hostctl 0.1.57 → 0.1.59

package/dist/index.js

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 
 // src/app.ts
 import process4 from "process";
-import * as fs11 from "fs";
+import * as fs12 from "fs";
 import { homedir as homedir3 } from "os";
 
 // src/handlebars.ts
@@ -1831,8 +1831,12 @@ var TmpFileRegistry = class _TmpFileRegistry {
   constructor(rootPath) {
     this.rootPath = Path.new(rootPath);
     this.tempFilePaths = [];
+    this.ensureRootPathExists();
     process2.on("exit", (code) => this.exitCallback());
   }
+  ensureRootPathExists() {
+    fs.mkdirSync(this.rootPath.toString(), { recursive: true });
+  }
   randName() {
     return Math.random().toString(36).slice(-5) + Math.random().toString(36).slice(-5);
   }
@@ -1849,6 +1853,7 @@ var TmpFileRegistry = class _TmpFileRegistry {
   }
   // this file will be automatically cleaned up at program exit
   writeTmpFile(fileContent) {
+    this.ensureRootPathExists();
     const path14 = this.tmpPath();
     fs.writeFileSync(path14.toString(), fileContent);
     this.registerTempFileOrDir(path14.toString());
@@ -1890,6 +1895,7 @@ var Host = class {
     this.user = opts.user;
     this.password = opts.password;
     this.sshKey = opts.sshKey;
+    this.sshKeyPassphrase = opts.sshKeyPassphrase;
     this.tags = opts.tags ?? [];
     this.tagSet = new Set(this.tags);
   }
@@ -1901,6 +1907,7 @@ var Host = class {
   user;
   password;
   sshKey;
+  sshKeyPassphrase;
   tags;
   tagSet;
   async decryptedPassword() {
@@ -1920,6 +1927,16 @@ var Host = class {
       return await secret?.plaintext();
     }
   }
+  async decryptedSshKeyPassphrase() {
+    if (V(this.sshKeyPassphrase).isA(SecretRef)) {
+      const secretRef = this.sshKeyPassphrase;
+      const secret = this.config.getSecret(secretRef.name);
+      return await secret?.plaintext();
+    }
+    if (typeof this.sshKeyPassphrase === "string") {
+      return this.sshKeyPassphrase;
+    }
+  }
   toYAML() {
     let passwordForYaml = this.password;
     if (this.password && V(this.password).isA(SecretRef)) {
@@ -1929,6 +1946,10 @@ var Host = class {
     if (this.sshKey && V(this.sshKey).isA(SecretRef)) {
       sshKeyForYaml = this.sshKey.toYAML();
     }
+    let sshKeyPassphraseForYaml = this.sshKeyPassphrase;
+    if (this.sshKeyPassphrase && V(this.sshKeyPassphrase).isA(SecretRef)) {
+      sshKeyPassphraseForYaml = this.sshKeyPassphrase.toYAML();
+    }
     return {
       host: this.hostname,
       // Always include the host field
@@ -1937,6 +1958,7 @@ var Host = class {
       // Only include port if not default
       password: passwordForYaml,
       "ssh-key": sshKeyForYaml,
+      "ssh-key-passphrase": sshKeyPassphraseForYaml,
       tags: this.tags
     };
   }
@@ -2288,6 +2310,7 @@ var ConfigFile2 = class {
       hostObj ||= {};
       const password = this.parseSecretValue(hostObj.password);
       const sshKey = this.parseSecretValue(hostObj["ssh-key"]);
+      const sshKeyPassphrase = this.parseSecretValue(hostObj["ssh-key-passphrase"]);
       const hostname = hostObj.host || alias;
       hostMap.set(
         alias,
@@ -2302,6 +2325,7 @@ var ConfigFile2 = class {
           user: hostObj.user,
           password,
           sshKey,
+          sshKeyPassphrase,
           tags: hostObj.tags
         })
       );
@@ -2476,6 +2500,7 @@ var ProviderConfig = class _ProviderConfig {
       user: input.user,
       password: input.password,
       sshKey: input.sshKey,
+      sshKeyPassphrase: input.sshKeyPassphrase,
       tags: input.tags
     });
   }
@@ -2519,6 +2544,7 @@ var FileConfigProvider = class {
       port: h.port,
       password: h.password,
       sshKey: h.sshKey,
+      sshKeyPassphrase: h.sshKeyPassphrase,
       tags: h.tags
     }));
   }
@@ -2719,7 +2745,7 @@ var Verbosity = {
 };
 
 // src/version.ts
-var version = "0.1.57";
+var version = "0.1.59";
 
 // src/commands/pkg/create.ts
 import { promises as fs5 } from "fs";
@@ -4150,9 +4176,13 @@ function task(runFn4, options) {
     options?.outputSchema
   );
   const taskFnObject = function(params) {
-    return function(parentInvocation) {
-      return parentInvocation.invokeChildTask(taskFnObject, params ?? {});
+    const normalizedParams = params ?? {};
+    const taskPartialFn = function(parentInvocation) {
+      return parentInvocation.invokeChildTask(taskFnObject, normalizedParams);
     };
+    taskPartialFn.taskFn = taskFnObject;
+    taskPartialFn.params = normalizedParams;
+    return taskPartialFn;
   };
   Object.assign(taskFnObject, { task: taskInstance });
   return taskFnObject;
@@ -4808,7 +4838,7 @@ var DirCreateOutputSchema = z.object({
   })
 );
 async function runFn(context) {
-  const { params, exec, run: run253 } = context;
+  const { params, exec, run: run249 } = context;
   const sudoDefault = context.host ? !context.host.isLocal() : false;
   const { path: path14, mode, owner, sudo = sudoDefault } = params;
   if (!path14) {
@@ -4832,7 +4862,7 @@ async function runFn(context) {
       }
     }
     if (mode) {
-      const chmodResult = await run253(chmod_default({ path: path14, mode, sudo: true }));
+      const chmodResult = await run249(chmod_default({ path: path14, mode, sudo: true }));
       if (!chmodResult?.success) {
         return { success: false, error: chmodResult?.error ?? "Failed to set directory mode" };
       }
@@ -5425,7 +5455,7 @@ async function ensureFile(context, file, sudo) {
   await exec(["touch", file], { sudo });
 }
 async function runFn2(context) {
-  const { params, exec, info, run: run253, error } = context;
+  const { params, exec, info, run: run249, error } = context;
   const {
     file,
     state = "present",
@@ -6112,7 +6142,7 @@ async function getOsReleaseInfo(exec) {
     const cpeMatch = osRelease.match(/^CPE_NAME=(.*?)$/im);
     if (idMatch) {
       let id = idMatch[1].trim().replace(/"/g, "");
-      const idLike = idLikeMatch ? idLikeMatch[1].trim().replace(/"/g, "") : id;
+      let idLike = idLikeMatch ? idLikeMatch[1].trim().replace(/"/g, "") : id;
       const version2 = versionIdMatch && versionIdMatch[1].trim().replace(/"/g, "") || buildIdMatch && buildIdMatch[1].trim().replace(/"/g, "") || "unknown";
       const nameValue = nameMatch ? nameMatch[1].trim().replace(/"/g, "") : "";
       const prettyName = prettyNameMatch ? prettyNameMatch[1].trim().replace(/"/g, "") : "";
@@ -6121,6 +6151,10 @@ async function getOsReleaseInfo(exec) {
       if (normalizedName.includes("rocky") || idLike.toLowerCase().includes("rocky")) {
         id = "rocky";
       }
+      if (normalizedName.includes("xcp-ng") || id.toLowerCase() === "xenenterprise") {
+        id = "xcp-ng";
+        idLike = "xcp-ng";
+      }
       return {
         idLike,
         id,
@@ -6140,6 +6174,53 @@ async function getOsReleaseInfo(exec) {
     };
   }
 }
+function parseKeyValueFile(contents) {
+  return contents.split("\n").map((line) => line.trim()).filter(Boolean).reduce((acc, line) => {
+    const match7 = line.match(/^([A-Za-z0-9_]+)=(.*)$/);
+    if (!match7) {
+      return acc;
+    }
+    const key = match7[1];
+    const rawValue = match7[2];
+    const value = rawValue.replace(/^"(.*)"$/, "$1");
+    acc[key] = value;
+    return acc;
+  }, {});
+}
+async function detectSynologyInfo(exec) {
+  try {
+    const { stdout } = await exec(["cat", "/etc.defaults/VERSION"]);
+    const values3 = parseKeyValueFile(stdout);
+    const version2 = values3.productversion || values3.version || `${values3.major || ""}.${values3.minor || ""}`.trim();
+    if (!version2 || version2 === ".") {
+      return null;
+    }
+    return {
+      idLike: "synology",
+      id: "synology",
+      version: version2
+    };
+  } catch {
+    return null;
+  }
+}
+async function detectXcpNgInfo(exec) {
+  try {
+    const { stdout } = await exec(["cat", "/etc/redhat-release"]);
+    if (!stdout.toLowerCase().includes("xcp-ng")) {
+      return null;
+    }
+    const versionMatch = stdout.match(/([0-9]+(?:\.[0-9]+)+)/);
+    const version2 = versionMatch ? versionMatch[1] : "unknown";
+    return {
+      idLike: "xcp-ng",
+      id: "xcp-ng",
+      version: version2
+    };
+  } catch {
+    return null;
+  }
+}
 async function detectRockyLinux(exec) {
   try {
     const { stdout } = await exec([
@@ -6154,58 +6235,74 @@ async function detectRockyLinux(exec) {
 }
 var os_default = task(
   async function run26(context) {
-    try {
-      const { exec } = context;
-      const {
-        success: ostypeSuccess,
-        stdout: ostypeOutput,
-        stderr: ostypeStderr
-      } = await exec(["bash", "-c", "echo $OSTYPE"]);
-      if (!ostypeSuccess) {
-        throw new Error(`Failed to get OSTYPE: ${ostypeStderr}`);
-      }
-      const family = await match3(ostypeOutput.trim().toLowerCase()).with(P2.string.startsWith("solaris"), () => "solaris").with(P2.string.startsWith("darwin"), () => "darwin").with(P2.string.startsWith("linux"), () => "linux").with(P2.string.startsWith("bsd"), () => "bsd").with(P2.string.startsWith("freebsd"), () => "bsd").with(P2.string.startsWith("msys"), () => "windows").with(P2.string.startsWith("cygwin"), () => "windows").with(P2.string.startsWith("mingw"), () => "windows").otherwise(async () => {
-        const { stdout: unameOutput } = await exec(["uname"]);
-        const unameFamily = match3(unameOutput.trim().toLowerCase()).with(P2.string.startsWith("sunos"), () => "solaris").with(P2.string.startsWith("darwin"), () => "darwin").with(P2.string.startsWith("linux"), () => "linux").with(P2.string.startsWith("freebsd"), () => "bsd").with(P2.string.startsWith("openbsd"), () => "bsd").with(P2.string.startsWith("netbsd"), () => "bsd").otherwise(() => "unknown");
-        return unameFamily;
-      });
-      const [osIdLike, osId, osVersion] = await match3(family).with("bsd", async () => {
-        const { stdout: unameROutput } = await exec(["uname", "-r"]);
-        return [family, family, unameROutput.trim()];
-      }).with("darwin", async () => {
-        const { stdout: swVersOutput } = await exec(["sw_vers", "-productVersion"]);
-        return [family, family, swVersOutput.trim()];
-      }).with("linux", async () => {
-        const { idLike, id, version: version2 } = await getOsReleaseInfo(exec);
-        return [idLike, id, version2];
-      }).with("solaris", async () => {
-        const { stdout: unameROutput } = await exec(["uname", "-r"]);
-        return ["solaris", "solaris", unameROutput.trim()];
-      }).with("windows", () => ["windows", "windows", "unknown"]).otherwise(() => ["unknown", "unknown", "unknown"]);
-      let variant = osId.toLowerCase();
-      if (family === "linux" && !variant.includes("rocky") && (osIdLike.toLowerCase().includes("rocky") || osId.toLowerCase().includes("rhel"))) {
-        const isRocky = await detectRockyLinux(exec);
-        if (isRocky) {
-          variant = "rocky";
+    return await context.memoize(
+      "core.host.os:v1",
+      async () => {
+        try {
+          const { exec } = context;
+          const {
+            success: ostypeSuccess,
+            stdout: ostypeOutput,
+            stderr: ostypeStderr
+          } = await exec(["bash", "-c", "echo $OSTYPE"]);
+          if (!ostypeSuccess) {
+            throw new Error(`Failed to get OSTYPE: ${ostypeStderr}`);
+          }
+          const family = await match3(ostypeOutput.trim().toLowerCase()).with(P2.string.startsWith("solaris"), () => "solaris").with(P2.string.startsWith("darwin"), () => "darwin").with(P2.string.startsWith("linux"), () => "linux").with(P2.string.startsWith("bsd"), () => "bsd").with(P2.string.startsWith("freebsd"), () => "bsd").with(P2.string.startsWith("msys"), () => "windows").with(P2.string.startsWith("cygwin"), () => "windows").with(P2.string.startsWith("mingw"), () => "windows").otherwise(async () => {
+            const { stdout: unameOutput } = await exec(["uname"]);
+            const unameFamily = match3(unameOutput.trim().toLowerCase()).with(P2.string.startsWith("sunos"), () => "solaris").with(P2.string.startsWith("darwin"), () => "darwin").with(P2.string.startsWith("linux"), () => "linux").with(P2.string.startsWith("freebsd"), () => "bsd").with(P2.string.startsWith("openbsd"), () => "bsd").with(P2.string.startsWith("netbsd"), () => "bsd").otherwise(() => "unknown");
+            return unameFamily;
+          });
+          const [osIdLike, osId, osVersion] = await match3(family).with("bsd", async () => {
+            const { stdout: unameROutput } = await exec(["uname", "-r"]);
+            return [family, family, unameROutput.trim()];
+          }).with("darwin", async () => {
+            const { stdout: swVersOutput } = await exec(["sw_vers", "-productVersion"]);
+            return [family, family, swVersOutput.trim()];
+          }).with("linux", async () => {
+            let { idLike, id, version: version2 } = await getOsReleaseInfo(exec);
+            if (id === "unknown") {
+              const synologyInfo = await detectSynologyInfo(exec);
+              if (synologyInfo) {
+                return [synologyInfo.idLike, synologyInfo.id, synologyInfo.version];
+              }
+              const xcpNgInfo = await detectXcpNgInfo(exec);
+              if (xcpNgInfo) {
+                return [xcpNgInfo.idLike, xcpNgInfo.id, xcpNgInfo.version];
+              }
+            }
+            return [idLike, id, version2];
+          }).with("solaris", async () => {
+            const { stdout: unameROutput } = await exec(["uname", "-r"]);
+            return ["solaris", "solaris", unameROutput.trim()];
+          }).with("windows", () => ["windows", "windows", "unknown"]).otherwise(() => ["unknown", "unknown", "unknown"]);
+          let variant = osId.toLowerCase();
+          if (family === "linux" && !variant.includes("rocky") && (osIdLike.toLowerCase().includes("rocky") || osId.toLowerCase().includes("rhel"))) {
+            const isRocky = await detectRockyLinux(exec);
+            if (isRocky) {
+              variant = "rocky";
+            }
+          }
+          return {
+            success: true,
+            family,
+            os: osIdLike.toLowerCase(),
+            variant,
+            version: osVersion
+          };
+        } catch (error) {
+          return {
+            success: false,
+            error: error.message,
+            family: "unknown",
+            os: "unknown",
+            variant: "unknown",
+            version: "unknown"
+          };
         }
-      }
-      return {
-        success: true,
-        family,
-        os: osIdLike.toLowerCase(),
-        variant,
-        version: osVersion
-      };
-    } catch (error) {
-      return {
-        success: false,
-        error: error.message,
-        family: "unknown",
-        os: "unknown",
