, err := GetBatteryStats()
-	assert.NoError(t, err)
-	// Only BAT0 counted
-	assert.Equal(t, uint8(90), pct)
-}
-
-func TestGetBatteryStats_UnknownStatusOnly(t *testing.T) {
-	_, addBattery := setupFakeSysfs(t)
-	addBattery("BAT0", "50", "SomethingWeird")
-
-	_, _, err := GetBatteryStats()
-	assert.Error(t, err)
-}
-
-func TestHasReadableBattery_True(t *testing.T) {
-	_, addBattery := setupFakeSysfs(t)
-	addBattery("BAT0", "50", "Charging")
-
+	assert.False(t, HasReadableBattery())
+	add(fakeBattery{id: "BAT0", capacity: "64", status: "Discharging"})
+	batteries, err := GetBatteryStats()
+	require.NoError(t, err)
 	assert.True(t, HasReadableBattery())
+	require.Len(t, batteries, 1)
+	assert.Equal(t, uint8(64), batteries[0].Percent)
 }
 
-func TestHasReadableBattery_False(t *testing.T) {
-	setupFakeSysfs(t) // no batteries
-
-	assert.False(t, HasReadableBattery())
-}
-
-func TestHasReadableBattery_NoCapacityFile(t *testing.T) {
-	tmp, _ := setupFakeSysfs(t)
-
-	// Battery dir with type file but no capacity file
-	batDir := filepath.Join(tmp, "BAT0")
-	err := os.MkdirAll(batDir, 0o755)
-	assert.NoError(t, err)
-	err = os.WriteFile(filepath.Join(batDir, "type"), []byte("Battery"), 0o644)
-	assert.NoError(t, err)
-
+func TestGetBatteryStatsNoReadableCapacity(t *testing.T) {
+	_, add := setupFakeSysfs(t)
+	add(fakeBattery{id: "BAT0", status: "Charging"})
+	_, err := GetBatteryStats()
+	assert.Error(t, err)
 	assert.False(t, HasReadableBattery())
 }

agent/battery/battery_stub.go

@@ -8,6 +8,6 @@ func HasReadableBattery() bool {
 	return false
 }
 
-func GetBatteryStats() (uint8, uint8, error) {
-	return 0, 0, errors.ErrUnsupported
+func GetBatteryStats() ([]Battery, error) {
+	return nil, errors.ErrUnsupported
 }

agent/battery/battery_test.go

@@ -0,0 +1,48 @@
+package battery
+
+import (
+	"testing"
+	"unicode/utf8"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPrimarySelection(t *testing.T) {
+	tests := []struct {
+		name string
+		bats []Battery
+		want string
+	}{
+		{"largest reported capacity", []Battery{{Name: "Small", FullChargeCapacity: 20, HasFullChargeCapacity: true, System: true}, {Name: "Large", FullChargeCapacity: 80, HasFullChargeCapacity: true}}, "Large"},
+		{"reported ranks over missing", []Battery{{Name: "Unknown", System: true}, {Name: "Known", FullChargeCapacity: 1, HasFullChargeCapacity: true}}, "Known"},
+		{"system wins capacity tie", []Battery{{Name: "Peripheral", FullChargeCapacity: 50, HasFullChargeCapacity: true}, {Name: "System", FullChargeCapacity: 50, HasFullChargeCapacity: true, System: true}}, "System"},
+		{"name resolves final tie", []Battery{{Name: "Zed"}, {Name: "Alpha"}}, "Alpha"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, ok := Primary(tt.bats)
+			require.True(t, ok)
+			assert.Equal(t, tt.want, got.Name)
+		})
+	}
+	_, ok := Primary(nil)
+	assert.False(t, ok)
+}
+
+func TestNormalizeBatteriesFallbackNames(t *testing.T) {
+	bats := normalizeBatteries([]Battery{{}, {}, {Name: "Mouse"}, {Name: "Mouse"}})
+	assert.Equal(t, []string{"Battery 1", "Battery 2", "Mouse", "Mouse (2)"}, []string{bats[0].Name, bats[1].Name, bats[2].Name, bats[3].Name})
+}
+
+func TestNormalizeBatteriesStripsInvalidUTF8(t *testing.T) {
+	// Firmware occasionally reports names that are not valid UTF-8 (a ThinkPad
+	// reporting "LNV-5B11K63024@\xd0" in model_name is a real example).
+	bats := normalizeBatteries([]Battery{{Name: "LNV-5B11K63024@\xd0"}, {Name: "\xff\xfe"}})
+	assert.Equal(t, "LNV-5B11K63024@", bats[0].Name)
+	// A name made up entirely of invalid bytes falls back to the generic name.
+	assert.Equal(t, "Battery 2", bats[1].Name)
+	for _, b := range bats {
+		assert.True(t, utf8.ValidString(b.Name))
+	}
+}

agent/battery/battery_windows.go

@@ -7,9 +7,6 @@ package battery
 
 import (
 	"errors"
-	"log/slog"
-	"math"
-	"sync"
 	"syscall"
 	"unsafe"
 
@@ -79,7 +76,7 @@ var (
 	setupDiDestroyDeviceInfoList     = setupapi.NewProc("SetupDiDestroyDeviceInfoList")
 )
 
-// winBatteryGet reads one battery by index. Returns (fullCapacity, currentCapacity, state, error).
+// winBatteryGet reads one battery by index.
 // Returns error == errNotFound when there are no more batteries.
 var errNotFound = errors.New("no more batteries")
 
@@ -122,7 +119,7 @@ func readWinBatteryState(powerState uint32) uint8 {
 	}
 }
 
-func winBatteryGet(idx int) (full, current uint32, state uint8, err error) {
+func winBatteryGet(idx int) (Battery, error) {
 	hdev, err := setupDiSetup(
 		setupDiGetClassDevsW,
 		4,
@@ -132,7 +129,7 @@ func winBatteryGet(idx int) (full, current uint32, state uint8, err error) {
 		0, 0,
 	)
 	if err != nil {
-		return 0, 0, stateUnknown, err
+		return Battery{}, err
 	}
 	defer syscall.SyscallN(setupDiDestroyDeviceInfoList.Addr(), hdev)
 
@@ -148,10 +145,10 @@ func winBatteryGet(idx int) (full, current uint32, state uint8, err error) {
 		0,
 	)
 	if errno == 259 { // ERROR_NO_MORE_ITEMS
-		return 0, 0, stateUnknown, errNotFound
+		return Battery{}, errNotFound
 	}
 	if errno != 0 {
-		return 0, 0, stateUnknown, errno
+		return Battery{}, errno
 	}
 
 	var cbRequired uint32
@@ -165,7 +162,7 @@ func winBatteryGet(idx int) (full, current uint32, state uint8, err error) {
 		0,
 	)
 	if errno != 0 && errno != 122 { // ERROR_INSUFFICIENT_BUFFER
-		return 0, 0, stateUnknown, errno
+		return Battery{}, errno
 	}
 	didd := make([]uint16, cbRequired/2)
 	cbSize := (*uint32)(unsafe.Pointer(&didd[0]))
@@ -185,7 +182,7 @@ func winBatteryGet(idx int) (full, current uint32, state uint8, err error) {
 		0,
 	)
 	if errno != 0 {
-		return 0, 0, stateUnknown, errno
+		return Battery{}, errno
 	}
 	devicePath := &didd[2:][0]
 
@@ -199,7 +196,7 @@ func winBatteryGet(idx int) (full, current uint32, state uint8, err error) {
 		0,
 	)
 	if err != nil {
-		return 0, 0, stateUnknown, err
+		return Battery{}, err
 	}
 	defer windows.CloseHandle(handle)
 
@@ -216,7 +213,7 @@ func winBatteryGet(idx int) (full, current uint32, state uint8, err error) {
 		&dwOut, nil,
 	)
 	if err != nil || bqi.BatteryTag == 0 {
-		return 0, 0, stateUnknown, errors.New("battery tag not returned")
+		return Battery{}, errors.New("battery tag not returned")
 	}
 
 	var bi batteryInformation
@@ -229,7 +226,21 @@ func winBatteryGet(idx int) (full, current uint32, state uint8, err error) {
 		uint32(unsafe.Sizeof(bi)),
 		&dwOut, nil,
 	); err != nil {
-		return 0, 0, stateUnknown, err
+		return Battery{}, err
+	}
+
+	// BatteryDeviceName is optional, so retain the deterministic fallback on error.
+	name := ""
+	nameQuery := bqi
+	nameQuery.InformationLevel = 4 // BatteryDeviceName
+	nameBuffer := make([]uint16, 128)
+	if err := windows.DeviceIoControl(
+		handle, 2703428,
+		(*byte)(unsafe.Pointer(&nameQuery)), uint32(unsafe.Sizeof(nameQuery)),
+		(*byte)(unsafe.Pointer(&nameBuffer[0])), uint32(len(nameBuffer)*2),
+		&dwOut, nil,
+	); err == nil {
+		name = windows.UTF16ToString(nameBuffer)
 	}
 
 	bws := batteryWaitStatus{BatteryTag: bqi.BatteryTag}
@@ -243,56 +254,38 @@ func winBatteryGet(idx int) (full, current uint32, state uint8, err error) {
 		uint32(unsafe.Sizeof(bs)),
 		&dwOut, nil,
 	); err != nil {
-		return 0, 0, stateUnknown, err
+		return Battery{}, err
 	}
 
-	if bs.Capacity == 0xffffffff { // BATTERY_UNKNOWN_CAPACITY
-		return 0, 0, stateUnknown, errors.New("battery capacity unknown")
+	if bs.Capacity == 0xffffffff || bi.FullChargedCapacity == 0 || bi.FullChargedCapacity == 0xffffffff {
+		return Battery{}, errors.New("battery capacity unknown")
 	}
-
-	return bi.FullChargedCapacity, bs.Capacity, readWinBatteryState(bs.PowerState), nil
+	percent := min(float64(bs.Capacity)/float64(bi.FullChargedCapacity)*100, 100)
+	return Battery{Name: name, Percent: uint8(percent), State: readWinBatteryState(bs.PowerState),
+		FullChargeCapacity: uint64(bi.FullChargedCapacity), HasFullChargeCapacity: true, System: true}, nil
 }
 
 // HasReadableBattery checks if the system has a battery and returns true if it does.
-var HasReadableBattery = sync.OnceValue(func() bool {
-	systemHasBattery := false
-	full, _, _, err := winBatteryGet(0)
-	if err == nil && full > 0 {
-		systemHasBattery = true
-	}
-	if !systemHasBattery {
-		slog.Debug("No battery found", "err", err)
-	}
-	return systemHasBattery
-})
-
-// GetBatteryStats returns the current battery percent and charge state.
-func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
-	if !HasReadableBattery() {
-		return batteryPercent, batteryState, errors.ErrUnsupported
-	}
-
-	totalFull := uint32(0)
-	totalCurrent := uint32(0)
-	batteryState = math.MaxUint8
+func HasReadableBattery() bool {
+	batteries, _ := GetBatteryStats()
+	return len(batteries) > 0
+}
 
+// GetBatteryStats returns every readable battery reported by Windows.
+func GetBatteryStats() ([]Battery, error) {
+	batteries := make([]Battery, 0, 2)
 	for i := 0; ; i++ {
-		full, current, state, bErr := winBatteryGet(i)
+		battery, bErr := winBatteryGet(i)
 		if errors.Is(bErr, errNotFound) {
 			break
 		}
-		if bErr != nil || full == 0 {
+		if bErr != nil {
 			continue
 		}
-		totalFull += full
-		totalCurrent += min(current, full)
-		batteryState = state
+		batteries = append(batteries, battery)
 	}
-
-	if totalFull == 0 || batteryState == math.MaxUint8 {
-		return batteryPercent, batteryState, errors.New("no battery capacity")
+	if len(batteries) == 0 {
+		return nil, errNoBatteries
 	}
-
-	batteryPercent = uint8(float64(totalCurrent) / float64(totalFull) * 100)
-	return batteryPercent, batteryState, nil
+	return normalizeBatteries(batteries), nil
 }

agent/btrfs/btrfs.go

@@ -0,0 +1,26 @@
+// Package btrfs reads btrfs filesystem state from sysfs.
+package btrfs
+
+// Filesystem is a mounted btrfs filesystem read from /sys/fs/btrfs/<uuid>.
+type Filesystem struct {
+	UUID     string // stable filesystem UUID from sysfs
+	MountID  string // kernel filesystem identity for matching monitored mounts
+	IODevice string // sole member block-device name, empty for multi-device/unknown pools
+	Name     string // label, else first mountpoint, else UUID
+	Size     uint64 // effective usable capacity, or raw member capacity when Raw
+	Raw      bool   // capacity and usage are physical bytes, unsuitable for disk alerts
+	Alloc    uint64 // raw bytes allocated to data, metadata and system chunks
+	Health   string // ONLINE, or DEGRADED when a device is missing
+	NRead    uint64 // cumulative bytes read across member devices
+	NWrite   uint64 // cumulative bytes written across member devices
+	Devices  []Device
+}
+
+// Device is one member device (devinfo/<devid>) with its error counters.
+type Device struct {
+	Name           string // "devid N"; sysfs does not expose the block device path
+	State          string // ONLINE or MISSING
+	ReadErrs       uint64
+	WriteErrs      uint64
+	CorruptionErrs uint64
+}

agent/btrfs/btrfs_linux.go

@@ -0,0 +1,285 @@
+//go:build linux
+
+package btrfs
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"unsafe"
+
+	"github.com/henrygd/beszel/agent/utils"
+	"golang.org/x/sys/unix"
+)
+
+var (
+	sysfsPath       = "/sys/fs/btrfs"
+	mountsPath      = "/proc/self/mounts"
+	mountinfoPath   = "/proc/self/mountinfo"
+	mountUUID       = MountID
+	deviceSize      = ioctlDeviceSize
+	filesystemUsage = statfsUsage
+)
+
+// Filesystems returns all mounted btrfs filesystems, or nil when there are none.
+func Filesystems() ([]Filesystem, error) {
+	entries, err := os.ReadDir(sysfsPath)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	mounts := mountpointsByDevice()
+	var filesystems []Filesystem
+	for _, entry := range entries {
+		if !entry.IsDir() || entry.Name() == "features" {
+			continue
+		}
+		fs, err := readFilesystem(filepath.Join(sysfsPath, entry.Name()), mounts)
+		if err != nil {
+			return nil, fmt.Errorf("btrfs %s: %w", entry.Name(), err)
+		}
+		filesystems = append(filesystems, fs)
+	}
+	return filesystems, nil
+}
+
+func readFilesystem(dir string, mounts map[string]string) (Filesystem, error) {
+	fs := Filesystem{UUID: filepath.Base(dir), Name: utils.ReadStringFile(filepath.Join(dir, "label")), Health: "UNKNOWN"}
+	for _, kind := range []string{"data", "metadata", "system"} {
+		if value, ok := utils.ReadUintFile(filepath.Join(dir, "allocation", kind, "disk_used")); ok {
+			fs.Alloc += value
+		}
+	}
+	// devices/<name> links to the block device's sysfs directory.
+	devices, err := os.ReadDir(filepath.Join(dir, "devices"))
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return fs, err
+	}
+	mountpoint := mounts["uuid:"+fs.UUID]
+	if fs.Name == "" {
+		fs.Name = mountpoint
+	}
+	var backingSize uint64
+	for _, dev := range devices {
+		if mountpoint == "" {
+			mountpoint = mounts[dev.Name()]
+		}
+		if fs.Name == "" {
+			fs.Name = mountpoint
+		}
+		devDir := filepath.Join(dir, "devices", dev.Name())
+		if size, ok := utils.ReadUintFile(filepath.Join(devDir, "size")); ok {
+			backingSize += size * 512
+		}
+		if stat := strings.Fields(utils.ReadStringFile(filepath.Join(devDir, "stat"))); len(stat) >= 7 {
+			fs.NRead += parseUint(stat[2]) * 512
+			fs.NWrite += parseUint(stat[6]) * 512
+		}
+	}
+	devids, err := os.ReadDir(filepath.Join(dir, "devinfo"))
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return fs, err
+	}
+	capacityAvailable := len(devids) > 0
+	healthKnown := len(devids) > 0
+	for _, devid := range devids {
+		devDir := filepath.Join(dir, "devinfo", devid.Name())
+		// Replacement targets do not add filesystem capacity.
+		replaceTarget, _ := utils.ReadUintFile(filepath.Join(devDir, "replace_target"))
+		if replaceTarget != 1 {
+			devid, err := strconv.ParseUint(devid.Name(), 10, 64)
+			if err != nil {
+				return fs, err
+			}
+			size, err := deviceSize(mountpoint, devid)
+			if err != nil {
+				capacityAvailable = false
+			}
+			fs.Size += size
+		}
+		dev := Device{Name: "devid " + devid.Name(), State: "ONLINE"}
+		missing := utils.ReadStringFile(filepath.Join(devDir, "missing"))
+		if missing != "0" && missing != "1" {
+			healthKnown = false
+			dev.State = "UNKNOWN"
+		}
+		if missing == "1" {
+			dev.State = "MISSING"
+			fs.Health = "DEGRADED"
+		}
+		for line := range strings.Lines(utils.ReadStringFile(filepath.Join(devDir, "error_stats"))) {
+			if fields := strings.Fields(line); len(fields) == 2 {
+				switch fields[0] {
+				case "read_errs":
+					dev.ReadErrs = parseUint(fields[1])
+				case "write_errs":
+					dev.WriteErrs = parseUint(fields[1])
+				case "corruption_errs":
+					dev.CorruptionErrs = parseUint(fields[1])
+				}
+			}
+		}
+		fs.Devices = append(fs.Devices, dev)
+	}
+	// Use one capacity source for the whole filesystem: device IDs cannot be
+	// reliably matched to block-device names in sysfs. A partial ioctl result
+	// must not be added to the complete backing-device total.
+	if !capacityAvailable {
+		fs.Size = backingSize
+	}
+	if fs.Health != "DEGRADED" && healthKnown {
+		fs.Health = "ONLINE"
+	}
+	fs.MountID = mountUUID(mountpoint)
+	if len(devices) == 1 && len(devids) == 1 && fs.Health == "ONLINE" {
+		fs.IODevice = devices[0].Name()
+	}
+	fs.Raw = true
+	if used, available, err := filesystemUsage(mountpoint); err == nil {
+		// Effective capacity excludes reserved/unavailable space, so Size-Alloc
+		// is available to applications and the usage ratio matches df.
+		fs.Size, fs.Alloc, fs.Raw = used+available, used, false
+	}
+	if fs.Name == "" {
+		fs.Name = filepath.Base(dir)
+	}
+	return fs, nil
+}
+
+// mountpointsByDevice prefers UUID matches from mountinfo and retains source
+// device names as a fallback for environments where FS_INFO is unavailable.
+func mountpointsByDevice() map[string]string {
+	mounts := mountpointsByUUID(utils.ReadStringFile(mountinfoPath), mountUUID)
+	for line := range strings.Lines(utils.ReadStringFile(mountsPath)) {
+		fields := strings.Fields(line)
+		if len(fields) < 3 || fields[2] != "btrfs" {
+			continue
+		}
+		device := fields[0]
+		if resolved, err := filepath.EvalSymlinks(device); err == nil {
+			device = resolved
+		}
+		if _, seen := mounts[filepath.Base(device)]; !seen {
+			mounts[filepath.Base(device)] = unescapeMountPath(fields[1])
+		}
+	}
+	return mounts
+}
+
+func parseUint(s string) uint64 {
+	n, _ := strconv.ParseUint(s, 10, 64)
+	return n
+}
+
+// ioctlDeviceSize reads Btrfs's recorded device size, which can be smaller
+// than the block device after a filesystem resize. BTRFS_IOC_DEV_INFO is
+// _IOWR(0x94, 30, struct btrfs_ioctl_dev_info_args), a 4096-byte ABI structure.
+func ioctlDeviceSize(mountpoint string, devid uint64) (uint64, error) {
+	if mountpoint == "" {
+		return 0, errors.New("no accessible mountpoint")
+	}
+	f, err := os.Open(mountpoint)
+	if err != nil {
+		return 0, err
+	}
+	defer f.Close()
+	args := struct {
+		Devid      uint64
+		UUID       [16]byte
+		BytesUsed  uint64
+		TotalBytes uint64
+		Reserved   [4096 - 40]byte
+	}{Devid: devid}
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, f.Fd(), 0xd000941e, uintptr(unsafe.Pointer(&args)))
+	if errno != 0 {
+		return 0, errno
+	}
+	return args.TotalBytes, nil
+}
+
+// The filesystem magic is unsigned even when Statfs_t.Type is int32.
+func isBtrfs(stat *unix.Statfs_t) bool {
+	return uint32(stat.Type) == unix.BTRFS_SUPER_MAGIC
+}
+
+func statfsUsage(path string) (used, available uint64, err error) {
+	if path == "" {
+		return 0, 0, errors.New("no accessible mountpoint")
+	}
+	var stat unix.Statfs_t
+	if err = unix.Statfs(path, &stat); err != nil {
+		return
+	}
+	if !isBtrfs(&stat) {
+		return 0, 0, errors.New("mountpoint is not Btrfs")
+	}
+	blockSize := uint64(stat.Bsize)
+	return (stat.Blocks - min(stat.Blocks, stat.Bfree)) * blockSize, min(stat.Blocks, stat.Bavail) * blockSize, nil
+}
+
+// MountID returns the filesystem UUID via BTRFS_IOC_FS_INFO. Unlike statfs
+// f_fsid, this identity is shared by all subvolumes and bind mounts.
+func MountID(path string) string {
+	if path == "" {
+		return ""
+	}
+	var stat unix.Statfs_t
+	if unix.Statfs(path, &stat) != nil || !isBtrfs(&stat) {
+		return ""
+	}
+	f, err := os.Open(path)
+	if err != nil {
+		return ""
+	}
+	defer f.Close()
+	args := struct {
+		MaxID      uint64
+		NumDevices uint64
+		FSID       [16]byte
+		Reserved   [992]byte
+	}{}
+	// _IOR(0x94, 31, 1024). Reuse the platform's read-direction bits;
+	// MIPS/PowerPC use a different encoding than asm-generic.
+	request := uintptr(unix.FS_IOC_GETFLAGS&0xe0000000) | 0x0400941f
+	_, _, errno := unix.Syscall(unix.SYS_IOCTL, f.Fd(), request, uintptr(unsafe.Pointer(&args)))
+	if errno != 0 {
+		return ""
+	}
+	id := args.FSID
+	return fmt.Sprintf("%x-%x-%x-%x-%x", id[:4], id[4:6], id[6:8], id[8:10], id[10:])
+}
+
+// Btrfs mountinfo device numbers can be virtual (0:N), so query the UUID
+// through the mount instead of comparing those numbers with sysfs block devs.
+// Retry another path when a bind mount is inaccessible. Once resolved, reuse
+// the result for that mount device to avoid opening every Docker bind mount.
+func mountpointsByUUID(mountinfo string, identify func(string) string) map[string]string {
+	mounts := make(map[string]string)
+	resolved := make(map[string]bool)
+	for line := range strings.Lines(mountinfo) {
+		before, after, ok := strings.Cut(line, " - ")
+		fields, fs := strings.Fields(before), strings.Fields(after)
+		if !ok || len(fields) < 6 || len(fs) < 3 || fs[0] != "btrfs" || resolved[fields[2]] {
+			continue
+		}
+		path := unescapeMountPath(fields[4])
+		uuid := identify(path)
+		if uuid == "" {
+			continue
+		}
+		resolved[fields[2]] = true
+		if mounts["uuid:"+uuid] == "" {
+			mounts["uuid:"+uuid] = path
+		}
+	}
+	return mounts
+}
+
+func unescapeMountPath(path string) string {
+	return strings.NewReplacer(`\040`, " ", `\011`, "\t", `\012`, "\n", `\134`, `\`).Replace(path)
+}

agent/btrfs/btrfs_linux_test.go

@@ -0,0 +1,274 @@
+//go:build testing && linux
+
+package btrfs
+
+import (
+	"os"
+	"path/filepath"
+	"strconv"
+	"testing"
+
+	"github.com/henrygd/beszel/agent/utils"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/unix"
+)
+
+func TestFilesystems(t *testing.T) {
+	root := t.TempDir()
+	oldSysfs, oldMounts := sysfsPath, mountsPath
+	sysfsPath, mountsPath = root, filepath.Join(root, "mounts")
+	t.Cleanup(func() { sysfsPath, mountsPath = oldSysfs, oldMounts })
+
+	fsDir := filepath.Join(root, "1b2c3d4e-0000-0000-0000-000000000000")
+	write := func(rel, content string) {
+		path := filepath.Join(fsDir, rel)
+		require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
+		require.NoError(t, os.WriteFile(path, []byte(content), 0o644))
+	}
+	require.NoError(t, os.MkdirAll(filepath.Join(root, "features"), 0o755))
+	oldUsage := filesystemUsage
+	filesystemUsage = func(string) (uint64, uint64, error) { return 0, 0, os.ErrNotExist }
+	t.Cleanup(func() { filesystemUsage = oldUsage })
+	oldDeviceSize := deviceSize
+	t.Cleanup(func() { deviceSize = oldDeviceSize })
+	deviceSize = func(_ string, devid uint64) (uint64, error) {
+		value, _ := utils.ReadUintFile(filepath.Join(fsDir, "recorded-size", strconv.FormatUint(devid, 10)))
+		return value, nil
+	}
+	// Recorded member capacities differ from the unchanged backing devices.
+	write("recorded-size/1", "256000\n")
+	write("recorded-size/2", "128000\n")
+	write("label", "tank\n")
+	write("allocation/data/disk_used", "4096\n")
+	write("allocation/metadata/disk_used", "2048\n")
+	write("allocation/system/disk_used", "1024\n")
+	write("devices/sda/size", "1000\n")
+	write("devices/sda/stat", "10 0 200 0 20 0 400 0 0 0 0\n")
+	write("devices/sdb/size", "1000\n")
+	write("devices/sdb/stat", "10 0 100 0 20 0 100 0 0 0 0\n")
+	write("devinfo/1/missing", "0\n")
+	write("devinfo/1/error_stats", "write_errs 1\nread_errs 2\nflush_errs 0\ncorruption_errs 3\ngeneration_errs 0\n")
+	write("devinfo/2/missing", "1\n")
+
+	filesystems, err := Filesystems()
+	require.NoError(t, err)
+	require.Len(t, filesystems, 1)
+	assert.Equal(t, Filesystem{
+		UUID: "1b2c3d4e-0000-0000-0000-000000000000", Raw: true, Name: "tank", Size: 384000, Alloc: 7168, Health: "DEGRADED", NRead: 153600, NWrite: 256000,
+		Devices: []Device{
+			{Name: "devid 1", State: "ONLINE", ReadErrs: 2, WriteErrs: 1, CorruptionErrs: 3},
+			{Name: "devid 2", State: "MISSING"},
+		},
+	}, filesystems[0])
+
+	// Unlabeled filesystems fall back to the first mountpoint, then the UUID.
+	write("label", "\n")
+	require.NoError(t, os.WriteFile(mountsPath, []byte(
+		"/dev/sdz1 /other btrfs rw 0 0\n/dev/sdb /mnt/storage btrfs rw 0 0\n/dev/sdb /mnt/storage/sub btrfs rw,subvol=/sub 0 0\n",
+	), 0o644))
+	filesystems, err = Filesystems()
+	require.NoError(t, err)
+	assert.Equal(t, "/mnt/storage", filesystems[0].Name)
+
+	require.NoError(t, os.Remove(mountsPath))
+	filesystems, err = Filesystems()
+	require.NoError(t, err)
+	assert.Equal(t, "1b2c3d4e-0000-0000-0000-000000000000", filesystems[0].Name)
+	write("devinfo/3/replace_target", "1\n")
+	write("recorded-size/3", "512000\n")
+	filesystems, err = Filesystems()
+	require.NoError(t, err)
+	assert.Equal(t, uint64(384000), filesystems[0].Size, "replacement target must not inflate capacity")
+
+	deviceSize = func(string, uint64) (uint64, error) { return 0, os.ErrPermission }
+	filesystems, err = Filesystems()
+	require.NoError(t, err)
+	require.Len(t, filesystems, 1)
+	assert.Equal(t, uint64(1024000), filesystems[0].Size)
+	assert.Equal(t, "DEGRADED", filesystems[0].Health)
+	assert.Equal(t, uint64(153600), filesystems[0].NRead)
+
+	// A partial ioctl result must not be mixed with the backing-device total.
+	deviceSize = func(_ string, devid uint64) (uint64, error) {
+		if devid == 2 {
+			return 0, os.ErrPermission
+		}
+		return 256000, nil
+	}
+	filesystems, err = Filesystems()
+	require.NoError(t, err)
+	assert.Equal(t, uint64(1024000), filesystems[0].Size)
+
+	// With no mount visible (e.g. Docker), the real lookup falls back too.
+	deviceSize = ioctlDeviceSize
+	filesystems, err = Filesystems()
+	require.NoError(t, err)
+	require.Len(t, filesystems, 1)
+	assert.Equal(t, uint64(1024000), filesystems[0].Size)
+
+	filesystemUsage = func(string) (uint64, uint64, error) { return 100, 900, nil }
+	filesystems, err = Filesystems()
+	require.NoError(t, err)
+	assert.Equal(t, uint64(1000), filesystems[0].Size)
+	assert.Equal(t, uint64(100), filesystems[0].Alloc)
+	assert.False(t, filesystems[0].Raw)
+}
+
+func TestFilesystemsNoBtrfs(t *testing.T) {
+	oldPath := sysfsPath
+	sysfsPath = filepath.Join(t.TempDir(), "missing")
+	t.Cleanup(func() { sysfsPath = oldPath })
+
+	filesystems, err := Filesystems()
+	require.NoError(t, err)
+	assert.Nil(t, filesystems)
+}
+
+func TestIoctlDeviceSizeFailure(t *testing.T) {
+	_, err := ioctlDeviceSize("", 1)
+	require.Error(t, err)
+	_, err = ioctlDeviceSize(t.TempDir(), 1)
+	require.Error(t, err)
+	assert.ErrorIs(t, err, unix.ENOTTY)
+}
+
+func TestMountpointsDecodeEscapes(t *testing.T) {
+	oldMounts := mountsPath
+	mountsPath = filepath.Join(t.TempDir(), "mounts")
+	t.Cleanup(func() { mountsPath = oldMounts })
+	require.NoError(t, os.WriteFile(mountsPath, []byte("/dev/test-btrfs /mnt/my\\040data btrfs rw 0 0\n"), 0o644))
+	assert.Equal(t, "/mnt/my data", mountpointsByDevice()["test-btrfs"])
+}
+
+func TestFilesystemWithoutDevinfo(t *testing.T) {
+	root := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(root, "devices", "sda"), 0755))
+	require.NoError(t, os.WriteFile(filepath.Join(root, "devices", "sda", "size"), []byte("1000"), 0644))
+	fs, err := readFilesystem(root, nil)
+	require.NoError(t, err)
+	assert.Equal(t, uint64(512000), fs.Size)
+	assert.True(t, fs.Raw)
+	assert.Equal(t, "UNKNOWN", fs.Health)
+	assert.Empty(t, fs.Devices)
+
+	require.NoError(t, os.MkdirAll(filepath.Join(root, "devinfo", "1"), 0755))
+	fs, err = readFilesystem(root, nil)
+	require.NoError(t, err)
+	assert.Equal(t, "UNKNOWN", fs.Health)
+	require.Len(t, fs.Devices, 1)
+	assert.Equal(t, "UNKNOWN", fs.Devices[0].State)
+
+	// Some older interfaces lack the devices directory too.
+	fs, err = readFilesystem(t.TempDir(), nil)
+	require.NoError(t, err)
+	assert.Equal(t, "UNKNOWN", fs.Health)
+}
+
+func TestLocalBtrfsUsage(t *testing.T) {
+	path := os.Getenv("BESZEL_TEST_BTRFS_MOUNT")
+	if path == "" {
+		t.Skip("set BESZEL_TEST_BTRFS_MOUNT for read-only live validation")
+	}
+	used, available, err := statfsUsage(path)
+	require.NoError(t, err)
+	filesystems, err := Filesystems()
+	require.NoError(t, err)
+	for _, fs := range filesystems {
+		if !fs.Raw && fs.Alloc == used && fs.Size == used+available {
+			t.Logf("pool=%s used=%d available=%d effective_capacity=%d", fs.Name, used, available, fs.Size)
+			return
+		}
+	}
+	t.Fatal("collector did not report the mounted filesystem's usable capacity")
+}
+
+func TestMountID(t *testing.T) {
+	assert.Empty(t, MountID(""))
+	assert.Empty(t, MountID(filepath.Join(t.TempDir(), "missing")))
+	path := os.Getenv("BESZEL_TEST_BTRFS_MOUNT")
+	if path == "" {
+		t.Skip("set BESZEL_TEST_BTRFS_MOUNT for live identity validation")
+	}
+	id := MountID(path)
+	require.NotEmpty(t, id)
+	assert.Equal(t, id, MountID(filepath.Join(path, ".")))
+}
+
+func TestMountinfoUUIDLookup(t *testing.T) {
+	info := `1 0 0:40 /@ /inaccessible ro shared:1 - btrfs /dev/mapper/unavailable rw
+2 0 0:40 /@/docker/hosts /etc/hosts ro - btrfs /dev/mapper/unavailable rw
+3 0 0:40 /@/docker/hostname /etc/hostname ro - btrfs /dev/mapper/unavailable rw
+4 0 0:41 /subvol /extra-filesystems/my\040disk ro master:2 - btrfs /dev/missing rw
+5 0 0:42 / /ext4 ro - ext4 /dev/mapper/unavailable rw
+malformed
+6 0 0:43 / /bad ro - btrfs
+`
+	var calls []string
+	mounts := mountpointsByUUID(info, func(path string) string {
+		calls = append(calls, path)
+		switch path {
+		case "/etc/hosts":
+			return "root-uuid"
+		case "/extra-filesystems/my disk":
+			return "extra-uuid"
+		}
+		return ""
+	})
+	assert.Equal(t, map[string]string{"uuid:root-uuid": "/etc/hosts", "uuid:extra-uuid": "/extra-filesystems/my disk"}, mounts)
+	assert.Equal(t, []string{"/inaccessible", "/etc/hosts", "/extra-filesystems/my disk"}, calls)
+}
+
+func TestDockerFilesystemWithoutDeviceNodes(t *testing.T) {
+	root := t.TempDir()
+	oldSysfs, oldMounts, oldInfo, oldUUID, oldUsage := sysfsPath, mountsPath, mountinfoPath, mountUUID, filesystemUsage
+	t.Cleanup(func() {
+		sysfsPath, mountsPath, mountinfoPath, mountUUID, filesystemUsage = oldSysfs, oldMounts, oldInfo, oldUUID, oldUsage
+	})
+	sysfsPath = filepath.Join(root, "sysfs")
+	mountsPath = filepath.Join(root, "missing-mounts")
+	mountinfoPath = filepath.Join(root, "mountinfo")
+	uuid := "11111111-1111-4111-8111-111111111111"
+	dir := filepath.Join(sysfsPath, uuid)
+	for path, content := range map[string]string{"devices/dm-0/size": "1000", "devinfo/1/missing": "0"} {
+		target := filepath.Join(dir, path)
+		require.NoError(t, os.MkdirAll(filepath.Dir(target), 0755))
+		require.NoError(t, os.WriteFile(target, []byte(content), 0644))
+	}
+	require.NoError(t, os.WriteFile(mountinfoPath, []byte("2 1 0:40 /@/docker/hosts /etc/hosts ro - btrfs /dev/mapper/not-in-container rw\n"), 0644))
+	mountUUID = func(path string) string {
+		if path == "/etc/hosts" {
+			return uuid
+		}
+		return ""
+	}
+	filesystemUsage = func(path string) (uint64, uint64, error) { require.Equal(t, "/etc/hosts", path); return 100, 900, nil }
+	fs, err := Filesystems()
+	require.NoError(t, err)
+	require.Len(t, fs, 1)
+	assert.Equal(t, uuid, fs[0].MountID)
+	assert.Equal(t, "dm-0", fs[0].IODevice)
+	assert.False(t, fs[0].Raw)
+	assert.Equal(t, uint64(1000), fs[0].Size)
+}
+
+func TestLivePoolMountIdentity(t *testing.T) {
+	path := os.Getenv("BESZEL_TEST_BTRFS_MOUNT")
+	if path == "" {
+		t.Skip("set BESZEL_TEST_BTRFS_MOUNT for live validation")
+	}
+	id := MountID(path)
+	require.NotEmpty(t, id)
+	pools, err := Filesystems()
+	require.NoError(t, err)
+	for _, pool := range pools {
+		if pool.UUID != id {
+			continue
+		}
+		assert.Equal(t, id, pool.MountID)
+		assert.False(t, pool.Raw)
+		t.Logf("uuid=%s mount_identity=%s io_device=%s raw=%v", pool.UUID, pool.MountID, pool.IODevice, pool.Raw)
+		return
+	}
+	t.Fatal("mounted Btrfs filesystem was not discovered")
+}

agent/btrfs/btrfs_unsupported.go

@@ -0,0 +1,11 @@
+//go:build !linux
+
+package btrfs
+
+import "errors"
+
+func Filesystems() ([]Filesystem, error) {
+	return nil, errors.ErrUnsupported
+}
+
+func MountID(string) string { return "" }

agent/client.go

@@ -2,6 +2,7 @@ package agent
 
 import (
 	"crypto/tls"
+	"crypto/x509"
 	"errors"
 	"fmt"
 	"log/slog"
@@ -24,9 +25,23 @@ import (
 )
 
 const (
-	wsDeadline = 70 * time.Second
+	// Keep the connection alive long enough for a slow collection cycle to
+	// finish before the hub considers the agent disconnected.
+	wsDeadline = 120 * time.Second
 )
 
+type caCertFileError struct {
+	err error
+}
+
+func (e *caCertFileError) Error() string {
+	return e.err.Error()
+}
+
+func (e *caCertFileError) Unwrap() error {
+	return e.err
+}
+
 // WebSocketClient manages the WebSocket connection between the agent and hub.
 // It handles authentication, message routing, and connection lifecycle management.
 type WebSocketClient struct {
@@ -40,6 +55,7 @@ type WebSocketClient struct {
 	hubRequest         *common.HubRequest[cbor.RawMessage] // Reusable request structure for message parsing
 	lastConnectAttempt time.Time                           // Timestamp of last connection attempt
 	hubVerified        bool                                // Whether the hub has been cryptographically verified
+	tlsConfig          *tls.Config                         // Optional TLS configuration with custom CA certificates
 }
 
 // newWebSocketClient creates a new WebSocket client for the given agent.
@@ -53,14 +69,18 @@ func newWebSocketClient(agent *Agent) (client *WebSocketClient, err error) {
 	client = &WebSocketClient{}
 
 	client.hubURL, err = url.Parse(hubURLStr)
-	if err != nil {
-		return nil, errors.New("invalid hub URL")
+	if err != nil || client.hubURL.Host == "" {
+		return nil, fmt.Errorf("invalid HUB_URL %q: must include scheme and host (e.g. http://hub.example.com:8090)", hubURLStr)
 	}
 	// get registration token
 	client.token, err = getToken()
 	if err != nil {
 		return nil, err
 	}
+	client.tlsConfig, err = getTLSConfig()
+	if err != nil {
+		return nil, err
+	}
 
 	client.agent = agent
 	client.hubRequest = &common.HubRequest[cbor.RawMessage]{}
@@ -87,7 +107,52 @@ func getToken() (string, error) {
 	if err != nil {
 		return "", err
 	}
-	return strings.TrimSpace(string(tokenBytes)), nil
+	return parseTokenFile(string(tokenBytes), tokenFile)
+}
+
+// parseTokenFile reads a single token from TOKEN_FILE.
+// Blank lines and comments are ignored. Multiple tokens are rejected because
+// the agent supports only one outbound hub connection.
+func parseTokenFile(contents, path string) (string, error) {
+	var token string
+	for line := range strings.Lines(contents) {
+		line = strings.TrimSpace(line)
+		if len(line) == 0 || strings.HasPrefix(line, "#") {
+			continue
+		}
+		if token != "" {
+			return "", fmt.Errorf("%s must contain a single token", path)
+		}
+		token = line
+	}
+	// An empty file keeps returning an empty token, as before: the caller decides
+	// what to do about it.
+	return token, nil
+}
+
+// getTLSConfig returns a TLS configuration containing the system certificate
+// pool plus any certificates configured through CA_CERT_FILE. A nil config lets
+// gws use Go's default TLS configuration and system roots.
+func getTLSConfig() (*tls.Config, error) {
+	caCertFile, _ := utils.GetEnv("CA_CERT_FILE")
+	if caCertFile == "" {
+		return nil, nil
+	}
+
+	caCertPEM, err := os.ReadFile(caCertFile)
+	if err != nil {
+		return nil, &caCertFileError{fmt.Errorf("read CA_CERT_FILE %q: %w", caCertFile, err)}
+	}
+
+	rootCAs, err := x509.SystemCertPool()
+	if err != nil {
+		return nil, &caCertFileError{fmt.Errorf("load system CA certificate pool: %w", err)}
+	}
+	if !rootCAs.AppendCertsFromPEM(caCertPEM) {
+		return nil, &caCertFileError{fmt.Errorf("CA_CERT_FILE %q does not contain any valid PEM certificates", caCertFile)}
+	}
+
+	return &tls.Config{RootCAs: rootCAs}, nil
 }
 
 // getOptions returns the WebSocket client options, creating them if necessary.
@@ -112,7 +177,7 @@ func (client *WebSocketClient) getOptions() *gws.ClientOption {
 
 	client.options = &gws.ClientOption{
 		Addr:      client.hubURL.String(),
-		TlsConfig: &tls.Config{InsecureSkipVerify: true},
+		TlsConfig: client.tlsConfig,
 		RequestHeader: http.Header{
 			"User-Agent": []string{getUserAgent()},
 			"X-Token":    []string{client.token},

agent/client_test.go

@@ -4,8 +4,19 @@ package agent
 
 import (
 	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"net"
+	"net/http"
+	"net/http/httptest"
 	"net/url"
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -15,6 +26,7 @@ import (
 	"github.com/henrygd/beszel/internal/common"
 
 	"github.com/fxamacker/cbor/v2"
+	"github.com/lxzan/gws"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
@@ -51,11 +63,18 @@ func TestNewWebSocketClient(t *testing.T) {
 			errorMsg:    "HUB_URL environment variable not set",
 		},
 		{
-			name:        "invalid URL",
+			name:        "malformed URL",
 			hubURL:      "ht\ttp://invalid",
 			token:       "test-token",
 			expectError: true,
-			errorMsg:    "invalid hub URL",
+			errorMsg:    "invalid HUB_URL",
+		},
+		{
+			name:        "URL without host",
+			hubURL:      "http:/api",
+			token:       "test-token",
+			expectError: true,
+			errorMsg:    "invalid HUB_URL",
 		},
 		{
 			name:        "missing token",
@@ -157,6 +176,155 @@ func TestWebSocketClient_GetOptions(t *testing.T) {
 	}
 }
 
+func TestWebSocketClient_TLSVerification(t *testing.T) {
+	agent := createTestAgent(t)
+	serverCert, serverCertPEM := newSelfSignedServerCertificate(t)
+	upgrader := gws.NewUpgrader(&gws.BuiltinEventHandler{}, nil)
+	server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := upgrader.Upgrade(w, r)
+		if err == nil {
+			go conn.ReadLoop()
+		}
+	}))
+	server.TLS = &tls.Config{Certificates: []tls.Certificate{serverCert}}
+	server.StartTLS()
+	t.Cleanup(server.Close)
+
+	caCertFile := filepath.Join(t.TempDir(), "hub-ca.crt")
+	require.NoError(t, os.WriteFile(caCertFile, serverCertPEM, 0600))
+
+	newClient := func(t *testing.T, caCertFile string) *WebSocketClient {
+		t.Helper()
+		t.Setenv("BESZEL_AGENT_HUB_URL", server.URL)
+		t.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+		t.Setenv("BESZEL_AGENT_CA_CERT_FILE", caCertFile)
+		client, err := newWebSocketClient(agent)
+		require.NoError(t, err)
+		return client
+	}
+
+	t.Run("system roots are used by default", func(t *testing.T) {
+		client := newClient(t, "")
+		assert.Nil(t, client.getOptions().TlsConfig)
+		_, _, err := gws.NewClient(&gws.BuiltinEventHandler{}, client.getOptions())
+		require.Error(t, err)
+	})
+
+	t.Run("custom CA trusts self-signed certificate", func(t *testing.T) {
+		systemRoots, err := x509.SystemCertPool()
+		require.NoError(t, err)
+		client := newClient(t, caCertFile)
+		assert.Greater(t, len(client.getOptions().TlsConfig.RootCAs.Subjects()), len(systemRoots.Subjects()))
+		conn, _, err := gws.NewClient(&gws.BuiltinEventHandler{}, client.getOptions())
+		require.NoError(t, err)
+		require.NoError(t, conn.NetConn().Close())
+	})
+
+	t.Run("custom CA does not bypass hostname verification", func(t *testing.T) {
+		client := newClient(t, caCertFile)
+		client.getOptions().TlsConfig.ServerName = "wrong.example.com"
+		_, _, err := gws.NewClient(&gws.BuiltinEventHandler{}, client.getOptions())
+		require.Error(t, err)
+	})
+}
+
+func TestWebSocketClient_NonTLSConnection(t *testing.T) {
+	agent := createTestAgent(t)
+	upgrader := gws.NewUpgrader(&gws.BuiltinEventHandler{}, nil)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		conn, err := upgrader.Upgrade(w, r)
+		if err == nil {
+			go conn.ReadLoop()
+		}
+	}))
+	t.Cleanup(server.Close)
+
+	t.Setenv("BESZEL_AGENT_HUB_URL", server.URL)
+	t.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	t.Setenv("BESZEL_AGENT_CA_CERT_FILE", "")
+	client, err := newWebSocketClient(agent)
+	require.NoError(t, err)
+	assert.Nil(t, client.getOptions().TlsConfig)
+
+	conn, _, err := gws.NewClient(&gws.BuiltinEventHandler{}, client.getOptions())
+	require.NoError(t, err)
+	require.NoError(t, conn.NetConn().Close())
+}
+
+func TestGetTLSConfigErrors(t *testing.T) {
+	tempDir := t.TempDir()
+	testCases := []struct {
+		name       string
+		path       string
+		contents   []byte
+		errorMatch string
+	}{
+		{
+			name:       "missing file",
+			path:       filepath.Join(tempDir, "missing.pem"),
+			errorMatch: "read CA_CERT_FILE",
+		},
+		{
+			name:       "unreadable path",
+			path:       tempDir,
+			errorMatch: "read CA_CERT_FILE",
+		},
+		{
+			name:       "empty file",
+			path:       filepath.Join(tempDir, "empty.pem"),
+			contents:   []byte{},
+			errorMatch: "does not contain any valid PEM certificates",
+		},
+		{
+			name:       "malformed file",
+			path:       filepath.Join(tempDir, "malformed.pem"),
+			contents:   []byte("not a PEM certificate"),
+			errorMatch: "does not contain any valid PEM certificates",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.contents != nil {
+				require.NoError(t, os.WriteFile(tc.path, tc.contents, 0600))
+			}
+			t.Setenv("BESZEL_AGENT_CA_CERT_FILE", tc.path)
+
+			tlsConfig, err := getTLSConfig()
+			require.Error(t, err)
+			assert.Nil(t, tlsConfig)
+			assert.Contains(t, err.Error(), tc.errorMatch)
+			assert.Contains(t, err.Error(), tc.path)
+		})
+	}
+}
+
+func newSelfSignedServerCertificate(t *testing.T) (tls.Certificate, []byte) {
+	t.Helper()
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+
+	template := &x509.Certificate{
+		SerialNumber:          big.NewInt(1),
+		Subject:               pkix.Name{CommonName: "127.0.0.1"},
+		NotBefore:             time.Now().Add(-time.Hour),
+		NotAfter:              time.Now().Add(time.Hour),
+		IPAddresses:           []net.IP{net.ParseIP("127.0.0.1")},
+		KeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment | x509.KeyUsageCertSign,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		BasicConstraintsValid: true,
+		IsCA:                  true,
+	}
+	certDER, err := x509.CreateCertificate(rand.Reader, template, template, &privateKey.PublicKey, privateKey)
+	require.NoError(t, err)
+
+	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
+	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(privateKey)})
+	certificate, err := tls.X509KeyPair(certPEM, keyPEM)
+	require.NoError(t, err)
+	return certificate, certPEM
+}
+
 // TestWebSocketClient_VerifySignature tests signature verification
 func TestWebSocketClient_VerifySignature(t *testing.T) {
 	agent := createTestAgent(t)
@@ -402,6 +570,41 @@ func TestGetToken(t *testing.T) {
 		assert.Equal(t, expectedToken, token)
 	})
 
+	t.Run("TOKEN_FILE with surrounding blank lines and comments", func(t *testing.T) {
+		expectedToken := "test-token-with-noise"
+		tokenFile := filepath.Join(t.TempDir(), "token")
+		require.NoError(t, os.WriteFile(tokenFile, []byte("# hub token\n\n"+expectedToken+"\n\n"), 0o600))
+
+		t.Setenv("TOKEN_FILE", tokenFile)
+
+		token, err := getToken()
+		assert.NoError(t, err)
+		assert.Equal(t, expectedToken, token)
+	})
+
+	t.Run("TOKEN_FILE with multiple tokens is rejected", func(t *testing.T) {
+		tokenFile := filepath.Join(t.TempDir(), "token")
+		require.NoError(t, os.WriteFile(tokenFile, []byte("11111111-1111-1111-1111-111111111111\n22222222-2222-2222-2222-222222222222\n"), 0o600))
+
+		t.Setenv("TOKEN_FILE", tokenFile)
+
+		token, err := getToken()
+		require.Error(t, err)
+		assert.Empty(t, token)
+		assert.Contains(t, err.Error(), "must contain a single token")
+	})
+
+	t.Run("TOKEN_FILE holding only comments behaves like an empty file", func(t *testing.T) {
+		tokenFile := filepath.Join(t.TempDir(), "token")
+		require.NoError(t, os.WriteFile(tokenFile, []byte("\n# only a comment\n"), 0o600))
+
+		t.Setenv("TOKEN_FILE", tokenFile)
+
+		token, err := getToken()
+		assert.NoError(t, err)
+		assert.Equal(t, "", token)
+	})
+
 	t.Run("token from BESZEL_AGENT_TOKEN_FILE", func(t *testing.T) {
 		// Create a temporary token file
 		expectedToken := "test-token-from-beszel-file"
@@ -497,3 +700,11 @@ func TestGetToken(t *testing.T) {
 		assert.Equal(t, expectedToken, token, "Whitespace should be stripped from token file content")
 	})
 }
+
+func TestWebSocketDeadlineCoversSlowCollection(t *testing.T) {
+	const minimumDeadline = 120 * time.Second
+
+	if wsDeadline < minimumDeadline {
+		t.Fatalf("WebSocket deadline %s is shorter than the slow-collection window of %s", wsDeadline, minimumDeadline)
+	}
+}

agent/connection_manager.go

@@ -87,6 +87,10 @@ func (c *ConnectionManager) Start(serverOptions ServerOptions) error {
 
 	wsClient, err := newWebSocketClient(c.agent)
 	if err != nil {
+		var caCertErr *caCertFileError
+		if errors.As(err, &caCertErr) {
+			return err
+		}
 		slog.Warn("Error creating WebSocket client", "err", err)
 	}
 	c.wsClient = wsClient
@@ -151,7 +155,9 @@ func (c *ConnectionManager) handleEvent(event ConnectionEvent) {
 	case WebSocketConnect:
 		c.handleStateChange(WebSocketConnected)
 	case SSHConnect:
-		c.handleStateChange(SSHConnected)
+		if c.State == Disconnected {
+			c.handleStateChange(SSHConnected)
+		}
 	case WebSocketDisconnect:
 		if c.State == WebSocketConnected {
 			c.handleStateChange(Disconnected)

agent/connection_manager_test.go

@@ -114,6 +114,12 @@ func TestConnectionManager_EventHandling(t *testing.T) {
 			event:         SSHConnect,
 			expectedState: SSHConnected,
 		},
+		{
+			name:          "SSH connect from WebSocket connected (no change)",
+			initialState:  WebSocketConnected,
+			event:         SSHConnect,
+			expectedState: WebSocketConnected,
+		},
 		{
 			name:          "WebSocket disconnect from connected",
 			initialState:  WebSocketConnected,
@@ -265,6 +271,19 @@ func TestConnectionManager_StartWithInvalidConfig(t *testing.T) {
 	assert.Error(t, err, "Should error when starting already started connection manager")
 }
 
