@mgsoftwarebv/mg-dashboard-mcp 3.7.0 → 3.10.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { spawn } from 'child_process';
-import { existsSync, statSync, readFileSync } from 'fs';
-import { join, isAbsolute } from 'path';
+import { existsSync, statSync, createReadStream, readFileSync } from 'fs';
+import { isAbsolute, join } from 'path';
 import { Client as Client$1 } from '@modelcontextprotocol/sdk/client/index.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
@@ -14,6 +14,7 @@ import { createClient } from '@supabase/supabase-js';
 import { readFile, mkdtemp, writeFile, rm } from 'fs/promises';
 import { tmpdir } from 'os';
 import { Client } from 'ssh2';
+import { ListObjectsV2Command, DeleteObjectsCommand, DeleteObjectCommand, CreateMultipartUploadCommand, UploadPartCommand, CompleteMultipartUploadCommand, AbortMultipartUploadCommand, PutObjectCommand, HeadObjectCommand, GetObjectCommand, S3Client } from '@aws-sdk/client-s3';
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -1212,8 +1213,6 @@ LinkedIn: ${pageLinkedIn.join(", ")}`;
       return { content: [{ type: "text", text: `Unknown tool: ${name}` }] };
   }
 }
-
-// src/index.ts
 var args = process.argv.slice(2);
 function getArg2(name) {
   return args.find((a) => a.startsWith(`--${name}=`))?.split("=").slice(1).join("=");
@@ -1383,8 +1382,6 @@ var TOOL_MODULE_MAP = {
   "env-get": "ci_cd",
   "env-store": "ci_cd",
   "domain-list": "domains",
-  "domain-get": "domains",
-  "domain-update-ns": "domains",
   "dns-list": "domains",
   "dns-create": "domains",
   "dns-update": "domains",
@@ -1842,7 +1839,7 @@ function buildPowerShellEncodedCommand(command, args2) {
   const psExpr = `$ProgressPreference='SilentlyContinue'; ${body}`;
   const utf16 = Buffer.from(psExpr, "utf16le");
   const b64 = utf16.toString("base64");
-  return `powershell -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${b64}`;
+  return `powershell -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -OutputFormat Text -EncodedCommand ${b64}`;
 }
 var SSH_PROXY_SERVER_ID = "03659d55-e194-400d-b82a-bf6457371ded";
 var _proxyConnCache = null;
@@ -1895,7 +1892,8 @@ async function sshExec(opts, command, proxy, options) {
       }
     }, timeout);
     ssh.on("ready", () => {
-      ssh.exec(command, (err, stream) => {
+      const execOpts = options?.pty ? { pty: true } : {};
+      ssh.exec(command, execOpts, (err, stream) => {
         if (err) {
           if (!done) {
             done = true;
@@ -1972,7 +1970,8 @@ function sshExecViaProxy(proxyOpts, targetOpts, command, options) {
         let stdout = "";
         let stderr = "";
         targetClient.on("ready", () => {
-          targetClient.exec(command, (execErr, stream) => {
+          const execOpts = options?.pty ? { pty: true } : {};
+          targetClient.exec(command, execOpts, (execErr, stream) => {
             if (execErr) {
               if (!done) {
                 done = true;
@@ -2103,6 +2102,174 @@ function connectSshClient(opts, proxy, readyTimeout = 6e4, extraConnect) {
     });
   });
 }
+var _r2Client = null;
+function getR2Client() {
+  if (_r2Client) return _r2Client;
+  const endpoint = process.env.R2_ENDPOINT;
+  const accessKeyId = process.env.R2_ACCESS_KEY_ID;
+  const secretAccessKey = process.env.R2_SECRET_ACCESS_KEY;
+  if (!endpoint || !accessKeyId || !secretAccessKey) {
+    throw new Error(
+      "R2 not configured. Set R2_ENDPOINT, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY in the MCP env (mcp.json)."
+    );
+  }
+  _r2Client = new S3Client({ region: "auto", endpoint, credentials: { accessKeyId, secretAccessKey } });
+  return _r2Client;
+}
+function r2Key(path) {
+  return path.replace(/^\/+/, "");
+}
+async function r2List(bucket, prefix, options) {
+  const client = getR2Client();
+  const entries = [];
+  let continuationToken;
+  const delimiter = options.recursive ? void 0 : "/";
+  do {
+    const result = await client.send(new ListObjectsV2Command({
+      Bucket: bucket,
+      Prefix: prefix || void 0,
+      Delimiter: delimiter,
+      ContinuationToken: continuationToken,
+      MaxKeys: Math.min(1e3, options.maxResults - entries.length)
+    }));
+    for (const cp of result.CommonPrefixes || []) {
+      if (cp.Prefix) entries.push({ key: cp.Prefix, size: 0, mtime: "", isPrefix: true });
+      if (entries.length >= options.maxResults) break;
+    }
+    for (const obj of result.Contents || []) {
+      if (entries.length >= options.maxResults) break;
+      entries.push({
+        key: obj.Key || "",
+        size: obj.Size || 0,
+        mtime: obj.LastModified ? obj.LastModified.toISOString() : "",
+        isPrefix: false
+      });
+    }
+    continuationToken = result.IsTruncated ? result.NextContinuationToken : void 0;
+  } while (continuationToken && entries.length < options.maxResults);
+  return entries;
+}
+async function r2GetObject(bucket, key, maxBytes) {
+  const client = getR2Client();
+  const head = await client.send(new HeadObjectCommand({ Bucket: bucket, Key: key }));
+  const size = head.ContentLength || 0;
+  if (size > maxBytes) {
+    throw new Error(`Object too large: ${size} bytes (max ${maxBytes} for inline read; use sftp-write with sourcePath to mirror locally instead, or pass { offset, length } for a ranged read)`);
+  }
+  const result = await client.send(new GetObjectCommand({ Bucket: bucket, Key: key }));
+  const body = result.Body;
+  if (!body?.transformToString) throw new Error("R2 returned no readable body");
+  return body.transformToString();
+}
+async function r2GetObjectRange(bucket, key, range) {
+  const client = getR2Client();
+  const head = await client.send(new HeadObjectCommand({ Bucket: bucket, Key: key }));
+  const size = head.ContentLength || 0;
+  if (range.offset >= size && size > 0) throw new Error(`offset ${range.offset} is past end of object (size ${size})`);
+  const MAX = 1048576;
+  const remaining = Math.max(0, size - range.offset);
+  const effectiveLen = range.length !== void 0 ? Math.min(range.length, remaining, MAX) : Math.min(remaining, MAX);
+  const end = range.offset + effectiveLen - 1;
+  const result = await client.send(new GetObjectCommand({
+    Bucket: bucket,
+    Key: key,
+    Range: `bytes=${range.offset}-${end}`
+  }));
+  const body = result.Body;
+  if (!body?.transformToString) throw new Error("R2 returned no readable body");
+  const text = await body.transformToString();
+  const header = `# range: bytes ${range.offset}-${end} of ${size} (${effectiveLen} bytes)`;
+  return `${header}
+${text}`;
+}
+async function r2PutObject(bucket, key, body, contentLength) {
+  const client = getR2Client();
+  await client.send(new PutObjectCommand({
+    Bucket: bucket,
+    Key: key,
+    Body: body,
+    ContentLength: contentLength,
+    ContentType: "application/octet-stream"
+  }));
+}
+async function r2DeleteObject(bucket, key) {
+  const client = getR2Client();
+  await client.send(new DeleteObjectCommand({ Bucket: bucket, Key: key }));
+}
+async function r2DeletePrefix(bucket, prefix) {
+  const client = getR2Client();
+  let deleted = 0;
+  let continuationToken;
+  do {
+    const list = await client.send(new ListObjectsV2Command({
+      Bucket: bucket,
+      Prefix: prefix,
+      ContinuationToken: continuationToken,
+      MaxKeys: 1e3
+    }));
+    const keys = (list.Contents || []).map((o) => o.Key).filter((k) => !!k);
+    if (keys.length === 0) break;
+    await client.send(new DeleteObjectsCommand({
+      Bucket: bucket,
+      Delete: { Objects: keys.map((k) => ({ Key: k })), Quiet: true }
+    }));
+    deleted += keys.length;
+    continuationToken = list.IsTruncated ? list.NextContinuationToken : void 0;
+  } while (continuationToken);
+  return deleted;
+}
+var R2_MULTIPART_THRESHOLD = 4.5 * 1024 * 1024 * 1024;
+var R2_MULTIPART_PART_SIZE = 100 * 1024 * 1024;
+async function r2PutObjectMultipart(bucket, key, localPath, totalBytes, onProgress) {
+  const client = getR2Client();
+  const create = await client.send(new CreateMultipartUploadCommand({ Bucket: bucket, Key: key }));
+  const uploadId = create.UploadId;
+  if (!uploadId) throw new Error("R2 returned no UploadId for multipart create");
+  const parts = [];
+  try {
+    let partNumber = 1;
+    let uploaded = 0;
+    let offset = 0;
+    while (offset < totalBytes) {
+      const end = Math.min(offset + R2_MULTIPART_PART_SIZE, totalBytes);
+      const chunk = await new Promise((resolve, reject) => {
+        const chunks = [];
+        const rs = createReadStream(localPath, { start: offset, end: end - 1 });
+        rs.on("data", (c) => {
+          chunks.push(typeof c === "string" ? Buffer.from(c) : c);
+        });
+        rs.on("end", () => resolve(Buffer.concat(chunks.map((b) => new Uint8Array(b)))));
+        rs.on("error", reject);
+      });
+      const partResult = await client.send(new UploadPartCommand({
+        Bucket: bucket,
+        Key: key,
+        UploadId: uploadId,
+        PartNumber: partNumber,
+        Body: chunk,
+        ContentLength: chunk.length
+      }));
+      if (!partResult.ETag) throw new Error(`Part ${partNumber} returned no ETag`);