-        variant: "unknown",
-        version: "unknown"
-      };
-    }
+      },
+      { scope: "host" }
+    );
   },
   {
     name: "os",
@@ -6256,15 +6353,29 @@ async function run27(context) {
     const hostnameResult = await runTask(hostname_default({}));
     const name = hostnameResult.hostname;
     const os6 = await runTask(os_default({}));
-    const { stdout: lsbOutput } = await exec(["lsb_release", "-a"]);
-    const lsb_release = lsbOutput.split("\n").filter(Boolean).reduce((acc, line) => {
-      const [key, ...valueParts] = line.split(":");
-      const value = valueParts.join(":").trim();
-      acc[key.trim()] = value;
-      return acc;
-    }, {});
-    const { stdout: lscpuOutput } = await exec(["lscpu", "-J"]);
-    const lscpu = JSON.parse(lscpuOutput).lscpu;
+    let lsb_release = {
+      "Distributor ID": "",
+      Description: "",
+      Release: "",
+      Codename: ""
+    };
+    try {
+      const { stdout: lsbOutput } = await exec(["lsb_release", "-a"]);
+      lsb_release = lsbOutput.split("\n").filter(Boolean).reduce((acc, line) => {
+        const [key, ...valueParts] = line.split(":");
+        const value = valueParts.join(":").trim();
+        acc[key.trim()] = value;
+        return acc;
+      }, {});
+    } catch {
+    }
+    let lscpu = [];
+    try {
+      const { stdout: lscpuOutput } = await exec(["lscpu", "-J"]);
+      const parsed = JSON.parse(lscpuOutput);
+      lscpu = Array.isArray(parsed?.lscpu) ? parsed.lscpu : [];
+    } catch {
+    }
     return {
       host: {
         name,
@@ -7647,10 +7758,6 @@ var uninstall_default2 = task(run41, {
 // src/core/pkg/dnf/update.ts
 async function run42(context) {
   const { sudo = true, updateMetadata = true } = context.params;
-  const isProtectedPackageError = (output) => {
-    const normalized = output.toLowerCase();
-    return normalized.includes("protected packages") || normalized.includes("protected package") || normalized.includes("the following protected") || normalized.includes("systemd-udev");
-  };
   try {
     if (!updateMetadata) {
       return {
@@ -7661,55 +7768,25 @@ async function run42(context) {
         updatedPackages: []
       };
     }
-    const command = ["dnf", "update", "-y", "--quiet"];
+    const command = ["dnf", "makecache", "--refresh", "--quiet"];
     const result = await context.exec(command, { sudo });
-    const combinedOutput = `${result.stdout}
-${result.stderr}`;
     if (result.exitCode === 0) {
-      const updatedPackages = [];
-      let packagesUpdated = 0;
-      const lines = result.stdout.split("\n");
-      for (const line of lines) {
-        if (line.includes("packages upgraded")) {
-          const match7 = line.match(/(\d+)\s+packages? upgraded/);
-          if (match7) {
-            packagesUpdated = parseInt(match7[1], 10);
-          }
-        } else if (line.includes("Installing") || line.includes("Upgrading")) {
-          const match7 = line.match(/(?:Installing|Upgrading)\s+(\S+)/);
-          if (match7) {
-            updatedPackages.push(match7[1]);
-          }
-        }
-      }
       return {
         success: true,
         packageManager: "dnf",
         output: result.stdout,
-        packagesUpdated,
-        updatedPackages
-      };
-    } else {
-      if (isProtectedPackageError(combinedOutput)) {
-        context.warn("DNF skipped updates because the transaction would remove protected packages.");
-        return {
-          success: true,
-          packageManager: "dnf",
-          output: combinedOutput,
-          packagesUpdated: 0,
-          updatedPackages: [],
-          warning: "DNF skipped updates due to protected packages; leaving system unchanged."
-        };
-      }
-      return {
-        success: false,
-        error: result.stderr || "Update failed",
-        packageManager: "dnf",
-        output: result.stdout,
         packagesUpdated: 0,
         updatedPackages: []
       };
     }
+    return {
+      success: false,
+      error: result.stderr || "Update failed",
+      packageManager: "dnf",
+      output: result.stdout,
+      packagesUpdated: 0,
+      updatedPackages: []
+    };
   } catch (error) {
     context.error("Error updating packages:", error);
     return {
@@ -7723,7 +7800,7 @@ ${result.stderr}`;
 }
 var update_default2 = task(run42, {
   name: "update",
-  description: "Update packages using dnf package manager",
+  description: "Update package metadata using dnf package manager",
   inputSchema: DnfUpdateParamsSchema,
   outputSchema: DnfUpdateResultSchema
 });
@@ -10368,6 +10445,44 @@ async function packageManagerSpecificInstall(pkgManager, context) {
       return abstractInstallFallback(context, pkgManager);
   }
 }
+async function packageManagerSpecificUpdate(pkgManager, context) {
+  const mapAptParams = () => ({
+    ...context.params,
+    packageManager: "apt",
+    updateLists: true,
+    upgrade: false
+  });
+  const mapDnfParams = () => ({
+    ...context.params,
+    packageManager: "dnf",
+    updateMetadata: true,
+    upgrade: false
+  });
+  const mapPacmanParams = () => ({
+    ...context.params,
+    packageManager: "pacman",
+    updateMetadata: true,
+    upgrade: false
+  });
+  const mapYumParams = () => ({
+    ...context.params,
+    packageManager: "yum",
+    updateMetadata: true,
+    upgrade: false
+  });
+  switch (pkgManager.name) {
+    case "apt":
+      return await context.run(update_default(mapAptParams()));
+    case "dnf":
+      return await context.run(update_default2(mapDnfParams()));
+    case "pacman":
+      return await context.run(update_default3(mapPacmanParams()));
+    case "yum":
+      return await context.run(update_default4(mapYumParams()));
+    default:
+      return await abstractUpdateFallback(context, pkgManager);
+  }
+}
 function buildCommandArray(pkgManager, operation, packages, extraArgs) {
   const baseCommand = pkgManager[operation];
   if (!baseCommand) {
@@ -10657,8 +10772,8 @@ async function abstractUninstallFallback(context) {
   }
 }
 async function abstractUpdate(context) {
-  const { params, exec, log, warn, info } = context;
-  const { sudo = true, packageManager: forcedManager, extraArgs, input: userInput } = params;
+  const { params, warn } = context;
+  const { packageManager: forcedManager } = params;
   try {
     const pkgManager = forcedManager ? PACKAGE_MANAGERS[forcedManager] : await detectPackageManager(context);
     if (!pkgManager) {
@@ -10668,14 +10783,26 @@ async function abstractUpdate(context) {
       };
     }
     warn(`Using package manager: ${pkgManager.name}`);
-    if (pkgManager.name === "pacman") {
-      return await context.run(
-        update_default3({
-          ...context.params,
-          packageManager: "pacman"
-        })
-      );
+    return await packageManagerSpecificUpdate(pkgManager, context);
+  } catch (error) {
+    return {
+      success: false,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function abstractUpdateFallback(context, detectedManager) {
+  const { params, exec, warn, info } = context;
+  const { sudo = true, packageManager: forcedManager, extraArgs, input: userInput } = params;
+  try {
+    const pkgManager = detectedManager || (forcedManager ? PACKAGE_MANAGERS[forcedManager] : await detectPackageManager(context));
+    if (!pkgManager) {
+      return {
+        success: false,
+        error: "No supported package manager detected. Please specify one explicitly."
+      };
     }
+    warn(`Using fallback implementation for package manager: ${pkgManager.name}`);
     const mergedInput = getInteractiveInput(pkgManager.name, userInput);
     const commandArray = buildCommandArray(pkgManager, "updateCommand", [], extraArgs);
     info(`Executing: ${commandArray.join(" ")}`);
@@ -11210,7 +11337,8 @@ async function abstractClean(context) {
 var AbstractPkgUpdateParamsSchema = AbstractPkgParamsSchema.pick({
   sudo: true,
   packageManager: true,
-  extraArgs: true
+  extraArgs: true,
+  input: true
 });
 var AbstractPkgUpdateResultSchema = AbstractPkgResultSchema;
 async function run68(context) {
@@ -11591,7 +11719,6 @@ async function run75(context) {
   const { params, run: runTask, exec, log, info, error } = context;
   let { public_key, user, sudo } = params;
   const publicKeyTrimmed = public_key.trim();
-  const sudoPrefix = sudo ? ["sudo"] : [];
   if (!user) {
     const usernameResult = await runTask(get_username_default());
     if (usernameResult instanceof Error) {
@@ -11645,9 +11772,7 @@ async function run75(context) {
     );
     return { success: false, changed: false };
   }
-  const checkKeyCommandParts = [];
-  checkKeyCommandParts.push("sudo", "-u", user, "grep", "-xqF", publicKeyTrimmed, authorizedKeysFile);
-  const checkKeyCmdResult = await exec(checkKeyCommandParts);
+  const checkKeyCmdResult = await exec(["grep", "-xqF", publicKeyTrimmed, authorizedKeysFile], { sudo });
   if (checkKeyCmdResult.exitCode === 0) {
     info(`SSH key already exists in ${authorizedKeysFile} for user ${user}.`);
     return { success: true, changed: false };
@@ -11657,7 +11782,7 @@ async function run75(context) {
   }
   const escapedPublicKey = publicKeyTrimmed.replace(/"/g, '\\"').replace(/\$/g, "\\$").replace(/`/g, "\\`");
   const command = `echo "${escapedPublicKey}" >> "${authorizedKeysFile}"`;
-  const addKeyResult = await exec([...sudoPrefix, "sh", "-c", command], { sudo });
+  const addKeyResult = await exec(["sh", "-c", command], { sudo });
   if (!addKeyResult.success) {
     error(`Failed to append public key to ${authorizedKeysFile}: ${addKeyResult.stderr}`);
     return { success: false, changed: false };
@@ -11955,7 +12080,7 @@ async function bootstrapServiceAccount(context) {
     create_home = true,
     create_group = true,
     system = false,
-    skip_packages = false
+    skip_packages = true
   } = params;
   const skipPackages = typeof skip_packages === "string" ? skip_packages === "true" : Boolean(skip_packages);
   if (!username || !password || !public_key) {
@@ -12208,7 +12333,6 @@ __export(pkg_exports, {
   removeCp: () => remove_cp_default,
   search: () => search_default5,
   update: () => update_default5,
-  updateCp: () => update_cp_default,
   upgrade: () => upgrade_default5,
   yum: () => yum_exports
 });
@@ -12719,94 +12843,6 @@ var remove_default = task(run89, {
 // src/core/pkg/remove-cp.ts
 var remove_cp_default = remove_default;
 
-// src/core/pkg/update/arch.ts
-async function run90(context) {
-  const {
-    params: { package: pkg, sudo = true },
-    exec
-  } = context;
-  const commandParts = [sudo ? "sudo" : "", "pacman", "-Syu", "--noconfirm"];
-  if (pkg && Array.isArray(pkg) && pkg.length) {
-    commandParts.push(...pkg);
-  }
-  const { success } = await exec(commandParts.filter(Boolean).join(" "), { sudo });
-  return { success };
-}
-var update = task(run90);
-
-// src/core/pkg/update/debian.ts
-async function run91(context) {
-  const {
-    params: { package: pkg, sudo = true, fullUpgrade = false },
-    exec
-  } = context;
-  const prefix = sudo ? "sudo " : "";
-  if (!pkg || Array.isArray(pkg) && pkg.length === 0) {
-    const upgradeCmd = fullUpgrade ? "apt-get dist-upgrade -y" : "apt-get upgrade -y";
-    const { success: u1 } = await exec(`${prefix}apt-get update`, { sudo });
-    if (!u1) return { success: false };
-    const { success: success2 } = await exec(prefix + upgradeCmd, { sudo });
-    return { success: success2 };
-  }
-  const packages = Array.isArray(pkg) ? pkg : [pkg];
-  const { success } = await exec(`${prefix}apt-get install -y --only-upgrade ${packages.join(" ")}`, { sudo });
-  return { success };
-}
-var update2 = task(run91);
-
-// src/core/pkg/update/fedora.ts
-async function run92(context) {
-  const {
-    params: { package: pkg, sudo = true },
-    exec
-  } = context;
-  const prefix = sudo ? "sudo " : "";
-  if (!pkg || Array.isArray(pkg) && pkg.length === 0) {
-    const { success: success2 } = await exec(`${prefix}dnf upgrade -y`, { sudo });
-    return { success: success2 };
-  }
-  const packages = Array.isArray(pkg) ? pkg : [pkg];
-  const { success } = await exec(`${prefix}dnf upgrade -y ${packages.join(" ")}`, { sudo });
-  return { success };
-}
-var update3 = task(run92);
-
-// src/core/pkg/update/index.ts
-async function run93(context) {
-  const { params: taskParams, run: runTask, error } = context;
-  const osDetails = await runTask(os_default());
-  if (osDetails instanceof Error) {
-    error(`Failed to determine OS details: ${osDetails.message}`);
-    return { success: false };
-  }
-  const baseOs = String(osDetails?.os ?? "");
-  let result;
-  if (/arch/.test(baseOs)) {
-    result = await runTask(update(taskParams));
-  } else if (/debian|ubuntu/.test(baseOs)) {
-    result = await runTask(update2(taskParams));
-  } else if (baseOs === "fedora") {
-    result = await runTask(update3(taskParams));
-  } else {
-    error(`Unsupported OS (${baseOs}) for pkg.update`);
-    return { success: false };
-  }
-  if (result instanceof Error) {
-    error(`pkg.update failed: ${result.message}`);
-    return { success: false };
-  }
-  return result;
-}
-var update_default6 = task(run93, {
-  name: "update",
-  description: "Updates packages using the appropriate OS package manager.",
-  inputSchema: PkgUpdateParamsSchema,
-  outputSchema: PkgUpdateResultSchema
-});
-
-// src/core/pkg/update-cp.ts
-var update_cp_default = update_default6;
-
 // src/core/pkg/search.ts
 var AbstractPkgSearchParamsSchema = z.object({
   /** Search query */
@@ -12815,13 +12851,13 @@ var AbstractPkgSearchParamsSchema = z.object({
   packageManager: z.string().optional()
 });
 var AbstractPkgSearchResultSchema = AbstractPkgResultSchema;
-async function run94(context) {
+async function run90(context) {
   const result = await abstractSearch(context);
   return {
     ...result
   };
 }
-var search_default5 = task(run94, {
+var search_default5 = task(run90, {
   description: "Search for packages using auto-detected or specified package manager",
   inputSchema: AbstractPkgSearchParamsSchema,
   outputSchema: AbstractPkgSearchResultSchema
@@ -12833,10 +12869,10 @@ var AbstractPkgListParamsSchema = z.object({
   packageManager: z.string().optional()
 });
 var AbstractPkgListResultSchema = AbstractPkgResultSchema;
-async function run95(context) {
+async function run91(context) {
   return await abstractList(context);
 }
-var list_default7 = task(run95, {
+var list_default7 = task(run91, {
   description: "List installed packages using auto-detected or specified package manager",
   inputSchema: AbstractPkgListParamsSchema,
   outputSchema: AbstractPkgListResultSchema
@@ -12848,10 +12884,10 @@ var AbstractPkgCleanParamsSchema = AbstractPkgParamsSchema.pick({
   sudo: true
 });
 var AbstractPkgCleanResultSchema = AbstractPkgResultSchema;