+func TestConnectionManager_StartRejectsInvalidCACertFile(t *testing.T) {
+	agent := createTestAgent(t)
+	cm := agent.connectionManager
+	t.Setenv("BESZEL_AGENT_HUB_URL", "https://hub.example.com")
+	t.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	t.Setenv("BESZEL_AGENT_CA_CERT_FILE", t.TempDir())
+
+	err := cm.Start(ServerOptions{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "read CA_CERT_FILE")
+	assert.Nil(t, cm.eventChan)
+}
+
 // TestConnectionManager_CloseWebSocket tests WebSocket closing
 func TestConnectionManager_CloseWebSocket(t *testing.T) {
 	agent := createTestAgent(t)

agent/data_dir_test.go

@@ -12,6 +12,14 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func invalidDataDir(t *testing.T) string {
+	t.Helper()
+
+	filePath := filepath.Join(t.TempDir(), "file")
+	require.NoError(t, os.WriteFile(filePath, nil, 0644))
+	return filepath.Join(filePath, "data")
+}
+
 func TestGetDataDir(t *testing.T) {
 	// Test with explicit dataDir parameter
 	t.Run("explicit data dir", func(t *testing.T) {
@@ -48,7 +56,7 @@ func TestGetDataDir(t *testing.T) {
 
 	// Test with invalid explicit dataDir
 	t.Run("invalid explicit data dir", func(t *testing.T) {
-		invalidPath := "/invalid/path/that/cannot/be/created"
+		invalidPath := invalidDataDir(t)
 		_, err := GetDataDir(invalidPath)
 		assert.Error(t, err)
 	})
@@ -78,7 +86,7 @@ func TestTestDataDirs(t *testing.T) {
 	// Test with multiple directories, first one valid
 	t.Run("multiple dirs - first valid", func(t *testing.T) {
 		tempDir := t.TempDir()
-		invalidDir := "/invalid/path"
+		invalidDir := invalidDataDir(t)
 		result, err := testDataDirs([]string{tempDir, invalidDir})
 		require.NoError(t, err)
 		assert.Equal(t, tempDir, result)
@@ -87,7 +95,7 @@ func TestTestDataDirs(t *testing.T) {
 	// Test with multiple directories, second one valid
 	t.Run("multiple dirs - second valid", func(t *testing.T) {
 		tempDir := t.TempDir()
-		invalidDir := "/invalid/path"
+		invalidDir := invalidDataDir(t)
 		result, err := testDataDirs([]string{invalidDir, tempDir})
 		require.NoError(t, err)
 		assert.Equal(t, tempDir, result)
@@ -109,7 +117,7 @@ func TestTestDataDirs(t *testing.T) {
 
 	// Test with no valid directories
 	t.Run("no valid directories", func(t *testing.T) {
-		invalidPaths := []string{"/invalid/path1", "/invalid/path2"}
+		invalidPaths := []string{invalidDataDir(t), invalidDataDir(t)}
 		_, err := testDataDirs(invalidPaths)
 		assert.Error(t, err)
 		assert.Contains(t, err.Error(), "data directory not found")

agent/disk.go

@@ -18,7 +18,8 @@ import (
 // fsRegistrationContext holds the shared lookup state needed to resolve a
 // filesystem into the tracked fsStats key and metadata.
 type fsRegistrationContext struct {
-	filesystem     string // value of optional FILESYSTEM env var
+	filesystem     string // device part of optional FILESYSTEM env var
+	filesystemName string // optional custom name from FILESYSTEM=device__name
 	isWindows      bool
 	efPath         string // path to extra filesystems (default "/extra-filesystems")
 	diskIoCounters map[string]disk.IOCountersStat
@@ -177,7 +178,7 @@ func (d *diskDiscovery) addConfiguredRootFs() bool {
 
 	for _, p := range d.partitions {
 		if filesystemMatchesPartitionSetting(d.ctx.filesystem, p) {
-			d.addFsStat(p.Device, p.Mountpoint, true, "")
+			d.addFsStat(p.Device, p.Mountpoint, true, d.ctx.filesystemName)
 			return true
 		}
 	}
@@ -185,7 +186,7 @@ func (d *diskDiscovery) addConfiguredRootFs() bool {
 	// FILESYSTEM may name a physical disk absent from partitions (e.g. ZFS lists
 	// dataset paths like zroot/ROOT/default, not block devices).
 	if ioKey, match := findIoDevice(d.ctx.filesystem, d.ctx.diskIoCounters); match {
-		d.agent.fsStats[ioKey] = &system.FsStats{Root: true, Mountpoint: d.rootMountPoint}
+		d.agent.fsStats[ioKey] = &system.FsStats{Root: true, Mountpoint: d.rootMountPoint, Name: d.ctx.filesystemName}
 		return true
 	}
 
@@ -300,7 +301,8 @@ func (d *diskDiscovery) addExtraFilesystemFolders(folderNames []string) {
 
 // Sets up the filesystems to monitor for disk usage and I/O.
 func (a *Agent) initializeDiskInfo() {
-	filesystem, _ := utils.GetEnv("FILESYSTEM")
+	filesystemRaw, _ := utils.GetEnv("FILESYSTEM")
+	filesystem, filesystemName := parseFilesystemEntry(filesystemRaw)
 	hasRoot := false
 	isWindows := runtime.GOOS == "windows"
 
@@ -324,6 +326,7 @@ func (a *Agent) initializeDiskInfo() {
 	slog.Debug("Disk I/O", "diskstats", diskIoCounters)
 	ctx := fsRegistrationContext{
 		filesystem:     filesystem,
+		filesystemName: filesystemName,
 		isWindows:      isWindows,
 		diskIoCounters: diskIoCounters,
 		efPath:         "/extra-filesystems",
@@ -534,7 +537,16 @@ func normalizeDeviceName(value string) string {
 func (a *Agent) initializeDiskIoStats(diskIoCounters map[string]disk.IOCountersStat) {
 	a.fsNames = a.fsNames[:0]
 	now := time.Now()
+	// ZFS datasets have no /proc/diskstats entry, so they are excluded from
+	// I/O tracking instead of warning about a missing device (#1541).
+	var zfsMountpoints map[string]bool
+	if a.storagePoolManager != nil {
+		zfsMountpoints = a.storagePoolManager.ZfsMountpoints()
+	}
 	for device, stats := range a.fsStats {
+		if zfsMountpoints[stats.Mountpoint] {
+			continue
+		}
 		// skip if not in diskIoCounters
 		d, exists := diskIoCounters[device]
 		if !exists {
@@ -559,20 +571,31 @@ func (a *Agent) updateDiskUsage(systemStats *system.Stats) {
 		!a.lastDiskUsageUpdate.IsZero() &&
 		time.Since(a.lastDiskUsageUpdate) < a.diskUsageCacheDuration
 
+	// ZFS dataset mountpoints use `zfs list` values because statfs(2) reports
+	// dataset-level usage that excludes child datasets (#1541).
+	var zfsUsage map[string]zfsDatasetUsage
+	if a.storagePoolManager != nil {
+		zfsUsage = a.storagePoolManager.DatasetUsage()
+	}
+
 	// disk usage
 	for _, stats := range a.fsStats {
 		// Skip non-root filesystems if caching is active
 		if cacheExtraFs && !stats.Root {
 			continue
 		}
-		if d, err := disk.Usage(stats.Mountpoint); err == nil {
-			stats.DiskTotal = utils.BytesToGigabytes(d.Total)
-			stats.DiskUsed = utils.BytesToGigabytes(d.Used)
-			if stats.Root {
-				systemStats.DiskTotal = utils.BytesToGigabytes(d.Total)
-				systemStats.DiskUsed = utils.BytesToGigabytes(d.Used)
-				systemStats.DiskPct = utils.TwoDecimals(d.UsedPercent)
+		var total, used uint64
+		var usedPct float64
+		if u, ok := zfsUsage[stats.Mountpoint]; ok {
+			total = u.used + u.avail
+			used = u.used
+			if total > 0 {
+				usedPct = float64(used) / float64(total) * 100
 			}
+		} else if d, err := disk.Usage(stats.Mountpoint); err == nil {
+			total = d.Total
+			used = d.Used
+			usedPct = d.UsedPercent
 		} else {
 			// reset stats if error (likely unmounted)
 			slog.Error("Error getting disk stats", "name", stats.Mountpoint, "err", err)
@@ -580,6 +603,14 @@ func (a *Agent) updateDiskUsage(systemStats *system.Stats) {
 			stats.DiskUsed = 0
 			stats.TotalRead = 0
 			stats.TotalWrite = 0
+			continue
+		}
+		stats.DiskTotal = utils.BytesToGigabytes(total)
+		stats.DiskUsed = utils.BytesToGigabytes(used)
+		if stats.Root {
+			systemStats.DiskTotal = stats.DiskTotal
+			systemStats.DiskUsed = stats.DiskUsed
+			systemStats.DiskPct = utils.TwoDecimals(usedPct)
 		}
 	}
 
@@ -696,6 +727,8 @@ func (a *Agent) updateDiskIo(cacheTimeMs uint16, systemStats *system.Stats) {
 				systemStats.DiskWritePs = stats.DiskWritePs
 				systemStats.DiskIO[0] = diskIORead
 				systemStats.DiskIO[1] = diskIOWrite
+				systemStats.DiskIOTotal[0] = d.ReadBytes
+				systemStats.DiskIOTotal[1] = d.WriteBytes
 				systemStats.DiskIoStats[0] = diskReadTime
 				systemStats.DiskIoStats[1] = diskWriteTime
 				systemStats.DiskIoStats[2] = diskIoUtilPct

agent/disk_test.go

@@ -78,14 +78,7 @@ func TestParseFilesystemEntry(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			fsEntry := strings.TrimSpace(tt.input)
-			var fs, customName string
-			if parts := strings.SplitN(fsEntry, "__", 2); len(parts) == 2 {
-				fs = strings.TrimSpace(parts[0])
-				customName = strings.TrimSpace(parts[1])
-			} else {
-				fs = fsEntry
-			}
+			fs, customName := parseFilesystemEntry(tt.input)
 
 			assert.Equal(t, tt.expectedFs, fs)
 			assert.Equal(t, tt.expectedName, customName)
@@ -287,8 +280,9 @@ func TestAddConfiguredRootFs(t *testing.T) {
 			rootMountPoint: "/",
 			partitions:     []disk.PartitionStat{{Device: "/dev/ada0p2", Mountpoint: "/"}},
 			ctx: fsRegistrationContext{
-				filesystem: "/dev/ada0p2",
-				isWindows:  false,
+				filesystem:     "/dev/ada0p2",
+				filesystemName: "root disk",
+				isWindows:      false,
 				diskIoCounters: map[string]disk.IOCountersStat{
 					"ada0": {Name: "ada0", ReadBytes: 1000, WriteBytes: 1000},
 				},
@@ -302,6 +296,7 @@ func TestAddConfiguredRootFs(t *testing.T) {
 		assert.True(t, exists)
 		assert.True(t, stats.Root)
 		assert.Equal(t, "/", stats.Mountpoint)
+		assert.Equal(t, "root disk", stats.Name)
 	})
 
 	t.Run("adds root from io device when partition is missing", func(t *testing.T) {
@@ -310,8 +305,9 @@ func TestAddConfiguredRootFs(t *testing.T) {
 			agent:          agent,
 			rootMountPoint: "/sysroot",
 			ctx: fsRegistrationContext{
-				filesystem: "zroot",
-				isWindows:  false,
+				filesystem:     "zroot",
+				filesystemName: "root pool",
+				isWindows:      false,
 				diskIoCounters: map[string]disk.IOCountersStat{
 					"nda0": {Name: "nda0", Label: "zroot", ReadBytes: 1000, WriteBytes: 1000},
 				},
@@ -325,6 +321,7 @@ func TestAddConfiguredRootFs(t *testing.T) {
 		assert.True(t, exists)
 		assert.True(t, stats.Root)
 		assert.Equal(t, "/sysroot", stats.Mountpoint)
+		assert.Equal(t, "root pool", stats.Name)
 	})
 
 	t.Run("returns false when filesystem cannot be resolved", func(t *testing.T) {

agent/disk_zfs_test.go

@@ -0,0 +1,110 @@
+//go:build testing
+
+package agent
+
+import (
+	"testing"
+	"time"
+
+	"github.com/henrygd/beszel/agent/zfs"
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/shirou/gopsutil/v4/disk"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestUpdateDiskUsageZfsMountpoint verifies that a filesystem whose mountpoint
+// is a ZFS dataset reports `zfs list` usage (which includes child datasets)
+// instead of the dataset-scoped statfs values (#1541).
+func TestUpdateDiskUsageZfsMountpoint(t *testing.T) {
+	zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs"}}}
+	zm.backends[0].datasetsFn = func() ([]zfs.Dataset, error) {
+		return []zfs.Dataset{
+			{Name: "tank", Used: 12000000000000, Avail: 11999000000000, Mountpoint: "/tank"},
+		}, nil
+	}
+	agent := &Agent{
+		fsStats: map[string]*system.FsStats{
+			"tank": {Root: false, Mountpoint: "/tank"},
+		},
+		storagePoolManager: zm,
+	}
+
+	var stats system.Stats
+	agent.updateDiskUsage(&stats)
+
+	fs := agent.fsStats["tank"]
+	require.NotNil(t, fs)
+	assert.Equal(t, 22350.81, fs.DiskTotal) // (used + avail) in GiB
+	assert.Equal(t, 11175.87, fs.DiskUsed)
+	// Non-root filesystems do not populate system-level stats.
+	assert.Equal(t, float64(0), stats.DiskTotal)
+}
+
+// TestUpdateDiskUsageZfsRootPopulatesSystemStats verifies the root disk values
+// are derived from ZFS usage when the root mountpoint is a ZFS dataset.
+func TestUpdateDiskUsageZfsRootPopulatesSystemStats(t *testing.T) {
+	zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs"}}}
+	zm.backends[0].datasetsFn = func() ([]zfs.Dataset, error) {
+		return []zfs.Dataset{
+			{Name: "rpool/ROOT/pve-1", Used: 900000000000, Avail: 300000000000, Mountpoint: "/"},
+		}, nil
+	}
+	agent := &Agent{
+		fsStats: map[string]*system.FsStats{
+			"rpool/ROOT/pve-1": {Root: true, Mountpoint: "/"},
+		},
+		storagePoolManager: zm,
+	}
+
+	var stats system.Stats
+	agent.updateDiskUsage(&stats)
+
+	assert.Equal(t, 1117.59, agent.fsStats["rpool/ROOT/pve-1"].DiskTotal)
+	assert.Equal(t, 838.19, agent.fsStats["rpool/ROOT/pve-1"].DiskUsed)
+	assert.Equal(t, 75.0, stats.DiskPct)
+	assert.Equal(t, 1117.59, stats.DiskTotal)
+	assert.Equal(t, 838.19, stats.DiskUsed)
+}
+
+// TestUpdateDiskUsageWithoutZfsManager falls back to statfs when no manager is
+// present (e.g. tests constructing bare Agent values).
+func TestUpdateDiskUsageWithoutZfsManager(t *testing.T) {
+	agent := &Agent{
+		fsStats: map[string]*system.FsStats{
+			"root": {Root: true, Mountpoint: "/"},
+		},
+	}
+
+	var stats system.Stats
+	agent.updateDiskUsage(&stats)
+
+	assert.True(t, agent.fsStats["root"].DiskTotal > 0, "root usage should come from statfs")
+	assert.True(t, stats.DiskTotal > 0)
+}
+
+// TestInitializeDiskIoStatsSkipsZfsMountpoints verifies ZFS filesystems are
+// excluded from diskstats I/O tracking instead of warning about a missing device.
+func TestInitializeDiskIoStatsSkipsZfsMountpoints(t *testing.T) {
+	zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs"}}}
+	zm.backends[0].datasetsFn = func() ([]zfs.Dataset, error) {
+		return []zfs.Dataset{{Name: "tank", Mountpoint: "/tank"}}, nil
+	}
+	agent := &Agent{
+		fsStats: map[string]*system.FsStats{
+			"tank": {Root: false, Mountpoint: "/tank"},
+			"sda1": {Root: false, Mountpoint: "/mnt/data"},
+		},
+		storagePoolManager: zm,
+		diskPrev:           make(map[uint16]map[string]prevDisk),
+	}
+
+	agent.initializeDiskIoStats(map[string]disk.IOCountersStat{
+		"sda1": {Name: "sda1", ReadBytes: 100, WriteBytes: 100},
+	})
+
+	assert.Equal(t, []string{"sda1"}, agent.fsNames)
+	assert.Equal(t, uint64(100), agent.fsStats["sda1"].TotalRead)
+	// ZFS entry is present but untouched by diskstats initialization.
+	assert.Equal(t, uint64(0), agent.fsStats["tank"].TotalRead)
+}

agent/docker.go

@@ -65,7 +65,6 @@ type dockerManager struct {
 	dockerVersionChecked bool                        // Whether a version probe has completed successfully
 	isWindows            bool                        // Whether the Docker Engine API is running on Windows
 	buf                  *bytes.Buffer               // Buffer to store and read response bodies
-	decoder              *json.Decoder               // Reusable JSON decoder that reads from buf
 	apiStats             *container.ApiStats         // Reusable API stats object
 	excludeContainers    []string                    // Patterns to exclude containers by name
 	usingPodman          bool                        // Whether the Docker Engine API is running on Podman
@@ -374,16 +373,26 @@ func convertContainerPortsToString(ctr *container.ApiInfo) string {
 		return ""
 	}
 	sort.Slice(ctr.Ports, func(i, j int) bool {
-		return ctr.Ports[i].PublicPort < ctr.Ports[j].PublicPort
+		if ctr.Ports[i].PublicPort != ctr.Ports[j].PublicPort {
+			return ctr.Ports[i].PublicPort < ctr.Ports[j].PublicPort
+		}
+		return ctr.Ports[i].IP < ctr.Ports[j].IP
 	})
 	var builder strings.Builder
-	seenPorts := make(map[uint16]struct{})
+	seen := make(map[string]struct{})
 	for _, p := range ctr.Ports {
-		_, ok := seenPorts[p.PublicPort]
-		if p.PublicPort == 0 || ok {
+		if p.PublicPort == 0 {
 			continue
 		}
-		seenPorts[p.PublicPort] = struct{}{}
+		keyIP := p.IP
+		if keyIP == "0.0.0.0" || keyIP == "::" {
+			keyIP = ""
+		}
+		key := keyIP + ":" + strconv.Itoa(int(p.PublicPort))
+		if _, ok := seen[key]; ok {
+			continue
+		}
+		seen[key] = struct{}{}
 		if builder.Len() > 0 {
 			builder.WriteString(", ")
 		}
@@ -535,11 +544,18 @@ func (dm *dockerManager) updateContainerStats(ctr *container.ApiInfo, cacheTimeM
 	// Get previous CPU values
 	prevCpuContainer, prevCpuSystem := dm.getCpuPreviousValues(cacheTimeMs, ctr.IdShort)
 
-	// Calculate CPU percentage based on platform
+	// Calculate CPU percentage based on platform.
+	// Podman reports system_cpu_usage from cgroup cpu.stat (not /proc/stat), so it reflects
+	// only cgroup-tracked activity rather than total host capacity. Use a time-based method
+	// instead so the result is comparable to host CPU utilization. See:
+	// https://github.com/henrygd/beszel/issues/2049
 	var cpuPct float64
 	if dm.isWindows {
 		prevRead := dm.lastCpuReadTime[cacheTimeMs][ctr.IdShort]
 		cpuPct = res.CalculateCpuPercentWindows(prevCpuContainer, prevRead)
+	} else if dm.usingPodman && res.CPUStats.OnlineCPUs > 0 {
+		prevRead := dm.lastCpuReadTime[cacheTimeMs][ctr.IdShort]
+		cpuPct = res.CalculateCpuPercentPodman(prevCpuContainer, prevRead)
 	} else {
 		cpuPct = res.CalculateCpuPercentLinux(prevCpuContainer, prevCpuSystem)
 	}
@@ -747,20 +763,18 @@ func (dm *dockerManager) applyDockerVersionInfo(serverHeader string, versionInfo
 	}
 }
 
-// Decodes Docker API JSON response using a reusable buffer and decoder. Not thread safe.
+// Decodes a Docker API JSON response using a reusable buffer. Not thread safe.
 func (dm *dockerManager) decode(resp *http.Response, d any) error {
 	if dm.buf == nil {
 		// initialize buffer with 256kb starting size
 		dm.buf = bytes.NewBuffer(make([]byte, 0, 1024*256))
-		dm.decoder = json.NewDecoder(dm.buf)
 	}
 	defer resp.Body.Close()
 	defer dm.buf.Reset()
-	_, err := dm.buf.ReadFrom(resp.Body)
-	if err != nil {
+	if _, err := dm.buf.ReadFrom(resp.Body); err != nil {
 		return err
 	}
-	return dm.decoder.Decode(d)
+	return json.Unmarshal(dm.buf.Bytes(), d)
 }
 
 // Test docker / podman sockets and return if one exists

agent/docker_test.go

@@ -729,6 +729,7 @@ func TestGetDockerStatsChecksDockerVersionAfterContainerList(t *testing.T) {
 
 			stats, err := dm.getDockerStats(defaultCacheTimeMs)
 			require.NoError(t, err)
+			require.NotNil(t, stats, "A successful empty snapshot must remain distinguishable from a collection failure")
 			assert.Empty(t, stats)
 			assert.True(t, dm.dockerVersionChecked)
 			assert.Equal(t, tt.expectedGood, dm.goodDockerVersion)
@@ -742,6 +743,7 @@ func TestGetDockerStatsChecksDockerVersionAfterContainerList(t *testing.T) {
 
 			stats, err = dm.getDockerStats(defaultCacheTimeMs)
 			require.NoError(t, err)
+			require.NotNil(t, stats, "A successful empty snapshot must remain distinguishable from a collection failure")
 			assert.Empty(t, stats)
 			assert.Equal(t, tt.expectedGood, dm.goodDockerVersion)
 			assert.Equal(t, tt.expectedPodman, dm.usingPodman)
@@ -804,6 +806,24 @@ func TestGetDockerStatsRetriesVersionCheckUntilSuccess(t *testing.T) {
 	assert.Equal(t, 2, requestCounts["/version"])
 }
 
+// A failed decode must not break later decodes. Previously the reused json.Decoder
+// stayed desynced after one truncated response, breaking decode until restart.
+func TestDecodeRecoversFromError(t *testing.T) {
+	dm := &dockerManager{}
+
+	// truncated JSON: body reads fine, decode fails
+	var bad []container.ApiInfo
+	err := dm.decode(&http.Response{Body: io.NopCloser(strings.NewReader(`[{"Id":"abc`))}, &bad)
+	require.Error(t, err)
+
+	// the next decode must still succeed
+	var good []container.ApiInfo
+	err = dm.decode(&http.Response{Body: io.NopCloser(strings.NewReader(`[{"Id":"abcdef012345","Names":["/ok"]}]`))}, &good)
+	require.NoError(t, err)
+	require.Len(t, good, 1)
+	assert.Equal(t, "abcdef012345", good[0].Id)
+}
+
 func TestCycleCpuDeltas(t *testing.T) {
 	dm := &dockerManager{
 		lastCpuContainer: map[uint16]map[string]uint64{
@@ -1003,6 +1023,200 @@ func TestCpuPercentageCalculationWithRealData(t *testing.T) {
 	assert.InDelta(t, expectedPct, actualPct, 0.01)
 }
 
+func TestCpuPercentageHandlesCounterRollback(t *testing.T) {
+	// If a stats response is processed after a newer one for the same container,
+	// or an accounting counter resets, the current total can be lower than the
+	// stored previous value. Unsigned subtraction wraps to ~2^64 instead of
+	// going negative, so the percentage explodes, validateCpuPercentage rejects
+	// the sample, and the whole collection is discarded - network stats too.
+	stats := &container.ApiStats{
+		CPUStats: container.CPUStats{
+			CPUUsage:    container.CPUUsage{TotalUsage: 1_000_000},
+			SystemUsage: 20_000_000,
+		},
+	}
+
+	// Container counter went backwards.
+	assert.Equal(t, 0.0, stats.CalculateCpuPercentLinux(2_000_000, 10_000_000))
+	// System counter went backwards.
+	assert.Equal(t, 0.0, stats.CalculateCpuPercentLinux(500_000, 30_000_000))
+	// A normal forward sample is unaffected: 500000 / 10000000 * 100 = 5%.
+	assert.InDelta(t, 5.0, stats.CalculateCpuPercentLinux(500_000, 10_000_000), 0.001)
+}
+
+func TestCpuPercentageWindowsHandlesCounterRollback(t *testing.T) {
+	now := time.Now()
+	stats := &container.ApiStats{
+		Read:     now,
+		NumProcs: 4,
+		CPUStats: container.CPUStats{
+			CPUUsage: container.CPUUsage{TotalUsage: 1_000_000},
+		},
+	}
+	prevRead := now.Add(-time.Second)
+
+	// Container counter went backwards.
+	assert.Equal(t, 0.0, stats.CalculateCpuPercentWindows(2_000_000, prevRead))
+	// A normal forward sample is unaffected.
+	assert.Greater(t, stats.CalculateCpuPercentWindows(500_000, prevRead), 0.0)
+}
+
+func TestCalculateCpuPercentPodman(t *testing.T) {
+	baseTime := time.Date(2026, 3, 15, 12, 0, 0, 0, time.UTC)
+
+	tests := []struct {
+		name             string
+		prevCpuContainer uint64
+		prevRead         time.Time
+		currentUsage     uint64
+		currentRead      time.Time
+		onlineCPUs       uint32
+		expectedPct      float64
+	}{
+		{
+			name: "normal calculation",
+			// container used 2ms of CPU over 1s with 2 CPUs → 0.1%
+			prevCpuContainer: 1_000_000_000,
+			prevRead:         baseTime,
+			currentUsage:     1_002_000_000, // +2ms CPU time
+			currentRead:      baseTime.Add(time.Second),
+			onlineCPUs:       2,
+			expectedPct:      0.1, // 2e6 / (1e9 * 2) * 100
+		},
+		{
+			name:             "first run returns zero",
+			prevCpuContainer: 0,
+			prevRead:         baseTime,
+			currentUsage:     5_000_000,
+			currentRead:      baseTime.Add(time.Second),
+			onlineCPUs:       4,
+			expectedPct:      0.0,
+		},
+		{
+			name:             "zero online cpus returns zero",
+			prevCpuContainer: 1_000_000_000,
+			prevRead:         baseTime,
+			currentUsage:     1_010_000_000,
+			currentRead:      baseTime.Add(time.Second),
+			onlineCPUs:       0,
+			expectedPct:      0.0,
+		},
+		{
+			name:             "same read time returns zero",
+			prevCpuContainer: 1_000_000_000,
+			prevRead:         baseTime,
+			currentUsage:     1_010_000_000,
+			currentRead:      baseTime, // no elapsed time
+			onlineCPUs:       2,
+			expectedPct:      0.0,
+		},
+		{
+			name:             "counter rollback returns zero",
+			prevCpuContainer: 2_000_000_000,
+			prevRead:         baseTime,
+			currentUsage:     1_000_000_000,
+			currentRead:      baseTime.Add(time.Second),
+			onlineCPUs:       2,
+			expectedPct:      0.0,
+		},
+		{
+			name: "100% single cpu",
+			// container consumed a full CPU-second over 1s on a 1-CPU host → 100%
+			prevCpuContainer: 1_000_000_000,
+			prevRead:         baseTime,
+			currentUsage:     2_000_000_000, // +1s CPU time
+			currentRead:      baseTime.Add(time.Second),
+			onlineCPUs:       1,
+			expectedPct:      100.0, // 1e9 / (1e9 * 1) * 100
+		},
+		{
+			name: "high utilization on multi-cpu host",
+			// container used 800ms on a 4-CPU host over 1s → 20%
+			prevCpuContainer: 10_000_000_000,
+			prevRead:         baseTime,
+			currentUsage:     10_800_000_000,
+			currentRead:      baseTime.Add(time.Second),
+			onlineCPUs:       4,
+			expectedPct:      20.0, // 800e6 / (1e9 * 4) * 100
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := &container.ApiStats{
+				Read: tt.currentRead,
+				CPUStats: container.CPUStats{
+					CPUUsage:   container.CPUUsage{TotalUsage: tt.currentUsage},
+					OnlineCPUs: tt.onlineCPUs,
+				},
+			}
+			got := s.CalculateCpuPercentPodman(tt.prevCpuContainer, tt.prevRead)
+			assert.InDelta(t, tt.expectedPct, got, 0.001, "test %q", tt.name)
+		})
+	}
+}
+
+func TestUpdateContainerStatsPodmanCpuCalculation(t *testing.T) {
+	// Verify that Podman containers use the time-based CPU calculation
+	// when online_cpus is provided in the stats response.
+	// container used 20ms CPU over 1s with 2 CPUs → 1%
+	prevReadTime := time.Date(2026, 3, 15, 21, 26, 58, 0, time.UTC) // 1 second before stats read
+	const prevCpuUsage = uint64(5_000_000_000)
+
+	dm := &dockerManager{
+		client: &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			switch req.URL.EscapedPath() {
+			case "/containers/0123456789ab/stats":
+				return &http.Response{
+					StatusCode: http.StatusOK,
+					Status:     "200 OK",
+					Header:     make(http.Header),
+					Body: io.NopCloser(strings.NewReader(`{
+						"read":"2026-03-15T21:26:59Z",
+						"cpu_stats":{"cpu_usage":{"total_usage":5020000000},"system_cpu_usage":9999999,"online_cpus":2},
+						"memory_stats":{"usage":1048576,"stats":{"inactive_file":262144}},
+						"networks":{"eth0":{"rx_bytes":0,"tx_bytes":0}}
+					}`)),
+					Request: req,
+				}, nil
+			default:
+				return nil, fmt.Errorf("unexpected path: %s", req.URL.EscapedPath())
+			}
+		})},
+		containerStatsMap: make(map[string]*container.Stats),
+		apiStats:          &container.ApiStats{},
+		usingPodman:       true,
+		lastCpuContainer: map[uint16]map[string]uint64{
+			defaultCacheTimeMs: {"0123456789ab": prevCpuUsage},
+		},
+		lastCpuSystem: map[uint16]map[string]uint64{
+			defaultCacheTimeMs: {"0123456789ab": 1}, // intentionally tiny — should NOT be used
+		},
+		lastCpuReadTime: map[uint16]map[string]time.Time{
+			defaultCacheTimeMs: {"0123456789ab": prevReadTime},
+		},
+		networkSentTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
+		networkRecvTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
+		lastNetworkReadTime: make(map[uint16]map[string]time.Time),
+	}
+
+	ctr := &container.ApiInfo{
+		IdShort: "0123456789ab",
+		Names:   []string{"/myapp"},
+		Status:  "Up 5 minutes",
+		Image:   "myapp:latest",
+	}
+
+	err := dm.updateContainerStats(ctr, defaultCacheTimeMs)
+	require.NoError(t, err)
+
+	// cpu delta = 5020000000 - 5000000000 = 20000000 ns (20ms)
+	// elapsed = 1s = 1000000000 ns, online_cpus = 2
+	// expected = 20000000 / (1000000000 * 2) * 100 = 1.0%
+	expectedCpu := 1.0
+	assert.InDelta(t, expectedCpu, dm.containerStatsMap[ctr.IdShort].Cpu, 0.01)
+}
+
 func TestNetworkStatsCalculationWithRealData(t *testing.T) {
 	// Create synthetic test data to avoid timing issues
 	apiStats1 := &container.ApiStats{
@@ -1864,6 +2078,14 @@ func TestConvertContainerPortsToString(t *testing.T) {
 			},
 			expected: "80, 443",
 		},
+		{
+			name: "ipv4 and ipv6 wildcard bindings are deduplicated",
+			ports: []port{
+				{PublicPort: 80, IP: "0.0.0.0"},
+				{PublicPort: 80, IP: "::"},
+			},
+			expected: "80",
+		},
 		{
 			name: "multiple ports with different IPs",
 			ports: []port{
@@ -1872,6 +2094,22 @@ func TestConvertContainerPortsToString(t *testing.T) {
 			},
 			expected: "80, 1.2.3.4:443",
 		},
+		{
+			name: "same port bound to multiple IPs shows all entries",
+			ports: []port{
+				{PublicPort: 65533, IP: "172.16.151.72"},
+				{PublicPort: 65533, IP: "172.16.156.25"},
+			},
+			expected: "172.16.151.72:65533, 172.16.156.25:65533",
+		},
+		{
+			name: "same port bound to IPv4 and IPv6",
+			ports: []port{
+				{PublicPort: 65534, IP: "172.16.151.72"},
+				{PublicPort: 65534, IP: "fd04:38e2:98c6:3fd::72"},
+			},
+			expected: "172.16.151.72:65534, fd04:38e2:98c6:3fd::72:65534",
+		},
 		{
 			name: "ports slice is nilled after call",
 			ports: []port{

agent/fans.go

@@ -0,0 +1,117 @@
+package agent
+
+import (
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"github.com/henrygd/beszel/agent/utils"
+	"github.com/henrygd/beszel/internal/entities/system"
+)
+
+type fanSensor struct {
+	key, path string
+}
+
+var getFanSensors = newFanSensorCache(hwmonRoot)
+
+func newFanSensorCache(root string) func() ([]fanSensor, error) {
+	return sync.OnceValues(func() ([]fanSensor, error) {
+		return discoverHwmonFans(root)
+	})
+}
+
+// updateFans populates systemStats.Fans from the host's hwmon sysfs tree.
+// No-op on platforms where hwmon isn't available (see fans_other.go).
+func (a *Agent) updateFans(systemStats *system.Stats) {
+	if hwmonRoot == "" {
+		return
+	}
+	sensors, err := getFanSensors()
+	if err != nil {
+		slog.Debug("Error reading fans", "err", err)
+		return
+	}
+	fans := readFanSensors(sensors)
+	if len(fans) == 0 {
+		return
+	}
+	systemStats.Fans = fans
+	// Note: Commented out because we don't currently use this value in the UI.
+	// Compute the single "dashboard" value used by the FanSpeed alert.
+	// Per-sensor RPMs live in Stats.Fans and drive the multi-line FanChart
+	// in the UI; the alert path only needs one number to compare against
+	// the user's threshold, so we use the highest RPM across all fans
+	// a.systemInfo.DashboardFan = 0
+	// for _, rpm := range fans {
+	// 	if rpm > a.systemInfo.DashboardFan {
+	// 		a.systemInfo.DashboardFan = rpm
+	// 	}
+	// }
+}
+
+// readHwmonFans walks the given hwmon root (typically /sys/class/hwmon) and
+// returns a map of "<chip>_<label-or-fan-idx>" → RPM for every fan*_input
+// file it finds. Zero RPM is retained because it can represent a real fan that
+// has stopped; negative and malformed readings are ignored.
+func readHwmonFans(root string) (map[string]uint16, error) {
+	sensors, err := discoverHwmonFans(root)
+	if err != nil {
+		return nil, err
+	}
+	return readFanSensors(sensors), nil
+}
+
+func discoverHwmonFans(root string) ([]fanSensor, error) {
+	entries, err := os.ReadDir(root)
+	if err != nil {
+		return nil, err
+	}
+	var sensors []fanSensor
+	for _, entry := range entries {
+		chipDir := filepath.Join(root, entry.Name())
+		sensorDir := chipDir
+		inputs, _ := filepath.Glob(filepath.Join(sensorDir, "fan*_input"))
+
+		// Some legacy hwmon drivers (notably applesmc) register a hwmon class
+		// device but create fan attributes on the parent platform device. In
+		// sysfs that parent is exposed through hwmonN/device.
+		if len(inputs) == 0 {
+			deviceDir := filepath.Join(chipDir, "device")
+			if deviceInputs, _ := filepath.Glob(filepath.Join(deviceDir, "fan*_input")); len(deviceInputs) > 0 {
+				sensorDir = deviceDir
+				inputs = deviceInputs
+			}
+		}
+
+		chipName := utils.ReadStringFile(filepath.Join(sensorDir, "name"))
+		if chipName == "" {
+			chipName = utils.ReadStringFile(filepath.Join(chipDir, "name"))
+		}
+		if chipName == "" {
+			chipName = entry.Name()
+		}
+		for _, inputPath := range inputs {
+			base := strings.TrimSuffix(filepath.Base(inputPath), "_input")
+			label := utils.ReadStringFile(filepath.Join(sensorDir, base+"_label"))
+			key := chipName + "_" + base
+			if label != "" {
+				key = chipName + "_" + label
+			}
+			sensors = append(sensors, fanSensor{key, inputPath})
+		}
+	}
+	return sensors, nil
+}
+
+func readFanSensors(sensors []fanSensor) map[string]uint16 {
+	fans := make(map[string]uint16, len(sensors))
+	for _, sensor := range sensors {
+		if rpm, ok := utils.ReadUintFile(sensor.path); ok {
+			fans[sensor.key] = uint16(rpm)
+		}
+	}
+	return fans
+}

agent/fans_linux.go

@@ -0,0 +1,8 @@
+//go:build linux
+
+package agent
+
+// hwmonRoot is the sysfs entry point for hardware monitor chips. Each
+// subdirectory (hwmon0, hwmon1, …) is one chip; fan*_input files inside it
+// expose RPM readings.
+const hwmonRoot = "/sys/class/hwmon"

agent/fans_other.go

@@ -0,0 +1,7 @@
+//go:build !linux
+
+package agent
+
+// hwmonRoot is empty on non-Linux platforms — fan RPM reporting via sysfs
+// hwmon is Linux-specific. updateFans() short-circuits when this is empty.
+const hwmonRoot = ""

agent/fans_test.go

@@ -0,0 +1,105 @@
+//go:build testing
+
+package agent
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// writeFile creates path with parents and writes contents.
+func writeFile(t *testing.T, path, contents string) {
+	t.Helper()
+	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
+	require.NoError(t, os.WriteFile(path, []byte(contents), 0o644))
+}
+
+// TestReadHwmonFans verifies the /sys/class/hwmon walker:
+//   - picks up fan*_input from every chip,
+//   - keys entries by chip name + sensor label (or fan idx if no label),
+//   - retains 0 RPM for stopped fans,
+//   - tolerates chips with no fan files at all.
+func TestReadHwmonFans(t *testing.T) {
+	root := t.TempDir()
+
+	// hwmon0: Raspberry Pi 5 active cooler — one fan, no label.
+	writeFile(t, filepath.Join(root, "hwmon0", "name"), "pwmfan\n")
+	writeFile(t, filepath.Join(root, "hwmon0", "fan1_input"), "6500\n")
+
+	// hwmon1: a thermal-only chip, no fan files. Must not error.
+	writeFile(t, filepath.Join(root, "hwmon1", "name"), "cpu_thermal\n")
+	writeFile(t, filepath.Join(root, "hwmon1", "temp1_input"), "55000\n")
+
+	// hwmon2: two fans — one stopped (0 RPM) and one labeled "chassis".
+	writeFile(t, filepath.Join(root, "hwmon2", "name"), "nct6798\n")
+	writeFile(t, filepath.Join(root, "hwmon2", "fan1_input"), "0\n")
+	writeFile(t, filepath.Join(root, "hwmon2", "fan2_input"), "1200\n")
+	writeFile(t, filepath.Join(root, "hwmon2", "fan2_label"), "chassis\n")
+
+	fans, err := readHwmonFans(root)
+	require.NoError(t, err)
+
+	assert.Equal(t, map[string]uint16{
+		"pwmfan_fan1":     6500,
+		"nct6798_fan1":    0,
+		"nct6798_chassis": 1200,
+	}, fans)
+}
+
+// TestReadHwmonFansLegacyParent verifies legacy hwmon layouts such as applesmc,
+// where the hwmon class node exists but fan attributes live on hwmonN/device.
+func TestReadHwmonFansLegacyParent(t *testing.T) {
+	root := t.TempDir()
+	deviceDir := filepath.Join(root, "devices", "applesmc.768")
+	writeFile(t, filepath.Join(deviceDir, "name"), "applesmc\n")
+	writeFile(t, filepath.Join(deviceDir, "fan1_input"), "1202\n")
+	writeFile(t, filepath.Join(deviceDir, "fan1_label"), "Exhaust\n")
+
+	chipDir := filepath.Join(root, "hwmon1")
+	require.NoError(t, os.MkdirAll(chipDir, 0o755))
+	require.NoError(t, os.Symlink(deviceDir, filepath.Join(chipDir, "device")))
+
+	fans, err := readHwmonFans(root)
+	require.NoError(t, err)
+	assert.Equal(t, map[string]uint16{"applesmc_Exhaust": 1202}, fans)
+}
+
+// TestReadHwmonFansMissingRoot returns an error rather than panicking when the
+// hwmon root doesn't exist (e.g. running on a kernel without hwmon support).
+func TestReadHwmonFansMissingRoot(t *testing.T) {
+	_, err := readHwmonFans(filepath.Join(t.TempDir(), "does-not-exist"))
+	assert.Error(t, err)
+}
+
+// TestReadHwmonFansEmpty returns an empty map (not nil error) when the root
+// exists but contains no chips at all.
+func TestReadHwmonFansEmpty(t *testing.T) {
+	root := t.TempDir()
+	fans, err := readHwmonFans(root)
+	require.NoError(t, err)
+	assert.Empty(t, fans)
+}
+
+func TestFanDiscoveryCache(t *testing.T) {
+	root := t.TempDir()
+	input := filepath.Join(root, "hwmon0", "fan1_input")
+	writeFile(t, filepath.Join(root, "hwmon0", "name"), "chip\n")
+	writeFile(t, input, "1000\n")
+
+	getSensors := newFanSensorCache(root)
+	sensors, err := getSensors()
+	require.NoError(t, err)
+	fans := readFanSensors(sensors)
+	assert.Equal(t, uint16(1000), fans["chip_fan1"])
+
+	writeFile(t, input, "1200\n")
+	writeFile(t, filepath.Join(root, "hwmon0", "fan1_label"), "case\n")
+	sensors, err = getSensors()
+	require.NoError(t, err)
+	fans = readFanSensors(sensors)
+	assert.Equal(t, map[string]uint16{"chip_fan1": 1200}, fans)
+}

agent/fingerprint.go

@@ -50,6 +50,9 @@ func generateFingerprint(hostname, cpuModel string) string {
 			if info, err := cpu.Info(); err == nil && len(info) > 0 {
 				cpuModel = info[0].ModelName
 			}
+			if cpuModel == "" {
+				cpuModel = getCpuModelFromCpuinfo()
+			}
 		}
 		fingerprint = hostname + cpuModel
 	}

agent/gpu.go

@@ -48,6 +48,8 @@ type GPUManager struct {
 	// Per-cache-key tracking for delta calculations
 	// cacheKey -> gpuId -> snapshot of last count/usage/power values
 	lastSnapshots map[uint16]map[string]*gpuSnapshot
+	// Per-card energy snapshots for Intel sysfs power calculation.
+	intelSysfsEnergySnapshots map[string]intelSysfsEnergySnapshot
 }
 
 // gpuSnapshot stores the last observed incremental values for delta tracking
@@ -90,6 +92,7 @@ const (
 	collectorSourceNVML         collectorSource = "nvml"
 	collectorSourceNvidiaSMI    collectorSource = collectorSource(nvidiaSmiCmd)
 	collectorSourceIntelGpuTop  collectorSource = collectorSource(intelGpuStatsCmd)
+	collectorSourceIntelSysfs   collectorSource = "intel_sysfs"
 	collectorSourceAmdSysfs     collectorSource = "amd_sysfs"
 	collectorSourceRocmSMI      collectorSource = collectorSource(rocmSmiCmd)
 	collectorSourceMacmon       collectorSource = collectorSource(macmonCmd)
@@ -106,6 +109,7 @@ func isValidCollectorSource(source collectorSource) bool {
 		collectorSourceNVML,
 		collectorSourceNvidiaSMI,
 		collectorSourceIntelGpuTop,
+		collectorSourceIntelSysfs,
 		collectorSourceAmdSysfs,
 		collectorSourceRocmSMI,
 		collectorSourceMacmon,
@@ -122,6 +126,8 @@ type gpuCapabilities struct {
 	hasAmdSysfs     bool
 	hasTegrastats   bool
 	hasIntelGpuTop  bool
+	hasXe           bool
+	hasIntelSysfs   bool
 	hasNvtop        bool
 	hasMacmon       bool
 	hasPowermetrics bool
@@ -355,12 +361,16 @@ func (gm *GPUManager) calculateGPUAverage(id string, gpu *system.GPUData, cacheK
 
 	// If no new data arrived
 	if deltaCount == 0 {
-		// If GPU appears suspended (instantaneous values are 0), return zero values
-		// Otherwise return last known average for temporary collection gaps
-		if gpu.Temperature == 0 && gpu.MemoryUsed == 0 {
+		// Only discrete GPUs report temp/memory, so treat all-zero as suspended (return zeros).
+		// Engine-based (Intel) GPUs don't, so carry the last average forward across sample gaps.
+		if gpu.Engines == nil && gpu.Temperature == 0 && gpu.MemoryUsed == 0 {
 			return system.GPUData{Name: gpu.Name}
 		}
-		return gm.lastAvgData[id] // zero value if not found
+		lastAvg := gm.lastAvgData[id] // zero value if not found
+		if lastAvg.Name == "" {
+			lastAvg.Name = gpu.Name
+		}
+		return lastAvg
 	}
 
 	// Calculate new average
@@ -369,12 +379,13 @@ func (gm *GPUManager) calculateGPUAverage(id string, gpu *system.GPUData, cacheK
 
 	gpuAvg.Power = utils.TwoDecimals(deltaPower / float64(deltaCount))
 
+	gpuAvg.PowerPkg = utils.TwoDecimals(deltaPowerPkg / float64(deltaCount))
+
 	if gpu.Engines != nil {
 		// make fresh map for averaged engine metrics to avoid mutating
 		// the accumulator map stored in gm.GpuDataMap
 		gpuAvg.Engines = make(map[string]float64, len(gpu.Engines))
 		gpuAvg.Usage = gm.calculateIntelGPUUsage(&gpuAvg, gpu, lastSnapshot, deltaCount)
-		gpuAvg.PowerPkg = utils.TwoDecimals(deltaPowerPkg / float64(deltaCount))
 	} else {
 		gpuAvg.Usage = utils.TwoDecimals(deltaUsage / float64(deltaCount))
 	}
@@ -444,6 +455,8 @@ func (gm *GPUManager) storeSnapshot(id string, gpu *system.GPUData, cacheKey uin
 func (gm *GPUManager) discoverGpuCapabilities() gpuCapabilities {
 	caps := gpuCapabilities{
 		hasAmdSysfs: gm.hasAmdSysfs(),
+		hasXe:       gm.hasXe(),
+		hasIntelSysfs: gm.hasIntelSysfs(),
 	}
 	if _, err := exec.LookPath(nvidiaSmiCmd); err == nil {
 		caps.hasNvidiaSmi = true
@@ -472,7 +485,7 @@ func (gm *GPUManager) discoverGpuCapabilities() gpuCapabilities {
 }
 
 func hasAnyGpuCollector(caps gpuCapabilities) bool {
-	return caps.hasNvidiaSmi || caps.hasRocmSmi || caps.hasAmdSysfs || caps.hasTegrastats || caps.hasIntelGpuTop || caps.hasNvtop || caps.hasMacmon || caps.hasPowermetrics
+	return caps.hasNvidiaSmi || caps.hasRocmSmi || caps.hasAmdSysfs || caps.hasTegrastats || caps.hasIntelGpuTop || caps.hasIntelSysfs || caps.hasNvtop || caps.hasMacmon || caps.hasPowermetrics
 }
 
 func (gm *GPUManager) startIntelCollector() {
@@ -563,6 +576,13 @@ func (gm *GPUManager) collectorDefinitions(caps gpuCapabilities) map[collectorSo
 				return true
 			},
 		},
+		collectorSourceIntelSysfs: {
+			group:     collectorGroupIntel,
+			available: caps.hasIntelSysfs,
+			start: func(_ func()) bool {
+				return gm.startIntelSysfsCollector()
+			},
+		},
 		collectorSourceAmdSysfs: {
 			group:     collectorGroupAmd,
 			available: caps.hasAmdSysfs,
@@ -705,9 +725,12 @@ func (gm *GPUManager) resolveLegacyCollectorPriority(caps gpuCapabilities) []col
 		priorities = append(priorities, collectorSourceAmdSysfs)
 	}
 
-	if caps.hasIntelGpuTop {
+	if caps.hasIntelGpuTop && !caps.hasXe {
 		priorities = append(priorities, collectorSourceIntelGpuTop)
 	}
+	if caps.hasIntelSysfs {
+		priorities = append(priorities, collectorSourceIntelSysfs)
+	}
 
 	// Apple collectors are currently opt-in only for testing.
 	// Enable them with GPU_COLLECTOR=macmon or GPU_COLLECTOR=powermetrics.