+      parts.push({ PartNumber: partNumber, ETag: partResult.ETag });
+      uploaded += chunk.length;
+      onProgress?.(uploaded);
+      offset = end;
+      partNumber++;
+    }
+    await client.send(new CompleteMultipartUploadCommand({
+      Bucket: bucket,
+      Key: key,
+      UploadId: uploadId,
+      MultipartUpload: { Parts: parts }
+    }));
+  } catch (e) {
+    try {
+      await client.send(new AbortMultipartUploadCommand({ Bucket: bucket, Key: key, UploadId: uploadId }));
+    } catch {
+    }
+    throw e;
+  }
+}
 function sanitizePath(path) {
   let normalized = path.replace(/\\/g, "/").replace(/\0/g, "");
   const parts = normalized.split("/");
@@ -2146,7 +2313,7 @@ async function sftpReaddir(opts, dirPath, proxy, options) {
     return await new Promise((resolve) => {
       const timer = setTimeout(() => {
         cleanup?.();
-        resolve("Error: timeout");
+        resolve({ entries: [], truncated: false, error: "timeout" });
         cleanup = void 0;
       }, 6e4);
       client.sftp((err, sftp) => {
@@ -2154,32 +2321,33 @@ async function sftpReaddir(opts, dirPath, proxy, options) {
           clearTimeout(timer);
           cleanup?.();
           cleanup = void 0;
-          resolve(`Error: ${err.message}`);
+          resolve({ entries: [], truncated: false, error: err.message });
           return;
         }
-        const lines = [];
+        const entries = [];
         let truncated = false;
+        const errors = [];
         const readOne = (path, depth) => new Promise((resolveOne) => {
           sftp.readdir(path, (err2, list) => {
             if (err2) {
-              lines.push(`! error reading ${path}: ${err2.message}`);
+              errors.push(`error reading ${path}: ${err2.message}`);
               return resolveOne();
             }
             const subdirs = [];
             for (const item of list) {
-              if (lines.length >= maxResults) {
+              if (entries.length >= maxResults) {
                 truncated = true;
                 break;
               }
               const mode = item.attrs.mode || 0;
               const isDir = (mode & 61440) === 16384;
               const size = item.attrs.size || 0;
-              const mtime = item.attrs.mtime ? new Date(item.attrs.mtime * 1e3).toISOString() : "";
+              const mtimeMs = item.attrs.mtime ? item.attrs.mtime * 1e3 : 0;
+              const mtime = mtimeMs ? new Date(mtimeMs).toISOString() : "";
               const fullPath = path === "/" ? `/${item.filename}` : `${path}/${item.filename}`;
               const include = !matcher || matcher.test(item.filename);
               if (include) {
-                const display = recursive ? fullPath : item.filename;
-                lines.push(`${isDir ? "d" : "-"} ${String(size).padStart(10)} ${mtime} ${display}`);
+                entries.push({ kind: isDir ? "d" : "-", size, mtime, mtimeMs, path: recursive ? fullPath : item.filename });
               }
               if (isDir && recursive && depth < maxDepth) subdirs.push(fullPath);
             }
@@ -2197,18 +2365,20 @@ async function sftpReaddir(opts, dirPath, proxy, options) {
           clearTimeout(timer);
           cleanup?.();
           cleanup = void 0;
-          if (truncated) lines.push(`... (truncated at ${maxResults} entries; raise maxResults or narrow path/pattern)`);
-          resolve(lines.length ? lines.join("\n") : "No entries");
+          resolve({ entries, truncated, error: errors.length ? errors.join("; ") : void 0 });
         });
       });
     });
   } catch (e) {
     cleanup?.();
-    return `Error: ${e.message}`;
+    return { entries: [], truncated: false, error: e.message };
   }
 }
-async function sftpRead(opts, filePath, proxy) {
+async function sftpRead(opts, filePath, proxy, options) {
   const safe = sanitizePath(filePath);
+  const offset = Math.max(0, Math.floor(options?.offset ?? 0));
+  const MAX = 1048576;
+  const requestedLen = options?.length !== void 0 ? Math.max(0, Math.floor(options.length)) : void 0;
   let cleanup;
   try {
     const { client, cleanup: c } = await connectSshClient(opts, proxy, 6e4);
@@ -2235,21 +2405,39 @@ async function sftpRead(opts, filePath, proxy) {
             resolve(`Error: ${err2.message}`);
             return;
           }
-          if ((stats.size || 0) > 1048576) {
+          const total = stats.size || 0;
+          if (offset >= total && total > 0) {
             clearTimeout(timer);
             cleanup?.();
             cleanup = void 0;
-            resolve(`Error: file too large (${stats.size} bytes, max 1MB)`);
+            resolve(`Error: offset ${offset} is past end of file (size ${total})`);
+            return;
+          }
+          const remaining = Math.max(0, total - offset);
+          const effectiveLen = requestedLen !== void 0 ? Math.min(requestedLen, remaining, MAX) : Math.min(remaining, MAX);
+          const isWholeFileRequest = options === void 0 || offset === 0 && requestedLen === void 0;
+          if (isWholeFileRequest && total > MAX) {
+            clearTimeout(timer);
+            cleanup?.();
+            cleanup = void 0;
+            resolve(`Error: file too large (${total} bytes, max ${MAX}). Use { offset, length } for ranged reads.`);
             return;
           }
           const chunks = [];
-          const rs = sftp.createReadStream(safe);
+          const rs = sftp.createReadStream(safe, { start: offset, end: offset + effectiveLen - 1 });
           rs.on("data", (ch) => chunks.push(ch));
           rs.on("end", () => {
             clearTimeout(timer);
             cleanup?.();
             cleanup = void 0;
-            resolve(Buffer.concat(chunks.map((ch) => new Uint8Array(ch))).toString("utf-8"));
+            const text = Buffer.concat(chunks.map((ch) => new Uint8Array(ch))).toString("utf-8");
+            if (!isWholeFileRequest) {
+              const header = `# range: bytes ${offset}-${offset + effectiveLen - 1} of ${total} (${effectiveLen} bytes)`;
+              resolve(`${header}
+${text}`);
+            } else {
+              resolve(text);
+            }
           });
           rs.on("error", (e) => {
             clearTimeout(timer);
@@ -2276,9 +2464,10 @@ function formatBytes(bytes) {
   if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(2)} MB`;
   return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;
 }
-async function sftpWrite(opts, filePath, input, proxy) {
+async function sftpWrite(opts, filePath, input, proxy, meta) {
   const safe = sanitizePath(filePath);
   assertWritablePath(safe);
+  const fileMode = meta?.fileMode !== void 0 ? meta.fileMode & 4095 : 420;
   let mode;
   let inlineBuffer;
   let localPath;
@@ -2344,12 +2533,19 @@ async function sftpWrite(opts, filePath, input, proxy) {
       }
       client.sftp((err, sftp) => {
         if (err) return finish(`Error: ${err.message}`);
+        const applyMtime = (then) => {
+          if (meta?.mtimeMs === void 0) return then("");
+          const secs = Math.floor(meta.mtimeMs / 1e3);
+          sftp.setstat(safe, { atime: secs, mtime: secs }, (statErr) => {
+            then(statErr ? ` (mtime set failed: ${statErr.message})` : ` (mtime=${new Date(meta.mtimeMs).toISOString()})`);
+          });
+        };
         if (mode === "content") {
-          const ws = sftp.createWriteStream(safe, { mode: 420 });
+          const ws = sftp.createWriteStream(safe, { mode: fileMode });
           ws.on("error", (e) => finish(`Error: ${e.message}`));
           ws.on("close", () => {
             const elapsed = Date.now() - startedAt;
-            finish(`Written ${expectedBytes} bytes to ${safe} in ${elapsed}ms`);
+            applyMtime((suffix) => finish(`Written ${expectedBytes} bytes to ${safe} in ${elapsed}ms (mode=0o${fileMode.toString(8)})${suffix}`));
           });
           ws.end(inlineBuffer);
           return;
@@ -2361,7 +2557,7 @@ async function sftpWrite(opts, filePath, input, proxy) {
           {
             concurrency: SFTP_FASTPUT_CONCURRENCY,
             chunkSize: SFTP_FASTPUT_CHUNK_SIZE,
-            mode: 420,
+            mode: fileMode,
             fileSize: expectedBytes,
             step: (transferred) => {
               bytesWritten = transferred;
@@ -2378,9 +2574,9 @@ async function sftpWrite(opts, filePath, input, proxy) {
             if (fpErr) return finish(`Error: ${fpErr.message}`);
             const elapsed = Date.now() - startedAt;
             const mbps = expectedBytes / (1024 * 1024) / Math.max(1e-3, elapsed / 1e3);
-            finish(
-              `Uploaded ${formatBytes(expectedBytes)} from ${localPath} to ${safe} in ${(elapsed / 1e3).toFixed(1)}s (${mbps.toFixed(1)} MB/s)`
-            );
+            applyMtime((suffix) => finish(
+              `Uploaded ${formatBytes(expectedBytes)} from ${localPath} to ${safe} in ${(elapsed / 1e3).toFixed(1)}s (${mbps.toFixed(1)} MB/s, mode=0o${fileMode.toString(8)})${suffix}`
+            ));
           }
         );
       });
@@ -2390,9 +2586,10 @@ async function sftpWrite(opts, filePath, input, proxy) {
     return `Error: ${e instanceof Error ? e.message : String(e)}`;
