hostctl 0.1.41 → 0.1.42

package/dist/index.js

@@ -2581,7 +2581,7 @@ var Verbosity = {
 };
 
 // src/version.ts
-var version = "0.1.41";
+var version = "0.1.42";
 
 // src/commands/pkg/create.ts
 import { promises as fs5 } from "fs";
@@ -6186,7 +6186,7 @@ __export(dir_exports, {
 // src/core/dir/exists.ts
 async function run5(context) {
   const { params, exec, error } = context;
-  const { path: path10 } = params;
+  const { path: path10, sudo = false } = params;
   if (!path10) {
     error('Required parameter "path" is missing');
     return {
@@ -6196,8 +6196,7 @@ async function run5(context) {
     };
   }
   try {
-    const command = ["test", "-d", path10].join(" ");
-    const { success: exists2 } = await exec(command);
+    const { success: exists2 } = await exec(["test", "-d", path10], { sudo });
     return {
       exists: exists2,
       success: true
@@ -6423,7 +6422,7 @@ var copy_default2 = task(run9, { name: "core.dir.copy", description: "Dir copy."
 
 // src/core/dir/create.ts
 async function runFn(context) {
-  const { params, exec, run: run245 } = context;
+  const { params, exec, run: run247 } = context;
   const { path: path10, mode, owner } = params;
   if (!path10) {
     return {
@@ -6447,7 +6446,7 @@ async function runFn(context) {
     }
     let chmodSuccess = true;
     if (mode && mkdirSuccess) {
-      const chmodResult = await run245(chmod_default({ path: path10, mode, sudo: !!owner }));
+      const chmodResult = await run247(chmod_default({ path: path10, mode, sudo: !!owner }));
       chmodSuccess = chmodResult?.success ?? false;
     }
     return {
@@ -6525,7 +6524,7 @@ var chgrp_default = task(run10, { name: "core.file.chgrp", description: "Chgrp."
 // src/core/file/exists.ts
 async function run11(context) {
   const { params, exec, error } = context;
-  const { path: path10 } = params;
+  const { path: path10, sudo = false } = params;
   if (!path10) {
     error('Required parameter "path" is missing');
     return {
@@ -6535,7 +6534,7 @@ async function run11(context) {
     };
   }
   try {
-    const { success: exists2 } = await exec(["test", "-f", path10]);
+    const { success: exists2 } = await exec(["test", "-f", path10], { sudo });
     return {
       exists: exists2,
       success: true
@@ -6553,7 +6552,7 @@ var exists_default2 = task(run11, { name: "core.file.exists", description: "File
 // src/core/file/touch.ts
 async function run12(context) {
   const { params, exec, run: runTask, error } = context;
-  const { file, mode, owner } = params;
+  const { file, mode, owner, sudo = false } = params;
   if (!file) {
     error('Required parameter "file" is missing');
     return {
@@ -6565,6 +6564,8 @@ async function run12(context) {
     const touchCommandArray = [];
     if (owner) {
       touchCommandArray.push("sudo", "-u", owner);
+    } else if (sudo) {
+      touchCommandArray.push("sudo");
     }
     touchCommandArray.push("touch", file);
     const { success: touchSuccess } = await exec(touchCommandArray);
@@ -6580,8 +6581,7 @@ async function run12(context) {
         chmod_default({
           path: file,
           mode,
-          sudo: !!owner
-          // Original logic: sudo for chmod is based on owner presence
+          sudo: !!owner || sudo
         })
       );
       chmodSuccess = chmodResult?.success ?? false;
@@ -6601,7 +6601,7 @@ var touch_default = task(run12, { name: "core.file.touch", description: "Touches
 // src/core/file/delete.ts
 async function run13(context) {
   const { params, exec, error } = context;
-  const { path: path10, recursive = false, force = false } = params;
+  const { path: path10, recursive = false, force = false, sudo = false } = params;
   if (!path10) {
     error('Required parameter "path" is missing');
     return {
@@ -6610,8 +6610,8 @@ async function run13(context) {
     };
   }
   try {
-    const p = Path.new(path10);
-    if (!await p.exists()) {
+    const { success: exists2 } = await exec(["test", "-e", path10], { sudo });
+    if (!exists2) {
       return {
         success: true
       };
@@ -6625,7 +6625,7 @@ async function run13(context) {
     }
     args.push("--");
     args.push(path10);
-    const { success } = await exec(["rm", ...args]);
+    const { success } = await exec(["rm", ...args], { sudo });
     return {
       success
     };
@@ -6695,6 +6695,17 @@ var KeySequence = {
 // src/core/file/edit.ts
 import { dirname as dirname2 } from "path";
 
+// src/util/ansi.ts
+var OSC_SEQUENCE_REGEX = /\u001b\][\s\S]*?(?:\u0007|\u001b\\)/g;
+var CSI_SEQUENCE_REGEX = /\u001b\[[0-9;?]*[ -\/]*[@-~]/g;
+var TWO_CHAR_ESCAPE_REGEX = /\u001b[@-_]/g;
+function stripAnsiSequences(input) {
+  if (!input) {
+    return "";
+  }
+  return input.replace(OSC_SEQUENCE_REGEX, "").replace(CSI_SEQUENCE_REGEX, "").replace(TWO_CHAR_ESCAPE_REGEX, "").replace(/\u0007/g, "");
+}
+
 // src/core/file/grep.ts
 async function run15(context) {
   const { params, exec, error } = context;
@@ -6710,7 +6721,8 @@ async function run15(context) {
     after_context,
     context: contextLines,
     max_count,
-    return_lines = false
+    return_lines = false,
+    sudo = false
   } = params;
   if (!file) {
     error('Required parameter "file" is missing');
@@ -6750,12 +6762,13 @@ async function run15(context) {
     if (after_context !== void 0) grepArgs.push("-A", String(after_context));
     if (max_count !== void 0) grepArgs.push("-m", String(max_count));
     grepArgs.push(pattern, file);
-    const { success, stdout } = await exec(grepArgs);
+    const { success, stdout } = await exec(grepArgs, { sudo });
+    const cleanedStdout = stripAnsiSequences(stdout);
     if (!needContent) {
-      const count = stdout ? parseInt(stdout.trim(), 10) : 0;
+      const count = cleanedStdout ? parseInt(cleanedStdout.trim(), 10) : 0;
       return { found: success, count, success: true };
     }
-    const lines = stdout ? stdout.trim().split("\n").map((l) => l.replace(/\r$/, "")).filter((l) => l.length > 0) : [];
+    const lines = cleanedStdout ? cleanedStdout.trim().split("\n").map((l) => l.replace(/\r$/, "")).filter((l) => l.length > 0) : [];
     return {
       found: success,
       count: lines.length,
@@ -6786,7 +6799,7 @@ async function ensureFile(context, file, sudo) {
   await exec(["touch", file], { sudo });
 }
 async function runFn2(context) {
-  const { params, exec, info, run: run245, error } = context;
+  const { params, exec, info, run: run247, error } = context;
   const {
     file,
     state = "present",
@@ -8082,8 +8095,8 @@ async function run37(context) {
   }
   try {
     const cmd = `curl -fsSL ${url} | gpg --dearmor -o ${keyring}`;
-    info(`Executing: ${cmd}`);
-    const result = await exec(cmd, { sudo });
+    info(`Adding apt key from ${url} to ${keyring}`);
+    const result = await exec(["bash", "-lc", cmd], { sudo });
     if (result.exitCode !== 0) {
       const errorMsg = `Failed to add key: ${result.stderr}`;
       error(errorMsg);
@@ -8115,9 +8128,11 @@ async function run38(context) {
   }
   const listFilePath = path5.join("/etc/apt/sources.list.d", `${name}.list`);
   try {
-    const cmd = `echo "${repo}" > ${listFilePath}`;
-    info(`Executing: ${cmd}`);
-    const result = await exec(cmd, { sudo });
+    const heredoc = `cat <<'EOF' > ${listFilePath}
+${repo}
+EOF`;
+    info(`Writing repository definition to ${listFilePath}`);
+    const result = await exec(["bash", "-lc", heredoc], { sudo });
     if (result.exitCode !== 0) {
       const errorMsg = `Failed to add repository: ${result.stderr}`;
       error(errorMsg);
@@ -9809,13 +9824,13 @@ var PACKAGE_MANAGERS = {
   },
   pacman: {
     name: "pacman",
-    installCommand: ["pacman", "-S", "--noconfirm", "--needed", "--quiet"],
-    uninstallCommand: ["pacman", "-R", "--noconfirm", "--cascade", "--quiet"],
-    updateCommand: ["pacman", "-Sy", "--quiet"],
-    upgradeCommand: ["pacman", "-Syu", "--noconfirm", "--quiet"],
+    installCommand: ["pacman", "-S", "--noconfirm", "--needed"],
+    uninstallCommand: ["pacman", "-R", "--noconfirm", "--cascade"],
+    updateCommand: ["pacman", "-Sy"],
+    upgradeCommand: ["pacman", "-Syu", "--noconfirm"],
     searchCommand: ["pacman", "-Ss"],
-    listCommand: ["pacman", "-Q", "--quiet"],
-    cleanCommand: ["pacman", "-Sc", "--noconfirm", "--quiet"]
+    listCommand: ["pacman", "-Q"],
+    cleanCommand: ["pacman", "-Sc", "--noconfirm"]
   },
   zypper: {
     name: "zypper",
@@ -9882,28 +9897,41 @@ var PACKAGE_MANAGERS = {
     cleanCommand: ["brew", "cleanup", "--quiet", "--no-progress"]
   }
 };
+async function commandExists(exec, binary) {
+  const candidates = [
+    ["/bin/sh", "-c", `command -v ${binary} >/dev/null 2>&1`],
+    ["which", binary],
+    ["cmd", "/c", `where ${binary}`]
+  ];
+  for (const candidate of candidates) {
+    try {
+      const result = await exec(candidate);
+      if (result.exitCode === 0) {
+        return true;
+      }
+    } catch {
+    }
+  }
+  return false;
+}
 async function detectPackageManager(context) {
   const { exec } = context;
   try {
     const managers = [
-      { name: "apt", test: "which apt-get" },
-      { name: "apk", test: "which apk" },
-      { name: "dnf", test: "which dnf" },
-      { name: "yum", test: "which yum" },
-      { name: "pacman", test: "which pacman" },
-      { name: "zypper", test: "which zypper" },
-      { name: "eopkg", test: "which eopkg" },
-      { name: "winget", test: "which winget" },
-      { name: "choco", test: "which choco" },
-      { name: "brew", test: "which brew" }
+      { name: "apt", binary: "apt-get" },
+      { name: "apk", binary: "apk" },
+      { name: "dnf", binary: "dnf" },
+      { name: "yum", binary: "yum" },
+      { name: "pacman", binary: "pacman" },
+      { name: "zypper", binary: "zypper" },
+      { name: "eopkg", binary: "eopkg" },
+      { name: "winget", binary: "winget" },
+      { name: "choco", binary: "choco" },
+      { name: "brew", binary: "brew" }
     ];
     for (const manager of managers) {
-      try {
-        const result = await exec(manager.test);
-        if (result.exitCode === 0) {
-          return PACKAGE_MANAGERS[manager.name];
-        }
-      } catch {
+      if (await commandExists(exec, manager.binary)) {
+        return PACKAGE_MANAGERS[manager.name];
       }
     }
   } catch (error) {
@@ -11234,23 +11262,48 @@ var docker_exports = {};
 __export(docker_exports, {
   addUsers: () => add_users_default,
   install: () => install_default6,
-  installCompose: () => install_compose_default
+  installCompose: () => install_compose_default,
+  runContainer: () => run_container_default,
+  runContainerDetached: () => run_container_detached_default
 });
 
 // src/core/docker/installers/debian.ts
-async function installForDebian(context, _variant, installComposePlugin) {
-  const { info, error, run: runTask } = context;
-  info("Running Debian/Ubuntu installation workflow...");
+var LEGACY_PACKAGES = ["docker", "docker-engine", "docker.io", "containerd", "runc"];
+var KEYRING_PATH = "/etc/apt/keyrings/docker.gpg";
+function resolveAptDistro(variant) {
+  if (variant?.toLowerCase().includes("ubuntu")) {
+    return "ubuntu";
+  }
+  return "debian";
+}
+async function getCodename(exec) {
+  const result = await exec(["bash", "-lc", '. /etc/os-release && echo "$VERSION_CODENAME"']);
+  if (result.exitCode === 0) {
+    return result.stdout.trim();
+  }
+  return void 0;
+}
+async function getArchitecture(exec) {
+  const result = await exec(["dpkg", "--print-architecture"]);
+  if (result.exitCode === 0) {
+    return result.stdout.trim();
+  }
+  return void 0;
+}
+async function installForDebian(context, variant, installComposePlugin) {
+  const { info, error, run: runTask, exec } = context;
+  info("Running Debian/Ubuntu installation workflow using official Docker instructions...");
   try {
+    await exec(["bash", "-lc", `apt-get remove -y ${LEGACY_PACKAGES.join(" ")} || true`], { sudo: true });
     const updateResult = await runTask(core_default.pkg.update({}));
     if (!updateResult?.success) {
-      const message = `Failed to update package list: ${updateResult?.error ?? "Unknown error"}`;
+      const message = `Failed to update package list before prerequisites: ${updateResult?.error ?? "Unknown error"}`;
       error(message);
       return { success: false, error: message };
     }
     const prereqResult = await runTask(
       core_default.pkg.install({
-        package: ["apt-transport-https", "ca-certificates", "curl", "gnupg", "lsb-release"]
+        package: ["ca-certificates", "curl", "gnupg"]
       })
     );
     if (!prereqResult?.success) {
@@ -11258,10 +11311,12 @@ async function installForDebian(context, _variant, installComposePlugin) {
       error(message);
       return { success: false, error: message };
     }
+    await exec(["install", "-m", "0755", "-d", "/etc/apt/keyrings"], { sudo: true });
+    const distro = resolveAptDistro(variant);
     const gpgResult = await runTask(
       core_default.apt.add_key({
-        url: "https://download.docker.com/linux/ubuntu/gpg",
-        keyring: "/usr/share/keyrings/docker-archive-keyring.gpg"
+        url: `https://download.docker.com/linux/${distro}/gpg`,
+        keyring: KEYRING_PATH
       })
     );
     if (!gpgResult?.success) {
@@ -11269,9 +11324,23 @@ async function installForDebian(context, _variant, installComposePlugin) {
       error(message);
       return { success: false, error: message };
     }
+    await exec(["chmod", "a+r", KEYRING_PATH], { sudo: true });
+    const architecture = await getArchitecture(exec);
+    if (!architecture) {
+      const message = "Unable to determine system architecture via dpkg.";
+      error(message);
+      return { success: false, error: message };
+    }
+    const codename = await getCodename(exec);
+    if (!codename) {
+      const message = "Unable to determine OS codename for Docker repository.";
+      error(message);
+      return { success: false, error: message };
+    }
+    const repoLine = `deb [arch=${architecture} signed-by=${KEYRING_PATH}] https://download.docker.com/linux/${distro} ${codename} stable`;
     const repoResult = await runTask(
       core_default.apt.add_repository({
-        repo: "deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu jammy stable",
+        repo: repoLine,
         name: "docker"
       })
     );
@@ -11280,26 +11349,36 @@ async function installForDebian(context, _variant, installComposePlugin) {
       error(message);
       return { success: false, error: message };
     }
-    const dockerResult = await runTask(
-      core_default.pkg.install({
-        package: ["docker-ce", "docker-ce-cli", "containerd.io", "docker-buildx-plugin"]
-      })
-    );
+    const refreshResult = await runTask(core_default.pkg.update({}));
+    if (!refreshResult?.success) {
+      const message = `Failed to refresh package cache after adding Docker repository: ${refreshResult?.error ?? "Unknown error"}`;
+      error(message);
+      return { success: false, error: message };
+    }
+    const packages = ["docker-ce", "docker-ce-cli", "containerd.io", "docker-buildx-plugin"];
+    if (installComposePlugin) {
+      packages.push("docker-compose-plugin");
+    }
+    const dockerResult = await runTask(core_default.pkg.install({ package: packages }));
     if (!dockerResult?.success) {
       const message = `Failed to install Docker Engine: ${dockerResult?.error ?? "Unknown error"}`;
       error(message);
       return { success: false, error: message };
     }
-    if (installComposePlugin) {
-      const composeResult = await runTask(core_default.pkg.install({ package: "docker-compose-plugin" }));
-      if (!composeResult?.success) {
-        const message = `Failed to install Docker Compose plugin: ${composeResult?.error ?? "Unknown error"}`;
-        error(message);
-        return { success: false, error: message };
-      }
+    await exec(["systemctl", "daemon-reload"], { sudo: true }).catch(() => {
+    });
+    const enableResult = await runTask(core_default.systemd.enable({ service: "docker", sudo: true }));
+    if (!enableResult?.success) {
+      const message = `Failed to enable docker service: ${enableResult?.error ?? "Unknown error"}`;
+      error(message);
+      return { success: false, error: message };
+    }
+    const startResult = await runTask(core_default.systemd.start({ service: "docker", sudo: true }));
+    if (!startResult?.success) {
+      const message = `Failed to start docker service: ${startResult?.error ?? "Unknown error"}`;
+      error(message);
+      return { success: false, error: message };
     }
-    await runTask(core_default.systemd.enable({ service: "docker" }));
-    await runTask(core_default.systemd.start({ service: "docker" }));
     return { success: true };
   } catch (e) {
     const message = `An unexpected error occurred: ${e instanceof Error ? e.message : String(e)}`;
@@ -11308,64 +11387,386 @@ async function installForDebian(context, _variant, installComposePlugin) {
   }
 }
 