agent/gpu_intel_sysfs_linux.go

@@ -0,0 +1,280 @@
+//go:build linux
+
+package agent
+
+import (
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/henrygd/beszel/agent/utils"
+	"github.com/henrygd/beszel/internal/entities/system"
+)
+
+var (
+	drmSysfsRoot  = "/sys/class/drm"
+	intelSysfsNow = time.Now
+)
+
+type intelSysfsEnergySnapshot struct {
+	microjoules uint64
+	timestamp   time.Time
+}
+
+type intelSysfsCard struct {
+	cardPath string
+	hwmonDir string
+}
+
+// hasIntelSysfs returns true if any Intel DRM card exposes an hwmon energy counter.
+func (gm *GPUManager) hasIntelSysfs() bool {
+	cards, err := discoverIntelSysfsCards()
+	return err == nil && len(cards) > 0
+}
+
+// startIntelSysfsCollector starts Intel GPU collection via sysfs.
+func (gm *GPUManager) startIntelSysfsCollector() bool {
+	go func() {
+		if err := gm.collectIntelSysfsStats(); err != nil {
+			slog.Warn("Error collecting Intel GPU data via sysfs", "err", err)
+		}
+	}()
+	return true
+}
+
+// collectIntelSysfsStats collects Intel GPU metrics directly from DRM sysfs / hwmon.
+func (gm *GPUManager) collectIntelSysfsStats() error {
+	sysfsPollInterval := 3000 * time.Millisecond
+	cards, err := discoverIntelSysfsCards()
+	if err != nil {
+		return err
+	}
+	if len(cards) == 0 {
+		return errNoValidData
+	}
+
+	slog.Debug("Using sysfs for Intel GPU data collection", "cards", len(cards))
+	for _, card := range cards {
+		slog.Debug("Intel sysfs card detected", "card", filepath.Base(card.cardPath), "hwmon", card.hwmonDir)
+	}
+
+	failures := 0
+	for {
+		hasData := false
+		for _, card := range cards {
+			if gm.updateIntelSysfsGpuData(card.cardPath, card.hwmonDir) {
+				hasData = true
+			}
+		}
+		if !hasData {
+			failures++
+			if failures > maxFailureRetries {
+				return errNoValidData
+			}
+			slog.Warn("No Intel GPU data from sysfs", "failures", failures)
+			time.Sleep(retryWaitTime)
+			continue
+		}
+		failures = 0
+		time.Sleep(sysfsPollInterval)
+	}
+}
+
+func discoverIntelSysfsCards() ([]intelSysfsCard, error) {
+	paths, err := filepath.Glob(filepath.Join(drmSysfsRoot, "card*"))
+	if err != nil {
+		return nil, err
+	}
+
+	var cards []intelSysfsCard
+	for _, cardPath := range paths {
+		if strings.Contains(filepath.Base(cardPath), "-") || !isIntelGpu(cardPath) {
+			continue
+		}
+		hwmonDir := findIntelEnergyHwmon(filepath.Join(cardPath, "device"))
+		if hwmonDir == "" {
+			continue
+		}
+		cards = append(cards, intelSysfsCard{cardPath: cardPath, hwmonDir: hwmonDir})
+	}
+	return cards, nil
+}
+
+func isIntelGpu(cardPath string) bool {
+	vendor, err := utils.ReadStringFileLimited(filepath.Join(cardPath, "device/vendor"), 64)
+	if err != nil {
+		return false
+	}
+	return strings.EqualFold(strings.TrimSpace(vendor), "0x8086")
+}
+
+func findIntelEnergyHwmon(devicePath string) string {
+	hwmons, _ := filepath.Glob(filepath.Join(devicePath, "hwmon/hwmon*"))
+	var fallback string
+	for _, hwmonDir := range hwmons {
+		if !sysfsFileExists(filepath.Join(hwmonDir, "energy1_input")) {
+			continue
+		}
+		if name, err := utils.ReadStringFileLimited(filepath.Join(hwmonDir, "name"), 64); err == nil && strings.EqualFold(strings.TrimSpace(name), "xe") {
+			return hwmonDir
+		}
+		if fallback == "" {
+			fallback = hwmonDir
+		}
+	}
+	return fallback
+}
+
+func sysfsFileExists(path string) bool {
+	_, err := utils.ReadStringFileLimited(path, 1)
+	return err == nil
+}
+
+// updateIntelSysfsGpuData reads GPU metrics from sysfs and updates the GPU data map.
+// Returns true if the required energy counter was read successfully.
+func (gm *GPUManager) updateIntelSysfsGpuData(cardPath, hwmonDir string) bool {
+	devicePath := filepath.Join(cardPath, "device")
+	id := filepath.Base(cardPath)
+
+	energy, err := readSysfsUint(filepath.Join(hwmonDir, "energy1_input"))
+	if err != nil {
+		return false
+	}
+
+	now := intelSysfsNow()
+	power, hasPower := gm.calculateIntelSysfsPower(id, energy, now)
+	powerPkg, hasPowerPkg := gm.readIntelSysfsPowerPkg(id, hwmonDir, now)
+	temp := readIntelSysfsTemperature(hwmonDir)
+	usage, usageErr := readOptionalSysfsFloat(filepath.Join(devicePath, "gpu_busy_percent"))
+	memUsed, memUsedErr := readFirstOptionalSysfsFloat(
+		filepath.Join(devicePath, "mem_info_vram_used"),
+		filepath.Join(devicePath, "mem_info_lmem_used"),
+		filepath.Join(devicePath, "mem_info_local_mem_used"),
+	)
+	memTotal, memTotalErr := readFirstOptionalSysfsFloat(
+		filepath.Join(devicePath, "mem_info_vram_total"),
+		filepath.Join(devicePath, "mem_info_lmem_total"),
+		filepath.Join(devicePath, "mem_info_local_mem_total"),
+	)
+
+	gm.Lock()
+	defer gm.Unlock()
+
+	gpu, ok := gm.GpuDataMap[id]
+	if !ok {
+		gpu = &system.GPUData{Name: getIntelSysfsGpuName(cardPath)}
+		gm.GpuDataMap[id] = gpu
+	}
+
+	if usageErr == nil {
+		gpu.Usage += usage
+	}
+	if memUsedErr == nil {
+		gpu.MemoryUsed = utils.BytesToMegabytes(memUsed)
+	}
+	if memTotalErr == nil {
+		gpu.MemoryTotal = utils.BytesToMegabytes(memTotal)
+	}
+	if temp > 0 {
+		gpu.Temperature = temp
+	}
+	if hasPower {
+		gpu.Power += power
+		slog.Debug("Computed Intel sysfs GPU power", "card", id, "watts", power)
+	}
+	if hasPowerPkg {
+		gpu.PowerPkg += powerPkg
+	}
+	gpu.Count++
+	return true
+}
+
+func (gm *GPUManager) calculateIntelSysfsPower(cardID string, microjoules uint64, timestamp time.Time) (float64, bool) {
+	if gm.intelSysfsEnergySnapshots == nil {
+		gm.intelSysfsEnergySnapshots = make(map[string]intelSysfsEnergySnapshot)
+	}
+
+	last, ok := gm.intelSysfsEnergySnapshots[cardID]
+	gm.intelSysfsEnergySnapshots[cardID] = intelSysfsEnergySnapshot{microjoules: microjoules, timestamp: timestamp}
+	if !ok {
+		return 0, false
+	}
+	if microjoules < last.microjoules {
+		slog.Debug("Intel sysfs energy counter reset", "card", cardID)
+		return 0, false
+	}
+	elapsed := timestamp.Sub(last.timestamp).Seconds()
+	if elapsed <= 0 {
+		return 0, false
+	}
+	delta := microjoules - last.microjoules
+	return float64(delta) / 1_000_000.0 / elapsed, true
+}
+
+func (gm *GPUManager) readIntelSysfsPowerPkg(cardID, hwmonDir string, timestamp time.Time) (float64, bool) {
+	energyPaths, _ := filepath.Glob(filepath.Join(hwmonDir, "energy*_input"))
+	for _, path := range energyPaths {
+		if filepath.Base(path) == "energy1_input" {
+			continue
+		}
+		energy, err := readSysfsUint(path)
+		if err != nil {
+			continue
+		}
+		return gm.calculateIntelSysfsPower(cardID+":"+filepath.Base(path), energy, timestamp)
+	}
+	return 0, false
+}
+
+func readIntelSysfsTemperature(hwmonDir string) float64 {
+	tempPaths, _ := filepath.Glob(filepath.Join(hwmonDir, "temp*_input"))
+	for _, path := range tempPaths {
+		temp, err := readSysfsFloat(path)
+		if err == nil && temp > 0 {
+			return temp / 1000.0
+		}
+	}
+	return 0
+}
+
+func readSysfsUint(path string) (uint64, error) {
+	val, err := utils.ReadStringFileLimited(path, 64)
+	if err != nil {
+		slog.Debug("Failed to read sysfs value", "path", path, "error", err)
+		return 0, err
+	}
+	return strconv.ParseUint(strings.TrimSpace(val), 10, 64)
+}
+
+func readOptionalSysfsFloat(path string) (float64, error) {
+	val, err := os.ReadFile(path)
+	if err != nil {
+		return 0, err
+	}
+	return strconv.ParseFloat(strings.TrimSpace(string(val)), 64)
+}
+
+func readFirstOptionalSysfsFloat(paths ...string) (float64, error) {
+	for _, path := range paths {
+		val, err := readOptionalSysfsFloat(path)
+		if err == nil {
+			return val, nil
+		}
+	}
+	return 0, fmt.Errorf("no sysfs values found")
+}
+
+func getIntelSysfsGpuName(cardPath string) string {
+	devicePath := filepath.Join(cardPath, "device")
+	if product, err := utils.ReadStringFileLimited(filepath.Join(devicePath, "product_name"), 128); err == nil && strings.TrimSpace(product) != "" {
+		return strings.TrimSpace(product)
+	}
+	if name, err := utils.ReadStringFileLimited(filepath.Join(devicePath, "name"), 128); err == nil && strings.TrimSpace(name) != "" {
+		return strings.TrimSpace(name)
+	}
+	return fmt.Sprintf("Intel GPU %s", filepath.Base(cardPath))
+}

agent/gpu_intel_sysfs_linux_test.go

@@ -0,0 +1,217 @@
+//go:build linux
+
+package agent
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/henrygd/beszel/agent/utils"
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func setupIntelSysfsTest(t *testing.T) (root, cardPath, hwmonPath string) {
+	t.Helper()
+	root = t.TempDir()
+	oldRoot := drmSysfsRoot
+	drmSysfsRoot = root
+	t.Cleanup(func() {
+		drmSysfsRoot = oldRoot
+	})
+
+	cardPath = filepath.Join(root, "card0")
+	devicePath := filepath.Join(cardPath, "device")
+	hwmonPath = filepath.Join(devicePath, "hwmon", "hwmon0")
+	require.NoError(t, os.MkdirAll(hwmonPath, 0o755))
+	return root, cardPath, hwmonPath
+}
+
+func writeIntelSysfsFile(t *testing.T, basePath, name, content string) {
+	t.Helper()
+	require.NoError(t, os.WriteFile(filepath.Join(basePath, name), []byte(content), 0o644))
+}
+
+func setIntelSysfsTime(t *testing.T, now time.Time) {
+	t.Helper()
+	oldNow := intelSysfsNow
+	intelSysfsNow = func() time.Time { return now }
+	t.Cleanup(func() {
+		intelSysfsNow = oldNow
+	})
+}
+
+func TestIntelSysfsDetectsIntelCardWithEnergy(t *testing.T) {
+	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
+	devicePath := filepath.Join(cardPath, "device")
+	writeIntelSysfsFile(t, devicePath, "vendor", "0x8086\n")
+	writeIntelSysfsFile(t, hwmonPath, "name", "xe\n")
+	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "1000000\n")
+
+	gm := &GPUManager{}
+	assert.True(t, gm.hasIntelSysfs())
+
+	cards, err := discoverIntelSysfsCards()
+	require.NoError(t, err)
+	require.Len(t, cards, 1)
+	assert.Equal(t, cardPath, cards[0].cardPath)
+	assert.Equal(t, hwmonPath, cards[0].hwmonDir)
+}
+
+func TestIntelSysfsRejectsNonIntelCard(t *testing.T) {
+	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
+	devicePath := filepath.Join(cardPath, "device")
+	writeIntelSysfsFile(t, devicePath, "vendor", "0x1002\n")
+	writeIntelSysfsFile(t, hwmonPath, "name", "xe\n")
+	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "1000000\n")
+
+	gm := &GPUManager{}
+	assert.False(t, gm.hasIntelSysfs())
+}
+
+func TestIntelSysfsRequiresEnergyInput(t *testing.T) {
+	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
+	devicePath := filepath.Join(cardPath, "device")
+	writeIntelSysfsFile(t, devicePath, "vendor", "0x8086\n")
+	writeIntelSysfsFile(t, hwmonPath, "name", "xe\n")
+
+	gm := &GPUManager{}
+	assert.False(t, gm.hasIntelSysfs())
+}
+
+func TestIntelSysfsFirstSampleInitializesWithoutBogusPower(t *testing.T) {
+	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
+	devicePath := filepath.Join(cardPath, "device")
+	writeIntelSysfsFile(t, devicePath, "vendor", "0x8086\n")
+	writeIntelSysfsFile(t, hwmonPath, "name", "xe\n")
+	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "1000000\n")
+	setIntelSysfsTime(t, time.Unix(100, 0))
+
+	gm := &GPUManager{GpuDataMap: make(map[string]*system.GPUData)}
+	ok := gm.updateIntelSysfsGpuData(cardPath, hwmonPath)
+	require.True(t, ok)
+
+	gpu := gm.GpuDataMap["card0"]
+	require.NotNil(t, gpu)
+	assert.Equal(t, "Intel GPU card0", gpu.Name)
+	assert.Equal(t, 0.0, gpu.Power)
+	assert.Equal(t, 1.0, gpu.Count)
+}
+
+func TestIntelSysfsSecondSampleComputesWatts(t *testing.T) {
+	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
+	devicePath := filepath.Join(cardPath, "device")
+	writeIntelSysfsFile(t, devicePath, "vendor", "0x8086\n")
+	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "1000000\n")
+
+	gm := &GPUManager{GpuDataMap: make(map[string]*system.GPUData)}
+	oldNow := intelSysfsNow
+	intelSysfsNow = func() time.Time { return time.Unix(100, 0) }
+	t.Cleanup(func() { intelSysfsNow = oldNow })
+	require.True(t, gm.updateIntelSysfsGpuData(cardPath, hwmonPath))
+
+	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "6000000\n")
+	intelSysfsNow = func() time.Time { return time.Unix(102, 0) }
+	require.True(t, gm.updateIntelSysfsGpuData(cardPath, hwmonPath))
+
+	gpu := gm.GpuDataMap["card0"]
+	require.NotNil(t, gpu)
+	assert.Equal(t, 2.5, gpu.Power)
+	assert.Equal(t, 2.0, gpu.Count)
+}
+
+func TestIntelSysfsSecondEnergyCounterMapsToPowerPkg(t *testing.T) {
+	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
+	devicePath := filepath.Join(cardPath, "device")
+	writeIntelSysfsFile(t, devicePath, "vendor", "0x8086\n")
+	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "1000000\n")
+	writeIntelSysfsFile(t, hwmonPath, "energy2_input", "2000000\n")
+
+	oldNow := intelSysfsNow
+	t.Cleanup(func() { intelSysfsNow = oldNow })
+	gm := &GPUManager{GpuDataMap: make(map[string]*system.GPUData)}
+	intelSysfsNow = func() time.Time { return time.Unix(100, 0) }
+	require.True(t, gm.updateIntelSysfsGpuData(cardPath, hwmonPath))
+
+	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "2000000\n")
+	writeIntelSysfsFile(t, hwmonPath, "energy2_input", "8000000\n")
+	intelSysfsNow = func() time.Time { return time.Unix(102, 0) }
+	require.True(t, gm.updateIntelSysfsGpuData(cardPath, hwmonPath))
+
+	gpu := gm.GpuDataMap["card0"]
+	require.NotNil(t, gpu)
+	assert.Equal(t, 0.5, gpu.Power)
+	assert.Equal(t, 3.0, gpu.PowerPkg)
+}
+
+func TestIntelSysfsCounterResetSkipsOneSample(t *testing.T) {
+	gm := &GPUManager{}
+	power, ok := gm.calculateIntelSysfsPower("card0", 5000000, time.Unix(100, 0))
+	assert.False(t, ok)
+	assert.Equal(t, 0.0, power)
+
+	power, ok = gm.calculateIntelSysfsPower("card0", 1000000, time.Unix(101, 0))
+	assert.False(t, ok)
+	assert.Equal(t, 0.0, power)
+
+	power, ok = gm.calculateIntelSysfsPower("card0", 3000000, time.Unix(103, 0))
+	assert.True(t, ok)
+	assert.Equal(t, 1.0, power)
+}
+
+func TestIntelSysfsTempInputMapsToCelsius(t *testing.T) {
+	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
+	devicePath := filepath.Join(cardPath, "device")
+	writeIntelSysfsFile(t, devicePath, "vendor", "0x8086\n")
+	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "1000000\n")
+	writeIntelSysfsFile(t, hwmonPath, "temp1_input", "43500\n")
+	setIntelSysfsTime(t, time.Unix(100, 0))
+
+	gm := &GPUManager{GpuDataMap: make(map[string]*system.GPUData)}
+	require.True(t, gm.updateIntelSysfsGpuData(cardPath, hwmonPath))
+
+	gpu := gm.GpuDataMap["card0"]
+	require.NotNil(t, gpu)
+	assert.Equal(t, 43.5, gpu.Temperature)
+}
+
+func TestIntelSysfsMissingOptionalFilesDoNotFail(t *testing.T) {
+	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
+	devicePath := filepath.Join(cardPath, "device")
+	writeIntelSysfsFile(t, devicePath, "vendor", "0x8086\n")
+	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "1000000\n")
+	setIntelSysfsTime(t, time.Unix(100, 0))
+
+	gm := &GPUManager{GpuDataMap: make(map[string]*system.GPUData)}
+	require.True(t, gm.updateIntelSysfsGpuData(cardPath, hwmonPath))
+
+	gpu := gm.GpuDataMap["card0"]
+	require.NotNil(t, gpu)
+	assert.Equal(t, 0.0, gpu.Usage)
+	assert.Equal(t, 0.0, gpu.MemoryUsed)
+	assert.Equal(t, 0.0, gpu.MemoryTotal)
+	assert.Equal(t, 0.0, gpu.Temperature)
+}
+
+func TestIntelSysfsMapsOpportunisticMemoryAndUsage(t *testing.T) {
+	_, cardPath, hwmonPath := setupIntelSysfsTest(t)
+	devicePath := filepath.Join(cardPath, "device")
+	writeIntelSysfsFile(t, devicePath, "vendor", "0x8086\n")
+	writeIntelSysfsFile(t, devicePath, "gpu_busy_percent", "37\n")
+	writeIntelSysfsFile(t, devicePath, "mem_info_lmem_used", "1073741824\n")
+	writeIntelSysfsFile(t, devicePath, "mem_info_lmem_total", "2147483648\n")
+	writeIntelSysfsFile(t, hwmonPath, "energy1_input", "1000000\n")
+	setIntelSysfsTime(t, time.Unix(100, 0))
+
+	gm := &GPUManager{GpuDataMap: make(map[string]*system.GPUData)}
+	require.True(t, gm.updateIntelSysfsGpuData(cardPath, hwmonPath))
+
+	gpu := gm.GpuDataMap["card0"]
+	require.NotNil(t, gpu)
+	assert.Equal(t, 37.0, gpu.Usage)
+	assert.Equal(t, utils.BytesToMegabytes(1073741824), gpu.MemoryUsed)
+	assert.Equal(t, utils.BytesToMegabytes(2147483648), gpu.MemoryTotal)
+}

agent/gpu_intel_sysfs_unsupported.go

@@ -0,0 +1,13 @@
+//go:build !linux
+
+package agent
+
+type intelSysfsEnergySnapshot struct{}
+
+func (gm *GPUManager) hasIntelSysfs() bool {
+	return false
+}
+
+func (gm *GPUManager) startIntelSysfsCollector() bool {
+	return false
+}

agent/gpu_nvtop.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"log/slog"
 	"os/exec"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"time"
@@ -48,9 +49,14 @@ func (gm *GPUManager) updateNvtopSnapshots(snapshots []nvtopSnapshot) bool {
 
 	valid := false
 	usedIDs := make(map[string]struct{}, len(snapshots))
+	var xeName string
 	for i, sample := range snapshots {
+		// nvtop leaves device_name unset on xe devices.
 		if sample.DeviceName == "" {
-			continue
+			if xeName == "" {
+				xeName = xeGpuName()
+			}
+			sample.DeviceName = xeName
 		}
 		indexID := "n" + strconv.Itoa(i)
 		id := indexID
@@ -158,3 +164,38 @@ func (gm *GPUManager) startNvtopCollector(interval string, onFailure func()) {
 		}
 	}()
 }
+
+// xeDevicePath returns the sysfs device path of the first xe GPU, or "".
+func xeDevicePath() string {
+	cards, err := filepath.Glob("/sys/class/drm/card*")
+	if err != nil {
+		return ""
+	}
+	for _, card := range cards {
+		if strings.Contains(filepath.Base(card), "-") {
+			continue
+		}
+		if uevent, err := utils.ReadStringFileLimited(filepath.Join(card, "device", "uevent"), 4096); err == nil && strings.Contains(uevent, "DRIVER=xe") {
+			return filepath.Join(card, "device")
+		}
+	}
+	return ""
+}
+
+func (gm *GPUManager) hasXe() bool {
+	return xeDevicePath() != ""
+}
+
+// xeGpuName names an xe GPU from its PCI device id; nvtop leaves device_name unset on xe.
+func xeGpuName() string {
+	devicePath := xeDevicePath()
+	if devicePath == "" {
+		return "GPU"
+	}
+	id, err := utils.ReadStringFileLimited(filepath.Join(devicePath, "device"), 64)
+	if err != nil {
+		return "GPU"
+	}
+	id = strings.ToLower(strings.TrimSpace(strings.TrimPrefix(id, "0x")))
+	return "Intel GPU (" + id + ")"
+}

agent/gpu_test.go

@@ -332,11 +332,12 @@ func TestUpdateNvtopSnapshotsKeepsDeviceAssociationWhenOrderChanges(t *testing.T
 }
 
 func TestParseCollectorPriority(t *testing.T) {
-	got := parseCollectorPriority(" nvml, nvidia-smi, intel_gpu_top, amd_sysfs, nvtop, rocm-smi, bad ")
+	got := parseCollectorPriority(" nvml, nvidia-smi, intel_gpu_top, intel_sysfs, amd_sysfs, nvtop, rocm-smi, bad ")
 	want := []collectorSource{
 		collectorSourceNVML,
 		collectorSourceNvidiaSMI,
 		collectorSourceIntelGpuTop,
+		collectorSourceIntelSysfs,
 		collectorSourceAmdSysfs,
 		collectorSourceNVTop,
 		collectorSourceRocmSMI,
@@ -565,6 +566,42 @@ func TestGetCurrentData(t *testing.T) {
 		assert.EqualValues(t, 2, gm.GpuDataMap["0"].Count, "Count should still be 2")
 	})
 
+	t.Run("carries Intel GPU average forward between samples", func(t *testing.T) {
+		// Intel GPUs report no temp/memory, so between-sample gaps (delta 0) must
+		// reuse the last average instead of returning zeros and blanking the chart.
+		gm := &GPUManager{
+			GpuDataMap: map[string]*system.GPUData{
+				"0": {
+					Name:     "GPU",
+					Usage:    0,   // derived from engines for Intel
+					Power:    200, // averages to 100 over 2 counts
+					PowerPkg: 60,  // averages to 30 over 2 counts
+					Count:    2,
+					Engines: map[string]float64{
+						"Render/3D": 80, // averages to 40
+						"Video":     20, // averages to 10
+					},
+				},
+			},
+		}
+
+		cacheKey := uint16(1000) // realtime cache key
+
+		// First collection - computes and stores averages
+		result1 := gm.GetCurrentData(cacheKey)
+		assert.InDelta(t, 100.0, result1["0"].Power, 0.01)
+		assert.InDelta(t, 30.0, result1["0"].PowerPkg, 0.01)
+		assert.InDelta(t, 40.0, result1["0"].Engines["Render/3D"], 0.01)
+
+		// Second collection with no new sample (count unchanged, temp/mem still 0).
+		// Must carry the last average forward rather than blanking to zero.
+		result2 := gm.GetCurrentData(cacheKey)
+		assert.Equal(t, "GPU", result2["0"].Name, "Name should be preserved")
+		assert.InDelta(t, 100.0, result2["0"].Power, 0.01, "Should reuse last average power, not 0")
+		assert.InDelta(t, 30.0, result2["0"].PowerPkg, 0.01, "Should reuse last average package power, not 0")
+		assert.InDelta(t, 40.0, result2["0"].Engines["Render/3D"], 0.01, "Should reuse last average engine usage")
+	})
+
 	t.Run("tracks separate averages per cache key", func(t *testing.T) {
 		gm := &GPUManager{
 			GpuDataMap: map[string]*system.GPUData{

agent/handlers.go

@@ -51,6 +51,7 @@ func NewHandlerRegistry() *HandlerRegistry {
 	registry.Register(common.GetContainerInfo, &GetContainerInfoHandler{})
 	registry.Register(common.GetSmartData, &GetSmartDataHandler{})
 	registry.Register(common.GetSystemdInfo, &GetSystemdInfoHandler{})
+	registry.Register(common.GetZfsData, &GetZfsDataHandler{})
 
 	return registry
 }
@@ -166,14 +167,33 @@ type GetSmartDataHandler struct{}
 
 func (h *GetSmartDataHandler) Handle(hctx *HandlerContext) error {
 	if hctx.Agent.smartManager == nil {
-		// return empty map to indicate no data
-		return hctx.SendResponse(map[string]smart.SmartData{}, hctx.RequestID)
+		return hctx.SendResponse(smart.SmartDataResponse{Data: map[string]smart.SmartData{}}, hctx.RequestID)
 	}
-	if err := hctx.Agent.smartManager.Refresh(false); err != nil {
+	complete, err := hctx.Agent.smartManager.Refresh(false)
+	if err != nil {
 		slog.Debug("smart refresh failed", "err", err)
 	}
-	data := hctx.Agent.smartManager.GetCurrentData()
-	return hctx.SendResponse(data, hctx.RequestID)
+	return hctx.SendResponse(smart.SmartDataResponse{
+		Data:     hctx.Agent.smartManager.GetCurrentData(),
+		Complete: complete,
+	}, hctx.RequestID)
+}
+
+////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////
+
+// GetZfsDataHandler handles ZFS detail data requests
+type GetZfsDataHandler struct{}
+
+func (h *GetZfsDataHandler) Handle(hctx *HandlerContext) error {
+	if hctx.Agent.storagePoolManager == nil {
+		return hctx.SendResponse(nil, hctx.RequestID)
+	}
+	var req common.ZfsDataRequest
+	if err := cbor.Unmarshal(hctx.Request.Data, &req); err != nil {
+		return err
+	}
+	return hctx.SendResponse(hctx.Agent.storagePoolManager.GetDetail(req.Force), hctx.RequestID)
 }
 
 ////////////////////////////////////////////////////////////////////////////

agent/handlers_test.go

@@ -4,9 +4,12 @@ package agent
 
 import (
 	"testing"
+	"time"
 
 	"github.com/fxamacker/cbor/v2"
+	"github.com/henrygd/beszel/agent/zfs"
 	"github.com/henrygd/beszel/internal/common"
+	"github.com/henrygd/beszel/internal/entities/smart"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -17,6 +20,44 @@ type MockHandler struct {
 	handleFunc           func(ctx *HandlerContext) error
 }
 
+func TestNewAgentResponseSmartData(t *testing.T) {
+	response := newAgentResponse(smart.SmartDataResponse{
+		Data: map[string]smart.SmartData{
+			"AAA": {SerialNumber: "AAA"},
+		},
+		Complete: true,
+	}, nil)
+
+	assert.Equal(t, "AAA", response.SmartData["AAA"].SerialNumber)
+	assert.True(t, response.SmartComplete)
+}
+
+func TestGetZfsDataHandlerForceRefresh(t *testing.T) {
+	poolCalls := 0
+	zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs"}}}
+	zm.backends[0].poolStatsFn = func() ([]zfs.PoolStat, error) {
+		poolCalls++
+		return []zfs.PoolStat{{Name: "tank", Alloc: uint64(poolCalls)}}, nil
+	}
+	zm.backends[0].poolStatusesFn = func() ([]zfs.PoolStatus, error) { return nil, nil }
+	zm.backends[0].datasetsFn = func() ([]zfs.Dataset, error) { return nil, nil }
+	zm.GetDetail(false)
+
+	requestData, err := cbor.Marshal(common.ZfsDataRequest{Force: true})
+	assert.NoError(t, err)
+	ctx := &HandlerContext{
+		Agent: &Agent{storagePoolManager: zm},
+		Request: &common.HubRequest[cbor.RawMessage]{
+			Action: common.GetZfsData,
+			Data:   requestData,
+		},
+		SendResponse: func(any, *uint32) error { return nil },
+	}
+
+	assert.NoError(t, (&GetZfsDataHandler{}).Handle(ctx))
+	assert.Equal(t, 2, poolCalls)
+}
+
 func (m *MockHandler) Handle(ctx *HandlerContext) error {
 	if m.handleFunc != nil {
 		return m.handleFunc(ctx)

agent/mdraid_linux.go

@@ -17,15 +17,17 @@ import (
 var mdraidSysfsRoot = "/sys"
 
 type mdraidHealth struct {
-	level         string
-	arrayState    string
-	degraded      uint64
-	raidDisks     uint64
-	syncAction    string
-	syncCompleted string
-	syncSpeed     string
-	mismatchCnt   uint64
-	capacity      uint64
+	level          string
+	arrayState     string
+	degraded       uint64
+	faultyDisks    uint64
+	populatedDisks uint64
+	raidDisks      uint64
+	syncAction     string
+	syncCompleted  string
+	syncSpeed      string
+	mismatchCnt    uint64
+	capacity       uint64
 }
 
 // scanMdraidDevices discovers Linux md arrays exposed in sysfs.
@@ -92,6 +94,9 @@ func (sm *SmartManager) collectMdraidHealth(deviceInfo *DeviceInfo) (bool, error
 	if health.degraded > 0 {
 		attrs = append(attrs, &smart.SmartAttribute{Name: "Degraded", RawValue: health.degraded})
 	}
+	if health.faultyDisks > 0 {
+		attrs = append(attrs, &smart.SmartAttribute{Name: "FaultyDisks", RawValue: health.faultyDisks})
+	}
 	if health.syncAction != "" {
 		attrs = append(attrs, &smart.SmartAttribute{Name: "SyncAction", RawString: health.syncAction})
 	}
@@ -152,6 +157,7 @@ func readMdraidHealth(blockName string) (mdraidHealth, bool) {
 	if val, ok := utils.ReadUintFile(filepath.Join(mdDir, "degraded")); ok {
 		out.degraded = val
 	}
+	out.faultyDisks, out.populatedDisks = countMdraidMemberStates(blockName, mdraidSysfsRoot)
 	if val, ok := utils.ReadUintFile(filepath.Join(mdDir, "mismatch_cnt")); ok {
 		out.mismatchCnt = val
 	}
@@ -177,11 +183,28 @@ func mdraidSmartStatus(health mdraidHealth) string {
 	case "resync", "recover", "reshape":
 		return "WARNING"
 	}
-	if health.degraded > 0 {
+	// Use actual faulty member count rather than the degraded counter, which
+	// equals raid_disks minus active_disks. On QNAP systems raid_disks may be
+	// set to a large value (e.g. 32) while only a few slots are ever used,
+	// making degraded misleadingly large despite zero failed disks.
+	if health.faultyDisks > 0 {
 		return "FAILED"
 	}
+	if health.degraded > 0 {
+		if isSparseSlotDegraded(health) {
+			// A sysfs snapshot cannot distinguish reserved slots from a removed
+			// member on sparse arrays, so report the ambiguity as a warning.
+			return "WARNING"
+		}
+		return "FAILED"
+	}
+	if health.mismatchCnt > 0 {
+		return "WARNING"
+	}
+	// "check" scans for consistency problems without repairing mismatches.
+	// With no mismatches, keep it green while reporting progress attributes.
 	switch syncAction {
-	case "check", "repair":
+	case "repair":
 		return "WARNING"
 	}
 	switch state {
@@ -191,6 +214,43 @@ func mdraidSmartStatus(health mdraidHealth) string {
 	return "UNKNOWN"
 }
 
+// countMdraidMemberStates reads member device directories under
+// block/<name>/md and returns how many are explicitly marked "faulty", plus
+// how many are populated at all (regardless of state). populatedDisks lets
+// callers distinguish RAID slots that were never used (QNAP reserves far
+// more raid_disks than it ever populates) from members that went missing.
+func countMdraidMemberStates(blockName, root string) (faultyDisks, populatedDisks uint64) {
+	devDir := filepath.Join(root, "block", blockName, "md")
+	entries, err := os.ReadDir(devDir)
+	if err != nil {
+		return 0, 0
+	}
+	for _, ent := range entries {
+		if !strings.HasPrefix(ent.Name(), "dev-") {
+			continue
+		}
+		populatedDisks++
+		statePath := filepath.Join(devDir, ent.Name(), "state")
+		state := utils.ReadStringFile(statePath)
+		if strings.Contains(state, "faulty") {
+			faultyDisks++
+		}
+	}
+	return faultyDisks, populatedDisks
+}
+
+// isSparseSlotDegraded reports whether a non-zero "degraded" count may be
+// explained by RAID slots that were never populated. QNAP configures system
+// arrays with raid_disks set to a large fixed maximum (e.g. 32) far beyond the
+// handful of slots it ever populates, so sparse slots outnumber populated ones.
+func isSparseSlotDegraded(health mdraidHealth) bool {
+	if health.populatedDisks == 0 || health.raidDisks <= health.populatedDisks {
+		return false
+	}
+	sparseSlots := health.raidDisks - health.populatedDisks
+	return sparseSlots > health.populatedDisks
+}
+
 // isMdraidBlockName matches /dev/mdN-style block device names.
 func isMdraidBlockName(name string) bool {
 	if !strings.HasPrefix(name, "md") {

agent/mdraid_linux_test.go

@@ -40,6 +40,15 @@ func TestMdraidMockSysfsScanAndCollect(t *testing.T) {
 	write(filepath.Join(mdDir, "sync_completed"), "10%\n")
 	write(filepath.Join(mdDir, "sync_speed"), "100M\n")
 	write(filepath.Join(mdDir, "mismatch_cnt"), "0\n")
+
+	// Simulate two healthy member devices (no faulty state).
+	for _, dev := range []string{"dev-sda", "dev-sdb"} {
+		devPath := filepath.Join(mdDir, dev)
+		if err := os.MkdirAll(devPath, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		write(filepath.Join(devPath, "state"), "in_sync\n")
+	}
 	write(filepath.Join(queueDir, "logical_block_size"), "512\n")
 	write(filepath.Join(tmp, "block", "md0", "size"), "2048\n")
 
@@ -81,19 +90,93 @@ func TestMdraidMockSysfsScanAndCollect(t *testing.T) {
 	}
 }
 
+func TestCountMdraidMemberStates(t *testing.T) {
+	tmp := t.TempDir()
+
+	write := func(path, content string) {
+		t.Helper()
+		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	mdDir := filepath.Join(tmp, "block", "md0", "md")
+
+	// No dev-* entries: zero faulty, zero populated.
+	if faulty, populated := countMdraidMemberStates("md0", tmp); faulty != 0 || populated != 0 {
+		t.Fatalf("no members: got (faulty=%d populated=%d), want (0,0)", faulty, populated)
+	}
+
+	// Two healthy members.
+	write(filepath.Join(mdDir, "dev-sda", "state"), "in_sync\n")
+	write(filepath.Join(mdDir, "dev-sdb", "state"), "in_sync\n")
+	if faulty, populated := countMdraidMemberStates("md0", tmp); faulty != 0 || populated != 2 {
+		t.Fatalf("all in_sync: got (faulty=%d populated=%d), want (0,2)", faulty, populated)
+	}
+
+	// One faulty member.
+	write(filepath.Join(mdDir, "dev-sdb", "state"), "faulty\n")
+	if faulty, populated := countMdraidMemberStates("md0", tmp); faulty != 1 || populated != 2 {
+		t.Fatalf("one faulty: got (faulty=%d populated=%d), want (1,2)", faulty, populated)
+	}
+
+	// QNAP-style: 28 degraded slots but no dev-* entries for them, 4 in_sync.
+	write(filepath.Join(mdDir, "dev-sdb", "state"), "in_sync\n")
+	write(filepath.Join(mdDir, "dev-sdc", "state"), "in_sync\n")
+	write(filepath.Join(mdDir, "dev-sdd", "state"), "in_sync\n")
+	if faulty, populated := countMdraidMemberStates("md0", tmp); faulty != 0 || populated != 4 {
+		t.Fatalf("qnap sparse: got (faulty=%d populated=%d), want (0,4)", faulty, populated)
+	}
+}
+
 func TestMdraidSmartStatus(t *testing.T) {
 	if got := mdraidSmartStatus(mdraidHealth{arrayState: "inactive"}); got != "FAILED" {
 		t.Fatalf("mdraidSmartStatus(inactive) = %q, want FAILED", got)
 	}
-	if got := mdraidSmartStatus(mdraidHealth{arrayState: "active", degraded: 1, syncAction: "recover"}); got != "WARNING" {
+	if got := mdraidSmartStatus(mdraidHealth{arrayState: "active", degraded: 1, faultyDisks: 1, syncAction: "recover"}); got != "WARNING" {
 		t.Fatalf("mdraidSmartStatus(degraded+recover) = %q, want WARNING", got)
 	}
-	if got := mdraidSmartStatus(mdraidHealth{arrayState: "active", degraded: 1}); got != "FAILED" {
-		t.Fatalf("mdraidSmartStatus(degraded) = %q, want FAILED", got)
+	if got := mdraidSmartStatus(mdraidHealth{arrayState: "active", degraded: 1, faultyDisks: 1}); got != "FAILED" {
+		t.Fatalf("mdraidSmartStatus(degraded+faulty) = %q, want FAILED", got)
+	}
+	// QNAP-style: raid_disks=32 but only 4 populated; degraded=28 but no faulty devices.
+	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", degraded: 28, faultyDisks: 0, raidDisks: 32, populatedDisks: 4}); got != "WARNING" {
+		t.Fatalf("mdraidSmartStatus(qnap sparse) = %q, want WARNING", got)
+	}
+	// A member disappearing from the same sparse array is indistinguishable
+	// from another reserved slot, so it must not be reported as healthy.
+	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", degraded: 29, faultyDisks: 0, raidDisks: 32, populatedDisks: 3}); got != "WARNING" {
+		t.Fatalf("mdraidSmartStatus(qnap sparse missing member) = %q, want WARNING", got)
+	}
+	// A genuinely missing member (removed dev-* entry, not just an unpopulated
+	// QNAP reserve slot) must still fail: raid_disks=4, only 3 populated, all
+	// of them in_sync, so faultyDisks==0 but degraded==1.
+	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", degraded: 1, faultyDisks: 0, raidDisks: 4, populatedDisks: 3}); got != "FAILED" {
+		t.Fatalf("mdraidSmartStatus(missing member) = %q, want FAILED", got)
+	}
+	// Degraded with no member-state info at all (e.g. sysfs read failed) must
+	// still fail rather than being silently treated as a sparse QNAP array.
+	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", degraded: 1, faultyDisks: 0, raidDisks: 4, populatedDisks: 0}); got != "FAILED" {
+		t.Fatalf("mdraidSmartStatus(degraded, no member info) = %q, want FAILED", got)
 	}
 	if got := mdraidSmartStatus(mdraidHealth{arrayState: "active", syncAction: "recover"}); got != "WARNING" {
 		t.Fatalf("mdraidSmartStatus(recover) = %q, want WARNING", got)
 	}
+	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", syncAction: "check"}); got != "PASSED" {
+		t.Fatalf("mdraidSmartStatus(clean+check) = %q, want PASSED", got)
+	}
+	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", syncAction: "check", mismatchCnt: 1}); got != "WARNING" {
+		t.Fatalf("mdraidSmartStatus(clean+check+mismatch) = %q, want WARNING", got)
+	}
+	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", mismatchCnt: 1}); got != "WARNING" {
+		t.Fatalf("mdraidSmartStatus(clean+mismatch) = %q, want WARNING", got)
+	}
+	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean", syncAction: "repair"}); got != "WARNING" {
+		t.Fatalf("mdraidSmartStatus(repair) = %q, want WARNING", got)
+	}
 	if got := mdraidSmartStatus(mdraidHealth{arrayState: "clean"}); got != "PASSED" {
 		t.Fatalf("mdraidSmartStatus(clean) = %q, want PASSED", got)
 	}

agent/response.go

@@ -21,6 +21,9 @@ func newAgentResponse(data any, requestID *uint32) common.AgentResponse {
 		response.String = &v
 	case map[string]smart.SmartData:
 		response.SmartData = v
+	case smart.SmartDataResponse:
+		response.SmartData = v.Data
+		response.SmartComplete = v.Complete
 	case systemd.ServiceDetails:
 		response.ServiceInfo = v
 	default:

agent/sensors_default.go

@@ -1,4 +1,4 @@
-//go:build !windows
+//go:build !windows && !freebsd
 
 package agent
 

agent/sensors_freebsd.go

@@ -0,0 +1,14 @@
+//go:build freebsd
+
+package agent
+
+import (
+	"context"
+
+	"github.com/shirou/gopsutil/v4/sensors"
+	"golang.org/x/sys/unix"
+)
+
+var getSensorTemps = func(ctx context.Context) ([]sensors.TemperatureStat, error) {
+	return getFreeBSDSensorTemps(ctx, unix.SysctlUint32)
+}

agent/sensors_freebsd_common.go

@@ -0,0 +1,81 @@
+//go:build freebsd || testing
+
+package agent
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/shirou/gopsutil/v4/sensors"
+)
+
+const (
+	freebsdZeroCelsiusDeciKelvin = 2731
+	freebsdAcpiThermalZoneCount  = 16
+)
+
+type freebsdSysctlUintReader func(name string) (uint32, error)
+
+func getFreeBSDSensorTemps(ctx context.Context, readSysctl freebsdSysctlUintReader) ([]sensors.TemperatureStat, error) {
+	cpuCount, err := readSysctl("hw.ncpu")
+	if err != nil {
+		return nil, err
+	}
+	temps := make([]sensors.TemperatureStat, 0, int(cpuCount)+freebsdAcpiThermalZoneCount)
+	for cpu := range cpuCount {
+		select {
+		case <-ctx.Done():
+			return temps, ctx.Err()
+		default:
+		}
+
+		sysctlName := fmt.Sprintf("dev.cpu.%d.temperature", cpu)
+		value, err := readSysctl(sysctlName)
+		if err != nil {
+			continue
+		}
+		temp, ok := freebsdDeciKelvinToCelsius(value)
+		if !ok {
+			continue
+		}
+		temps = append(temps, sensors.TemperatureStat{
+			SensorKey:   fmt.Sprintf("cpu.%d", cpu),
+			Temperature: temp,
+		})
+	}
+
+	for zone := 0; zone < freebsdAcpiThermalZoneCount; zone++ {
+		select {
+		case <-ctx.Done():
+			return temps, ctx.Err()
+		default:
+		}
+
+		sysctlName := fmt.Sprintf("hw.acpi.thermal.tz%d.temperature", zone)
+		value, err := readSysctl(sysctlName)
+		if err != nil {
+			continue
+		}
+		temp, ok := freebsdDeciKelvinToCelsius(value)
+		if !ok {
+			continue
+		}
+		temps = append(temps, sensors.TemperatureStat{
+			SensorKey:   fmt.Sprintf("acpi.thermal.tz%d", zone),
+			Temperature: temp,
+		})
+	}
+
+	return temps, nil
+}
+
+func freebsdDeciKelvinToCelsius(value uint32) (float64, bool) {
+	if value <= freebsdZeroCelsiusDeciKelvin {
+		return 0, false
+	}
+	temp := float64(int64(value)-freebsdZeroCelsiusDeciKelvin) / 10
+	if temp <= 0 || temp >= 200 {
+		return 0, false
+	}
+	return temp, true
+}

agent/sensors_freebsd_common_test.go

@@ -0,0 +1,167 @@
+//go:build testing
+
+package agent
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var errFakeFreeBSDSysctlNotFound = errors.New("sysctl not found")
+
+type fakeFreeBSDSysctls struct {
+	values map[string]uint32
+	errs   map[string]error
+}
+
+func (f fakeFreeBSDSysctls) read(name string) (uint32, error) {
+	if err, ok := f.errs[name]; ok {
+		return 0, err
+	}
+	if value, ok := f.values[name]; ok {
+		return value, nil
+	}
+	return 0, errFakeFreeBSDSysctlNotFound
+}
+
+func TestFreeBSDDeciKelvinToCelsius(t *testing.T) {
+	tests := []struct {
+		name     string
+		value    uint32
+		expected float64
+		ok       bool
+	}{
+		{
+			name:     "45 Celsius",
+			value:    3181,
+			expected: 45,
+			ok:       true,
+		},
+		{
+			name:     "fractional Celsius",
+			value:    3186,
+			expected: 45.5,
+			ok:       true,
+		},
+		{
+			name:  "zero deci-Kelvin",
+			value: 0,
+			ok:    false,
+		},
+		{
+			name:  "zero Celsius",
+			value: freebsdZeroCelsiusDeciKelvin,
+			ok:    false,
+		},
+		{
+			name:  "below zero Celsius",
+			value: freebsdZeroCelsiusDeciKelvin - 1,
+			ok:    false,
+		},
+		{
+			name:  "invalid signed integer",
+			value: 1<<32 - 1,
+			ok:    false,
+		},
+		{
+			name:  "unreasonably high Celsius",
+			value: freebsdZeroCelsiusDeciKelvin + 2000,
+			ok:    false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, ok := freebsdDeciKelvinToCelsius(tt.value)
+			assert.Equal(t, tt.ok, ok)
+			assert.InDelta(t, tt.expected, result, 0.001)
+		})
+	}
+}
+
+func TestGetFreeBSDSensorTemps(t *testing.T) {
+	reader := fakeFreeBSDSysctls{
+		values: map[string]uint32{
+			"hw.ncpu":                         4,
+			"dev.cpu.0.temperature":           3231,
+			"dev.cpu.1.temperature":           3242,
+			"dev.cpu.3.temperature":           freebsdZeroCelsiusDeciKelvin,
+			"hw.acpi.thermal.tz0.temperature": 3101,
+			"hw.acpi.thermal.tz2.temperature": 3116,
+			"hw.acpi.thermal.tz3.temperature": freebsdZeroCelsiusDeciKelvin,
+			"unrelated.sensor.value":          9999,
+			"dev.cpu.99.temperature":          9999,
+			"dev.amdtemp.0.core0.foo":         9999,
+		},
+	}
+
+	temps, err := getFreeBSDSensorTemps(context.Background(), reader.read)
+
+	require.NoError(t, err)
+	require.Len(t, temps, 4)
+	assert.Equal(t, "cpu.0", temps[0].SensorKey)
+	assert.InDelta(t, 50.0, temps[0].Temperature, 0.001)
+	assert.Equal(t, "cpu.1", temps[1].SensorKey)
+	assert.InDelta(t, 51.1, temps[1].Temperature, 0.001)
+	assert.Equal(t, "acpi.thermal.tz0", temps[2].SensorKey)
+	assert.InDelta(t, 37.0, temps[2].Temperature, 0.001)
+	assert.Equal(t, "acpi.thermal.tz2", temps[3].SensorKey)
+	assert.InDelta(t, 38.5, temps[3].Temperature, 0.001)
+}
+
+func TestGetFreeBSDSensorTempsCpuCountError(t *testing.T) {
+	reader := fakeFreeBSDSysctls{
+		errs: map[string]error{
+			"hw.ncpu": errors.New("permission denied"),
+		},
+	}
+
+	temps, err := getFreeBSDSensorTemps(context.Background(), reader.read)
+
+	assert.Nil(t, temps)
+	assert.EqualError(t, err, "permission denied")
+}
+
+func TestGetFreeBSDSensorTempsNoTemperatureSysctls(t *testing.T) {
+	reader := fakeFreeBSDSysctls{
+		values: map[string]uint32{"hw.ncpu": 2},
+	}
+
+	temps, err := getFreeBSDSensorTemps(context.Background(), reader.read)
+
+	require.NoError(t, err)
+	assert.Empty(t, temps)
+}
+
+func TestGetFreeBSDSensorTempsAcpiOnly(t *testing.T) {
+	reader := fakeFreeBSDSysctls{
+		values: map[string]uint32{
+			"hw.ncpu":                         0,
+			"hw.acpi.thermal.tz0.temperature": 3081,
+		},
+	}
+
+	temps, err := getFreeBSDSensorTemps(context.Background(), reader.read)
+
+	require.NoError(t, err)
+	require.Len(t, temps, 1)
+	assert.Equal(t, "acpi.thermal.tz0", temps[0].SensorKey)
+	assert.InDelta(t, 35.0, temps[0].Temperature, 0.001)
+}
+
+func TestGetFreeBSDSensorTempsContextCancelled(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	reader := fakeFreeBSDSysctls{
+		values: map[string]uint32{"hw.ncpu": 2},
+	}
+
+	temps, err := getFreeBSDSensorTemps(ctx, reader.read)
+
+	assert.Empty(t, temps)
+	assert.ErrorIs(t, err, context.Canceled)
+}

agent/sensors_test.go

@@ -602,8 +602,9 @@ func TestUpdateTemperaturesSkipsOnTimeout(t *testing.T) {
 		},
 	}
 
+	originalGetSensorTemps := getSensorTemps
 	t.Cleanup(func() {
-		getSensorTemps = sensors.TemperaturesWithContext
+		getSensorTemps = originalGetSensorTemps
 	})
 	getSensorTemps = func(ctx context.Context) ([]sensors.TemperatureStat, error) {
 		time.Sleep(50 * time.Millisecond)

agent/sensors_windows.go

@@ -214,9 +214,12 @@ func (lhm *lhmProcess) getTemps(ctx context.Context) (temps []sensors.Temperatur
 	return temps, nil
 }
 
-// getSensorTemps attempts to pull sensor temperatures from the embedded LHM process.
+// getSensorTemps is a variable so tests can replace the platform sensor collector.
+var getSensorTemps = getWindowsSensorTemps
+
+// getWindowsSensorTemps attempts to pull sensor temperatures from the embedded LHM process.
 // NB: LibreHardwareMonitorLib requires admin privileges to access all available sensors.
-func getSensorTemps(ctx context.Context) (temps []sensors.TemperatureStat, err error) {
+func getWindowsSensorTemps(ctx context.Context) (temps []sensors.TemperatureStat, err error) {
 	defer func() {
 		if err != nil {
 			slog.Debug("Error reading sensors", "err", err)

agent/server.go

@@ -29,9 +29,6 @@ type ServerOptions struct {
 	Keys    []gossh.PublicKey // SSH public keys for authentication
 }
 
-// hubVersions caches hub versions by session ID to avoid repeated parsing.
-var hubVersions map[string]semver.Version
-
 // StartServer starts the SSH server with the provided options.
 // It configures the server with secure defaults, sets up authentication,
 // and begins listening for connections. Returns an error if the server
@@ -99,24 +96,15 @@ func (a *Agent) StartServer(opts ServerOptions) error {
 	return a.server.Serve(ln)
 }
 
-// getHubVersion retrieves and caches the hub version for a given session.
-// It extracts the version from the SSH client version string and caches
-// it to avoid repeated parsing. Returns a zero version if parsing fails.
-func (a *Agent) getHubVersion(sessionId string, sessionCtx ssh.Context) semver.Version {
-	if hubVersions == nil {
-		hubVersions = make(map[string]semver.Version, 1)
-	}
-	hubVersion, ok := hubVersions[sessionId]
-	if ok {
-		return hubVersion
-	}
-	// Extract hub version from SSH client version
+// getHubVersion extracts the hub version from the SSH client version string
+// for a given session. Returns a zero version if parsing fails.
+func (a *Agent) getHubVersion(sessionCtx ssh.Context) semver.Version {
 	clientVersion := sessionCtx.Value(ssh.ContextKeyClientVersion)
 	if versionStr, ok := clientVersion.(string); ok {
-		hubVersion, _ = extractHubVersion(versionStr)
+		hubVersion, _ := extractHubVersion(versionStr)
+		return hubVersion
 	}
-	hubVersions[sessionId] = hubVersion
-	return hubVersion
+	return semver.Version{}
 }
 
 // handleSession handles an incoming SSH session by gathering system statistics
@@ -127,9 +115,8 @@ func (a *Agent) handleSession(s ssh.Session) {
 	a.connectionManager.eventChan <- SSHConnect
 
 	sessionCtx := s.Context()
-	sessionID := sessionCtx.SessionID()
 
-	hubVersion := a.getHubVersion(sessionID, sessionCtx)
+	hubVersion := a.getHubVersion(sessionCtx)
 
 	// Legacy one-shot behavior for older hubs
 	if hubVersion.LT(beszel.MinVersionAgentResponse) {
@@ -278,6 +265,5 @@ func (a *Agent) StopServer() error {
 	slog.Info("Stopping SSH server")
 	_ = a.server.Close()
 	a.server = nil
-	a.connectionManager.eventChan <- SSHDisconnect
 	return nil
 }

agent/server_test.go

@@ -198,6 +198,28 @@ func TestStartServerDisableSSH(t *testing.T) {
 	assert.Contains(t, err.Error(), "SSH disabled")
 }
 
+func TestStopServerDoesNotBlockWhenEventQueueFull(t *testing.T) {
+	agent := createTestAgent(t)
+	agent.server = &ssh.Server{}
+	agent.connectionManager.eventChan = make(chan ConnectionEvent, 1)
+	agent.connectionManager.eventChan <- WebSocketConnect
+
+	done := make(chan error, 1)
+	go func() {
+		done <- agent.StopServer()
+	}()
+
+	select {
+	case err := <-done:
+		require.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("StopServer blocked on the connection event queue")
+	}
+
+	assert.Nil(t, agent.server)
+	assert.Equal(t, WebSocketConnect, <-agent.connectionManager.eventChan)
+}
+
 /////////////////////////////////////////////////////////////////
 //////////////////// ParseKeys Tests ////////////////////////////
 /////////////////////////////////////////////////////////////////
@@ -404,27 +426,23 @@ func TestGetHubVersion(t *testing.T) {
 		clientVersion: "SSH-2.0-beszel_0.12.0",
 	}
 
-	// Test first call - should extract and cache version
-	version := agent.getHubVersion("test-session-123", mockCtx)
+	// Test first call - should extract version
+	version := agent.getHubVersion(mockCtx)
 	assert.Equal(t, "0.12.0", version.String())
 
-	// Test second call - should return cached version
-	mockCtx.clientVersion = "SSH-2.0-beszel_0.11.0" // Change version but should still return cached
-	version = agent.getHubVersion("test-session-123", mockCtx)
-	assert.Equal(t, "0.12.0", version.String()) // Should still be cached version
-
-	// Test different session - should extract new version
-	version = agent.getHubVersion("different-session", mockCtx)
+	// Test that version reflects the current client version (no stale caching)
+	mockCtx.clientVersion = "SSH-2.0-beszel_0.11.0"
+	version = agent.getHubVersion(mockCtx)
 	assert.Equal(t, "0.11.0", version.String())
 