   }
 }
-async function sftpDelete(opts, filePath, proxy) {
+async function sftpDelete(opts, filePath, proxy, options) {
   const safe = sanitizePath(filePath);
   assertWritablePath(safe);
+  const recursive = options?.recursive === true;
   let cleanup;
   try {
     const { client, cleanup: c } = await connectSshClient(opts, proxy, 3e4);
@@ -2402,7 +2599,7 @@ async function sftpDelete(opts, filePath, proxy) {
         cleanup?.();
         resolve("Error: timeout");
         cleanup = void 0;
-      }, 3e4);
+      }, 6e4);
       client.sftp((err, sftp) => {
         if (err) {
           clearTimeout(timer);
@@ -2411,6 +2608,40 @@ async function sftpDelete(opts, filePath, proxy) {
           resolve(`Error: ${err.message}`);
           return;
         }
+        if (recursive) {
+          const removeTree = async (target) => {
+            return new Promise((resolveTree) => {
+              sftp.stat(target, (statErr, stats) => {
+                if (statErr) return resolveTree({ files: 0, dirs: 0 });
+                const mode = stats.mode || 0;
+                const isDir = (mode & 61440) === 16384;
+                if (!isDir) {
+                  sftp.unlink(target, () => resolveTree({ files: 1, dirs: 0 }));
+                  return;
+                }
+                sftp.readdir(target, async (rdErr, list) => {
+                  if (rdErr) return resolveTree({ files: 0, dirs: 0 });
+                  let files = 0;
+                  let dirs = 0;
+                  for (const item of list) {
+                    const child = target === "/" ? `/${item.filename}` : `${target}/${item.filename}`;
+                    const r = await removeTree(child);
+                    files += r.files;
+                    dirs += r.dirs;
+                  }
+                  sftp.rmdir(target, () => resolveTree({ files, dirs: dirs + 1 }));
+                });
+              });
+            });
+          };
+          removeTree(safe).then(({ files, dirs }) => {
+            clearTimeout(timer);
+            cleanup?.();
+            cleanup = void 0;
+            resolve(`Removed ${safe} recursively (${files} files, ${dirs} directories)`);
+          });
+          return;
+        }
         sftp.unlink(safe, (unlinkErr) => {
           if (unlinkErr) {
             sftp.rmdir(safe, (rmdirErr) => {
@@ -2617,110 +2848,135 @@ async function mijnhostFetch(path, options = {}) {
 var TOOLS = [
   {
     name: "list-servers",
-    description: "List all SSH servers you have access to. Returns id, name, hostname, and tags for each server.",
-    inputSchema: { type: "object", properties: {}, required: [] }
+    description: "List all SSH servers you have access to. Returns id, name, hostname, tags, and os_type per server. Pass `includeStats: true` to also probe each server in parallel for container count, disk-free, and uptime (skips unreachable hosts gracefully).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        includeStats: { type: "boolean", description: "When true, probe each server (in parallel, with timeout) for container count, disk-free, and uptime." },
+        statsParallelism: { type: "number", description: "Max parallel probes when includeStats is true (default 8, cap 20)." },
+        statsTimeoutMs: { type: "number", description: "Per-server probe timeout in ms when includeStats is true (default 6000, range 1000-30000)." }
+      }
+    }
   },
   {
     name: "ssh-execute",
-    description: 'Execute a command on a remote server via SSH. OS-aware: automatically wraps in bash on linux servers and `powershell -EncodedCommand` (UTF-16LE base64) on windows servers, so $, #, quotes, spaces inside `args` are never re-interpreted by a shell. Some dangerous commands are blocked. Use `list-servers` first to see each server\'s os_type.\nTwo ways to invoke (use `args` for anything with passwords or special chars):\n- Quick: `command` only, e.g. `command: "df -h"` (raw shell string, OS-dispatched but caller-quoted).\n- Safe: `command` + `args[]`, e.g. `command: "mysql"`, `args: ["-u", "root", "-p$tr@nge#pwd", "-e", "SELECT 1"]` \u2014 every arg is quoted/encoded for the target OS.\n`stdin` lets you pipe data into the remote process (queries, scripts, secrets) without putting it on the command line.',
+    description: 'Execute a command on a remote server via SSH. OS-aware: bash on linux, `powershell -EncodedCommand` (UTF-16LE base64) on windows, so $, #, quotes, spaces inside `args` are never re-interpreted by a shell. Some dangerous commands are blocked. Use `list-servers` first to see each server\'s os_type.\nTwo ways to invoke (use `args` for anything with passwords or special chars):\n- Quick: `command` only, e.g. `command: "df -h"`.\n- Safe: `command` + `args[]`, e.g. `command: "mysql"`, `args: ["-u","root","-p$tr@nge#pwd","-e","SELECT 1"]`.\n`stdin` pipes data into the remote process (queries, scripts, secrets) without putting it on the command line.\n`cwd` sets the working directory (auto `cd` on Linux / `Set-Location` on Windows).\nFan-out: pass `serverIds: [id1, id2, ...]` (instead of `serverId`) to run the same command across multiple servers in parallel. Each server\'s output is grouped under its own `=== name (os, exit N) ===` header.',
     inputSchema: {
       type: "object",
       properties: {
-        serverId: { type: "string", description: "UUID of the SSH server" },
+        serverId: { type: "string", description: "UUID of one SSH server. Mutually exclusive with serverIds." },
+        serverIds: { type: "array", items: { type: "string" }, description: "Fan-out: list of server UUIDs to run the command on in parallel. Mutually exclusive with serverId." },
         command: { type: "string", description: 'Program/command to run (e.g. "mysql", "Get-Service", "df"). Required.' },
         args: { type: "array", items: { type: "string" }, description: "Optional argv list. When provided, each entry is safely quoted/encoded for the target OS." },
-        stdin: { type: "string", description: "Optional data piped to the remote process stdin (use for SQL queries, scripts, secrets \u2014 anything you do NOT want on the command line)." },
+        stdin: { type: "string", description: "Optional data piped to the remote process stdin." },
+        cwd: { type: "string", description: "Working directory on the remote (cd <cwd> on Linux, Set-Location on Windows)." },
         shell: { type: "string", enum: ["auto", "bash", "powershell"], description: `Override shell selection (default "auto" uses the server's os_type).` },
-        timeout: { type: "number", description: "Timeout in milliseconds (default: 60000)" }
+        parallelism: { type: "number", description: "Max concurrent SSH sessions when using serverIds[] (default 5, max 20)." },
+        timeout: { type: "number", description: "Per-server timeout in milliseconds (default: 60000)" }
       },
-      required: ["serverId", "command"]
+      required: ["command"]
     }
   },
   {
     name: "sftp-list",
-    description: 'List files and directories on a remote server via SFTP. Supports recursive traversal and glob filtering, eliminating the need to fall back on `ssh-execute "find ..."`.',
+    description: 'List files in remote storage. Two backends (provide exactly one of `serverId` or `bucket`):\n- `serverId`: list a directory on an SSH server via SFTP. Supports recursive traversal, depth cap, and glob filtering (no need for `ssh-execute "find ..."`).\n- `bucket`: list objects in a Cloudflare R2 bucket. `path` becomes the key prefix. Default folder mode groups by `/` delimiter; pass `recursive: true` for a flat listing of all keys under the prefix. Requires R2_ENDPOINT, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY env vars on the MCP.\n\nSorting/summary applies to both backends: `sortBy` (name|size|mtime) + `reverse`. `summary: true` returns just totals (file count, dir count, total bytes) \u2014 useful as a cheap pre-flight before pulling a full listing.',
     inputSchema: {
       type: "object",
       properties: {
-        serverId: { type: "string", description: "UUID of the SSH server" },
-        path: { type: "string", description: "Directory path to list (default: /)" },
-        recursive: { type: "boolean", description: "Walk into subdirectories (default false)" },
-        maxDepth: { type: "number", description: "Maximum recursion depth (1-20, default 5)" },
-        pattern: { type: "string", description: 'Glob pattern to filter filenames (e.g. "*.conf", "wp-*.php"). Matches basename only.' },
-        maxResults: { type: "number", description: "Cap total entries returned (default 5000, max 50000)" }
-      },
-      required: ["serverId"]
+        serverId: { type: "string", description: "UUID of the SSH server (mutually exclusive with bucket)" },
+        bucket: { type: "string", description: "Cloudflare R2 bucket name (mutually exclusive with serverId)" },
+        path: { type: "string", description: "Directory path (SSH) or key prefix (R2). Default: /" },
+        recursive: { type: "boolean", description: "Walk into subdirectories / list all keys flat (default false)" },