+// src/core/docker/installers/kernel-prereqs.ts
+var DEFAULT_MODULES = [
+  "overlay",
+  "br_netfilter",
+  "bridge",
+  "veth",
+  "ip_tables",
+  "iptable_filter",
+  "iptable_mangle",
+  "iptable_raw",
+  "iptable_nat",
+  "ip6table_filter",
+  "ip6table_mangle",
+  "ip6table_raw",
+  "ip6table_nat",
+  "nf_tables",
+  "nft_chain_nat",
+  "nfnetlink",
+  "nf_nat",
+  "nf_nat_ipv4",
+  "nf_nat_ipv6",
+  "nf_conntrack",
+  "nf_conntrack_ipv4",
+  "nf_conntrack_ipv6",
+  "xt_conntrack",
+  "xt_addrtype",
+  "xt_comment",
+  "xt_mark",
+  "xt_nat",
+  "xt_MASQUERADE"
+];
+var DEFAULT_SYSCTL = {
+  "net.bridge.bridge-nf-call-iptables": "1",
+  "net.bridge.bridge-nf-call-ip6tables": "1",
+  "net.bridge.bridge-nf-call-arptables": "1",
+  "net.ipv4.ip_forward": "1"
+};
+var DEFAULT_MODULES_FILE = "/etc/modules-load.d/hostctl-docker.conf";
+var DEFAULT_SYSCTL_FILE = "/etc/sysctl.d/99-hostctl-docker.conf";
+async function ensureDockerKernelPrereqs(context, options = {}) {
+  const modules = options.modules ?? DEFAULT_MODULES;
+  const sysctlEntries = options.sysctl ?? DEFAULT_SYSCTL;
+  const modulesFile = options.modulesFile ?? DEFAULT_MODULES_FILE;
+  const sysctlFile = options.sysctlFile ?? DEFAULT_SYSCTL_FILE;
+  const { debug, info } = context;
+  const failedModules = [];
+  const failedSysctls = [];
+  if (modules.length) {
+    const uniqueModules = Array.from(new Set(modules.filter((name) => typeof name === "string" && name.length > 0)));
+    const moduleContent = `${uniqueModules.join("\n")}
+`;
+    const moduleScript = [`cat <<'EOF' > ${modulesFile}`, moduleContent, "EOF"].join("\n");
+    await context.exec(["bash", "-lc", moduleScript], { sudo: true }).catch(() => {
+    });
+    for (const moduleName of uniqueModules) {
+      try {
+        const result = await context.exec(["modprobe", moduleName], { sudo: true });
+        if (result.exitCode !== 0) {
+          failedModules.push(moduleName);
+          debug?.(
+            `modprobe ${moduleName} exited with ${result.exitCode}: ${result.stderr || result.stdout || "no output"}`
+          );
+        }
+      } catch (error) {
+        failedModules.push(moduleName);
+        debug?.(`Failed to modprobe ${moduleName}: ${error.message}`);
+      }
+    }
+  }
+  const sysctlKeys = Object.keys(sysctlEntries);
+  if (sysctlKeys.length) {
+    const sysctlContent = `${sysctlKeys.map((key) => `${key} = ${sysctlEntries[key]}`).join("\n")}
+`;
+    const sysctlScript = [`cat <<'EOF' > ${sysctlFile}`, sysctlContent, "EOF"].join("\n");
+    await context.exec(["bash", "-lc", sysctlScript], { sudo: true }).catch(() => {
+    });
+    for (const [key, value] of Object.entries(sysctlEntries)) {
+      try {
+        const result = await context.exec(["sysctl", "-w", `${key}=${value}`], { sudo: true });
+        if (result.exitCode !== 0) {
+          failedSysctls.push(key);
+          debug?.(`sysctl write ${key} failed with ${result.exitCode}: ${result.stderr || result.stdout || "no output"}`);
+        }
+      } catch (error) {
+        failedSysctls.push(key);
+        debug?.(`Failed to write sysctl ${key}: ${error.message}`);
+      }
+    }
+  }
+  if (failedModules.length) {
+    info?.(
+      `Unable to load kernel modules required by Docker: ${failedModules.join(
+        ", "
+      )}. Containers may fail to start if the hypervisor kernel omits these modules.`
+    );
+  }
+  if (failedSysctls.length) {
+    info?.(
+      `Failed to apply Docker networking sysctl keys: ${failedSysctls.join(
+        ", "
+      )}. Check kernel support for these parameters.`
+    );
+  }
+}
+async function ensureNftNatTables(context) {
+  const { info } = context;
+  const script = `
+set -e
+if ! command -v nft >/dev/null 2>&1; then
+  exit 0
+fi
+ensure_table() {
+  local family="$1"
+  if nft list table "$family" nat >/dev/null 2>&1; then
+    return 0
+  fi
+  nft add table "$family" nat >/dev/null 2>&1 || true
+}
+ensure_chain() {
+  local family="$1"
+  local chain="$2"
+  local hook="$3"
+  local priority="$4"
+  if nft list chain "$family" nat "$chain" >/dev/null 2>&1; then
+    return 0
+  fi
+  nft add chain "$family" nat "$chain" "{ type nat hook $hook priority $priority; policy accept; }" >/dev/null 2>&1 || true
+}
+for family in ip ip6; do
+  ensure_table "$family"
+  ensure_chain "$family" PREROUTING prerouting dstnat
+  ensure_chain "$family" INPUT input dstnat
+  ensure_chain "$family" OUTPUT output dstnat
+  ensure_chain "$family" POSTROUTING postrouting srcnat
+done
+`.trim();
+  const result = await context.exec(["bash", "-lc", script], { sudo: true }).catch((error) => {
+    info?.(`Failed to ensure nftables nat tables: ${error.message}`);
+    return void 0;
+  });
+  if (result?.exitCode === 0) {
+    info?.("Ensured nftables nat tables/chains with nat priorities exist for ip and ip6 families.");
+  }
+}
+
 // src/core/docker/installers/fedora.ts
-async function installForFedora(context, installComposePlugin) {
-  const { info, error, run: runTask } = context;
-  info("Running Fedora/RHEL/CentOS installation workflow...");
+var LEGACY_PACKAGES2 = [
+  "docker",
+  "docker-client",
+  "docker-client-latest",
+  "docker-common",
+  "docker-latest",
+  "docker-latest-logrotate",
+  "docker-logrotate",
+  "docker-engine",
+  "podman-docker"
+];
+function resolveRepoBase(variant) {
+  const normalized = variant?.toLowerCase() ?? "";
+  if (normalized.includes("fedora")) {
+    return "fedora";
+  }
+  if (normalized.includes("rhel")) {
+    return "rhel";
+  }
+  return "centos";
+}
+async function hasCommand(exec, binary) {
+  const result = await exec(["bash", "-lc", `command -v ${binary}`]);
+  return result.exitCode === 0;
+}
+async function detectPackageManager2(exec) {
+  if (await hasCommand(exec, "dnf")) {
+    return "dnf";
+  }
+  return "yum";
+}
+function repoFallbackContent(repoBase) {
+  return `[docker-ce-stable]
+name=Docker CE Stable - $basearch
+baseurl=https://download.docker.com/linux/${repoBase}/$releasever/$basearch/stable
+enabled=1
+gpgcheck=1
+gpgkey=https://download.docker.com/linux/${repoBase}/gpg`;
+}
+async function refreshPackageMetadata(exec, manager) {
+  const command = manager === "dnf" ? ["dnf", "-y", "makecache", "--refresh", "--quiet"] : ["yum", "-y", "makecache", "--quiet"];
+  const result = await exec(command, { sudo: true });
+  if (result.exitCode === 0) {
+    return { success: true };
+  }
+  const failure = result.stderr?.trim() || result.stdout?.trim() || `exit ${result.exitCode}`;
+  return { success: false, error: failure };
+}
+async function installKernelModulePackages(context, manager) {
+  const { exec, info } = context;
   try {
-    const updateResult = await runTask(core_default.pkg.update({}));
-    if (!updateResult?.success) {
-      const message = `Failed to update package list: ${updateResult?.error ?? "Unknown error"}`;
-      error(message);
-      return { success: false, error: message };
+    const kernelResult = await exec(["uname", "-r"]);
+    const release = kernelResult.stdout.trim();
+    if (!release) {
+      return;
     }
-    const prereqResult = await runTask(
+    const packages = [`kernel-modules-${release}`, `kernel-modules-extra-${release}`];
+    const installCommand = manager === "dnf" ? `dnf install -y --skip-broken --setopt=install_weak_deps=0 ${packages.join(" ")}` : `yum install -y ${packages.join(" ")}`;
+    const result = await exec(["bash", "-lc", installCommand], { sudo: true });
+    if (result.exitCode === 0) {
+      info?.(`Ensured kernel module packages for ${release} are installed.`);
+    } else {
+      info?.(
+        `Failed to install kernel module packages (${packages.join(
+          ", "
+        )}) for ${release}: ${result.stderr || result.stdout || `exit ${result.exitCode}`}`
+      );
+    }
+  } catch (error) {
+    info?.(`Unable to install kernel module packages: ${error.message}`);
+  }
+}
+async function ensureIptablesBackend(context, runTask, manager, backend) {
+  const { info } = context;
+  if (backend === "legacy") {
+    const legacyResult = await runTask(
       core_default.pkg.install({
-        package: ["yum-utils", "device-mapper-persistent-data", "lvm2"]
+        package: ["iptables-legacy"],
+        packageManager: manager
       })
     );
+    if (!legacyResult?.success) {
+      info?.(
+        "iptables-legacy package could not be installed (may not exist for this distro); attempting to switch existing binaries."
+      );
+    }
+  }
+  const suffix = backend === "legacy" ? "legacy" : "nft";
+  const script = `
+set +e
+switch_backend() {
+  local tool="$1"
+  local suffix="$2"
+  local target=""
+  for candidate in /usr/sbin/\${tool}-\${suffix} /usr/bin/\${tool}-\${suffix}; do
+    if [ -x "$candidate" ]; then
+      target="$candidate"
+      break
+    fi
+  done
+  if [ -z "$target" ]; then
+    return 1
+  fi
+  if command -v alternatives >/dev/null 2>&1; then
+    alternatives --set "$tool" "$target" >/dev/null 2>&1 || true
+  fi
+  if command -v update-alternatives >/dev/null 2>&1; then
+    update-alternatives --set "$tool" "$target" >/dev/null 2>&1 || true
+  fi
+  ln -sf "$target" "/usr/sbin/$tool" 2>/dev/null || true
+  ln -sf "$target" "/usr/bin/$tool" 2>/dev/null || true
+  return 0
+}
+status=0
+for tool in iptables ip6tables ebtables arptables; do
+  if ! switch_backend "$tool" "${suffix}"; then
+    status=1
+  fi
+done
+exit $status
+`.trim();
+  const switchResult = await context.exec(["bash", "-lc", script], { sudo: true });
+  if (switchResult.exitCode !== 0) {
+    info?.(`Failed to switch iptables utilities to the ${backend} backend (exit ${switchResult.exitCode}).`);
+    return false;
+  }
+  try {
+    const version2 = await context.exec(["iptables", "--version"], { sudo: true });
+    const output = version2.stdout.trim();
+    const expected = backend === "legacy" ? "(legacy)" : "(nf_tables)";
+    const matches2 = output.includes(expected);
+    info?.(`iptables now reports: ${output}`);
+    return matches2;
+  } catch (error) {
+    info?.(`Unable to verify iptables backend: ${error.message}`);
+    return false;
+  }
+}
+async function installForFedora(context, variant, installComposePlugin) {
+  const { info, error, run: runTask, exec } = context;
+  info("Running Fedora/RHEL/CentOS installation workflow using official Docker instructions...");
+  try {
+    const manager = await detectPackageManager2(exec);
+    const repoBase = resolveRepoBase(variant);
+    const repoUrl = `https://download.docker.com/linux/${repoBase}/docker-ce.repo`;
+    info(`Removing legacy/conflicting Docker packages via ${manager}...`);
+    await exec(["bash", "-lc", `${manager} remove -y ${LEGACY_PACKAGES2.join(" ")} || true`], { sudo: true });
+    info("Refreshing package metadata before installing prerequisites...");
+    const metadataResult = await refreshPackageMetadata(exec, manager);
+    if (!metadataResult.success) {
+      const message = `Failed to refresh package metadata before prerequisites: ${metadataResult.error ?? "Unknown error"}`;
+      error(message);
+      return { success: false, error: message };
+    }
+    const pluginPackage = manager === "dnf" ? "dnf-plugins-core" : "yum-utils";
+    const prereqPackages = [pluginPackage, "device-mapper-persistent-data", "lvm2", "iproute", "iptables"];
+    if (repoBase !== "fedora") {
+      prereqPackages.push("kernel-modules");
+      prereqPackages.push("kernel-modules-extra");
+    }
+    info(`Installing prerequisite packages: ${prereqPackages.join(", ")}...`);
+    const prereqResult = await runTask(core_default.pkg.install({ package: prereqPackages }));
     if (!prereqResult?.success) {
-      const message = `Failed to install prerequisites: ${prereqResult?.error ?? "Unknown error"}`;
+      const message = `Failed to install prerequisite packages: ${prereqResult?.error ?? "Unknown error"}`;
       error(message);
       return { success: false, error: message };
     }
-    const repoContent = `[docker-ce-stable]
-name=Docker CE Stable - $basearch
-baseurl=https://download.docker.com/linux/centos/$releasever/$basearch/stable
-enabled=1
-gpgcheck=1
-gpgkey=https://download.docker.com/linux/centos/gpg`;
-    const repoResult = await runTask(
-      core_default.yum.add_repository({
-        content: repoContent,
-        name: "docker-ce"
-      })
-    );
-    if (!repoResult?.success) {
-      const message = `Failed to add Docker repository: ${repoResult?.error ?? "Unknown error"}`;
+    let repoAdded = false;
+    if (manager === "dnf") {
+      info("Adding Docker CE repository via dnf config-manager...");
+      const addResult = await exec(["dnf", "config-manager", "--add-repo", repoUrl], { sudo: true });
+      repoAdded = addResult.exitCode === 0;
+    } else {
+      info("Adding Docker CE repository via yum-config-manager...");
+      const addResult = await exec(["yum-config-manager", "--add-repo", repoUrl], { sudo: true });
+      repoAdded = addResult.exitCode === 0;
+    }
+    if (!repoAdded) {
+      info("Falling back to manual Docker repo file...");
+      const repoResult = await runTask(
+        core_default.yum.add_repository({
+          content: repoFallbackContent(repoBase),
+          name: "docker-ce"
+        })
+      );
+      if (!repoResult?.success) {
+        const message = `Failed to add Docker repository: ${repoResult?.error ?? "Unknown error"}`;
+        error(message);
+        return { success: false, error: message };
+      }
+    }
+    info("Refreshing package metadata after adding Docker repository...");
+    const refreshResult = await refreshPackageMetadata(exec, manager);
+    if (!refreshResult.success) {
+      const message = `Failed to refresh package metadata after adding Docker repository: ${refreshResult.error ?? "Unknown error"}`;
       error(message);
       return { success: false, error: message };
     }
-    const dockerResult = await runTask(
-      core_default.pkg.install({
-        package: ["docker-ce", "docker-ce-cli", "containerd.io", "docker-buildx-plugin"]
-      })
-    );
+    const packages = ["docker-ce", "docker-ce-cli", "containerd.io", "docker-buildx-plugin"];
+    if (installComposePlugin) {
+      packages.push("docker-compose-plugin");
+    }
+    info(`Installing Docker Engine packages: ${packages.join(", ")}...`);
+    const dockerResult = await runTask(core_default.pkg.install({ package: packages }));
     if (!dockerResult?.success) {
-      const message = `Failed to install Docker Engine: ${dockerResult?.error ?? "Unknown error"}`;
+      const message = `Failed to install Docker Engine packages: ${dockerResult?.error ?? "Unknown error"}`;
       error(message);
       return { success: false, error: message };
     }
-    if (installComposePlugin) {
-      const composeResult = await runTask(core_default.pkg.install({ package: "docker-compose-plugin" }));
-      if (!composeResult?.success) {
-        const message = `Failed to install Docker Compose plugin: ${composeResult?.error ?? "Unknown error"}`;
-        error(message);
-        return { success: false, error: message };
-      }
+    info("Configuring kernel modules and sysctl prerequisites for Docker networking...");
+    await installKernelModulePackages(context, manager);
+    await ensureDockerKernelPrereqs(context);
+    info("Ensuring iptables utilities use the legacy backend...");
+    const legacySelected = await ensureIptablesBackend(context, runTask, manager, "legacy");
+    if (!legacySelected) {
+      info("Continuing with nftables backend for iptables; ensuring nft nat tables exist.");
+      await ensureNftNatTables(context);
+    }
+    await exec(["systemctl", "daemon-reload"], { sudo: true }).catch(() => {
+    });
+    info("Enabling docker service...");
+    const enableResult = await runTask(core_default.systemd.enable({ service: "docker", sudo: true }));
+    if (!enableResult?.success) {
+      const message = `Failed to enable docker service: ${enableResult?.error ?? "Unknown error"}`;
+      error(message);
+      return { success: false, error: message };
+    }
+    info("Starting docker service...");
+    const startResult = await runTask(core_default.systemd.start({ service: "docker", sudo: true }));
+    if (!startResult?.success) {
+      const message = `Failed to start docker service: ${startResult?.error ?? "Unknown error"}`;
+      error(message);
+      return { success: false, error: message };
     }
-    await runTask(core_default.systemd.enable({ service: "docker" }));
-    await runTask(core_default.systemd.start({ service: "docker" }));
     return { success: true };
   } catch (e) {
     const message = `An unexpected error occurred: ${e instanceof Error ? e.message : String(e)}`;
@@ -11474,20 +11875,37 @@ async function run91(context) {
     return { success: false, error: message };
   }
   const { os: os5, variant } = osDetails;
+  const normalizedOs = (os5 ?? "").toLowerCase();
+  const normalizedVariant = (variant ?? "").toLowerCase();
   info(`Detected OS: ${os5} (${variant})`);
   let engineInstallResult;
-  if (/debian|ubuntu/i.test(os5)) {
+  if (/debian|ubuntu/.test(normalizedOs) || /debian|ubuntu/.test(normalizedVariant)) {
     engineInstallResult = await installForDebian(context, variant, installComposePlugin);
-  } else if (/fedora|rhel|centos/i.test(os5)) {
-    engineInstallResult = await installForFedora(context, installComposePlugin);
+  } else if (/fedora|rhel|centos|rocky|alma|almalinux|ol|oracle/.test(`${normalizedOs} ${normalizedVariant}`)) {
+    engineInstallResult = await installForFedora(context, variant, installComposePlugin);
   } else {
     const message = `Unsupported OS: ${os5}`;
     logError2(message);
     return { success: false, error: message };
   }
   if (!engineInstallResult?.success) {
+    if (engineInstallResult?.error && /docker service/i.test(engineInstallResult.error)) {
+      const diag = await collectDockerServiceDiagnostics(context);
+      if (diag) {
+        return {
+          success: false,
+          error: `${engineInstallResult.error}
+${diag}`
+        };
+      }
+    }
     return engineInstallResult ?? { success: false, error: "Failed to install Docker Engine" };
   }
+  const daemonResult = await waitForDockerDaemon(context);
+  if (!daemonResult.success) {
+    logError2(daemonResult.error ?? "Docker daemon did not become ready.");
+    return daemonResult;
+  }
   info("Docker Engine installation successful.");
   if (installComposeStandalone) {
     info("Installing Docker Compose standalone binary...");
@@ -11513,10 +11931,392 @@ async function run91(context) {
   info("Docker installation workflow completed successfully.");
   return { success: true };
 }
+async function waitForDockerDaemon(context, { timeoutMs = 9e4, delayMs = 5e3 } = {}) {
+  const { info, debug } = context;
+  const start = Date.now();
+  let attempt = 0;
+  let activeSince;
+  let stableIterations = 0;
+  let lastInfoError;
+  let lastSocketError;
+  let lastServiceState;
+  while (Date.now() - start < timeoutMs) {
+    attempt += 1;
+    let serviceActive = false;
+    try {
+      const status = await context.exec(["systemctl", "is-active", "docker"], { sudo: true });
+      const rawState = status.stdout.trim() || status.stderr.trim();
+      const normalizedState = sanitizeSystemctlState(rawState);
+      lastServiceState = normalizedState || rawState || `exit ${status.exitCode}`;
+      debug(`docker systemctl status attempt ${attempt}: ${lastServiceState}`);
+      serviceActive = status.exitCode === 0 && normalizedState.startsWith("active");
+    } catch (error) {
+      debug(`Error checking docker daemon (attempt ${attempt}): ${error.message}`);
+    }
+    if (serviceActive) {
+      if (!activeSince) {
+        activeSince = Date.now();
+      }
+      const infoProbe = await dockerInfoAvailable(context);
+      if (infoProbe.success) {
+        info("Docker daemon is running.");
+        return { success: true };
+      }
+      lastInfoError = infoProbe.error;
+      const socketProbe = await dockerSocketAvailable(context);
+      debug(`docker socket ready: ${socketProbe.success}`);
+      if (socketProbe.success) {
+        info("Docker daemon is running.");
+        return { success: true };
+      }
+      lastSocketError = socketProbe.error;
+      const socketUnitActive = await systemdSocketActive(context);
+      if (socketUnitActive) {
+        info("Docker socket unit is active and docker service is running.");
+        return { success: true };
+      }
+      stableIterations += 1;
+      if (activeSince && Date.now() - activeSince > 3e4 && stableIterations >= 3) {
+        info("Docker service has been active for 30s without passing readiness probes; continuing anyway.");
+        return { success: true };
+      }
+    } else {
+      activeSince = void 0;
+      stableIterations = 0;
+    }
+    await sleep(delayMs);
+  }
+  const details = await collectDockerServiceDiagnostics(context);
+  const probeDetails = [lastInfoError, lastSocketError].filter(Boolean).join(" | ");
+  const stateDetail = lastServiceState ? ` Last known systemctl state: ${lastServiceState}.` : "";
+  return {
+    success: false,
+    error: `Docker daemon did not become ready before timeout.${probeDetails ? ` Last errors: ${probeDetails}.` : ""}${stateDetail}${details ? `
+${details}` : ""}`
+  };
+}
+async function dockerSocketAvailable(context) {
+  const { debug } = context;
+  const socketPaths = ["/run/docker.sock", "/var/run/docker.sock"];
+  for (const socketPath of socketPaths) {
+    try {
+      const result = await context.exec(["test", "-S", socketPath], { sudo: true });
+      if (result.exitCode === 0) {
+        return { success: true };
+      }
+      const stderr = result.stderr?.trim() || result.stdout?.trim();
+      if (stderr) {
+        debug(`docker socket ${socketPath} not ready (exit ${result.exitCode}): ${stderr}`);
+      }
+    } catch (error) {
+      debug(`error checking docker socket ${socketPath}: ${error.message}`);
+    }
+  }
+  return { success: false, error: "unix socket not present" };
+}
+async function dockerInfoAvailable(context) {
+  const { debug } = context;
+  try {
+    const infoResult = await context.exec(["docker", "info"], { sudo: true });
+    if (infoResult.exitCode === 0) {
+      return { success: true };
+    }
+    const message = infoResult.stderr?.trim() || infoResult.stdout?.trim();
+    if (message) {
+      debug(`docker info failed with exit ${infoResult.exitCode}: ${message}`);
+      return { success: false, error: message };
+    }
+    debug(`docker info failed with exit ${infoResult.exitCode}.`);
+    return { success: false, error: `exit ${infoResult.exitCode}` };
+  } catch (error) {
+    const message = error.message;
+    debug(`docker info threw: ${message}`);
+    return { success: false, error: message };
+  }
+}
+async function systemdSocketActive(context) {
+  try {
+    const socketStatus = await context.exec(["systemctl", "is-active", "docker.socket"], { sudo: true });
+    return socketStatus.exitCode === 0 && socketStatus.stdout.trim() === "active";
+  } catch {
+    return false;
+  }
+}
+async function sleep(ms) {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function collectDockerServiceDiagnostics(context) {
+  const logs = [];
+  try {
+    const status = await context.exec(["systemctl", "status", "docker", "--no-pager"], { sudo: true });
+    const text = status.stdout || status.stderr;
+    if (text?.trim()) {
+      logs.push("systemctl status docker:\n" + text.trim());
+    }
+  } catch {
+  }
+  try {
+    const journal = await context.exec(["journalctl", "-xeu", "docker.service", "--no-pager", "-n", "50"], {
+      sudo: true
+    });
+    const text = journal.stdout || journal.stderr;
+    if (text?.trim()) {
+      logs.push("journalctl -xeu docker.service:\n" + text.trim());
+    }
+  } catch {
+  }
+  await appendDiagnosticsCommand(context, logs, "iptables --version", ["iptables", "--version"]);
+  await appendDiagnosticsCommand(context, logs, "iptables -t nat -S", ["iptables", "-t", "nat", "-S"]);
+  await appendDiagnosticsCommand(context, logs, "nft list table ip nat", ["nft", "list", "table", "ip", "nat"]);
+  await appendDiagnosticsCommand(context, logs, "nft list table ip6 nat", ["nft", "list", "table", "ip6", "nat"]);
+  await appendDiagnosticsCommand(
+    context,
+    logs,
+    "Loaded Docker networking modules",
+    [
+      "bash",
+      "-lc",
+      "lsmod | egrep 'overlay|br_netfilter|bridge|ip_tables|iptable_nat|nf_tables|xt_addrtype|xt_nat' || true"
+    ]
+  );
+  await appendDiagnosticsCommand(
+    context,
+    logs,
+    "Docker networking sysctls",
+    [
+      "bash",
+      "-lc",
+      "sysctl net.bridge.bridge-nf-call-iptables net.bridge.bridge-nf-call-ip6tables net.ipv4.ip_forward 2>/dev/null"
+    ]
+  );
+  if (logs.length === 0) {
+    return void 0;
+  }
+  return logs.join("\n\n");
+}
+async function appendDiagnosticsCommand(context, logs, label, command) {
+  try {
+    const result = await context.exec(command, { sudo: true });
+    const text = result.stdout || result.stderr;
+    if (text?.trim()) {
+      logs.push(`${label}:
+${text.trim()}`);
+    } else {
+      logs.push(`${label}: (no output, exit ${result.exitCode})`);
+    }
+  } catch (error) {
+    logs.push(`${label} (failed): ${error.message}`);
+  }
+}
+function sanitizeSystemctlState(value) {
+  if (!value) {
+    return "";
+  }
+  return value.replace(/\u001b\][^\u001b]*\u001b\\/g, "").replace(/\u001b\[[0-9;?]*[ -/]*[@-~]/g, "").trim().toLowerCase();
+}
 var install_default6 = task(run91, {
   description: "Installs and configures Docker, Docker Compose, and group membership."
 });
 