 	// Test with invalid version string (non-beszel client)
 	mockCtx.clientVersion = "SSH-2.0-OpenSSH_8.0"
-	version = agent.getHubVersion("invalid-session", mockCtx)
+	version = agent.getHubVersion(mockCtx)
 	assert.Equal(t, "0.0.0", version.String()) // Should be empty version for non-beszel clients
 
 	// Test with no client version
 	mockCtx.clientVersion = ""
-	version = agent.getHubVersion("no-version-session", mockCtx)
+	version = agent.getHubVersion(mockCtx)
 	assert.True(t, version.EQ(semver.Version{})) // Should be empty version
 }
 
@@ -501,9 +519,6 @@ func TestWriteToSessionEncoding(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			// Reset the global hubVersions map to ensure clean state for each test
-			hubVersions = nil
-
 			agent, err := NewAgent("")
 			require.NoError(t, err)
 
@@ -585,39 +600,28 @@ func createTestCombinedData() *system.CombinedData {
 	}
 }
 
-func TestHubVersionCaching(t *testing.T) {
-	// Reset the global hubVersions map to ensure clean state
-	hubVersions = nil
-
+// TestGetHubVersionConcurrent guards against a regression of the
+// "concurrent map writes" panic previously caused by a shared, unsynchronized
+// hubVersions cache (see https://github.com/henrygd/beszel/issues/2128).
+// getHubVersion no longer shares mutable state between sessions, so calling
+// it concurrently from many goroutines must be safe under `go test -race`.
+func TestGetHubVersionConcurrent(t *testing.T) {
 	agent, err := NewAgent("")
 	require.NoError(t, err)
 
-	ctx1 := &mockSSHContext{
-		sessionID:     "session1",
-		clientVersion: "SSH-2.0-beszel_0.12.0",
+	const goroutines = 50
+	var wg sync.WaitGroup
+	wg.Add(goroutines)
+	for i := 0; i < goroutines; i++ {
+		go func(i int) {
+			defer wg.Done()
+			ctx := &mockSSHContext{
+				sessionID:     fmt.Sprintf("session-%d", i),
+				clientVersion: "SSH-2.0-beszel_0.12.0",
+			}
+			version := agent.getHubVersion(ctx)
+			assert.Equal(t, "0.12.0", version.String())
+		}(i)
 	}
-	ctx2 := &mockSSHContext{
-		sessionID:     "session2",
-		clientVersion: "SSH-2.0-beszel_0.11.0",
-	}
-
-	// First calls should cache the versions
-	v1 := agent.getHubVersion("session1", ctx1)
-	v2 := agent.getHubVersion("session2", ctx2)
-
-	assert.Equal(t, "0.12.0", v1.String())
-	assert.Equal(t, "0.11.0", v2.String())
-
-	// Verify caching by changing context but keeping same session ID
-	ctx1.clientVersion = "SSH-2.0-beszel_0.10.0"
-	v1Cached := agent.getHubVersion("session1", ctx1)
-	assert.Equal(t, "0.12.0", v1Cached.String()) // Should still be cached version
-
-	// New session should get new version
-	ctx3 := &mockSSHContext{
-		sessionID:     "session3",
-		clientVersion: "SSH-2.0-beszel_0.13.0",
-	}
-	v3 := agent.getHubVersion("session3", ctx3)
-	assert.Equal(t, "0.13.0", v3.String())
+	wg.Wait()
 }

agent/smart.go

@@ -55,6 +55,11 @@ type DeviceInfo struct {
 	typeVerified bool
 	// parserType holds the parser type (nvme, sat, scsi) that last succeeded.
 	parserType string
+	// explicitType reports whether Type came from an explicit ":type" hint in
+	// SMART_DEVICES. Such a type is a deliberate user override and must always be
+	// passed to smartctl via -d, even for scsi/ata where a scan-detected type is
+	// otherwise left off (see smartctlArgs and issue #1345).
+	explicitType bool
 }
 
 // deviceKey is a composite key for a device, used to identify a device uniquely.
@@ -65,8 +70,9 @@ type deviceKey struct {
 
 var errNoValidSmartData = fmt.Errorf("no valid SMART data found") // Error for missing data
 
-// Refresh updates SMART data for all known devices
-func (sm *SmartManager) Refresh(forceScan bool) error {
+// Refresh updates SMART data for all known devices and reports whether every
+// discovered device was collected successfully.
+func (sm *SmartManager) Refresh(forceScan bool) (bool, error) {
 	sm.refreshMutex.Lock()
 	defer sm.refreshMutex.Unlock()
 
@@ -87,7 +93,7 @@ func (sm *SmartManager) Refresh(forceScan bool) error {
 		}
 	}
 
-	return sm.resolveRefreshError(scanErr, collectErr)
+	return scanErr == nil && collectErr == nil, sm.resolveRefreshError(scanErr, collectErr)
 }
 
 // devicesSnapshot returns a copy of the current device slice to avoid iterating
@@ -251,8 +257,9 @@ func (sm *SmartManager) parseConfiguredDevices(config string) ([]*DeviceInfo, er
 		}
 
 		devices = append(devices, &DeviceInfo{
-			Name: name,
-			Type: devType,
+			Name:         name,
+			Type:         devType,
+			explicitType: devType != "",
 		})
 	}
 
@@ -368,9 +375,15 @@ func (sm *SmartManager) parseSmartOutput(deviceInfo *DeviceInfo, output []byte)
 		Type  string
 		Parse func([]byte) (bool, int)
 	}{
-		{Type: "nvme", Parse: sm.parseSmartForNvme},
-		{Type: "sat", Parse: sm.parseSmartForSata},
-		{Type: "scsi", Parse: sm.parseSmartForScsi},
+		{Type: "nvme", Parse: func(output []byte) (bool, int) {
+			return sm.parseSmartForNvme(output, deviceInfo.Type)
+		}},
+		{Type: "sat", Parse: func(output []byte) (bool, int) {
+			return sm.parseSmartForSata(output, deviceInfo.Type)
+		}},
+		{Type: "scsi", Parse: func(output []byte) (bool, int) {
+			return sm.parseSmartForScsi(output, deviceInfo.Type)
+		}},
 	}
 
 	deviceType := normalizeParserType(deviceInfo.parserType)
@@ -479,10 +492,11 @@ func (sm *SmartManager) CollectSmart(deviceInfo *DeviceInfo) error {
 		return errNoValidSmartData
 	}
 
-	// slog.Info("collecting SMART data", "device", deviceInfo.Name, "type", deviceInfo.Type, "has_existing_data", sm.hasDataForDevice(deviceInfo.Name))
+	// slog.Info("collecting SMART data", "device", deviceInfo.Name, "type", deviceInfo.Type, "has_existing_data", sm.hasDataForDevice(deviceInfo))
 
-	// Check if we have any existing data for this device
-	hasExistingData := sm.hasDataForDevice(deviceInfo.Name)
+	// Check if we have existing data for this exact device identity. Multiple
+	// bridge slots can share a path, so a name-only match is not sufficient.
+	hasExistingData := sm.hasDataForDevice(deviceInfo)
 
 	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
 	defer cancel()
@@ -558,7 +572,9 @@ func (sm *SmartManager) smartctlArgs(deviceInfo *DeviceInfo, includeStandby bool
 		deviceType = strings.ToLower(deviceInfo.Type)
 		parserType = strings.ToLower(deviceInfo.parserType)
 		// types sometimes misidentified in scan; see github.com/henrygd/beszel/issues/1345
-		if deviceType != "" && deviceType != "scsi" && deviceType != "ata" {
+		// An explicit SMART_DEVICES ":type" hint is a deliberate override, so always
+		// pass it through; otherwise scsi/ata are left off so smartctl can auto-detect.
+		if deviceType != "" && (deviceInfo.explicitType || (deviceType != "scsi" && deviceType != "ata")) {
 			args = append(args, "-d", deviceInfo.Type)
 		}
 	}
@@ -583,14 +599,18 @@ func (sm *SmartManager) smartctlArgs(deviceInfo *DeviceInfo, includeStandby bool
 	return args
 }
 
-// hasDataForDevice checks if we have cached SMART data for a specific device
-func (sm *SmartManager) hasDataForDevice(deviceName string) bool {
+// hasDataForDevice checks if we have cached SMART data for a specific device identity.
+func (sm *SmartManager) hasDataForDevice(deviceInfo *DeviceInfo) bool {
+	if deviceInfo == nil {
+		return false
+	}
+
 	sm.Lock()
 	defer sm.Unlock()
 
-	// Check if any cached data has this device name
+	deviceKey := makeDeviceKey(deviceInfo.Name, deviceInfo.Type)
 	for _, data := range sm.SmartDataMap {
-		if data != nil && data.DiskName == deviceName {
+		if data != nil && makeDeviceKey(data.DiskName, data.DiskType) == deviceKey {
 			return true
 		}
 	}
@@ -663,6 +683,9 @@ func mergeDeviceLists(existing, scanned, configured []*DeviceInfo) []*DeviceInfo
 		target.Type = prev.Type
 		target.typeVerified = true
 		target.parserType = prev.parserType
+		if prev.explicitType {
+			target.explicitType = true
+		}
 	}
 
 	// applyConfiguredMetadata updates a matched device with any configured
@@ -676,6 +699,9 @@ func mergeDeviceLists(existing, scanned, configured []*DeviceInfo) []*DeviceInfo
 			existingDev.typeVerified = false
 			existingDev.parserType = normalizeParserType(newType)
 		}
+		if configuredDev.explicitType {
+			existingDev.explicitType = true
+		}
 		if configuredDev.InfoName != "" {
 			existingDev.InfoName = configuredDev.InfoName
 		}
@@ -732,7 +758,14 @@ func mergeDeviceLists(existing, scanned, configured []*DeviceInfo) []*DeviceInfo
 			continue
 		}
 		if existingDev := deviceIndexByName[configuredDevice.Name]; existingDev != nil {
+			oldKey := makeDeviceKey(existingDev.Name, existingDev.Type)
+			if prev := existingIndex[key]; prev != nil {
+				preserveVerifiedType(existingDev, prev)
+			}
 			applyConfiguredMetadata(existingDev, configuredDevice)
+			delete(deviceIndex, oldKey)
+			deviceIndex[makeDeviceKey(existingDev.Name, existingDev.Type)] = existingDev
+			delete(deviceIndexByName, configuredDevice.Name)
 			continue
 		}
 
@@ -836,9 +869,11 @@ func (sm *SmartManager) isVirtualDeviceFromStrings(fields ...string) bool {
 	return false
 }
 
-// parseSmartForSata parses the output of smartctl --all -j for SATA/ATA devices and updates the SmartDataMap
+// parseSmartForSata parses the output of smartctl --all -j for SATA/ATA devices and updates the SmartDataMap.
+// deviceType is the exact type used to identify and query the device; when set,
+// it takes precedence over the generic type reported by smartctl.
 // Returns hasValidData and exitStatus
-func (sm *SmartManager) parseSmartForSata(output []byte) (bool, int) {
+func (sm *SmartManager) parseSmartForSata(output []byte, deviceType string) (bool, int) {
 	var data smart.SmartInfoForSata
 
 	if err := json.Unmarshal(output, &data); err != nil {
@@ -877,6 +912,9 @@ func (sm *SmartManager) parseSmartForSata(output []byte) (bool, int) {
 	smartData.SmartStatus = getSmartStatus(smartData.Temperature, data.SmartStatus.Passed)
 	smartData.DiskName = data.Device.Name
 	smartData.DiskType = data.Device.Type
+	if deviceType != "" {
+		smartData.DiskType = deviceType
+	}
 
 	// get values from ata_device_statistics if necessary
 	var ataDeviceStats smart.AtaDeviceStatistics
@@ -893,6 +931,9 @@ func (sm *SmartManager) parseSmartForSata(output []byte) (bool, int) {
 		if parsed, ok := smart.ParseSmartRawValueString(attr.Raw.String); ok {
 			rawValue = parsed
 		}
+		if smartData.SmartStatus == "PASSED" && rawValue > 0 && (attr.ID == 5 || attr.ID == 197 || attr.ID == 198) {
+			smartData.SmartStatus = "WARNING"
+		}
 		smartAttr := &smart.SmartAttribute{
 			ID:         attr.ID,
 			Name:       attr.Name,
@@ -950,7 +991,7 @@ func findAtaDeviceStatisticsValue(data *smart.SmartInfoForSata, ataDeviceStats *
 	return nil
 }
 
-func (sm *SmartManager) parseSmartForScsi(output []byte) (bool, int) {
+func (sm *SmartManager) parseSmartForScsi(output []byte, deviceType string) (bool, int) {
 	var data smart.SmartInfoForScsi
 
 	if err := json.Unmarshal(output, &data); err != nil {
@@ -985,6 +1026,9 @@ func (sm *SmartManager) parseSmartForScsi(output []byte) (bool, int) {
 	smartData.SmartStatus = getSmartStatus(smartData.Temperature, data.SmartStatus.Passed)
 	smartData.DiskName = data.Device.Name
 	smartData.DiskType = data.Device.Type
+	if deviceType != "" {
+		smartData.DiskType = deviceType
+	}
 
 	attributes := make([]*smart.SmartAttribute, 0, 10)
 	attributes = append(attributes, &smart.SmartAttribute{Name: "PowerOnHours", RawValue: data.PowerOnTime.Hours})
@@ -1082,9 +1126,11 @@ func (sm *SmartManager) lookupDarwinNvmeCapacity(serial string) uint64 {
 	return sm.darwinNvmeCapacity[serial]
 }
 
-// parseSmartForNvme parses the output of smartctl --all -j /dev/nvmeX and updates the SmartDataMap
+// parseSmartForNvme parses the output of smartctl --all -j /dev/nvmeX and updates the SmartDataMap.
+// deviceType is the exact type used to identify and query the device; when set,
+// it takes precedence over the generic type reported by smartctl.
 // Returns hasValidData and exitStatus
-func (sm *SmartManager) parseSmartForNvme(output []byte) (bool, int) {
+func (sm *SmartManager) parseSmartForNvme(output []byte, deviceType string) (bool, int) {
 	data := &smart.SmartInfoForNvme{}
 
 	if err := json.Unmarshal(output, &data); err != nil {
@@ -1128,6 +1174,9 @@ func (sm *SmartManager) parseSmartForNvme(output []byte) (bool, int) {
 	smartData.SmartStatus = getSmartStatus(smartData.Temperature, data.SmartStatus.Passed)
 	smartData.DiskName = data.Device.Name
 	smartData.DiskType = data.Device.Type
+	if deviceType != "" {
+		smartData.DiskType = deviceType
+	}
 
 	// nvme attributes does not follow the same format as ata attributes,
 	// so we manually map each field to SmartAttributes

agent/smart_test.go

@@ -4,8 +4,10 @@ package agent
 
 import (
 	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
+	"strconv"
 	"testing"
 
 	"github.com/henrygd/beszel/internal/entities/smart"
@@ -24,7 +26,7 @@ func TestParseSmartForScsi(t *testing.T) {
 		SmartDataMap: make(map[string]*smart.SmartData),
 	}
 
-	hasData, exitStatus := sm.parseSmartForScsi(data)
+	hasData, exitStatus := sm.parseSmartForScsi(data, "")
 	if !hasData {
 		t.Fatalf("expected SCSI data to parse successfully")
 	}
@@ -69,7 +71,7 @@ func TestParseSmartForSata(t *testing.T) {
 		SmartDataMap: make(map[string]*smart.SmartData),
 	}
 
-	hasData, exitStatus := sm.parseSmartForSata(data)
+	hasData, exitStatus := sm.parseSmartForSata(data, "")
 	require.True(t, hasData)
 	assert.Equal(t, 64, exitStatus)
 
@@ -88,6 +90,52 @@ func TestParseSmartForSata(t *testing.T) {
 	}
 }
 
+func TestParseSmartForSataWarnsForCriticalAttributes(t *testing.T) {
+	for _, attrID := range []int{5, 197, 198} {
+		t.Run("attribute "+strconv.Itoa(attrID), func(t *testing.T) {
+			jsonPayload := []byte(fmt.Sprintf(`{
+				"smartctl": {"exit_status": 0},
+				"device": {"name": "/dev/sda", "type": "sat"},
+				"model_name": "Example",
+				"serial_number": "WARNING%d",
+				"smart_status": {"passed": true},
+				"temperature": {"current": 30},
+				"ata_smart_attributes": {"table": [{"id": %d, "raw": {"value": 1, "string": "1"}}]}
+			}`, attrID, attrID))
+
+			sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
+			hasData, _ := sm.parseSmartForSata(jsonPayload, "")
+			require.True(t, hasData)
+			assert.Equal(t, "WARNING", sm.SmartDataMap[fmt.Sprintf("WARNING%d", attrID)].SmartStatus)
+		})
+	}
+}
+
+func TestParseSmartForSataPreservesFailedAndUnknownStatus(t *testing.T) {
+	for _, test := range []struct {
+		name        string
+		temperature int
+		want        string
+	}{
+		{name: "failed", temperature: 30, want: "FAILED"},
+		{name: "unknown", want: "UNKNOWN"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			jsonPayload := []byte(fmt.Sprintf(`{
+				"device": {"name": "/dev/sda", "type": "sat"},
+				"serial_number": "PRESERVE%s",
+				"temperature": {"current": %d},
+				"ata_smart_attributes": {"table": [{"id": 197, "raw": {"value": 1, "string": "1"}}]}
+			}`, test.name, test.temperature))
+
+			sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
+			hasData, _ := sm.parseSmartForSata(jsonPayload, "")
+			require.True(t, hasData)
+			assert.Equal(t, test.want, sm.SmartDataMap["PRESERVE"+test.name].SmartStatus)
+		})
+	}
+}
+
 func TestParseSmartForSataDeviceStatisticsTemperature(t *testing.T) {
 	jsonPayload := []byte(`{
 		"smartctl": {"exit_status": 0},
@@ -112,7 +160,7 @@ func TestParseSmartForSataDeviceStatisticsTemperature(t *testing.T) {
 	}`)
 
 	sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
-	hasData, exitStatus := sm.parseSmartForSata(jsonPayload)
+	hasData, exitStatus := sm.parseSmartForSata(jsonPayload, "")
 	require.True(t, hasData)
 	assert.Equal(t, 0, exitStatus)
 
@@ -147,7 +195,7 @@ func TestParseSmartForSataAtaDeviceStatistics(t *testing.T) {
 	}`)
 
 	sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
-	hasData, exitStatus := sm.parseSmartForSata(jsonPayload)
+	hasData, exitStatus := sm.parseSmartForSata(jsonPayload, "")
 	require.True(t, hasData)
 	assert.Equal(t, 0, exitStatus)
 
@@ -184,7 +232,7 @@ func TestParseSmartForSataNegativeDeviceStatistics(t *testing.T) {
 	}`)
 
 	sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
-	hasData, exitStatus := sm.parseSmartForSata(jsonPayload)
+	hasData, exitStatus := sm.parseSmartForSata(jsonPayload, "")
 	require.True(t, hasData)
 	assert.Equal(t, 0, exitStatus)
 
@@ -223,7 +271,7 @@ func TestParseSmartForSataParentheticalRawValue(t *testing.T) {
 
 	sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
 
-	hasData, exitStatus := sm.parseSmartForSata(jsonPayload)
+	hasData, exitStatus := sm.parseSmartForSata(jsonPayload, "")
 	require.True(t, hasData)
 	assert.Equal(t, 0, exitStatus)
 
@@ -245,7 +293,7 @@ func TestParseSmartForNvme(t *testing.T) {
 		SmartDataMap: make(map[string]*smart.SmartData),
 	}
 
-	hasData, exitStatus := sm.parseSmartForNvme(data)
+	hasData, exitStatus := sm.parseSmartForNvme(data, "")
 	require.True(t, hasData)
 	assert.Equal(t, 0, exitStatus)
 
@@ -268,13 +316,15 @@ func TestParseSmartForNvme(t *testing.T) {
 func TestHasDataForDevice(t *testing.T) {
 	sm := &SmartManager{
 		SmartDataMap: map[string]*smart.SmartData{
-			"serial-1": {DiskName: "/dev/sda"},
+			"serial-1": {DiskName: "/dev/sda", DiskType: "jms56x,0"},
 			"serial-2": nil,
 		},
 	}
 
-	assert.True(t, sm.hasDataForDevice("/dev/sda"))
-	assert.False(t, sm.hasDataForDevice("/dev/sdb"))
+	assert.True(t, sm.hasDataForDevice(&DeviceInfo{Name: "/dev/sda", Type: "jms56x,0"}))
+	assert.False(t, sm.hasDataForDevice(&DeviceInfo{Name: "/dev/sda", Type: "jms56x,1"}))
+	assert.False(t, sm.hasDataForDevice(&DeviceInfo{Name: "/dev/sdb", Type: "jms56x,0"}))
+	assert.False(t, sm.hasDataForDevice(nil))
 }
 
 func TestDevicesSnapshotReturnsCopy(t *testing.T) {
@@ -392,6 +442,81 @@ func TestSmartctlArgs(t *testing.T) {
 	)
 }
 
+// TestSmartctlArgsExplicitType verifies that an explicit SMART_DEVICES type hint
+// is always passed to smartctl via -d, while a scan-detected scsi/ata type is
+// still left off so smartctl can auto-detect it (see issue #1345).
+func TestSmartctlArgsExplicitType(t *testing.T) {
+	sm := &SmartManager{}
+
+	// Scan-detected scsi: -d is intentionally omitted.
+	scanScsi := &DeviceInfo{Name: "/dev/sda", Type: "scsi"}
+	assert.Equal(t,
+		[]string{"-a", "--json=c", "/dev/sda"},
+		sm.smartctlArgs(scanScsi, false),
+	)
+
+	// Explicit scsi from SMART_DEVICES: -d scsi must be passed.
+	explicitScsi := &DeviceInfo{Name: "/dev/sda", Type: "scsi", explicitType: true}
+	assert.Equal(t,
+		[]string{"-d", "scsi", "-a", "--json=c", "/dev/sda"},
+		sm.smartctlArgs(explicitScsi, false),
+	)
+
+	// Explicit ata from SMART_DEVICES: -d ata must be passed (devstat still added).
+	explicitAta := &DeviceInfo{Name: "/dev/sdb", Type: "ata", explicitType: true}
+	assert.Equal(t,
+		[]string{"-d", "ata", "-a", "--json=c", "-l", "devstat", "/dev/sdb"},
+		sm.smartctlArgs(explicitAta, false),
+	)
+}
+
+// TestSmartDevicesExplicitTypeFlowsToSmartctlArgs is a regression test for
+// issue #2072: an explicit SMART_DEVICES type (e.g. /dev/sda:scsi) must win over
+// a wrong scan-detected type (sat) and be handed to smartctl as -d scsi.
+func TestSmartDevicesExplicitTypeFlowsToSmartctlArgs(t *testing.T) {
+	sm := &SmartManager{}
+
+	configured, err := sm.parseConfiguredDevices("/dev/sda:scsi")
+	require.NoError(t, err)
+	require.Len(t, configured, 1)
+	assert.True(t, configured[0].explicitType)
+
+	// smartctl --scan misreports this USB drive as sat, which fails on it.
+	scanned := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "sat", Protocol: "ATA"},
+	}
+
+	merged := mergeDeviceLists(nil, scanned, configured)
+	require.Len(t, merged, 1)
+
+	device := merged[0]
+	assert.Equal(t, "scsi", device.Type, "configured type should win over scan-detected sat")
+	assert.True(t, device.explicitType, "explicit hint must survive the merge")
+
+	assert.Equal(t,
+		[]string{"-d", "scsi", "-a", "--json=c", "/dev/sda"},
+		sm.smartctlArgs(device, false),
+		"explicit scsi type must be passed to smartctl, not dropped",
+	)
+}
+
+// TestMergeDeviceListsPreservesExplicitTypeAcrossRescan ensures a verified,
+// explicitly-typed device keeps its explicit flag when a later scan re-reports
+// it with a different auto-detected type.
+func TestMergeDeviceListsPreservesExplicitTypeAcrossRescan(t *testing.T) {
+	existing := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "scsi", parserType: "scsi", typeVerified: true, explicitType: true},
+	}
+	scanned := []*DeviceInfo{
+		{Name: "/dev/sda", Type: "sat"},
+	}
+
+	merged := mergeDeviceLists(existing, scanned, nil)
+	require.Len(t, merged, 1)
+	assert.Equal(t, "scsi", merged[0].Type)
+	assert.True(t, merged[0].explicitType, "explicit type flag should survive a rescan")
+}
+
 func TestResolveRefreshError(t *testing.T) {
 	scanErr := errors.New("scan failed")
 	collectErr := errors.New("collect failed")
@@ -534,6 +659,74 @@ func TestMergeDeviceListsPrefersConfigured(t *testing.T) {
 	assert.Equal(t, "sat", byName["/dev/sdb"].Type)
 }
 
+func TestMergeDeviceListsExpandsConfiguredDevicesWithSamePath(t *testing.T) {
+	scanned := []*DeviceInfo{
+		{Name: "/dev/sdb", Type: "sat", InfoName: "scan-info", Protocol: "ATA"},
+	}
+	configured := []*DeviceInfo{
+		{Name: "/dev/sdb", Type: "jms56x,0", explicitType: true},
+		{Name: "/dev/sdb", Type: "jms56x,1", explicitType: true},
+	}
+
+	merged := mergeDeviceLists(nil, scanned, configured)
+	require.Len(t, merged, 2)
+
+	byKey := make(map[deviceKey]*DeviceInfo, len(merged))
+	for _, device := range merged {
+		byKey[makeDeviceKey(device.Name, device.Type)] = device
+	}
+
+	first := byKey[makeDeviceKey("/dev/sdb", "jms56x,0")]
+	require.NotNil(t, first)
+	assert.Equal(t, "scan-info", first.InfoName)
+	assert.Equal(t, "ATA", first.Protocol)
+	assert.True(t, first.explicitType)
+
+	second := byKey[makeDeviceKey("/dev/sdb", "jms56x,1")]
+	require.NotNil(t, second)
+	assert.True(t, second.explicitType)
+	assert.NotContains(t, byKey, makeDeviceKey("/dev/sdb", "sat"))
+}
+
+func TestMergeDeviceListsPreservesSamePathVerificationAcrossRescan(t *testing.T) {
+	existing := []*DeviceInfo{
+		{Name: "/dev/sdb", Type: "jms56x,0", parserType: "sat", typeVerified: true, explicitType: true},
+		{Name: "/dev/sdb", Type: "jms56x,1", parserType: "sat", typeVerified: true, explicitType: true},
+	}
+	scanned := []*DeviceInfo{
+		{Name: "/dev/sdb", Type: "sat", Protocol: "ATA"},
+	}
+	configured := []*DeviceInfo{
+		{Name: "/dev/sdb", Type: "jms56x,0", explicitType: true},
+		{Name: "/dev/sdb", Type: "jms56x,1", explicitType: true},
+	}
+
+	merged := mergeDeviceLists(existing, scanned, configured)
+	require.Len(t, merged, 2)
+	byKey := make(map[deviceKey]*DeviceInfo, len(merged))
+	for _, device := range merged {
+		byKey[makeDeviceKey(device.Name, device.Type)] = device
+		assert.True(t, device.typeVerified, device.Type)
+		assert.Equal(t, "sat", device.parserType, device.Type)
+		assert.True(t, device.explicitType, device.Type)
+	}
+	assert.Contains(t, byKey, makeDeviceKey("/dev/sdb", "jms56x,0"))
+	assert.Contains(t, byKey, makeDeviceKey("/dev/sdb", "jms56x,1"))
+}
+
+func TestMergeDeviceListsDeduplicatesConfiguredIdentityAfterRekey(t *testing.T) {
+	scanned := []*DeviceInfo{{Name: "/dev/sdb", Type: "sat"}}
+	configured := []*DeviceInfo{
+		{Name: "/dev/sdb", Type: "jms56x,0", explicitType: true},
+		{Name: "/dev/sdb", Type: "jms56x,0", explicitType: true},
+	}
+
+	merged := mergeDeviceLists(nil, scanned, configured)
+	require.Len(t, merged, 1)
+	assert.Equal(t, "/dev/sdb", merged[0].Name)
+	assert.Equal(t, "jms56x,0", merged[0].Type)
+}
+
 func TestMergeDeviceListsPreservesVerification(t *testing.T) {
 	existing := []*DeviceInfo{
 		{Name: "/dev/sda", Type: "sat+megaraid", parserType: "sat", typeVerified: true},
@@ -678,6 +871,20 @@ func TestParseSmartOutputKeepsCustomType(t *testing.T) {
 	assert.Equal(t, "sat+megaraid", device.Type)
 	assert.Equal(t, "sat", device.parserType)
 	assert.True(t, device.typeVerified)
+	assert.Equal(t, "sat+megaraid", sm.SmartDataMap["9C40918040082"].DiskType)
+}
+
+func TestParseSmartOutputDoesNotNormalizeDeviceIdentity(t *testing.T) {
+	fixturePath := filepath.Join("test-data", "smart", "sda.json")
+	data, err := os.ReadFile(fixturePath)
+	require.NoError(t, err)
+
+	sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
+	device := &DeviceInfo{Name: "/dev/sda", Type: "ata", explicitType: true}
+
+	require.True(t, sm.parseSmartOutput(device, data))
+	assert.Equal(t, "sat", device.parserType)
+	assert.Equal(t, "ata", sm.SmartDataMap["9C40918040082"].DiskType)
 }
 
 func TestParseSmartOutputResetsVerificationOnFailure(t *testing.T) {
@@ -1225,7 +1432,7 @@ func TestParseSmartForNvmeAppleSSD(t *testing.T) {
 		darwinNvmeProvider: fakeProvider,
 	}
 
-	hasData, _ := sm.parseSmartForNvme(data)
+	hasData, _ := sm.parseSmartForNvme(data, "")
 	require.True(t, hasData)
 
 	deviceData, ok := sm.SmartDataMap["0ba0147940253c15"]
@@ -1237,7 +1444,7 @@ func TestParseSmartForNvmeAppleSSD(t *testing.T) {
 	assert.Equal(t, 1, providerCalls, "system_profiler should be called once")
 
 	// Second parse: provider should NOT be called again (cache hit)
-	_, _ = sm.parseSmartForNvme(data)
+	_, _ = sm.parseSmartForNvme(data, "")
 	assert.Equal(t, 1, providerCalls, "system_profiler should not be called again after caching")
 }
 

agent/storage_pool.go

@@ -0,0 +1,462 @@
+package agent
+
+import (
+	"errors"
+	"log/slog"
+	"os/exec"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/henrygd/beszel/agent/btrfs"
+	"github.com/henrygd/beszel/agent/zfs"
+	"github.com/henrygd/beszel/internal/entities/system"
+	zfsentity "github.com/henrygd/beszel/internal/entities/zfs"
+)
+
+// zfsDatasetUsage holds usage values for a ZFS dataset mountpoint.
+type zfsDatasetUsage struct {
+	used  uint64
+	avail uint64
+}
+
+// datasetUsageRefreshInterval controls how often `zfs list` is re-run for the
+// mountpoint usage map. Dataset inventory changes rarely.
+const datasetUsageRefreshInterval = 5 * time.Minute
+
+// poolStatsRefreshInterval controls how often `zpool list` is re-run for pool
+// capacity. Health and I/O are read from procfs on Linux, so the utility only
+// needs to refresh slow-moving space accounting.
+const poolStatsRefreshInterval = time.Minute
+
+// btrfsFilesystems is the btrfs source; overridable in tests.
+var btrfsFilesystems = btrfs.Filesystems
+
+type poolKernelSample struct {
+	nread  uint64
+	nwrite uint64
+	at     time.Time
+}
+
+// StoragePoolManager combines independent backend inventories. Metrics and
+// dataset usage require the agent lock; GetDetail is safe for concurrent calls.
+type StoragePoolManager struct {
+	backends       []*poolBackend
+	detailInterval time.Duration
+}
+
+// poolBackend owns one backend's collectors and caches. Collector functions
+// are immutable after construction and may run concurrently for metrics/details.
+type poolBackend struct {
+	name           string
+	poolStatsFn    func() ([]zfs.PoolStat, error)       // capacity/health source
+	datasetsFn     func() ([]zfs.Dataset, error)        // dataset inventory source
+	kernelStatsFn  func() ([]zfs.PoolKernelStat, error) // procfs pool state/I/O source
+	poolStatusesFn func() ([]zfs.PoolStatus, error)     // scrub/vdev detail source
+
+	poolData      []zfs.PoolStat // cached pool inventory (TTL below)
+	lastPoolStats time.Time
+	kernelSamples map[string]poolKernelSample
+
+	datasetUsage     map[string]zfsDatasetUsage // mountpoint -> usage
+	lastUsageRefresh time.Time
+
+	// Detail data (pools, vdevs, scrub, datasets) is cached and refreshed on
+	// an interval. Accessed from handler goroutines, so it is mutex-protected.
+	detailMu          sync.Mutex
+	detail            *zfsentity.ZfsData
+	lastDetailRefresh time.Time
+	detailFailed      bool
+}
+
+func newStoragePoolManager() *StoragePoolManager {
+	return &StoragePoolManager{
+		backends:       []*poolBackend{newZfsBackend(), newBtrfsBackend()},
+		detailInterval: time.Hour,
+	}
+}
+
+func newZfsBackend() *poolBackend {
+	return &poolBackend{
+		name:           "zfs",
+		poolStatsFn:    optionalPoolSource(zfs.PoolStats),
+		datasetsFn:     zfs.Datasets,
+		kernelStatsFn:  optionalPoolSource(zfs.PoolKernelStats),
+		poolStatusesFn: optionalPoolSource(zfs.PoolStatuses),
+	}
+}
+
+func newBtrfsBackend() *poolBackend {
+	return &poolBackend{
+		name:           "btrfs",
+		poolStatsFn:    btrfsSource(btrfsPoolStats),
+		kernelStatsFn:  btrfsSource(btrfsKernelStats),
+		poolStatusesFn: btrfsSource(btrfsPoolStatuses),
+	}
+}
+
+// datasets is optional: only backends that expose datasets provide a collector.
+func (b *poolBackend) datasets() ([]zfs.Dataset, error) {
+	if b.datasetsFn == nil {
+		return nil, nil
+	}
+	return b.datasetsFn()
+}
+
+// A missing utility/interface is a successfully observed absent backend.
+func optionalPoolSource[T any](source func() ([]T, error)) func() ([]T, error) {
+	return func() ([]T, error) {
+		items, err := source()
+		if errors.Is(err, zfs.ErrNoZfs) || errors.Is(err, exec.ErrNotFound) || errors.Is(err, errors.ErrUnsupported) {
+			return nil, nil
+		}
+		return items, err
+	}
+}
+
+func btrfsSource[T any](convert func(btrfs.Filesystem) T) func() ([]T, error) {
+	return func() ([]T, error) {
+		filesystems, err := optionalPoolSource(btrfsFilesystems)()
+		if err != nil {
+			return nil, err
+		}
+		items := make([]T, 0, len(filesystems))
+		for _, fs := range filesystems {
+			items = append(items, convert(fs))
+		}
+		return items, nil
+	}
+}
+
+// Update refreshes systemStats.ZfsPools with the latest pool data. I/O
+// throughput and health come from inexpensive kernel kstats on Linux. Pool
+// capacity and dataset usage come from separately cached utility calls. The
+// pool map is empty when both backends are absent.
+func (m *StoragePoolManager) Update(systemStats *system.Stats) {
+	// Rebuild the combined map so successful pool removals clear old samples.
+	systemStats.ZfsPools = nil
+	for _, backend := range m.backends {
+		backend.updateBackendStats(systemStats)
+	}
+}
+
+func (b *poolBackend) updateBackendStats(systemStats *system.Stats) {
+	pools := b.poolStats()
+	if len(pools) == 0 {
+		b.kernelSamples = nil
+		return
+	}
+
+	kernelStats, ioRates := b.kernelStats()
+
+	if systemStats.ZfsPools == nil {
+		systemStats.ZfsPools = make(map[string]*system.ZfsPool, len(pools))
+	}
+	for i := range pools {
+		pool := &pools[i]
+		// Full precision, matching the dataset values below; the frontend
+		// formats any magnitude.
+		stats := &system.ZfsPool{
+			DisplayName: pool.DisplayName,
+			Raw:         pool.Raw,
+			Total:       float64(pool.Size) / (1024 * 1024 * 1024),
+			Used:        float64(pool.Alloc) / (1024 * 1024 * 1024),
+			Health:      pool.Health,
+		}
+		if kernel, exists := kernelStats[pool.Name]; exists && kernel.Health != "" {
+			stats.Health = kernel.Health
+		}
+		if io, exists := ioRates[pool.Name]; exists {
+			stats.ReadBytes = io.NRead
+			stats.WriteBytes = io.NWrite
+		}
+		slog.Debug("Storage pool sample", "backend", b.name, "pool", pool.Name, "health", stats.Health, "used_gb", stats.Used, "read_bps", stats.ReadBytes, "write_bps", stats.WriteBytes)
+		systemStats.ZfsPools[pool.Name] = stats
+	}
+
+}
+
+// poolStats returns the cached pool inventory, calling its collector at most
+// every poolStatsRefreshInterval. On failure the previous inventory is
+// retained and the refresh is retried on the next cadence.
+func (b *poolBackend) poolStats() []zfs.PoolStat {
+	if b.lastPoolStats.IsZero() || time.Since(b.lastPoolStats) >= poolStatsRefreshInterval {
+		pools, err := b.poolStatsFn()
+		if err != nil {
+			slog.Debug("Storage pool stats unavailable", "backend", b.name, "err", err)
+		} else {
+			b.poolData = pools
+		}
+		b.lastPoolStats = time.Now()
+	}
+	return b.poolData
+}
+
+// kernelStats reads cumulative pool counters and converts them to per-second
+// rates. Counter decreases indicate a pool export/import and reset the
+// baseline instead of producing an underflow spike.
+func (b *poolBackend) kernelStats() (map[string]zfs.PoolKernelStat, map[string]zfs.PoolIoStats) {
+	if b.kernelStatsFn == nil {
+		return nil, nil
+	}
+	stats, err := b.kernelStatsFn()
+	if err != nil {
+		slog.Debug("Storage pool kernel stats unavailable", "backend", b.name, "err", err)
+		return nil, nil
+	}
+	now := time.Now()
+	byName := make(map[string]zfs.PoolKernelStat, len(stats))
+	rates := make(map[string]zfs.PoolIoStats, len(stats))
+	nextSamples := make(map[string]poolKernelSample, len(stats))
+	for _, stat := range stats {
+		byName[stat.Name] = stat
+		if previous, ok := b.kernelSamples[stat.Name]; ok && now.After(previous.at) &&
+			stat.NRead >= previous.nread && stat.NWrite >= previous.nwrite {
+			seconds := now.Sub(previous.at).Seconds()
+			rates[stat.Name] = zfs.PoolIoStats{
+				NRead:  uint64(float64(stat.NRead-previous.nread) / seconds),
+				NWrite: uint64(float64(stat.NWrite-previous.nwrite) / seconds),
+			}
+		}
+		nextSamples[stat.Name] = poolKernelSample{nread: stat.NRead, nwrite: stat.NWrite, at: now}
+	}
+	b.kernelSamples = nextSamples
+	return byName, rates
+}
+
+// refreshDatasetUsage re-runs `zfs list` when the refresh window has elapsed
+// and rebuilds the mountpoint-keyed usage map.
+func (b *poolBackend) refreshDatasetUsage() {
+	if !b.lastUsageRefresh.IsZero() && time.Since(b.lastUsageRefresh) < datasetUsageRefreshInterval {
+		return
+	}
+	datasets, err := b.datasets()
+	if err != nil {
+		slog.Debug("Storage pool dataset usage unavailable", "backend", b.name, "err", err)
+	} else {
+		usage := make(map[string]zfsDatasetUsage, len(datasets))
+		for _, ds := range datasets {
+			if ds.Mountpoint != "" && ds.Mountpoint != "-" {
+				usage[ds.Mountpoint] = zfsDatasetUsage{used: ds.Used, avail: ds.Avail}
+			}
+		}
+		b.datasetUsage = usage
+	}
+	b.lastUsageRefresh = time.Now()
+}
+
+// DatasetUsage returns ZFS dataset usage keyed by mountpoint, refreshed at
+// most every datasetUsageRefreshInterval. On failure the previous map is
+// retained and a debug log is emitted.
+func (m *StoragePoolManager) DatasetUsage() map[string]zfsDatasetUsage {
+	for _, backend := range m.backends {
+		if backend.name == "zfs" {
+			backend.refreshDatasetUsage()
+			return backend.datasetUsage
+		}
+	}
+	return nil
+}
+
+// GetDetail combines backend snapshots, identifying successful inventories so
+// the hub can accept partial updates without deleting failed backend records.
+func (m *StoragePoolManager) GetDetail(force bool) *zfsentity.ZfsData {
+	data := &zfsentity.ZfsData{Complete: true}
+	for _, backend := range m.backends {
+		snapshot := backend.getBackendDetail(force, m.detailInterval)
+		data.Pools = append(data.Pools, snapshot.Pools...)
+		if snapshot.Complete {
+			data.CompleteBackends = append(data.CompleteBackends, backend.name)
+		} else {
+			data.Complete = false
+		}
+	}
+	return data
+}
+
+func (b *poolBackend) getBackendDetail(force bool, interval time.Duration) *zfsentity.ZfsData {
+	b.detailMu.Lock()
+	defer b.detailMu.Unlock()
+
+	if force || b.detailFailed || b.detail == nil || time.Since(b.lastDetailRefresh) >= interval {
+		if data, err := b.collectDetail(b.detail); err != nil {
+			b.detailFailed = true
+			slog.Debug("Storage pool detail collection failed", "backend", b.name, "err", err)
+			if b.detail == nil {
+				return &zfsentity.ZfsData{}
+			}
+			return &zfsentity.ZfsData{Pools: b.detail.Pools}
+		} else {
+			b.detailFailed = false
+			b.detail = data
+			b.lastDetailRefresh = time.Now()
+		}
+	}
+	if b.detail == nil {
+		return &zfsentity.ZfsData{}
+	}
+	return b.detail
+}
+
+// collectDetail builds a ZfsData payload from the current system state.
+func (b *poolBackend) collectDetail(previous *zfsentity.ZfsData) (*zfsentity.ZfsData, error) {
+	pools, err := b.poolStatsFn()
+	if err != nil {
+		return nil, err
+	}
+	if len(pools) == 0 {
+		return &zfsentity.ZfsData{Pools: []*zfsentity.PoolDetail{}, Complete: true}, nil
+	}
+
+	statuses, statusErr := b.poolStatusesFn()
+	if statusErr != nil {
+		slog.Debug("Storage pool status unavailable", "backend", b.name, "err", statusErr)
+	}
+	datasets, datasetsErr := b.datasets()
+	if datasetsErr != nil {
+		slog.Debug("Storage pool datasets unavailable", "backend", b.name, "err", datasetsErr)
+	}
+
+	statusByPool := make(map[string]zfs.PoolStatus, len(statuses))
+	for _, st := range statuses {
+		statusByPool[st.Name] = st
+	}
+
+	previousByPool := make(map[string]*zfsentity.PoolDetail)
+	if previous != nil {
+		for _, pool := range previous.Pools {
+			if pool != nil {
+				previousByPool[pool.Name] = pool
+			}
+		}
+	}
+
+	data := &zfsentity.ZfsData{Pools: make([]*zfsentity.PoolDetail, 0, len(pools)), Complete: true}
+	for i := range pools {
+		p := &pools[i]
+		detail := &zfsentity.PoolDetail{
+			DisplayName: p.DisplayName,
+			Raw:         p.Raw,
+			Name:        p.Name,
+			Health:      p.Health,
+			Size:        p.Size,
+			Alloc:       p.Alloc,
+			Free:        p.Free,
+		}
+		if st, ok := statusByPool[p.Name]; statusErr == nil && ok {
+			if st.Scrub.State != "" && st.Scrub.State != "NONE" {
+				detail.Scrub = &zfsentity.Scrub{
+					State:    st.Scrub.State,
+					Progress: st.Scrub.Progress,
+					Errors:   st.Scrub.Errors,
+				}
+			}
+			for _, v := range st.Vdevs {
+				detail.Vdevs = append(detail.Vdevs, &zfsentity.Vdev{
+					Name:         v.Name,
+					State:        v.State,
+					ReadErrs:     v.ReadErrs,
+					WriteErrs:    v.WriteErrs,
+					ChecksumErrs: v.ChecksumErrs,
+				})
+			}
+		} else {
+			if cached := previousByPool[p.Name]; cached != nil {
+				detail.Scrub = cached.Scrub
+				detail.Vdevs = cached.Vdevs
+			}
+		}
+		if datasetsErr == nil {
+			foundDataset := false
+			for _, ds := range datasets {
+				if poolOfDataset(ds.Name) == p.Name {
+					foundDataset = true
+					detail.Datasets = append(detail.Datasets, &zfsentity.Dataset{
+						Name:       ds.Name,
+						Used:       ds.Used,
+						Avail:      ds.Avail,
+						Mountpoint: ds.Mountpoint,
+					})
+				}
+			}
+			if !foundDataset {
+				if cached := previousByPool[p.Name]; cached != nil {
+					detail.Datasets = cached.Datasets
+				}
+			}
+		} else if cached := previousByPool[p.Name]; cached != nil {
+			detail.Datasets = cached.Datasets
+		}
+		data.Pools = append(data.Pools, detail)
+	}
+	return data, nil
+}
+
+// poolOfDataset returns the pool name for a dataset name (everything before
+// the first '/'). Datasets without a separator belong to a pool of the same
+// name.
+func poolOfDataset(name string) string {
+	if idx := strings.IndexByte(name, '/'); idx >= 0 {
+		return name[:idx]
+	}
+	return name
+}
+
+// ZfsMountpoints returns the set of mountpoints backed by ZFS datasets.
+func (m *StoragePoolManager) ZfsMountpoints() map[string]bool {
+	usage := m.DatasetUsage()
+	mountpoints := make(map[string]bool, len(usage))
+	for mountpoint := range usage {
+		mountpoints[mountpoint] = true
+	}
+	return mountpoints
+}
+
+func btrfsPoolStats(fs btrfs.Filesystem) zfs.PoolStat {
+	return zfs.PoolStat{MountID: fs.MountID, IODevice: fs.IODevice, Raw: fs.Raw, DisplayName: fs.Name, Name: "b:" + fs.UUID, Size: fs.Size, Alloc: fs.Alloc, Free: fs.Size - min(fs.Alloc, fs.Size), Health: fs.Health}
+}
+
+func btrfsKernelStats(fs btrfs.Filesystem) zfs.PoolKernelStat {
+	return zfs.PoolKernelStat{Name: "b:" + fs.UUID, Health: fs.Health, NRead: fs.NRead, NWrite: fs.NWrite}
+}
+
+func btrfsPoolStatuses(fs btrfs.Filesystem) zfs.PoolStatus {
+	status := zfs.PoolStatus{Name: "b:" + fs.UUID, State: fs.Health, Scrub: zfs.ScrubStatus{State: "NONE"}}
+	for _, dev := range fs.Devices {
+		status.Vdevs = append(status.Vdevs, zfs.VdevStatus{
+			Name: dev.Name, State: dev.State,
+			ReadErrs: dev.ReadErrs, WriteErrs: dev.WriteErrs, ChecksumErrs: dev.CorruptionErrs,
+		})
+	}
+	return status
+}
+
+// markDuplicateCharts leaves pool telemetry and detail intact, but tells the
+// hub which charts already have a filesystem equivalent. Only exact kernel
+// filesystem and I/O-device matches qualify; labels are never used.
+func (m *StoragePoolManager) markDuplicateCharts(stats *system.Stats, filesystems map[string]*system.FsStats, mountID func(string) string) {
+	identities := make(map[string]string, len(filesystems))
+	for device, fs := range filesystems {
+		if fs.DiskTotal > 0 {
+			identities[device] = mountID(fs.Mountpoint)
+		}
+	}
+	for _, backend := range m.backends {
+		for _, pool := range backend.poolData {
+			sample := stats.ZfsPools[pool.Name]
+			if sample == nil || pool.MountID == "" {
+				continue
+			}
+			for device, identity := range identities {
+				if identity != pool.MountID {
+					continue
+				}
+				// Raw physical usage is not equivalent to a filesystem usage chart.
+				sample.HideUsage = !pool.Raw
+				if pool.IODevice != "" && pool.IODevice == device {
+					sample.HideIO = true
+				}
+			}
+		}
+	}
+}