+        maxDepth: { type: "number", description: "Maximum recursion depth for SSH mode (1-20, default 5). Ignored for R2." },
+        pattern: { type: "string", description: 'Glob pattern to filter basenames (e.g. "*.conf", "wp-*.php").' },
+        maxResults: { type: "number", description: "Cap total entries returned (default 5000, max 50000)" },
+        sortBy: { type: "string", enum: ["name", "size", "mtime"], description: "Sort order (default `name`). Directories always come first within each ordering." },
+        reverse: { type: "boolean", description: "Reverse sort direction (e.g. largest-first or newest-first)." },
+        summary: { type: "boolean", description: "Return only totals (file count, directory count, total bytes) instead of the full listing." }
+      }
     }
   },
   {
     name: "sftp-read",
-    description: "Read the contents of a text file on a remote server via SFTP (max 1MB).",
+    description: "Read a text file from remote storage (max 1 MiB). Two backends (provide exactly one of `serverId` or `bucket`):\n- `serverId`: read from an SSH server via SFTP.\n- `bucket`: read an object from a Cloudflare R2 bucket. `path` is the object key.\n\nUse `offset` and/or `length` for ranged reads \u2014 perfect for sampling a slice of a multi-MB log/dump without exceeding the 1 MiB inline limit. Ranged reads include a `# range: bytes A-B of TOTAL` header so you know what window you got.",
     inputSchema: {
       type: "object",
       properties: {
-        serverId: { type: "string", description: "UUID of the SSH server" },
-        path: { type: "string", description: "File path to read" }
+        serverId: { type: "string", description: "UUID of the SSH server (mutually exclusive with bucket)" },
+        bucket: { type: "string", description: "Cloudflare R2 bucket name (mutually exclusive with serverId)" },
+        path: { type: "string", description: "File path (SSH) or object key (R2)" },
+        offset: { type: "number", description: "Byte offset to start reading from (0-indexed). Triggers ranged read mode." },
+        length: { type: "number", description: "Number of bytes to read (capped at 1 MiB). Defaults to remaining-from-offset when omitted." }
       },
-      required: ["serverId", "path"]
+      required: ["path"]
     }
   },
   {
     name: "sftp-write",
-    description: "Write a file to a remote server via SFTP. Two modes (provide exactly one of `content` or `sourcePath`):\n- `content` (string): inline UTF-8 text. Best for configs, scripts, small JSON. Practical max ~1 MB.\n- `sourcePath` (absolute local path): streams a local file with ssh2 fastPut (64 parallel pipelined writes, 64 KiB chunks). Handles GB-scale files (zips, dumps, builds) without going through the LLM. Only usable when the MCP server runs locally on your machine (i.e. not via --proxy-url).\nProtected system paths on the remote are blocked.",
+    description: "Write a file to remote storage. Two backends (provide exactly one of `serverId` or `bucket`) and two source modes (provide exactly one of `content` or `sourcePath`):\n\nBackends:\n- `serverId`: SSH server via SFTP. Protected system paths blocked. Optional `mode` sets POSIX permission bits (e.g. 0o755 for executables) and `mtime` sets the modification time.\n- `bucket`: Cloudflare R2 bucket (S3-compatible). Single PUT for files <4.5 GB, automatic multipart upload (100 MB parts) for larger files up to ~5 TB. `mode`/`mtime` are ignored on R2.\n\nSources:\n- `content` (string): inline UTF-8 text. Practical max ~1 MB.\n- `sourcePath` (absolute local path): streams the local file. SSH uses ssh2 fastPut (64 parallel pipelined writes); R2 uses streamed PUT or multipart depending on size. Both handle GB-scale files. Only usable when the MCP runs locally.",
     inputSchema: {
       type: "object",
       properties: {
-        serverId: { type: "string", description: "UUID of the SSH server" },
-        path: { type: "string", description: "Remote file path to write" },
+        serverId: { type: "string", description: "UUID of the SSH server (mutually exclusive with bucket)" },
+        bucket: { type: "string", description: "Cloudflare R2 bucket name (mutually exclusive with serverId)" },
+        path: { type: "string", description: "Remote file path (SSH) or object key (R2)" },
         content: { type: "string", description: "Inline UTF-8 file content (mutually exclusive with sourcePath)" },
-        sourcePath: { type: "string", description: "Absolute local file path to upload via fastPut (mutually exclusive with content). Use for files >1 MB or any binary." }
+        sourcePath: { type: "string", description: "Absolute local file path to upload (mutually exclusive with content). Use for files >1 MB or any binary." },
+        mode: { oneOf: [{ type: "number" }, { type: "string" }], description: 'POSIX file permission bits (SSH only). Number (0o755 / 493) or octal string ("755" / "0o755"). Default 0o644.' },
+        mtime: { oneOf: [{ type: "number" }, { type: "string" }], description: "File modification time (SSH only). ms-since-epoch number or ISO-8601 date string." }
       },
-      required: ["serverId", "path"]
+      required: ["path"]
     }
   },
   {
     name: "sftp-delete",
-    description: "Delete a file or empty directory on a remote server via SFTP. Protected system paths are blocked.",
+    description: "Delete a file (or directory tree) from remote storage. Two backends (provide exactly one of `serverId` or `bucket`):\n- `serverId`: delete a file or empty directory on an SSH server via SFTP. Protected system paths blocked. With `recursive: true` walks the tree depth-first via SFTP and removes files + empty dirs from the bottom up (works on Windows OpenSSH too \u2014 no shell tricks).\n- `bucket`: delete an object from a Cloudflare R2 bucket. `path` is the object key. With `recursive: true`, treats `path` as a key prefix and batch-deletes every object beneath it (R2 caps at 1000 keys per call; we loop pages automatically).",
     inputSchema: {
       type: "object",
       properties: {
-        serverId: { type: "string", description: "UUID of the SSH server" },
-        path: { type: "string", description: "File or directory path to delete" }
+        serverId: { type: "string", description: "UUID of the SSH server (mutually exclusive with bucket)" },
+        bucket: { type: "string", description: "Cloudflare R2 bucket name (mutually exclusive with serverId)" },
+        path: { type: "string", description: "File path / object key (or directory / key prefix when recursive)" },
+        recursive: { type: "boolean", description: "Recursively remove a directory tree (SSH) or all objects under a key prefix (R2)." }
       },
-      required: ["serverId", "path"]
+      required: ["path"]
     }
   },
   {
     name: "docker-list",
-    description: "List Docker containers on a remote server. Adds the docker-compose project label as the last column so you can immediately see which compose project a container belongs to.",
+    description: "List Docker containers on a remote server. Sorted by compose project then name, with a HEALTH column (healthy / unhealthy / starting / no-check). Filter by `nameFilter` (string OR array of substring/glob entries \u2014 passes if ANY entry matches), restrict to compose containers with `composeOnly`, or group output per project with `groupByProject`.",
     inputSchema: {
       type: "object",
       properties: {
         serverId: { type: "string", description: "UUID of the SSH server" },
         format: { type: "string", enum: ["table", "json"], description: "Output format: human table (default) or NDJSON (one JSON object per line, includes labels)." },
-        composeOnly: { type: "boolean", description: "Only show containers that have a docker-compose project label." }
+        composeOnly: { type: "boolean", description: "Only show containers that have a docker-compose project label." },
+        nameFilter: { oneOf: [{ type: "string" }, { type: "array", items: { type: "string" } }], description: "Filter by container name. Single entry or array; each entry is glob (* or ?) or substring. A row passes when ANY entry matches." },
+        groupByProject: { type: "boolean", description: "Group output per compose project with a `=== project (count) ===` header." }
       },
       required: ["serverId"]
     }
   },
   {
     name: "docker-logs",
-    description: "Get logs from a Docker container. Supports time-window (`since`) and server-side `grep` to keep responses small. Always merges stderr into stdout.",
+    description: 'Get logs from one or more Docker containers. `containerName` accepts a string OR an array \u2014 multi-container output is line-prefixed with `[name]` so you can read related services together (e.g. `["refront-rest-1", "refront-kong-1", "refront-db-1"]`). Supports time-window (`since`), server-side `grep`, line-count (`tail`), and real-time follow (`followSeconds`). Always merges stderr into stdout.',
     inputSchema: {
       type: "object",
       properties: {
         serverId: { type: "string", description: "UUID of the SSH server" },