+// src/core/docker/run-container.ts
+import crypto2 from "crypto";
+
+// src/core/docker/run-helpers.ts
+import Shellwords2 from "shellwords-ts";
+function buildDockerRunCommand(params, options) {
+  if (!params.image) {
+    throw new Error("Docker image is required.");
+  }
+  const args = ["docker", "run"];
+  if (options.detach) {
+    args.push("-d");
+  } else {
+    if (options.remove !== false) {
+      args.push("--rm");
+    }
+  }
+  args.push("--cidfile", options.cidFilePath);
+  if (params.pull) {
+    args.push("--pull", params.pull);
+  }
+  if (params.name) {
+    args.push("--name", params.name);
+  }
+  if (params.privileged) {
+    args.push("--privileged");
+  }
+  if (params.user) {
+    args.push("-u", params.user);
+  }
+  if (params.workdir) {
+    args.push("-w", params.workdir);
+  }
+  if (params.entrypoint) {
+    args.push("--entrypoint", params.entrypoint);
+  }
+  if (params.network) {
+    args.push("--network", params.network);
+  }
+  if (params.restart) {
+    args.push("--restart", params.restart);
+  }
+  if (params.gpus) {
+    args.push("--gpus", params.gpus);
+  }
+  if (params.env) {
+    for (const [key, value] of Object.entries(params.env)) {
+      args.push("-e", `${key}=${value}`);
+    }
+  }
+  if (params.volumes) {
+    for (const volume of params.volumes) {
+      args.push("-v", volume);
+    }
+  }
+  if (params.ports) {
+    for (const port of params.ports) {
+      args.push("-p", port);
+    }
+  }
+  if (params.labels) {
+    for (const [key, value] of Object.entries(params.labels)) {
+      args.push("--label", `${key}=${value}`);
+    }
+  }
+  if (params.add_hosts) {
+    for (const hostMapping of params.add_hosts) {
+      args.push("--add-host", hostMapping);
+    }
+  }
+  if (params.extra_args) {
+    args.push(...params.extra_args);
+  }
+  args.push(params.image);
+  const commandParts = normalizeCommand(params.command);
+  if (commandParts.length) {
+    args.push(...commandParts);
+  }
+  if (params.args?.length) {
+    args.push(...params.args);
+  }
+  return args;
+}
+function normalizeCommand(command) {
+  if (!command) return [];
+  if (Array.isArray(command)) {
+    return command.filter(Boolean);
+  }
+  return Shellwords2.split(command).filter(Boolean);
+}
+async function removeFileIfExists(context, path10, sudo) {
+  try {
+    await context.exec(["rm", "-f", path10], { sudo });
+  } catch {
+  }
+}
+async function readContainerId(context, path10, sudo) {
+  try {
+    const result = await context.exec(["cat", path10], { sudo });
+    if (result.exitCode === 0) {
+      return result.stdout.trim();
+    }
+  } catch {
+  }
+  return void 0;
+}
+
+// src/core/docker/run-container.ts
+async function run92(context) {
+  const { params, exec, info, error: logError2 } = context;
+  if (!params.image) {
+    const message = "Docker image is required.";
+    logError2(message);
+    return { success: false, exitCode: -1, stdout: "", stderr: "", error: message };
+  }
+  const runAsSudo = params.sudo ?? false;
+  const cidFilePath = `/tmp/hostctl-docker-${crypto2.randomUUID()}.cid`;
+  await removeFileIfExists(context, cidFilePath, runAsSudo);
+  const dockerCommand = buildDockerRunCommand(params, {
+    detach: false,
+    cidFilePath,
+    remove: params.remove ?? true
+  });
+  info(`Running docker container from image ${params.image}...`);
+  const result = await exec(dockerCommand, { sudo: runAsSudo, cwd: params.cwd });
+  const containerId = await readContainerId(context, cidFilePath, runAsSudo);
+  await removeFileIfExists(context, cidFilePath, runAsSudo);
+  if (result.exitCode !== 0) {
+    const message = result.stderr || result.stdout || "Docker container exited with a non-zero status.";
+    logError2(message);
+    return {
+      success: false,
+      exitCode: result.exitCode,
+      stdout: result.stdout,
+      stderr: result.stderr,
+      containerId,
+      containerName: params.name,
+      error: message
+    };
+  }
+  return {
+    success: true,
+    exitCode: result.exitCode,
+    stdout: result.stdout,
+    stderr: result.stderr,
+    containerId,
+    containerName: params.name
+  };
+}
+var run_container_default = task(run92, {
+  description: "Runs a Docker container and returns its output (attached)."
+});
+
+// src/core/docker/run-container-detached.ts
+import crypto3 from "crypto";
+async function run93(context) {
+  const { params, exec, info, error: logError2 } = context;
+  if (!params.image) {
+    const message = "Docker image is required.";
+    logError2(message);
+    return { success: false, stdout: "", stderr: "", error: message };
+  }
+  const runAsSudo = params.sudo ?? false;
+  const cidFilePath = `/tmp/hostctl-docker-${crypto3.randomUUID()}.cid`;
+  await removeFileIfExists(context, cidFilePath, runAsSudo);
+  const dockerCommand = buildDockerRunCommand(params, {
+    detach: true,
+    cidFilePath,
+    remove: false
+  });
+  info(`Starting docker container in detached mode from image ${params.image}...`);
+  const result = await exec(dockerCommand, { sudo: runAsSudo, cwd: params.cwd });
+  const cidFromFile = await readContainerId(context, cidFilePath, runAsSudo);
+  await removeFileIfExists(context, cidFilePath, runAsSudo);
+  const containerId = cidFromFile || result.stdout.trim() || void 0;
+  if (result.exitCode !== 0 || !containerId) {
+    const message = result.stderr || result.stdout || "Failed to start Docker container.";
+    logError2(message);
+    return {
+      success: false,
+      stdout: result.stdout,
+      stderr: result.stderr,
+      containerId,
+      containerName: params.name,
+      error: message
+    };
+  }
+  return {
+    success: true,
+    stdout: result.stdout,
+    stderr: result.stderr,
+    containerId,
+    containerName: params.name
+  };
+}
+var run_container_detached_default = task(run93, {
+  description: "Runs a Docker container in detached mode and returns its metadata."
+});
+
 // src/core/ssh/index.ts
 var ssh_exports = {};
 __export(ssh_exports, {
@@ -11527,7 +12327,7 @@ __export(ssh_exports, {
 import path6 from "path";
 