-async function run96(context) {
+async function run92(context) {
   return await abstractClean(context);
 }
-var clean_default5 = task(run96, {
+var clean_default5 = task(run92, {
   description: "Clean package cache using auto-detected or specified package manager",
   inputSchema: AbstractPkgCleanParamsSchema,
   outputSchema: AbstractPkgCleanResultSchema
@@ -12905,7 +12941,7 @@ var K3supInstallOutputSchema = z.object({
   /** The command that would be run if --print-command was used */
   executedCommand: z.string().optional()
 });
-async function run97(context) {
+async function run93(context) {
   const { params, exec, log, error, debug } = context;
   const k3supCmd = ["k3sup", "install"];
   const addFlag = (flag, condition) => {
@@ -12963,7 +12999,7 @@ async function run97(context) {
     throw e;
   }
 }
-var k3sup_install_default = task(run97, {
+var k3sup_install_default = task(run93, {
   name: "k3sup-install",
   description: "K3s k3sup-install.",
   inputSchema: K3supInstallInputSchema,
@@ -13727,7 +13763,7 @@ var AddUsersOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run98(context) {
+async function run94(context) {
   const { params, info, warn, error, run: runTask } = context;
   const { users } = params;
   if (!users || users.length === 0) {
@@ -13760,7 +13796,7 @@ async function run98(context) {
     return { success: false, error: message };
   }
 }
-var add_users_default = task(run98, {
+var add_users_default = task(run94, {
   description: "Adds one or more users to the docker group.",
   inputSchema: AddUsersInputSchema,
   outputSchema: AddUsersOutputSchema
@@ -13780,7 +13816,7 @@ var InstallComposeOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run99(context) {
+async function run95(context) {
   const { params, info, error, run: runTask } = context;
   const version2 = params.version ?? "v2.24.5";
   const composePath = params.path ?? "/usr/local/bin/docker-compose";
@@ -13818,7 +13854,7 @@ async function run99(context) {
     return { success: false, error: message };
   }
 }
-var install_compose_default = task(run99, {
+var install_compose_default = task(run95, {
   description: "Installs the Docker Compose standalone binary.",
   inputSchema: InstallComposeInputSchema,
   outputSchema: InstallComposeOutputSchema
@@ -13841,7 +13877,7 @@ var DockerInstallOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run100(context) {
+async function run96(context) {
   const { info, run: runTask, params, error: logError2 } = context;
   const installComposePlugin = params.install_compose_plugin !== false;
   const installComposeStandalone = params.install_compose_standalone === true;
@@ -14080,7 +14116,7 @@ function sanitizeSystemctlState(value) {
   }
   return value.replace(/\u001b\][^\u001b]*\u001b\\/g, "").replace(/\u001b\[[0-9;?]*[ -/]*[@-~]/g, "").trim().toLowerCase();
 }
-var install_default6 = task(run100, {
+var install_default6 = task(run96, {
   name: "install",
   description: "Installs and configures Docker, Docker Compose, and group membership.",
   inputSchema: DockerInstallInputSchema,
@@ -14229,7 +14265,7 @@ var DockerRunContainerOutputSchema = z.object({
   containerName: z.string().optional(),
   error: z.string().optional()
 });
-async function run101(context) {
+async function run97(context) {
   const { params, exec, info, error: logError2 } = context;
   if (!params.image) {
     const message = "Docker image is required.";
@@ -14270,7 +14306,7 @@ async function run101(context) {
     containerName: params.name
   };
 }
-var run_container_default = task(run101, {
+var run_container_default = task(run97, {
   description: "Runs a Docker container and returns its output (attached).",
   inputSchema: DockerRunContainerInputSchema,
   outputSchema: DockerRunContainerOutputSchema
@@ -14287,7 +14323,7 @@ var DockerRunDetachedOutputSchema = z.object({
   containerName: z.string().optional(),
   error: z.string().optional()
 });
-async function run102(context) {
+async function run98(context) {
   const { params, exec, info, error: logError2 } = context;
   if (!params.image) {
     const message = "Docker image is required.";
@@ -14327,7 +14363,7 @@ async function run102(context) {
     containerName: params.name
   };
 }
-var run_container_detached_default = task(run102, {
+var run_container_detached_default = task(run98, {
   description: "Runs a Docker container in detached mode and returns its metadata.",
   inputSchema: DockerRunDetachedInputSchema,
   outputSchema: DockerRunDetachedOutputSchema
@@ -14386,7 +14422,7 @@ var ProcessListOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run103(context) {
+async function run99(context) {
   const { params, exec, debug, error } = context;
   const { user, command, limit, sort, reverse } = params;
   try {
@@ -14472,7 +14508,7 @@ async function run103(context) {
     return { success: false, error: errorMsg };
   }
 }
-var list_default8 = task(run103, {
+var list_default8 = task(run99, {
   name: "list",
   description: "Lists processes on the system.",
   inputSchema: ProcessListInputSchema,
@@ -14518,7 +14554,7 @@ var ProcessSearchOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run104(context) {
+async function run100(context) {
   const { params, exec, debug, error } = context;
   const { name, user, pid, ppid, args, state, regex = false, ignoreCase = false, limit } = params;
   debug(`Searching processes with params: ${JSON.stringify(params)}`);
@@ -14632,7 +14668,7 @@ function filterProcesses(processes, filters) {
     return true;
   });
 }
-var search_default6 = task(run104, {
+var search_default6 = task(run100, {
   name: "search",
   description: "Search for processes matching specified criteria.",
   inputSchema: ProcessSearchInputSchema,
@@ -14660,7 +14696,7 @@ var ProcessKillOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run105(context) {
+async function run101(context) {
   const { params, exec, debug, error } = context;
   const { pid, user, command, signal = "TERM", force = false, sudo = false } = params;
   try {
@@ -14748,7 +14784,7 @@ async function run105(context) {
     return { success: false, error: errorMsg };
   }
 }
-var kill_default = task(run105, {
+var kill_default = task(run101, {
   name: "kill",
   description: "Kills processes matching specified criteria. Requires at least one filtering parameter (pid, user, or command) to prevent accidental killing of all processes.",
   inputSchema: ProcessKillInputSchema,
@@ -14769,7 +14805,7 @@ var ProcessSignalOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run106(context) {
+async function run102(context) {
   const { params, exec, debug, error } = context;
   const { pid, signal = "TERM", sudo = false } = params;
   if (!pid || pid <= 0) {
@@ -14792,7 +14828,7 @@ async function run106(context) {
     return { success: false, error: errorMsg };
   }
 }
-var signal_default = task(run106, {
+var signal_default = task(run102, {
   name: "signal",
   description: "Sends a signal to a process.",
   inputSchema: ProcessSignalInputSchema,
@@ -14828,7 +14864,7 @@ var ProcessInfoOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run107(context) {
+async function run103(context) {
   const { params, exec, debug, error } = context;
   const { pid } = params;
   if (!pid || pid <= 0) {
@@ -14904,7 +14940,7 @@ async function run107(context) {
     return { success: false, error: errorMsg };
   }
 }
-var info_default7 = task(run107, {
+var info_default7 = task(run103, {
   name: "info",
   description: "Gets detailed information about a specific process.",
   inputSchema: ProcessInfoInputSchema,
@@ -14968,7 +15004,7 @@ var ProcessTopOutputSchema = z.object({
     timestamp: z.string()
   })
 );
-async function run108(context) {
+async function run104(context) {
   const { params, exec, debug, error } = context;
   const {
     limit = 10,
@@ -15130,7 +15166,7 @@ function sortProcesses(processes, sort) {
     }
   });
 }
-var top_default = task(run108, {
+var top_default = task(run104, {
   name: "top",
   description: "Get top processes with system information.",
   inputSchema: ProcessTopInputSchema,
@@ -15194,7 +15230,7 @@ var ProcessStatsOutputSchema = z.object({
     timestamp: z.string()
   })
 );
-async function run109(context) {
+async function run105(context) {
   const { params, exec, debug, error } = context;
   const { includeUsers = true, includeStates = true, includeCommands = false, commandLimit = 10 } = params;
   debug(`Getting process statistics with params: ${JSON.stringify(params)}`);
@@ -15372,7 +15408,7 @@ function calculateCommandStats(processes, limit) {
   }
   return Array.from(commandMap.values()).sort((a, b) => b.cpu - a.cpu).slice(0, limit);
 }
-var stats_default = task(run109, {
+var stats_default = task(run105, {
   name: "stats",
   description: "Get system-wide process statistics.",
   inputSchema: ProcessStatsInputSchema,
@@ -15407,7 +15443,7 @@ var ProcessChildrenOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run110(context) {
+async function run106(context) {
   const { params, exec, debug, error } = context;
   const { pid, recursive = false, maxDepth } = params;
   debug(`Getting children for process ${pid} with params: ${JSON.stringify(params)}`);
@@ -15492,7 +15528,7 @@ async function getDescendants(exec, parentPid, currentDepth, maxDepth) {
   }
   return allDescendants;
 }
-var children_default = task(run110, {
+var children_default = task(run106, {
   name: "children",
   description: "Get child processes of a given PID.",
   inputSchema: ProcessChildrenInputSchema,
@@ -15525,7 +15561,7 @@ var RebootOutputSchema = z.object({
   error: z.string().optional(),
   status: z.string()
 });
-async function run111(context) {
+async function run107(context) {
   const { params, info, warn, exec } = context;
   const time = params.time || "now";
   const sudo = params.sudo ?? true;
@@ -15558,7 +15594,7 @@ stderr: ${stderr}`
     };
   }
 }
-var reboot_default = task(run111, {
+var reboot_default = task(run107, {
   description: "Reboots a system",
   inputSchema: RebootInputSchema,
   outputSchema: RebootOutputSchema
@@ -15578,7 +15614,7 @@ var ShutdownOutputSchema = z.object({
   error: z.string().optional(),
   status: z.string()
 });
-async function run112(context) {
+async function run108(context) {
   const { params, info, warn, exec } = context;
   const time = params.time || "now";
   const sudo = params.sudo ?? true;
@@ -15610,7 +15646,7 @@ stderr: ${stderr}`
     };
   }
 }
-var shutdown_default = task(run112, {
+var shutdown_default = task(run108, {
   description: "Shuts down a system",
   inputSchema: ShutdownInputSchema,
   outputSchema: ShutdownOutputSchema
@@ -15631,7 +15667,7 @@ var RebootIfNeededOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run113(context) {
+async function run109(context) {
   const { params, run: runTask, exec, error, info, warn } = context;
   const delayInSeconds = Math.max(1, params.delay ?? 1);
   const message = params.message ?? "Reboot is required. Initiating reboot sequence.";
@@ -15661,7 +15697,7 @@ ${stderr}`;
   }
   return { rebooting: true, success: true };
 }
-var reboot_if_needed_default = task(run113, {
+var reboot_if_needed_default = task(run109, {
   name: "reboot_if_needed",
   description: "Reboot if needed.",
   inputSchema: RebootIfNeededInputSchema,
@@ -15678,7 +15714,7 @@ var SystemUptimeOutputSchema = z.object({
   days: z.number().optional(),
   error: z.string().optional()
 });
-async function run114(context) {
+async function run110(context) {
   const { params, exec, error } = context;
   const sudo = params.sudo ?? false;
   const { success, stdout, stderr } = await exec(["cat", "/proc/uptime"], { sudo });
@@ -15697,7 +15733,7 @@ async function run114(context) {
     days: Math.floor(uptimeSeconds / 86400)
   };
 }
-var uptime_default = task(run114, {
+var uptime_default = task(run110, {
   name: "uptime",
   description: "Report system uptime.",
   inputSchema: SystemUptimeInputSchema,
@@ -15722,7 +15758,7 @@ var SystemDatetimeOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run115(context) {
+async function run111(context) {
   const { params, exec } = context;
   const sudo = params.sudo ?? false;
   const isoResult = await exec(["date", "--iso-8601=seconds"], { sudo }).catch((error) => error);
@@ -15743,7 +15779,7 @@ async function run115(context) {
     timezone
   };
 }
-var datetime_default = task(run115, {
+var datetime_default = task(run111, {
   name: "datetime",
   description: "Report system time and timezone.",
   inputSchema: SystemDatetimeInputSchema,
@@ -15770,7 +15806,7 @@ var SystemHardwareOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run116(context) {
+async function run112(context) {
   const { params, exec } = context;
   const sudo = params.sudo ?? false;
   const archResult = await exec(["uname", "-m"], { sudo }).catch((error) => error);
@@ -15797,7 +15833,7 @@ async function run116(context) {
     memTotalKb: Number.isFinite(memTotalKb ?? NaN) ? memTotalKb : void 0
   };
 }
-var hardware_default = task(run116, {
+var hardware_default = task(run112, {
   name: "hardware",
   description: "Report CPU and memory details.",
   inputSchema: SystemHardwareInputSchema,
@@ -15829,7 +15865,7 @@ var SystemdDisableOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run117(context) {
+async function run113(context) {
   const { params, exec, error } = context;
   const { service, sudo = false } = params;
   if (!service) {
@@ -15852,7 +15888,7 @@ async function run117(context) {
     };
   }
 }
-var disable_default = task(run117, {
+var disable_default = task(run113, {
   name: "disable",
   description: "Systemd disable.",
   inputSchema: SystemdDisableInputSchema,
@@ -15872,7 +15908,7 @@ var SystemdEnableOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run118(context) {
+async function run114(context) {
   const { params, exec, error } = context;
   const { service, sudo = false } = params;
   if (!service) {
@@ -15895,7 +15931,7 @@ async function run118(context) {
     };
   }
 }
-var enable_default = task(run118, {
+var enable_default = task(run114, {
   name: "enable",
   description: "Systemd enable.",
   inputSchema: SystemdEnableInputSchema,
@@ -15915,7 +15951,7 @@ var SystemdRestartOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run119(context) {
+async function run115(context) {
   const { params, exec, error } = context;
   const { service, sudo = false } = params;
   if (!service) {
@@ -15942,7 +15978,7 @@ async function run119(context) {
     };
   }
 }
-var restart_default = task(run119, {
+var restart_default = task(run115, {
   name: "restart",
   description: "Systemd restart.",
   inputSchema: SystemdRestartInputSchema,