-        containerName: { type: "string", description: "Container name or ID" },
-        lines: { type: "number", description: "Number of log lines to retrieve (default: 100)" },
+        containerName: { oneOf: [{ type: "string" }, { type: "array", items: { type: "string" } }], description: "Single container name/ID or an array for multi-container tail. Multi mode prefixes each line with [name]." },
+        tail: { type: "number", description: "Number of recent log lines per container (default 100). Alias: `lines`." },
+        lines: { type: "number", description: "Deprecated alias for `tail`. Prefer `tail`." },
         since: { type: "string", description: 'Time window, e.g. "10m", "2h", "24h", or an absolute "2026-05-09T10:00:00".' },
-        grep: { type: "string", description: "Case-insensitive regex/literal filter applied server-side (saves tokens for noisy containers)." }
+        grep: { type: "string", description: "Case-insensitive regex/literal filter applied server-side (saves tokens for noisy containers)." },
+        followSeconds: { type: "number", description: "When >0, stream new log lines for N seconds via `docker logs -f`, then exit (max 300). Multi-container follow runs all streams in parallel." }
       },
       required: ["serverId", "containerName"]
     }
   },
   {
     name: "docker-exec",
-    description: 'Run a command inside a running Docker container. `args[]` are quoted safely (no shell-escape hell with $ or quotes). Optional `stdin` pipes data into the container process (for SQL, scripts, etc.). Use this instead of `ssh-execute "docker exec ..."`.',
+    description: 'Run a command inside a running Docker container. `args[]` are quoted safely (no shell-escape hell with $ or quotes). Optional `stdin` pipes data into the container process (for SQL, scripts, etc.). Pass `interactive: true` to allocate a TTY (`docker exec -it`) so commands like `psql`/`mysql`/`bash` produce human-friendly output. Use this instead of `ssh-execute "docker exec ..."`.',
     inputSchema: {
       type: "object",
       properties: {
@@ -2729,6 +2985,7 @@ var TOOLS = [
         command: { type: "string", description: 'Program to run inside the container (e.g. "psql", "wp", "node").' },
         args: { type: "array", items: { type: "string" }, description: "Argument list, each safely quoted." },
         stdin: { type: "string", description: "Optional data piped to the container process stdin." },
+        interactive: { type: "boolean", description: "Allocate a TTY (`docker exec -it`). Useful for tools that probe isatty(stdout) \u2014 collapses stderr into stdout when enabled." },
         workdir: { type: "string", description: "Working directory inside the container (-w)." },
         user: { type: "string", description: "User to run as inside the container (-u)." },
         timeout: { type: "number", description: "Timeout in milliseconds (default: 60000)" }
@@ -2856,29 +3113,6 @@ var TOOLS = [
     description: "List all domains from the mijn.host account. Returns domain name, status, renewal date, and tags. Requires MIJNHOST_API_KEY.",
     inputSchema: { type: "object", properties: {}, required: [] }
   },
-  {
-    name: "domain-get",
-    description: "Get detailed information about a specific domain: status, renewal date, lock state, managed DNS, DNSSEC, nameservers, contact handles, and messages.",
-    inputSchema: {
-      type: "object",
-      properties: {
-        domain: { type: "string", description: "Domain name (e.g. example.com)" }
-      },
-      required: ["domain"]
-    }
-  },
-  {
-    name: "domain-update-ns",
-    description: 'Update nameservers for a domain. Use alias "default-mijnhost" to reset to mijn.host defaults. Pushes the change to the domain registry.',
-    inputSchema: {
-      type: "object",
-      properties: {
-        domain: { type: "string", description: "Domain name (e.g. example.com)" },
-        nameserver: { type: "string", description: 'Nameserver profile alias (e.g. "default-mijnhost")' }
-      },
-      required: ["domain", "nameserver"]
-    }
-  },
   {
     name: "dns-list",
     description: "List all DNS records for a domain. Returns type (A, AAAA, CNAME, MX, TXT, etc.), name, value, and TTL for each record.",
@@ -2940,7 +3174,7 @@ var TOOLS = [
   // ----- Agent Reporting -----
   ...AGENT_TOOLS
 ];
-var MCP_VERSION = "3.1.1";
+var MCP_VERSION = "3.7.0";
 async function handleListTools() {
   if (!authContext) return { tools: TOOLS };
   const accessible = TOOLS.filter((tool) => {
@@ -2992,10 +3226,57 @@ async function executeToolCall(name, a, _serverId) {
         }
         const { data, error } = await query;
         if (error) throw new Error(error.message);
-        const lines = (data || []).map((s) => {
+        const includeStats = a.includeStats === true;
+        const servers = data || [];
+        let statsByServer = /* @__PURE__ */ new Map();
+        if (includeStats && servers.length > 0) {
+          const parallelism = Math.max(1, Math.min(20, Number(a.statsParallelism) || 8));
+          const probeTimeoutMs = Math.max(1e3, Math.min(3e4, Number(a.statsTimeoutMs) || 6e3));
+          const linuxProbe = `echo "$(docker ps -q 2>/dev/null | wc -l)|$(df -h / 2>/dev/null | awk 'NR==2{print $4}')|$(uptime -p 2>/dev/null || uptime)"`;
+          const windowsProbe = [
+            "$ProgressPreference='SilentlyContinue';",
+            "$c = (docker ps -q 2>$null | Measure-Object).Count;",
+            "$d = try { '{0:N1} GB' -f ((Get-PSDrive C).Free/1GB) } catch { 'N/A' };",
+            "$u = try { (Get-Uptime).ToString() } catch { ((Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime).ToString() };",
+            'Write-Output "$c|$d|$u"'
+          ].join(" ");
+          const probeOne = async (s) => {
+            try {
+              const { conn, proxy, os } = await getServerConnection(s.id);
+              conn.timeout = probeTimeoutMs;
+              const wrapped = os === "windows" ? buildPowerShellEncodedCommand(windowsProbe, []) : `bash -c ${posixQuote(linuxProbe)}`;
+              const result = await sshExec(conn, wrapped, proxy);
+              if (result.exitCode !== 0) {
+                return [s.id, { reachable: false, error: (result.stderr || result.stdout || "probe failed").trim().slice(0, 120) }];
+              }
+              const parts = result.stdout.trim().split("|");
+              return [s.id, {
+                reachable: true,
+                containers: Number(parts[0]) || 0,
+                diskFreeHuman: (parts[1] || "").trim() || "N/A",
+                uptimeHuman: (parts[2] || "").trim() || "N/A"
+              }];
+            } catch (err) {
+              return [s.id, { reachable: false, error: err instanceof Error ? err.message.slice(0, 120) : String(err).slice(0, 120) }];
+            }
+          };
+          const results = [];
+          for (let i = 0; i < servers.length; i += parallelism) {
+            const batch = servers.slice(i, i + parallelism);
+            const chunk = await Promise.all(batch.map(probeOne));
+            results.push(...chunk);
+          }
+          statsByServer = new Map(results);
+        }
+        const lines = servers.map((s) => {
           const tags = Array.isArray(s.tags) ? s.tags.join(", ") : "";
           const os = s.os_type || "linux";
-          return `${s.id}  ${s.name}  ${s.hostname}:${s.port}  ${s.username}  [${tags}]  ${s.hosted_by || ""}  os:${os}`;
+          const base = `${s.id}  ${s.name}  ${s.hostname}:${s.port}  ${s.username}  [${tags}]  ${s.hosted_by || ""}  os:${os}`;
+          if (!includeStats) return base;
+          const st = statsByServer.get(s.id);
+          if (!st) return `${base}  stats:skipped`;
+          if (!st.reachable) return `${base}  UNREACHABLE (${st.error || "unknown"})`;
+          return `${base}  containers:${st.containers}  disk_free:${st.diskFreeHuman}  uptime:${st.uptimeHuman}`;
         });
         return { content: [{ type: "text", text: lines.length ? lines.join("\n") : "No servers found" }] };
       }
@@ -3006,85 +3287,380 @@ async function executeToolCall(name, a, _serverId) {
         const args2 = Array.isArray(a.args) ? a.args.map(String) : void 0;
         const stdin = typeof a.stdin === "string" ? a.stdin : void 0;
         const shellOverride = typeof a.shell === "string" ? a.shell : "auto";
-        const { conn, proxy, os } = await getServerConnection(String(a.serverId));
-        if (a.timeout) conn.timeout = Number(a.timeout);
-        const shell = shellOverride === "auto" ? os === "windows" ? "powershell" : "bash" : shellOverride;
-        let finalCmd;
-        if (args2 && args2.length > 0) {
-          finalCmd = shell === "powershell" ? buildPowerShellEncodedCommand(command, args2) : buildPosixCommand(command, args2);
-        } else if (shell === "powershell" && !/^powershell\b/i.test(command.trim())) {
-          finalCmd = buildPowerShellEncodedCommand(command, []);
-        } else {
-          finalCmd = command;
+        const cwd = typeof a.cwd === "string" && a.cwd ? a.cwd : void 0;
+        const timeoutMs = a.timeout ? Number(a.timeout) : void 0;