 // src/core/user/exists.ts
-async function run92(context) {
+async function run94(context) {
   const { params, exec } = context;
   const { user } = params;
   const command = ["id", user].join(" ");
@@ -11536,10 +12336,10 @@ async function run92(context) {
     exists: exists2
   };
 }
-var exists_default4 = task(run92, { name: "core.user.exists", description: "User exists." });
+var exists_default4 = task(run94, { name: "core.user.exists", description: "User exists." });
 
 // src/core/user/home_dir.ts
-async function run93(context) {
+async function run95(context) {
   const { params, exec } = context;
   const { user } = params;
   const getentCommand = ["getent", "passwd", user].filter(Boolean).join(" ");
@@ -11560,10 +12360,10 @@ async function run93(context) {
     exists: exists2
   };
 }
-var home_dir_default = task(run93, { name: "core.user.home_dir", description: "User home dir." });
+var home_dir_default = task(run95, { name: "core.user.home_dir", description: "User home dir." });
 
 // src/core/user/get_username.ts
-async function run94(context) {
+async function run96(context) {
   const { exec } = context;
   const command = ["id", "-un"].filter(Boolean).join(" ");
   const { success, stdout: username } = await exec(command);
@@ -11572,10 +12372,10 @@ async function run94(context) {
     username: username.trim()
   };
 }
-var get_username_default = task(run94, { name: "core.user.get_username", description: "User get username." });
+var get_username_default = task(run96, { name: "core.user.get_username", description: "User get username." });
 
 // src/core/ssh/copy_id.ts
-async function run95(context) {
+async function run97(context) {
   const { params, run: runTask, exec, log, info, error } = context;
   let { public_key, user, sudo } = params;
   const publicKeyTrimmed = public_key.trim();
@@ -11655,7 +12455,7 @@ async function run95(context) {
     changed: true
   };
 }
-var copy_id_default = task(run95, { name: "core.ssh.copy_id", description: "Ssh copy id." });
+var copy_id_default = task(run97, { name: "core.ssh.copy_id", description: "Ssh copy id." });
 
 // src/core/sudoers/index.ts
 var sudoers_exports = {};
@@ -11665,7 +12465,7 @@ __export(sudoers_exports, {
 });
 
 // src/core/sudoers/check.ts
-async function run96(context) {
+async function run98(context) {
   const { params, exec, error } = context;
   const effectiveFile = params.file || "/etc/sudoers";
   try {
@@ -11686,10 +12486,10 @@ async function run96(context) {
     };
   }
 }
-var check_default = task(run96, { name: "core.sudoers.check", description: "Sudoers check." });
+var check_default = task(run98, { name: "core.sudoers.check", description: "Sudoers check." });
 
 // src/core/sudoers/grant-nopasswd.ts
-async function run97(context) {
+async function run99(context) {
   const { params, exec, error, info } = context;
   const { user } = params;
   if (!user) {
@@ -11773,7 +12573,7 @@ async function run97(context) {
     return { success: false, changed: false, filePath: "", error: e instanceof Error ? e.message : String(e) };
   }
 }
-var grant_nopasswd_default = task(run97, {
+var grant_nopasswd_default = task(run99, {
   description: "Grants a user passwordless sudo privileges by creating a file in /etc/sudoers.d/."
 });
 
@@ -11791,7 +12591,7 @@ __export(process_exports, {
 });
 
 // src/core/process/list.ts
-async function run98(context) {
+async function run100(context) {
   const { params, exec, debug, error } = context;
   const { user, command, limit, sort, reverse } = params;
   try {
@@ -11877,10 +12677,10 @@ async function run98(context) {
     return { success: false, error: errorMsg };
   }
 }
-var list_default7 = task(run98, { description: "Lists processes on the system." });
+var list_default7 = task(run100, { description: "Lists processes on the system." });
 
 // src/core/process/search.ts
-async function run99(context) {
+async function run101(context) {
   const { params, exec, debug, error } = context;
   const {
     name,
@@ -12004,10 +12804,10 @@ function filterProcesses(processes, filters) {
     return true;
   });
 }
-var search_default6 = task(run99, { name: "core.process.search", description: "Search for processes matching specified criteria." });
+var search_default6 = task(run101, { name: "core.process.search", description: "Search for processes matching specified criteria." });
 
 // src/core/process/kill.ts
-async function run100(context) {
+async function run102(context) {
   const { params, exec, debug, error } = context;
   const { pid, user, command, signal = "TERM", force = false, sudo = false } = params;
   try {
@@ -12095,10 +12895,10 @@ async function run100(context) {
     return { success: false, error: errorMsg };
   }
 }
-var kill_default = task(run100, { description: "Kills processes matching specified criteria. Requires at least one filtering parameter (pid, user, or command) to prevent accidental killing of all processes." });
+var kill_default = task(run102, { description: "Kills processes matching specified criteria. Requires at least one filtering parameter (pid, user, or command) to prevent accidental killing of all processes." });
 
 // src/core/process/signal.ts
-async function run101(context) {
+async function run103(context) {
   const { params, exec, debug, error } = context;
   const { pid, signal = "TERM", sudo = false } = params;
   if (!pid || pid <= 0) {
@@ -12121,10 +12921,10 @@ async function run101(context) {
     return { success: false, error: errorMsg };
   }
 }
-var signal_default = task(run101, { description: "Sends a signal to a process." });
+var signal_default = task(run103, { description: "Sends a signal to a process." });
 
 // src/core/process/info.ts
-async function run102(context) {
+async function run104(context) {
   const { params, exec, debug, error } = context;
   const { pid } = params;
   if (!pid || pid <= 0) {
@@ -12200,10 +13000,10 @@ async function run102(context) {
     return { success: false, error: errorMsg };
   }
 }
-var info_default7 = task(run102, { description: "Gets detailed information about a specific process." });
+var info_default7 = task(run104, { description: "Gets detailed information about a specific process." });
 
 // src/core/process/top.ts
-async function run103(context) {
+async function run105(context) {
   const { params, exec, debug, error } = context;
   const {
     limit = 10,
@@ -12362,10 +13162,10 @@ function sortProcesses(processes, sort) {
     }
   });
 }
-var top_default = task(run103, { name: "core.process.top", description: "Get top processes with system information." });
+var top_default = task(run105, { name: "core.process.top", description: "Get top processes with system information." });
 
 // src/core/process/stats.ts
-async function run104(context) {
+async function run106(context) {
   const { params, exec, debug, error } = context;
   const { includeUsers = true, includeStates = true, includeCommands = false, commandLimit = 10 } = params;
   debug(`Getting process statistics with params: ${JSON.stringify(params)}`);
@@ -12528,10 +13328,10 @@ function calculateCommandStats(processes, limit) {
   }
   return Array.from(commandMap.values()).sort((a, b) => b.cpu - a.cpu).slice(0, limit);
 }
-var stats_default = task(run104, { name: "core.process.stats", description: "Get system-wide process statistics." });
+var stats_default = task(run106, { name: "core.process.stats", description: "Get system-wide process statistics." });
 
 // src/core/process/children.ts
-async function run105(context) {
+async function run107(context) {
   const { params, exec, debug, error } = context;
   const { pid, recursive = false, maxDepth } = params;
   debug(`Getting children for process ${pid} with params: ${JSON.stringify(params)}`);
@@ -12608,7 +13408,7 @@ async function getDescendants(exec, parentPid, currentDepth, maxDepth) {
   }
   return allDescendants;
 }
-var children_default = task(run105, { name: "core.process.children", description: "Get child processes of a given PID." });
+var children_default = task(run107, { name: "core.process.children", description: "Get child processes of a given PID." });
 
 // src/core/system/index.ts
 var system_exports = {};
@@ -12620,7 +13420,7 @@ __export(system_exports, {
 });
 
 // src/core/system/reboot.ts
-async function run106(context) {
+async function run108(context) {
   const { params, info, warn, exec } = context;
   const time = params.time || "now";
   const sudo = params.sudo ?? true;
@@ -12653,12 +13453,12 @@ stderr: ${stderr}`
     };
   }
 }
-var reboot_default = task(run106, {
+var reboot_default = task(run108, {
   description: "Reboots a system"
 });
 
 // src/core/system/shutdown.ts
-async function run107(context) {
+async function run109(context) {
   const { params, info, warn, exec } = context;
   const time = params.time || "now";
   const sudo = params.sudo ?? true;
@@ -12690,10 +13490,10 @@ stderr: ${stderr}`
     };
   }
 }
-var shutdown_default = task(run107);
+var shutdown_default = task(run109);
 
 // src/core/system/reboot_if_needed.ts
-async function run108(context) {
+async function run110(context) {
   const { params, run: runTask, exec, error, info, warn } = context;
   const delayInSeconds = Math.max(1, params.delay ?? 1);
   const message = params.message ?? "Reboot is required. Initiating reboot sequence.";
@@ -12723,7 +13523,7 @@ ${stderr}`;
   }
   return { rebooting: true, success: true };
 }
-var reboot_if_needed_default = task(run108, { name: "core.system.reboot_if_needed", description: "Reboot if needed." });
+var reboot_if_needed_default = task(run110, { name: "core.system.reboot_if_needed", description: "Reboot if needed." });
 
 // src/core/systemd/index.ts
 var systemd_exports = {};
@@ -12738,7 +13538,7 @@ __export(systemd_exports, {
 });
 
 // src/core/systemd/disable.ts
-async function run109(context) {
+async function run111(context) {
   const { params, exec, error } = context;
   const { service, sudo = false } = params;
   if (!service) {
@@ -12761,10 +13561,10 @@ async function run109(context) {
     };
   }
 }
-var disable_default = task(run109, { name: "core.systemd.disable", description: "Systemd disable." });
+var disable_default = task(run111, { name: "core.systemd.disable", description: "Systemd disable." });
 
 // src/core/systemd/enable.ts
-async function run110(context) {
+async function run112(context) {
   const { params, exec, error } = context;
   const { service, sudo = false } = params;
   if (!service) {
@@ -12775,14 +13575,10 @@ async function run110(context) {
     };
   }
   try {
-    const commandArray = [];
-    if (sudo) {
-      commandArray.push("sudo");
-    }
-    commandArray.push("systemctl", "enable", service);
-    const { success } = await exec(commandArray);
+    const result = await exec(["systemctl", "enable", service], { sudo });
     return {
-      success
+      success: result.exitCode === 0,
+      error: result.exitCode === 0 ? void 0 : result.stderr || result.stdout
     };
   } catch (err) {
     return {
@@ -12791,10 +13587,10 @@ async function run110(context) {
     };
   }
 }
-var enable_default = task(run110, { name: "core.systemd.enable", description: "Systemd enable." });
+var enable_default = task(run112, { name: "core.systemd.enable", description: "Systemd enable." });
 
 // src/core/systemd/restart.ts
-async function run111(context) {
+async function run113(context) {
   const { params, exec, error } = context;
   const { service, sudo = false } = params;
   if (!service) {
@@ -12821,10 +13617,10 @@ async function run111(context) {
     };
   }
 }
-var restart_default = task(run111, { name: "core.systemd.restart", description: "Systemd restart." });
+var restart_default = task(run113, { name: "core.systemd.restart", description: "Systemd restart." });
 
 // src/core/systemd/start.ts
-async function run112(context) {
+async function run114(context) {
   const { params, exec, error } = context;
   const { service, sudo = false } = params;
   if (!service) {
@@ -12835,14 +13631,10 @@ async function run112(context) {
     };
   }
   try {
-    const commandArray = [];
-    if (sudo) {
-      commandArray.push("sudo");
-    }
-    commandArray.push("systemctl", "start", service);
-    const { success } = await exec(commandArray);
+    const result = await exec(["systemctl", "start", service], { sudo });
     return {
-      success
+      success: result.exitCode === 0,
+      error: result.exitCode === 0 ? void 0 : result.stderr || result.stdout
     };
   } catch (err) {
     return {
@@ -12851,10 +13643,10 @@ async function run112(context) {
     };
   }
 }
-var start_default = task(run112, { name: "core.systemd.start", description: "Systemd start." });
+var start_default = task(run114, { name: "core.systemd.start", description: "Systemd start." });
 
 // src/core/systemd/stop.ts
-async function run113(context) {
+async function run115(context) {
   const { params, exec, error } = context;
   const { service, sudo = false } = params;
   if (!service) {
@@ -12881,10 +13673,10 @@ async function run113(context) {
     };
   }
 }
-var stop_default = task(run113, { name: "core.systemd.stop", description: "Systemd stop." });
+var stop_default = task(run115, { name: "core.systemd.stop", description: "Systemd stop." });
 
 // src/core/systemd/reload.ts
-async function run114(context) {
+async function run116(context) {
   const { params, exec, error } = context;
   const { service, sudo = false } = params;
   if (!service) {
@@ -12905,13 +13697,13 @@ async function run114(context) {
     };
   }
 }
-var reload_default = task(run114, {
+var reload_default = task(run116, {
   name: "core.systemd.reload",
   description: "Reloads a systemd service (e.g., re-reads configuration without full restart)."
 });
 
 // src/core/systemd/status.ts
-async function run115(context) {
+async function run117(context) {
   const { params, exec, error } = context;
   const { service, sudo = false } = params;
   if (!service) {
@@ -12934,7 +13726,7 @@ async function run115(context) {
     };
   }
 }
-var status_default = task(run115, {
+var status_default = task(run117, {
   name: "core.systemd.status",
   description: "Checks systemd service status."
 });
@@ -12949,7 +13741,7 @@ __export(template_exports, {
 import { promises as fs9 } from "fs";
 import path7 from "path";
 async function runFn3(context) {
-  const { params, warn, error, debug, run: run245 } = context;
+  const { params, warn, error, debug, run: run247 } = context;
   const { template, template_file, variables, to, mode, owner, group, sudo } = params;
   let templateContent = template;
   if (template && template_file) {
@@ -12996,7 +13788,7 @@ async function runFn3(context) {
     debug(`Setting mode ${mode} for ${outputPath}`);
     try {
       const chmodParams = { path: outputPath, mode, sudo };
-      const chmodResult = await run245(chmod_default(chmodParams));
+      const chmodResult = await run247(chmod_default(chmodParams));
       if (chmodResult instanceof Error) {
         error(`Error setting mode for ${outputPath}: ${chmodResult.message}`);
         overallSuccess = false;
@@ -13022,7 +13814,7 @@ async function runFn3(context) {
       if (group) {
         chownTaskParams.group = group;
       }
-      const chownResult = await run245(chown_default(chownTaskParams));
+      const chownResult = await run247(chown_default(chownTaskParams));
       if (chownResult instanceof Error) {
         error(`Error setting owner/group for ${outputPath}: ${chownResult.message}`);
         overallSuccess = false;
@@ -13063,7 +13855,7 @@ __export(ufw_exports, {
 });
 