@@ -15962,7 +15998,7 @@ var SystemdStartOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run120(context) {
+async function run116(context) {
   const { params, exec, error } = context;
   const { service, sudo = false } = params;
   if (!service) {
@@ -15985,7 +16021,7 @@ async function run120(context) {
     };
   }
 }
-var start_default = task(run120, {
+var start_default = task(run116, {
   name: "start",
   description: "Systemd start.",
   inputSchema: SystemdStartInputSchema,
@@ -16005,7 +16041,7 @@ var SystemdStopOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run121(context) {
+async function run117(context) {
   const { params, exec, error } = context;
   const { service, sudo = false } = params;
   if (!service) {
@@ -16032,7 +16068,7 @@ async function run121(context) {
     };
   }
 }
-var stop_default = task(run121, {
+var stop_default = task(run117, {
   name: "stop",
   description: "Systemd stop.",
   inputSchema: SystemdStopInputSchema,
@@ -16052,7 +16088,7 @@ var SystemdReloadOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run122(context) {
+async function run118(context) {
   const { params, exec, error } = context;
   const { service, sudo = false } = params;
   if (!service) {
@@ -16073,7 +16109,7 @@ async function run122(context) {
     };
   }
 }
-var reload_default = task(run122, {
+var reload_default = task(run118, {
   name: "reload",
   description: "Reloads a systemd service (e.g., re-reads configuration without full restart).",
   inputSchema: SystemdReloadInputSchema,
@@ -16095,7 +16131,7 @@ var SystemdStatusOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run123(context) {
+async function run119(context) {
   const { params, exec, error } = context;
   const { service, sudo = false } = params;
   if (!service) {
@@ -16118,7 +16154,7 @@ async function run123(context) {
     };
   }
 }
-var status_default = task(run123, {
+var status_default = task(run119, {
   name: "status",
   description: "Checks systemd service status.",
   inputSchema: SystemdStatusInputSchema,
@@ -16148,7 +16184,7 @@ var TemplateWriteOutputSchema = z.object({
   path: z.string()
 });
 async function runFn3(context) {
-  const { params, warn, error, debug, run: run253, file, exec } = context;
+  const { params, warn, error, debug, run: run249, file, exec } = context;
   const { template, template_file, variables, to, mode, owner, group, sudo } = params;
   let templateContent = template;
   if (template && template_file) {
@@ -16203,7 +16239,7 @@ EOF`;
     debug(`Setting mode ${mode} for ${outputPath}`);
     try {
       const chmodParams = { path: outputPath, mode, sudo };
-      const chmodResult = await run253(chmod_default(chmodParams));
+      const chmodResult = await run249(chmod_default(chmodParams));
       if (chmodResult instanceof Error) {
         error(`Error setting mode for ${outputPath}: ${chmodResult.message}`);
         overallSuccess = false;
@@ -16229,7 +16265,7 @@ EOF`;
       if (group) {
         chownTaskParams.group = group;
       }
-      const chownResult = await run253(chown_default(chownTaskParams));
+      const chownResult = await run249(chown_default(chownTaskParams));
       if (chownResult instanceof Error) {
         error(`Error setting owner/group for ${outputPath}: ${chownResult.message}`);
         overallSuccess = false;
@@ -16289,7 +16325,7 @@ var UfwAllowOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run124(context) {
+async function run120(context) {
   const { params, exec, info } = context;
   const { port, proto = "tcp", from } = params;
   if (!port) {
@@ -16320,7 +16356,7 @@ async function run124(context) {
     return { success: false, error };
   }
 }
-var allow_default = task(run124, {
+var allow_default = task(run120, {
   description: "Allows a port through UFW firewall.",
   inputSchema: UfwAllowInputSchema,
   outputSchema: UfwAllowOutputSchema
@@ -16341,7 +16377,7 @@ var UfwDenyOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run125(context) {
+async function run121(context) {
   const { params, exec, error, info } = context;
   const { port, proto = "tcp", from } = params;
   if (!port) {
@@ -16372,7 +16408,7 @@ async function run125(context) {
     };
   }
 }
-var deny_default = task(run125, {
+var deny_default = task(run121, {
   name: "deny",
   description: "Ufw deny.",
   inputSchema: UfwDenyInputSchema,
@@ -16391,7 +16427,7 @@ var UfwDeleteOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run126(context) {
+async function run122(context) {
   const { params, exec, error } = context;
   const { rule_number } = params;
   if (!rule_number || rule_number <= 0) {
@@ -16413,7 +16449,7 @@ async function run126(context) {
     };
   }
 }
-var delete_default4 = task(run126, {
+var delete_default4 = task(run122, {
   name: "delete",
   description: "Ufw delete.",
   inputSchema: UfwDeleteInputSchema,
@@ -16426,7 +16462,7 @@ var UfwDisableOutputSchema = z.object({
   success: z.boolean(),
   error: z.string().optional()
 });
-async function run127(context) {
+async function run123(context) {
   const { exec, error } = context;
   try {
     const result = await exec(["ufw", "disable"], { sudo: true });
@@ -16442,7 +16478,7 @@ async function run127(context) {
     return { success: false, error: errorMsg };
   }
 }
-var disable_default2 = task(run127, {
+var disable_default2 = task(run123, {
   description: "Disables UFW firewall.",
   inputSchema: UfwDisableInputSchema,
   outputSchema: UfwDisableOutputSchema
@@ -16454,7 +16490,7 @@ var UfwEnableOutputSchema = z.object({
   success: z.boolean(),
   error: z.string().optional()
 });
-async function run128(context) {
+async function run124(context) {
   const { exec, error } = context;
   try {
     const result = await exec(["ufw", "--force", "enable"], { sudo: true });
@@ -16470,7 +16506,7 @@ async function run128(context) {
     return { success: false, error: errorMsg };
   }
 }
-var enable_default2 = task(run128, {
+var enable_default2 = task(run124, {
   description: "Enables UFW firewall.",
   inputSchema: UfwEnableInputSchema,
   outputSchema: UfwEnableOutputSchema
@@ -16486,7 +16522,7 @@ var UfwInstallOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run129(context) {
+async function run125(context) {
   const { run: runTask, error } = context;
   try {
     const installResult = await runTask(install_default5({ package: "ufw", sudo: true }));
@@ -16505,7 +16541,7 @@ async function run129(context) {
     };
   }
 }
-var install_default7 = task(run129, {
+var install_default7 = task(run125, {
   name: "install",
   description: "Ufw install.",
   inputSchema: UfwInstallInputSchema,
@@ -16525,7 +16561,7 @@ var UfwLoggingOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run130(context) {
+async function run126(context) {
   const { params, exec, log } = context;
   const level = params.level || "on";
   try {
@@ -16542,7 +16578,7 @@ async function run130(context) {
     return { success: false, error };
   }
 }
-var logging_default = task(run130, {
+var logging_default = task(run126, {
   description: "Configures UFW logging",
   inputSchema: UfwLoggingInputSchema,
   outputSchema: UfwLoggingOutputSchema
@@ -16558,7 +16594,7 @@ var UfwReloadOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run131(context) {
+async function run127(context) {
   const { exec, error } = context;
   try {
     const { success } = await exec(["sudo", "ufw", "reload"], { sudo: true });
@@ -16570,7 +16606,7 @@ async function run131(context) {
     };
   }
 }
-var reload_default2 = task(run131, {
+var reload_default2 = task(run127, {
   name: "reload",
   description: "Ufw reload.",
   inputSchema: UfwReloadInputSchema,
@@ -16588,7 +16624,7 @@ var UfwResetOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run132(context) {
+async function run128(context) {
   const { exec, error, info } = context;
   try {
     const command = ["ufw", "--force", "reset"];
@@ -16609,7 +16645,7 @@ async function run132(context) {
     return { success: false, error: errorMsg };
   }
 }
-var reset_default = task(run132, {
+var reset_default = task(run128, {
   name: "reset",
   description: "Resets UFW firewall to default state.",
   inputSchema: UfwResetInputSchema,
@@ -16632,7 +16668,7 @@ var UfwStatusOutputSchema = z.object({
   rules: z.array(UfwRuleSchema).optional(),
   error: z.string().optional()
 });
-async function run133(context) {
+async function run129(context) {
   const { exec, error } = context;
   try {
     const result = await exec(["ufw", "status", "numbered"], { sudo: true });
@@ -16687,7 +16723,7 @@ async function run133(context) {
     return { success: false, error: errorMsg };
   }
 }
-var status_default2 = task(run133, {
+var status_default2 = task(run129, {
   description: "Gets UFW firewall status with numbered rules.",
   inputSchema: UfwStatusInputSchema,
   outputSchema: UfwStatusOutputSchema
@@ -16726,7 +16762,7 @@ var AddGroupsOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run134(context) {
+async function run130(context) {
   const { params, exec } = context;
   const { user, groups, sudo = true } = params;
   const normalizedGroups = Array.isArray(groups) ? groups : typeof groups === "string" ? groups.split(",").map((group) => group.trim()).filter(Boolean) : [];
@@ -16741,7 +16777,7 @@ async function run134(context) {
     error: success ? void 0 : stderr || stdout
   };
 }
-var add_groups_default = task(run134, {
+var add_groups_default = task(run130, {
   name: "add_groups",
   description: "User add groups.",
   inputSchema: AddGroupsInputSchema,
@@ -16761,7 +16797,7 @@ var GetGidOutputSchema = z.object({
     gid: z.string().optional()
   })
 );
-async function run135(context) {
+async function run131(context) {
   const { params, exec } = context;
   const { user } = params;
   const command = ["id", "-g", user].filter(Boolean).join(" ");
@@ -16771,7 +16807,7 @@ async function run135(context) {
     gid: gid.trim()
   };
 }
-var get_gid_default = task(run135, {
+var get_gid_default = task(run131, {
   name: "get_gid",
   description: "User get gid.",
   inputSchema: GetGidInputSchema,
@@ -16791,7 +16827,7 @@ var GetGroupsOutputSchema = z.object({
     groups: z.array(z.string()).optional()
   })
 );
-async function run136(context) {
+async function run132(context) {
   const { params, exec } = context;
   const { user } = params;
   const command = ["groups", user].filter(Boolean).join(" ");
@@ -16808,7 +16844,7 @@ async function run136(context) {
     groups
   };
 }
-var get_groups_default = task(run136, {
+var get_groups_default = task(run132, {
   name: "get_groups",
   description: "User get groups.",
   inputSchema: GetGroupsInputSchema,
@@ -16828,7 +16864,7 @@ var GetUidOutputSchema = z.object({
     uid: z.string().optional()
   })
 );
-async function run137(context) {
+async function run133(context) {
   const { params, exec } = context;
   const { user } = params;
   const command = ["id", "-u", user].filter(Boolean).join(" ");
@@ -16838,7 +16874,7 @@ async function run137(context) {
     uid: uid.trim()
   };
 }
-var get_uid_default = task(run137, {
+var get_uid_default = task(run133, {
   name: "get_uid",
   description: "User get uid.",
   inputSchema: GetUidInputSchema,
@@ -16859,7 +16895,7 @@ var SetUserGroupsOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run138(context) {
+async function run134(context) {
   const { params, exec } = context;
   const { user, groups, sudo = true } = params;
   const normalizedGroups = Array.isArray(groups) ? groups : typeof groups === "string" ? groups.split(",").map((group) => group.trim()).filter(Boolean) : [];
@@ -16874,7 +16910,7 @@ async function run138(context) {
     error: success ? void 0 : stderr || stdout
   };
 }
-var set_groups_default = task(run138, {
+var set_groups_default = task(run134, {
   name: "set_groups",
   description: "User set groups.",
   inputSchema: SetUserGroupsInputSchema,
@@ -16895,7 +16931,7 @@ var SetUserShellOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run139(context) {
+async function run135(context) {
   const { params, exec } = context;
   const { user, shell, sudo = true } = params;
   const command = [sudo ? "sudo" : "", "usermod", "-s", shell, user].filter(Boolean).join(" ");
@@ -16905,7 +16941,7 @@ async function run139(context) {
     error: success ? void 0 : stderr || stdout
   };
 }
-var set_shell_default = task(run139, {
+var set_shell_default = task(run135, {
   name: "set_shell",
   description: "User set shell.",
   inputSchema: SetUserShellInputSchema,
@@ -16924,8 +16960,8 @@ var UserDeleteOutputSchema = z.object({
   success: z.boolean(),
   error: z.string().optional()
 });
-async function run140(context) {
-  const { params, debug, exec, run: run253, error } = context;
+async function run136(context) {
+  const { params, debug, exec, run: run249, error } = context;
   const { user, remove: remove4 = false, sudo = true } = params;
   if (!user) {
     error('Required parameter "user" is missing');
@@ -16935,7 +16971,7 @@ async function run140(context) {
     };
   }
   try {
-    const { exists: userExists } = await run253(exists_default4({ user }));
+    const { exists: userExists } = await run249(exists_default4({ user }));
     if (!userExists) {
       debug(`User '${user}' does not exist, considering task successful (idempotent).`);
       return { success: true };
@@ -16963,7 +16999,7 @@ async function run140(context) {
     };
   }
 }
-var delete_default5 = task(run140, {
+var delete_default5 = task(run136, {
   description: "Deletes a user from the system idempotently",
   inputSchema: UserDeleteInputSchema,
   outputSchema: UserDeleteOutputSchema
@@ -16993,7 +17029,7 @@ var ModifyUserOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run141(context) {
+async function run137(context) {
   const { params, exec, run: runTask, error } = context;
   const {
     user,
@@ -17052,7 +17088,7 @@ async function run141(context) {
     };
   }
 }
-var modify_default2 = task(run141, {
+var modify_default2 = task(run137, {
   name: "modify",
   description: "Modify an existing user account.",
   inputSchema: ModifyUserInputSchema,
@@ -17337,7 +17373,7 @@ var XcpngAttachVdiResultSchema = z.object({
   plugged: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run142(context) {
+async function run138(context) {
   const { params, error, debug } = context;
   const { vm_uuid, vdi_uuid, device = "0", mode = "RW", bootable: rawBootable = false } = params;
   if (!vm_uuid) {
@@ -17396,7 +17432,7 @@ async function run142(context) {
     plugged: true
   };
 }
-var attach_vdi_default = task(run142, {
+var attach_vdi_default = task(run138, {
   inputSchema: XcpngAttachVdiParamsSchema,
   outputSchema: XcpngAttachVdiResultSchema,
   description: "Attaches an existing virtual disk image to a VM and plugs it into the guest."