agent/storage_pool_test.go

@@ -0,0 +1,505 @@
+//go:build testing
+
+package agent
+
+import (
+	"errors"
+	"fmt"
+	"os/exec"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/henrygd/beszel/agent/btrfs"
+	"github.com/henrygd/beszel/agent/zfs"
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestOptionalPoolSource(t *testing.T) {
+	failure := errors.New("timeout")
+	for _, err := range []error{nil, zfs.ErrNoZfs, fmt.Errorf("zpool: %w", exec.ErrNotFound), errors.ErrUnsupported, failure} {
+		_, got := optionalPoolSource(func() ([]zfs.PoolStat, error) { return nil, err })()
+		if err == failure {
+			assert.ErrorIs(t, got, failure)
+		} else {
+			assert.NoError(t, got)
+		}
+	}
+}
+
+type poolTestBackend struct {
+	name  string
+	err   error
+	alloc uint64
+	read  uint64
+	empty bool
+}
+
+func (state *poolTestBackend) backend() *poolBackend {
+	name := "zfs"
+	if strings.HasPrefix(state.name, "b:") {
+		name = "btrfs"
+	}
+	return &poolBackend{
+		name: name,
+		poolStatsFn: func() ([]zfs.PoolStat, error) {
+			if state.empty {
+				return nil, state.err
+			}
+			return []zfs.PoolStat{{Name: state.name, Size: 100, Alloc: state.alloc}}, state.err
+		},
+		kernelStatsFn: func() ([]zfs.PoolKernelStat, error) {
+			return []zfs.PoolKernelStat{{Name: state.name, NRead: state.read}}, state.err
+		},
+		poolStatusesFn: func() ([]zfs.PoolStatus, error) { return nil, nil },
+		datasetsFn:     func() ([]zfs.Dataset, error) { return nil, nil },
+	}
+}
+
+func TestIndependentPoolBackendCaches(t *testing.T) {
+	for _, failed := range []int{0, 1} {
+		t.Run([]string{"zfs", "btrfs"}[failed], func(t *testing.T) {
+			states := []*poolTestBackend{{name: "tank", alloc: 10}, {name: "b:uuid", alloc: 10}}
+			managers := []*poolBackend{states[0].backend(), states[1].backend()}
+			zm := &StoragePoolManager{backends: managers, detailInterval: time.Hour}
+			var stats system.Stats
+			zm.Update(&stats)
+			require.Len(t, stats.ZfsPools, 2)
+			require.True(t, zm.GetDetail(true).Complete)
+			baseline := poolKernelSample{at: time.Now().Add(-time.Second)}
+			for i, m := range managers {
+				m.lastPoolStats = time.Time{}
+				m.kernelSamples[states[i].name] = baseline
+				states[i].alloc = 20
+				states[i].read = 100
+			}
+			states[failed].err = errors.New("collection failed")
+			zm.Update(&stats)
+			healthy := 1 - failed
+			assert.Equal(t, uint64(10), managers[failed].poolData[0].Alloc)
+			assert.Equal(t, uint64(20), managers[healthy].poolData[0].Alloc)
+			assert.Equal(t, baseline, managers[failed].kernelSamples[states[failed].name])
+			assert.Zero(t, stats.ZfsPools[states[failed].name].ReadBytes)
+			assert.Positive(t, stats.ZfsPools[states[healthy].name].ReadBytes)
+			partial := zm.GetDetail(true)
+			assert.False(t, partial.Complete)
+			assert.False(t, partial.CanRefreshPool(states[failed].name))
+			assert.True(t, partial.CanRefreshPool(states[healthy].name))
+			assert.Equal(t, uint64(10), partial.Pools[failed].Alloc)
+			assert.Equal(t, uint64(20), partial.Pools[healthy].Alloc)
+			assert.False(t, zm.GetDetail(false).Complete, "a failed forced refresh must not become complete from cache")
+
+			// Successful empty inventory removes only the healthy backend's pool.
+			states[healthy].empty = true
+			managers[healthy].lastPoolStats = time.Time{}
+			zm.Update(&stats)
+			require.Len(t, stats.ZfsPools, 1)
+			assert.Contains(t, stats.ZfsPools, states[failed].name)
+			partial = zm.GetDetail(true)
+			require.Len(t, partial.Pools, 1)
+			assert.True(t, partial.CanRefreshPool(states[healthy].name))
+
+			// Recovery uses the retained I/O baseline, then normal removal works.
+			states[failed].err = nil
+			managers[failed].lastPoolStats = time.Time{}
+			zm.Update(&stats)
+			assert.Positive(t, stats.ZfsPools[states[failed].name].ReadBytes)
+			assert.True(t, zm.GetDetail(true).Complete)
+			states[failed].empty = true
+			managers[failed].lastPoolStats = time.Time{}
+			zm.Update(&stats)
+			assert.Empty(t, stats.ZfsPools)
+			assert.Empty(t, zm.GetDetail(true).Pools)
+		})
+	}
+}
+
+func TestIndependentBackendsWithoutCache(t *testing.T) {
+	z := &poolTestBackend{name: "tank", err: errors.New("ZFS failure")}
+	b := &poolTestBackend{name: "b:uuid", alloc: 20}
+	zm := &StoragePoolManager{backends: []*poolBackend{z.backend(), b.backend()}, detailInterval: time.Hour}
+	var stats system.Stats
+	zm.Update(&stats)
+	require.Len(t, stats.ZfsPools, 1)
+	assert.Contains(t, stats.ZfsPools, "b:uuid")
+	detail := zm.GetDetail(true)
+	require.Len(t, detail.Pools, 1)
+	assert.False(t, detail.Complete)
+	assert.Equal(t, []string{"btrfs"}, detail.CompleteBackends)
+}
+
+func TestConcurrentBackendDetailsAndMetrics(t *testing.T) {
+	zm := &StoragePoolManager{backends: []*poolBackend{(&poolTestBackend{name: "tank"}).backend(), (&poolTestBackend{name: "b:uuid"}).backend()}, detailInterval: time.Hour}
+	var wg sync.WaitGroup
+	for i := 0; i < 3; i++ {
+		wg.Add(1)
+		go func(metrics bool) {
+			defer wg.Done()
+			for j := 0; j < 10; j++ {
+				if metrics {
+					zm.Update(&system.Stats{})
+				} else {
+					zm.GetDetail(true)
+				}
+			}
+		}(i == 0)
+	}
+	wg.Wait()
+}
+
+func TestStoragePoolBackendOrder(t *testing.T) {
+	z := (&poolTestBackend{name: "tank"}).backend()
+	b := (&poolTestBackend{name: "b:uuid"}).backend()
+	b.datasetsFn = nil // Btrfs does not expose datasets.
+	z.datasetsFn = func() ([]zfs.Dataset, error) {
+		return []zfs.Dataset{{Name: "tank/data", Mountpoint: "/tank", Used: 10}}, nil
+	}
+	m := &StoragePoolManager{backends: []*poolBackend{b, z}, detailInterval: time.Hour}
+	var stats system.Stats
+	m.Update(&stats)
+	require.Len(t, stats.ZfsPools, 2)
+	detail := m.GetDetail(true)
+	require.True(t, detail.Complete)
+	assert.Equal(t, []string{"btrfs", "zfs"}, detail.CompleteBackends)
+	assert.Empty(t, detail.Pools[0].Datasets)
+	assert.Len(t, detail.Pools[1].Datasets, 1)
+	assert.Equal(t, uint64(10), m.DatasetUsage()["/tank"].used)
+
+	b.poolData[0].MountID = "uuid"
+	b.poolData[0].IODevice = "sda"
+	calls := 0
+	m.markDuplicateCharts(&stats, map[string]*system.FsStats{
+		"sda": {Mountpoint: "/", DiskTotal: 100},
+	}, func(string) string { calls++; return "uuid" })
+	assert.Equal(t, 1, calls, "resolve each filesystem once across all backends")
+	assert.True(t, stats.ZfsPools["b:uuid"].HideUsage)
+	assert.True(t, stats.ZfsPools["b:uuid"].HideIO)
+}
+
+func TestUpdatePopulatesZfsPools(t *testing.T) {
+	zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs"}}}
+	zm.backends[0].poolStatsFn = func() ([]zfs.PoolStat, error) {
+		return []zfs.PoolStat{{Name: "tank", Size: 23999000000000, Alloc: 12000000000000, Free: 11999000000000, Health: "DEGRADED"}}, nil
+	}
+	zm.backends[0].datasetsFn = func() ([]zfs.Dataset, error) {
+		return []zfs.Dataset{
+			{Name: "tank/apps", Used: 5000000000000, Avail: 11999000000000, Mountpoint: "/tank/apps"},
+			{Name: "tank/backup", Used: 6000000000000, Avail: 11999000000000, Mountpoint: "/tank/backup"},
+			// Small zvol (Proxmox VM EFI disk): must not round to zero.
+			{Name: "rpool/vm-100-disk-2", Used: 4194304, Avail: 0, Mountpoint: "-"},
+		}, nil
+	}
+	var kernelCalls int
+	zm.backends[0].kernelStatsFn = func() ([]zfs.PoolKernelStat, error) {
+		kernelCalls++
+		return []zfs.PoolKernelStat{{
+			Name: "tank", Health: "ONLINE",
+			NRead: uint64(kernelCalls-1) * 1250, NWrite: uint64(kernelCalls-1) * 5120,
+		}}, nil
+	}
+
+	var stats system.Stats
+	// The first kernel sample establishes the cumulative-counter baseline.
+	zm.Update(&stats)
+	zm.backends[0].kernelSamples["tank"] = poolKernelSample{at: time.Now().Add(-time.Second)}
+	zm.Update(&stats)
+	require.NotNil(t, stats.ZfsPools)
+	require.Contains(t, stats.ZfsPools, "tank")
+	assert.InDelta(t, 22350.8105, stats.ZfsPools["tank"].Total, 0.0001) // Size in GiB
+	assert.InDelta(t, 11175.8709, stats.ZfsPools["tank"].Used, 0.0001)  // Alloc in GiB
+	assert.Equal(t, "ONLINE", stats.ZfsPools["tank"].Health)
+	assert.InDelta(t, 1250, stats.ZfsPools["tank"].ReadBytes, 5)
+	assert.InDelta(t, 5120, stats.ZfsPools["tank"].WriteBytes, 5)
+
+}
+
+// TestUpdateKernelStatsMissing verifies pools without a kernel sample report zero
+// I/O instead of erroring.
+func TestUpdateKernelStatsMissing(t *testing.T) {
+	zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs"}}}
+	zm.backends[0].poolStatsFn = func() ([]zfs.PoolStat, error) {
+		return []zfs.PoolStat{{Name: "tank", Size: 1, Alloc: 1, Health: "ONLINE"}}, nil
+	}
+	zm.backends[0].datasetsFn = func() ([]zfs.Dataset, error) { return nil, nil }
+	zm.backends[0].kernelStatsFn = func() ([]zfs.PoolKernelStat, error) {
+		return nil, zfs.ErrNoZfs
+	}
+
+	var stats system.Stats
+	zm.Update(&stats)
+	require.NotNil(t, stats.ZfsPools)
+	assert.Equal(t, uint64(0), stats.ZfsPools["tank"].ReadBytes)
+	assert.Equal(t, uint64(0), stats.ZfsPools["tank"].WriteBytes)
+}
+
+func TestUpdateKernelCounterReset(t *testing.T) {
+	zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs"}}}
+	zm.backends[0].poolStatsFn = func() ([]zfs.PoolStat, error) {
+		return []zfs.PoolStat{{Name: "tank", Health: "ONLINE"}}, nil
+	}
+	zm.backends[0].datasetsFn = func() ([]zfs.Dataset, error) { return nil, nil }
+	zm.backends[0].kernelSamples = map[string]poolKernelSample{
+		"tank": {nread: 100, nwrite: 200, at: time.Now().Add(-time.Second)},
+	}
+	zm.backends[0].kernelStatsFn = func() ([]zfs.PoolKernelStat, error) {
+		return []zfs.PoolKernelStat{{Name: "tank", Health: "ONLINE", NRead: 10, NWrite: 20}}, nil
+	}
+
+	var stats system.Stats
+	zm.Update(&stats)
+	assert.Equal(t, uint64(0), stats.ZfsPools["tank"].ReadBytes)
+	assert.Equal(t, uint64(0), stats.ZfsPools["tank"].WriteBytes)
+}
+
+func TestUpdateNoZfs(t *testing.T) {
+	zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs"}}}
+	calls := 0
+	zm.backends[0].poolStatsFn = func() ([]zfs.PoolStat, error) {
+		calls++
+		return nil, zfs.ErrNoZfs
+	}
+
+	var stats system.Stats
+	zm.Update(&stats)
+	zm.Update(&stats)
+	assert.Nil(t, stats.ZfsPools)
+	assert.Equal(t, 1, calls, "failed pool discovery should be cached until the next refresh interval")
+}
+
+func TestUpdateEmptyPools(t *testing.T) {
+	zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs"}}}
+	calls := 0
+	zm.backends[0].poolStatsFn = func() ([]zfs.PoolStat, error) {
+		calls++
+		return nil, nil
+	}
+
+	var stats system.Stats
+	zm.Update(&stats)
+	zm.Update(&stats)
+	assert.Nil(t, stats.ZfsPools)
+	assert.Equal(t, 1, calls, "an empty pool inventory should be cached until the next refresh interval")
+}
+
+func TestDatasetUsage(t *testing.T) {
+	zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs"}}}
+	calls := 0
+	zm.backends[0].datasetsFn = func() ([]zfs.Dataset, error) {
+		calls++
+		return []zfs.Dataset{
+			{Name: "tank", Used: 12000000000000, Avail: 11999000000000, Mountpoint: "/tank"},
+			{Name: "tank/apps", Used: 1000000000000, Avail: 11999000000000, Mountpoint: "/tank/apps"},
+			{Name: "rpool", Used: 900000000000, Avail: 300000000000, Mountpoint: "-"}, // zvol/unmounted: excluded
+		}, nil
+	}
+
+	usage := zm.DatasetUsage()
+	require.Len(t, usage, 2)
+	assert.Equal(t, zfsDatasetUsage{used: 12000000000000, avail: 11999000000000}, usage["/tank"])
+	assert.Equal(t, zfsDatasetUsage{used: 1000000000000, avail: 11999000000000}, usage["/tank/apps"])
+	assert.Equal(t, 1, calls)
+
+	// Second call within the refresh window must not re-run the collector.
+	zm.DatasetUsage()
+	assert.Equal(t, 1, calls)
+}
+
+func TestDatasetUsageRefreshOnErrorKeepsPrevious(t *testing.T) {
+	zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs"}}}
+	zm.backends[0].datasetsFn = func() ([]zfs.Dataset, error) {
+		return []zfs.Dataset{{Name: "tank", Used: 1, Avail: 1, Mountpoint: "/tank"}}, nil
+	}
+	assert.Len(t, zm.DatasetUsage(), 1)
+
+	// Force refresh window expiry, then a failing collector.
+	zm.backends[0].lastUsageRefresh = time.Now().Add(-10 * time.Minute)
+	zm.backends[0].datasetsFn = func() ([]zfs.Dataset, error) {
+		return nil, zfs.ErrNoZfs
+	}
+	usage := zm.DatasetUsage()
+	assert.Len(t, usage, 1, "previous usage should be retained on error")
+}
+
+func TestGetDetailForceRefresh(t *testing.T) {
+	zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs"}}}
+	poolCalls := 0
+	zm.backends[0].poolStatsFn = func() ([]zfs.PoolStat, error) {
+		poolCalls++
+		return []zfs.PoolStat{{Name: "tank", Alloc: uint64(poolCalls)}}, nil
+	}
+	zm.backends[0].poolStatusesFn = func() ([]zfs.PoolStatus, error) { return nil, nil }
+	zm.backends[0].datasetsFn = func() ([]zfs.Dataset, error) { return nil, nil }
+
+	first := zm.GetDetail(false)
+	assert.True(t, first.Complete)
+	require.Len(t, first.Pools, 1)
+	assert.Equal(t, uint64(1), first.Pools[0].Alloc)
+
+	cached := zm.GetDetail(false)
+	require.Len(t, cached.Pools, 1)
+	assert.Equal(t, uint64(1), cached.Pools[0].Alloc)
+	assert.Equal(t, 1, poolCalls)
+
+	refreshed := zm.GetDetail(true)
+	assert.True(t, refreshed.Complete)
+	require.Len(t, refreshed.Pools, 1)
+	assert.Equal(t, uint64(2), refreshed.Pools[0].Alloc)
+	assert.Equal(t, 2, poolCalls)
+}
+
+func TestGetDetailSuccessfulEmptyInventoryClearsCache(t *testing.T) {
+	zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs"}}}
+	zm.backends[0].poolStatsFn = func() ([]zfs.PoolStat, error) {
+		return []zfs.PoolStat{{Name: "tank"}}, nil
+	}
+	zm.backends[0].poolStatusesFn = func() ([]zfs.PoolStatus, error) { return nil, nil }
+	zm.backends[0].datasetsFn = func() ([]zfs.Dataset, error) { return nil, nil }
+
+	require.Len(t, zm.GetDetail(false).Pools, 1)
+	zm.backends[0].poolStatsFn = func() ([]zfs.PoolStat, error) { return nil, nil }
+	empty := zm.GetDetail(true)
+	assert.True(t, empty.Complete)
+	assert.Empty(t, empty.Pools)
+}
+
+func TestGetDetailFailureReturnsIncompleteCachedInventory(t *testing.T) {
+	zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs"}}}
+	zm.backends[0].poolStatsFn = func() ([]zfs.PoolStat, error) {
+		return []zfs.PoolStat{{Name: "tank"}}, nil
+	}
+	zm.backends[0].poolStatusesFn = func() ([]zfs.PoolStatus, error) {
+		return []zfs.PoolStatus{{Name: "tank", Vdevs: []zfs.VdevStatus{{Name: "mirror-0"}}}}, nil
+	}
+	zm.backends[0].datasetsFn = func() ([]zfs.Dataset, error) {
+		return []zfs.Dataset{{Name: "tank/data"}}, nil
+	}
+	first := zm.GetDetail(false)
+	require.True(t, first.Complete)
+	require.Len(t, first.Pools[0].Vdevs, 1)
+	require.Len(t, first.Pools[0].Datasets, 1)
+
+	zm.backends[0].poolStatusesFn = func() ([]zfs.PoolStatus, error) { return nil, zfs.ErrNoZfs }
+	zm.backends[0].datasetsFn = func() ([]zfs.Dataset, error) { return nil, zfs.ErrNoZfs }
+	partial := zm.GetDetail(true)
+	require.True(t, partial.Complete)
+	require.Len(t, partial.Pools[0].Vdevs, 1)
+	require.Len(t, partial.Pools[0].Datasets, 1)
+
+	zm.backends[0].poolStatsFn = func() ([]zfs.PoolStat, error) { return nil, zfs.ErrNoZfs }
+	lastSuccessfulRefresh := zm.backends[0].lastDetailRefresh
+	failed := zm.GetDetail(true)
+	assert.False(t, failed.Complete)
+	require.Len(t, failed.Pools, 1)
+	assert.Equal(t, "tank", failed.Pools[0].Name)
+	assert.Equal(t, lastSuccessfulRefresh, zm.backends[0].lastDetailRefresh)
+}
+
+func TestZfsMountpoints(t *testing.T) {
+	zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs"}}}
+	zm.backends[0].datasetsFn = func() ([]zfs.Dataset, error) {
+		return []zfs.Dataset{
+			{Name: "tank", Mountpoint: "/tank"},
+			{Name: "rpool/ROOT/pve-1", Mountpoint: "/"},
+		}, nil
+	}
+	mountpoints := zm.ZfsMountpoints()
+	assert.Len(t, mountpoints, 2)
+	assert.True(t, mountpoints["/tank"])
+	assert.True(t, mountpoints["/"])
+}
+
+func TestBtrfsRawCapacityPropagates(t *testing.T) {
+	zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs", poolStatsFn: func() ([]zfs.PoolStat, error) {
+		return []zfs.PoolStat{btrfsPoolStats(btrfs.Filesystem{UUID: "raw", Name: "raw", Size: 200, Alloc: 100, Raw: true})}, nil
+	},
+		poolStatusesFn: func() ([]zfs.PoolStatus, error) { return nil, nil },
+		datasetsFn:     func() ([]zfs.Dataset, error) { return nil, nil }}}}
+	var stats system.Stats
+	zm.Update(&stats)
+	require.True(t, stats.ZfsPools["b:raw"].Raw)
+	detail := zm.GetDetail(true)
+	require.True(t, detail.Complete)
+	require.Len(t, detail.Pools, 1)
+	assert.True(t, detail.Pools[0].Raw)
+}
+
+func TestMarkDuplicatePoolCharts(t *testing.T) {
+	for _, tc := range []struct {
+		name, poolID, device string
+		raw                  bool
+		diskTotal            float64
+		wantUsage, wantIO    bool
+	}{
+		{"single device root", "fs1", "dm-0", false, 100, true, true},
+		{"multi device", "fs1", "", false, 100, true, false},
+		{"different IO device", "fs1", "nvme0n1", false, 100, true, false},
+		{"different filesystem", "fs2", "dm-0", false, 100, false, false},
+		{"unknown identity", "", "dm-0", false, 100, false, false},
+		{"raw usage", "fs1", "dm-0", true, 100, false, true},
+		{"failed disk collection", "fs1", "dm-0", false, 0, false, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs", poolData: []zfs.PoolStat{{Name: "arbitrary label", MountID: tc.poolID, IODevice: tc.device, Raw: tc.raw}}}}}
+			stats := &system.Stats{ZfsPools: map[string]*system.ZfsPool{"arbitrary label": {}}}
+			fs := map[string]*system.FsStats{"dm-0": {Root: true, Mountpoint: "/", DiskTotal: tc.diskTotal}}
+			zm.markDuplicateCharts(stats, fs, func(string) string { return "fs1" })
+			assert.Equal(t, tc.wantUsage, stats.ZfsPools["arbitrary label"].HideUsage)
+			assert.Equal(t, tc.wantIO, stats.ZfsPools["arbitrary label"].HideIO)
+			// Bind mounts and custom extra-filesystem names have the same identity.
+			fs["dm-0"].Root = false
+			fs["dm-0"].Mountpoint = "/extra-filesystems/storage"
+			fs["dm-0"].Name = "custom name"
+			stats.ZfsPools["arbitrary label"] = &system.ZfsPool{}
+			zm.markDuplicateCharts(stats, fs, func(string) string { return "fs1" })
+			assert.Equal(t, tc.wantUsage, stats.ZfsPools["arbitrary label"].HideUsage)
+			assert.Equal(t, tc.wantIO, stats.ZfsPools["arbitrary label"].HideIO)
+		})
+	}
+}
+
+func TestBtrfsPoolIdentities(t *testing.T) {
+	old := btrfsFilesystems
+	t.Cleanup(func() { btrfsFilesystems = old })
+	label := "tank"
+	btrfsFilesystems = func() ([]btrfs.Filesystem, error) {
+		return []btrfs.Filesystem{
+			{UUID: "11111111-1111-4111-8111-111111111111", Name: label, Size: 100, Health: "ONLINE", NRead: 100, Devices: []btrfs.Device{{Name: "first"}}},
+			{UUID: "22222222-2222-4222-8222-222222222222", Name: "tank", Size: 200, Health: "DEGRADED", NRead: 200, Devices: []btrfs.Device{{Name: "second"}}},
+		}, nil
+	}
+	zm := &StoragePoolManager{detailInterval: time.Hour, backends: []*poolBackend{{name: "zfs", poolStatsFn: func() ([]zfs.PoolStat, error) { return []zfs.PoolStat{{Name: "tank", Size: 300}}, nil },
+		kernelStatsFn: func() ([]zfs.PoolKernelStat, error) { return []zfs.PoolKernelStat{{Name: "tank", NRead: 300}}, nil },
+		poolStatusesFn: func() ([]zfs.PoolStatus, error) {
+			return []zfs.PoolStatus{{Name: "tank", Vdevs: []zfs.VdevStatus{{Name: "zfs-device"}}}}, nil
+		},
+
+		datasetsFn: func() ([]zfs.Dataset, error) { return []zfs.Dataset{{Name: "tank/data"}}, nil }}, newBtrfsBackend()}}
+	first := "b:11111111-1111-4111-8111-111111111111"
+	second := "b:22222222-2222-4222-8222-222222222222"
+	var stats system.Stats
+	zm.Update(&stats)
+	require.Len(t, stats.ZfsPools, 3)
+	assert.Contains(t, stats.ZfsPools, "tank")
+	assert.Equal(t, "ONLINE", stats.ZfsPools[first].Health)
+	assert.Equal(t, "DEGRADED", stats.ZfsPools[second].Health)
+	assert.Equal(t, uint64(100), zm.backends[1].kernelSamples[first].nread)
+	assert.Equal(t, uint64(200), zm.backends[1].kernelSamples[second].nread)
+	detail := zm.GetDetail(true)
+	require.Len(t, detail.Pools, 3)
+	assert.Equal(t, "zfs-device", detail.Pools[0].Vdevs[0].Name)
+	assert.Len(t, detail.Pools[0].Datasets, 1)
+	assert.Equal(t, "first", detail.Pools[1].Vdevs[0].Name)
+	assert.Empty(t, detail.Pools[1].Datasets)
+	assert.Equal(t, "second", detail.Pools[2].Vdevs[0].Name)
+	label = "renamed"
+	zm.backends[0].lastPoolStats = time.Time{}
+	zm.backends[1].lastPoolStats = time.Time{}
+	zm.Update(&stats)
+	require.Len(t, stats.ZfsPools, 3)
+	assert.Equal(t, "renamed", stats.ZfsPools[first].DisplayName)
+	assert.Equal(t, first, zm.GetDetail(true).Pools[1].Name)
+	assert.Equal(t, "renamed", zm.GetDetail(true).Pools[1].DisplayName)
+}

agent/system.go

@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"errors"
 	"fmt"
+	"io"
 	"log/slog"
 	"os"
 	"runtime"
@@ -11,6 +12,7 @@ import (
 
 	"github.com/henrygd/beszel"
 	"github.com/henrygd/beszel/agent/battery"
+	"github.com/henrygd/beszel/agent/btrfs"
 	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/agent/zfs"
 	"github.com/henrygd/beszel/internal/entities/container"
@@ -31,7 +33,11 @@ func (a *Agent) refreshSystemDetails() {
 
 	if a.dockerManager != nil {
 		a.systemDetails.Podman = a.dockerManager.IsPodman()
-		hostInfo, _ = a.dockerManager.GetHostInfo()
+		// Docker's host info describes the machine its daemon runs on. On macOS and
+		// Windows that is a Linux VM, so its CPU and memory totals are not this host's.
+		if runtime.GOOS != "darwin" && runtime.GOOS != "windows" {
+			hostInfo, _ = a.dockerManager.GetHostInfo()
+		}
 	}
 
 	a.systemDetails.Hostname, _ = os.Hostname()
@@ -78,6 +84,12 @@ func (a *Agent) refreshSystemDetails() {
 	if info, err := cpu.Info(); err == nil && len(info) > 0 {
 		a.systemDetails.CpuModel = info[0].ModelName
 	}
+	// gopsutil doesn't parse the "cpu model" field from /proc/cpuinfo, which
+	// is the only source of the CPU model name on MIPS. Fall back to reading
+	// it directly when ModelName is empty.
+	if a.systemDetails.CpuModel == "" {
+		a.systemDetails.CpuModel = getCpuModelFromCpuinfo()
+	}
 	// cores / threads
 	cores, _ := cpu.Counts(false)
 	threads := hostInfo.NCPU
@@ -132,9 +144,14 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 	var systemStats system.Stats
 
 	// battery
-	if batteryPercent, batteryState, err := battery.GetBatteryStats(); err == nil {
-		systemStats.Battery[0] = batteryPercent
-		systemStats.Battery[1] = batteryState
+	if batteries, err := battery.GetBatteryStats(); err == nil {
+		systemStats.Batteries = make(map[string]uint8, len(batteries))
+		for _, device := range batteries {
+			systemStats.Batteries[device.Name] = device.Percent
+		}
+		if primary, ok := battery.Primary(batteries); ok {
+			systemStats.Battery = [2]uint8{primary.Percent, primary.State}
+		}
 	}
 
 	// cpu metrics
@@ -159,9 +176,9 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 
 	// load average
 	if avgstat, err := load.Avg(); err == nil {
-		systemStats.LoadAvg[0] = avgstat.Load1
-		systemStats.LoadAvg[1] = avgstat.Load5
-		systemStats.LoadAvg[2] = avgstat.Load15
+		systemStats.LoadAvg[0] = utils.TwoDecimals(avgstat.Load1)
+		systemStats.LoadAvg[1] = utils.TwoDecimals(avgstat.Load5)
+		systemStats.LoadAvg[2] = utils.TwoDecimals(avgstat.Load15)
 		slog.Debug("Load average", "5m", avgstat.Load5, "15m", avgstat.Load15)
 	} else {
 		slog.Error("Error getting load average", "err", err)
@@ -169,21 +186,11 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 
 	// memory
 	if v, err := mem.VirtualMemory(); err == nil {
+		used, cacheBuff, swapUsed := calculateHostMemoryUsage(v, a.memCalc == "htop")
 		// swap
 		systemStats.Swap = utils.BytesToGigabytes(v.SwapTotal)
-		systemStats.SwapUsed = utils.BytesToGigabytes(v.SwapTotal - v.SwapFree - v.SwapCached)
-		// cache + buffers value for default mem calculation
-		// note: gopsutil automatically adds SReclaimable to v.Cached
-		cacheBuff := v.Cached + v.Buffers - v.Shared
-		if cacheBuff <= 0 {
-			cacheBuff = max(v.Total-v.Free-v.Used, 0)
-		}
-		// htop memory calculation overrides (likely outdated as of mid 2025)
-		if a.memCalc == "htop" {
-			// cacheBuff = v.Cached + v.Buffers - v.Shared
-			v.Used = v.Total - (v.Free + cacheBuff)
-			v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
-		}
+		systemStats.SwapUsed = utils.BytesToGigabytes(swapUsed)
+		v.Used = used
 		// if a.memCalc == "legacy" {
 		// 	v.Used = v.Total - v.Free - v.Buffers - v.Cached
 		// 	cacheBuff = v.Total - v.Free - v.Used
@@ -193,10 +200,14 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 		if a.zfs {
 			if arcSize, _ := zfs.ARCSize(); arcSize > 0 && arcSize < v.Used {
 				v.Used = v.Used - arcSize
-				v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
 				systemStats.MemZfsArc = utils.BytesToGigabytes(arcSize)
 			}
 		}
+		if v.Total > 0 {
+			v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
+		} else {
+			v.UsedPercent = 0
+		}
 		systemStats.Mem = utils.BytesToGigabytes(v.Total)
 		systemStats.MemBuffCache = utils.BytesToGigabytes(cacheBuff)
 		systemStats.MemUsed = utils.BytesToGigabytes(v.Used)
@@ -209,6 +220,10 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 	// disk i/o (cache-aware per interval)
 	a.updateDiskIo(cacheTimeMs, &systemStats)
 
+	// storage pool stats
+	a.storagePoolManager.Update(&systemStats)
+	a.storagePoolManager.markDuplicateCharts(&systemStats, a.fsStats, btrfs.MountID)
+
 	// network stats (per cache interval)
 	a.updateNetworkStats(cacheTimeMs, &systemStats)
 
@@ -216,6 +231,9 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 	// TODO: maybe refactor to methods on systemStats
 	a.updateTemperatures(&systemStats)
 
+	// fan speeds (Linux-only; sysfs hwmon)
+	a.updateFans(&systemStats)
+
 	// GPU data
 	if a.gpuManager != nil {
 		// reset high gpu percent
@@ -256,13 +274,99 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 	a.systemInfo.MemPct = systemStats.MemPct
 	a.systemInfo.DiskPct = systemStats.DiskPct
 	a.systemInfo.Battery = systemStats.Battery
-	a.systemInfo.Uptime, _ = host.Uptime()
+	a.systemInfo.Uptime, _ = getUptime()
 	a.systemInfo.BandwidthBytes = systemStats.Bandwidth[0] + systemStats.Bandwidth[1]
 	a.systemInfo.Threads = a.systemDetails.Threads
 
 	return systemStats
 }
 
+// cpuModelFallbackKeys are the field names to look for in /proc/cpuinfo when
+// gopsutil fails to return a ModelName. The "cpu model" key is used on MIPS
+// (e.g. "MIPS 1004Kc V2.15"), while "system type" provides SoC information
+// on various embedded architectures.
+var cpuModelFallbackKeys = []string{"cpu model", "system type"}
+
+// getCpuModelFromCpuinfo reads /proc/cpuinfo and returns a CPU model string.
+// This is a fallback for architectures where gopsutil's cpu.Info() does not
+// populate ModelName, most notably MIPS.
+func getCpuModelFromCpuinfo() string {
+	file, err := os.Open("/proc/cpuinfo")
+	if err != nil {
+		return ""
+	}
+	defer file.Close()
+	return parseCpuModel(file)
+}
+
+// parseCpuModel scans r (expected to be /proc/cpuinfo content) and returns
+// a combined CPU model string. It collects values from all matching keys
+// and joins them with " / " when multiple are found.
+func parseCpuModel(r io.Reader) string {
+	lines := readLines(r)
+	var parts []string
+	for _, key := range cpuModelFallbackKeys {
+		for _, line := range lines {
+			after, found := strings.CutPrefix(line, key)
+			if !found {
+				continue
+			}
+			after = strings.TrimSpace(after)
+			if len(after) < 2 || after[0] != ':' {
+				continue
+			}
+			if value := strings.TrimSpace(after[1:]); value != "" {
+				parts = append(parts, value)
+				break
+			}
+		}
+	}
+	return strings.Join(parts, " / ")
+}
+
+// readLines reads all lines from r into a slice.
+func readLines(r io.Reader) []string {
+	scanner := bufio.NewScanner(r)
+	var lines []string
+	for scanner.Scan() {
+		lines = append(lines, scanner.Text())
+	}
+	return lines
+}
+
+// calculateHostMemoryUsage derives counters defensively because /proc/meminfo may
+// change while gopsutil reads it. Invalid unsigned subtractions saturate at zero.
+func calculateHostMemoryUsage(v *mem.VirtualMemoryStat, htop bool) (used, cacheBuff, swapUsed uint64) {
+	used = v.Used
+	if used > v.Total {
+		used = saturatingSub(v.Total, v.Available)
+	}
+
+	// gopsutil automatically adds SReclaimable to Cached.
+	cacheBuff = min(v.Cached, v.Total)
+	cacheBuff += min(v.Buffers, v.Total-cacheBuff)
+	cacheBuff = saturatingSub(cacheBuff, min(v.Shared, v.Total))
+	if v.Cached == 0 && v.Buffers == 0 {
+		cacheBuff = saturatingSub(v.Total, v.Free, used)
+	}
+	if htop {
+		used = saturatingSub(v.Total, v.Free, cacheBuff)
+	}
+	// Cached swap pages still occupy swap slots and are included in `free`'s used value.
+	return used, cacheBuff, saturatingSub(v.SwapTotal, v.SwapFree)
+}
+
+// saturatingSub subtracts each value, returning zero on underflow.
+func saturatingSub(value uint64, subtrahends ...uint64) uint64 {
+	for _, subtrahend := range subtrahends {
+		if subtrahend > value {
+			return 0
+		}
+		value -= subtrahend
+	}
+	return value
+}
+
 // getOsPrettyName attempts to get the pretty OS name from /etc/os-release on Linux systems
 func getOsPrettyName() (string, error) {
 	file, err := os.Open("/etc/os-release")

agent/system_test.go

@@ -1,10 +1,12 @@
 package agent
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/henrygd/beszel/internal/common"
 	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/shirou/gopsutil/v4/mem"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -33,6 +35,59 @@ func TestGatherStatsDoesNotAttachDetailsToCachedRequests(t *testing.T) {
 	assert.Nil(t, secondResponse.Details)
 }
 
+func TestCalculateHostMemoryUsage(t *testing.T) {
+	tests := []struct {
+		name                      string
+		memory                    mem.VirtualMemoryStat
+		htop                      bool
+		used, cacheBuff, swapUsed uint64
+	}{
+		{
+			name:      "normal",
+			memory:    mem.VirtualMemoryStat{Total: 100, Available: 40, Used: 60, Free: 20, Cached: 25, Buffers: 10, Shared: 5, SwapTotal: 20, SwapFree: 8, SwapCached: 2},
+			used:      60,
+			cacheBuff: 30,
+			swapUsed:  12,
+		},
+		{
+			name:      "inconsistent counters saturate",
+			memory:    mem.VirtualMemoryStat{Total: 100, Available: 110, Used: ^uint64(0) - 9, Free: 90, Cached: 5, Buffers: 10, Shared: 20, SwapTotal: 10, SwapFree: 9, SwapCached: 2},
+			used:      0,
+			cacheBuff: 0,
+			swapUsed:  1,
+		},
+		{
+			name:      "htop subtraction saturates",
+			memory:    mem.VirtualMemoryStat{Total: 100, Available: 20, Used: 80, Free: 90, Cached: 20, Buffers: 5, SwapTotal: 30, SwapFree: 10, SwapCached: 5},
+			htop:      true,
+			used:      0,
+			cacheBuff: 25,
+			swapUsed:  20,
+		},
+		{
+			name:      "zero cache from shared cancellation does not fall back",
+			memory:    mem.VirtualMemoryStat{Total: 100, Used: 60, Free: 10, Cached: 20, Buffers: 10, Shared: 30},
+			used:      60,
+			cacheBuff: 0,
+		},
+		{
+			name:      "absent cache counters use fallback",
+			memory:    mem.VirtualMemoryStat{Total: 100, Used: 60, Free: 10},
+			used:      60,
+			cacheBuff: 30,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			used, cacheBuff, swapUsed := calculateHostMemoryUsage(&tt.memory, tt.htop)
+			assert.Equal(t, tt.used, used)
+			assert.Equal(t, tt.cacheBuff, cacheBuff)
+			assert.Equal(t, tt.swapUsed, swapUsed)
+		})
+	}
+}
+
 func TestUpdateSystemDetailsMarksDetailsDirty(t *testing.T) {
 	agent := &Agent{}
 
@@ -59,3 +114,81 @@ func TestUpdateSystemDetailsMarksDetailsDirty(t *testing.T) {
 	assert.False(t, agent.detailsDirty)
 	assert.Nil(t, original.Details)
 }
+
+func TestParseCpuModel(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name: "MIPS with both cpu model and system type",
+			input: `system type             : MediaTek MT7621 ver:1 eco:3
+machine                 : ASUS RT-AX53U
+processor               : 0
+cpu model               : MIPS 1004Kc V2.15
+BogoMIPS                : 586.13
+wait instruction        : yes`,
+			expected: "MIPS 1004Kc V2.15 / MediaTek MT7621 ver:1 eco:3",
+		},
+		{
+			name: "MIPS with different SoC",
+			input: `system type             : Atheros AR7161 rev 2
+machine                 : NETGEAR WNDR3700
+processor               : 0
+cpu model               : MIPS 24Kc V7.4
+BogoMIPS                : 452.19`,
+			expected: "MIPS 24Kc V7.4 / Atheros AR7161 rev 2",
+		},
+		{
+			name: "only system type when cpu model missing",
+			input: `system type             : Broadcom BCM47xx
+processor               : 0
+BogoMIPS                : 296.11`,
+			expected: "Broadcom BCM47xx",
+		},
+		{
+			name: "only cpu model when system type missing",
+			input: `processor               : 0
+cpu model               : MIPS 34Kc V2.15
+BogoMIPS                : 300.00`,
+			expected: "MIPS 34Kc V2.15",
+		},
+		{
+			name: "x86 cpuinfo returns empty",
+			input: `processor	: 0
+vendor_id	: GenuineIntel
+cpu family	: 6
+model		: 142
+model name	: Intel(R) Core(TM) i5-8250U CPU @ 1.60GHz
+stepping	: 10`,
+			expected: "",
+		},
+		{
+			name:     "empty input",
+			input:    "",
+			expected: "",
+		},
+		{
+			name: "cpu model with extra whitespace",
+			input: `processor               : 0
+cpu model               :   MIPS 34Kc V2.15
+BogoMIPS                : 300.00`,
+			expected: "MIPS 34Kc V2.15",
+		},
+		{
+			name: "cpu model without value",
+			input: `processor               : 0
+cpu model               :
+BogoMIPS                : 300.00`,
+			expected: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := parseCpuModel(strings.NewReader(tt.input))
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}

agent/test-data/zfs/zfs_list.txt

@@ -0,0 +1,9 @@
+tank	12000000000000	11999000000000	/tank
+tank/apps	1000000000000	11999000000000	/tank/apps
+tank/backup	2000000000000	11999000000000	/tank/backup
+tank/media	1000000000000	11999000000000	/tank/my media
+rpool	900000000000	300000000000	-
+rpool/ROOT	1000000000	300000000000	-
+rpool/ROOT/pve-1	890000000000	300000000000	/
+rpool/data	9000000000	300000000000	-
+rpool/data/subvol-100-disk-0	400000000000	300000000000	/subvol-100-disk-0

agent/test-data/zfs/zpool_list.txt

@@ -0,0 +1,2 @@
+tank	23999000000000	12000000000000	11999000000000	ONLINE
+rpool	1200000000000	900000000000	300000000000	DEGRADED

agent/test-data/zfs/zpool_status.txt

@@ -0,0 +1,29 @@
+  pool: tank
+ state: ONLINE
+  scan: scrub repaired 0B in 00:05:12 with 0 errors on Sun Jun  1 02:00:12 2025
+config:
+
+	NAME        STATE     READ WRITE CKSUM
+	tank        ONLINE       0     0     0
+	  mirror-0  ONLINE       0     0     0
+	    sda     ONLINE       0     0     0
+	    sdb     ONLINE       0     0     0
+
+errors: No known data errors
+
+  pool: rpool
+ state: DEGRADED
+ status: One or more devices could not be used because the label is missing or
+	invalid.  Sufficient replicas exist for the pool to continue functioning in a
+	degraded state.
+  scan: scrub in progress since Sun Jun  8 01:00:00 2025
+	10.00% done, 01:30:00 to go, 0.00/s
+config:
+
+	NAME        STATE     READ WRITE CKSUM
+	rpool       DEGRADED     0     0     0
+	  mirror-0  DEGRADED     0     0     0
+	    sda     ONLINE       0     0     0
+	    sdb     FAULTED      1     2     3
+
+errors: 1 data errors, use '-v' for a list

agent/uptime_linux.go

@@ -0,0 +1,44 @@
+//go:build linux
+
+package agent
+
+import (
+	"math"
+	"os"
+	"strconv"
+	"strings"
+
+	"github.com/shirou/gopsutil/v4/host"
+)
+
+// uptimeFilePath is a variable so tests can point it at a fixture.
+var uptimeFilePath = "/proc/uptime"
+
+// getUptime returns the system uptime in seconds.
+//
+// This reads /proc/uptime instead of using host.Uptime(), which calls the
+// sysinfo(2) syscall. Inside an LXC container lxcfs virtualizes /proc/uptime
+// but cannot intercept a syscall, so sysinfo(2) reports the host's uptime
+// rather than the container's.
+//
+// Falls back to host.Uptime() if /proc/uptime is missing or unparseable, so
+// behavior is unchanged anywhere the file isn't available.
+func getUptime() (uint64, error) {
+	data, err := os.ReadFile(uptimeFilePath)
+	if err != nil {
+		return host.Uptime()
+	}
+	fields := strings.Fields(string(data))
+	if len(fields) == 0 {
+		return host.Uptime()
+	}
+	seconds, err := strconv.ParseFloat(fields[0], 64)
+	if err != nil ||
+		math.IsNaN(seconds) ||
+		math.IsInf(seconds, 0) ||
+		seconds < 0 ||
+		seconds >= 1<<64 {
+		return host.Uptime()
+	}
+	return uint64(seconds), nil
+}

agent/uptime_linux_test.go

@@ -0,0 +1,101 @@
+//go:build linux
+
+package agent
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestGetUptimeFromProc(t *testing.T) {
+	tests := []struct {
+		name     string
+		contents string
+		want     uint64
+	}{
+		{"typical", "12345.67 98765.43\n", 12345},
+		{"zero", "0.00 0.00\n", 0},
+		{"no trailing newline", "42.99 7.00", 42},
+		{"single field", "600.5", 600},
+		{"large value", "266030.12 1000000.00\n", 266030},
+	}
+
+	prev := uptimeFilePath
+	t.Cleanup(func() { uptimeFilePath = prev })
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "uptime")
+			if err := os.WriteFile(path, []byte(tt.contents), 0o644); err != nil {
+				t.Fatal(err)
+			}
+			uptimeFilePath = path
+
+			got, err := getUptime()
+			if err != nil {
+				t.Fatalf("getUptime() returned error: %v", err)
+			}
+			if got != tt.want {
+				t.Errorf("getUptime() = %d, want %d", got, tt.want)
+			}
+		})
+	}
+}
+
+func writeUptime(contents string) func(t *testing.T) string {
+	return func(t *testing.T) string {
+		path := filepath.Join(t.TempDir(), "uptime")
+		if err := os.WriteFile(path, []byte(contents), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		return path
+	}
+}
+
+// Malformed, missing, or out-of-range input must fall back to host.Uptime()
+// rather than returning a bogus value, so the agent still reports something sane.
+func TestGetUptimeFallsBack(t *testing.T) {
+	prev := uptimeFilePath
+	t.Cleanup(func() { uptimeFilePath = prev })
+
+	for _, tt := range []struct {
+		name    string
+		prepare func(t *testing.T) string
+	}{
+		{"missing file", func(t *testing.T) string {
+			return filepath.Join(t.TempDir(), "does-not-exist")
+		}},
+		{"empty file", func(t *testing.T) string {
+			path := filepath.Join(t.TempDir(), "uptime")
+			if err := os.WriteFile(path, nil, 0o644); err != nil {
+				t.Fatal(err)
+			}
+			return path
+		}},
+		{"unparseable", func(t *testing.T) string {
+			path := filepath.Join(t.TempDir(), "uptime")
+			if err := os.WriteFile(path, []byte("not-a-number 1.0\n"), 0o644); err != nil {
+				t.Fatal(err)
+			}
+			return path
+		}},
+		{"NaN", writeUptime("NaN 1.0\n")},
+		{"positive infinity", writeUptime("+Inf 1.0\n")},
+		{"negative infinity", writeUptime("-Inf 1.0\n")},
+		{"negative", writeUptime("-42.5 1.0\n")},
+		{"exceeds uint64 range", writeUptime("1e20 1.0\n")},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			uptimeFilePath = tt.prepare(t)
+
+			got, err := getUptime()
+			if err != nil {
+				t.Fatalf("getUptime() returned error: %v", err)
+			}
+			if got == 0 {
+				t.Error("getUptime() = 0, expected fallback to host.Uptime()")
+			}
+		})
+	}
+}

agent/uptime_stub.go

@@ -0,0 +1,10 @@
+//go:build !linux
+
+package agent
+
+import "github.com/shirou/gopsutil/v4/host"
+
+// getUptime returns the system uptime in seconds.
+func getUptime() (uint64, error) {
+	return host.Uptime()
+}

agent/zfs/zfs.go

@@ -0,0 +1,164 @@
+// Package zfs provides functions to read ZFS statistics.
+package zfs
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+	"time"
+)
+
+var commandTimeout = 10 * time.Second
+
+var commandOutput = func(name string, args ...string) ([]byte, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), commandTimeout)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, name, args...)
+	cmd.Env = append(os.Environ(), "LC_ALL=C", "LANG=C")
+	out, err := cmd.Output()
+	if ctx.Err() != nil {
+		return nil, fmt.Errorf("%s timed out after %s: %w", name, commandTimeout, ctx.Err())
+	}
+	return out, err
+}
+
+// ErrNoZfs is returned when the ZFS utilities or kernel interfaces are unavailable.
+var ErrNoZfs = errors.New("zfs utilities unavailable")
+
+// PoolStat is a snapshot of a ZFS pool's capacity and health.
+type PoolStat struct {
+	DisplayName string // optional friendly name; Name remains the stable key
+	MountID     string // Btrfs filesystem identity, empty for other backends
+	IODevice    string // sole Btrfs member device, if known
+	Raw         bool   // physical accounting rather than usable filesystem space
+	Name        string
+	Size        uint64 // total capacity in bytes
+	Alloc       uint64 // allocated bytes
+	Free        uint64 // free bytes
+	Health      string // ONLINE, DEGRADED, FAULTED, ...
+}
+
+// PoolKernelStat is the inexpensive pool telemetry exposed by the ZFS kernel.
+// NRead and NWrite are cumulative byte counters since the pool was imported.
+type PoolKernelStat struct {
+	Name   string
+	Health string
+	NRead  uint64
+	NWrite uint64
+}
+
+// PoolIoStats holds calculated per-second I/O rates for a pool.
+type PoolIoStats struct {
+	NRead  uint64
+	NWrite uint64
+}
+
+// Dataset is a single ZFS dataset with usage information.
+type Dataset struct {
+	Name       string
+	Used       uint64
+	Avail      uint64
+	Mountpoint string
+}
+
+// PoolStats returns capacity and health for all pools on the system using
+// `zpool list`. Frequent health and I/O sampling uses PoolKernelStats instead.
+func PoolStats() ([]PoolStat, error) {
+	out, err := commandOutput("zpool", "list", "-Hp", "-o", "name,size,alloc,free,health")
+	if err != nil {
+		var exitErr *exec.ExitError
+		if errors.As(err, &exitErr) && strings.Contains(string(exitErr.Stderr), "no pools available") {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("zpool list: %w", err)
+	}
+	return parseZpoolListOutput(out)
+}
+
+// Datasets returns all datasets on the system with usage and mountpoint
+// information using `zfs list` (recursive by default).
+func Datasets() ([]Dataset, error) {
+	out, err := commandOutput("zfs", "list", "-Hp", "-o", "name,used,avail,mountpoint")
+	if err != nil {
+		return nil, fmt.Errorf("zfs list: %w", err)
+	}
+	return parseZfsListOutput(out)
+}
+
+// parseZpoolListOutput parses `zpool list -Hp -o name,size,alloc,free,health` output.
+// Columns are tab-separated; numeric columns are raw bytes.
+func parseZpoolListOutput(out []byte) ([]PoolStat, error) {
+	var pools []PoolStat
+	scanner := bufio.NewScanner(bytes.NewReader(out))
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" {
+			continue
+		}
+		if line == "no pools available" && len(pools) == 0 {
+			return nil, nil
+		}
+		fields := strings.Split(line, "\t")
+		if len(fields) < 5 {
+			return nil, fmt.Errorf("unexpected zpool list line: %q", line)
+		}
+		size, err := strconv.ParseUint(fields[1], 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("parsing size for pool %q: %w", fields[0], err)
+		}
+		alloc, err := strconv.ParseUint(fields[2], 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("parsing alloc for pool %q: %w", fields[0], err)
+		}
+		free, err := strconv.ParseUint(fields[3], 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("parsing free for pool %q: %w", fields[0], err)
+		}
+		pools = append(pools, PoolStat{
+			Name:   fields[0],
+			Size:   size,
+			Alloc:  alloc,
+			Free:   free,
+			Health: fields[4],
+		})
+	}
+	return pools, scanner.Err()
+}
+
+// parseZfsListOutput parses `zfs list -Hp -o name,used,avail,mountpoint` output.
+// The mountpoint column may contain spaces, so it is split on tabs only.
+func parseZfsListOutput(out []byte) ([]Dataset, error) {
+	var datasets []Dataset
+	scanner := bufio.NewScanner(bytes.NewReader(out))
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" {
+			continue
+		}
+		fields := strings.SplitN(line, "\t", 4)
+		if len(fields) < 4 {
+			return nil, fmt.Errorf("unexpected zfs list line: %q", line)
+		}
+		used, err := strconv.ParseUint(fields[1], 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("parsing used for dataset %q: %w", fields[0], err)
+		}
+		avail, err := strconv.ParseUint(fields[2], 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("parsing avail for dataset %q: %w", fields[0], err)
+		}
+		datasets = append(datasets, Dataset{
+			Name:       fields[0],
+			Used:       used,
+			Avail:      avail,
+			Mountpoint: fields[3],
+		})
+	}
+	return datasets, scanner.Err()
+}

agent/zfs/zfs_freebsd.go

@@ -3,9 +3,17 @@
 package zfs
 
 import (
+	"errors"
+
 	"golang.org/x/sys/unix"
 )
 
 func ARCSize() (uint64, error) {
 	return unix.SysctlUint64("kstat.zfs.misc.arcstats.size")
 }
+
+// FreeBSD does not expose Linux's per-pool procfs kstats. Capacity, health,
+// and detail collection still work through the cached utilities.
+func PoolKernelStats() ([]PoolKernelStat, error) {
+	return nil, errors.ErrUnsupported
+}

agent/zfs/zfs_linux.go

@@ -5,14 +5,18 @@ package zfs
 
 import (
 	"bufio"
+	"errors"
 	"fmt"
 	"os"
+	"path/filepath"
 	"strconv"
 	"strings"
 )
 