 // src/core/ufw/allow.ts
-async function run116(context) {
+async function run118(context) {
   const { params, exec, info } = context;
   const { port, proto = "tcp", from } = params;
   if (!port) {
@@ -13094,10 +13886,10 @@ async function run116(context) {
     return { success: false, error };
   }
 }
-var allow_default = task(run116, { description: "Allows a port through UFW firewall." });
+var allow_default = task(run118, { description: "Allows a port through UFW firewall." });
 
 // src/core/ufw/deny.ts
-async function run117(context) {
+async function run119(context) {
   const { params, exec, error, info } = context;
   const { port, proto = "tcp", from } = params;
   if (!port) {
@@ -13128,10 +13920,10 @@ async function run117(context) {
     };
   }
 }
-var deny_default = task(run117, { name: "core.ufw.deny", description: "Ufw deny." });
+var deny_default = task(run119, { name: "core.ufw.deny", description: "Ufw deny." });
 
 // src/core/ufw/delete.ts
-async function run118(context) {
+async function run120(context) {
   const { params, exec, error } = context;
   const { rule_number } = params;
   if (!rule_number || rule_number <= 0) {
@@ -13153,10 +13945,10 @@ async function run118(context) {
     };
   }
 }
-var delete_default3 = task(run118, { name: "core.ufw.delete", description: "Ufw delete." });
+var delete_default3 = task(run120, { name: "core.ufw.delete", description: "Ufw delete." });
 
 // src/core/ufw/disable.ts
-async function run119(context) {
+async function run121(context) {
   const { exec, error } = context;
   try {
     const result = await exec(["ufw", "disable"], { sudo: true });
@@ -13172,10 +13964,10 @@ async function run119(context) {
     return { success: false, error: errorMsg };
   }
 }
-var disable_default2 = task(run119, { description: "Disables UFW firewall." });
+var disable_default2 = task(run121, { description: "Disables UFW firewall." });
 
 // src/core/ufw/enable.ts
-async function run120(context) {
+async function run122(context) {
   const { exec, error } = context;
   try {
     const result = await exec(["ufw", "--force", "enable"], { sudo: true });
@@ -13191,10 +13983,10 @@ async function run120(context) {
     return { success: false, error: errorMsg };
   }
 }
-var enable_default2 = task(run120, { description: "Enables UFW firewall." });
+var enable_default2 = task(run122, { description: "Enables UFW firewall." });
 
 // src/core/ufw/install.ts
-async function run121(context) {
+async function run123(context) {
   const { run: runTask, error } = context;
   try {
     const installResult = await runTask(install_default5({ package: "ufw", sudo: true }));
@@ -13213,10 +14005,10 @@ async function run121(context) {
     };
   }
 }
-var install_default7 = task(run121, { name: "core.ufw.install", description: "Ufw install." });
+var install_default7 = task(run123, { name: "core.ufw.install", description: "Ufw install." });
 
 // src/core/ufw/logging.ts
-async function run122(context) {
+async function run124(context) {
   const { params, exec, log } = context;
   const level = params.level || "on";
   try {
@@ -13233,10 +14025,10 @@ async function run122(context) {
     return { success: false, error };
   }
 }
-var logging_default = task(run122, { description: "Configures UFW logging" });
+var logging_default = task(run124, { description: "Configures UFW logging" });
 
 // src/core/ufw/reload.ts
-async function run123(context) {
+async function run125(context) {
   const { exec, error } = context;
   try {
     const { success } = await exec(["sudo", "ufw", "reload"], { sudo: true });
@@ -13248,10 +14040,10 @@ async function run123(context) {
     };
   }
 }
-var reload_default2 = task(run123, { name: "core.ufw.reload", description: "Ufw reload." });
+var reload_default2 = task(run125, { name: "core.ufw.reload", description: "Ufw reload." });
 
 // src/core/ufw/reset.ts
-async function run124(context) {
+async function run126(context) {
   const { exec, error, info } = context;
   try {
     const command = ["ufw", "--force", "reset"];
@@ -13272,10 +14064,10 @@ async function run124(context) {
     return { success: false, error: errorMsg };
   }
 }
-var reset_default = task(run124, { name: "core.ufw.reset", description: "Resets UFW firewall to default state." });
+var reset_default = task(run126, { name: "core.ufw.reset", description: "Resets UFW firewall to default state." });
 
 // src/core/ufw/status.ts
-async function run125(context) {
+async function run127(context) {
   const { exec, error } = context;
   try {
     const result = await exec(["ufw", "status", "numbered"], { sudo: true });
@@ -13330,7 +14122,7 @@ async function run125(context) {
     return { success: false, error: errorMsg };
   }
 }
-var status_default2 = task(run125, { description: "Gets UFW firewall status with numbered rules." });
+var status_default2 = task(run127, { description: "Gets UFW firewall status with numbered rules." });
 
 // src/core/user/index.ts
 var user_exports = {};
@@ -13350,7 +14142,7 @@ __export(user_exports, {
 });
 
 // src/core/user/add_groups.ts
-async function run126(context) {
+async function run128(context) {
   const { params, exec } = context;
   const { user, groups } = params;
   const normalizedGroups = Array.isArray(groups) ? groups : typeof groups === "string" ? groups.split(",").map((group) => group.trim()).filter(Boolean) : [];
@@ -13364,10 +14156,10 @@ async function run126(context) {
     success
   };
 }
-var add_groups_default = task(run126, { name: "core.user.add_groups", description: "User add groups." });
+var add_groups_default = task(run128, { name: "core.user.add_groups", description: "User add groups." });
 
 // src/core/user/create.ts
-async function run127(context) {
+async function run129(context) {
   const { params, exec, run: runTask, error } = context;
   const { user, create_home = true, create_group = true, system = false, sudo = true } = params;
   if (!user) {
@@ -13414,10 +14206,10 @@ async function run127(context) {
     };
   }
 }
-var create_default3 = task(run127, { name: "core.user.create", description: "User create." });
+var create_default3 = task(run129, { name: "core.user.create", description: "User create." });
 
 // src/core/user/get_gid.ts
-async function run128(context) {
+async function run130(context) {
   const { params, exec } = context;
   const { user } = params;
   const command = ["id", "-g", user].filter(Boolean).join(" ");
@@ -13427,10 +14219,10 @@ async function run128(context) {
     gid: gid.trim()
   };
 }
-var get_gid_default = task(run128, { name: "core.user.get_gid", description: "User get gid." });
+var get_gid_default = task(run130, { name: "core.user.get_gid", description: "User get gid." });
 
 // src/core/user/get_groups.ts
-async function run129(context) {
+async function run131(context) {
   const { params, exec } = context;
   const { user } = params;
   const command = ["groups", user].filter(Boolean).join(" ");
@@ -13447,10 +14239,10 @@ async function run129(context) {
     groups
   };
 }
-var get_groups_default = task(run129, { name: "core.user.get_groups", description: "User get groups." });
+var get_groups_default = task(run131, { name: "core.user.get_groups", description: "User get groups." });
 
 // src/core/user/get_uid.ts
-async function run130(context) {
+async function run132(context) {
   const { params, exec } = context;
   const { user } = params;
   const command = ["id", "-u", user].filter(Boolean).join(" ");
@@ -13460,10 +14252,10 @@ async function run130(context) {
     uid: uid.trim()
   };
 }
-var get_uid_default = task(run130, { name: "core.user.get_uid", description: "User get uid." });
+var get_uid_default = task(run132, { name: "core.user.get_uid", description: "User get uid." });
 
 // src/core/user/set_groups.ts
-async function run131(context) {
+async function run133(context) {
   const { params, exec } = context;
   const { user, groups } = params;
   const normalizedGroups = Array.isArray(groups) ? groups : typeof groups === "string" ? groups.split(",").map((group) => group.trim()).filter(Boolean) : [];
@@ -13477,10 +14269,10 @@ async function run131(context) {
     success
   };
 }
-var set_groups_default = task(run131, { name: "core.user.set_groups", description: "User set groups." });
+var set_groups_default = task(run133, { name: "core.user.set_groups", description: "User set groups." });
 
 // src/core/user/set_shell.ts
-async function run132(context) {
+async function run134(context) {
   const { params, exec } = context;
   const { user, shell } = params;
   const command = ["sudo", "usermod", "-s", shell, user].filter(Boolean).join(" ");
@@ -13489,11 +14281,11 @@ async function run132(context) {
     success
   };
 }
-var set_shell_default = task(run132, { name: "core.user.set_shell", description: "User set shell." });
+var set_shell_default = task(run134, { name: "core.user.set_shell", description: "User set shell." });
 
 // src/core/user/delete.ts
-async function run133(context) {
-  const { params, debug, exec, run: run245, error } = context;
+async function run135(context) {
+  const { params, debug, exec, run: run247, error } = context;
   const { user, remove: remove4 = false, sudo = true } = params;
   if (!user) {
     error('Required parameter "user" is missing');
@@ -13503,7 +14295,7 @@ async function run133(context) {
     };
   }
   try {
-    const { exists: userExists } = await run245(exists_default4({ user }));
+    const { exists: userExists } = await run247(exists_default4({ user }));
     if (!userExists) {
       debug(`User '${user}' does not exist, considering task successful (idempotent).`);
       return { success: true };
@@ -13531,12 +14323,12 @@ async function run133(context) {
     };
   }
 }
-var delete_default4 = task(run133, {
+var delete_default4 = task(run135, {
   description: "Deletes a user from the system idempotently"
 });
 
 // src/core/user/modify.ts
-async function run134(context) {
+async function run136(context) {
   const { params, exec, run: runTask, error } = context;
   const {
     user,
@@ -13595,7 +14387,7 @@ async function run134(context) {
     };
   }
 }
-var modify_default2 = task(run134, { name: "core.user.modify", description: "Modify an existing user account." });
+var modify_default2 = task(run136, { name: "core.user.modify", description: "Modify an existing user account." });
 
 // src/core/xcpng/index.ts
 var xcpng_exports = {};
@@ -13852,7 +14644,7 @@ function coerceBoolean(value, defaultValue = false) {
 }
 
 // src/core/xcpng/attach-vdi.ts
-async function run135(context) {
+async function run137(context) {
   const { params, error, debug } = context;
   const {
     vm_uuid,
@@ -13917,7 +14709,7 @@ async function run135(context) {
     plugged: true
   };
 }
-var attach_vdi_default = task(run135, {
+var attach_vdi_default = task(run137, {
   description: "Attaches an existing virtual disk image to a VM and plugs it into the guest."
 });
 
@@ -13963,7 +14755,7 @@ function resolveSizeBytes(input, fieldLabel) {
 }
 
 // src/core/xcpng/create-vdi.ts
-async function run136(context) {
+async function run138(context) {
   const { params, error } = context;
   const {
     name_label,
@@ -14029,12 +14821,12 @@ async function run136(context) {
     command: result.command
   };
 }
-var create_vdi_default = task(run136, {
+var create_vdi_default = task(run138, {
   description: "Creates a new virtual disk image on the specified XCP-ng storage repository."
 });
 
 // src/core/xcpng/list-sr-params.ts
-async function run137(context) {
+async function run139(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "sr-param-list", filters);
   if (!result.success) {
@@ -14048,12 +14840,12 @@ async function run137(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_sr_params_default = task(run137, {
+var list_sr_params_default = task(run139, {
   description: "Lists parameters for storage repositories (SRs) on an XCP-ng host."
 });
 
 // src/core/xcpng/list-storage-repositories.ts
-async function run138(context) {
+async function run140(context) {
   const { params } = context;
   const filters = normalizeFilterArgs(params?.filters);
   const result = await runXeCommand(context, "sr-list", filters);
@@ -14104,12 +14896,12 @@ async function run138(context) {
     items: enrichedItems
   };
 }
-var list_storage_repositories_default = task(run138, {
+var list_storage_repositories_default = task(run140, {
   description: "Lists storage repositories on an XCP-ng host."
 });
 
 // src/core/xcpng/find-storage-repository.ts
-async function run139(context) {
+async function run141(context) {
   const params = context.params ?? {};
   const {
     name_label: nameLabel,
@@ -14229,12 +15021,12 @@ async function runListStorageRepositories(context, params) {
     })
   );
 }
-var find_storage_repository_default = task(run139, {
+var find_storage_repository_default = task(run141, {
   description: "Finds a single storage repository on an XCP-ng host, optionally allowing multiple matches."
 });
 
 // src/core/xcpng/add-disk.ts
-async function run140(context) {
+async function run142(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuid,
@@ -14367,12 +15159,12 @@ async function destroyVdi(context, vdiUuid, appliedCommands) {
     context.warn(`Failed to clean up VDI ${vdiUuid}: ${xeErrorMessage(result, "unknown error")}`);
   }
 }
-var add_disk_default = task(run140, {
+var add_disk_default = task(run142, {
   description: "Creates a VDI and attaches it to a VM on XCP-ng."
 });
 
 // src/core/xcpng/attach-iso.ts
-async function run141(context) {
+async function run143(context) {
   const { params, error, debug } = context;
   const {
     vm_uuid,
@@ -14470,12 +15262,12 @@ async function run141(context) {
     plugged
   };
 }
-var attach_iso_default = task(run141, {
+var attach_iso_default = task(run143, {
   description: "Attaches an ISO image to a VM by invoking xe vm-cd-insert, ejecting existing media if requested."
 });
 
 // src/core/xcpng/attach-network-interface.ts
-async function run142(context) {
+async function run144(context) {
   const { params, error, debug } = context;
   const {
     vm_uuid,
@@ -14546,12 +15338,12 @@ async function run142(context) {
     plugged: true
   };
 }
-var attach_network_interface_default = task(run142, {
+var attach_network_interface_default = task(run144, {
   description: "Creates and plugs a virtual network interface for a VM on XCP-ng."
 });
 
 // src/core/xcpng/list-template-params.ts
-async function run143(context) {
+async function run145(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "template-param-list", filters);
   if (!result.success) {
@@ -14565,12 +15357,12 @@ async function run143(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_template_params_default = task(run143, {
+var list_template_params_default = task(run145, {
   description: "Lists parameters for templates on an XCP-ng host."
 });
 
 // src/core/xcpng/list-templates.ts
-async function run144(context) {
+async function run146(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "template-list", filters);
   if (!result.success) {
@@ -14622,12 +15414,12 @@ async function run144(context) {
     items: enriched
   };
 }
-var list_templates_default = task(run144, {
+var list_templates_default = task(run146, {
   description: "Lists VM templates available on the XCP-ng host."
 });
 
 // src/core/xcpng/find-template.ts
-async function run145(context) {
+async function run147(context) {
   const params = context.params ?? {};
   const {
     name_label: nameLabel,
@@ -14725,12 +15517,12 @@ async function runListTemplates(context, params) {
     })
   );
 }
-var find_template_default = task(run145, {
+var find_template_default = task(run147, {
   description: "Finds a single template on an XCP-ng host, optionally allowing multiple matches."
 });
 
 // src/core/xcpng/clone-template.ts
-async function run146(context) {
+async function run148(context) {
   const { params, error } = context;
   const {
     source_template_uuid: sourceTemplateUuidParam,
@@ -14850,12 +15642,12 @@ async function run146(context) {
     appliedCommands
   };
 }
-var clone_template_default = task(run146, {
+var clone_template_default = task(run148, {
   description: "Clones an existing XCP-ng template to a new template name."
 });
 
 // src/core/xcpng/list-hosts.ts
-async function run147(context) {
+async function run149(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "host-list", filters);
   if (!result.success) {
@@ -14869,12 +15661,12 @@ async function run147(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_hosts_default = task(run147, {
+var list_hosts_default = task(run149, {
   description: "Lists hosts in an XCP-ng pool, returning parsed xe host-list output."
 });
 
 // src/core/xcpng/find-host.ts
-async function run148(context) {
+async function run150(context) {
   const params = context.params ?? {};
   const {
     name_label: nameLabel,
@@ -14974,12 +15766,12 @@ async function runListHosts(context, params) {
     })
   );
 }
-var find_host_default = task(run148, {
+var find_host_default = task(run150, {
   description: "Finds a single host on an XCP-ng pool, optionally allowing multiple matches."
 });
 