@@ -17460,7 +17496,7 @@ var XcpngCreateVdiResultSchema = z.object({
   command: z.string().optional(),
   error: z.string().optional()
 });
-async function run143(context) {
+async function run139(context) {
   const { params, error } = context;
   const { name_label, sr_uuid, size_bytes, size_mb, size_gb, description, type = "user", shareable = false } = params;
   if (!name_label) {
@@ -17513,7 +17549,7 @@ async function run143(context) {
     command: result.command
   };
 }
-var create_vdi_default = task(run143, {
+var create_vdi_default = task(run139, {
   inputSchema: XcpngCreateVdiParamsSchema,
   outputSchema: XcpngCreateVdiResultSchema,
   description: "Creates a new virtual disk image on the specified XCP-ng storage repository."
@@ -17528,7 +17564,7 @@ var XcpngListSrParamsResultSchema = z.object({
   items: z.any().optional(),
   error: z.string().optional()
 });
-async function run144(context) {
+async function run140(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "sr-param-list", filters);
   if (!result.success) {
@@ -17542,7 +17578,7 @@ async function run144(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_sr_params_default = task(run144, {
+var list_sr_params_default = task(run140, {
   inputSchema: XcpngListSrParamsParamsSchema,
   outputSchema: XcpngListSrParamsResultSchema,
   description: "Lists parameters for storage repositories (SRs) on an XCP-ng host."
@@ -17557,7 +17593,7 @@ var XcpngListStorageRepositoriesResultSchema = z.object({
   items: z.array(z.any()).optional(),
   error: z.string().optional()
 });
-async function run145(context) {
+async function run141(context) {
   const { params } = context;
   const filters = normalizeFilterArgs(params?.filters);
   const result = await runXeCommand(context, "sr-list", filters);
@@ -17606,7 +17642,7 @@ async function run145(context) {
     items: enrichedItems
   };
 }
-var list_storage_repositories_default = task(run145, {
+var list_storage_repositories_default = task(run141, {
   inputSchema: XcpngListStorageRepositoriesParamsSchema,
   outputSchema: XcpngListStorageRepositoriesResultSchema,
   description: "Lists storage repositories on an XCP-ng host."
@@ -17629,7 +17665,7 @@ var XcpngFindStorageRepositoryResultSchema = z.object({
   multiple: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run146(context) {
+async function run142(context) {
   const params = context.params ?? {};
   const {
     name_label: nameLabel,
@@ -17749,7 +17785,7 @@ async function runListStorageRepositories(context, params) {
     })
   );
 }
-var find_storage_repository_default = task(run146, {
+var find_storage_repository_default = task(run142, {
   inputSchema: XcpngFindStorageRepositoryParamsSchema,
   outputSchema: XcpngFindStorageRepositoryResultSchema,
   description: "Finds a single storage repository on an XCP-ng host, optionally allowing multiple matches."
@@ -17782,7 +17818,7 @@ var XcpngAddDiskResultSchema = z.object({
   plugged: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run147(context) {
+async function run143(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuid,
@@ -17915,7 +17951,7 @@ async function destroyVdi(context, vdiUuid, appliedCommands) {
     context.warn(`Failed to clean up VDI ${vdiUuid}: ${xeErrorMessage(result, "unknown error")}`);
   }
 }
-var add_disk_default = task(run147, {
+var add_disk_default = task(run143, {
   inputSchema: XcpngAddDiskParamsSchema,
   outputSchema: XcpngAddDiskResultSchema,
   description: "Creates a VDI and attaches it to a VM on XCP-ng."
@@ -17934,7 +17970,7 @@ var XcpngAttachIsoResultSchema = z.object({
   plugged: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run148(context) {
+async function run144(context) {
   const { params, error, debug } = context;
   const { vm_uuid, iso_vdi_uuid, device, eject_before_insert = true } = params;
   if (!vm_uuid) {
@@ -18027,7 +18063,7 @@ async function run148(context) {
     plugged
   };
 }
-var attach_iso_default = task(run148, {
+var attach_iso_default = task(run144, {
   inputSchema: XcpngAttachIsoParamsSchema,
   outputSchema: XcpngAttachIsoResultSchema,
   description: "Attaches an ISO image to a VM by invoking xe vm-cd-insert, ejecting existing media if requested."
@@ -18048,7 +18084,7 @@ var XcpngAttachNetworkInterfaceResultSchema = z.object({
   plugged: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run149(context) {
+async function run145(context) {
   const { params, error, debug } = context;
   const { vm_uuid, network_uuid, device = "0", mac_address, mtu } = params;
   if (!vm_uuid) {
@@ -18113,7 +18149,7 @@ async function run149(context) {
     plugged: true
   };
 }
-var attach_network_interface_default = task(run149, {
+var attach_network_interface_default = task(run145, {
   inputSchema: XcpngAttachNetworkInterfaceParamsSchema,
   outputSchema: XcpngAttachNetworkInterfaceResultSchema,
   description: "Creates and plugs a virtual network interface for a VM on XCP-ng."
@@ -18128,7 +18164,7 @@ var XcpngListTemplateParamsResultSchema = z.object({
   items: z.any().optional(),
   error: z.string().optional()
 });
-async function run150(context) {
+async function run146(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "template-param-list", filters);
   if (!result.success) {
@@ -18142,7 +18178,7 @@ async function run150(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_template_params_default = task(run150, {
+var list_template_params_default = task(run146, {
   inputSchema: XcpngListTemplateParamsParamsSchema,
   outputSchema: XcpngListTemplateParamsResultSchema,
   description: "Lists parameters for templates on an XCP-ng host."
@@ -18157,7 +18193,7 @@ var XcpngListTemplatesResultSchema = z.object({
   items: z.array(z.any()).optional(),
   error: z.string().optional()
 });
-async function run151(context) {
+async function run147(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "template-list", filters);
   if (!result.success) {
@@ -18207,7 +18243,7 @@ async function run151(context) {
     items: enriched
   };
 }
-var list_templates_default = task(run151, {
+var list_templates_default = task(run147, {
   inputSchema: XcpngListTemplatesParamsSchema,
   outputSchema: XcpngListTemplatesResultSchema,
   description: "Lists VM templates available on the XCP-ng host."
@@ -18228,7 +18264,7 @@ var XcpngFindTemplateResultSchema = z.object({
   multiple: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run152(context) {
+async function run148(context) {
   const params = context.params ?? {};
   const {
     name_label: nameLabel,
@@ -18326,7 +18362,7 @@ async function runListTemplates(context, params) {
     })
   );
 }
-var find_template_default = task(run152, {
+var find_template_default = task(run148, {
   inputSchema: XcpngFindTemplateParamsSchema,
   outputSchema: XcpngFindTemplateResultSchema,
   description: "Finds a single template on an XCP-ng host, optionally allowing multiple matches."
@@ -18351,7 +18387,7 @@ var XcpngCloneTemplateResultSchema = z.object({
   alreadyExists: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run153(context) {
+async function run149(context) {
   const { params, error } = context;
   const {
     source_template_uuid: sourceTemplateUuidParam,
@@ -18471,7 +18507,7 @@ async function run153(context) {
     appliedCommands
   };
 }
-var clone_template_default = task(run153, {
+var clone_template_default = task(run149, {
   inputSchema: XcpngCloneTemplateParamsSchema,
   outputSchema: XcpngCloneTemplateResultSchema,
   description: "Clones an existing XCP-ng template to a new template name."
@@ -18486,7 +18522,7 @@ var XcpngListHostsResultSchema = z.object({
   items: z.any().optional(),
   error: z.string().optional()
 });
-async function run154(context) {
+async function run150(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "host-list", filters);
   if (!result.success) {
@@ -18500,7 +18536,7 @@ async function run154(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_hosts_default = task(run154, {
+var list_hosts_default = task(run150, {
   inputSchema: XcpngListHostsParamsSchema,
   outputSchema: XcpngListHostsResultSchema,
   description: "Lists hosts in an XCP-ng pool, returning parsed xe host-list output."
@@ -18521,7 +18557,7 @@ var XcpngFindHostResultSchema = z.object({
   multiple: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run155(context) {
+async function run151(context) {
   const params = context.params ?? {};
   const {
     name_label: nameLabel,
@@ -18621,7 +18657,7 @@ async function runListHosts(context, params) {
     })
   );
 }
-var find_host_default = task(run155, {
+var find_host_default = task(run151, {
   inputSchema: XcpngFindHostParamsSchema,
   outputSchema: XcpngFindHostResultSchema,
   description: "Finds a single host on an XCP-ng pool, optionally allowing multiple matches."
@@ -18636,7 +18672,7 @@ var XcpngListNetworkParamsResultSchema = z.object({
   items: z.any().optional(),
   error: z.string().optional()
 });
-async function run156(context) {
+async function run152(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "network-param-list", filters);
   if (!result.success) {
@@ -18650,7 +18686,7 @@ async function run156(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_network_params_default = task(run156, {
+var list_network_params_default = task(run152, {
   inputSchema: XcpngListNetworkParamsParamsSchema,
   outputSchema: XcpngListNetworkParamsResultSchema,
   description: "Lists parameters for networks on an XCP-ng host."
@@ -18665,7 +18701,7 @@ var XcpngListNetworksResultSchema = z.object({
   items: z.array(z.any()).optional(),
   error: z.string().optional()
 });
-async function run157(context) {
+async function run153(context) {
   const { params } = context;
   const filters = normalizeFilterArgs(params?.filters);
   const result = await runXeCommand(context, "network-list", filters);
@@ -18714,7 +18750,7 @@ async function run157(context) {
     items: enrichedItems
   };
 }
-var list_networks_default = task(run157, {
+var list_networks_default = task(run153, {
   inputSchema: XcpngListNetworksParamsSchema,
   outputSchema: XcpngListNetworksResultSchema,
   description: "Lists networks on an XCP-ng host."
@@ -18735,7 +18771,7 @@ var XcpngFindNetworkResultSchema = z.object({
   multiple: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run158(context) {
+async function run154(context) {
   const params = context.params ?? {};
   const {
     name_label: nameLabel,
@@ -18826,7 +18862,7 @@ function buildMultipleMessage4(nameLabel, uuid, count) {
   const detail = identifiers.length > 0 ? identifiers.join(", ") : "specified criteria";
   return `Multiple networks (${count}) matched ${detail}; refine filters or set allow_multiple:true.`;
 }
-var find_network_default = task(run158, {
+var find_network_default = task(run154, {
   inputSchema: XcpngFindNetworkParamsSchema,
   outputSchema: XcpngFindNetworkResultSchema,
   description: "Finds a single network on an XCP-ng host, optionally allowing multiple matches."
@@ -18853,7 +18889,7 @@ var XcpngCreateBondResultSchema = z.object({
   appliedCommands: z.array(z.string()),
   error: z.string().optional()
 });
-async function run159(context) {
+async function run155(context) {
   const { params, error } = context;
   const {
     host_uuid: hostUuidParam,
@@ -18975,7 +19011,7 @@ async function run159(context) {
     appliedCommands
   };
 }
-var create_bond_default = task(run159, {
+var create_bond_default = task(run155, {
   inputSchema: XcpngCreateBondParamsSchema,
   outputSchema: XcpngCreateBondResultSchema,
   description: "Creates a bonded interface on a host, wrapping xe bond-create."
@@ -18990,7 +19026,7 @@ var XcpngListPbdParamsResultSchema = z.object({
   items: z.any().optional(),
   error: z.string().optional()
 });
-async function run160(context) {
+async function run156(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "pbd-param-list", filters);
   if (!result.success) {
@@ -19004,7 +19040,7 @@ async function run160(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_pbd_params_default = task(run160, {
+var list_pbd_params_default = task(run156, {
   inputSchema: XcpngListPbdParamsParamsSchema,
   outputSchema: XcpngListPbdParamsResultSchema,
   description: "Lists parameters for PBDs on an XCP-ng host."
@@ -19019,7 +19055,7 @@ var XcpngListPbdsResultSchema = z.object({
   items: z.array(z.any()).optional(),
   error: z.string().optional()
 });
-async function run161(context) {
+async function run157(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "pbd-list", filters);
   if (!result.success) {
@@ -19067,7 +19103,7 @@ async function run161(context) {
     items: enrichedItems
   };
 }
-var list_pbds_default = task(run161, {
+var list_pbds_default = task(run157, {
   inputSchema: XcpngListPbdsParamsSchema,
   outputSchema: XcpngListPbdsResultSchema,
   description: "Lists storage bindings (PBDs) between hosts and storage repositories."
@@ -19089,7 +19125,7 @@ var XcpngFindPbdResultSchema = z.object({
   multiple: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run162(context) {
+async function run158(context) {
   const params = context.params ?? {};
   const {
     uuid,
@@ -19202,7 +19238,7 @@ async function runListPbds(context, params) {
     })
   );
 }
-var find_pbd_default = task(run162, {
+var find_pbd_default = task(run158, {
   inputSchema: XcpngFindPbdParamsSchema,
   outputSchema: XcpngFindPbdResultSchema,
   description: "Finds a single PBD (host \u2194 SR binding), optionally allowing multiple matches."
@@ -19227,7 +19263,7 @@ var XcpngCreatePbdResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run163(context) {
+async function run159(context) {
   const { params, error } = context;
   const {
     host_uuid: hostUuidParam,
@@ -19344,7 +19380,7 @@ async function run163(context) {
     appliedCommands
   };
 }
-var create_pbd_default = task(run163, {
+var create_pbd_default = task(run159, {
   inputSchema: XcpngCreatePbdParamsSchema,
   outputSchema: XcpngCreatePbdResultSchema,
   description: "Creates a host \u2194 storage repository binding (PBD)."
@@ -19359,7 +19395,7 @@ var XcpngListVmParamsResultSchema = z.object({
   items: z.any().optional(),
   error: z.string().optional()
 });
-async function run164(context) {
+async function run160(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "vm-param-list", filters);
   if (!result.success) {
@@ -19373,7 +19409,7 @@ async function run164(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_vm_params_default = task(run164, {
+var list_vm_params_default = task(run160, {
   inputSchema: XcpngListVmParamsParamsSchema,
   outputSchema: XcpngListVmParamsResultSchema,
   description: "Lists virtual machines (VMs) on an XCP-ng host."
@@ -19389,7 +19425,7 @@ var XcpngListVmsResultSchema = z.object({
   items: z.array(z.any()).optional(),
   error: z.string().optional()
 });
-async function run165(context) {
+async function run161(context) {
   const { params } = context;
   const filters = normalizeFilterArgs(params?.filters);
   const paramsArg = buildParamsArg(params?.params);
@@ -19442,7 +19478,7 @@ async function run165(context) {
     items: enrichedItems
   };
 }
-var list_vms_default = task(run165, {
+var list_vms_default = task(run161, {
   inputSchema: XcpngListVmsParamsSchema,
   outputSchema: XcpngListVmsResultSchema,
   description: "Lists VMs on an XCP-ng host and returns structured metadata."