+var procZfsPath = "/proc/spl/kstat/zfs"
+
 func ARCSize() (uint64, error) {
-	file, err := os.Open("/proc/spl/kstat/zfs/arcstats")
+	file, err := os.Open(filepath.Join(procZfsPath, "arcstats"))
 	if err != nil {
 		return 0, err
 	}
@@ -29,6 +33,167 @@ func ARCSize() (uint64, error) {
 			return strconv.ParseUint(fields[2], 10, 64)
 		}
 	}
+	if err := scanner.Err(); err != nil {
+		return 0, err
+	}
 
 	return 0, fmt.Errorf("size field not found in arcstats")
 }
+
+// PoolKernelStats reads pool state and cumulative I/O counters directly from
+// procfs. These kstats are the same interfaces used by node_exporter's Linux
+// ZFS collector and avoid keeping a `zpool iostat` subprocess alive.
+func PoolKernelStats() ([]PoolKernelStat, error) {
+	poolDirs := make(map[string]struct{})
+	for _, filename := range []string{"state", "io", "objset-*"} {
+		paths, err := filepath.Glob(filepath.Join(procZfsPath, "*", filename))
+		if err != nil {
+			return nil, err
+		}
+		for _, path := range paths {
+			poolDirs[filepath.Dir(path)] = struct{}{}
+		}
+	}
+	if len(poolDirs) == 0 {
+		return nil, ErrNoZfs
+	}
+	pools := make([]PoolKernelStat, 0, len(poolDirs))
+	for poolDir := range poolDirs {
+		nread, nwrite, err := readPoolCounters(poolDir)
+		if err != nil {
+			if errors.Is(err, os.ErrNotExist) {
+				continue // pool may have been exported after the glob
+			}
+			return nil, err
+		}
+		state, err := os.ReadFile(filepath.Join(poolDir, "state"))
+		if err != nil && !errors.Is(err, os.ErrNotExist) {
+			return nil, err
+		}
+		pools = append(pools, PoolKernelStat{
+			Name: filepath.Base(poolDir), Health: strings.ToUpper(strings.TrimSpace(string(state))),
+			NRead: nread, NWrite: nwrite,
+		})
+	}
+	if len(pools) == 0 {
+		return nil, ErrNoZfs
+	}
+	return pools, nil
+}
+
+// readPoolCounters supports both ZFS kernel interfaces. OpenZFS through 2.3
+// exposes aggregate vdev counters in "io". When that file is unavailable, sum
+// the logical I/O counters exposed for each dataset in the pool.
+func readPoolCounters(poolDir string) (uint64, uint64, error) {
+	nread, nwrite, err := readPoolIO(filepath.Join(poolDir, "io"))
+	if err == nil || !errors.Is(err, os.ErrNotExist) {
+		return nread, nwrite, err
+	}
+	return readPoolObjsets(poolDir)
+}
+
+func readPoolIO(path string) (uint64, uint64, error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return 0, 0, err
+	}
+	defer file.Close()
+
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		fields := strings.Fields(scanner.Text())
+		if len(fields) < 2 || fields[0] != "nread" {
+			continue
+		}
+		if !scanner.Scan() {
+			break
+		}
+		values := strings.Fields(scanner.Text())
+		if len(values) < 2 {
+			break
+		}
+		nread, err := strconv.ParseUint(values[0], 10, 64)
+		if err != nil {
+			return 0, 0, fmt.Errorf("parsing nread in %s: %w", path, err)
+		}
+		nwrite, err := strconv.ParseUint(values[1], 10, 64)
+		if err != nil {
+			return 0, 0, fmt.Errorf("parsing nwritten in %s: %w", path, err)
+		}
+		return nread, nwrite, nil
+	}
+	if err := scanner.Err(); err != nil {
+		return 0, 0, err
+	}
+	return 0, 0, fmt.Errorf("I/O counters not found in %s", path)
+}
+
+func readPoolObjsets(poolDir string) (uint64, uint64, error) {
+	paths, err := filepath.Glob(filepath.Join(poolDir, "objset-*"))
+	if err != nil {
+		return 0, 0, err
+	}
+	if len(paths) == 0 {
+		return 0, 0, fmt.Errorf("dataset I/O counters not found in %s", poolDir)
+	}
+
+	var totalRead, totalWrite uint64
+	objsetsRead := 0
+	for _, path := range paths {
+		nread, nwrite, err := readObjsetIO(path)
+		if errors.Is(err, os.ErrNotExist) {
+			continue // dataset may have been destroyed after the glob
+		}
+		if err != nil {
+			return 0, 0, err
+		}
+		totalRead += nread
+		totalWrite += nwrite
+		objsetsRead++
+	}
+	if objsetsRead == 0 {
+		return 0, 0, fmt.Errorf("dataset I/O counters not found in %s", poolDir)
+	}
+	return totalRead, totalWrite, nil
+}
+
+func readObjsetIO(path string) (uint64, uint64, error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return 0, 0, err
+	}
+	defer file.Close()
+
+	var nread, nwrite uint64
+	var foundRead, foundWrite bool
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		fields := strings.Fields(scanner.Text())
+		if len(fields) < 3 {
+			continue
+		}
+		var target *uint64
+		switch fields[0] {
+		case "nread":
+			target = &nread
+			foundRead = true
+		case "nwritten":
+			target = &nwrite
+			foundWrite = true
+		default:
+			continue
+		}
+		value, err := strconv.ParseUint(fields[2], 10, 64)
+		if err != nil {
+			return 0, 0, fmt.Errorf("parsing %s in %s: %w", fields[0], path, err)
+		}
+		*target = value
+	}
+	if err := scanner.Err(); err != nil {
+		return 0, 0, err
+	}
+	if !foundRead || !foundWrite {
+		return 0, 0, fmt.Errorf("incomplete I/O counters in %s", path)
+	}
+	return nread, nwrite, nil
+}

agent/zfs/zfs_linux_test.go

@@ -0,0 +1,90 @@
+//go:build testing && linux
+
+package zfs
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPoolKernelStats(t *testing.T) {
+	root := t.TempDir()
+	oldPath := procZfsPath
+	procZfsPath = root
+	t.Cleanup(func() { procZfsPath = oldPath })
+
+	poolDir := filepath.Join(root, "tank")
+	require.NoError(t, os.MkdirAll(poolDir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(poolDir, "io"), []byte(
+		"11 3 0x00 1 80 0 0\n"+
+			"nread nwritten reads writes wtime wlentime wupdate rtime rlentime rupdate wcnt rcnt\n"+
+			"1884160 6450688 22 978 0 0 0 0 0 0 0 0\n",
+	), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(poolDir, "state"), []byte("DEGRADED\n"), 0o644))
+
+	stats, err := PoolKernelStats()
+	require.NoError(t, err)
+	require.Len(t, stats, 1)
+	assert.Equal(t, PoolKernelStat{
+		Name: "tank", Health: "DEGRADED", NRead: 1884160, NWrite: 6450688,
+	}, stats[0])
+}
+
+func TestPoolKernelStatsOpenZfs24(t *testing.T) {
+	root := t.TempDir()
+	oldPath := procZfsPath
+	procZfsPath = root
+	t.Cleanup(func() { procZfsPath = oldPath })
+
+	poolDir := filepath.Join(root, "tank")
+	require.NoError(t, os.MkdirAll(poolDir, 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(poolDir, "state"), []byte("ONLINE\n"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(poolDir, "objset-0x1"), []byte(
+		"34 1 0x01 28 7872 0 0\n"+
+			"name type data\n"+
+			"dataset_name 7 tank\n"+
+			"nwritten 4 2000\n"+
+			"nread 4 1000\n",
+	), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(poolDir, "objset-0x2"), []byte(
+		"34 1 0x01 28 7872 0 0\n"+
+			"name type data\n"+
+			"dataset_name 7 tank/videos\n"+
+			"nwritten 4 400\n"+
+			"nread 4 300\n",
+	), 0o644))
+
+	stats, err := PoolKernelStats()
+	require.NoError(t, err)
+	require.Len(t, stats, 1)
+	assert.Equal(t, PoolKernelStat{
+		Name: "tank", Health: "ONLINE", NRead: 1300, NWrite: 2400,
+	}, stats[0])
+}
+
+func TestPoolKernelStatsNoZfs(t *testing.T) {
+	oldPath := procZfsPath
+	procZfsPath = t.TempDir()
+	t.Cleanup(func() { procZfsPath = oldPath })
+
+	_, err := PoolKernelStats()
+	assert.ErrorIs(t, err, ErrNoZfs)
+}
+
+func TestReadPoolIORejectsMalformedCounters(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "io")
+	require.NoError(t, os.WriteFile(path, []byte("nread nwritten\nnope 10\n"), 0o644))
+	_, _, err := readPoolIO(path)
+	require.Error(t, err)
+}
+
+func TestReadObjsetIORequiresAllCounters(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "objset-0x1")
+	require.NoError(t, os.WriteFile(path, []byte("nread 4 10\n"), 0o644))
+	_, _, err := readObjsetIO(path)
+	require.Error(t, err)
+}

agent/zfs/zfs_status.go

@@ -0,0 +1,150 @@
+package zfs
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+// PoolStatus holds parsed `zpool status` information for one pool.
+type PoolStatus struct {
+	Name  string
+	State string // ONLINE, DEGRADED, FAULTED, ...
+	Scrub ScrubStatus
+	Vdevs []VdevStatus
+}
+
+// ScrubStatus holds the scrub (or resilver) status parsed from the scan line.
+type ScrubStatus struct {
+	State    string // NONE, SCANNING, FINISHED, CANCELED
+	Progress string // e.g. "10.00%" while scanning
+	Errors   uint64
+}
+
+// VdevStatus is a single vdev row (mirror, raidz, or leaf disk).
+type VdevStatus struct {
+	Name         string
+	State        string
+	ReadErrs     uint64
+	WriteErrs    uint64
+	ChecksumErrs uint64
+}
+
+var (
+	progressRe = regexp.MustCompile(`(\d+\.\d+)%\s+done`)
+	errorsRe   = regexp.MustCompile(`with\s+(\d+)\s+errors`)
+)
+
+// PoolStatuses runs `zpool status` and parses per-pool state, scrub, and vdev
+// information. The human-readable format has been stable across OpenZFS
+// releases; rows are matched by their tabular shape rather than position.
+func PoolStatuses() ([]PoolStatus, error) {
+	out, err := commandOutput("zpool", "status")
+	if err != nil {
+		return nil, fmt.Errorf("zpool status: %w", err)
+	}
+	return parseZpoolStatusOutput(out)
+}
+
+// parseZpoolStatusOutput parses the output of `zpool status`.
+func parseZpoolStatusOutput(out []byte) ([]PoolStatus, error) {
+	var pools []PoolStatus
+	var current *PoolStatus
+	inConfig := false
+	scanContinuation := false // next non-blank line continues the scan line (progress)
+
+	scanner := bufio.NewScanner(bytes.NewReader(out))
+	for scanner.Scan() {
+		line := scanner.Text()
+		trimmed := strings.TrimSpace(line)
+
+		switch {
+		case strings.HasPrefix(trimmed, "pool:"):
+			pools = append(pools, PoolStatus{Name: strings.TrimSpace(strings.TrimPrefix(trimmed, "pool:"))})
+			current = &pools[len(pools)-1]
+			inConfig = false
+			scanContinuation = false
+		case current == nil:
+			continue
+		case strings.HasPrefix(trimmed, "state:"):
+			current.State = strings.TrimSpace(strings.TrimPrefix(trimmed, "state:"))
+		case strings.HasPrefix(trimmed, "scan:"):
+			current.Scrub = parseScanLine(trimmed)
+			// zpool status prints the progress percentage on the line after scan.
+			scanContinuation = true
+		case trimmed == "config:":
+			inConfig = true
+		case scanContinuation:
+			// The line after scan: may be an indented progress continuation.
+			if m := progressRe.FindStringSubmatch(trimmed); m != nil {
+				current.Scrub.Progress = m[1] + "%"
+			}
+			scanContinuation = false
+		case inConfig && (line == "" || strings.HasPrefix(line, " ") || strings.HasPrefix(line, "\t")):
+			// Table rows are indented; blank lines separate sections. The
+			// column header and the pool's own row are skipped.
+			if trimmed != "" && !strings.HasPrefix(trimmed, "NAME") {
+				if vdev, ok := parseVdevLine(trimmed, current.Name); ok {
+					current.Vdevs = append(current.Vdevs, vdev)
+				}
+			}
+		case inConfig:
+			// unindented line (errors:, status:, next pool:) ends the table
+			inConfig = false
+		}
+	}
+	return pools, scanner.Err()
+}
+
+// parseScanLine maps a `scan:` line to a ScrubStatus.
+func parseScanLine(line string) ScrubStatus {
+	var scrub ScrubStatus
+	switch {
+	case strings.Contains(line, "in progress"):
+		scrub.State = "SCANNING"
+	case strings.Contains(line, "canceled"):
+		scrub.State = "CANCELED"
+	case strings.Contains(line, "repaired"), strings.Contains(line, "resilvered"):
+		scrub.State = "FINISHED"
+	default:
+		scrub.State = "NONE"
+	}
+	if m := progressRe.FindStringSubmatch(line); m != nil {
+		scrub.Progress = m[1] + "%"
+	}
+	if m := errorsRe.FindStringSubmatch(line); m != nil {
+		if n, err := strconv.ParseUint(m[1], 10, 64); err == nil {
+			scrub.Errors = n
+		}
+	}
+	return scrub
+}
+
+// parseVdevLine parses one row of the config table. Rows have the shape
+// "NAME STATE READ WRITE CKSUM [extra...]". The first data row is the pool
+// itself and is skipped since it duplicates pool-level info.
+func parseVdevLine(line, poolName string) (VdevStatus, bool) {
+	fields := strings.Fields(line)
+	if len(fields) < 5 {
+		return VdevStatus{}, false
+	}
+	if fields[0] == poolName {
+		return VdevStatus{}, false
+	}
+	read, err1 := strconv.ParseUint(fields[2], 10, 64)
+	write, err2 := strconv.ParseUint(fields[3], 10, 64)
+	cksum, err3 := strconv.ParseUint(fields[4], 10, 64)
+	if err1 != nil || err2 != nil || err3 != nil {
+		return VdevStatus{}, false
+	}
+	return VdevStatus{
+		Name:         fields[0],
+		State:        fields[1],
+		ReadErrs:     read,
+		WriteErrs:    write,
+		ChecksumErrs: cksum,
+	}, true
+}

agent/zfs/zfs_test.go

@@ -0,0 +1,143 @@
+//go:build testing
+
+package zfs
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func fixturePath(name string) string {
+	return filepath.Join("..", "test-data", "zfs", name)
+}
+
+func TestParseZpoolListOutput(t *testing.T) {
+	data, err := os.ReadFile(fixturePath("zpool_list.txt"))
+	require.NoError(t, err)
+
+	pools, err := parseZpoolListOutput(data)
+	require.NoError(t, err)
+	require.Len(t, pools, 2)
+
+	assert.Equal(t, PoolStat{Name: "tank", Size: 23999000000000, Alloc: 12000000000000, Free: 11999000000000, Health: "ONLINE"}, pools[0])
+	assert.Equal(t, PoolStat{Name: "rpool", Size: 1200000000000, Alloc: 900000000000, Free: 300000000000, Health: "DEGRADED"}, pools[1])
+}
+
+func TestParseZpoolListOutputIgnoresEmptyLines(t *testing.T) {
+	pools, err := parseZpoolListOutput([]byte("tank\t100\t50\t50\tONLINE\n\n"))
+	require.NoError(t, err)
+	require.Len(t, pools, 1)
+	assert.Equal(t, "tank", pools[0].Name)
+}
+
+func TestParseZpoolListOutputNoPools(t *testing.T) {
+	pools, err := parseZpoolListOutput([]byte("no pools available\n"))
+	require.NoError(t, err)
+	assert.Empty(t, pools)
+}
+
+func TestParseZpoolListOutputRejectsMalformedLine(t *testing.T) {
+	_, err := parseZpoolListOutput([]byte("tank\t100\t50\n"))
+	require.Error(t, err)
+
+	_, err = parseZpoolListOutput([]byte("tank\tnotanumber\t50\t50\tONLINE\n"))
+	require.Error(t, err)
+}
+
+func TestParseZfsListOutput(t *testing.T) {
+	data, err := os.ReadFile(fixturePath("zfs_list.txt"))
+	require.NoError(t, err)
+
+	datasets, err := parseZfsListOutput(data)
+	require.NoError(t, err)
+	require.Len(t, datasets, 9)
+
+	// Mountpoint with a space must be kept intact (tab-split only).
+	assert.Equal(t, "/tank/my media", datasets[3].Mountpoint)
+	// Unmounted datasets/zvols report "-".
+	assert.Equal(t, "-", datasets[4].Mountpoint)
+	assert.Equal(t, uint64(12000000000000), datasets[0].Used)
+	assert.Equal(t, uint64(11999000000000), datasets[0].Avail)
+}
+
+func TestParseZpoolStatusOutput(t *testing.T) {
+	data, err := os.ReadFile(fixturePath("zpool_status.txt"))
+	require.NoError(t, err)
+
+	pools, err := parseZpoolStatusOutput(data)
+	require.NoError(t, err)
+	require.Len(t, pools, 2)
+
+	tank := pools[0]
+	assert.Equal(t, "tank", tank.Name)
+	assert.Equal(t, "ONLINE", tank.State)
+	assert.Equal(t, "FINISHED", tank.Scrub.State)
+	assert.Equal(t, "", tank.Scrub.Progress)
+	assert.Equal(t, uint64(0), tank.Scrub.Errors)
+	// Pool row itself is skipped; mirror + 2 disks remain.
+	require.Len(t, tank.Vdevs, 3)
+	assert.Equal(t, "mirror-0", tank.Vdevs[0].Name)
+	assert.Equal(t, "sda", tank.Vdevs[1].Name)
+	assert.Equal(t, "sdb", tank.Vdevs[2].Name)
+
+	rpool := pools[1]
+	assert.Equal(t, "rpool", rpool.Name)
+	assert.Equal(t, "DEGRADED", rpool.State)
+	assert.Equal(t, "SCANNING", rpool.Scrub.State)
+	assert.Equal(t, "10.00%", rpool.Scrub.Progress)
+	require.Len(t, rpool.Vdevs, 3)
+	assert.Equal(t, "FAULTED", rpool.Vdevs[2].State)
+	assert.Equal(t, uint64(1), rpool.Vdevs[2].ReadErrs)
+	assert.Equal(t, uint64(2), rpool.Vdevs[2].WriteErrs)
+	assert.Equal(t, uint64(3), rpool.Vdevs[2].ChecksumErrs)
+}
+
+func TestParseScanLine(t *testing.T) {
+	assert.Equal(t, "FINISHED", parseScanLine("scan: scrub repaired 0B in 00:05:12 with 0 errors on Sun Jun  1 02:00:12 2025").State)
+	assert.Equal(t, uint64(3), parseScanLine("scan: scrub repaired 10G in 01:00:00 with 3 errors on Sun Jun  1 02:00:12 2025").Errors)
+	assert.Equal(t, "SCANNING", parseScanLine("scan: scrub in progress since Sun Jun  8 01:00:00 2025").State)
+	assert.Equal(t, "CANCELED", parseScanLine("scan: scrub canceled on Sun Jun  1 02:00:12 2025").State)
+	assert.Equal(t, "FINISHED", parseScanLine("scan: resilvered 1.23G in 00:01:00 with 0 errors on Sun Jun  1 02:00:12 2025").State)
+	assert.Equal(t, "NONE", parseScanLine("scan: none requested").State)
+}
+
+func TestCommandOutputForcesLocaleAndTimesOut(t *testing.T) {
+	t.Setenv("BESZEL_ZFS_COMMAND_HELPER", "1")
+	out, err := commandOutput(os.Args[0], "-test.run=TestZfsCommandHelperProcess", "--", "locale")
+	require.NoError(t, err)
+	assert.Equal(t, "C/C", string(out))
+
+	oldTimeout := commandTimeout
+	commandTimeout = 20 * time.Millisecond
+	t.Cleanup(func() { commandTimeout = oldTimeout })
+	_, err = commandOutput(os.Args[0], "-test.run=TestZfsCommandHelperProcess", "--", "sleep")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "timed out")
+}
+
+func TestZfsCommandHelperProcess(t *testing.T) {
+	if os.Getenv("BESZEL_ZFS_COMMAND_HELPER") != "1" {
+		return
+	}
+	mode := ""
+	for i, arg := range os.Args {
+		if arg == "--" && i+1 < len(os.Args) {
+			mode = os.Args[i+1]
+			break
+		}
+	}
+	switch strings.TrimSpace(mode) {
+	case "locale":
+		_, _ = fmt.Printf("%s/%s", os.Getenv("LC_ALL"), os.Getenv("LANG"))
+	case "sleep":
+		time.Sleep(time.Second)
+	}
+	os.Exit(0)
+}

agent/zfs/zfs_unsupported.go

@@ -7,3 +7,7 @@ import "errors"
 func ARCSize() (uint64, error) {
 	return 0, errors.ErrUnsupported
 }
+
+func PoolKernelStats() ([]PoolKernelStat, error) {
+	return nil, errors.ErrUnsupported
+}

beszel.go

@@ -6,7 +6,7 @@ import "github.com/blang/semver"
 
 const (
 	// Version is the current version of the application.
-	Version = "0.18.7"
+	Version = "0.19.0"
 	// AppName is the name of the application.
 	AppName = "beszel"
 )
@@ -16,3 +16,6 @@ var MinVersionCbor = semver.MustParse("0.12.0")
 
 // MinVersionAgentResponse is the minimum supported version for AgentResponse compatibility.
 var MinVersionAgentResponse = semver.MustParse("0.13.0")
+
+// MinVersionZfsData is the minimum agent version that supports ZFS detail requests.
+var MinVersionZfsData = semver.MustParse("0.18.9")

go.mod

@@ -1,26 +1,27 @@
 module github.com/henrygd/beszel
 
-go 1.26.1
+go 1.27.1
 
 require (
 	github.com/blang/semver v3.5.1+incompatible
 	github.com/coreos/go-systemd/v22 v22.7.0
-	github.com/ebitengine/purego v0.10.0
-	github.com/fxamacker/cbor/v2 v2.9.0
+	github.com/ebitengine/purego v0.11.0
+	github.com/fxamacker/cbor/v2 v2.9.3
 	github.com/gliderlabs/ssh v0.3.8
 	github.com/google/uuid v1.6.0
-	github.com/lxzan/gws v1.9.1
-	github.com/nicholas-fedor/shoutrrr v0.14.3
+	github.com/lxzan/gws v1.10.1
+	github.com/nicholas-fedor/shoutrrr v0.20.0
 	github.com/pocketbase/dbx v1.12.0
-	github.com/pocketbase/pocketbase v0.36.8
-	github.com/shirou/gopsutil/v4 v4.26.3
+	github.com/pocketbase/pocketbase v0.40.2
+	github.com/shirou/gopsutil/v4 v4.26.8
 	github.com/spf13/cast v1.10.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
-	github.com/stretchr/testify v1.11.1
-	golang.org/x/crypto v0.49.0
-	golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90
-	golang.org/x/sys v0.42.0
+	github.com/stretchr/testify v1.12.1
+	golang.org/x/crypto v0.56.0
+	golang.org/x/exp v0.0.0-20260824195058-e88cd73687aa
+	golang.org/x/net v0.58.0
+	golang.org/x/sys v0.47.0
 	gopkg.in/yaml.v3 v3.0.1
 	howett.net/plist v1.0.1
 )
@@ -28,41 +29,40 @@ require (
 require (
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/disintegration/imaging v1.6.2 // indirect
 	github.com/domodwyer/mailyak/v3 v3.6.2 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/eclipse/paho.golang v0.23.0 // indirect
 	github.com/fatih/color v1.19.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
-	github.com/ganigeorgiev/fexpr v0.5.0 // indirect
+	github.com/fsnotify/fsnotify v1.10.1 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.15 // indirect
+	github.com/ganigeorgiev/fexpr v0.6.0 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
-	github.com/go-ozzo/ozzo-validation/v4 v4.3.0 // indirect
 	github.com/go-sql-driver/mysql v1.9.1 // indirect
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/klauspost/compress v1.18.5 // indirect
-	github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749 // indirect
-	github.com/mattn/go-colorable v0.1.14 // indirect
-	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/klauspost/compress v1.20.0 // indirect
+	github.com/lufia/plan9stats v0.0.0-20260802145828-341c2f0c90b5 // indirect
+	github.com/mattn/go-colorable v0.1.15 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
+	github.com/pocketbase/ozzo-validation/v4 v4.3.0 // indirect
+	github.com/power-devops/perfstat v0.0.0-20260805114148-88456608a4f6 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/tklauser/go-sysconf v0.3.16 // indirect
-	github.com/tklauser/numcpus v0.11.0 // indirect
+	github.com/tklauser/go-sysconf v0.4.0 // indirect
+	github.com/tklauser/numcpus v0.12.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	golang.org/x/image v0.38.0 // indirect
-	golang.org/x/net v0.52.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/image v0.45.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/term v0.41.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
-	modernc.org/libc v1.70.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.41.0 // indirect
+	modernc.org/libc v1.74.4 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.11.0 // indirect
-	modernc.org/sqlite v1.48.0 // indirect
+	modernc.org/memory v1.12.1 // indirect
+	modernc.org/sqlite v1.57.0 // indirect
 )

go.sum

@@ -1,7 +1,7 @@
 filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
-github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
-github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
+github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/asaskevich/govalidator v0.0.0-20200108200545-475eaeb16496/go.mod h1:oGkLhpf+kjZl6xBf758TQhh5XrAeiJv/7FRz/2spLIg=
@@ -13,37 +13,35 @@ github.com/coreos/go-systemd/v22 v22.7.0 h1:LAEzFkke61DFROc7zNLX/WA2i5J8gYqe0rSj
 github.com/coreos/go-systemd/v22 v22.7.0/go.mod h1:xNUYtjHu2EDXbsxz1i41wouACIwT7Ybq9o0BQhMwD0w=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/disintegration/imaging v1.6.2 h1:w1LecBlG2Lnp8B3jk5zSuNqd7b4DXhcjwek1ei82L+c=
 github.com/disintegration/imaging v1.6.2/go.mod h1:44/5580QXChDfwIclfc/PCwrr44amcmDAg8hxG0Ewe4=
 github.com/domodwyer/mailyak/v3 v3.6.2 h1:x3tGMsyFhTCaxp6ycgR0FE/bu5QiNp+hetUuCOBXMn8=
 github.com/domodwyer/mailyak/v3 v3.6.2/go.mod h1:lOm/u9CyCVWHeaAmHIdF4RiKVxKUT/H5XX10lIKAL6c=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/ebitengine/purego v0.10.0 h1:QIw4xfpWT6GWTzaW5XEKy3HXoqrJGx1ijYHzTF0/ISU=
-github.com/ebitengine/purego v0.10.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/ebitengine/purego v0.11.0 h1:jhp/D+Nyv7UUW8HAcmcjt2N2rYrYi9m3SL21k0Ua/NI=
+github.com/ebitengine/purego v0.11.0/go.mod h1:DCHPP08djqhNSoTfImcnHYQRZmd0qhakvrozqaEYhGQ=
 github.com/eclipse/paho.golang v0.23.0 h1:KHgl2wz6EJo7cMBmkuhpt7C576vP+kpPv7jjvSyR6Mk=
 github.com/eclipse/paho.golang v0.23.0/go.mod h1:nQRhTkoZv8EAiNs5UU0/WdQIx2NrnWUpL9nsGJTQN04=
 github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
 github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
-github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
-github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
-github.com/ganigeorgiev/fexpr v0.5.0 h1:XA9JxtTE/Xm+g/JFI6RfZEHSiQlk+1glLvRK1Lpv/Tk=
-github.com/ganigeorgiev/fexpr v0.5.0/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
+github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
+github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
+github.com/fxamacker/cbor/v2 v2.9.3 h1:oQBnFATpNdY8gJHTndDDv5Xl4QqNaz51G5LLEPhng3Q=
+github.com/fxamacker/cbor/v2 v2.9.3/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/gabriel-vasile/mimetype v1.4.15 h1:05iP/CYtZ/w455R/KZM6rZ5ieAdh99UPtd+d3YzLmaI=
+github.com/gabriel-vasile/mimetype v1.4.15/go.mod h1:azpTcoLcDZRNgFou5j+APrqQx9HqVPWa6ijYQIIVswQ=
+github.com/ganigeorgiev/fexpr v0.6.0 h1:Fza3O/QMBKEudUvxV862qe6GjxM60GJjjKytdp+VQus=
+github.com/ganigeorgiev/fexpr v0.6.0/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
 github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
-github.com/go-ozzo/ozzo-validation/v4 v4.3.0 h1:byhDUpfEwjsVQb1vBunvIjh2BHQ9ead57VkAEY4V+Es=
-github.com/go-ozzo/ozzo-validation/v4 v4.3.0/go.mod h1:2NKgrcHl3z6cJs+3Oo940FPRiTzuqKbvfrL2RxCj6Ew=
 github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.9.1 h1:FrjNGn/BsJQjVRuSa8CBrM5BWA9BWoXXat3KrtSb/iI=
 github.com/go-sql-driver/mysql v1.9.1/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
@@ -56,8 +54,8 @@ github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArs
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc h1:VBbFa1lDYWEeV5FZKUiYKYT0VxCp9twUmmaq9eb8sXw=
-github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/pprof v0.0.0-20260906184651-6331bc6350fe h1:QAinXoAFJdGQYztXn3VpFey7KCwpedbZ/EkzbplQ0cY=
+github.com/google/pprof v0.0.0-20260906184651-6331bc6350fe/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
@@ -66,47 +64,47 @@ github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/jarcoal/httpmock v1.4.1 h1:0Ju+VCFuARfFlhVXFc2HxlcQkfB+Xq12/EotHko+x2A=
-github.com/jarcoal/httpmock v1.4.1/go.mod h1:ftW1xULwo+j0R0JJkJIIi7UKigZUXCLLanykgjwBXL0=
+github.com/jarcoal/httpmock v1.4.2 h1:dKwiP/9zITCPfBLsDn3kchbSOu16JrnxtVEmL0fPRcI=
+github.com/jarcoal/httpmock v1.4.2/go.mod h1:ftW1xULwo+j0R0JJkJIIi7UKigZUXCLLanykgjwBXL0=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
-github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
-github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.20.0 h1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=
+github.com/klauspost/compress v1.20.0/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749 h1:Qj3hTcdWH8uMZDI41HNuTuJN525C7NBrbtH5kSO6fPk=
-github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
-github.com/lxzan/gws v1.9.1 h1:4lbIp4cW0hOLP3ejFHR/uWRy741AURx7oKkNNi2OT9o=
-github.com/lxzan/gws v1.9.1/go.mod h1:gXHSCPmTGryWJ4icuqy8Yho32E4YIMHH0fkDRYJRbdc=
-github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
-github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/lufia/plan9stats v0.0.0-20260802145828-341c2f0c90b5 h1:eveIIGn4BGM3qknO74omf6HYr30/exH+eVUTuAgwjZ0=
+github.com/lufia/plan9stats v0.0.0-20260802145828-341c2f0c90b5/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
+github.com/lxzan/gws v1.10.1 h1:1xG+tDOV0lgDeVPf0wNT74u3cn0K3LpcavRrTPTrMwQ=
+github.com/lxzan/gws v1.10.1/go.mod h1:gXHSCPmTGryWJ4icuqy8Yho32E4YIMHH0fkDRYJRbdc=
+github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=
+github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/nicholas-fedor/shoutrrr v0.14.3 h1:aBX2iw9a7jl5wfHd3bi9LnS5ucoYIy6KcLH9XVF+gig=
-github.com/nicholas-fedor/shoutrrr v0.14.3/go.mod h1:U7IywBkLpBV7rgn8iLbQ9/LklJG1gm24bFv5cXXsDKs=
-github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
-github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
-github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
-github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
+github.com/nicholas-fedor/shoutrrr v0.20.0 h1:hMAxIYlfAeZ1FcTDgU0kUOvVXUsOirWo8IWlnzGLkac=
+github.com/nicholas-fedor/shoutrrr v0.20.0/go.mod h1:hgde37yNWCXh8+N6WemyDRMNYLOFTf326GsBx8Z7CFA=
+github.com/onsi/ginkgo/v2 v2.32.1 h1:6tlvcDm/3sE8lGJbZ4+d4mO3RLy24/tQWOFzVSQNIfw=
+github.com/onsi/ginkgo/v2 v2.32.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
+github.com/onsi/gomega v1.43.0 h1:VlG/1FxqNxhSO+lq/OHBNaaqwiBK/mO8JbVkX9Y+FeU=
+github.com/onsi/gomega v1.43.0/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pocketbase/dbx v1.12.0 h1:/oLErM+A0b4xI0PWTGPqSDVjzix48PqI/bng2l0PzoA=
 github.com/pocketbase/dbx v1.12.0/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
-github.com/pocketbase/pocketbase v0.36.8 h1:gCNqoesZ44saYOD3J7edhi5nDwUWKyQG7boM/kVwz2c=
-github.com/pocketbase/pocketbase v0.36.8/go.mod h1:OY4WaXbP0WnF/EXoBbboWJK+ZSZ1A85tiA0sjrTKxTA=
-github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
-github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
+github.com/pocketbase/ozzo-validation/v4 v4.3.0 h1:uKBDVma7bZqgR2a6AwE+k9hkuDFfiZMpBHQdZ1z3iQs=
+github.com/pocketbase/ozzo-validation/v4 v4.3.0/go.mod h1:6XNjSTw/Jb2F8LOkKO3oyzIWExbrGiYoS4uVxVwz90g=
+github.com/pocketbase/pocketbase v0.40.2 h1:7gTqvt3bmilkphyZZ1QNhX19g3BXHqT7ynDyU81RVT4=
+github.com/pocketbase/pocketbase v0.40.2/go.mod h1:jc3YuyToy+ZXM4CeO7uSCN/htgR8yv+tjSE3eJZ8eh8=
+github.com/power-devops/perfstat v0.0.0-20260805114148-88456608a4f6 h1:jL3a8soXdzuTCcRnKhOmtcsVOObdDTFf4O2B403HPRU=
+github.com/power-devops/perfstat v0.0.0-20260805114148-88456608a4f6/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/shirou/gopsutil/v4 v4.26.3 h1:2ESdQt90yU3oXF/CdOlRCJxrP+Am1aBYubTMTfxJ1qc=
-github.com/shirou/gopsutil/v4 v4.26.3/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
+github.com/shirou/gopsutil/v4 v4.26.8 h1:YQMTF/1J50B5+Y0vlo1eDRf5DoR7Gk69hY+8wjYkQeo=
+github.com/shirou/gopsutil/v4 v4.26.8/go.mod h1:5O9FjBiXoTDFatIWjZZosqj4pV0DRtLx598xGbBehzM=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
 github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
@@ -118,87 +116,86 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
 github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
-github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
-github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=
-github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/tklauser/go-sysconf v0.4.0 h1:7H0uAN+7RkwWRaxhYXDLqa5V3LPrJeV8wmD9dRUgPQU=
+github.com/tklauser/go-sysconf v0.4.0/go.mod h1:8mTNWyog7H+MpKijp4VmKJAd2bbYQ2zuUwkYRbUArPI=
+github.com/tklauser/numcpus v0.12.0 h1:NR85qdvHA9pFse3x3weVZ0r0ST8R6l5RHbZrlRaqob4=
+github.com/tklauser/numcpus v0.12.0/go.mod h1:ABHeXzJnr/qqwguhClkZKT1/8VABcYrsyUiUGobwWJg=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
-golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
-golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 h1:jiDhWWeC7jfWqR9c/uplMOqJ0sbNlNWv0UkzE0vX1MA=
-golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90/go.mod h1:xE1HEv6b+1SCZ5/uscMRjUBKtIxworgEcEi+/n9NQDQ=
+golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
+golang.org/x/exp v0.0.0-20260824195058-e88cd73687aa h1:QSyA8ishJCyT21kER9KwNt0b7BM3iRK4x9QXhjN5Fdk=
+golang.org/x/exp v0.0.0-20260824195058-e88cd73687aa/go.mod h1:zeBbvyFKDaLwa7CH/zI8KXt7gTl14SF7sO08Pl5jBCM=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.38.0 h1:5l+q+Y9JDC7mBOMjo4/aPhMDcxEptsX+Tt3GgRQRPuE=
-golang.org/x/image v0.38.0/go.mod h1:/3f6vaXC+6CEanU4KJxbcUZyEePbyKbaLoDOe4ehFYY=
-golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
-golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/image v0.45.0 h1:FMb1nTbH5H9vF55SriQHgFw5GnNL9Jg6L25BwXKzhB0=
+golang.org/x/image v0.45.0/go.mod h1:n62x/7RqlwXDvGsSU4u6IUTUf6KghUZ9Bt7cG/T9Fx4=
+golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
+golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
 howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
-modernc.org/cc/v4 v4.27.1 h1:9W30zRlYrefrDV2JE2O8VDtJ1yPGownxciz5rrbQZis=
-modernc.org/cc/v4 v4.27.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
-modernc.org/ccgo/v4 v4.32.0 h1:hjG66bI/kqIPX1b2yT6fr/jt+QedtP2fqojG2VrFuVw=
-modernc.org/ccgo/v4 v4.32.0/go.mod h1:6F08EBCx5uQc38kMGl+0Nm0oWczoo1c7cgpzEry7Uc0=
+modernc.org/cc/v4 v4.29.1 h1:MKgdCV3WykTSPqpVrnxdEDS0HEd2FHpKZDzxzU5LyeI=
+modernc.org/cc/v4 v4.29.1/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.34.6 h1:sBgfIwyN0TQ9C5hwIeuqyeAKyMWnbvj2fvpF4L11uzU=
+modernc.org/ccgo/v4 v4.34.6/go.mod h1:SZ8YcN9NG7XVsQYdm6jYBvi8PQP1qi+kqB6OhjqI3Fk=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
-modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.4 h1:2g65LGVSmFQrXeITAw97x7hCRvZFcyE1uDP+7Vng7JI=
+modernc.org/gc/v3 v3.1.4/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.70.0 h1:U58NawXqXbgpZ/dcdS9kMshu08aiA6b7gusEusqzNkw=
-modernc.org/libc v1.70.0/go.mod h1:OVmxFGP1CI/Z4L3E0Q3Mf1PDE0BucwMkcXjjLntvHJo=
+modernc.org/libc v1.74.4 h1:fX1Omw4o2/1C2iRkkIsrQTasJQldLhRmuPreXLoWs9k=
+modernc.org/libc v1.74.4/go.mod h1:eeQAS9W3sZeKYMFubydxJpII9ybHWshk+7or7bLG9co=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
-modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
-modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
-modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/memory v1.12.1 h1:nFMiWrpStgZczNl6XI9GnIk/rWhYIyHGUaR04pGbp9g=
+modernc.org/memory v1.12.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
+modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.48.0 h1:ElZyLop3Q2mHYk5IFPPXADejZrlHu7APbpB0sF78bq4=
-modernc.org/sqlite v1.48.0/go.mod h1:hWjRO6Tj/5Ik8ieqxQybiEOUXy0NJFNp2tpvVpKlvig=
+modernc.org/sqlite v1.57.0 h1:qNQP6xnx5M0ISNtlnxoOX0+cD5bJ0/gr9aMmndFczzg=
+modernc.org/sqlite v1.57.0/go.mod h1:yCJ2cmAaIkHQ25oXWrF8H4O1lIfPYPR26yCEDj2P3pQ=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

internal/alerts/alerts.go

@@ -48,6 +48,7 @@ type SystemAlertFsStats struct {
 // Values pulled from system_stats.stats that are relevant to alerts.
 type SystemAlertStats struct {
 	Cpu          float64                       `json:"cpu"`
+	CpuBreakdown []float64                     `json:"cpub"`
 	Mem          float64                       `json:"mp"`
 	Disk         float64                       `json:"dp"`
 	Bandwidth    [2]uint64                     `json:"b"`
@@ -55,13 +56,21 @@ type SystemAlertStats struct {
 	Temperatures map[string]float32            `json:"t"`
 	LoadAvg      [3]float64                    `json:"la"`
 	Battery      [2]uint8                      `json:"bat"`
+	Batteries    map[string]uint8              `json:"bats"`
 	ExtraFs      map[string]SystemAlertFsStats `json:"efs"`
+	ZfsPools     map[string]SystemAlertZfsPool `json:"z"`
 }
 
 type SystemAlertGPUData struct {
 	Usage float64 `json:"u"`
 }
 
+type SystemAlertZfsPool struct {
+	Raw   bool    `json:"raw,omitempty"`
+	Total float64 `json:"d"`
+	Used  float64 `json:"du"`
+}
+
 type SystemAlertData struct {
 	systemRecord *core.Record
 	alertData    CachedAlertData
@@ -110,6 +119,9 @@ func (am *AlertManager) bindEvents() {
 	am.hub.OnRecordAfterUpdateSuccess("alerts").BindFunc(updateHistoryOnAlertUpdate)
 	am.hub.OnRecordAfterDeleteSuccess("alerts").BindFunc(resolveHistoryOnAlertDelete)
 	am.hub.OnRecordAfterUpdateSuccess("smart_devices").BindFunc(am.handleSmartDeviceAlert)
+	am.hub.OnRecordAfterCreateSuccess("zfs_pools").BindFunc(am.handleZfsPoolCreateAlert)
+	am.hub.OnRecordAfterUpdateSuccess("zfs_pools").BindFunc(am.handleZfsPoolAlert)
+	am.hub.OnRecordAfterDeleteSuccess("zfs_pools").BindFunc(resolveZfsPoolHistoryOnDelete)
 
 	am.hub.OnServe().BindFunc(func(e *core.ServeEvent) error {
 		// Populate all alerts into cache on startup
@@ -118,6 +130,9 @@ func (am *AlertManager) bindEvents() {
 		if err := resolveStatusAlerts(e.App); err != nil {
 			e.App.Logger().Error("Failed to resolve stale status alerts", "err", err)
 		}
+		if err := resolveSystemdAlerts(e.App); err != nil {
+			e.App.Logger().Error("Failed to resolve stale systemd alerts", "err", err)
+		}
 		if err := am.restorePendingStatusAlerts(); err != nil {
 			e.App.Logger().Error("Failed to restore pending status alerts", "err", err)
 		}
@@ -217,8 +232,20 @@ func (am *AlertManager) SendAlert(data AlertMessageData) error {
 		am.hub.Logger().Error("Failed to unmarshal user settings", "err", err)
 	}
 	// send alerts via webhooks
+	send := sendPublicNotification
+	if len(userAlertSettings.Webhooks) > 0 {
+		// Read the owner's current role at delivery time, including for URLs
+		// saved before an admin was demoted. Never fall back on lookup failure.
+		owner, err := am.hub.FindRecordById("users", data.UserID)
+		if err != nil {
+			return fmt.Errorf("load notification owner: %w", err)
+		}
+		if owner.GetString("role") == "admin" {
+			send = shoutrrr.Send
+		}
+	}
 	for _, webhook := range userAlertSettings.Webhooks {
-		if err := am.SendShoutrrrAlert(webhook, data.Title, data.Message, data.Link, data.LinkText); err != nil {
+		if err := am.sendShoutrrrAlert(webhook, data.Title, data.Message, data.Link, data.LinkText, send); err != nil {
 			am.hub.Logger().Error("Failed to send shoutrrr alert", "err", err)
 		}
 	}
@@ -249,6 +276,10 @@ func (am *AlertManager) SendAlert(data AlertMessageData) error {
 
 // SendShoutrrrAlert sends an alert via a Shoutrrr URL
 func (am *AlertManager) SendShoutrrrAlert(notificationUrl, title, message, link, linkText string) error {
+	return am.sendShoutrrrAlert(notificationUrl, title, message, link, linkText, shoutrrr.Send)
+}
+
+func (am *AlertManager) sendShoutrrrAlert(notificationUrl, title, message, link, linkText string, send func(string, string) error) error {
 	// Parse the URL
 	parsedURL, err := url.Parse(notificationUrl)
 	if err != nil {
@@ -291,7 +322,7 @@ func (am *AlertManager) SendShoutrrrAlert(notificationUrl, title, message, link,
 	parsedURL.RawQuery = queryParams.Encode()
 	// log.Println("URL after modification:", parsedURL.String())
 
-	err = shoutrrr.Send(parsedURL.String(), message)
+	err = send(parsedURL.String(), message)
 
 	if err == nil {
 		am.hub.Logger().Info("Sent shoutrrr alert", "title", title)

internal/alerts/alerts_api.go

@@ -3,12 +3,11 @@ package alerts
 import (
 	"database/sql"
 	"errors"
-	"net"
 	"net/http"
-	"net/url"
 	"slices"
-	"strings"
 
+	"github.com/henrygd/beszel/internal/hub/utils"
+	"github.com/nicholas-fedor/shoutrrr"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 )
@@ -37,6 +36,9 @@ func UpsertUserAlerts(e *core.RequestEvent) error {
 
 	err = e.App.RunInTransaction(func(txApp core.App) error {
 		for _, systemId := range reqData.Systems {
+			if !userHasSystem(txApp, userID, systemId) {
+				continue
+			}
 			// find existing matching alert
 			alertRecord, err := txApp.FindFirstRecordByFilter(alertsCollection,
 				"system={:system} && name={:name} && user={:user}",
@@ -94,6 +96,9 @@ func DeleteUserAlerts(e *core.RequestEvent) error {
 
 	err = e.App.RunInTransaction(func(txApp core.App) error {
 		for _, systemId := range reqData.Systems {
+			if !userHasSystem(txApp, userID, systemId) {
+				continue
+			}
 			// Find existing alert to delete
 			alertRecord, err := txApp.FindFirstRecordByFilter("alerts",
 				"system={:system} && name={:name} && user={:user}",
@@ -122,6 +127,15 @@ func DeleteUserAlerts(e *core.RequestEvent) error {
 	return e.JSON(http.StatusOK, map[string]any{"success": true, "count": numDeleted})
 }
 
+func userHasSystem(app core.App, userID, systemID string) bool {
+	system, err := app.FindRecordById("systems", systemID)
+	if err != nil {
+		return false
+	}
+	shareAll, _ := utils.GetEnv("SHARE_ALL_SYSTEMS")
+	return shareAll == "true" || slices.Contains(system.GetStringSlice("users"), userID)
+}
+
 // SendTestNotification handles API request to send a test notification to a specified Shoutrrr URL
 func (am *AlertManager) SendTestNotification(e *core.RequestEvent) error {
 	var data struct {
@@ -131,62 +145,16 @@ func (am *AlertManager) SendTestNotification(e *core.RequestEvent) error {
 	if err != nil || data.URL == "" {
 		return e.BadRequestError("URL is required", err)
 	}
-	// Only allow admins to send test notifications to internal URLs
+	send := shoutrrr.Send
 	if !e.Auth.IsSuperuser() && e.Auth.GetString("role") != "admin" {
-		internalURL, err := isInternalURL(data.URL)
-		if err != nil {
-			return e.BadRequestError(err.Error(), nil)
-		}
-		if internalURL {
-			return e.ForbiddenError("Only admins can send to internal destinations", nil)
-		}
+		send = sendPublicNotification
+	}
+	err = am.sendShoutrrrAlert(data.URL, "Test Alert", "This is a notification from Beszel.", am.hub.Settings().Meta.AppURL, "View Beszel", send)
+	if errors.Is(err, errInternalDestination) || errors.Is(err, errUnrestrictedService) {
+		return e.ForbiddenError(err.Error(), nil)
 	}
-	err = am.SendShoutrrrAlert(data.URL, "Test Alert", "This is a notification from Beszel.", am.hub.Settings().Meta.AppURL, "View Beszel")
 	if err != nil {
 		return e.JSON(200, map[string]string{"err": err.Error()})
 	}
 	return e.JSON(200, map[string]bool{"err": false})
 }
-
-// isInternalURL checks if the given shoutrrr URL points to an internal destination (localhost or private IP)
-func isInternalURL(rawURL string) (bool, error) {
-	parsedURL, err := url.Parse(rawURL)
-	if err != nil {
-		return false, err
-	}
-
-	host := parsedURL.Hostname()
-	if host == "" {
-		return false, nil
-	}
-
-	if strings.EqualFold(host, "localhost") {
-		return true, nil
-	}
-
-	if ip := net.ParseIP(host); ip != nil {
-		return isInternalIP(ip), nil
-	}
-
-	// Some Shoutrrr URLs use the host position for service identifiers rather than a
-	// network hostname (for example, discord://token@webhookid). Restrict DNS lookups
-	// to names that look like actual hostnames so valid service URLs keep working.
-	if !strings.Contains(host, ".") {
-		return false, nil
-	}
-
-	ips, err := net.LookupIP(host)
-	if err != nil {
-		return false, nil
-	}
-
-	if slices.ContainsFunc(ips, isInternalIP) {
-		return true, nil
-	}
-
-	return false, nil
-}
-
-func isInternalIP(ip net.IP) bool {
-	return ip.IsPrivate() || ip.IsLoopback() || ip.IsUnspecified()
-}

internal/alerts/alerts_api_test.go

@@ -7,10 +7,11 @@ import (
 	"encoding/json"
 	"io"
 	"net/http"
+	"net/http/httptest"
 	"strings"
+	"sync/atomic"
 	"testing"
 
-	"github.com/henrygd/beszel/internal/alerts"
 	beszelTests "github.com/henrygd/beszel/internal/tests"
 	pbTests "github.com/pocketbase/pocketbase/tests"
 
@@ -29,31 +30,6 @@ func jsonReader(v any) io.Reader {
 	return bytes.NewReader(data)
 }
 
-func TestIsInternalURL(t *testing.T) {
-	testCases := []struct {
-		name     string
-		url      string
-		internal bool
-	}{
-		{name: "loopback ipv4", url: "generic://127.0.0.1", internal: true},
-		{name: "localhost hostname", url: "generic://localhost", internal: true},
-		{name: "localhost hostname", url: "generic+http://localhost/api/v1/postStuff", internal: true},
-		{name: "localhost hostname", url: "generic+http://127.0.0.1:8080/api/v1/postStuff", internal: true},
-		{name: "localhost hostname", url: "generic+https://beszel.dev/api/v1/postStuff", internal: false},
-		{name: "public ipv4", url: "generic://8.8.8.8", internal: false},
-		{name: "token style service url", url: "discord://abc123@123456789", internal: false},
-		{name: "single label service url", url: "slack://token@team/channel", internal: false},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			internal, err := alerts.IsInternalURL(testCase.url)
-			assert.NoError(t, err)
-			assert.Equal(t, testCase.internal, internal)
-		})
-	}
-}
-
 func TestUserAlertsApi(t *testing.T) {
 	hub, _ := beszelTests.NewTestHub(t.TempDir())
 	defer hub.Cleanup()
@@ -190,6 +166,30 @@ func TestUserAlertsApi(t *testing.T) {
 				assert.EqualValues(t, 3, user1Alerts, "should have 3 alerts")
 			},
 		},
+		{
+			Name:   "POST ignores systems the user cannot access",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user2Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system1.Id},
+				"value":   90,
+				"min":     10,
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.Zero(t, alerts)
+			},
+		},
 		{
 			Name:   "Overwrite: false, should not overwrite existing alert",
 			Method: http.MethodPost,
@@ -347,6 +347,31 @@ func TestUserAlertsApi(t *testing.T) {
 				assert.Zero(t, alerts, "should have 0 alerts")
 			},
 		},
+		{
+			Name:   "DELETE ignores systems the user cannot access",
+			Method: http.MethodDelete,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user2Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"count\":0", "\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system1.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name": "CPU", "system": system1.Id, "user": user2.Id, "value": 80,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 1, alerts)
+			},
+		},
 		{
 			Name:   "User 2 should not be able to delete alert of user 1",
 			Method: http.MethodDelete,
@@ -396,6 +421,17 @@ func TestSendTestNotification(t *testing.T) {
 	hub, user := beszelTests.GetHubWithUser(t)
 	defer hub.Cleanup()
 
+	var delivered atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		delivered.Add(1)
+	}))
+	defer server.Close()
+	localURL := "generic+" + server.URL
+
+	readonlyUser, err := beszelTests.CreateUserWithRole(hub, "readonly@example.com", "password123", "readonly")
+	assert.NoError(t, err)
+	readonlyToken, err := readonlyUser.NewAuthToken()
+	assert.NoError(t, err)
 	userToken, err := user.NewAuthToken()
 
 	adminUser, err := beszelTests.CreateUserWithRole(hub, "admin@example.com", "password123", "admin")
@@ -420,11 +456,11 @@ func TestSendTestNotification(t *testing.T) {
 			ExpectedContent: []string{"requires valid"},
 			TestAppFactory:  testAppFactory,
 			Body: jsonReader(map[string]any{
-				"url": "generic://127.0.0.1",
+				"url": localURL,
 			}),
 		},
 		{
-			Name:           "POST /test-notification - with external auth should succeed",
+			Name:           "POST /test-notification - invalid service reports error",
 			Method:         http.MethodPost,
 			URL:            "/api/beszel/test-notification",
 			TestAppFactory: testAppFactory,
@@ -432,7 +468,7 @@ func TestSendTestNotification(t *testing.T) {
 				"Authorization": userToken,
 			},
 			Body: jsonReader(map[string]any{
-				"url": "generic://8.8.8.8",
+				"url": "unknown://example.com",
 			}),
 			ExpectedStatus:  200,
 			ExpectedContent: []string{"\"err\":"},
@@ -474,10 +510,10 @@ func TestSendTestNotification(t *testing.T) {
 				"Authorization": adminUserToken,
 			},
 			Body: jsonReader(map[string]any{
-				"url": "generic://127.0.0.1",
+				"url": localURL,
 			}),
 			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"err\":"},
+			ExpectedContent: []string{"\"err\":false"},
 		},
 		{
 			Name:           "POST /test-notification - internal url with superuser auth should succeed",
@@ -488,14 +524,28 @@ func TestSendTestNotification(t *testing.T) {
 				"Authorization": superuserToken,
 			},
 			Body: jsonReader(map[string]any{
-				"url": "generic://127.0.0.1",
+				"url": localURL,
 			}),
 			ExpectedStatus:  200,
 			ExpectedContent: []string{"\"err\":"},
 		},
 	}
 
+	for _, url := range []string{localURL, "smtp://user:pass@127.0.0.1/?fromAddress=sender@example.com&toAddresses=recipient@example.com", "mqtt://127.0.0.1/topic"} {
+		scenarios = append(scenarios, beszelTests.ApiScenario{
+			Name:            "readonly cannot send to " + url,
+			Method:          http.MethodPost,
+			URL:             "/api/beszel/test-notification",
+			TestAppFactory:  testAppFactory,
+			Headers:         map[string]string{"Authorization": readonlyToken},
+			Body:            jsonReader(map[string]any{"url": url}),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{"Only admins"},
+		})
+	}
+
 	for _, scenario := range scenarios {
 		scenario.Test(t)
 	}
+	assert.EqualValues(t, 2, delivered.Load(), "only admin and superuser requests should reach the server")
 }

internal/alerts/alerts_cache.go

@@ -1,6 +1,8 @@
 package alerts
 
 import (
+	"time"
+
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/store"
@@ -8,13 +10,14 @@ import (
 
 // CachedAlertData represents the relevant fields of an alert record for status checking and updates.
 type CachedAlertData struct {
-	Id        string
-	SystemID  string
-	UserID    string
-	Name      string
-	Value     float64
-	Triggered bool
-	Min       uint8
+	Id           string
+	SystemID     string
+	UserID       string
+	Name         string
+	Value        float64
+	Triggered    bool
+	Min          uint8
+	PendingSince time.Time
 	// Created   types.DateTime
 }
 