 // src/core/xcpng/list-network-params.ts
-async function run149(context) {
+async function run151(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "network-param-list", filters);
   if (!result.success) {
@@ -14993,12 +15785,12 @@ async function run149(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_network_params_default = task(run149, {
+var list_network_params_default = task(run151, {
   description: "Lists parameters for networks on an XCP-ng host."
 });
 
 // src/core/xcpng/list-networks.ts
-async function run150(context) {
+async function run152(context) {
   const { params } = context;
   const filters = normalizeFilterArgs(params?.filters);
   const result = await runXeCommand(context, "network-list", filters);
@@ -15049,12 +15841,12 @@ async function run150(context) {
     items: enrichedItems
   };
 }
-var list_networks_default = task(run150, {
+var list_networks_default = task(run152, {
   description: "Lists networks on an XCP-ng host."
 });
 
 // src/core/xcpng/find-network.ts
-async function run151(context) {
+async function run153(context) {
   const params = context.params ?? {};
   const {
     name_label: nameLabel,
@@ -15145,12 +15937,12 @@ function buildMultipleMessage4(nameLabel, uuid, count) {
   const detail = identifiers.length > 0 ? identifiers.join(", ") : "specified criteria";
   return `Multiple networks (${count}) matched ${detail}; refine filters or set allow_multiple:true.`;
 }
-var find_network_default = task(run151, {
+var find_network_default = task(run153, {
   description: "Finds a single network on an XCP-ng host, optionally allowing multiple matches."
 });
 
 // src/core/xcpng/create-bond.ts
-async function run152(context) {
+async function run154(context) {
   const { params, error } = context;
   const {
     host_uuid: hostUuidParam,
@@ -15272,12 +16064,12 @@ async function run152(context) {
     appliedCommands
   };
 }
-var create_bond_default = task(run152, {
+var create_bond_default = task(run154, {
   description: "Creates a bonded interface on a host, wrapping xe bond-create."
 });
 
 // src/core/xcpng/list-pbd-params.ts
-async function run153(context) {
+async function run155(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "pbd-param-list", filters);
   if (!result.success) {
@@ -15291,12 +16083,12 @@ async function run153(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_pbd_params_default = task(run153, {
+var list_pbd_params_default = task(run155, {
   description: "Lists parameters for PBDs on an XCP-ng host."
 });
 
 // src/core/xcpng/list-pbds.ts
-async function run154(context) {
+async function run156(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "pbd-list", filters);
   if (!result.success) {
@@ -15346,12 +16138,12 @@ async function run154(context) {
     items: enrichedItems
   };
 }
-var list_pbds_default = task(run154, {
+var list_pbds_default = task(run156, {
   description: "Lists storage bindings (PBDs) between hosts and storage repositories."
 });
 
 // src/core/xcpng/find-pbd.ts
-async function run155(context) {
+async function run157(context) {
   const params = context.params ?? {};
   const {
     uuid,
@@ -15464,12 +16256,12 @@ async function runListPbds(context, params) {
     })
   );
 }
-var find_pbd_default = task(run155, {
+var find_pbd_default = task(run157, {
   description: "Finds a single PBD (host \u2194 SR binding), optionally allowing multiple matches."
 });
 
 // src/core/xcpng/create-pbd.ts
-async function run156(context) {
+async function run158(context) {
   const { params, error } = context;
   const {
     host_uuid: hostUuidParam,
@@ -15586,12 +16378,12 @@ async function run156(context) {
     appliedCommands
   };
 }
-var create_pbd_default = task(run156, {
+var create_pbd_default = task(run158, {
   description: "Creates a host \u2194 storage repository binding (PBD)."
 });
 
 // src/core/xcpng/list-vm-params.ts
-async function run157(context) {
+async function run159(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "vm-param-list", filters);
   if (!result.success) {
@@ -15605,12 +16397,12 @@ async function run157(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_vm_params_default = task(run157, {
+var list_vm_params_default = task(run159, {
   description: "Lists virtual machines (VMs) on an XCP-ng host."
 });
 
 // src/core/xcpng/list-vms.ts
-async function run158(context) {
+async function run160(context) {
   const { params } = context;
   const filters = normalizeFilterArgs(params?.filters);
   const paramsArg = buildParamsArg(params?.params);
@@ -15665,7 +16457,7 @@ async function run158(context) {
     items: enrichedItems
   };
 }
-var list_vms_default = task(run158, {
+var list_vms_default = task(run160, {
   description: "Lists VMs on an XCP-ng host and returns structured metadata."
 });
 var DEFAULT_VM_FIELDS = [
@@ -15699,7 +16491,7 @@ function buildParamsArg(params) {
 }
 
 // src/core/xcpng/find-vm.ts
-async function run159(context) {
+async function run161(context) {
   const params = context.params ?? {};
   const {
     name_label: nameLabel,
@@ -15829,7 +16621,7 @@ async function runListVms(context, params) {
     })
   );
 }
-var find_vm_default = task(run159, {
+var find_vm_default = task(run161, {
   description: "Finds a single VM on an XCP-ng host, optionally allowing multiple matches."
 });
 
@@ -15916,7 +16708,7 @@ async function waitForVmPowerState(context, vmUuid, desiredState, options = {})
 }
 
 // src/core/xcpng/create-template.ts
-async function run160(context) {
+async function run162(context) {
   const { params, error } = context;
   const {
     source_vm_uuid: sourceVmUuidParam,
@@ -16024,7 +16816,7 @@ async function run160(context) {
     waitAttempts: ensureHalted.attempts
   };
 }
-var create_template_default = task(run160, {
+var create_template_default = task(run162, {
   description: "Clones a VM and converts it into an XCP-ng template."
 });
 
@@ -16032,7 +16824,7 @@ var create_template_default = task(run160, {
 import { randomUUID } from "crypto";
 
 // src/core/xcpng/create-vm.ts
-async function run161(context) {
+async function run163(context) {
   const { params, error } = context;
   const {
     name_label,
@@ -16158,12 +16950,12 @@ async function run161(context) {
     appliedCommands
   };
 }
-var create_vm_default = task(run161, {
+var create_vm_default = task(run163, {
   description: "Creates a new VM on XCP-ng and optionally applies memory and CPU sizing."
 });
 
 // src/core/xcpng/list-vdi-params.ts
-async function run162(context) {
+async function run164(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "vdi-param-list", filters);
   if (!result.success) {
@@ -16177,12 +16969,12 @@ async function run162(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_vdi_params_default = task(run162, {
+var list_vdi_params_default = task(run164, {
   description: "Lists virtual disk image parameters (VDI params) on an XCP-ng host."
 });
 
 // src/core/xcpng/list-vdis.ts
-async function run163(context) {
+async function run165(context) {
   const { params } = context;
   const filters = normalizeFilterArgs(params?.filters);
   const result = await runXeCommand(context, "vdi-list", filters);
@@ -16235,12 +17027,12 @@ async function run163(context) {
     items: enrichedItems
   };
 }
-var list_vdis_default = task(run163, {
+var list_vdis_default = task(run165, {
   description: "Lists VDIs on an XCP-ng host with optional filtering."
 });
 
 // src/core/xcpng/find-vdi.ts
-async function run164(context) {
+async function run166(context) {
   const params = context.params ?? {};
   const {
     name_label: nameLabel,
@@ -16346,12 +17138,12 @@ function buildMultipleMessage7(nameLabel, uuid, srUuid, count) {
   const detail = identifiers.length > 0 ? identifiers.join(", ") : "specified criteria";
   return `Multiple VDIs (${count}) matched ${detail}; refine filters or set allow_multiple:true.`;
 }
-var find_vdi_default = task(run164, {
+var find_vdi_default = task(run166, {
   description: "Finds a single VDI on an XCP-ng host, optionally allowing multiple matches."
 });
 
 // src/core/xcpng/list-vbd-params.ts
-async function run165(context) {
+async function run167(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "vbd-param-list", filters);
   if (!result.success) {
@@ -16365,12 +17157,12 @@ async function run165(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_vbd_params_default = task(run165, {
+var list_vbd_params_default = task(run167, {
   description: "Lists virtual block devices (VBDs) on an XCP-ng host."
 });
 
 // src/core/xcpng/list-vbds.ts
-async function run166(context) {
+async function run168(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "vbd-list", filters);
   if (!result.success) {
@@ -16422,12 +17214,12 @@ async function run166(context) {
     items: enrichedItems
   };
 }
-var list_vbds_default = task(run166, {
+var list_vbds_default = task(run168, {
   description: "Lists virtual block devices (VBDs) on an XCP-ng host."
 });
 
 // src/core/xcpng/list-attached-disks.ts
-async function run167(context) {
+async function run169(context) {
   const { params, error } = context;
   const { vm_uuid: vmUuid, include_readonly: rawIncludeReadonly } = params ?? {};
   if (!vmUuid) {
@@ -16523,12 +17315,12 @@ async function run167(context) {
     disks
   };
 }
-var list_attached_disks_default = task(run167, {
+var list_attached_disks_default = task(run169, {
   description: "Lists VBDs attached to a VM and enriches them with VDI metadata so disks vs CD drives can be distinguished."
 });
 
 // src/core/xcpng/remove-disk.ts
-async function run168(context) {
+async function run170(context) {
   const { params, error } = context;
   const {
     vbd_uuid: vbdUuidParam,
@@ -16716,12 +17508,12 @@ async function waitForVdiRemoval(context, vdiUuid, timeoutMs) {
     await new Promise((resolve) => setTimeout(resolve, 1e3));
   }
 }
-var remove_disk_default = task(run168, {
+var remove_disk_default = task(run170, {
   description: "Detaches a VDI from a VM and optionally destroys the backing disk on XCP-ng."
 });
 
 // src/core/xcpng/set-boot-order.ts
-async function run169(context) {
+async function run171(context) {
   const { params, error } = context;
   const { vm_uuid, boot_order, firmware } = params;
   if (!vm_uuid) {
@@ -16785,7 +17577,7 @@ async function run169(context) {
     appliedCommands
   };
 }
-var set_boot_order_default = task(run169, {
+var set_boot_order_default = task(run171, {
   description: "Configures VM boot order and optional firmware mode via xe vm-param-set."
 });
 
@@ -16799,7 +17591,7 @@ var OTHER_CONFIG_KEYS_TO_REMOVE = [
   "cloud-init-hostname",
   "cloud-init-instance-id"
 ];
-async function run170(context) {
+async function run172(context) {
   if (!context.host) {
     const message = "core.xcpng.create-template-from-vdi must run against a remote XCP-ng host.";
     return {
@@ -17332,7 +18124,7 @@ async function run170(context) {
     steps
   };
 }
-var create_template_from_vdi_default = task(run170, {
+var create_template_from_vdi_default = task(run172, {
   description: "Creates an XCP-ng template from an existing VDI by staging a VM and converting it."
 });
 function parseKeyValueList(input) {
@@ -17432,7 +18224,7 @@ function buildOtherConfigUpdates(baseOtherConfig, macSeed) {
 }
 
 // src/core/xcpng/create-network.ts
-async function run171(context) {
+async function run173(context) {
   const { params, error } = context;
   const {
     name_label: nameLabel,
@@ -17504,7 +18296,7 @@ async function run171(context) {
     appliedCommands
   };
 }
-var create_network_default = task(run171, {
+var create_network_default = task(run173, {
   description: "Creates a new network on an XCP-ng host (bridge, MTU, and tags optional)."
 });
 
@@ -17515,7 +18307,7 @@ import { posix as pathPosix } from "path";
 
 // src/core/xcpng/find-or-create-iso-sr.ts
 var DEFAULT_ISO_SR_PATH = "/var/opt/xen/iso-sr";
-async function run172(context) {
+async function run174(context) {
   const { params, debug, error: logError2 } = context;
   const {
     name_label: nameLabel,
@@ -17667,7 +18459,7 @@ async function runDirCreate(context, params) {
     })
   );
 }
-var find_or_create_iso_sr_default = task(run172, {
+var find_or_create_iso_sr_default = task(run174, {
   description: "Finds an ISO storage repository by name, creating it if missing using xe sr-create."
 });
 
@@ -17675,7 +18467,7 @@ var find_or_create_iso_sr_default = task(run172, {
 var DEFAULT_SR_NAME = "hostctl-config-drives";
 var DEFAULT_SR_LOCATION = "/var/opt/xen/hostctl-config-drives";
 var DEFAULT_VOLUME_ID = "CIDATA";
-async function run173(context) {
+async function run175(context) {
   if (!context.host) {
     return {
       success: false,
@@ -18208,12 +19000,12 @@ function decodeBase64Field(field, value) {
     };
   }
 }
-var create_config_drive_default = task(run173, {
+var create_config_drive_default = task(run175, {
   description: "Generates a NoCloud config-drive ISO, stores it in an ISO SR, and returns the associated VDI."
 });
 
 // src/core/xcpng/convert-template-to-vm.ts
-async function run174(context) {
+async function run176(context) {
   const { params, error } = context;
   const {
     template_uuid: templateUuidParam,
@@ -18312,12 +19104,12 @@ async function run174(context) {
     alreadyVm
   };
 }
-var convert_template_to_vm_default = task(run174, {
+var convert_template_to_vm_default = task(run176, {
   description: "Converts an XCP-ng template into a VM by clearing the template flag and optionally renaming it."
 });
 
 // src/core/xcpng/destroy-iso-sr.ts
-async function run175(context) {
+async function run177(context) {
   const { params, error } = context;
   const {
     sr_uuid: srUuidParam,
@@ -18488,12 +19280,12 @@ async function detachSrPbds(context, srUuid, allowMissing) {
   }
   return { commands };
 }
-var destroy_iso_sr_default = task(run175, {
+var destroy_iso_sr_default = task(run177, {
   description: "Destroys an ISO storage repository and optionally removes its backing directory."
 });
 
 // src/core/xcpng/destroy-bond.ts
-async function run176(context) {
+async function run178(context) {
   const { params, error } = context;
   const {
     bond_uuid: bondUuidParam,
@@ -18534,12 +19326,12 @@ async function run176(context) {
     appliedCommands
   };
 }
-var destroy_bond_default = task(run176, {
+var destroy_bond_default = task(run178, {
   description: "Destroys a bonded interface, wrapping xe bond-destroy."
 });
 
 // src/core/xcpng/create-sr.ts
-async function run177(context) {
+async function run179(context) {
   const { params, error } = context;
   const {
     name_label: nameLabel,
@@ -18614,12 +19406,12 @@ async function run177(context) {
     appliedCommands
   };
 }
-var create_sr_default = task(run177, {
+var create_sr_default = task(run179, {
   description: "Creates a new storage repository (SR) with the specified device configuration."
 });
 
 // src/core/xcpng/destroy-sr.ts
-async function run178(context) {
+async function run180(context) {
   const { params, error } = context;
   const {
     sr_uuid: srUuidParam,
@@ -18688,12 +19480,12 @@ async function run178(context) {
     appliedCommands
   };
 }
-var destroy_sr_default = task(run178, {
+var destroy_sr_default = task(run180, {
   description: "Destroys a storage repository by UUID or name-label (optionally forcing)."
 });
 
 // src/core/xcpng/destroy-network.ts
-async function run179(context) {
+async function run181(context) {
   const { params, error } = context;
   const {
     network_uuid: networkUuidParam,
@@ -18760,12 +19552,12 @@ async function run179(context) {
     appliedCommands
   };
 }
-var destroy_network_default = task(run179, {
+var destroy_network_default = task(run181, {
   description: "Destroys an XCP-ng network by UUID or name-label."
 });
 
 // src/core/xcpng/destroy-pbd.ts
-async function run180(context) {
+async function run182(context) {
   const { params, error } = context;
   const {
     pbd_uuid: pbdUuidParam,
@@ -18874,12 +19666,12 @@ async function run180(context) {
     appliedCommands
   };
 }
-var destroy_pbd_default = task(run180, {
+var destroy_pbd_default = task(run182, {
   description: "Destroys a host \u2194 storage repository binding (PBD)."
 });
 
 // src/core/xcpng/destroy-snapshot.ts
-async function run181(context) {
+async function run183(context) {
   const { params, error } = context;
   const { snapshot_uuid: snapshotUuid } = params ?? {};
   if (!snapshotUuid) {
@@ -18902,12 +19694,12 @@ async function run181(context) {
     command: result.command
   };
 }
-var destroy_snapshot_default = task(run181, {
+var destroy_snapshot_default = task(run183, {
   description: "Destroys an XCP-ng VM snapshot."
 });
 