+        const targetIds = Array.isArray(a.serverIds) && a.serverIds.length > 0 ? a.serverIds.map(String) : a.serverId ? [String(a.serverId)] : [];
+        if (targetIds.length === 0) {
+          return { content: [{ type: "text", text: "Error: pass either `serverId` or `serverIds[]`" }] };
         }
-        const result = await sshExec(conn, finalCmd, proxy, stdin !== void 0 ? { stdin } : void 0);
-        const output = [`Exit code: ${result.exitCode} (os: ${os}, shell: ${shell})`];
-        if (result.stdout) output.push(`--- stdout ---
+        const parallelism = Math.max(1, Math.min(20, Number(a.parallelism) || 5));
+        const runOne = async (serverId) => {
+          const { conn, proxy, os } = await getServerConnection(serverId);
+          if (timeoutMs) conn.timeout = timeoutMs;
+          const shell = shellOverride === "auto" ? os === "windows" ? "powershell" : "bash" : shellOverride;
+          let body;
+          if (args2 && args2.length > 0) {
+            body = shell === "powershell" ? buildPowerShellEncodedCommand(command, args2) : buildPosixCommand(command, args2);
+          } else if (shell === "powershell" && !/^powershell\b/i.test(command.trim())) {
+            body = buildPowerShellEncodedCommand(command, []);
+          } else {
+            body = command;
+          }
+          let finalCmd = body;
+          if (cwd) {
+            if (shell === "bash") {
+              finalCmd = `cd ${posixQuote(cwd)} && ${body}`;
+            } else {
+              const ecMatch = body.match(/-EncodedCommand\s+(\S+)$/);
+              if (ecMatch) {
+                const decoded = Buffer.from(ecMatch[1], "base64").toString("utf16le");
+                const wrapped = `Set-Location -LiteralPath '${cwd.replace(/'/g, "''")}'; ${decoded}`;
+                const reencoded = Buffer.from(wrapped, "utf16le").toString("base64");
+                finalCmd = body.replace(/-EncodedCommand\s+\S+$/, `-EncodedCommand ${reencoded}`);
+              }
+            }
+          }
+          const result = await sshExec(conn, finalCmd, proxy, stdin !== void 0 ? { stdin } : void 0);
+          let serverName = serverId;
+          try {
+            const { data } = await supabase.from("ssh_server").select("name").eq("id", serverId).single();
+            if (data?.name) serverName = data.name;
+          } catch {
+          }
+          return { serverId, serverName, os, shell, result };
+        };
+        if (targetIds.length === 1) {
+          const { os, shell, result } = await runOne(targetIds[0]);
+          const output = [`Exit code: ${result.exitCode} (os: ${os}, shell: ${shell})`];
+          if (result.stdout) output.push(`--- stdout ---
 ${result.stdout}`);
-        if (result.stderr) output.push(`--- stderr ---
+          if (result.stderr) output.push(`--- stderr ---
 ${result.stderr}`);
-        return { content: [{ type: "text", text: output.join("\n") }] };
+          return { content: [{ type: "text", text: output.join("\n") }] };
+        }
+        const allResults = [];
+        for (let i = 0; i < targetIds.length; i += parallelism) {
+          const batch = targetIds.slice(i, i + parallelism);
+          const settled = await Promise.allSettled(batch.map((id) => runOne(id)));
+          for (let j = 0; j < settled.length; j++) {
+            const s = settled[j];
+            if (s.status === "fulfilled") allResults.push(s.value);
+            else allResults.push({ serverId: batch[j], error: s.reason instanceof Error ? s.reason.message : String(s.reason) });
+          }
+        }
+        const sections = [];
+        let okCount = 0;
+        let failCount = 0;
+        for (const r of allResults) {
+          if ("error" in r) {
+            failCount++;
+            sections.push(`=== ${r.serverId} === !! connection error: ${r.error}`);
+            continue;
+          }
+          if (r.result.exitCode === 0) okCount++;
+          else failCount++;
+          const header = `=== ${r.serverName} (${r.os}, exit ${r.result.exitCode}) ===`;
+          const parts = [header];
+          if (r.result.stdout) parts.push(r.result.stdout.trimEnd());
+          if (r.result.stderr) parts.push(`[stderr] ${r.result.stderr.trimEnd()}`);
+          sections.push(parts.join("\n"));
+        }
+        sections.push(`--- fan-out summary: ${okCount} ok / ${failCount} failed across ${allResults.length} servers (parallelism ${parallelism}) ---`);
+        return { content: [{ type: "text", text: sections.join("\n\n") }] };
       }
       // ----- SFTP -----
       case "sftp-list": {
-        const { conn, proxy } = await getServerConnection(String(a.serverId));
-        const listing = await sftpReaddir(conn, String(a.path || "/"), proxy, {
-          recursive: a.recursive === true,
-          maxDepth: typeof a.maxDepth === "number" ? a.maxDepth : void 0,
-          pattern: typeof a.pattern === "string" ? a.pattern : void 0,
-          maxResults: typeof a.maxResults === "number" ? a.maxResults : void 0
+        const bucket = typeof a.bucket === "string" && a.bucket ? a.bucket : "";
+        const recursive = a.recursive === true;
+        const maxResults = Math.max(1, Math.min(5e4, Number(a.maxResults) || 5e3));
+        const pattern = typeof a.pattern === "string" ? a.pattern : "";
+        const summary = a.summary === true;
+        const sortBy = a.sortBy === "size" || a.sortBy === "mtime" || a.sortBy === "name" ? a.sortBy : "name";
+        const reverse = a.reverse === true;
+        let entries;
+        let truncated = false;
+        let warning = "";
+        if (bucket) {
+          const prefix = r2Key(String(a.path || ""));
+          const matcher = pattern ? globToRegExp(pattern) : null;
+          const r2Entries = await r2List(bucket, prefix, { recursive, maxResults });
+          const filtered = matcher ? r2Entries.filter((e) => matcher.test(e.key.split("/").pop() || e.key)) : r2Entries;
+          entries = filtered.map((e) => {
+            const ms = e.mtime ? Date.parse(e.mtime) : 0;
+            return {
+              kind: e.isPrefix ? "d" : "-",
+              size: e.size,
+              mtime: e.mtime,
+              mtimeMs: Number.isFinite(ms) ? ms : 0,
+              path: e.key
+            };
+          });
+        } else {
+          const { conn, proxy } = await getServerConnection(String(a.serverId));
+          const result = await sftpReaddir(conn, String(a.path || "/"), proxy, {
+            recursive,
+            maxDepth: typeof a.maxDepth === "number" ? a.maxDepth : void 0,
+            pattern: pattern || void 0,
+            maxResults
+          });
+          if (result.error && result.entries.length === 0) {
+            return { content: [{ type: "text", text: `Error: ${result.error}` }] };
+          }
+          entries = result.entries;
+          truncated = result.truncated;
+          if (result.error) warning = result.error;
+        }
+        if (summary) {
+          const files = entries.filter((e) => e.kind === "-");
+          const dirs = entries.filter((e) => e.kind === "d");
+          const totalSize = files.reduce((acc, e) => acc + (e.size || 0), 0);
+          const lines2 = [
+            `Files:        ${files.length}`,
+            `Directories:  ${dirs.length}`,
+            `Total size:   ${totalSize} bytes (${(totalSize / (1024 * 1024)).toFixed(2)} MB)`
+          ];
+          if (truncated) lines2.push(`(truncated at ${maxResults}; counts may be partial)`);
+          if (warning) lines2.push(`(warnings: ${warning})`);
+          return { content: [{ type: "text", text: lines2.join("\n") }] };
+        }
+        entries.sort((x, y) => {
+          if (x.kind !== y.kind) return x.kind === "d" ? -1 : 1;
+          let cmp = 0;
+          if (sortBy === "size") cmp = x.size - y.size;
+          else if (sortBy === "mtime") cmp = x.mtimeMs - y.mtimeMs;
+          else cmp = x.path.localeCompare(y.path);
+          return reverse ? -cmp : cmp;
         });
-        return { content: [{ type: "text", text: listing }] };
+        if (entries.length === 0) return { content: [{ type: "text", text: "No entries" }] };
+        const lines = entries.map((e) => {
+          const sizeCol = e.kind === "d" && bucket ? "(prefix)" : String(e.size);
+          return `${e.kind} ${sizeCol.padStart(10)} ${(e.mtime || "").padEnd(24)} ${e.path}`;
+        });
+        if (truncated) lines.push(`... (truncated at ${maxResults} entries; raise maxResults or narrow path/pattern)`);
+        if (warning) lines.push(`! ${warning}`);
+        return { content: [{ type: "text", text: lines.join("\n") }] };
       }
       case "sftp-read": {
+        const bucket = typeof a.bucket === "string" && a.bucket ? a.bucket : "";
+        const offset = a.offset !== void 0 ? Math.max(0, Number(a.offset)) : void 0;
+        const length = a.length !== void 0 ? Math.max(0, Number(a.length)) : void 0;
+        const hasRange = offset !== void 0 || length !== void 0;
+        if (bucket) {
+          const key = r2Key(String(a.path));
+          if (!key) return { content: [{ type: "text", text: "Error: path is required" }] };