@@ -19493,7 +19529,7 @@ var XcpngFindVmResultSchema = z.object({
   multiple: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run166(context) {
+async function run162(context) {
   const params = context.params ?? {};
   const {
     name_label: nameLabel,
@@ -19621,7 +19657,7 @@ async function runListVms(context, params) {
     })
   );
 }
-var find_vm_default = task(run166, {
+var find_vm_default = task(run162, {
   inputSchema: XcpngFindVmParamsSchema,
   outputSchema: XcpngFindVmResultSchema,
   description: "Finds a single VM on an XCP-ng host, optionally allowing multiple matches."
@@ -19726,7 +19762,7 @@ var XcpngCreateTemplateResultSchema = z.object({
   powerState: z.string().optional(),
   waitAttempts: z.number().optional()
 });
-async function run167(context) {
+async function run163(context) {
   const { params, error } = context;
   const {
     source_vm_uuid: sourceVmUuidParam,
@@ -19834,7 +19870,7 @@ async function run167(context) {
     waitAttempts: ensureHalted.attempts
   };
 }
-var create_template_default = task(run167, {
+var create_template_default = task(run163, {
   inputSchema: XcpngCreateTemplateParamsSchema,
   outputSchema: XcpngCreateTemplateResultSchema,
   description: "Clones a VM and converts it into an XCP-ng template."
@@ -19861,7 +19897,7 @@ var XcpngCreateVmResultSchema = z.object({
   appliedCommands: z.array(z.string()),
   error: z.string().optional()
 });
-async function run168(context) {
+async function run164(context) {
   const { params, error } = context;
   const {
     name_label,
@@ -19987,7 +20023,7 @@ async function run168(context) {
     appliedCommands
   };
 }
-var create_vm_default = task(run168, {
+var create_vm_default = task(run164, {
   inputSchema: XcpngCreateVmParamsSchema,
   outputSchema: XcpngCreateVmResultSchema,
   description: "Creates a new VM on XCP-ng and optionally applies memory and CPU sizing."
@@ -20002,7 +20038,7 @@ var XcpngListVdiParamsResultSchema = z.object({
   items: z.any().optional(),
   error: z.string().optional()
 });
-async function run169(context) {
+async function run165(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "vdi-param-list", filters);
   if (!result.success) {
@@ -20016,7 +20052,7 @@ async function run169(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_vdi_params_default = task(run169, {
+var list_vdi_params_default = task(run165, {
   inputSchema: XcpngListVdiParamsParamsSchema,
   outputSchema: XcpngListVdiParamsResultSchema,
   description: "Lists virtual disk image parameters (VDI params) on an XCP-ng host."
@@ -20031,7 +20067,7 @@ var XcpngListVdisResultSchema = z.object({
   items: z.array(z.any()).optional(),
   error: z.string().optional()
 });
-async function run170(context) {
+async function run166(context) {
   const { params } = context;
   const filters = normalizeFilterArgs(params?.filters);
   const result = await runXeCommand(context, "vdi-list", filters);
@@ -20082,7 +20118,7 @@ async function run170(context) {
     items: enrichedItems
   };
 }
-var list_vdis_default = task(run170, {
+var list_vdis_default = task(run166, {
   inputSchema: XcpngListVdisParamsSchema,
   outputSchema: XcpngListVdisResultSchema,
   description: "Lists VDIs on an XCP-ng host with optional filtering."
@@ -20104,7 +20140,7 @@ var XcpngFindVdiResultSchema = z.object({
   multiple: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run171(context) {
+async function run167(context) {
   const params = context.params ?? {};
   const {
     name_label: nameLabel,
@@ -20210,7 +20246,7 @@ function buildMultipleMessage7(nameLabel, uuid, srUuid, count) {
   const detail = identifiers.length > 0 ? identifiers.join(", ") : "specified criteria";
   return `Multiple VDIs (${count}) matched ${detail}; refine filters or set allow_multiple:true.`;
 }
-var find_vdi_default = task(run171, {
+var find_vdi_default = task(run167, {
   inputSchema: XcpngFindVdiParamsSchema,
   outputSchema: XcpngFindVdiResultSchema,
   description: "Finds a single VDI on an XCP-ng host, optionally allowing multiple matches."
@@ -20225,7 +20261,7 @@ var XcpngListVbdParamsResultSchema = z.object({
   items: z.any().optional(),
   error: z.string().optional()
 });
-async function run172(context) {
+async function run168(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "vbd-param-list", filters);
   if (!result.success) {
@@ -20239,7 +20275,7 @@ async function run172(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_vbd_params_default = task(run172, {
+var list_vbd_params_default = task(run168, {
   inputSchema: XcpngListVbdParamsParamsSchema,
   outputSchema: XcpngListVbdParamsResultSchema,
   description: "Lists virtual block devices (VBDs) on an XCP-ng host."
@@ -20254,7 +20290,7 @@ var XcpngListVbdsResultSchema = z.object({
   items: z.array(z.any()).optional(),
   error: z.string().optional()
 });
-async function run173(context) {
+async function run169(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "vbd-list", filters);
   if (!result.success) {
@@ -20304,7 +20340,7 @@ async function run173(context) {
     items: enrichedItems
   };
 }
-var list_vbds_default = task(run173, {
+var list_vbds_default = task(run169, {
   inputSchema: XcpngListVbdsParamsSchema,
   outputSchema: XcpngListVbdsResultSchema,
   description: "Lists virtual block devices (VBDs) on an XCP-ng host."
@@ -20321,7 +20357,7 @@ var XcpngListAttachedDisksResultSchema = z.object({
   disks: z.array(z.any()).optional(),
   error: z.string().optional()
 });
-async function run174(context) {
+async function run170(context) {
   const { params, error } = context;
   const { vm_uuid: vmUuid, include_readonly: rawIncludeReadonly } = params ?? {};
   if (!vmUuid) {
@@ -20415,7 +20451,7 @@ async function run174(context) {
     disks
   };
 }
-var list_attached_disks_default = task(run174, {
+var list_attached_disks_default = task(run170, {
   inputSchema: XcpngListAttachedDisksParamsSchema,
   outputSchema: XcpngListAttachedDisksResultSchema,
   description: "Lists VBDs attached to a VM and enriches them with VDI metadata so disks vs CD drives can be distinguished."
@@ -20442,7 +20478,7 @@ var XcpngRemoveDiskResultSchema = z.object({
   appliedCommands: z.array(z.string()),
   error: z.string().optional()
 });
-async function run175(context) {
+async function run171(context) {
   const { params, error } = context;
   const {
     vbd_uuid: vbdUuidParam,
@@ -20630,7 +20666,7 @@ async function waitForVdiRemoval(context, vdiUuid, timeoutMs) {
     await new Promise((resolve) => setTimeout(resolve, 1e3));
   }
 }
-var remove_disk_default = task(run175, {
+var remove_disk_default = task(run171, {
   inputSchema: XcpngRemoveDiskParamsSchema,
   outputSchema: XcpngRemoveDiskResultSchema,
   description: "Detaches a VDI from a VM and optionally destroys the backing disk on XCP-ng."
@@ -20647,7 +20683,7 @@ var XcpngSetBootOrderResultSchema = z.object({
   appliedCommands: z.array(z.string()),
   error: z.string().optional()
 });
-async function run176(context) {
+async function run172(context) {
   const { params, error } = context;
   const { vm_uuid, boot_order, firmware } = params;
   if (!vm_uuid) {
@@ -20711,7 +20747,7 @@ async function run176(context) {
     appliedCommands
   };
 }
-var set_boot_order_default = task(run176, {
+var set_boot_order_default = task(run172, {
   inputSchema: XcpngSetBootOrderParamsSchema,
   outputSchema: XcpngSetBootOrderResultSchema,
   description: "Configures VM boot order and optional firmware mode via xe vm-param-set."
@@ -20764,7 +20800,7 @@ var OTHER_CONFIG_KEYS_TO_REMOVE = [
   "cloud-init-hostname",
   "cloud-init-instance-id"
 ];
-async function run177(context) {
+async function run173(context) {
   if (!context.host) {
     const message = "core.xcpng.create-template-from-vdi must run against a remote XCP-ng host.";
     return {
@@ -21297,7 +21333,7 @@ async function run177(context) {
     steps
   };
 }
-var create_template_from_vdi_default = task(run177, {
+var create_template_from_vdi_default = task(run173, {
   inputSchema: XcpngCreateTemplateFromVdiParamsSchema,
   outputSchema: XcpngCreateTemplateFromVdiResultSchema,
   description: "Creates an XCP-ng template from an existing VDI by staging a VM and converting it."
@@ -21414,7 +21450,7 @@ var XcpngCreateNetworkResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run178(context) {
+async function run174(context) {
   const { params, error } = context;
   const { name_label: nameLabel, description, bridge, mtu, tags, allow_existing: rawAllowExisting } = params ?? {};
   if (!nameLabel) {
@@ -21479,7 +21515,7 @@ async function run178(context) {
     appliedCommands
   };
 }
-var create_network_default = task(run178, {
+var create_network_default = task(run174, {
   inputSchema: XcpngCreateNetworkParamsSchema,
   outputSchema: XcpngCreateNetworkResultSchema,
   description: "Creates a new network on an XCP-ng host (bridge, MTU, and tags optional)."
@@ -21511,7 +21547,7 @@ var XcpngFindOrCreateIsoSrResultSchema = z.object({
   commands: z.array(z.string()),
   error: z.string().optional()
 });
-async function run179(context) {
+async function run175(context) {
   const { params, debug, error: logError2 } = context;
   const {
     name_label: nameLabel,
@@ -21663,7 +21699,7 @@ async function runDirCreate(context, params) {
     })
   );
 }
-var find_or_create_iso_sr_default = task(run179, {
+var find_or_create_iso_sr_default = task(run175, {
   inputSchema: XcpngFindOrCreateIsoSrParamsSchema,
   outputSchema: XcpngFindOrCreateIsoSrResultSchema,
   description: "Finds an ISO storage repository by name, creating it if missing using xe sr-create."
@@ -21706,7 +21742,7 @@ var XcpngCreateConfigDriveResultSchema = z.object({
   steps: z.array(z.any()),
   error: z.string().optional()
 });
-async function run180(context) {
+async function run176(context) {
   if (!context.host) {
     return {
       success: false,
@@ -22225,7 +22261,7 @@ function decodeBase64Field(field, value) {
     };
   }
 }
-var create_config_drive_default = task(run180, {
+var create_config_drive_default = task(run176, {
   inputSchema: XcpngCreateConfigDriveParamsSchema,
   outputSchema: XcpngCreateConfigDriveResultSchema,
   description: "Generates a NoCloud config-drive ISO, stores it in an ISO SR, and returns the associated VDI."
@@ -22249,7 +22285,7 @@ var XcpngConvertTemplateToVmResultSchema = z.object({
   alreadyVm: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run181(context) {
+async function run177(context) {
   const { params, error } = context;
   const {
     template_uuid: templateUuidParam,
@@ -22348,7 +22384,7 @@ async function run181(context) {
     alreadyVm
   };
 }
-var convert_template_to_vm_default = task(run181, {
+var convert_template_to_vm_default = task(run177, {
   inputSchema: XcpngConvertTemplateToVmParamsSchema,
   outputSchema: XcpngConvertTemplateToVmResultSchema,
   description: "Converts an XCP-ng template into a VM by clearing the template flag and optionally renaming it."
@@ -22369,7 +22405,7 @@ var XcpngDestroyIsoSrResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run182(context) {
+async function run178(context) {
   const { params, error } = context;
   const { sr_uuid: srUuidParam, sr_name_label: srName, location, allow_missing: rawAllowMissing } = params ?? {};
   const allowMissing = coerceBoolean(rawAllowMissing, false);
@@ -22535,7 +22571,7 @@ async function detachSrPbds(context, srUuid, allowMissing) {
   }
   return { commands };
 }
-var destroy_iso_sr_default = task(run182, {
+var destroy_iso_sr_default = task(run178, {
   inputSchema: XcpngDestroyIsoSrParamsSchema,
   outputSchema: XcpngDestroyIsoSrResultSchema,
   description: "Destroys an ISO storage repository and optionally removes its backing directory."
@@ -22554,7 +22590,7 @@ var XcpngDestroyBondResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run183(context) {
+async function run179(context) {
   const { params, error } = context;
   const { bond_uuid: bondUuidParam, pif_uuid: pifUuidParam, allow_missing: rawAllowMissing } = params ?? {};
   const allowMissing = coerceBoolean(rawAllowMissing, false);
@@ -22591,7 +22627,7 @@ async function run183(context) {
     appliedCommands
   };
 }
-var destroy_bond_default = task(run183, {
+var destroy_bond_default = task(run179, {
   inputSchema: XcpngDestroyBondParamsSchema,
   outputSchema: XcpngDestroyBondResultSchema,
   description: "Destroys a bonded interface, wrapping xe bond-destroy."
@@ -22613,7 +22649,7 @@ var XcpngCreateSrResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run184(context) {
+async function run180(context) {
   const { params, error } = context;
   const {
     name_label: nameLabel,
@@ -22688,7 +22724,7 @@ async function run184(context) {
     appliedCommands
   };
 }
-var create_sr_default = task(run184, {
+var create_sr_default = task(run180, {
   inputSchema: XcpngCreateSrParamsSchema,
   outputSchema: XcpngCreateSrResultSchema,
   description: "Creates a new storage repository (SR) with the specified device configuration."
@@ -22708,7 +22744,7 @@ var XcpngDestroySrResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run185(context) {
+async function run181(context) {
   const { params, error } = context;
   const {
     sr_uuid: srUuidParam,
@@ -22782,7 +22818,7 @@ async function run185(context) {
     appliedCommands
   };
 }
-var destroy_sr_default = task(run185, {
+var destroy_sr_default = task(run181, {
   inputSchema: XcpngDestroySrParamsSchema,
   outputSchema: XcpngDestroySrResultSchema,
   description: "Destroys a storage repository by UUID or name-label (optionally forcing)."
@@ -22801,7 +22837,7 @@ var XcpngDestroyNetworkResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run186(context) {
+async function run182(context) {
   const { params, error } = context;
   const {
     network_uuid: networkUuidParam,
@@ -22868,7 +22904,7 @@ async function run186(context) {
     appliedCommands
   };
 }
-var destroy_network_default = task(run186, {
+var destroy_network_default = task(run182, {
   inputSchema: XcpngDestroyNetworkParamsSchema,
   outputSchema: XcpngDestroyNetworkResultSchema,
   description: "Destroys an XCP-ng network by UUID or name-label."