@@ -26,6 +29,7 @@ func (a *CachedAlertData) PopulateFromRecord(record *core.Record) {
 	a.Value = record.GetFloat("value")
 	a.Triggered = record.GetBool("triggered")
 	a.Min = uint8(record.GetInt("min"))
+	a.PendingSince = record.GetDateTime("pending_since").Time()
 	// a.Created = record.GetDateTime("created")
 }
 

internal/alerts/alerts_container.go

@@ -0,0 +1,318 @@
+package alerts
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/henrygd/beszel/internal/entities/container"
+	"github.com/henrygd/beszel/internal/entities/system"
+
+	"github.com/pocketbase/pocketbase/core"
+)
+
+const (
+	// containerAlertName is the value stored in the alerts.name field for this alert type.
+	containerAlertName = "ContainerHealth"
+
+	// containerLogMaxLines caps how many matched (error/fatal) log lines are kept.
+	containerLogMaxLines = 12
+	// containerLogFallbackLines is how many trailing raw log lines are used when no
+	// line matches "error" or "fatal", so the notification still carries some context.
+	containerLogFallbackLines = 6
+	// containerLogExcerptMaxChars bounds a single container's log excerpt so a
+	// handful of containers can't blow past Discord's message size limit.
+	containerLogExcerptMaxChars = 500
+	// containerAlertMaxLogged is the max number of unhealthy containers we fetch
+	// and embed logs for in a single alert message.
+	containerAlertMaxLogged = 2
+	// containerAlertMessageMaxChars is a final safety cap on the whole message body.
+	containerAlertMessageMaxChars = 1800
+)
+
+// FetchContainerLogsFunc retrieves recent logs for a container ID from its
+// connected agent. Implementations should apply their own timeout. This is a
+// type alias (not a defined type) so it satisfies the hubLike interface in
+// internal/hub/systems, which declares the same func signature without
+// importing this package.
+type FetchContainerLogsFunc = func(containerID string) (string, error)
+
+// containerAlertTarget is an immutable snapshot of the fields needed after the
+// alert fires. Keeping agent-owned container records out of notification work
+// avoids retaining and concurrently reading data that is refreshed in place.
+type containerAlertTarget struct {
+	id   string
+	name string
+}
+
+// HandleContainerAlerts checks configured "ContainerHealth" alerts for a system
+// against the Docker container health data included in the latest agent update.
+// It persists when containers first become unhealthy, fires from a fresh poll
+// once the configured delay has elapsed, and resolves once containers recover.
+// fetchLogs is used when an alert actually fires so the notification can include
+// a log excerpt (prioritizing lines containing "error"/"fatal") for context.
+func (am *AlertManager) HandleContainerAlerts(systemRecord *core.Record, data *system.CombinedData, fetchLogs FetchContainerLogsFunc) error {
+	alerts := am.alertsCache.GetAlertsByName(systemRecord.Id, containerAlertName)
+	if len(alerts) == 0 {
+		return nil
+	}
+	if data.Containers == nil {
+		// An unknown Docker state must not resolve a triggered alert or count
+		// toward the minimum unhealthy duration.
+		var result error
+		for _, alertData := range alerts {
+			if err := am.clearPendingContainerAlert(alertData); err != nil {
+				result = errors.Join(result, err)
+			}
+		}
+		return result
+	}
+
+	var unhealthy []*container.Stats
+	for _, c := range data.Containers {
+		if c.Health == container.DockerHealthUnhealthy {
+			unhealthy = append(unhealthy, c)
+		}
+	}
+
+	systemName := systemRecord.GetString("name")
+	now := time.Now().UTC()
+	var result error
+	for _, alertData := range alerts {
+		if len(unhealthy) > 0 {
+			if alertData.Triggered {
+				continue
+			}
+			min := max(1, int(alertData.Min))
+			if alertData.PendingSince.IsZero() {
+				pendingSince, err := am.setPendingContainerAlert(alertData, now)
+				if err != nil {
+					result = errors.Join(result, err)
+					continue
+				}
+				if pendingSince.IsZero() {
+					continue
+				}
+				alertData.PendingSince = pendingSince
+				if min > 1 {
+					continue
+				}
+			}
+			if min > 1 && now.Before(alertData.PendingSince.Add(time.Duration(min)*time.Minute)) {
+				continue
+			}
+			if err := am.sendContainerHealthAlert(true, systemName, alertData, snapshotContainerAlertTargets(unhealthy), fetchLogs); err != nil {
+				result = errors.Join(result, err)
+			}
+			continue
+		}
+
+		// no unhealthy containers right now
+		if err := am.clearPendingContainerAlert(alertData); err != nil {
+			result = errors.Join(result, err)
+		}
+		if !alertData.Triggered {
+			continue
+		}
+		if err := am.sendContainerHealthAlert(false, systemName, alertData, nil, fetchLogs); err != nil {
+			result = errors.Join(result, err)
+		}
+	}
+	return result
+}
+
+func snapshotContainerAlertTargets(containers []*container.Stats) []containerAlertTarget {
+	targets := make([]containerAlertTarget, len(containers))
+	for i, c := range containers {
+		targets[i] = containerAlertTarget{id: c.Id, name: c.Name}
+	}
+	return targets
+}
+
+// setPendingContainerAlert durably records the first unhealthy observation and
+// returns the persisted generation used to claim delivery.
+func (am *AlertManager) setPendingContainerAlert(alertData CachedAlertData, since time.Time) (time.Time, error) {
+	record, err := am.hub.FindRecordById("alerts", alertData.Id)
+	if err != nil {
+		return time.Time{}, err
+	}
+	if record.GetBool("triggered") {
+		return time.Time{}, nil
+	}
+	if pendingSince := record.GetDateTime("pending_since").Time(); !pendingSince.IsZero() {
+		return pendingSince, nil
+	}
+	// PocketBase date fields are persisted with millisecond precision. Normalize
+	// before saving so the update-hook cache and a subsequent database read agree.
+	since = since.Truncate(time.Millisecond)
+	record.Set("pending_since", since)
+	return since, am.hub.Save(record)
+}
+
+func (am *AlertManager) clearPendingContainerAlert(alertData CachedAlertData) error {
+	if alertData.PendingSince.IsZero() {
+		return nil
+	}
+	record, err := am.hub.FindRecordById("alerts", alertData.Id)
+	if err != nil {
+		return err
+	}
+	if record.GetDateTime("pending_since").Time().IsZero() {
+		return nil
+	}
+	record.Set("pending_since", nil)
+	return am.hub.Save(record)
+}
+
+// claimPendingContainerAlert marks an alert triggered only if the pending
+// generation is still current. A healthy/unknown update can clear the timestamp
+// while logs are being fetched, causing this claim to become a no-op.
+func (am *AlertManager) claimPendingContainerAlert(alertData CachedAlertData) (bool, error) {
+	record, err := am.hub.FindRecordById("alerts", alertData.Id)
+	if err != nil {
+		return false, err
+	}
+	pendingSince := record.GetDateTime("pending_since").Time()
+	if record.GetBool("triggered") || pendingSince.IsZero() || pendingSince.UnixMilli() != alertData.PendingSince.UnixMilli() {
+		return false, nil
+	}
+	record.Set("pending_since", nil)
+	record.Set("triggered", true)
+	return true, am.hub.Save(record)
+}
+
+// CancelPendingContainerAlerts clears pending container-health durations for a
+// system. Called when monitoring pauses or the system goes down.
+func (am *AlertManager) CancelPendingContainerAlerts(systemID string) {
+	for _, alertData := range am.alertsCache.GetAlertsByName(systemID, containerAlertName) {
+		if err := am.clearPendingContainerAlert(alertData); err != nil {
+			am.hub.Logger().Error("Failed to clear pending container alert", "err", err)
+		}
+	}
+}
+
+// sendContainerHealthAlert updates the alert's triggered state and sends the
+// notification. When unhealthy is true, it embeds a log excerpt (prioritizing
+// error/fatal lines) for up to containerAlertMaxLogged of the affected containers.
+func (am *AlertManager) sendContainerHealthAlert(unhealthy bool, systemName string, alertData CachedAlertData, containers []containerAlertTarget, fetchLogs FetchContainerLogsFunc) error {
+	link := am.hub.MakeLink("system", alertData.SystemID)
+	linkText := "View " + systemName
+
+	if !unhealthy {
+		if err := am.setAlertTriggered(alertData, false); err != nil {
+			return err
+		}
+		title := fmt.Sprintf("%s containers are healthy ✅", systemName)
+		return am.SendAlert(AlertMessageData{
+			UserID:   alertData.UserID,
+			SystemID: alertData.SystemID,
+			Title:    title,
+			Message:  strings.TrimSuffix(title, " ✅"),
+			Link:     link,
+			LinkText: linkText,
+		})
+	}
+
+	names := make([]string, len(containers))
+	for i, c := range containers {
+		names[i] = c.name
+	}
+
+	var title string
+	if len(names) == 1 {
+		title = fmt.Sprintf("Unhealthy container %s on %s \U0001F534", names[0], systemName)
+	} else {
+		title = fmt.Sprintf("%d unhealthy containers on %s \U0001F534", len(names), systemName)
+	}
+
+	var body strings.Builder
+	fmt.Fprintf(&body, "Unhealthy: %s", strings.Join(names, ", "))
+	body.WriteString(am.buildContainerLogsSection(containers, fetchLogs))
+
+	message := body.String()
+	if len(message) > containerAlertMessageMaxChars {
+		message = message[:containerAlertMessageMaxChars] + "\n…(truncated)"
+	}
+
+	claimed, err := am.claimPendingContainerAlert(alertData)
+	if err != nil || !claimed {
+		return err
+	}
+
+	return am.SendAlert(AlertMessageData{
+		UserID:   alertData.UserID,
+		SystemID: alertData.SystemID,
+		Title:    title,
+		Message:  message,
+		Link:     link,
+		LinkText: linkText,
+	})
+}
+
+// buildContainerLogsSection attempts to fetch and format log excerpts for up to
+// containerAlertMaxLogged unhealthy containers, to append to an alert message.
+func (am *AlertManager) buildContainerLogsSection(containers []containerAlertTarget, fetchLogs FetchContainerLogsFunc) string {
+	if fetchLogs == nil {
+		return ""
+	}
+
+	var section strings.Builder
+	attempts := min(len(containers), containerAlertMaxLogged)
+	for _, c := range containers[:attempts] {
+		rawLogs, err := fetchLogs(c.id)
+		if err != nil {
+			am.hub.Logger().Warn("Failed to fetch container logs for alert", "container", c.name, "err", err)
+			continue
+		}
+		excerpt := buildContainerLogExcerpt(rawLogs)
+		if excerpt == "" {
+			continue
+		}
+		fmt.Fprintf(&section, "\n\n%s logs:\n```\n%s\n```", c.name, excerpt)
+	}
+
+	if len(containers) > containerAlertMaxLogged {
+		fmt.Fprintf(&section, "\n\n(+%d more unhealthy container(s), logs omitted)", len(containers)-containerAlertMaxLogged)
+	}
+
+	return section.String()
+}
+
+// buildContainerLogExcerpt filters raw container log output down to the lines
+// most likely to explain why the container is unhealthy: lines containing
+// "error" or "fatal" (case-insensitive) are preferred. If none match, the tail
+// of the raw output is used instead so the notification still carries context.
+func buildContainerLogExcerpt(raw string) string {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return ""
+	}
+	lines := strings.Split(raw, "\n")
+
+	var matched []string
+	for _, line := range lines {
+		line = strings.TrimRight(line, "\r")
+		if line == "" {
+			continue
+		}
+		lower := strings.ToLower(line)
+		if strings.Contains(lower, "error") || strings.Contains(lower, "fatal") {
+			matched = append(matched, line)
+		}
+	}
+
+	selected := matched
+	if len(selected) == 0 {
+		start := max(0, len(lines)-containerLogFallbackLines)
+		selected = lines[start:]
+	} else if len(selected) > containerLogMaxLines {
+		selected = selected[len(selected)-containerLogMaxLines:]
+	}
+
+	excerpt := strings.TrimSpace(strings.Join(selected, "\n"))
+	if len(excerpt) > containerLogExcerptMaxChars {
+		excerpt = "…" + excerpt[len(excerpt)-containerLogExcerptMaxChars:]
+	}
+	return excerpt
+}

internal/alerts/alerts_container_test.go

@@ -0,0 +1,349 @@
+//go:build testing
+
+package alerts_test
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/henrygd/beszel/internal/alerts"
+	"github.com/henrygd/beszel/internal/entities/container"
+	"github.com/henrygd/beszel/internal/entities/system"
+	beszelTests "github.com/henrygd/beszel/internal/tests"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type containerAlertTestFixture struct {
+	hub          *beszelTests.TestHub
+	am           *alerts.AlertManager
+	alertID      string
+	systemRecord *core.Record
+}
+
+func newContainerAlertTestFixture(t *testing.T, min int) *containerAlertTestFixture {
+	t.Helper()
+
+	hub, user := beszelTests.GetHubWithUser(t)
+
+	systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
+	require.NoError(t, err)
+	systemRecord := systems[0]
+
+	userSettings, err := hub.FindFirstRecordByFilter("user_settings", "user={:user}", map[string]any{"user": user.Id})
+	require.NoError(t, err)
+	userSettings.Set("settings", `{"emails":["test@example.com"],"webhooks":[]}`)
+	require.NoError(t, hub.Save(userSettings))
+
+	alertRecord, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
+		"name":   "ContainerHealth",
+		"system": systemRecord.Id,
+		"user":   user.Id,
+		"min":    min,
+	})
+	require.NoError(t, err)
+	assert.False(t, alertRecord.GetBool("triggered"), "Alert should not be triggered initially")
+
+	return &containerAlertTestFixture{
+		hub:          hub,
+		am:           alerts.NewTestAlertManagerWithoutWorker(hub),
+		alertID:      alertRecord.Id,
+		systemRecord: systemRecord,
+	}
+}
+
+func (f *containerAlertTestFixture) cleanup() {
+	f.hub.Cleanup()
+}
+
+func (f *containerAlertTestFixture) submit(t *testing.T, containers []*container.Stats, fetchLogs alerts.FetchContainerLogsFunc) {
+	t.Helper()
+	data := &system.CombinedData{Containers: containers}
+	require.NoError(t, f.am.HandleContainerAlerts(f.systemRecord, data, fetchLogs))
+}
+
+func (f *containerAlertTestFixture) submitInvalid(t *testing.T) {
+	t.Helper()
+	require.NoError(t, f.am.HandleContainerAlerts(f.systemRecord, &system.CombinedData{}, nil))
+}
+
+func (f *containerAlertTestFixture) assertTriggered(t *testing.T, triggered bool, message string) {
+	t.Helper()
+	alertRecord, err := f.hub.FindRecordById("alerts", f.alertID)
+	require.NoError(t, err)
+	assert.Equal(t, triggered, alertRecord.GetBool("triggered"), message)
+}
+
+func (f *containerAlertTestFixture) assertPending(t *testing.T, pending bool) {
+	t.Helper()
+	alertRecord, err := f.hub.FindRecordById("alerts", f.alertID)
+	require.NoError(t, err)
+	assert.Equal(t, pending, !alertRecord.GetDateTime("pending_since").Time().IsZero())
+}
+
+func waitForContainerAlert(d time.Duration) {
+	time.Sleep(d)
+	synctest.Wait()
+}
+
+func healthyContainer(name string) *container.Stats {
+	return &container.Stats{Name: name, Id: "abc123def456", Health: container.DockerHealthHealthy}
+}
+
+func unhealthyContainer(name string) *container.Stats {
+	return &container.Stats{Name: name, Id: "abc123def456", Health: container.DockerHealthUnhealthy}
+}
+
+func TestContainerHealthAlertTriggersAndResolves(t *testing.T) {
+	fixture := newContainerAlertTestFixture(t, 1)
+	defer fixture.cleanup()
+
+	synctest.Test(t, func(t *testing.T) {
+		fixture.submit(t, []*container.Stats{unhealthyContainer("web")}, nil)
+
+		fixture.assertTriggered(t, true, "A one-minute alert should trigger on the first unhealthy update")
+		require.Equal(t, 1, fixture.hub.TestMailer.TotalSend(), "An email should have been sent")
+
+		msg := fixture.hub.TestMailer.LastMessage()
+		assert.Contains(t, msg.Subject, "web", "Subject should name the unhealthy container")
+		assert.Contains(t, strings.ToLower(msg.Subject), "unhealthy")
+
+		fixture.submit(t, []*container.Stats{unhealthyContainer("web")}, nil)
+		fixture.assertPending(t, false)
+
+		fixture.submitInvalid(t)
+		fixture.assertTriggered(t, true, "An invalid container snapshot should not resolve the alert")
+		assert.Equal(t, 1, fixture.hub.TestMailer.TotalSend(), "An invalid snapshot should not send a recovery")
+
+		fixture.submit(t, []*container.Stats{}, nil)
+		waitForContainerAlert(time.Second)
+
+		fixture.assertTriggered(t, false, "Alert should resolve once the container is healthy again")
+		assert.Equal(t, 2, fixture.hub.TestMailer.TotalSend(), "A second email should have been sent for the recovery")
+		assert.Contains(t, fixture.hub.TestMailer.LastMessage().Subject, " healthy")
+	})
+}
+
+func TestContainerHealthAlertInvalidSnapshotCancelsPending(t *testing.T) {
+	fixture := newContainerAlertTestFixture(t, 5)
+	defer fixture.cleanup()
+
+	synctest.Test(t, func(t *testing.T) {
+		fixture.submit(t, []*container.Stats{unhealthyContainer("db")}, nil)
+		fixture.assertPending(t, true)
+		waitForContainerAlert(time.Minute)
+		fixture.submitInvalid(t)
+		fixture.assertPending(t, false)
+		waitForContainerAlert(10 * time.Minute)
+		fixture.submit(t, []*container.Stats{unhealthyContainer("db")}, nil)
+
+		fixture.assertTriggered(t, false, "Stale unhealthy data should not trigger an alert")
+		fixture.assertPending(t, true)
+		assert.Equal(t, 0, fixture.hub.TestMailer.TotalSend())
+	})
+}
+
+func TestContainerHealthAlertSystemDownCancelsPending(t *testing.T) {
+	fixture := newContainerAlertTestFixture(t, 5)
+	defer fixture.cleanup()
+
+	// Use the hub's alert manager because the system-manager status hook invokes
+	// cancellation on that instance.
+	am := fixture.hub.GetAlertManager()
+	require.NoError(t, am.HandleContainerAlerts(
+		fixture.systemRecord,
+		&system.CombinedData{Containers: []*container.Stats{unhealthyContainer("db")}},
+		nil,
+	))
+	fixture.assertPending(t, true)
+
+	fixture.systemRecord.Set("status", "down")
+	require.NoError(t, fixture.hub.Save(fixture.systemRecord))
+
+	fixture.assertPending(t, false)
+}
+
+func TestContainerHealthAlertResolvesBeforeMinDelayCancelsPending(t *testing.T) {
+	fixture := newContainerAlertTestFixture(t, 5)
+	defer fixture.cleanup()
+
+	synctest.Test(t, func(t *testing.T) {
+		fixture.submit(t, []*container.Stats{unhealthyContainer("db")}, nil)
+		waitForContainerAlert(time.Minute)
+
+		fixture.assertTriggered(t, false, "Alert should not fire until the min delay elapses")
+		fixture.assertPending(t, true)
+		assert.Equal(t, 0, fixture.hub.TestMailer.TotalSend())
+
+		// container recovers before the 5 minute delay elapses
+		fixture.submit(t, []*container.Stats{healthyContainer("db")}, nil)
+		waitForContainerAlert(10 * time.Minute)
+		fixture.submit(t, []*container.Stats{healthyContainer("db")}, nil)
+
+		fixture.assertTriggered(t, false, "Alert should remain untriggered")
+		fixture.assertPending(t, false)
+		assert.Equal(t, 0, fixture.hub.TestMailer.TotalSend(), "No email should be sent for a container that recovered before the delay")
+	})
+}
+
+func TestContainerHealthAlertPreservesPendingDurationAcrossManagerRestart(t *testing.T) {
+	fixture := newContainerAlertTestFixture(t, 2)
+	defer fixture.cleanup()
+
+	synctest.Test(t, func(t *testing.T) {
+		fixture.submit(t, []*container.Stats{unhealthyContainer("db")}, nil)
+		waitForContainerAlert(30 * time.Second)
+
+		restarted := alerts.NewTestAlertManagerWithoutWorker(fixture.hub)
+		waitForContainerAlert(91 * time.Second)
+		require.NoError(t, restarted.HandleContainerAlerts(
+			fixture.systemRecord,
+			&system.CombinedData{Containers: []*container.Stats{unhealthyContainer("db")}},
+			nil,
+		))
+
+		fixture.assertTriggered(t, true, "Restart should preserve the original unhealthy start time")
+		fixture.assertPending(t, false)
+		assert.Equal(t, 1, fixture.hub.TestMailer.TotalSend())
+	})
+}
+
+func TestContainerHealthAlertClaimsPendingTimestampAtDatabasePrecision(t *testing.T) {
+	fixture := newContainerAlertTestFixture(t, 1)
+	defer fixture.cleanup()
+
+	alertRecord, err := fixture.hub.FindRecordById("alerts", fixture.alertID)
+	require.NoError(t, err)
+	// PocketBase persists dates to milliseconds, while record update hooks can
+	// retain the original sub-millisecond value in the in-memory alert cache.
+	alertRecord.Set("pending_since", time.Now().UTC().Add(-2*time.Minute).Truncate(time.Millisecond).Add(123*time.Nanosecond))
+	require.NoError(t, fixture.hub.Save(alertRecord))
+
+	fixture.submit(t, []*container.Stats{unhealthyContainer("db")}, nil)
+
+	fixture.assertTriggered(t, true, "Equivalent persisted and cached timestamps should claim the alert")
+	fixture.assertPending(t, false)
+	assert.Equal(t, 1, fixture.hub.TestMailer.TotalSend())
+}
+
+func TestContainerHealthAlertRecoveryWhileFetchingLogsCancelsDelivery(t *testing.T) {
+	fixture := newContainerAlertTestFixture(t, 1)
+	defer fixture.cleanup()
+
+	synctest.Test(t, func(t *testing.T) {
+		fetchLogs := func(containerID string) (string, error) {
+			fixture.submit(t, []*container.Stats{healthyContainer("api")}, nil)
+			return "FATAL stale failure", nil
+		}
+		fixture.submit(t, []*container.Stats{unhealthyContainer("api")}, fetchLogs)
+
+		fixture.assertTriggered(t, false, "Recovery should cancel delivery while logs are fetched")
+		fixture.assertPending(t, false)
+		assert.Equal(t, 0, fixture.hub.TestMailer.TotalSend())
+	})
+}
+
+func TestContainerHealthAlertIncludesLogExcerpt(t *testing.T) {
+	fixture := newContainerAlertTestFixture(t, 1)
+	defer fixture.cleanup()
+
+	rawLogs := strings.Join([]string{
+		"2026-08-16T10:00:00Z booting",
+		"2026-08-16T10:00:01Z ERROR could not reach upstream",
+		"2026-08-16T10:00:02Z FATAL giving up after 3 retries",
+	}, "\n")
+	fetchLogs := func(containerID string) (string, error) {
+		assert.Equal(t, "abc123def456", containerID)
+		return rawLogs, nil
+	}
+
+	synctest.Test(t, func(t *testing.T) {
+		fixture.submit(t, []*container.Stats{unhealthyContainer("api")}, fetchLogs)
+
+		fixture.assertTriggered(t, true, "Alert should be triggered")
+		require.Equal(t, 1, fixture.hub.TestMailer.TotalSend())
+
+		body := fixture.hub.TestMailer.LastMessage().Text
+		assert.Contains(t, body, "could not reach upstream")
+		assert.Contains(t, body, "giving up after 3 retries")
+		assert.NotContains(t, body, "booting", "non error/fatal lines should be dropped when matches exist")
+	})
+}
+
+func TestContainerHealthAlertSkipsLogsOnFetchError(t *testing.T) {
+	fixture := newContainerAlertTestFixture(t, 1)
+	defer fixture.cleanup()
+
+	fetchLogs := func(containerID string) (string, error) {
+		return "", fmt.Errorf("agent unreachable")
+	}
+
+	synctest.Test(t, func(t *testing.T) {
+		fixture.submit(t, []*container.Stats{unhealthyContainer("api")}, fetchLogs)
+
+		fixture.assertTriggered(t, true, "Alert should still be triggered even if logs can't be fetched")
+		require.Equal(t, 1, fixture.hub.TestMailer.TotalSend())
+	})
+}
+
+func TestContainerHealthAlertCapsLogFetchAttempts(t *testing.T) {
+	fixture := newContainerAlertTestFixture(t, 1)
+	defer fixture.cleanup()
+
+	containers := make([]*container.Stats, 100)
+	for i := range containers {
+		containers[i] = &container.Stats{
+			Name:   fmt.Sprintf("container-%d", i),
+			Id:     fmt.Sprintf("id-%d", i),
+			Health: container.DockerHealthUnhealthy,
+		}
+	}
+	attempts := 0
+	fetchLogs := func(containerID string) (string, error) {
+		attempts++
+		return "", fmt.Errorf("agent unreachable")
+	}
+
+	synctest.Test(t, func(t *testing.T) {
+		fixture.submit(t, containers, fetchLogs)
+
+		fixture.assertTriggered(t, true, "Alert should still fire when log retrieval fails")
+		assert.Equal(t, 2, attempts, "Log retrieval should attempt at most two containers")
+		require.Equal(t, 1, fixture.hub.TestMailer.TotalSend())
+	})
+}
+
+func TestBuildContainerLogExcerptPrefersErrorAndFatalLines(t *testing.T) {
+	raw := strings.Join([]string{
+		"2026-08-16T10:00:00Z starting up",
+		"2026-08-16T10:00:01Z listening on :8080",
+		"2026-08-16T10:00:02Z ERROR failed to connect to db",
+		"2026-08-16T10:00:03Z retrying connection",
+		"2026-08-16T10:00:04Z FATAL could not recover, exiting",
+	}, "\n")
+
+	excerpt := alerts.BuildContainerLogExcerpt(raw)
+	assert.Contains(t, excerpt, "failed to connect to db")
+	assert.Contains(t, excerpt, "could not recover, exiting")
+	assert.NotContains(t, excerpt, "starting up", "non-matching lines should be dropped when error/fatal lines exist")
+}
+
+func TestBuildContainerLogExcerptFallsBackToTailWhenNoMatches(t *testing.T) {
+	var lines []string
+	for i := range 20 {
+		lines = append(lines, fmt.Sprintf("line %d: all good here", i))
+	}
+	raw := strings.Join(lines, "\n")
+
+	excerpt := alerts.BuildContainerLogExcerpt(raw)
+	assert.Contains(t, excerpt, "line 19", "should keep the tail of the output")
+	assert.NotContains(t, excerpt, "line 0:", "should not keep the very start when falling back to a short tail")
+}
+
+func TestBuildContainerLogExcerptEmpty(t *testing.T) {
+	assert.Equal(t, "", alerts.BuildContainerLogExcerpt("   \n  \n"))
+}

internal/alerts/alerts_quiet_hours_test.go

@@ -322,8 +322,9 @@ func TestAlertSilencedMultiUser(t *testing.T) {
 }
 
 func TestAlertSilencedWithActualAlert(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+
 	synctest.Test(t, func(t *testing.T) {
-		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		// Create a system

internal/alerts/alerts_status_test.go

@@ -29,8 +29,9 @@ func setStatusAlertEmail(t *testing.T, hub core.App, userID, email string) {
 }
 
 func TestStatusAlerts(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+
 	synctest.Test(t, func(t *testing.T) {
-		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		systems, err := beszelTests.CreateSystems(hub, 4, user.Id, "paused")
@@ -234,8 +235,9 @@ func TestHandleStatusAlertsDoesNotSendRecoveryWhileDownIsOnlyPending(t *testing.
 }
 
 func TestStatusAlertTimerCancellationPreventsBoundaryDelivery(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+
 	synctest.Test(t, func(t *testing.T) {
-		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		userSettings, err := hub.FindFirstRecordByFilter("user_settings", "user={:user}", map[string]any{"user": user.Id})
@@ -336,8 +338,9 @@ func TestStatusAlertDownFiresAfterDelayExpires(t *testing.T) {
 }
 
 func TestStatusAlertMultipleUsersRespectDifferentMinutes(t *testing.T) {
+	hub, user1 := beszelTests.GetHubWithUser(t)
+
 	synctest.Test(t, func(t *testing.T) {
-		hub, user1 := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		setStatusAlertEmail(t, hub, user1.Id, "user1@example.com")
@@ -423,8 +426,9 @@ func TestStatusAlertMultipleUsersRespectDifferentMinutes(t *testing.T) {
 }
 
 func TestStatusAlertMultipleUsersRecoveryBetweenMinutesOnlyAlertsEarlierUser(t *testing.T) {
+	hub, user1 := beszelTests.GetHubWithUser(t)
+
 	synctest.Test(t, func(t *testing.T) {
-		hub, user1 := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		setStatusAlertEmail(t, hub, user1.Id, "user1@example.com")
@@ -816,8 +820,9 @@ func TestResolveStatusAlerts(t *testing.T) {
 }
 
 func TestAlertsHistoryStatus(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+
 	synctest.Test(t, func(t *testing.T) {
-		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		// Create a system
@@ -882,8 +887,9 @@ func TestAlertsHistoryStatus(t *testing.T) {
 }
 
 func TestStatusAlertClearedBeforeSend(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+
 	synctest.Test(t, func(t *testing.T) {
-		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		// Create a system

internal/alerts/alerts_system.go

@@ -13,8 +13,41 @@ import (
 	"github.com/pocketbase/pocketbase/tools/types"
 )
 
+var cpuStateAlerts = map[string]struct {
+	index int
+	label string
+}{
+	"CPUIOWait": {2, "CPU I/O Wait"},
+	"CPUSteal":  {3, "CPU Steal Time"},
+}
+
+func cpuStateAlertValue(name string, breakdown []float64) (float64, bool) {
+	state, ok := cpuStateAlerts[name]
+	if !ok || len(breakdown) < 5 {
+		return 0, false
+	}
+	var total float64
+	for _, value := range breakdown {
+		total += value
+	}
+	if total <= 0 {
+		return 0, false
+	}
+	return breakdown[state.index], true
+}
+
 func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *system.CombinedData) error {
-	alerts := am.alertsCache.GetAlertsExcludingNames(systemRecord.Id, "Status")
+	// Systemd alerts are binary state, not numeric thresholds, so they're handled
+	// separately. They read their own state from the database and don't use data.
+	if err := am.HandleSystemdAlerts(systemRecord); err != nil {
+		am.hub.Logger().Error("Error handling systemd alerts", "err", err)
+	}
+
+	if data == nil {
+		return nil
+	}
+
+	alerts := am.alertsCache.GetAlertsExcludingNames(systemRecord.Id, "Status", alertNameSystemdFailed, containerAlertName)
 	if len(alerts) == 0 {
 		return nil
 	}
@@ -44,6 +77,14 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 					maxUsedPct = usedPct
 				}
 			}
+			for _, pool := range data.Stats.ZfsPools {
+				if pool != nil && !pool.Raw && pool.Total > 0 {
+					usedPct := pool.Used / pool.Total * 100
+					if usedPct > maxUsedPct {
+						maxUsedPct = usedPct
+					}
+				}
+			}
 			val = maxUsedPct
 		case "Temperature":
 			if data.Info.DashboardTemp < 1 {
@@ -63,10 +104,15 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 		case "GPU":
 			val = data.Info.GpuPct
 		case "Battery":
-			if data.Stats.Battery[0] == 0 {
+			if !hasRepresentativeBattery(data.Stats.Battery, data.Stats.Batteries) {
 				continue
 			}
 			val = float64(data.Stats.Battery[0])
+		default:
+			var ok bool
+			if val, ok = cpuStateAlertValue(name, data.Stats.CpuBreakdown); !ok {
+				continue
+			}
 		}
 
 		triggered := alertData.Triggered
@@ -167,6 +213,7 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 		stat := systemStats[i]
 		// subtract 10 seconds to give a small time buffer
 		systemStatsCreation := stat.Created.Time().Add(-time.Second * 10)
+		stats = SystemAlertStats{}
 		if err := json.Unmarshal(stat.Stats, &stats); err != nil {
 			return err
 		}
@@ -207,6 +254,16 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 						alert.mapSums[key] += float32(fs.DiskUsed / fs.DiskTotal * 100)
 					}
 				}
+				// add zfs pool usage from historical record
+				for key, pool := range stats.ZfsPools {
+					if !pool.Raw && pool.Total > 0 {
+						zfsKey := zfsDiskAlertKey(key)
+						if _, ok := alert.mapSums[zfsKey]; !ok {
+							alert.mapSums[zfsKey] = 0.0
+						}
+						alert.mapSums[zfsKey] += float32(pool.Used / pool.Total * 100)
+					}
+				}
 			case "Temperature":
 				if alert.mapSums == nil {
 					alert.mapSums = make(map[string]float32, len(stats.Temperatures))
@@ -235,15 +292,25 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 				}
 				alert.val += maxUsage
 			case "Battery":
+				if !hasRepresentativeBattery(stats.Battery, stats.Batteries) {
+					continue
+				}
 				alert.val += float64(stats.Battery[0])
 			default:
-				continue
+				value, ok := cpuStateAlertValue(alert.name, stats.CpuBreakdown)
+				if !ok {
+					continue
+				}
+				alert.val += value
 			}
 			alert.count++
 		}
 	}
 	// sum up vals for each alert
 	for _, alert := range validAlerts {
+		if alert.count == 0 {
+			continue
+		}
 		switch alert.name {
 		case "Disk":
 			maxPct := float32(0)
@@ -251,7 +318,12 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 				sumPct := float32(value)
 				if sumPct > maxPct {
 					maxPct = sumPct
-					alert.descriptor = fmt.Sprintf("Usage of %s", key)
+					alert.descriptor = diskAlertDescriptor(key)
+					if poolKey, ok := strings.CutPrefix(key, "zfs:"); ok {
+						if pool := data.Stats.ZfsPools[poolKey]; pool != nil && pool.DisplayName != "" {
+							alert.descriptor = diskAlertDescriptor(zfsDiskAlertKey(pool.DisplayName))
+						}
+					}
 				}
 			}
 			alert.val = float64(maxPct / float32(alert.count))
@@ -297,10 +369,28 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 	return nil
 }
 
+func zfsDiskAlertKey(poolName string) string {
+	return "zfs:" + poolName
+}
+
+func diskAlertDescriptor(key string) string {
+	if poolName, ok := strings.CutPrefix(key, "zfs:"); ok {
+		return fmt.Sprintf("Usage of storage pool %s", poolName)
+	}
+	return fmt.Sprintf("Usage of %s", key)
+}
+
+func hasRepresentativeBattery(legacy [2]uint8, batteries map[string]uint8) bool {
+	return legacy != [2]uint8{} || len(batteries) > 0
+}
+
 func (am *AlertManager) sendSystemAlert(alert SystemAlertData) {
 	// log.Printf("Sending alert %s: val %f | count %d | threshold %f\n", alert.name, alert.val, alert.count, alert.threshold)
 	systemName := alert.systemRecord.GetString("name")
 
+	if state, ok := cpuStateAlerts[alert.name]; ok {
+		alert.name = state.label
+	}
 	// change Disk to Disk usage
 	if alert.name == "Disk" {
 		alert.name += " usage"
@@ -312,7 +402,7 @@ func (am *AlertManager) sendSystemAlert(alert SystemAlertData) {
 
 	// make title alert name lowercase if not CPU or GPU
 	titleAlertName := alert.name
-	if titleAlertName != "CPU" && titleAlertName != "GPU" {
+	if titleAlertName != "CPU" && titleAlertName != "GPU" && !strings.HasPrefix(titleAlertName, "CPU") {
 		titleAlertName = strings.ToLower(titleAlertName)
 	}
 

internal/alerts/alerts_system_test.go

@@ -95,11 +95,10 @@ func waitForSystemAlert(d time.Duration) {
 
 func testOneMinuteSystemAlert[T any](t *testing.T, alertName string, threshold float64, setValue systemAlertValueSetter[T], triggerValue, resolveValue T) {
 	t.Helper()
+	fixture := newSystemAlertTestFixture(t, alertName, 1, threshold)
+	defer fixture.cleanup()
 
 	synctest.Test(t, func(t *testing.T) {
-		fixture := newSystemAlertTestFixture(t, alertName, 1, threshold)
-		defer fixture.cleanup()
-
 		submitValue(fixture, t, triggerValue, setValue)
 		waitForSystemAlert(time.Second)
 
@@ -118,11 +117,10 @@ func testOneMinuteSystemAlert[T any](t *testing.T, alertName string, threshold f
 
 func testMultiMinuteSystemAlert[T any](t *testing.T, alertName string, threshold float64, min int, setValue systemAlertValueSetter[T], baselineValue, triggerValue, resolveValue T) {
 	t.Helper()
+	fixture := newSystemAlertTestFixture(t, alertName, min, threshold)
+	defer fixture.cleanup()
 
 	synctest.Test(t, func(t *testing.T) {
-		fixture := newSystemAlertTestFixture(t, alertName, min, threshold)
-		defer fixture.cleanup()
-
 		submitValue(fixture, t, baselineValue, setValue)
 		waitForSystemAlert(time.Minute + time.Second)
 		fixture.assertTriggered(t, false, "Alert should not be triggered yet")
@@ -148,6 +146,20 @@ func setCPUAlertValue(info *system.Info, stats *system.Stats, value float64) {
 	stats.Cpu = value
 }
 
+func setCPUStateAlertValue(_ *system.Info, stats *system.Stats, value []float64) {
+	stats.CpuBreakdown = value
+}
+
+var cpuStateAlertTests = []struct {
+	name     string
+	trigger  []float64
+	resolve  []float64
+	baseline []float64
+}{
+	{"CPUIOWait", []float64{0, 0, 51, 0, 49}, []float64{0, 0, 48, 0, 52}, []float64{0, 0, 10, 0, 90}},
+	{"CPUSteal", []float64{0, 0, 0, 51, 49}, []float64{0, 0, 0, 48, 52}, []float64{0, 0, 0, 10, 90}},
+}
+
 func setMemoryAlertValue(info *system.Info, stats *system.Stats, value float64) {
 	info.MemPct = value
 	stats.MemPct = value
@@ -193,6 +205,11 @@ func setBatteryAlertValue(info *system.Info, stats *system.Stats, value [2]uint8
 
 func TestSystemAlertsOneMin(t *testing.T) {
 	testOneMinuteSystemAlert(t, "CPU", 50, setCPUAlertValue, 51, 49)
+	for _, test := range cpuStateAlertTests {
+		t.Run(test.name, func(t *testing.T) {
+			testOneMinuteSystemAlert(t, test.name, 50, setCPUStateAlertValue, test.trigger, test.resolve)
+		})
+	}
 	testOneMinuteSystemAlert(t, "Memory", 50, setMemoryAlertValue, 51, 49)
 	testOneMinuteSystemAlert(t, "Disk", 50, setDiskAlertValue, 51, 49)
 	testOneMinuteSystemAlert(t, "Bandwidth", 50, setBandwidthAlertValue, [2]uint64{megabytesToBytes(26), megabytesToBytes(25)}, [2]uint64{megabytesToBytes(25), megabytesToBytes(24)})
@@ -201,11 +218,16 @@ func TestSystemAlertsOneMin(t *testing.T) {
 	testOneMinuteSystemAlert(t, "LoadAvg1", 4, setLoadAvgAlertValue, [3]float64{4.1, 0, 0}, [3]float64{3.9, 0, 0})
 	testOneMinuteSystemAlert(t, "LoadAvg5", 4, setLoadAvgAlertValue, [3]float64{0, 4.1, 0}, [3]float64{0, 3.9, 0})
 	testOneMinuteSystemAlert(t, "LoadAvg15", 4, setLoadAvgAlertValue, [3]float64{0, 0, 4.1}, [3]float64{0, 0, 3.9})
-	testOneMinuteSystemAlert(t, "Battery", 20, setBatteryAlertValue, [2]uint8{19, 0}, [2]uint8{21, 0})
+	testOneMinuteSystemAlert(t, "Battery", 20, setBatteryAlertValue, [2]uint8{0, 1}, [2]uint8{21, 0})
 }
 
 func TestSystemAlertsTwoMin(t *testing.T) {
 	testMultiMinuteSystemAlert(t, "CPU", 50, 2, setCPUAlertValue, 10, 51, 48)
+	for _, test := range cpuStateAlertTests {
+		t.Run(test.name, func(t *testing.T) {
+			testMultiMinuteSystemAlert(t, test.name, 50, 2, setCPUStateAlertValue, test.baseline, test.trigger, test.resolve)
+		})
+	}
 	testMultiMinuteSystemAlert(t, "Memory", 50, 2, setMemoryAlertValue, 10, 51, 48)
 	testMultiMinuteSystemAlert(t, "Disk", 50, 2, setDiskAlertValue, 10, 51, 48)
 	testMultiMinuteSystemAlert(t, "Bandwidth", 50, 2, setBandwidthAlertValue, [2]uint64{megabytesToBytes(10), megabytesToBytes(10)}, [2]uint64{megabytesToBytes(26), megabytesToBytes(25)}, [2]uint64{megabytesToBytes(10), megabytesToBytes(10)})
@@ -216,3 +238,17 @@ func TestSystemAlertsTwoMin(t *testing.T) {
 	testMultiMinuteSystemAlert(t, "LoadAvg15", 4, 2, setLoadAvgAlertValue, [3]float64{0, 0, 2}, [3]float64{0, 0, 4.1}, [3]float64{0, 0, 3.5})
 	testMultiMinuteSystemAlert(t, "Battery", 20, 2, setBatteryAlertValue, [2]uint8{21, 0}, [2]uint8{19, 0}, [2]uint8{25, 1})
 }
+
+func TestCPUStateAlertWithoutBreakdown(t *testing.T) {
+	fixture := newSystemAlertTestFixture(t, "CPUSteal", 1, 1)
+	defer fixture.cleanup()
+
+	synctest.Test(t, func(t *testing.T) {
+		submitValue(fixture, t, []float64(nil), setCPUStateAlertValue)
+		submitValue(fixture, t, []float64{0, 0, 0, 0, 0}, setCPUStateAlertValue)
+		waitForSystemAlert(time.Second)
+
+		fixture.assertTriggered(t, false, "Alert should ignore missing CPU breakdown data")
+		assert.Zero(t, fixture.hub.TestMailer.TotalSend(), "No email should be sent without CPU breakdown data")
+	})
+}

internal/alerts/alerts_systemd.go

@@ -0,0 +1,190 @@
+package alerts
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/henrygd/beszel/internal/entities/systemd"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+// alertNameSystemdFailed is the alerts.name value for the failed systemd services alert.
+const alertNameSystemdFailed = "SystemdFailed"
+
+// maxListedServices caps how many service names are listed in a notification body.
+const maxListedServices = 10
+
+// HandleSystemdAlerts manages alerts for systemd services in the failed state.
+//
+// This is a binary state alert and fires on the first observation of a failed
+// service rather than using a delay. The agent only refreshes systemd state every
+// 10 minutes, so a shorter delay could never observe new data before expiring, and
+// that poll interval already hides services that fail and restart quickly.
+func (am *AlertManager) HandleSystemdAlerts(systemRecord *core.Record) error {
+	alerts := am.alertsCache.GetAlertsByName(systemRecord.Id, alertNameSystemdFailed)
+	if len(alerts) == 0 {
+		return nil
+	}
+
+	// State is read from the systemd_services snapshot rather than the update payload.
+	// The payload is not a reliable source here: realtime dashboard subscriptions fetch
+	// from the agent with a shorter cache time, and the agent omits systemd services from
+	// those responses, overwriting the cached payload roughly once a second while a system
+	// is being viewed. The snapshot table is only written by the full update cycle.
+	total, failed, err := am.queryServiceStates(systemRecord.Id)
+	if err != nil {
+		return err
+	}
+	if total == 0 {
+		// No rows normally means no systemd data for this system (agent without
+		// systemd, or not yet reported), which must not be treated as a recovery.
+		// Read info only in this ambiguous case. The record being saved is used
+		// instead of data because dashboard polling can replace the system's
+		// in-memory payload concurrently.
+		var currentInfo system.Info
+		if err := systemRecord.UnmarshalJSONField("info", &currentInfo); err != nil ||
+			len(currentInfo.Services) == 0 || currentInfo.Services[0] != 0 {
+			return nil
+		}
+	}
+
+	systemName := systemRecord.GetString("name")
+
+	for _, alertData := range alerts {
+		triggered := len(failed) > 0
+		// Only notify on a change of state, so a service that stays failed across
+		// cycles doesn't re-notify every update.
+		if triggered == alertData.Triggered {
+			continue
+		}
+		if err := am.sendSystemdAlert(triggered, systemName, alertData, failed); err != nil {
+			am.hub.Logger().Error("Failed to send alert", "err", err)
+		}
+	}
+	return nil
+}
+
+// queryServiceStates returns the number of services reported in the most recent update
+// for a system, and the names of those in the failed state.
+//
+// Rows are restricted to the latest update because systemd_services is upserted, never
+// pruned on change: a service that no longer exists on the host stops being reported and
+// its row keeps its last known state until the retention sweep removes it. Every row
+// written in one cycle shares a single updated timestamp, so the newest timestamp
+// identifies exactly the services the agent last reported.
+func (am *AlertManager) queryServiceStates(systemID string) (total int, failed []string, err error) {
+	var rows []struct {
+		Name  string               `db:"name"`
+		State systemd.ServiceState `db:"state"`
+	}
+	err = am.hub.DB().
+		Select("name", "state").
+		From("systemd_services").
+		Where(dbx.NewExp(
+			"system={:system} AND updated=(SELECT MAX(updated) FROM systemd_services WHERE system={:system})",
+			dbx.Params{"system": systemID},
+		)).
+		OrderBy("name").
+		All(&rows)
+	if err != nil {
+		return 0, nil, err
+	}
+	for _, row := range rows {
+		if row.State == systemd.StatusFailed {
+			failed = append(failed, row.Name)
+		}
+	}
+	return len(rows), failed, nil
+}
+
+// sendSystemdAlert sends a failed or recovered systemd services alert to the alert's user.
+func (am *AlertManager) sendSystemdAlert(triggered bool, systemName string, alertData CachedAlertData, failed []string) error {
+	// Update trigger state for alert record before sending alert
+	if err := am.setAlertTriggered(alertData, triggered); err != nil {
+		return err
+	}
+
+	var title, message string
+	if triggered {
+		title = fmt.Sprintf("Failed services on %s %v", systemName, "\U0001F534") // Red alert emoji
+		message = fmt.Sprintf("%s on %s: %s", pluralizeServices(len(failed)), systemName, formatServiceList(failed))
+	} else {
+		title = fmt.Sprintf("Services recovered on %s %v", systemName, "✅") // Green checkmark emoji
+		message = fmt.Sprintf("No services are in the failed state on %s.", systemName)
+	}
+
+	systemID := alertData.SystemID
+
+	return am.SendAlert(AlertMessageData{
+		UserID:   alertData.UserID,
+		SystemID: systemID,
+		Title:    title,
+		Message:  message,
+		Link:     am.hub.MakeLink("system", systemID),
+		LinkText: "View " + systemName,
+	})
+}
+
+// pluralizeServices returns a count label like "1 failed service" or "3 failed services".
+func pluralizeServices(count int) string {
+	if count == 1 {
+		return "1 failed service"
+	}
+	return fmt.Sprintf("%d failed services", count)
+}
+
+// formatServiceList joins service names, truncating long lists.
+func formatServiceList(names []string) string {
+	if len(names) <= maxListedServices {
+		return strings.Join(names, ", ")
+	}
+	remaining := len(names) - maxListedServices
+	return fmt.Sprintf("%s and %d more", strings.Join(names[:maxListedServices], ", "), remaining)
+}
+
+// resolveSystemdAlerts resolves triggered systemd alerts for systems that no longer
+// have any failed services. This clears stale state left by a hub restart.
+func resolveSystemdAlerts(app core.App) error {
+	db := app.DB()
+	var alertIds []string
+	err := db.NewQuery(`
+		SELECT a.id
+		FROM alerts a
+		JOIN systems sys ON sys.id = a.system
+		WHERE a.name = {:name}
+		AND a.triggered = true
+		AND (
+			EXISTS (
+				SELECT 1 FROM systemd_services cur
+				WHERE cur.system = a.system
+				AND cur.updated = (SELECT MAX(updated) FROM systemd_services WHERE system = a.system)
+			)
+			OR json_extract(sys.info, '$.sv[0]') = 0
+		)
+		AND NOT EXISTS (
+			SELECT 1 FROM systemd_services s
+			WHERE s.system = a.system AND s.state = {:state}
+			AND s.updated = (SELECT MAX(updated) FROM systemd_services WHERE system = a.system)
+		)
+	`).Bind(dbx.Params{
+		"name":  alertNameSystemdFailed,
+		"state": systemd.StatusFailed,
+	}).Column(&alertIds)
+	if err != nil {
+		return err
+	}
+	for _, alertId := range alertIds {
+		alert, err := app.FindRecordById("alerts", alertId)
+		if err != nil {
+			return err
+		}
+		alert.Set("triggered", false)
+		if err := app.Save(alert); err != nil {
+			return err
+		}
+	}
+	return nil
+}