+          try {
+            if (hasRange) {
+              const content3 = await r2GetObjectRange(bucket, key, { offset: offset ?? 0, length });
+              return { content: [{ type: "text", text: content3 }] };
+            }
+            const content2 = await r2GetObject(bucket, key, 1048576);
+            return { content: [{ type: "text", text: content2 }] };
+          } catch (e) {
+            return { content: [{ type: "text", text: `Error: ${e instanceof Error ? e.message : String(e)}` }] };
+          }
+        }
         const { conn, proxy } = await getServerConnection(String(a.serverId));
-        const content = await sftpRead(conn, String(a.path), proxy);
+        const content = await sftpRead(conn, String(a.path), proxy, hasRange ? { offset, length } : void 0);
         return { content: [{ type: "text", text: content }] };
       }
       case "sftp-write": {
+        const bucket = typeof a.bucket === "string" && a.bucket ? a.bucket : "";
+        let fileMode;
+        if (typeof a.mode === "number" && Number.isFinite(a.mode)) fileMode = a.mode & 4095;
+        else if (typeof a.mode === "string" && a.mode) {
+          const cleaned = a.mode.replace(/^0o?/i, "");
+          const parsed = parseInt(cleaned, 8);
+          if (!Number.isNaN(parsed)) fileMode = parsed & 4095;
+        }
+        let mtimeMs;
+        if (typeof a.mtime === "number" && Number.isFinite(a.mtime)) mtimeMs = a.mtime;
+        else if (typeof a.mtime === "string" && a.mtime) {
+          const parsed = Date.parse(a.mtime);
+          if (!Number.isNaN(parsed)) mtimeMs = parsed;
+        }
+        if (bucket) {
+          const key = r2Key(String(a.path));
+          if (!key) return { content: [{ type: "text", text: "Error: path is required" }] };
+          if (fileMode !== void 0 || mtimeMs !== void 0) {
+          }
+          try {
+            if (typeof a.sourcePath === "string" && a.sourcePath.length > 0) {
+              const local = a.sourcePath;
+              if (!isAbsolute(local)) return { content: [{ type: "text", text: `Error: sourcePath must be an absolute path: ${local}` }] };
+              if (!existsSync(local)) return { content: [{ type: "text", text: `Error: sourcePath does not exist: ${local}` }] };
+              const st = statSync(local);
+              if (!st.isFile()) return { content: [{ type: "text", text: `Error: sourcePath is not a regular file: ${local}` }] };
+              const startedAt = Date.now();
+              if (st.size > R2_MULTIPART_THRESHOLD) {
+                let lastLog = 0;
+                await r2PutObjectMultipart(bucket, key, local, st.size, (uploaded) => {
+                  if (uploaded - lastLog >= 500 * 1024 * 1024) {
+                    console.error(`[r2-write] ${formatBytes(uploaded)} / ${formatBytes(st.size)} \u2192 r2://${bucket}/${key}`);
+                    lastLog = uploaded;
+                  }
+                });
+                const elapsed2 = Date.now() - startedAt;
+                const mbps = st.size / (1024 * 1024) / Math.max(1e-3, elapsed2 / 1e3);
+                const noteParts = [];
+                if (fileMode !== void 0) noteParts.push("mode ignored (R2)");
+                if (mtimeMs !== void 0) noteParts.push("mtime ignored (R2)");
+                const note = noteParts.length ? ` [${noteParts.join(", ")}]` : "";
+                return { content: [{ type: "text", text: `Uploaded ${formatBytes(st.size)} from ${local} to r2://${bucket}/${key} via multipart in ${(elapsed2 / 1e3).toFixed(1)}s (${mbps.toFixed(1)} MB/s)${note}` }] };
+              }
+              const stream = createReadStream(local);
+              await r2PutObject(bucket, key, stream, st.size);
+              const elapsed = Date.now() - startedAt;
+              return { content: [{ type: "text", text: `Uploaded ${st.size} bytes from ${local} to r2://${bucket}/${key} in ${elapsed}ms` }] };
+            }
+            const buf = Buffer.from(String(a.content ?? ""), "utf-8");
+            await r2PutObject(bucket, key, buf, buf.length);
+            return { content: [{ type: "text", text: `Wrote ${buf.length} bytes to r2://${bucket}/${key}` }] };
+          } catch (e) {
+            return { content: [{ type: "text", text: `Error: ${e instanceof Error ? e.message : String(e)}` }] };
+          }
+        }
         const { conn, proxy } = await getServerConnection(String(a.serverId));
         const input = typeof a.sourcePath === "string" && a.sourcePath.length > 0 ? { sourcePath: a.sourcePath } : { content: String(a.content ?? "") };
-        const result = await sftpWrite(conn, String(a.path), input, proxy);
+        const result = await sftpWrite(conn, String(a.path), input, proxy, { fileMode, mtimeMs });
         return { content: [{ type: "text", text: result }] };
       }
       case "sftp-delete": {
+        const bucket = typeof a.bucket === "string" && a.bucket ? a.bucket : "";
+        const recursive = a.recursive === true;
+        if (bucket) {
+          const key = r2Key(String(a.path));
+          if (!key) return { content: [{ type: "text", text: "Error: path is required" }] };
+          try {
+            if (recursive) {
+              const deleted = await r2DeletePrefix(bucket, key);
+              return { content: [{ type: "text", text: `Deleted ${deleted} object(s) under r2://${bucket}/${key}` }] };
+            }
+            await r2DeleteObject(bucket, key);
+            return { content: [{ type: "text", text: `Deleted r2://${bucket}/${key}` }] };
+          } catch (e) {
+            return { content: [{ type: "text", text: `Error: ${e instanceof Error ? e.message : String(e)}` }] };
+          }
+        }
         const { conn, proxy } = await getServerConnection(String(a.serverId));
-        const result = await sftpDelete(conn, String(a.path), proxy);
+        const result = await sftpDelete(conn, String(a.path), proxy, { recursive });
         return { content: [{ type: "text", text: result }] };
       }
       // ----- Docker -----
       case "docker-list": {
         const format = a.format === "json" ? "json" : "table";
         const composeOnly = a.composeOnly === true;
-        const filterArg = composeOnly ? ' --filter "label=com.docker.compose.project"' : "";
-        const fmtArg = format === "json" ? ` --format '{{json .}}'` : (
-          // Add the compose project as the last column. Docker exposes
-          // labels through the `.Label "key"` method (Labels itself is a
-          // string slice "k=v,k=v" in docker ps, not a map — `index` fails).
-          ` --format 'table {{.Names}}	{{.Image}}	{{.Status}}	{{.Ports}}	{{.Label "com.docker.compose.project"}}'`
-        );
-        const cmd = `docker ps -a${filterArg}${fmtArg}`;
+        const groupByProject = a.groupByProject === true;
+        const nameFiltersRaw = Array.isArray(a.nameFilter) ? a.nameFilter.map((v) => String(v).trim()).filter(Boolean) : typeof a.nameFilter === "string" && a.nameFilter.trim() ? [a.nameFilter.trim()] : [];
+        const filterArg = composeOnly ? ` --filter "label=com.docker.compose.project"` : "";
+        const cmd = `docker ps -a${filterArg} --format '{{json .}}'`;
         const { conn, proxy } = await getServerConnection(String(a.serverId));
         const result = await sshExec(conn, cmd, proxy);
-        return { content: [{ type: "text", text: result.exitCode === 0 ? result.stdout : `Error: ${result.stderr}` }] };
+        if (result.exitCode !== 0) {
+          return { content: [{ type: "text", text: `Error: ${result.stderr || result.stdout}` }] };
+        }
+        const containers = [];
+        for (const line of result.stdout.split("\n")) {
+          const trimmed = line.trim();
+          if (!trimmed) continue;
+          try {
+            containers.push(JSON.parse(trimmed));
+          } catch {
+          }
+        }
+        for (const c of containers) {
+          const m = (c.Labels || "").match(/com\.docker\.compose\.project=([^,]+)/);
+          c.Project = m ? m[1] : "";
+          const status = c.Status || "";
+          if (/\(unhealthy\)/i.test(status)) c.Health = "unhealthy";
+          else if (/\(health: starting\)|\(starting\)/i.test(status)) c.Health = "starting";
+          else if (/\(healthy\)/i.test(status)) c.Health = "healthy";
+          else if (/^Up\b/i.test(status)) c.Health = "no-check";
+          else c.Health = "";
+        }
+        let filtered = containers;
+        if (nameFiltersRaw.length > 0) {
+          const matchers = nameFiltersRaw.map((raw) => {
+            if (raw.includes("*") || raw.includes("?")) return { kind: "glob", re: globToRegExp(raw) };
+            return { kind: "sub", lower: raw.toLowerCase() };
+          });
+          filtered = containers.filter((c) => {
+            const name2 = c.Names || "";
+            const lower = name2.toLowerCase();
+            return matchers.some((m) => m.kind === "glob" ? m.re.test(name2) : lower.includes(m.lower));
+          });
+        }
+        filtered.sort((x, y) => {
+          const px = x.Project || "~";
+          const py = y.Project || "~";