 // src/core/xcpng/introduce-sr.ts
-async function run182(context) {
+async function run184(context) {
   const { params, error } = context;
   const {
     sr_uuid: srUuid,
@@ -18954,12 +19746,12 @@ async function run182(context) {
     appliedCommands
   };
 }
-var introduce_sr_default = task(run182, {
+var introduce_sr_default = task(run184, {
   description: "Introduces an existing storage repository into the pool."
 });
 
 // src/core/xcpng/forget-sr.ts
-async function run183(context) {
+async function run185(context) {
   const { params, error } = context;
   const {
     sr_uuid: srUuidParam,
@@ -19026,12 +19818,12 @@ async function run183(context) {
     appliedCommands
   };
 }
-var forget_sr_default = task(run183, {
+var forget_sr_default = task(run185, {
   description: "Forgets an SR from the pool metadata without destroying the underlying storage."
 });
 
 // src/core/xcpng/list-snapshots.ts
-async function run184(context) {
+async function run186(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "snapshot-list", filters);
   if (!result.success) {
@@ -19045,12 +19837,12 @@ async function run184(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_snapshots_default = task(run184, {
+var list_snapshots_default = task(run186, {
   description: "Lists VM snapshots available on the host."
 });
 
 // src/core/xcpng/list-messages.ts
-async function run185(context) {
+async function run187(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "message-list", filters);
   if (!result.success) {
@@ -19064,12 +19856,12 @@ async function run185(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_messages_default = task(run185, {
+var list_messages_default = task(run187, {
   description: "Lists messages emitted by the XCP-ng pool."
 });
 
 // src/core/xcpng/clear-messages.ts
-async function run186(context) {
+async function run188(context) {
   const { params, error } = context;
   const {
     uuid,
@@ -19134,12 +19926,12 @@ async function run186(context) {
     commands
   };
 }
-var clear_messages_default = task(run186, {
+var clear_messages_default = task(run188, {
   description: "Clears messages (all, by UUID, or UUID prefix)."
 });
 
 // src/core/xcpng/destroy-template.ts
-async function run187(context) {
+async function run189(context) {
   const { params, error } = context;
   const {
     template_uuid: templateUuidParam,
@@ -19214,12 +20006,12 @@ async function run187(context) {
     command: commandResult.command
   };
 }
-var destroy_template_default = task(run187, {
+var destroy_template_default = task(run189, {
   description: "Destroys an XCP-ng template by UUID or name-label."
 });
 
 // src/core/xcpng/destroy-vdi.ts
-async function run188(context) {
+async function run190(context) {
   const { params, error } = context;
   const {
     vdi_uuid: vdiUuidParam,
@@ -19284,12 +20076,12 @@ async function run188(context) {
     command: result.command
   };
 }
-var destroy_vdi_default = task(run188, {
+var destroy_vdi_default = task(run190, {
   description: "Destroys an XCP-ng VDI by UUID (optionally resolving by name-label)."
 });
 
 // src/core/xcpng/destroy-vm.ts
-async function run189(context) {
+async function run191(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuidParam,
@@ -19454,12 +20246,12 @@ async function run189(context) {
     destroyedVdiUuids
   };
 }
-var destroy_vm_default = task(run189, {
+var destroy_vm_default = task(run191, {
   description: "Destroys an XCP-ng VM, optionally forcing and pruning snapshots."
 });
 
 // src/core/xcpng/copy-vdi.ts
-async function run190(context) {
+async function run192(context) {
   const { params, error } = context;
   const {
     source_vdi_uuid: sourceVdiUuidParam,
@@ -19604,12 +20396,12 @@ async function run190(context) {
     appliedCommands
   };
 }
-var copy_vdi_default = task(run190, {
+var copy_vdi_default = task(run192, {
   description: "Copies an XCP-ng VDI to a destination storage repository and optionally updates its metadata."
 });
 
 // src/core/xcpng/detach-iso.ts
-async function run191(context) {
+async function run193(context) {
   const { params, error } = context;
   const { vm_uuid: vmUuid, allow_missing: rawAllowMissing } = params;
   if (!vmUuid) {
@@ -19641,12 +20433,12 @@ async function run191(context) {
     error: message
   };
 }
-var detach_iso_default = task(run191, {
+var detach_iso_default = task(run193, {
   description: "Ejects ISO media from a VM, tolerating empty drives when allow_missing:true."
 });
 
 // src/core/xcpng/detach-vdi.ts
-async function run192(context) {
+async function run194(context) {
   const { params } = context;
   const {
     vbd_uuid,
@@ -19683,12 +20475,12 @@ async function run192(context) {
     error: result.error
   };
 }
-var detach_vdi_default = task(run192, {
+var detach_vdi_default = task(run194, {
   description: "Detaches a VDI from a VM by unplugging and optionally destroying the VBD, leaving the VDI intact by default."
 });
 
 // src/core/xcpng/detach-network-interface.ts
-async function run193(context) {
+async function run195(context) {
   const { params, error } = context;
   const {
     vif_uuid: vifUuidParam,
@@ -19782,12 +20574,12 @@ async function run193(context) {
     appliedCommands
   };
 }
-var detach_network_interface_default = task(run193, {
+var detach_network_interface_default = task(run195, {
   description: "Unplugs (and optionally destroys) a virtual network interface from an XCP-ng VM."
 });
 
 // src/core/xcpng/enable-host.ts
-async function run194(context) {
+async function run196(context) {
   const { params, error } = context;
   const {
     host_uuid: hostUuidParam,
@@ -19855,12 +20647,12 @@ async function run194(context) {
     appliedCommands
   };
 }
-var enable_host_default = task(run194, {
+var enable_host_default = task(run196, {
   description: "Enables maintenance-disabled hosts so they rejoin scheduling."
 });
 
 // src/core/xcpng/disable-host.ts
-async function run195(context) {
+async function run197(context) {
   const { params, error } = context;
   const {
     host_uuid: hostUuidParam,
@@ -19945,12 +20737,12 @@ async function run195(context) {
     evacuated: evacuate
   };
 }
-var disable_host_default = task(run195, {
+var disable_host_default = task(run197, {
   description: "Disables a host (optionally evacuating resident VMs first)."
 });
 
 // src/core/xcpng/plug-pbd.ts
-async function run196(context) {
+async function run198(context) {
   const { params, error } = context;
   const {
     pbd_uuid: pbdUuidParam,
@@ -20019,12 +20811,12 @@ async function run196(context) {
     appliedCommands
   };
 }
-var plug_pbd_default = task(run196, {
+var plug_pbd_default = task(run198, {
   description: "Plugs a PBD so the host reattaches the storage repository."
 });
 
 // src/core/xcpng/unplug-pbd.ts
-async function run197(context) {
+async function run199(context) {
   const { params, error } = context;
   const {
     pbd_uuid: pbdUuidParam,
@@ -20093,12 +20885,12 @@ async function run197(context) {
     appliedCommands
   };
 }
-var unplug_pbd_default = task(run197, {
+var unplug_pbd_default = task(run199, {
   description: "Unplugs a PBD so the host detaches the storage repository."
 });
 
 // src/core/xcpng/list-pools.ts
-async function run198(context) {
+async function run200(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "pool-list", filters);
   if (!result.success) {
@@ -20112,12 +20904,12 @@ async function run198(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_pools_default = task(run198, {
+var list_pools_default = task(run200, {
   description: "Lists pools available to the current host."
 });
 
 // src/core/xcpng/find-pool.ts
-async function run199(context) {
+async function run201(context) {
   const params = context.params ?? {};
   const {
     uuid,
@@ -20217,12 +21009,12 @@ async function runListPools(context, params) {
     })
   );
 }
-var find_pool_default = task(run199, {
+var find_pool_default = task(run201, {
   description: "Finds a single pool by UUID or name-label, optionally allowing multiple matches."
 });
 
 // src/core/xcpng/set-pool-param.ts
-async function run200(context) {
+async function run202(context) {
   const { params, error } = context;
   const {
     pool_uuid: poolUuidParam,
@@ -20288,12 +21080,12 @@ async function run200(context) {
     appliedCommands
   };
 }
-var set_pool_param_default = task(run200, {
+var set_pool_param_default = task(run202, {
   description: "Updates a pool parameter (wraps xe pool-param-set)."
 });
 
 // src/core/xcpng/reboot-host.ts
-async function run201(context) {
+async function run203(context) {
   const { params, error } = context;
   const {
     host_uuid: hostUuidParam,
@@ -20354,12 +21146,12 @@ async function run201(context) {
     command: commandResult.command
   };
 }
-var reboot_host_default = task(run201, {
+var reboot_host_default = task(run203, {
   description: "Reboots an XCP-ng host (optionally forcing)."
 });
 
 // src/core/xcpng/shutdown-host.ts
-async function run202(context) {
+async function run204(context) {
   const { params, error } = context;
   const {
     host_uuid: hostUuidParam,
@@ -20418,12 +21210,12 @@ async function run202(context) {
     command: commandResult.command
   };
 }
-var shutdown_host_default = task(run202, {
+var shutdown_host_default = task(run204, {
   description: "Shuts down an XCP-ng host (optionally forcing)."
 });
 
 // src/core/xcpng/evacuate-host.ts
-async function run203(context) {
+async function run205(context) {
   const { params, error } = context;
   const {
     host_uuid: hostUuidParam,
@@ -20480,12 +21272,12 @@ async function run203(context) {
     command: commandResult.command
   };
 }
-var evacuate_host_default = task(run203, {
+var evacuate_host_default = task(run205, {
   description: "Evacuates all VMs from a host."
 });
 
 // src/core/xcpng/plug-pif.ts
-async function run204(context) {
+async function run206(context) {
   const { params, error } = context;
   const {
     pif_uuid: pifUuidParam,
@@ -20582,12 +21374,12 @@ async function run204(context) {
     appliedCommands
   };
 }
-var plug_pif_default = task(run204, {
+var plug_pif_default = task(run206, {
   description: "Plugs a physical interface (PIF) on the specified host."
 });
 
 // src/core/xcpng/pif-scan.ts
-async function run205(context) {
+async function run207(context) {
   const { params, error } = context;
   const {
     host_uuid: hostUuidParam,
@@ -20656,12 +21448,12 @@ async function run205(context) {
     appliedCommands
   };
 }
-var pif_scan_default = task(run205, {
+var pif_scan_default = task(run207, {
   description: "Rescans physical interfaces (PIFs) on a host to discover changes."
 });
 
 // src/core/xcpng/unplug-pif.ts
-async function run206(context) {
+async function run208(context) {
   const { params, error } = context;
   const {
     pif_uuid: pifUuidParam,
@@ -20758,12 +21550,12 @@ async function run206(context) {
     appliedCommands
   };
 }
-var unplug_pif_default = task(run206, {
+var unplug_pif_default = task(run208, {
   description: "Unplugs a physical interface (PIF) on the specified host."
 });
 
 // src/core/xcpng/set-pif-param.ts
-async function run207(context) {
+async function run209(context) {
   const { params, error } = context;
   const { pif_uuid: pifUuid, key, value } = params ?? {};
   if (!pifUuid) {
@@ -20801,12 +21593,12 @@ async function run207(context) {
     command: commandResult.command
   };
 }
-var set_pif_param_default = task(run207, {
+var set_pif_param_default = task(run209, {
   description: "Updates a PIF parameter (wraps `xe pif-param-set`)."
 });
 
 // src/core/xcpng/unplug-vbd.ts
-async function run208(context) {
+async function run210(context) {
   const { params, error } = context;
   const { vbd_uuid: vbdUuid, allow_missing: rawAllowMissing } = params;
   if (!vbdUuid) {
@@ -20836,12 +21628,12 @@ async function run208(context) {
     error: message
   };
 }
-var unplug_vbd_default = task(run208, {
+var unplug_vbd_default = task(run210, {
   description: "Unplugs a VBD from an XCP-ng VM, tolerating already-detached devices when allow_missing:true."
 });
 
 // src/core/xcpng/suspend-vm.ts
-async function run209(context) {
+async function run211(context) {
   const { params, error } = context;
   const { vm_uuid: vmUuid, allow_running: rawAllowRunning } = params;
   if (!vmUuid) {
@@ -20902,12 +21694,12 @@ async function run209(context) {
     waitAttempts: waitResult.attempts
   };
 }
-var suspend_vm_default = task(run209, {
+var suspend_vm_default = task(run211, {
   description: "Suspends an XCP-ng VM, waiting until the VM reports the suspended power state."
 });
 
 // src/core/xcpng/resume-vm.ts
-async function run210(context) {
+async function run212(context) {
   const { params, error } = context;
   const { vm_uuid: vmUuid, start_paused: rawStartPaused, host_uuid: hostUuid } = params;
   if (!vmUuid) {
@@ -20972,12 +21764,12 @@ async function run210(context) {
     waitAttempts: waitResult.attempts
   };
 }
-var resume_vm_default = task(run210, {
+var resume_vm_default = task(run212, {
   description: "Resumes a suspended XCP-ng VM, optionally starting it in a paused state or on a specific host."
 });
 
 // src/core/xcpng/list-vif-params.ts
-async function run211(context) {
+async function run213(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "vif-param-list", filters);
   if (!result.success) {
@@ -20991,12 +21783,12 @@ async function run211(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_vif_params_default = task(run211, {
+var list_vif_params_default = task(run213, {
   description: "Lists parameters for virtual interfaces (VIFs) on an XCP-ng host."
 });
 
 // src/core/xcpng/list-vifs.ts
-async function run212(context) {
+async function run214(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "vif-list", filters);
   if (!result.success) {
@@ -21046,12 +21838,12 @@ async function run212(context) {
     items: enrichedItems
   };
 }
-var list_vifs_default = task(run212, {
+var list_vifs_default = task(run214, {
   description: "Lists VIFs (virtual interfaces) attached to VMs."
 });
 
 // src/core/xcpng/list-pif-params.ts
-async function run213(context) {
+async function run215(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "pif-param-list", filters);
   if (!result.success) {
@@ -21065,12 +21857,12 @@ async function run213(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_pif_params_default = task(run213, {
+var list_pif_params_default = task(run215, {
   description: "Lists parameters for PIFs on an XCP-ng host."
 });
 
 // src/core/xcpng/list-pifs.ts
-async function run214(context) {
+async function run216(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "pif-list", filters);
   if (!result.success) {
@@ -21120,12 +21912,12 @@ async function run214(context) {
     items: enrichedItems
   };
 }
-var list_pifs_default = task(run214, {
+var list_pifs_default = task(run216, {
   description: "Lists PIFs (physical interfaces) available on the XCP-ng host."
 });
 
 // src/core/xcpng/reboot-vm.ts
-async function run215(context) {
+async function run217(context) {
   const { params, error } = context;
   const { vm_uuid: vmUuidParam, vm_name_label: vmNameLabel, force: rawForce } = params ?? {};
   const force = coerceBoolean(rawForce, false);
@@ -21186,12 +21978,12 @@ async function run215(context) {
     waitAttempts: waitResult.attempts
   };
 }
-var reboot_vm_default = task(run215, {
+var reboot_vm_default = task(run217, {
   description: "Reboots an XCP-ng VM using `xe vm-reboot`."
 });
 
 // src/core/xcpng/set-network-param.ts
-async function run216(context) {
+async function run218(context) {
   const { params, error } = context;
   const {
     network_uuid: networkUuidParam,
@@ -21257,12 +22049,12 @@ async function run216(context) {
     appliedCommands
   };
 }
-var set_network_param_default = task(run216, {
+var set_network_param_default = task(run218, {
   description: "Updates a network parameter (wraps xe network-param-set)."
 });
 
 // src/core/xcpng/resize-vdi.ts
-async function run217(context) {
+async function run219(context) {
   const { params, error } = context;
   const {
     vdi_uuid: vdiUuidParam,
@@ -21336,12 +22128,12 @@ async function run217(context) {
     newSizeBytes: sizeBytes
   };
 }
-var resize_vdi_default = task(run217, {
+var resize_vdi_default = task(run219, {
   description: "Resizes an existing VDI on XCP-ng using `xe vdi-resize`/`vdi-resize-online`."
 });
 
 // src/core/xcpng/set-vm-resources.ts
-async function run218(context) {
+async function run220(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuidParam,
@@ -21644,12 +22436,12 @@ function ensurePositiveMib(value, fieldName) {
     bytes: mibToBytes2(value)
   };
 }
-var set_vm_resources_default = task(run218, {
+var set_vm_resources_default = task(run220, {
   description: "Updates VM memory and vCPU settings on an XCP-ng host."
 });
 