@@ -22890,7 +22926,7 @@ var XcpngDestroyPbdResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run187(context) {
+async function run183(context) {
   const { params, error } = context;
   const {
     pbd_uuid: pbdUuidParam,
@@ -22999,7 +23035,7 @@ async function run187(context) {
     appliedCommands
   };
 }
-var destroy_pbd_default = task(run187, {
+var destroy_pbd_default = task(run183, {
   inputSchema: XcpngDestroyPbdParamsSchema,
   outputSchema: XcpngDestroyPbdResultSchema,
   description: "Destroys a host \u2194 storage repository binding (PBD)."
@@ -23015,7 +23051,7 @@ var XcpngDestroySnapshotResultSchema = z.object({
   command: z.string().optional(),
   error: z.string().optional()
 });
-async function run188(context) {
+async function run184(context) {
   const { params, error } = context;
   const { snapshot_uuid: snapshotUuid } = params ?? {};
   if (!snapshotUuid) {
@@ -23038,7 +23074,7 @@ async function run188(context) {
     command: result.command
   };
 }
-var destroy_snapshot_default = task(run188, {
+var destroy_snapshot_default = task(run184, {
   inputSchema: XcpngDestroySnapshotParamsSchema,
   outputSchema: XcpngDestroySnapshotResultSchema,
   description: "Destroys an XCP-ng VM snapshot."
@@ -23058,7 +23094,7 @@ var XcpngIntroduceSrResultSchema = z.object({
   appliedCommands: z.array(z.string()),
   error: z.string().optional()
 });
-async function run189(context) {
+async function run185(context) {
   const { params, error } = context;
   const { sr_uuid: srUuid, name_label: nameLabel, type, content_type: contentType, shared } = params ?? {};
   if (!srUuid) {
@@ -23099,7 +23135,7 @@ async function run189(context) {
     appliedCommands
   };
 }
-var introduce_sr_default = task(run189, {
+var introduce_sr_default = task(run185, {
   inputSchema: XcpngIntroduceSrParamsSchema,
   outputSchema: XcpngIntroduceSrResultSchema,
   description: "Introduces an existing storage repository into the pool."
@@ -23118,7 +23154,7 @@ var XcpngForgetSrResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run190(context) {
+async function run186(context) {
   const { params, error } = context;
   const { sr_uuid: srUuidParam, sr_name_label: srNameLabel, allow_missing: rawAllowMissing } = params ?? {};
   const allowMissing = coerceBoolean(rawAllowMissing, false);
@@ -23181,7 +23217,7 @@ async function run190(context) {
     appliedCommands
   };
 }
-var forget_sr_default = task(run190, {
+var forget_sr_default = task(run186, {
   inputSchema: XcpngForgetSrParamsSchema,
   outputSchema: XcpngForgetSrResultSchema,
   description: "Forgets an SR from the pool metadata without destroying the underlying storage."
@@ -23196,7 +23232,7 @@ var XcpngListSnapshotsResultSchema = z.object({
   items: z.any().optional(),
   error: z.string().optional()
 });
-async function run191(context) {
+async function run187(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "snapshot-list", filters);
   if (!result.success) {
@@ -23210,7 +23246,7 @@ async function run191(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_snapshots_default = task(run191, {
+var list_snapshots_default = task(run187, {
   inputSchema: XcpngListSnapshotsParamsSchema,
   outputSchema: XcpngListSnapshotsResultSchema,
   description: "Lists VM snapshots available on the host."
@@ -23225,7 +23261,7 @@ var XcpngListMessagesResultSchema = z.object({
   items: z.any().optional(),
   error: z.string().optional()
 });
-async function run192(context) {
+async function run188(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "message-list", filters);
   if (!result.success) {
@@ -23239,7 +23275,7 @@ async function run192(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_messages_default = task(run192, {
+var list_messages_default = task(run188, {
   inputSchema: XcpngListMessagesParamsSchema,
   outputSchema: XcpngListMessagesResultSchema,
   description: "Lists messages emitted by the XCP-ng pool."
@@ -23258,7 +23294,7 @@ var XcpngClearMessagesResultSchema = z.object({
   commands: z.any().optional(),
   error: z.string().optional()
 });
-async function run193(context) {
+async function run189(context) {
   const { params, error } = context;
   const { uuid, uuid_prefix: uuidPrefix, all: rawAll, filters } = params ?? {};
   const all = coerceBoolean(rawAll, false);
@@ -23316,7 +23352,7 @@ async function run193(context) {
     commands
   };
 }
-var clear_messages_default = task(run193, {
+var clear_messages_default = task(run189, {
   inputSchema: XcpngClearMessagesParamsSchema,
   outputSchema: XcpngClearMessagesResultSchema,
   description: "Clears messages (all, by UUID, or UUID prefix)."
@@ -23337,7 +23373,7 @@ var XcpngDestroyTemplateResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run194(context) {
+async function run190(context) {
   const { params, error } = context;
   const {
     template_uuid: templateUuidParam,
@@ -23412,7 +23448,7 @@ async function run194(context) {
     command: commandResult.command
   };
 }
-var destroy_template_default = task(run194, {
+var destroy_template_default = task(run190, {
   inputSchema: XcpngDestroyTemplateParamsSchema,
   outputSchema: XcpngDestroyTemplateResultSchema,
   description: "Destroys an XCP-ng template by UUID or name-label."
@@ -23432,7 +23468,7 @@ var XcpngDestroyVdiResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run195(context) {
+async function run191(context) {
   const { params, error } = context;
   const {
     vdi_uuid: vdiUuidParam,
@@ -23497,7 +23533,7 @@ async function run195(context) {
     command: result.command
   };
 }
-var destroy_vdi_default = task(run195, {
+var destroy_vdi_default = task(run191, {
   inputSchema: XcpngDestroyVdiParamsSchema,
   outputSchema: XcpngDestroyVdiResultSchema,
   description: "Destroys an XCP-ng VDI by UUID (optionally resolving by name-label)."
@@ -23522,7 +23558,7 @@ var XcpngDestroyVmResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run196(context) {
+async function run192(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuidParam,
@@ -23685,7 +23721,7 @@ async function run196(context) {
     destroyedVdiUuids
   };
 }
-var destroy_vm_default = task(run196, {
+var destroy_vm_default = task(run192, {
   inputSchema: XcpngDestroyVmParamsSchema,
   outputSchema: XcpngDestroyVmResultSchema,
   description: "Destroys an XCP-ng VM, optionally forcing and pruning snapshots."
@@ -23714,7 +23750,7 @@ var XcpngCopyVdiResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run197(context) {
+async function run193(context) {
   const { params, error } = context;
   const {
     source_vdi_uuid: sourceVdiUuidParam,
@@ -23859,7 +23895,7 @@ async function run197(context) {
     appliedCommands
   };
 }
-var copy_vdi_default = task(run197, {
+var copy_vdi_default = task(run193, {
   inputSchema: XcpngCopyVdiParamsSchema,
   outputSchema: XcpngCopyVdiResultSchema,
   description: "Copies an XCP-ng VDI to a destination storage repository and optionally updates its metadata."
@@ -23877,7 +23913,7 @@ var XcpngDetachIsoResultSchema = z.object({
   alreadyEmpty: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run198(context) {
+async function run194(context) {
   const { params, error } = context;
   const { vm_uuid: vmUuid, allow_missing: rawAllowMissing } = params;
   if (!vmUuid) {
@@ -23909,7 +23945,7 @@ async function run198(context) {
     error: message
   };
 }
-var detach_iso_default = task(run198, {
+var detach_iso_default = task(run194, {
   inputSchema: XcpngDetachIsoParamsSchema,
   outputSchema: XcpngDetachIsoResultSchema,
   description: "Ejects ISO media from a VM, tolerating empty drives when allow_missing:true."
@@ -23935,7 +23971,7 @@ var XcpngDetachVdiResultSchema = z.object({
   appliedCommands: z.array(z.string()),
   error: z.string().optional()
 });
-async function run199(context) {
+async function run195(context) {
   const { params } = context;
   const {
     vbd_uuid,
@@ -23972,7 +24008,7 @@ async function run199(context) {
     error: result.error
   };
 }
-var detach_vdi_default = task(run199, {
+var detach_vdi_default = task(run195, {
   inputSchema: XcpngDetachVdiParamsSchema,
   outputSchema: XcpngDetachVdiResultSchema,
   description: "Detaches a VDI from a VM by unplugging and optionally destroying the VBD, leaving the VDI intact by default."
@@ -23994,7 +24030,7 @@ var XcpngDetachNetworkInterfaceResultSchema = z.object({
   appliedCommands: z.array(z.string()),
   error: z.string().optional()
 });
-async function run200(context) {
+async function run196(context) {
   const { params, error } = context;
   const {
     vif_uuid: vifUuidParam,
@@ -24088,7 +24124,7 @@ async function run200(context) {
     appliedCommands
   };
 }
-var detach_network_interface_default = task(run200, {
+var detach_network_interface_default = task(run196, {
   inputSchema: XcpngDetachNetworkInterfaceParamsSchema,
   outputSchema: XcpngDetachNetworkInterfaceResultSchema,
   description: "Unplugs (and optionally destroys) a virtual network interface from an XCP-ng VM."
@@ -24108,7 +24144,7 @@ var XcpngEnableHostResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run201(context) {
+async function run197(context) {
   const { params, error } = context;
   const {
     host_uuid: hostUuidParam,
@@ -24176,7 +24212,7 @@ async function run201(context) {
     appliedCommands
   };
 }
-var enable_host_default = task(run201, {
+var enable_host_default = task(run197, {
   inputSchema: XcpngEnableHostParamsSchema,
   outputSchema: XcpngEnableHostResultSchema,
   description: "Enables maintenance-disabled hosts so they rejoin scheduling."
@@ -24198,7 +24234,7 @@ var XcpngDisableHostResultSchema = z.object({
   evacuated: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run202(context) {
+async function run198(context) {
   const { params, error } = context;
   const {
     host_uuid: hostUuidParam,
@@ -24283,7 +24319,7 @@ async function run202(context) {
     evacuated: evacuate
   };
 }
-var disable_host_default = task(run202, {
+var disable_host_default = task(run198, {
   inputSchema: XcpngDisableHostParamsSchema,
   outputSchema: XcpngDisableHostResultSchema,
   description: "Disables a host (optionally evacuating resident VMs first)."
@@ -24303,7 +24339,7 @@ var XcpngPlugPbdResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run203(context) {
+async function run199(context) {
   const { params, error } = context;
   const { pbd_uuid: pbdUuidParam, sr_uuid: srUuid, host_uuid: hostUuid, allow_missing: rawAllowMissing } = params ?? {};
   const allowMissing = coerceBoolean(rawAllowMissing, false);
@@ -24367,7 +24403,7 @@ async function run203(context) {
     appliedCommands
   };
 }
-var plug_pbd_default = task(run203, {
+var plug_pbd_default = task(run199, {
   inputSchema: XcpngPlugPbdParamsSchema,
   outputSchema: XcpngPlugPbdResultSchema,
   description: "Plugs a PBD so the host reattaches the storage repository."
@@ -24387,7 +24423,7 @@ var XcpngUnplugPbdResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run204(context) {
+async function run200(context) {
   const { params, error } = context;
   const { pbd_uuid: pbdUuidParam, sr_uuid: srUuid, host_uuid: hostUuid, allow_missing: rawAllowMissing } = params ?? {};
   const allowMissing = coerceBoolean(rawAllowMissing, false);
@@ -24451,7 +24487,7 @@ async function run204(context) {
     appliedCommands
   };
 }
-var unplug_pbd_default = task(run204, {
+var unplug_pbd_default = task(run200, {
   inputSchema: XcpngUnplugPbdParamsSchema,
   outputSchema: XcpngUnplugPbdResultSchema,
   description: "Unplugs a PBD so the host detaches the storage repository."
@@ -24466,7 +24502,7 @@ var XcpngListPoolsResultSchema = z.object({
   items: z.any().optional(),
   error: z.string().optional()
 });
-async function run205(context) {
+async function run201(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "pool-list", filters);
   if (!result.success) {
@@ -24480,7 +24516,7 @@ async function run205(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_pools_default = task(run205, {
+var list_pools_default = task(run201, {
   inputSchema: XcpngListPoolsParamsSchema,
   outputSchema: XcpngListPoolsResultSchema,
   description: "Lists pools available to the current host."
@@ -24501,7 +24537,7 @@ var XcpngFindPoolResultSchema = z.object({
   multiple: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run206(context) {
+async function run202(context) {
   const params = context.params ?? {};
   const {
     uuid,
@@ -24601,7 +24637,7 @@ async function runListPools(context, params) {
     })
   );
 }
-var find_pool_default = task(run206, {
+var find_pool_default = task(run202, {
   inputSchema: XcpngFindPoolParamsSchema,
   outputSchema: XcpngFindPoolResultSchema,
   description: "Finds a single pool by UUID or name-label, optionally allowing multiple matches."
@@ -24620,7 +24656,7 @@ var XcpngSetPoolParamResultSchema = z.object({
   appliedCommands: z.array(z.string()),
   error: z.string().optional()
 });
-async function run207(context) {
+async function run203(context) {
   const { params, error } = context;
   const { pool_uuid: poolUuidParam, pool_name_label: poolNameLabel, key, value } = params ?? {};
   if (!key) {
@@ -24681,7 +24717,7 @@ async function run207(context) {
     appliedCommands
   };
 }
-var set_pool_param_default = task(run207, {
+var set_pool_param_default = task(run203, {
   inputSchema: XcpngSetPoolParamParamsSchema,
   outputSchema: XcpngSetPoolParamResultSchema,
   description: "Updates a pool parameter (wraps xe pool-param-set)."
@@ -24701,7 +24737,7 @@ var XcpngRebootHostResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run208(context) {
+async function run204(context) {
   const { params, error } = context;
   const {
     host_uuid: hostUuidParam,
@@ -24767,7 +24803,7 @@ async function run208(context) {
     command: commandResult.command
   };
 }
-var reboot_host_default = task(run208, {
+var reboot_host_default = task(run204, {
   inputSchema: XcpngRebootHostParamsSchema,
   outputSchema: XcpngRebootHostResultSchema,
   description: "Reboots an XCP-ng host (optionally forcing)."
@@ -24787,7 +24823,7 @@ var XcpngShutdownHostResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run209(context) {
+async function run205(context) {
   const { params, error } = context;
   const {
     host_uuid: hostUuidParam,
@@ -24851,7 +24887,7 @@ async function run209(context) {
     command: commandResult.command
   };
 }
-var shutdown_host_default = task(run209, {
+var shutdown_host_default = task(run205, {
   inputSchema: XcpngShutdownHostParamsSchema,
   outputSchema: XcpngShutdownHostResultSchema,
   description: "Shuts down an XCP-ng host (optionally forcing)."
@@ -24870,7 +24906,7 @@ var XcpngEvacuateHostResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run210(context) {
+async function run206(context) {
   const { params, error } = context;
   const { host_uuid: hostUuidParam, host_name_label: hostNameLabel, allow_missing: rawAllowMissing } = params ?? {};
   const allowMissing = coerceBoolean(rawAllowMissing, false);
@@ -24923,7 +24959,7 @@ async function run210(context) {
     command: commandResult.command
   };
 }
-var evacuate_host_default = task(run210, {
+var evacuate_host_default = task(run206, {
   inputSchema: XcpngEvacuateHostParamsSchema,
   outputSchema: XcpngEvacuateHostResultSchema,
   description: "Evacuates all VMs from a host."