+          const p = px.localeCompare(py);
+          return p !== 0 ? p : (x.Names || "").localeCompare(y.Names || "");
+        });
+        if (format === "json") {
+          const text2 = filtered.map((c) => JSON.stringify(c)).join("\n") || "(no containers)";
+          return { content: [{ type: "text", text: text2 }] };
+        }
+        const fmtRow = (r) => `${(r.Names || "").padEnd(36)}  ${(r.Image || "").padEnd(40)}  ${(r.Status || "").padEnd(24)}  ${(r.Health || "").padEnd(10)}  ${(r.Ports || "").padEnd(40)}`;
+        if (groupByProject) {
+          const groups = /* @__PURE__ */ new Map();
+          for (const c of filtered) {
+            const key = c.Project || "(no compose project)";
+            const list = groups.get(key);
+            if (list) list.push(c);
+            else groups.set(key, [c]);
+          }
+          const out = [];
+          for (const [project, rows] of groups) {
+            out.push(`=== ${project} (${rows.length}) ===`);
+            for (const r of rows) out.push("  " + fmtRow(r));
+            out.push("");
+          }
+          return { content: [{ type: "text", text: out.join("\n").trimEnd() || "(no containers)" }] };
+        }
+        const header = `${"NAMES".padEnd(36)}  ${"IMAGE".padEnd(40)}  ${"STATUS".padEnd(24)}  ${"HEALTH".padEnd(10)}  ${"PORTS".padEnd(40)}  PROJECT`;
+        const body = filtered.map((r) => `${fmtRow(r)}  ${r.Project || ""}`);
+        const text = filtered.length === 0 ? "(no containers match)" : [header, ...body].join("\n");
+        return { content: [{ type: "text", text }] };
       }
       case "docker-logs": {
-        const container = String(a.containerName).replace(/[^a-zA-Z0-9._-]/g, "");
-        const lines = Number(a.lines) || 100;
+        const rawNames = Array.isArray(a.containerName) ? a.containerName.map(String) : [String(a.containerName)];
+        const containers = rawNames.map((n) => n.replace(/[^a-zA-Z0-9._-]/g, "")).filter((n) => n.length > 0);
+        if (containers.length === 0) {
+          return { content: [{ type: "text", text: "Error: no valid containerName provided" }] };
+        }
+        const tail = Number(a.tail) > 0 ? Number(a.tail) : Number(a.lines) > 0 ? Number(a.lines) : 100;
         const sinceRaw = typeof a.since === "string" ? a.since.trim() : "";
         const grepRaw = typeof a.grep === "string" ? a.grep : "";
-        let sinceArg = "";
-        if (sinceRaw) {
-          if (!/^\d+[smhd]$/i.test(sinceRaw) && !/^\d{4}-\d{2}-\d{2}/.test(sinceRaw)) {
-            return { content: [{ type: "text", text: 'Error: invalid `since` format (expected e.g. "10m", "2h", or ISO timestamp)' }] };
-          }
-          sinceArg = ` --since ${posixQuote(sinceRaw)}`;
+        const followSeconds = Math.max(0, Math.min(300, Number(a.followSeconds) || 0));
+        if (sinceRaw && !/^\d+[smhd]$/i.test(sinceRaw) && !/^\d{4}-\d{2}-\d{2}/.test(sinceRaw)) {
+          return { content: [{ type: "text", text: 'Error: invalid `since` format (expected e.g. "10m", "2h", or ISO timestamp)' }] };
         }
-        const grepSuffix = grepRaw ? ` | grep -i -E ${posixQuote(grepRaw)}` : "";
-        const cmd = `docker logs --tail ${lines}${sinceArg} ${container} 2>&1${grepSuffix}`;
+        const sinceArg = sinceRaw ? ` --since ${posixQuote(sinceRaw)}` : "";
+        const grepSuffix = grepRaw ? ` | grep -i -E ${posixQuote(grepRaw)} --line-buffered` : "";
+        const followTail = a.tail !== void 0 || a.lines !== void 0 ? tail : 0;
+        const tailArg = followSeconds > 0 ? followTail : tail;
         const { conn, proxy } = await getServerConnection(String(a.serverId));
+        if (followSeconds > 0) conn.timeout = (followSeconds + 10) * 1e3;
+        const followFlag = followSeconds > 0 ? " -f" : "";
+        if (containers.length === 1) {
+          const c = containers[0];
+          const inner2 = `docker logs${followFlag} --tail ${tailArg}${sinceArg} ${c} 2>&1${grepSuffix}`;
+          const cmd2 = followSeconds > 0 ? `timeout --signal=INT ${followSeconds} sh -c ${posixQuote(inner2)}` : inner2;
+          const result2 = await sshExec(conn, cmd2, proxy);
+          const acceptable2 = followSeconds > 0 ? result2.exitCode === 0 || result2.exitCode === 124 || result2.exitCode === 130 : result2.exitCode === 0 || grepRaw && result2.exitCode === 1;
+          if (!acceptable2) {
+            return { content: [{ type: "text", text: `Error (exit ${result2.exitCode}): ${result2.stderr || result2.stdout}` }] };
+          }
+          return { content: [{ type: "text", text: result2.stdout || "(no log lines matched)" }] };
+        }
+        const subShells = containers.map((c) => {
+          const inner2 = `docker logs${followFlag} --tail ${tailArg}${sinceArg} ${c} 2>&1${grepSuffix}`;
+          return `(${inner2} | sed -u -e ${posixQuote(`s/^/[${c}] /`)})`;
+        });
+        const inner = followSeconds > 0 ? subShells.join(" & ") + " & wait" : subShells.join("; ");
+        const cmd = followSeconds > 0 ? `timeout --signal=INT ${followSeconds} sh -c ${posixQuote(inner)}` : inner;
         const result = await sshExec(conn, cmd, proxy);
-        if (result.exitCode !== 0 && !(grepRaw && result.exitCode === 1)) {
+        const acceptable = followSeconds > 0 ? result.exitCode === 0 || result.exitCode === 124 || result.exitCode === 130 || result.exitCode === 143 : result.exitCode === 0 || grepRaw && result.exitCode === 1;
+        if (!acceptable) {
           return { content: [{ type: "text", text: `Error (exit ${result.exitCode}): ${result.stderr || result.stdout}` }] };
         }
         return { content: [{ type: "text", text: result.stdout || "(no log lines matched)" }] };
@@ -3095,14 +3671,20 @@ ${result.stderr}`);
         const command = String(a.command);
         const args2 = Array.isArray(a.args) ? a.args.map(String) : [];
         const stdin = typeof a.stdin === "string" ? a.stdin : void 0;
+        const interactive = a.interactive === true;
         const workdir = typeof a.workdir === "string" && a.workdir ? ["-w", a.workdir] : [];
         const user = typeof a.user === "string" && a.user ? ["-u", a.user] : [];
-        const stdinFlag = stdin !== void 0 ? ["-i"] : [];
-        const dockerArgs = [...stdinFlag, ...workdir, ...user, container, command, ...args2];
+        const flags = [];
+        if (stdin !== void 0 || interactive) flags.push("-i");
+        if (interactive) flags.push("-t");
+        const dockerArgs = [...flags, ...workdir, ...user, container, command, ...args2];
         const fullCmd = buildPosixCommand("docker", ["exec", ...dockerArgs]);
         const { conn, proxy } = await getServerConnection(String(a.serverId));
         if (a.timeout) conn.timeout = Number(a.timeout);
-        const result = await sshExec(conn, fullCmd, proxy, stdin !== void 0 ? { stdin } : void 0);
+        const result = await sshExec(conn, fullCmd, proxy, {
+          stdin,
+          pty: interactive
+        });
         const output = [`Exit code: ${result.exitCode}`];
         if (result.stdout) output.push(`--- stdout ---
 ${result.stdout}`);
@@ -3390,49 +3972,6 @@ echo -e "$R"
 
 ${lines.join("\n")}` }] };
       }
-      case "domain-get": {
-        const domain = String(a.domain);
-        if (!domain) throw new Error("domain is required");
-        const res = await mijnhostFetch(`/domains/${encodeURIComponent(domain)}`);
-        const d = res.data;
-        const sections = [
-          `=== ${d.domain} ===`,
-          `Status: ${d.status}`,
-          `Renewal: ${d.renewal_date}`,
-          `Locked: ${d.is_locked ? "Yes" : "No"} (lockable: ${d.is_lockable ? "Yes" : "No"})`,
-          `Managed DNS: ${d.managed_dns ? "Yes" : "No"}`,
-          `DNSSEC: ${d.dnssec_enabled ? "Enabled" : "Disabled"}`,
-          `Nameservers: ${d.nameservers.join(", ")}`,
-          "",
-          "--- Contact Handles ---",
-          `Owner: ${d.handles?.owner?.name ?? "-"}`,
-          `Admin: ${d.handles?.admin?.name ?? "-"}`,
-          `Tech: ${d.handles?.tech?.name ?? "-"}`,
-          `Reseller: ${d.handles?.reseller?.name ?? "-"}`
-        ];
-        if (d.messages?.length) {
-          sections.push("", "--- Messages ---", ...d.messages);
-        }
-        return { content: [{ type: "text", text: sections.join("\n") }] };
-      }
-      case "domain-update-ns": {
-        const domain = String(a.domain);
-        const nameserver = String(a.nameserver);
-        if (!domain || !nameserver) throw new Error("domain and nameserver are required");
-        await mijnhostFetch(`/domains/${encodeURIComponent(domain)}`, {
-          method: "PUT",
-          body: JSON.stringify({ nameserver })
-        });
-        const verify = await mijnhostFetch(`/domains/${encodeURIComponent(domain)}`);
-        const ns = verify.data.nameservers;
-        return {
-          content: [{
-            type: "text",
-            text: `Nameservers for ${domain} updated to profile "${nameserver}".
-Current nameservers: ${ns.join(", ")}`
-          }]
-        };
-      }
       case "dns-list": {
         const domain = String(a.domain);
         if (!domain) throw new Error("domain is required");