internal/alerts/alerts_systemd_test.go

@@ -0,0 +1,383 @@
+//go:build testing
+
+package alerts_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/henrygd/beszel/internal/alerts"
+	systemEntity "github.com/henrygd/beszel/internal/entities/system"
+	"github.com/henrygd/beszel/internal/entities/systemd"
+	beszelTests "github.com/henrygd/beszel/internal/tests"
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// setSystemdServiceState upserts a systemd_services row mirroring the raw SQL write
+// path used by the hub (createSystemdStatsRecords), which bypasses record hooks.
+func setSystemdServiceState(t *testing.T, hub core.App, systemID, name string, state systemd.ServiceState, updated int64) {
+	t.Helper()
+
+	_, err := hub.DB().NewQuery(
+		"INSERT INTO systemd_services (id, system, name, state, sub, cpu, cpuPeak, memory, memPeak, updated) " +
+			"VALUES ({:id}, {:system}, {:name}, {:state}, 0, 0, 0, 0, 0, {:updated}) " +
+			"ON CONFLICT(id) DO UPDATE SET state = excluded.state, updated = excluded.updated",
+	).Bind(dbx.Params{
+		"id":      systemID + "-" + name,
+		"system":  systemID,
+		"name":    name,
+		"state":   state,
+		"updated": updated,
+	}).Execute()
+	require.NoError(t, err)
+}
+
+// seedServices writes a set of services into the systemd_services snapshot, which is the
+// source HandleSystemdAlerts reads from. All rows share one updated timestamp, matching
+// how the hub writes a batch in createSystemdStatsRecords.
+func seedServices(t *testing.T, hub core.App, systemID string, states ...systemd.ServiceState) {
+	t.Helper()
+	seedServicesAt(t, hub, systemID, time.Now().UTC().UnixMilli(), states...)
+}
+
+// seedServicesAt writes services with an explicit batch timestamp.
+func seedServicesAt(t *testing.T, hub core.App, systemID string, updated int64, states ...systemd.ServiceState) {
+	t.Helper()
+	for i, state := range states {
+		setSystemdServiceState(t, hub, systemID, serviceName(i), state, updated)
+	}
+}
+
+func serviceName(i int) string {
+	return string(rune('a'+i)) + ".service"
+}
+
+// systemdTestSetup creates a user with an email, a system, and a SystemdFailed alert.
+func systemdTestSetup(t *testing.T, triggered bool) (*beszelTests.TestHub, *core.Record, *core.Record) {
+	t.Helper()
+
+	hub, user := beszelTests.GetHubWithUser(t)
+
+	userSettings, err := hub.FindFirstRecordByFilter("user_settings", "user={:user}", map[string]any{"user": user.Id})
+	require.NoError(t, err)
+	userSettings.Set("settings", `{"emails":["test@example.com"],"webhooks":[]}`)
+	require.NoError(t, hub.Save(userSettings))
+
+	// "paused" avoids spawning a background updater goroutine that would outlive
+	// the test hub; these tests drive HandleSystemdAlerts directly.
+	systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "paused")
+	require.NoError(t, err)
+	system := systems[0]
+
+	alert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
+		"name":      "SystemdFailed",
+		"system":    system.Id,
+		"user":      user.Id,
+		"triggered": triggered,
+	})
+	require.NoError(t, err)
+
+	return hub, system, alert
+}
+
+func TestSystemdAlertFiresImmediately(t *testing.T) {
+	hub, system, alert := systemdTestSetup(t, false)
+	defer hub.Cleanup()
+
+	initialEmailCount := hub.TestMailer.TotalSend()
+	am := alerts.NewTestAlertManagerWithoutWorker(hub)
+
+	seedServices(t, hub, system.Id, systemd.StatusFailed, systemd.StatusActive)
+	require.NoError(t, am.HandleSystemdAlerts(system))
+
+	assert.Equal(t, initialEmailCount+1, hub.TestMailer.TotalSend(), "failed service should notify on first observation")
+
+	messages := hub.TestMailer.Messages()
+	require.NotEmpty(t, messages)
+	last := messages[len(messages)-1]
+	assert.Contains(t, last.Subject, "Failed services")
+	assert.Contains(t, last.Text, "a.service", "notification should name the failed service")
+
+	alertRecord, err := hub.FindRecordById("alerts", alert.Id)
+	require.NoError(t, err)
+	assert.True(t, alertRecord.GetBool("triggered"), "alert should be marked triggered")
+
+	// history record should be created via the alerts update hook
+	historyCount, err := hub.CountRecords("alerts_history", dbx.HashExp{"resolved": ""})
+	require.NoError(t, err)
+	assert.EqualValues(t, 1, historyCount, "should have one unresolved alert history record")
+}
+
+func TestSystemdAlertFullCycle(t *testing.T) {
+	hub, system, alert := systemdTestSetup(t, false)
+	defer hub.Cleanup()
+
+	initialEmailCount := hub.TestMailer.TotalSend()
+	am := alerts.NewTestAlertManagerWithoutWorker(hub)
+
+	// Fail, then recover.
+	seedServices(t, hub, system.Id, systemd.StatusFailed)
+	require.NoError(t, am.HandleSystemdAlerts(system))
+	seedServices(t, hub, system.Id, systemd.StatusActive)
+	require.NoError(t, am.HandleSystemdAlerts(system))
+
+	assert.Equal(t, initialEmailCount+2, hub.TestMailer.TotalSend(), "should send a failure and a recovery notification")
+
+	messages := hub.TestMailer.Messages()
+	require.Len(t, messages, 2)
+	assert.Contains(t, messages[0].Subject, "Failed services")
+	assert.Contains(t, messages[1].Subject, "Services recovered")
+
+	alertRecord, err := hub.FindRecordById("alerts", alert.Id)
+	require.NoError(t, err)
+	assert.False(t, alertRecord.GetBool("triggered"), "alert should be cleared after recovery")
+
+	// history record should be resolved
+	historyCount, err := hub.CountRecords("alerts_history", dbx.HashExp{"resolved": ""})
+	require.NoError(t, err)
+	assert.Zero(t, historyCount, "alert history record should be resolved")
+}
+
+func TestSystemdAlertSendsRecoveryWhenTriggered(t *testing.T) {
+	hub, system, alert := systemdTestSetup(t, true)
+	defer hub.Cleanup()
+
+	initialEmailCount := hub.TestMailer.TotalSend()
+	am := alerts.NewTestAlertManagerWithoutWorker(hub)
+
+	seedServices(t, hub, system.Id, systemd.StatusActive, systemd.StatusInactive)
+	require.NoError(t, am.HandleSystemdAlerts(system))
+
+	assert.Equal(t, initialEmailCount+1, hub.TestMailer.TotalSend(), "recovery notification should be sent")
+	messages := hub.TestMailer.Messages()
+	require.NotEmpty(t, messages)
+	assert.Contains(t, messages[len(messages)-1].Subject, "Services recovered")
+
+	alertRecord, err := hub.FindRecordById("alerts", alert.Id)
+	require.NoError(t, err)
+	assert.False(t, alertRecord.GetBool("triggered"), "alert should be cleared after recovery")
+}
+
+func TestSystemdAlertDoesNotResendWhileTriggered(t *testing.T) {
+	hub, system, _ := systemdTestSetup(t, true)
+	defer hub.Cleanup()
+
+	initialEmailCount := hub.TestMailer.TotalSend()
+	am := alerts.NewTestAlertManagerWithoutWorker(hub)
+
+	// Still failing across several cycles — should not re-notify.
+	for range 3 {
+		seedServices(t, hub, system.Id, systemd.StatusFailed)
+		require.NoError(t, am.HandleSystemdAlerts(system))
+	}
+
+	assert.Equal(t, initialEmailCount, hub.TestMailer.TotalSend(), "should not re-notify while still triggered")
+}
+
+func TestSystemdAlertRepeatedFailureNotifiesOnce(t *testing.T) {
+	hub, system, _ := systemdTestSetup(t, false)
+	defer hub.Cleanup()
+
+	initialEmailCount := hub.TestMailer.TotalSend()
+	am := alerts.NewTestAlertManagerWithoutWorker(hub)
+
+	for range 3 {
+		seedServices(t, hub, system.Id, systemd.StatusFailed)
+		require.NoError(t, am.HandleSystemdAlerts(system))
+	}
+
+	assert.Equal(t, initialEmailCount+1, hub.TestMailer.TotalSend(), "repeated failures should only notify once")
+}
+
+// A service that no longer exists on the host stops being reported, but its row stays
+// in systemd_services with its last known state until the retention sweep. That stale
+// row must not keep the alert triggered.
+func TestSystemdAlertIgnoresServicesNoLongerReported(t *testing.T) {
+	hub, system, alert := systemdTestSetup(t, true)
+	defer hub.Cleanup()
+
+	initialEmailCount := hub.TestMailer.TotalSend()
+	am := alerts.NewTestAlertManagerWithoutWorker(hub)
+
+	now := time.Now().UTC().UnixMilli()
+	// Older batch still holding a failed service that has since been removed.
+	setSystemdServiceState(t, hub, system.Id, "gone.service", systemd.StatusFailed, now-60_000)
+	// Current batch reports only healthy services.
+	seedServicesAt(t, hub, system.Id, now, systemd.StatusActive, systemd.StatusActive)
+
+	require.NoError(t, am.HandleSystemdAlerts(system))
+
+	assert.Equal(t, initialEmailCount+1, hub.TestMailer.TotalSend(), "stale failed row should not block recovery")
+	alertRecord, err := hub.FindRecordById("alerts", alert.Id)
+	require.NoError(t, err)
+	assert.False(t, alertRecord.GetBool("triggered"), "alert should resolve once the service stops being reported")
+}
+
+func TestResolveSystemdAlertsIgnoresStaleFailedRows(t *testing.T) {
+	hub, system, alert := systemdTestSetup(t, true)
+	defer hub.Cleanup()
+
+	now := time.Now().UTC().UnixMilli()
+	setSystemdServiceState(t, hub, system.Id, "gone.service", systemd.StatusFailed, now-60_000)
+	seedServicesAt(t, hub, system.Id, now, systemd.StatusActive)
+
+	require.NoError(t, alerts.ResolveSystemdAlerts(hub))
+
+	alertRecord, err := hub.FindRecordById("alerts", alert.Id)
+	require.NoError(t, err)
+	assert.False(t, alertRecord.GetBool("triggered"), "stale failed row should not keep the alert triggered")
+}
+
+func TestSystemdAlertNoSystemdDataIsIgnored(t *testing.T) {
+	hub, system, alert := systemdTestSetup(t, true)
+	defer hub.Cleanup()
+
+	initialEmailCount := hub.TestMailer.TotalSend()
+	am := alerts.NewTestAlertManagerWithoutWorker(hub)
+
+	// A system with no systemd_services rows (agent without systemd, or nothing
+	// reported yet) must not be treated as a recovery.
+	require.NoError(t, am.HandleSystemdAlerts(system))
+	require.NoError(t, am.HandleSystemdAlerts(system))
+
+	assert.Equal(t, initialEmailCount, hub.TestMailer.TotalSend(), "missing systemd data should not send a recovery")
+	alertRecord, err := hub.FindRecordById("alerts", alert.Id)
+	require.NoError(t, err)
+	assert.True(t, alertRecord.GetBool("triggered"), "triggered state should be preserved when data is absent")
+}
+
+func TestSystemdAlertFreshEmptySnapshotResolves(t *testing.T) {
+	hub, system, alert := systemdTestSetup(t, true)
+	defer hub.Cleanup()
+
+	initialEmailCount := hub.TestMailer.TotalSend()
+	am := alerts.NewTestAlertManagerWithoutWorker(hub)
+
+	// An explicit zero service count on the saved system record distinguishes a
+	// confirmed empty snapshot from an agent response that omitted systemd data.
+	system.Set("info", systemEntity.Info{Services: []uint16{0, 0}})
+	require.NoError(t, am.HandleSystemAlerts(system, nil))
+
+	assert.Equal(t, initialEmailCount+1, hub.TestMailer.TotalSend(), "fresh empty snapshot should send a recovery")
+	alertRecord, err := hub.FindRecordById("alerts", alert.Id)
+	require.NoError(t, err)
+	assert.False(t, alertRecord.GetBool("triggered"), "fresh empty snapshot should resolve the alert")
+}
+
+func TestSystemdAlertNoAlertRecord(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "paused")
+	require.NoError(t, err)
+	system := systems[0]
+
+	initialEmailCount := hub.TestMailer.TotalSend()
+	am := alerts.NewTestAlertManagerWithoutWorker(hub)
+
+	seedServices(t, hub, system.Id, systemd.StatusFailed)
+	require.NoError(t, am.HandleSystemdAlerts(system))
+	assert.Equal(t, initialEmailCount, hub.TestMailer.TotalSend(), "no email when no alert record exists")
+}
+
+func TestResolveSystemdAlertsClearsStaleTriggered(t *testing.T) {
+	hub, system, alert := systemdTestSetup(t, true)
+	defer hub.Cleanup()
+
+	// No failed services in the snapshot, but the alert is still marked triggered
+	// (e.g. the hub restarted while the alert was active).
+	setSystemdServiceState(t, hub, system.Id, "a.service", systemd.StatusActive, time.Now().UTC().UnixMilli())
+
+	require.NoError(t, alerts.ResolveSystemdAlerts(hub))
+
+	alertRecord, err := hub.FindRecordById("alerts", alert.Id)
+	require.NoError(t, err)
+	assert.False(t, alertRecord.GetBool("triggered"), "stale triggered flag should be cleared")
+}
+
+func TestResolveSystemdAlertsKeepsTriggeredWithoutSystemdData(t *testing.T) {
+	hub, _, alert := systemdTestSetup(t, true)
+	defer hub.Cleanup()
+
+	// Missing rows do not prove recovery. This can happen when a system is offline
+	// and its last service snapshot has been removed by retention.
+	require.NoError(t, alerts.ResolveSystemdAlerts(hub))
+
+	alertRecord, err := hub.FindRecordById("alerts", alert.Id)
+	require.NoError(t, err)
+	assert.True(t, alertRecord.GetBool("triggered"), "missing systemd data should preserve triggered state")
+}
+
+func TestResolveSystemdAlertsClearsConfirmedEmptySnapshot(t *testing.T) {
+	hub, system, alert := systemdTestSetup(t, true)
+	defer hub.Cleanup()
+
+	// Update the persisted snapshot directly so record hooks don't alter alert state
+	// before the startup resolver is exercised.
+	_, err := hub.DB().NewQuery(
+		"UPDATE systems SET info = {:info} WHERE id = {:id}",
+	).Bind(dbx.Params{"info": `{"sv":[0,0]}`, "id": system.Id}).Execute()
+	require.NoError(t, err)
+	require.NoError(t, alerts.ResolveSystemdAlerts(hub))
+
+	alertRecord, err := hub.FindRecordById("alerts", alert.Id)
+	require.NoError(t, err)
+	assert.False(t, alertRecord.GetBool("triggered"), "confirmed empty snapshot should clear triggered state")
+}
+
+func TestResolveSystemdAlertsKeepsStillFailing(t *testing.T) {
+	hub, system, alert := systemdTestSetup(t, true)
+	defer hub.Cleanup()
+
+	setSystemdServiceState(t, hub, system.Id, "a.service", systemd.StatusFailed, time.Now().UTC().UnixMilli())
+
+	require.NoError(t, alerts.ResolveSystemdAlerts(hub))
+
+	alertRecord, err := hub.FindRecordById("alerts", alert.Id)
+	require.NoError(t, err)
+	assert.True(t, alertRecord.GetBool("triggered"), "alert should stay triggered while a service is still failed")
+}
+
+func TestSystemdAlertMultipleUsersRespectOwnAlerts(t *testing.T) {
+	hub, user1 := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	setStatusAlertEmail(t, hub, user1.Id, "user1@example.com")
+
+	user2, err := beszelTests.CreateUser(hub, "user2@example.com", "password")
+	require.NoError(t, err)
+	_, err = beszelTests.CreateRecord(hub, "user_settings", map[string]any{
+		"user": user2.Id,
+		"settings": map[string]any{
+			"emails":   []string{"user2@example.com"},
+			"webhooks": []string{},
+		},
+	})
+	require.NoError(t, err)
+
+	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "shared-system",
+		"users": []string{user1.Id, user2.Id},
+		"host":  "127.0.0.1",
+	})
+	require.NoError(t, err)
+
+	for _, user := range []*core.Record{user1, user2} {
+		_, err = beszelTests.CreateRecord(hub, "alerts", map[string]any{
+			"name":   "SystemdFailed",
+			"system": system.Id,
+			"user":   user.Id,
+		})
+		require.NoError(t, err)
+	}
+
+	am := alerts.NewTestAlertManagerWithoutWorker(hub)
+	seedServices(t, hub, system.Id, systemd.StatusFailed)
+	require.NoError(t, am.HandleSystemdAlerts(system))
+
+	messages := hub.TestMailer.Messages()
+	require.Len(t, messages, 2, "each user should receive their own alert")
+}

internal/alerts/alerts_test.go

@@ -15,8 +15,9 @@ import (
 )
 
 func TestAlertsHistory(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+
 	synctest.Test(t, func(t *testing.T) {
-		hub, user := beszelTests.GetHubWithUser(t)
 		defer hub.Cleanup()
 
 		// Create systems and alerts

internal/alerts/alerts_test_helpers.go

@@ -88,6 +88,10 @@ func ResolveStatusAlerts(app core.App) error {
 	return resolveStatusAlerts(app)
 }
 
+func ResolveSystemdAlerts(app core.App) error {
+	return resolveSystemdAlerts(app)
+}
+
 func (am *AlertManager) RestorePendingStatusAlerts() error {
 	return am.restorePendingStatusAlerts()
 }
@@ -96,6 +100,7 @@ func (am *AlertManager) SetAlertTriggered(alert CachedAlertData, triggered bool)
 	return am.setAlertTriggered(alert, triggered)
 }
 
-func IsInternalURL(rawURL string) (bool, error) {
-	return isInternalURL(rawURL)
+// BuildContainerLogExcerpt exposes buildContainerLogExcerpt for testing.
+func BuildContainerLogExcerpt(raw string) string {
+	return buildContainerLogExcerpt(raw)
 }

internal/alerts/alerts_webhooks_test.go

@@ -0,0 +1,66 @@
+//go:build testing
+
+package alerts_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+
+	"github.com/henrygd/beszel/internal/alerts"
+	beszelTests "github.com/henrygd/beszel/internal/tests"
+	"github.com/pocketbase/dbx"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPersistedWebhooksUseCurrentOwnerRole(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+	am := alerts.NewTestAlertManagerWithoutWorker(hub)
+
+	var delivered atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		delivered.Add(1)
+	}))
+	defer server.Close()
+
+	settings, err := hub.FindFirstRecordByFilter("user_settings", "user={:user}", dbx.Params{"user": user.Id})
+	require.NoError(t, err)
+	settings.Set("settings", alerts.UserNotificationSettings{Webhooks: []string{"generic+" + server.URL}})
+	require.NoError(t, hub.Save(settings))
+	message := alerts.AlertMessageData{UserID: user.Id, Title: "Test", Message: "Persisted webhook"}
+
+	// Keep the same URL and manager while changing roles, so cached privileges
+	// or treating previously saved URLs as trusted would fail this test.
+	for _, tc := range []struct {
+		name string
+		role string
+		want int32
+	}{
+		{"regular user", "user", 0},
+		{"readonly user", "readonly", 0},
+		{"promoted admin", "admin", 1},
+		{"demoted admin", "user", 1},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			user.Set("role", tc.role)
+			require.NoError(t, hub.Save(user))
+			// Webhook errors are logged; SendAlert continues to email delivery.
+			require.NoError(t, am.SendAlert(message))
+			require.Equal(t, tc.want, delivered.Load())
+		})
+	}
+
+	t.Run("missing owner fails closed", func(t *testing.T) {
+		// Model an orphaned settings record without deleting it through the
+		// normal user deletion cascade.
+		const missingOwner = "missingowner123"
+		settings.Set("user", missingOwner)
+		require.NoError(t, hub.SaveNoValidate(settings))
+		message.UserID = missingOwner
+		err := am.SendAlert(message)
+		require.ErrorContains(t, err, "load notification owner")
+		require.EqualValues(t, 1, delivered.Load())
+	})
+}

internal/alerts/alerts_zfs.go

@@ -0,0 +1,145 @@
+package alerts
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+// handleZfsPoolAlert sends alerts when a ZFS pool health state worsens and
+// resolves the alert history entry when the pool recovers. Like the SMART
+// hook, this is automatic and does not require user opt-in.
+func (am *AlertManager) handleZfsPoolAlert(e *core.RecordEvent) error {
+	return am.handleZfsPoolHealthAlert(e, e.Record.Original().GetString("health"))
+}
+
+func (am *AlertManager) handleZfsPoolCreateAlert(e *core.RecordEvent) error {
+	return am.handleZfsPoolHealthAlert(e, "")
+}
+
+func (am *AlertManager) handleZfsPoolHealthAlert(e *core.RecordEvent, oldHealth string) error {
+	newHealth := e.Record.GetString("health")
+	oldSeverity := zfsPoolSeverity(oldHealth)
+	newSeverity := zfsPoolSeverity(newHealth)
+
+	systemID := e.Record.GetString("system")
+	if systemID == "" {
+		return e.Next()
+	}
+
+	systemRecord, err := e.App.FindRecordById("systems", systemID)
+	if err != nil {
+		e.App.Logger().Error("Failed to find system for ZFS alert", "err", err, "systemID", systemID)
+		return e.Next()
+	}
+
+	// Pool recovered to a healthy state: resolve any open history entries.
+	if newSeverity == 1 && oldSeverity > 1 {
+		resolveAllAlertHistoryRecords(e.App, e.Record.Id)
+		return e.Next()
+	}
+
+	if !shouldSendZfsPoolAlert(oldSeverity, newSeverity) {
+		return e.Next()
+	}
+
+	systemName := systemRecord.GetString("name")
+	poolName := e.Record.GetString("display_name")
+	if poolName == "" {
+		poolName = e.Record.GetString("name")
+	}
+
+	title := fmt.Sprintf("Storage pool %s on %s: %s", newHealth, systemName, poolName)
+	message := fmt.Sprintf("Storage pool %s (%s) was first observed as %s", poolName, systemName, newHealth)
+	if oldSeverity > 0 {
+		message = fmt.Sprintf("Storage pool %s (%s) health changed from %s to %s", poolName, systemName, oldHealth, newHealth)
+	}
+
+	userIDs := systemRecord.GetStringSlice("users")
+	if len(userIDs) == 0 {
+		return e.Next()
+	}
+
+	for _, userID := range userIDs {
+		if err := am.SendAlert(AlertMessageData{
+			UserID:   userID,
+			SystemID: systemID,
+			Title:    title,
+			Message:  message,
+			Link:     am.hub.MakeLink("system", systemID),
+			LinkText: "View " + systemName,
+		}); err != nil {
+			e.App.Logger().Error("Failed to send ZFS alert", "err", err, "userID", userID)
+		}
+		_ = createZfsPoolHistoryRecord(e.App, userID, systemID, e.Record.Id, poolName)
+	}
+
+	return e.Next()
+}
+
+// resolveZfsPoolHistoryOnDelete resolves open alert history entries when a
+// pool record is deleted (manually or because the pool disappeared), so the
+// UI does not keep showing an ongoing alert for a pool that no longer exists.
+func resolveZfsPoolHistoryOnDelete(e *core.RecordEvent) error {
+	resolveAllAlertHistoryRecords(e.App, e.Record.Id)
+	return e.Next()
+}
+
+// shouldSendZfsPoolAlert reports whether a health transition warrants an alert.
+// First observations of unhealthy pools and worsening transitions are reported.
+func shouldSendZfsPoolAlert(oldSeverity, newSeverity int) bool {
+	return newSeverity > 1 && (oldSeverity == 0 || newSeverity > oldSeverity)
+}
+
+// zfsPoolSeverity ranks pool health states: healthy (1), degraded (2),
+// failed/unavailable (3), unknown (0).
+func zfsPoolSeverity(health string) int {
+	switch health {
+	case "ONLINE":
+		return 1
+	case "DEGRADED":
+		return 2
+	case "FAULTED", "OFFLINE", "UNAVAIL", "REMOVED", "SUSPENDED":
+		return 3
+	default:
+		return 0
+	}
+}
+
+// createZfsPoolHistoryRecord logs a pool health alert in the alerts history so
+// it is visible in the UI without creating an editable alert configuration.
+func createZfsPoolHistoryRecord(app core.App, userID, systemID, alertID, poolName string) error {
+	collection, err := app.FindCachedCollectionByNameOrId("alerts_history")
+	if err != nil {
+		return err
+	}
+	record := core.NewRecord(collection)
+	record.Set("user", userID)
+	record.Set("system", systemID)
+	record.Set("alert_id", alertID)
+	record.Set("name", "Storage Pool: "+poolName)
+	return app.Save(record)
+}
+
+// resolveAllAlertHistoryRecords resolves every open history entry for an alert
+// record id (one per system user).
+func resolveAllAlertHistoryRecords(app core.App, alertID string) {
+	records, err := app.FindRecordsByFilter(
+		"alerts_history",
+		"alert_id={:alert_id} && resolved=null",
+		"", 0, 0,
+		dbx.Params{"alert_id": alertID},
+	)
+	if err != nil || len(records) == 0 {
+		return
+	}
+	now := time.Now().UTC()
+	for _, record := range records {
+		record.Set("resolved", now)
+		if err := app.Save(record); err != nil {
+			app.Logger().Error("Failed to resolve ZFS alert history", "err", err, "recordId", record.Id)
+		}
+	}
+}

internal/alerts/alerts_zfs_disk_test.go

@@ -0,0 +1,179 @@
+//go:build testing
+
+package alerts_test
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/henrygd/beszel/internal/entities/system"
+	beszelTests "github.com/henrygd/beszel/internal/tests"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestDiskAlertZfsPoolMultiMinute verifies that ZFS pool usage participates in
+// the Disk threshold alert using historical per-minute values, mirroring the
+// extra-filesystem behavior.
+func TestDiskAlertZfsPoolMultiMinute(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
+	require.NoError(t, err)
+	systemRecord := systems[0]
+
+	diskAlert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
+		"name":   "Disk",
+		"system": systemRecord.Id,
+		"user":   user.Id,
+		"value":  80, // threshold: 80%
+		"min":    2,  // requires historical averaging
+	})
+	require.NoError(t, err)
+
+	am := hub.GetAlertManager()
+	now := time.Now().UTC()
+
+	poolHigh := map[string]*system.ZfsPool{
+		"tank": {Total: 1000, Used: 920}, // 92% - above threshold
+	}
+
+	recordTimes := []time.Duration{
+		-180 * time.Second,
+		-90 * time.Second,
+		-60 * time.Second,
+		-30 * time.Second,
+	}
+
+	for _, offset := range recordTimes {
+		stats := system.Stats{
+			DiskPct:  30, // root disk at 30% - below threshold
+			ZfsPools: poolHigh,
+		}
+		statsJSON, _ := json.Marshal(stats)
+
+		recordTime := now.Add(offset)
+		record, err := beszelTests.CreateRecord(hub, "system_stats", map[string]any{
+			"system": systemRecord.Id,
+			"type":   "1m",
+			"stats":  string(statsJSON),
+		})
+		require.NoError(t, err)
+		record.SetRaw("created", recordTime.Format(types.DefaultDateLayout))
+		err = hub.SaveNoValidate(record)
+		require.NoError(t, err)
+	}
+
+	combinedDataHigh := &system.CombinedData{
+		Stats: system.Stats{
+			DiskPct:  30,
+			ZfsPools: poolHigh,
+		},
+		Info: system.Info{
+			DiskPct: 30,
+		},
+	}
+
+	systemRecord.Set("updated", now)
+	err = hub.SaveNoValidate(systemRecord)
+	require.NoError(t, err)
+
+	err = am.HandleSystemAlerts(systemRecord, combinedDataHigh)
+	require.NoError(t, err)
+
+	time.Sleep(20 * time.Millisecond)
+
+	diskAlert, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": diskAlert.Id})
+	require.NoError(t, err)
+	assert.True(t, diskAlert.GetBool("triggered"),
+		"Alert should be triggered when ZFS pool average (92%%) exceeds threshold (80%%)")
+
+	// --- Resolution: pool drops to 50%, alert should resolve ---
+
+	poolLow := map[string]*system.ZfsPool{
+		"tank": {Total: 1000, Used: 500}, // 50% - below threshold
+	}
+
+	newNow := now.Add(2 * time.Minute)
+	for _, offset := range recordTimes {
+		stats := system.Stats{
+			DiskPct:  30,
+			ZfsPools: poolLow,
+		}
+		statsJSON, _ := json.Marshal(stats)
+
+		recordTime := newNow.Add(offset)
+		record, err := beszelTests.CreateRecord(hub, "system_stats", map[string]any{
+			"system": systemRecord.Id,
+			"type":   "1m",
+			"stats":  string(statsJSON),
+		})
+		require.NoError(t, err)
+		record.SetRaw("created", recordTime.Format(types.DefaultDateLayout))
+		err = hub.SaveNoValidate(record)
+		require.NoError(t, err)
+	}
+
+	combinedDataLow := &system.CombinedData{
+		Stats: system.Stats{
+			DiskPct:  30,
+			ZfsPools: poolLow,
+		},
+		Info: system.Info{
+			DiskPct: 30,
+		},
+	}
+
+	systemRecord.Set("updated", newNow)
+	err = hub.SaveNoValidate(systemRecord)
+	require.NoError(t, err)
+
+	err = am.HandleSystemAlerts(systemRecord, combinedDataLow)
+	require.NoError(t, err)
+
+	time.Sleep(20 * time.Millisecond)
+
+	diskAlert, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": diskAlert.Id})
+	require.NoError(t, err)
+	assert.False(t, diskAlert.GetBool("triggered"),
+		"Alert should be resolved when ZFS pool average (50%%) drops below threshold (80%%)")
+}
+
+func TestDiskAlertIgnoresRawPool(t *testing.T) {
+	for _, minutes := range []int{0, 2} {
+		hub, user := beszelTests.GetHubWithUser(t)
+		systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
+		require.NoError(t, err)
+		alert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{"name": "Disk", "system": systems[0].Id, "user": user.Id, "value": 80, "min": minutes})
+		require.NoError(t, err)
+		pools := map[string]*system.ZfsPool{"btrfs": {Total: 100, Used: 99, Raw: true}}
+		for _, offset := range []time.Duration{-180, -90, -60, -30} {
+			data, err := json.Marshal(system.Stats{ZfsPools: pools})
+			require.NoError(t, err)
+			record, err := beszelTests.CreateRecord(hub, "system_stats", map[string]any{"system": systems[0].Id, "type": "1m", "stats": string(data)})
+			require.NoError(t, err)
+			record.SetRaw("created", time.Now().UTC().Add(offset*time.Second).Format(types.DefaultDateLayout))
+			require.NoError(t, hub.SaveNoValidate(record))
+		}
+		require.NoError(t, hub.GetAlertManager().HandleSystemAlerts(systems[0], &system.CombinedData{Stats: system.Stats{ZfsPools: pools}}))
+		time.Sleep(20 * time.Millisecond)
+		record, err := hub.FindRecordById("alerts", alert.Id)
+		require.NoError(t, err)
+		assert.False(t, record.GetBool("triggered"))
+		if minutes > 0 {
+			// A current usable sample must not make raw historical values eligible.
+			pools["btrfs"].Raw = false
+			require.NoError(t, hub.GetAlertManager().HandleSystemAlerts(systems[0], &system.CombinedData{Stats: system.Stats{ZfsPools: pools}}))
+			time.Sleep(20 * time.Millisecond)
+			record, err = hub.FindRecordById("alerts", alert.Id)
+			require.NoError(t, err)
+			assert.False(t, record.GetBool("triggered"))
+		}
+		hub.Cleanup()
+	}
+}

internal/alerts/alerts_zfs_key_test.go

@@ -0,0 +1,15 @@
+//go:build testing
+
+package alerts
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestZfsDiskAlertKeyIsNamespaced(t *testing.T) {
+	assert.Equal(t, "zfs:tank", zfsDiskAlertKey("tank"))
+	assert.Equal(t, "Usage of storage pool tank", diskAlertDescriptor(zfsDiskAlertKey("tank")))
+	assert.Equal(t, "Usage of tank", diskAlertDescriptor("tank"))
+}

internal/alerts/alerts_zfs_test.go

@@ -0,0 +1,292 @@
+//go:build testing
+
+package alerts_test
+
+import (
+	"testing"
+	"time"
+
+	beszelTests "github.com/henrygd/beszel/internal/tests"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestZfsPoolAlertOnlineToDegraded(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "test-system",
+		"users": []string{user.Id},
+		"host":  "127.0.0.1",
+	})
+	assert.NoError(t, err)
+
+	pool, err := beszelTests.CreateRecord(hub, "zfs_pools", map[string]any{
+		"system": system.Id,
+		"name":   "tank",
+		"health": "ONLINE",
+	})
+	assert.NoError(t, err)
+
+	// Re-fetch so PocketBase tracks original values
+	pool, err = hub.FindRecordById("zfs_pools", pool.Id)
+	assert.NoError(t, err)
+
+	pool.Set("health", "DEGRADED")
+	err = hub.Save(pool)
+	assert.NoError(t, err)
+
+	time.Sleep(50 * time.Millisecond)
+
+	assert.EqualValues(t, 1, hub.TestMailer.TotalSend(), "should have 1 email sent after pool became DEGRADED")
+	lastMessage := hub.TestMailer.LastMessage()
+	assert.Contains(t, lastMessage.Subject, "Storage pool DEGRADED on test-system")
+	assert.Contains(t, lastMessage.Subject, "tank")
+	assert.Contains(t, lastMessage.Text, "ONLINE to DEGRADED")
+}
+
+func TestZfsPoolAlertDegradedToFaulted(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "test-system",
+		"users": []string{user.Id},
+		"host":  "127.0.0.1",
+	})
+	assert.NoError(t, err)
+
+	pool, err := beszelTests.CreateRecord(hub, "zfs_pools", map[string]any{
+		"system": system.Id,
+		"name":   "rpool",
+		"health": "DEGRADED",
+	})
+	assert.NoError(t, err)
+
+	pool, err = hub.FindRecordById("zfs_pools", pool.Id)
+	assert.NoError(t, err)
+
+	pool.Set("health", "FAULTED")
+	err = hub.Save(pool)
+	assert.NoError(t, err)
+
+	time.Sleep(50 * time.Millisecond)
+
+	assert.EqualValues(t, 2, hub.TestMailer.TotalSend(), "should alert on initial DEGRADED state and later FAULTED transition")
+	lastMessage := hub.TestMailer.LastMessage()
+	assert.Contains(t, lastMessage.Subject, "Storage pool FAULTED on test-system")
+}
+
+func TestZfsPoolAlertNoAlertOnRecovery(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "test-system",
+		"users": []string{user.Id},
+		"host":  "127.0.0.1",
+	})
+	assert.NoError(t, err)
+
+	pool, err := beszelTests.CreateRecord(hub, "zfs_pools", map[string]any{
+		"system": system.Id,
+		"name":   "tank",
+		"health": "DEGRADED",
+	})
+	assert.NoError(t, err)
+
+	// Trigger a worsening alert first
+	pool, err = hub.FindRecordById("zfs_pools", pool.Id)
+	assert.NoError(t, err)
+	pool.Set("health", "FAULTED")
+	err = hub.Save(pool)
+	assert.NoError(t, err)
+	time.Sleep(50 * time.Millisecond)
+	assert.EqualValues(t, 2, hub.TestMailer.TotalSend(), "expected alerts for initial DEGRADED state and DEGRADED -> FAULTED")
+
+	// Recovery back to ONLINE must not send a new alert
+	pool, err = hub.FindRecordById("zfs_pools", pool.Id)
+	assert.NoError(t, err)
+	pool.Set("health", "ONLINE")
+	err = hub.Save(pool)
+	assert.NoError(t, err)
+	time.Sleep(50 * time.Millisecond)
+	assert.EqualValues(t, 2, hub.TestMailer.TotalSend(), "recovery should not send a new alert")
+
+	// And the open history entry should have been resolved
+	history, err := hub.FindRecordsByFilter("alerts_history", "alert_id={:alert_id}", "", 0, 0, map[string]any{"alert_id": pool.Id})
+	assert.NoError(t, err)
+	requireHistoryResolved(t, history)
+}
+
+func TestZfsPoolAlertUnknownHealthDoesNotResolve(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "test-system",
+		"users": []string{user.Id},
+		"host":  "127.0.0.1",
+	})
+	require.NoError(t, err)
+
+	pool, err := beszelTests.CreateRecord(hub, "zfs_pools", map[string]any{
+		"system": system.Id,
+		"name":   "tank",
+		"health": "DEGRADED",
+	})
+	require.NoError(t, err)
+	time.Sleep(50 * time.Millisecond)
+
+	pool, err = hub.FindRecordById("zfs_pools", pool.Id)
+	require.NoError(t, err)
+	pool.Set("health", "")
+	require.NoError(t, hub.Save(pool))
+	time.Sleep(50 * time.Millisecond)
+
+	history, err := hub.FindRecordsByFilter("alerts_history", "alert_id={:alert_id} && resolved=null", "", 0, 0, map[string]any{"alert_id": pool.Id})
+	require.NoError(t, err)
+	require.Len(t, history, 1, "unknown health must not resolve an active alert")
+}
+
+func TestZfsPoolAlertUnknownToFaulted(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "test-system",
+		"users": []string{user.Id},
+		"host":  "127.0.0.1",
+	})
+	assert.NoError(t, err)
+
+	pool, err := beszelTests.CreateRecord(hub, "zfs_pools", map[string]any{
+		"system": system.Id,
+		"name":   "tank",
+		"health": "",
+	})
+	assert.NoError(t, err)
+
+	pool, err = hub.FindRecordById("zfs_pools", pool.Id)
+	assert.NoError(t, err)
+
+	pool.Set("health", "FAULTED")
+	err = hub.Save(pool)
+	assert.NoError(t, err)
+
+	time.Sleep(50 * time.Millisecond)
+
+	assert.EqualValues(t, 1, hub.TestMailer.TotalSend(), "should alert when a previously unknown pool becomes FAULTED")
+}
+
+func TestZfsPoolAlertOnInitialUnhealthyState(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "test-system",
+		"users": []string{user.Id},
+		"host":  "127.0.0.1",
+	})
+	require.NoError(t, err)
+
+	pool, err := beszelTests.CreateRecord(hub, "zfs_pools", map[string]any{
+		"system": system.Id,
+		"name":   "tank",
+		"health": "DEGRADED",
+	})
+	require.NoError(t, err)
+	time.Sleep(50 * time.Millisecond)
+
+	require.EqualValues(t, 1, hub.TestMailer.TotalSend())
+	assert.Contains(t, hub.TestMailer.LastMessage().Text, "first observed as DEGRADED")
+
+	pool, err = hub.FindRecordById("zfs_pools", pool.Id)
+	require.NoError(t, err)
+	require.NoError(t, hub.Save(pool))
+	time.Sleep(50 * time.Millisecond)
+	assert.EqualValues(t, 1, hub.TestMailer.TotalSend(), "unchanged unhealthy health must not duplicate alerts")
+}
+
+func TestZfsPoolAlertWritesHistory(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "test-system",
+		"users": []string{user.Id},
+		"host":  "127.0.0.1",
+	})
+	assert.NoError(t, err)
+
+	pool, err := beszelTests.CreateRecord(hub, "zfs_pools", map[string]any{
+		"system": system.Id,
+		"name":   "tank",
+		"health": "ONLINE",
+	})
+	assert.NoError(t, err)
+
+	pool, err = hub.FindRecordById("zfs_pools", pool.Id)
+	assert.NoError(t, err)
+	pool.Set("health", "FAULTED")
+	err = hub.Save(pool)
+	assert.NoError(t, err)
+
+	time.Sleep(50 * time.Millisecond)
+
+	history, err := hub.FindRecordsByFilter("alerts_history", "alert_id={:alert_id}", "", 0, 0, map[string]any{"alert_id": pool.Id})
+	assert.NoError(t, err)
+	require.Len(t, history, 1, "expected one history entry per user")
+	assert.Equal(t, "Storage Pool: tank", history[0].GetString("name"))
+	assert.Equal(t, system.Id, history[0].GetString("system"))
+}
+
+func TestZfsPoolAlertResolvedOnRecordDelete(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "test-system",
+		"users": []string{user.Id},
+		"host":  "127.0.0.1",
+	})
+	assert.NoError(t, err)
+
+	pool, err := beszelTests.CreateRecord(hub, "zfs_pools", map[string]any{
+		"system": system.Id,
+		"name":   "tank",
+		"health": "ONLINE",
+	})
+	assert.NoError(t, err)
+
+	// Trigger an alert so an open history entry exists.
+	pool, err = hub.FindRecordById("zfs_pools", pool.Id)
+	assert.NoError(t, err)
+	pool.Set("health", "FAULTED")
+	err = hub.Save(pool)
+	assert.NoError(t, err)
+	time.Sleep(50 * time.Millisecond)
+
+	history, err := hub.FindRecordsByFilter("alerts_history", "alert_id={:alert_id} && resolved=null", "", 0, 0, map[string]any{"alert_id": pool.Id})
+	assert.NoError(t, err)
+	require.Len(t, history, 1, "expected one open history entry")
+
+	// Deleting the pool record must resolve the open entry.
+	err = hub.Delete(pool)
+	assert.NoError(t, err)
+	time.Sleep(50 * time.Millisecond)
+
+	history, err = hub.FindRecordsByFilter("alerts_history", "alert_id={:alert_id}", "", 0, 0, map[string]any{"alert_id": pool.Id})
+	assert.NoError(t, err)
+	require.Len(t, history, 1)
+	requireHistoryResolved(t, history)
+}
+
+func requireHistoryResolved(t *testing.T, history []*core.Record) {
+	t.Helper()
+	for _, record := range history {
+		assert.False(t, record.GetDateTime("resolved").Time().IsZero(), "expected history entry to be resolved")
+	}
+}

internal/alerts/notification_client.go

@@ -0,0 +1,150 @@
+package alerts
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/netip"
+	"sync/atomic"
+	"syscall"
+	"time"
+
+	"github.com/nicholas-fedor/shoutrrr/pkg/router"
+	"github.com/nicholas-fedor/shoutrrr/pkg/types"
+)
+
+var (
+	errInternalDestination   = errors.New("Only admins can send to internal destinations")
+	errUnrestrictedService   = errors.New("Only admins can use this notification service") // Restrict services w/o custom connection support
+	publicNotificationDialer = &net.Dialer{
+		Timeout: 10 * time.Second,
+		// Control checks each resolved address immediately before connecting.
+		Control: func(_, address string, _ syscall.RawConn) error { return checkNotificationAddress(address) },
+	}
+	publicNotificationClient = newPublicNotificationClient()
+)
+
+func newPublicNotificationClient() *http.Client {
+	return &http.Client{
+		Timeout: 15 * time.Second,
+		Transport: &http.Transport{
+			// Do not use proxies: they can resolve the target themselves and
+			// bypass the destination check on our socket.
+			DialContext:         publicNotificationDialer.DialContext,
+			TLSHandshakeTimeout: 10 * time.Second,
+			IdleConnTimeout:     90 * time.Second,
+		},
+	}
+}
+
+func checkNotificationAddress(address string) error {
+	addr, err := netip.ParseAddrPort(address)
+	if err != nil || addr.Addr().Zone() != "" {
+		return errInternalDestination
+	}
+	ip := net.IP(addr.Addr().AsSlice())
+	if !ip.IsGlobalUnicast() || isInternalIP(ip) {
+		return errInternalDestination
+	}
+	return nil
+}
+
+func sendPublicNotification(rawURL, message string) error {
+	client := &notificationClient{Client: publicNotificationClient}
+	service, err := newPublicNotificationService(rawURL, types.SenderOptions{HTTPClient: client, DialContext: client.dialContext})
+	if err == nil {
+		if closer, ok := service.(io.Closer); ok {
+			defer closer.Close()
+		}
+		err = service.Send(message, &types.Params{})
+	}
+	// Some services format errors without preserving their error chain.
+	if client.blocked.Load() {
+		return errInternalDestination
+	}
+	return err
+}
+
+type notificationClient struct {
+	*http.Client
+	blocked atomic.Bool
+}
+
+func (c *notificationClient) Do(req *http.Request) (*http.Response, error) {
+	response, err := c.Client.Do(req)
+	if errors.Is(err, errInternalDestination) {
+		c.blocked.Store(true)
+	}
+	return response, err
+}
+
+func (c *notificationClient) dialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	conn, err := publicNotificationDialer.DialContext(ctx, network, address)
+	if errors.Is(err, errInternalDestination) {
+		c.blocked.Store(true)
+	}
+	return conn, err
+}
+
+func newPublicNotificationService(rawURL string, opts types.SenderOptions) (types.Service, error) {
+	r := &router.ServiceRouter{}
+	scheme, serviceURL, err := r.ExtractServiceName(rawURL)
+	if err != nil {
+		return nil, err
+	}
+	service, err := r.NewService(scheme)
+	if err != nil {
+		return nil, err
+	}
+	httpSetter, httpOK := service.(types.HTTPClientSetter)
+	dialSetter, dialOK := service.(types.DialContextSetter)
+	if (!httpOK || opts.HTTPClient == nil) && (!dialOK || opts.DialContext == nil) {
+		return nil, errUnrestrictedService
+	}
+	if serviceURL.Scheme != scheme {
+		custom, ok := service.(types.CustomURLService)
+		if !ok {
+			return nil, fmt.Errorf("%w: %s", router.ErrCustomURLsNotSupported, scheme)
+		}
+		serviceURL, err = custom.GetServiceURLFromCustom(serviceURL)
+		if err != nil {
+			return nil, err
+		}
+	}
+	// Shoutrrr v0.20.0 CreateSenderWithOptions injects only AFTER Initialize.
+	// Matrix can log in during Initialize, so inject before it as well.
+	if httpOK {
+		httpSetter.SetHTTPClient(opts.HTTPClient)
+	}
+	if dialOK {
+		dialSetter.SetDialContext(opts.DialContext)
+	}
+	if err := service.Initialize(serviceURL, nil); err != nil {
+		return nil, err
+	}
+	// Some initializers replace their HTTP client with a default client.
+	if httpOK {
+		httpSetter.SetHTTPClient(opts.HTTPClient)
+	}
+	if dialOK {
+		dialSetter.SetDialContext(opts.DialContext)
+	}
+	return service, nil
+}
+
+var cgnatNetwork = &net.IPNet{
+	IP:   net.IPv4(100, 64, 0, 0),
+	Mask: net.CIDRMask(10, 32),
+}
+
+func isInternalIP(ip net.IP) bool {
+	return ip.IsPrivate() ||
+		ip.IsLoopback() ||
+		ip.IsUnspecified() ||
+		ip.IsLinkLocalUnicast() ||
+		ip.IsMulticast() ||
+		cgnatNetwork.Contains(ip)
+}

internal/alerts/notification_client_test.go

@@ -0,0 +1,217 @@
+package alerts
+
+import (
+	"context"
+	"encoding/binary"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	"github.com/nicholas-fedor/shoutrrr/pkg/types"
+	"golang.org/x/net/dns/dnsmessage"
+)
+
+func TestCheckNotificationAddress(t *testing.T) {
+	for _, host := range []string{"127.0.0.1", "10.0.0.1", "172.16.0.1", "192.168.0.1", "169.254.169.254", "100.64.0.0", "100.127.255.255", "0.0.0.0", "224.0.0.1", "255.255.255.255", "::1", "::", "fc00::1", "fe80::1", "ff02::1", "::ffff:127.0.0.1", "::ffff:169.254.169.254", "fe80::1%lo", "localhost", "consul"} {
+		t.Run(host, func(t *testing.T) {
+			if err := checkNotificationAddress(net.JoinHostPort(host, "80")); !errors.Is(err, errInternalDestination) {
+				t.Fatalf("expected blocked address, got %v", err)
+			}
+		})
+	}
+	for _, host := range []string{"8.8.8.8", "100.63.255.255", "100.128.0.0", "2001:4860:4860::8888"} {
+		if err := checkNotificationAddress(net.JoinHostPort(host, "443")); err != nil {
+			t.Errorf("public address %s: %v", host, err)
+		}
+	}
+}
+
+func TestPublicNotificationBlocksInternalRequests(t *testing.T) {
+	var hits atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hits.Add(1)
+	}))
+	defer server.Close()
+	host := strings.TrimPrefix(server.URL, "http://")
+	for _, rawURL := range []string{
+		"generic+http://" + host,
+		"generic+https://" + host,
+		"generic+http://localhost:" + strings.Split(host, ":")[1],
+		"matrix://user:password@" + host + "/room?disabletls=yes",
+		"mattermost://" + host + "/token?disabletls=yes",
+	} {
+		t.Run(rawURL, func(t *testing.T) {
+			if err := sendPublicNotification(rawURL, "test"); !errors.Is(err, errInternalDestination) {
+				t.Fatalf("expected internal destination error, got %v", err)
+			}
+		})
+	}
+	if hits.Load() != 0 {
+		t.Fatal("internal server received a request")
+	}
+
+}
+
+type notificationRoundTripper func(*http.Request) (*http.Response, error)
+
+func (f notificationRoundTripper) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) }
+
+func TestPublicNotificationRedirect(t *testing.T) {
+	client := newPublicNotificationClient()
+	defer client.CloseIdleConnections()
+	transport := client.Transport
+	client.Transport = notificationRoundTripper(func(r *http.Request) (*http.Response, error) {
+		if r.URL.Host == "public.example" {
+			return &http.Response{StatusCode: 307, Header: http.Header{"Location": {"http://127.0.0.1/"}}, Body: io.NopCloser(strings.NewReader("")), Request: r}, nil
+		}
+		return transport.RoundTrip(r)
+	})
+	_, err := client.Get("http://public.example/")
+	if !errors.Is(err, errInternalDestination) {
+		t.Fatalf("expected redirect to be blocked, got %v", err)
+	}
+}
+
+func TestPublicNotificationServiceClient(t *testing.T) {
+	for _, rawURL := range []string{"generic+http://public.example/path", "discord://token@123456789", "slack://hook:AAAAAAAAA-BBBBBBBBB-123456789123456789123456@webhook"} {
+		t.Run(rawURL, func(t *testing.T) {
+			var hits int
+			client := &http.Client{Transport: notificationRoundTripper(func(r *http.Request) (*http.Response, error) {
+				hits++
+				body := `{"ok":true}`
+				if strings.HasPrefix(rawURL, "slack:") {
+					body = "ok"
+				}
+				return &http.Response{StatusCode: 200, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(body)), Request: r}, nil
+			})}
+			service, err := newPublicNotificationService(rawURL, types.SenderOptions{HTTPClient: client})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := service.Send("test", &types.Params{}); err != nil {
+				t.Fatal(err)
+			}
+			if hits == 0 {
+				t.Fatal("injected client was not used")
+			}
+		})
+	}
+}
+
+func TestPublicNotificationDNS(t *testing.T) {
+	// Supply deterministic DNS responses over an in-memory TCP connection.
+	// The first lookup sees a public IP; subsequent lookups see loopback.
+	var rebound atomic.Bool
+	resolver := &net.Resolver{PreferGo: true, Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
+		client, server := net.Pipe()
+		go func() {
+			defer server.Close()
+			var size [2]byte
+			if _, err := io.ReadFull(server, size[:]); err != nil {
+				return
+			}
+			buf := make([]byte, binary.BigEndian.Uint16(size[:]))
+			if _, err := io.ReadFull(server, buf); err != nil {
+				return
+			}
+			var msg dnsmessage.Message
+			if err := msg.Unpack(buf); err != nil {
+				return
+			}
+			msg.Header.Response = true
+			msg.Header.RecursionAvailable = true
+			q := msg.Questions[0]
+			if q.Type == dnsmessage.TypeA {
+				ip := [4]byte{8, 8, 8, 8}
+				if rebound.Load() {
+					ip = [4]byte{127, 0, 0, 1}
+				}
+				msg.Answers = []dnsmessage.Resource{{Header: dnsmessage.ResourceHeader{Name: q.Name, Type: q.Type, Class: dnsmessage.ClassINET}, Body: &dnsmessage.AResource{A: ip}}}
+			}
+			buf, err := msg.Pack()
+			if err != nil {
+				return
+			}
+			binary.BigEndian.PutUint16(size[:], uint16(len(buf)))
+			server.Write(append(size[:], buf...))
+		}()
+		return client, nil
+	}}
+	// These tests do not run in parallel; restore the process resolver afterward.
+	previous := net.DefaultResolver
+	net.DefaultResolver = resolver
+	t.Cleanup(func() { net.DefaultResolver = previous })
+	ips, err := resolver.LookupIP(context.Background(), "ip4", "rebind.example")
+	if err != nil || len(ips) != 1 || !ips[0].Equal(net.IPv4(8, 8, 8, 8)) {
+		t.Fatalf("initial DNS lookup: %v, %v", ips, err)
+	}
+	rebound.Store(true)
+	client := newPublicNotificationClient()
+	defer client.CloseIdleConnections()
+	for _, host := range []string{"rebind.example", "consul"} {
+		guarded := &notificationClient{Client: client}
+		conn, dialErr := guarded.dialContext(context.Background(), "tcp", net.JoinHostPort(host, "25"))
+		if conn != nil {
+			conn.Close()
+		}
+		if !errors.Is(dialErr, errInternalDestination) || !guarded.blocked.Load() {
+			t.Errorf("expected TCP dial-time rejection for %s, got %v", host, dialErr)
+		}
+		_, err := client.Get("http://" + host + "/")
+		if !errors.Is(err, errInternalDestination) {
+			t.Errorf("expected dial-time rejection for %s, got %v", host, err)
+		}
+	}
+}
+
+func TestPublicNotificationTCP(t *testing.T) {
+	for _, rawURL := range []string{
+		"smtp://user:pass@HOST:25/?fromAddress=sender@example.com&toAddresses=recipient@example.com",
+		"smtp://user:pass@HOST:465/?fromAddress=sender@example.com&toAddresses=recipient@example.com",
+		"mqtt://HOST:1883/topic",
+		"mqtts://HOST:8883/topic",
+	} {
+		t.Run(rawURL, func(t *testing.T) {
+			t.Parallel()
+			t.Run("internal destination", func(t *testing.T) {
+				err := sendPublicNotification(strings.ReplaceAll(rawURL, "HOST", "127.0.0.1"), "test")
+				if !errors.Is(err, errInternalDestination) {
+					t.Fatalf("expected blocked destination, got %v", err)
+				}
+			})
+			t.Run("public destination uses injected dialer", func(t *testing.T) {
+				var calls atomic.Int32
+				stopped := errors.New("test dial stopped")
+				service, err := newPublicNotificationService(strings.ReplaceAll(rawURL, "HOST", "8.8.8.8"), types.SenderOptions{
+					DialContext: func(ctx context.Context, network, address string) (net.Conn, error) {
+						calls.Add(1)
+						if network != "tcp" || !strings.HasPrefix(address, "8.8.8.8:") {
+							t.Errorf("unexpected dial: %s %s", network, address)
+						}
+						if err := checkNotificationAddress(address); err != nil {
+							t.Error(err)
+						}
+						return nil, stopped
+					},
+				})
+				if err != nil {
+					t.Fatal(err)
+				}
+				if closer, ok := service.(io.Closer); ok {
+					defer closer.Close()
+				}
+				if err := service.Send("test", &types.Params{}); err == nil {
+					t.Fatal("expected dial failure")
+				}
+				if calls.Load() == 0 {
+					t.Fatal("custom dialer was not used")
+				}
+			})
+		})
+	}
+}