 // src/core/xcpng/resize-vm-cpus.ts
-async function run219(context) {
+async function run221(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuid,
@@ -21698,12 +22490,12 @@ async function run219(context) {
     waitAttempts: result.waitAttempts
   };
 }
-var resize_vm_cpus_default = task(run219, {
+var resize_vm_cpus_default = task(run221, {
   description: "Resizes an XCP-ng VM\u2019s vCPU configuration."
 });
 
 // src/core/xcpng/resize-vm-memory.ts
-async function run220(context) {
+async function run222(context) {
   const { params, error } = context;
   const { vm_uuid: vmUuid, vm_name_label: vmNameLabel, memory_mib: memoryMib } = params ?? {};
   if (!memoryMib || !Number.isFinite(memoryMib) || memoryMib <= 0) {
@@ -21742,12 +22534,12 @@ async function run220(context) {
     waitAttempts: result.waitAttempts
   };
 }
-var resize_vm_memory_default = task(run220, {
+var resize_vm_memory_default = task(run222, {
   description: "Resizes an XCP-ng VM\u2019s memory allocation (static/dynamic bounds)."
 });
 
 // src/core/xcpng/revert-snapshot.ts
-async function run221(context) {
+async function run223(context) {
   const { params, error } = context;
   const { snapshot_uuid: snapshotUuid } = params ?? {};
   if (!snapshotUuid) {
@@ -21836,12 +22628,12 @@ async function run221(context) {
     waitAttempts
   };
 }
-var revert_snapshot_default = task(run221, {
+var revert_snapshot_default = task(run223, {
   description: "Reverts an XCP-ng VM to a specified snapshot."
 });
 
 // src/core/xcpng/set-snapshot-param.ts
-async function run222(context) {
+async function run224(context) {
   const { params, error } = context;
   const { snapshot_uuid: snapshotUuid, key, value } = params ?? {};
   if (!snapshotUuid) {
@@ -21879,12 +22671,12 @@ async function run222(context) {
     command: commandResult.command
   };
 }
-var set_snapshot_param_default = task(run222, {
+var set_snapshot_param_default = task(run224, {
   description: "Updates a snapshot parameter (wraps xe snapshot-param-set)."
 });
 
 // src/core/xcpng/set-sr-param.ts
-async function run223(context) {
+async function run225(context) {
   const { params, error } = context;
   const {
     sr_uuid: srUuidParam,
@@ -21950,12 +22742,12 @@ async function run223(context) {
     appliedCommands
   };
 }
-var set_sr_param_default = task(run223, {
+var set_sr_param_default = task(run225, {
   description: "Updates a storage repository parameter (wraps xe sr-param-set)."
 });
 
 // src/core/xcpng/start-vm.ts
-async function run224(context) {
+async function run226(context) {
   const { params, error } = context;
   const { vm_uuid, start_paused: rawStartPaused, force: rawForce } = params;
   const startPaused = coerceBoolean(rawStartPaused, false);
@@ -22022,12 +22814,12 @@ async function run224(context) {
     waitAttempts: waitResult.attempts
   };
 }
-var start_vm_default = task(run224, {
+var start_vm_default = task(run226, {
   description: "Starts an XCP-ng virtual machine with optional paused or forced modes."
 });
 
 // src/core/xcpng/stop-vm.ts
-async function run225(context) {
+async function run227(context) {
   const { params, error } = context;
   const { vm_uuid, force: rawForce, timeout_seconds: rawTimeout } = params;
   const force = coerceBoolean(rawForce, false);
@@ -22102,14 +22894,14 @@ async function run225(context) {
     waitAttempts: waitResult.attempts
   };
 }
-var stop_vm_default = task(run225, {
+var stop_vm_default = task(run227, {
   description: "Stops an XCP-ng virtual machine gracefully or forcefully."
 });
 
 // src/core/xcpng/import-iso.ts
 import { posix as pathPosix2 } from "path";
 var DEFAULT_ISO_SR_PATH2 = "/var/opt/xen/iso-sr";
-async function run226(context) {
+async function run228(context) {
   if (!context.host) {
     return {
       success: false,
@@ -22315,7 +23107,7 @@ async function findIsoVdi2(context, srUuid, isoFileName) {
   }
   return { vdi };
 }
-var import_iso_default = task(run226, {
+var import_iso_default = task(run228, {
   description: "Ensures an ISO file is represented as a VDI in an ISO SR by rescanning and importing when necessary."
 });
 
@@ -22323,7 +23115,7 @@ var import_iso_default = task(run226, {
 import { basename, posix as pathPosix3 } from "path";
 import { createReadStream, promises as fs10 } from "fs";
 var DEFAULT_ISO_SR_PATH3 = "/var/opt/xen/iso-sr";
-async function run227(context) {
+async function run229(context) {
   if (context.host) {
     return {
       success: false,
@@ -22376,10 +23168,10 @@ async function run227(context) {
   }
   let overallSuccess = true;
   const uploads = await context.ssh([], async (remoteContext) => {
-    const { run: run245 } = remoteContext;
+    const { run: run247 } = remoteContext;
     const remotePath = pathPosix3.join(resolvedLocation, remoteFileName);
     try {
-      const srResult = await run245(find_or_create_iso_sr_default({
+      const srResult = await run247(find_or_create_iso_sr_default({
         name_label: isoSrName,
         location: resolvedLocation,
         location_owner: locationOwner,
@@ -22394,7 +23186,7 @@ async function run227(context) {
           error: srResult.error ?? "Failed to ensure ISO SR exists."
         };
       }
-      const fileExistsResult = await run245(exists_default2({ path: remotePath }));
+      const fileExistsResult = await run247(exists_default2({ path: remotePath }));
       if (fileExistsResult.exists) {
         return {
           success: true,
@@ -22460,7 +23252,7 @@ function resolveChunkSizeBytes(chunkSizeMb) {
   const bounded = Math.min(Math.max(safeSize, MIN_CHUNK_SIZE_MB), MAX_CHUNK_SIZE_MB);
   return bounded * 1024 * 1024;
 }
-var upload_iso_default = task(run227, {
+var upload_iso_default = task(run229, {
   description: "Uploads a local ISO to the remote XCP-ng hypervisor, ensuring the target ISO SR exists beforehand."
 });
 
@@ -22479,7 +23271,7 @@ function parseMapValue(raw) {
     return acc;
   }, {});
 }
-async function run228(context) {
+async function run230(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuidParam,
@@ -22617,12 +23409,12 @@ async function run228(context) {
   }
   return result;
 }
-var get_vm_info_default = task(run228, {
+var get_vm_info_default = task(run230, {
   description: "Returns structured VM details (platform, boot configuration, memory/CPU sizing, and optional VBD/VIF inventory)."
 });
 
 // src/core/xcpng/export-vdi.ts
-async function run229(context) {
+async function run231(context) {
   const { params, error } = context;
   const {
     vdi_uuid: vdiUuidParam,
@@ -22702,12 +23494,12 @@ async function run229(context) {
     appliedCommands
   };
 }
-var export_vdi_default = task(run229, {
+var export_vdi_default = task(run231, {
   description: "Exports a VDI to the hypervisor filesystem via xe vdi-export."
 });
 
 // src/core/xcpng/provision-vm-from-iso.ts
-async function run230(context) {
+async function run232(context) {
   if (!context.host) {
     return {
       success: false,
@@ -23034,7 +23826,7 @@ async function run230(context) {
     steps
   };
 }
-var provision_vm_from_iso_default = task(run230, {
+var provision_vm_from_iso_default = task(run232, {
   description: "Creates a VM from a template, attaches storage, network, and ISO media, and optionally boots it for installation."
 });
 
@@ -24007,7 +24799,7 @@ function resolveMemoryMib(input) {
   }
   return { value: Math.floor(value) };
 }
-async function run231(context) {
+async function run233(context) {
   if (!context.host) {
     return runLocal(context);
   }
@@ -24236,7 +25028,7 @@ function buildLocalFailure(step, message) {
     error: message
   };
 }
-var provision_vm_default = task(run231, {
+var provision_vm_default = task(run233, {
   description: "Provisions a VM from an XCP-ng template by cloning its root disk, configuring cloud-init metadata, and attaching network resources."
 });
 function delay(ms) {
@@ -24286,7 +25078,7 @@ function parseNumber2(value) {
 }
 
 // src/core/xcpng/snapshot-vm.ts
-async function run232(context) {
+async function run234(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuidParam,
@@ -24356,13 +25148,13 @@ async function run232(context) {
     command: snapshotResult.command
   };
 }
-var snapshot_vm_default = task(run232, {
+var snapshot_vm_default = task(run234, {
   description: "Creates a snapshot of an XCP-ng VM (optionally with quiesce)."
 });
 
 // src/core/xcpng/import-vdi.ts
 import path8 from "path";
-async function run233(context) {
+async function run235(context) {
   const { params, error } = context;
   const {
     sr_uuid: srUuidParam,
@@ -24484,7 +25276,7 @@ async function run233(context) {
     appliedCommands
   };
 }
-var import_vdi_default = task(run233, {
+var import_vdi_default = task(run235, {
   description: "Imports a VDI file into a storage repository via xe vdi-import."
 });
 async function resolveVirtualSize(context, options) {
@@ -24563,7 +25355,7 @@ function parseOriginalSizeFromVhdTool(output) {
 }
 
 // src/core/xcpng/vm-migrate.ts
-async function run234(context) {
+async function run236(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuidParam,
@@ -24687,12 +25479,12 @@ async function run234(context) {
     appliedCommands
   };
 }
-var vm_migrate_default = task(run234, {
+var vm_migrate_default = task(run236, {
   description: "Migrates a VM to another host (and optionally storage repository) via xe vm-migrate."
 });
 
 // src/core/xcpng/vm-export.ts
-async function run235(context) {
+async function run237(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuidParam,
@@ -24781,12 +25573,12 @@ async function run235(context) {
     appliedCommands
   };
 }
-var vm_export_default = task(run235, {
+var vm_export_default = task(run237, {
   description: "Exports a VM to an XVA file via xe vm-export."
 });
 
 // src/core/xcpng/vm-import.ts
-async function run236(context) {
+async function run238(context) {
   const { params, error } = context;
   const {
     filename,
@@ -24855,12 +25647,12 @@ async function run236(context) {
     appliedCommands
   };
 }
-var vm_import_default = task(run236, {
+var vm_import_default = task(run238, {
   description: "Imports a VM image from an XVA file via xe vm-import."
 });
 
 // src/core/xcpng/vm-copy.ts
-async function run237(context) {
+async function run239(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuidParam,
@@ -24987,12 +25779,12 @@ async function run237(context) {
     appliedCommands
   };
 }
-var vm_copy_default = task(run237, {
+var vm_copy_default = task(run239, {
   description: "Creates a full copy of a VM, optionally targeting a different SR."
 });
 
 // src/core/xcpng/detach-cd-media.ts
-async function run238(context) {
+async function run240(context) {
   if (!context.host) {
     return {
       success: false,
@@ -25136,12 +25928,12 @@ function filterCdDisks(disks) {
   }
   return results;
 }
-var detach_cd_media_default = task(run238, {
+var detach_cd_media_default = task(run240, {
   description: "Detaches CD/DVD virtual media from a VM by unplugging and destroying associated VBDs."
 });
 
 // src/core/xcpng/cleanup-config-drive.ts
-async function run239(context) {
+async function run241(context) {
   if (!context.host) {
     return {
       success: false,
@@ -25341,7 +26133,7 @@ async function run239(context) {
     steps
   };
 }
-var cleanup_config_drive_default = task(run239, {
+var cleanup_config_drive_default = task(run241, {
   description: "Detaches an attached config-drive ISO from a VM and removes the associated VDI once the guest is halted."
 });
 
@@ -25453,7 +26245,7 @@ __export(yum_exports2, {
 
 // src/core/yum/add_repository.ts
 import path9 from "path";
-async function run240(context) {
+async function run242(context) {
   const { params, exec, info, error } = context;
   const { content, name, sudo = true } = params;
   if (!content) {
@@ -25468,9 +26260,11 @@ async function run240(context) {
   }
   const repoFilePath = path9.join("/etc/yum.repos.d", `${name}.repo`);
   try {
-    const cmd = `echo "${content}" > ${repoFilePath}`;
-    info(`Executing: ${cmd}`);
-    const result = await exec(cmd, { sudo });
+    const heredoc = `cat <<'EOF' > ${repoFilePath}
+${content}
+EOF`;
+    info(`Writing repository definition to ${repoFilePath}`);
+    const result = await exec(["bash", "-lc", heredoc], { sudo });
     if (result.exitCode !== 0) {
       const errorMsg = `Failed to add repository: ${result.stderr}`;
       error(errorMsg);
@@ -25483,7 +26277,7 @@ async function run240(context) {
     return { success: false, error: errorMsg };
   }
 }
-var add_repository_default2 = task(run240, { description: "Adds a YUM repository." });
+var add_repository_default2 = task(run242, { description: "Adds a YUM repository." });
 
 // src/core/net/index.ts
 var net_exports = {};
@@ -25493,7 +26287,7 @@ __export(net_exports, {
 });
 
 // src/core/net/download.ts
-async function run241(context) {
+async function run243(context) {
   const { params, info, error, exec } = context;
   const { url, dest, mode, sudo = false } = params;
   if (!url || !dest) {
@@ -25538,10 +26332,10 @@ async function run241(context) {
     return { success: false, error: errorMsg };
   }
 }
-var download_default = task(run241, { description: "Downloads a file from a URL using curl or wget." });
+var download_default = task(run243, { description: "Downloads a file from a URL using curl or wget." });
 
 // src/core/net/interfaces.ts
-async function run242(context) {
+async function run244(context) {
   const { params, info, error, exec } = context;
   const { sudo = false } = params;
   try {
@@ -25552,8 +26346,9 @@ async function run242(context) {
       return { success: false, error: errorMsg };
     }
     let interfaces = [];
+    const sanitizedOutput = stripAnsiSequences(ipResult.stdout);
     try {
-      const ipData = JSON.parse(ipResult.stdout);
+      const ipData = sanitizedOutput ? JSON.parse(sanitizedOutput) : [];
       for (const iface of ipData) {
         const interfaceInfo = {
           name: iface.ifname,
@@ -25599,7 +26394,7 @@ async function run242(context) {
       }
     } catch (parseError) {
       info("JSON parsing failed, falling back to manual parsing");
-      const lines = ipResult.stdout.split("\n");
+      const lines = sanitizedOutput.split("\n");
       let currentInterface = null;
       for (const line of lines) {
         const trimmed = line.trim();
@@ -25668,7 +26463,7 @@ async function run242(context) {
     return { success: false, error: errorMsg };
   }
 }
-var interfaces_default = task(run242, { description: "Lists network interfaces with their properties." });
+var interfaces_default = task(run244, { description: "Lists network interfaces with their properties." });
 
 // src/core/nftables/index.ts
 var nftables_exports = {};
@@ -25677,7 +26472,7 @@ __export(nftables_exports, {
 });
 
 // src/core/nftables/apply.ts
-async function run243(context) {
+async function run245(context) {
   const { params, exec, info } = context;
   const { config } = params;
   if (!config) {
@@ -25701,7 +26496,7 @@ async function run243(context) {
     return { success: false, error };
   }
 }
-var apply_default = task(run243, { description: "Applies an nftables configuration." });
+var apply_default = task(run245, { description: "Applies an nftables configuration." });
 
 // src/core/nftables/index.ts
 var nftables_default = {
@@ -25715,7 +26510,7 @@ __export(firewalld_exports, {
 });
 
 // src/core/firewalld/disable.ts
-async function run244(context) {
+async function run246(context) {
   const { run: runTask, debug, error, info } = context;
   const statusResult = await runTask(status_default({ service: "firewalld" }));
   if (!statusResult.success && (statusResult.error?.includes("Could not find") || statusResult.error?.includes("not-found"))) {
@@ -25739,7 +26534,7 @@ async function run244(context) {
   info("firewalld service disabled successfully.");
   return { success: true };
 }
-var disable_default3 = task(run244, { description: "Disables and stops the firewalld service." });
+var disable_default3 = task(run246, { description: "Disables and stops the firewalld service." });
 
 // src/core/firewalld/index.ts
 var firewalld_default = {