@@ -24944,7 +24980,7 @@ var XcpngPlugPifResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run211(context) {
+async function run207(context) {
   const { params, error } = context;
   const {
     pif_uuid: pifUuidParam,
@@ -25041,7 +25077,7 @@ async function run211(context) {
     appliedCommands
   };
 }
-var plug_pif_default = task(run211, {
+var plug_pif_default = task(run207, {
   inputSchema: XcpngPlugPifParamsSchema,
   outputSchema: XcpngPlugPifResultSchema,
   description: "Plugs a physical interface (PIF) on the specified host."
@@ -25060,7 +25096,7 @@ var XcpngPifScanResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run212(context) {
+async function run208(context) {
   const { params, error } = context;
   const { host_uuid: hostUuidParam, host_name_label: hostNameLabel, allow_missing: rawAllowMissing } = params ?? {};
   const allowMissing = coerceBoolean(rawAllowMissing, false);
@@ -25125,7 +25161,7 @@ async function run212(context) {
     appliedCommands
   };
 }
-var pif_scan_default = task(run212, {
+var pif_scan_default = task(run208, {
   inputSchema: XcpngPifScanParamsSchema,
   outputSchema: XcpngPifScanResultSchema,
   description: "Rescans physical interfaces (PIFs) on a host to discover changes."
@@ -25146,7 +25182,7 @@ var XcpngUnplugPifResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run213(context) {
+async function run209(context) {
   const { params, error } = context;
   const {
     pif_uuid: pifUuidParam,
@@ -25243,7 +25279,7 @@ async function run213(context) {
     appliedCommands
   };
 }
-var unplug_pif_default = task(run213, {
+var unplug_pif_default = task(run209, {
   inputSchema: XcpngUnplugPifParamsSchema,
   outputSchema: XcpngUnplugPifResultSchema,
   description: "Unplugs a physical interface (PIF) on the specified host."
@@ -25261,7 +25297,7 @@ var XcpngSetPifParamResultSchema = z.object({
   command: z.string().optional(),
   error: z.string().optional()
 });
-async function run214(context) {
+async function run210(context) {
   const { params, error } = context;
   const { pif_uuid: pifUuid, key, value } = params ?? {};
   if (!pifUuid) {
@@ -25299,7 +25335,7 @@ async function run214(context) {
     command: commandResult.command
   };
 }
-var set_pif_param_default = task(run214, {
+var set_pif_param_default = task(run210, {
   inputSchema: XcpngSetPifParamParamsSchema,
   outputSchema: XcpngSetPifParamResultSchema,
   description: "Updates a PIF parameter (wraps `xe pif-param-set`)."
@@ -25316,7 +25352,7 @@ var XcpngUnplugVbdResultSchema = z.object({
   alreadyDetached: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run215(context) {
+async function run211(context) {
   const { params, error } = context;
   const { vbd_uuid: vbdUuid, allow_missing: rawAllowMissing } = params;
   if (!vbdUuid) {
@@ -25346,7 +25382,7 @@ async function run215(context) {
     error: message
   };
 }
-var unplug_vbd_default = task(run215, {
+var unplug_vbd_default = task(run211, {
   inputSchema: XcpngUnplugVbdParamsSchema,
   outputSchema: XcpngUnplugVbdResultSchema,
   description: "Unplugs a VBD from an XCP-ng VM, tolerating already-detached devices when allow_missing:true."
@@ -25366,7 +25402,7 @@ var XcpngSuspendVmResultSchema = z.object({
   waitAttempts: z.number().optional(),
   error: z.string().optional()
 });
-async function run216(context) {
+async function run212(context) {
   const { params, error } = context;
   const { vm_uuid: vmUuid, allow_running: rawAllowRunning } = params;
   if (!vmUuid) {
@@ -25427,7 +25463,7 @@ async function run216(context) {
     waitAttempts: waitResult.attempts
   };
 }
-var suspend_vm_default = task(run216, {
+var suspend_vm_default = task(run212, {
   inputSchema: XcpngSuspendVmParamsSchema,
   outputSchema: XcpngSuspendVmResultSchema,
   description: "Suspends an XCP-ng VM, waiting until the VM reports the suspended power state."
@@ -25448,7 +25484,7 @@ var XcpngResumeVmResultSchema = z.object({
   waitAttempts: z.number().optional(),
   error: z.string().optional()
 });
-async function run217(context) {
+async function run213(context) {
   const { params, error } = context;
   const { vm_uuid: vmUuid, start_paused: rawStartPaused, host_uuid: hostUuid } = params;
   if (!vmUuid) {
@@ -25513,7 +25549,7 @@ async function run217(context) {
     waitAttempts: waitResult.attempts
   };
 }
-var resume_vm_default = task(run217, {
+var resume_vm_default = task(run213, {
   inputSchema: XcpngResumeVmParamsSchema,
   outputSchema: XcpngResumeVmResultSchema,
   description: "Resumes a suspended XCP-ng VM, optionally starting it in a paused state or on a specific host."
@@ -25528,7 +25564,7 @@ var XcpngListVifParamsResultSchema = z.object({
   items: z.any().optional(),
   error: z.string().optional()
 });
-async function run218(context) {
+async function run214(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "vif-param-list", filters);
   if (!result.success) {
@@ -25542,7 +25578,7 @@ async function run218(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_vif_params_default = task(run218, {
+var list_vif_params_default = task(run214, {
   inputSchema: XcpngListVifParamsParamsSchema,
   outputSchema: XcpngListVifParamsResultSchema,
   description: "Lists parameters for virtual interfaces (VIFs) on an XCP-ng host."
@@ -25557,7 +25593,7 @@ var XcpngListVifsResultSchema = z.object({
   items: z.array(z.any()).optional(),
   error: z.string().optional()
 });
-async function run219(context) {
+async function run215(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "vif-list", filters);
   if (!result.success) {
@@ -25605,7 +25641,7 @@ async function run219(context) {
     items: enrichedItems
   };
 }
-var list_vifs_default = task(run219, {
+var list_vifs_default = task(run215, {
   inputSchema: XcpngListVifsParamsSchema,
   outputSchema: XcpngListVifsResultSchema,
   description: "Lists VIFs (virtual interfaces) attached to VMs."
@@ -25620,7 +25656,7 @@ var XcpngListPifParamsResultSchema = z.object({
   items: z.any().optional(),
   error: z.string().optional()
 });
-async function run220(context) {
+async function run216(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "pif-param-list", filters);
   if (!result.success) {
@@ -25634,7 +25670,7 @@ async function run220(context) {
     items: parseKeyValueOutput(result.stdout)
   };
 }
-var list_pif_params_default = task(run220, {
+var list_pif_params_default = task(run216, {
   inputSchema: XcpngListPifParamsParamsSchema,
   outputSchema: XcpngListPifParamsResultSchema,
   description: "Lists parameters for PIFs on an XCP-ng host."
@@ -25649,7 +25685,7 @@ var XcpngListPifsResultSchema = z.object({
   items: z.array(z.any()).optional(),
   error: z.string().optional()
 });
-async function run221(context) {
+async function run217(context) {
   const filters = normalizeFilterArgs(context.params?.filters);
   const result = await runXeCommand(context, "pif-list", filters);
   if (!result.success) {
@@ -25697,7 +25733,7 @@ async function run221(context) {
     items: enrichedItems
   };
 }
-var list_pifs_default = task(run221, {
+var list_pifs_default = task(run217, {
   inputSchema: XcpngListPifsParamsSchema,
   outputSchema: XcpngListPifsResultSchema,
   description: "Lists PIFs (physical interfaces) available on the XCP-ng host."
@@ -25717,7 +25753,7 @@ var XcpngRebootVmResultSchema = z.object({
   powerState: z.string().optional(),
   waitAttempts: z.number().optional()
 });
-async function run222(context) {
+async function run218(context) {
   const { params, error } = context;
   const { vm_uuid: vmUuidParam, vm_name_label: vmNameLabel, force: rawForce } = params ?? {};
   const force = coerceBoolean(rawForce, false);
@@ -25778,7 +25814,7 @@ async function run222(context) {
     waitAttempts: waitResult.attempts
   };
 }
-var reboot_vm_default = task(run222, {
+var reboot_vm_default = task(run218, {
   inputSchema: XcpngRebootVmParamsSchema,
   outputSchema: XcpngRebootVmResultSchema,
   description: "Reboots an XCP-ng VM using `xe vm-reboot`."
@@ -25797,7 +25833,7 @@ var XcpngSetNetworkParamResultSchema = z.object({
   appliedCommands: z.array(z.string()),
   error: z.string().optional()
 });
-async function run223(context) {
+async function run219(context) {
   const { params, error } = context;
   const { network_uuid: networkUuidParam, network_name_label: networkNameLabel, key, value } = params ?? {};
   if (!key) {
@@ -25858,7 +25894,7 @@ async function run223(context) {
     appliedCommands
   };
 }
-var set_network_param_default = task(run223, {
+var set_network_param_default = task(run219, {
   inputSchema: XcpngSetNetworkParamParamsSchema,
   outputSchema: XcpngSetNetworkParamResultSchema,
   description: "Updates a network parameter (wraps xe network-param-set)."
@@ -25882,7 +25918,7 @@ var XcpngResizeVdiResultSchema = z.object({
   newSizeBytes: z.number().optional(),
   error: z.string().optional()
 });
-async function run224(context) {
+async function run220(context) {
   const { params, error } = context;
   const {
     vdi_uuid: vdiUuidParam,
@@ -25956,7 +25992,7 @@ async function run224(context) {
     newSizeBytes: sizeBytes
   };
 }
-var resize_vdi_default = task(run224, {
+var resize_vdi_default = task(run220, {
   inputSchema: XcpngResizeVdiParamsSchema,
   outputSchema: XcpngResizeVdiResultSchema,
   description: "Resizes an existing VDI on XCP-ng using `xe vdi-resize`/`vdi-resize-online`."
@@ -25988,7 +26024,7 @@ var XcpngSetVmResourcesResultSchema = z.object({
   powerState: z.string().optional(),
   waitAttempts: z.number().optional()
 });
-async function run225(context) {
+async function run221(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuidParam,
@@ -26236,14 +26272,14 @@ async function run225(context) {
         cpuUpdates.push({ field, value });
       }
     }
-    for (const update4 of cpuUpdates) {
+    for (const update of cpuUpdates) {
       const result = await runXeCommand(context, "vm-param-set", {
         uuid: vmUuid,
-        [update4.field]: update4.value
+        [update.field]: update.value
       });
       appliedCommands.push(result.command);
       if (!result.success) {
-        const message = xeErrorMessage(result, `xe vm-param-set (${update4.field}) failed`);
+        const message = xeErrorMessage(result, `xe vm-param-set (${update.field}) failed`);
         error(message);
         return {
           success: false,
@@ -26291,7 +26327,7 @@ function ensurePositiveMib(value, fieldName) {
     bytes: mibToBytes2(value)
   };
 }
-var set_vm_resources_default = task(run225, {
+var set_vm_resources_default = task(run221, {
   inputSchema: XcpngSetVmResourcesParamsSchema,
   outputSchema: XcpngSetVmResourcesResultSchema,
   description: "Updates VM memory and vCPU settings on an XCP-ng host."
@@ -26316,7 +26352,7 @@ var XcpngResizeVmCpusResultSchema = z.object({
   powerState: z.string().optional(),
   waitAttempts: z.number().optional()
 });
-async function run226(context) {
+async function run222(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuid,
@@ -26365,7 +26401,7 @@ async function run226(context) {
     waitAttempts: result.waitAttempts
   };
 }
-var resize_vm_cpus_default = task(run226, {
+var resize_vm_cpus_default = task(run222, {
   inputSchema: XcpngResizeVmCpusParamsSchema,
   outputSchema: XcpngResizeVmCpusResultSchema,
   description: "Resizes an XCP-ng VM\u2019s vCPU configuration."
@@ -26386,7 +26422,7 @@ var XcpngResizeVmMemoryResultSchema = z.object({
   powerState: z.string().optional(),
   waitAttempts: z.number().optional()
 });
-async function run227(context) {
+async function run223(context) {
   const { params, error } = context;
   const { vm_uuid: vmUuid, vm_name_label: vmNameLabel, memory_mib: memoryMib } = params ?? {};
   if (!memoryMib || !Number.isFinite(memoryMib) || memoryMib <= 0) {
@@ -26425,7 +26461,7 @@ async function run227(context) {
     waitAttempts: result.waitAttempts
   };
 }
-var resize_vm_memory_default = task(run227, {
+var resize_vm_memory_default = task(run223, {
   inputSchema: XcpngResizeVmMemoryParamsSchema,
   outputSchema: XcpngResizeVmMemoryResultSchema,
   description: "Resizes an XCP-ng VM\u2019s memory allocation (static/dynamic bounds)."
@@ -26444,7 +26480,7 @@ var XcpngRevertSnapshotResultSchema = z.object({
   powerState: z.string().optional(),
   waitAttempts: z.number().optional()
 });
-async function run228(context) {
+async function run224(context) {
   const { params, error } = context;
   const { snapshot_uuid: snapshotUuid } = params ?? {};
   if (!snapshotUuid) {
@@ -26533,7 +26569,7 @@ async function run228(context) {
     waitAttempts
   };
 }
-var revert_snapshot_default = task(run228, {
+var revert_snapshot_default = task(run224, {
   inputSchema: XcpngRevertSnapshotParamsSchema,
   outputSchema: XcpngRevertSnapshotResultSchema,
   description: "Reverts an XCP-ng VM to a specified snapshot."
@@ -26551,7 +26587,7 @@ var XcpngSetSnapshotParamResultSchema = z.object({
   command: z.string().optional(),
   error: z.string().optional()
 });
-async function run229(context) {
+async function run225(context) {
   const { params, error } = context;
   const { snapshot_uuid: snapshotUuid, key, value } = params ?? {};
   if (!snapshotUuid) {
@@ -26589,7 +26625,7 @@ async function run229(context) {
     command: commandResult.command
   };
 }
-var set_snapshot_param_default = task(run229, {
+var set_snapshot_param_default = task(run225, {
   inputSchema: XcpngSetSnapshotParamParamsSchema,
   outputSchema: XcpngSetSnapshotParamResultSchema,
   description: "Updates a snapshot parameter (wraps xe snapshot-param-set)."
@@ -26608,7 +26644,7 @@ var XcpngSetSrParamResultSchema = z.object({
   appliedCommands: z.array(z.string()),
   error: z.string().optional()
 });
-async function run230(context) {
+async function run226(context) {
   const { params, error } = context;
   const { sr_uuid: srUuidParam, sr_name_label: srNameLabel, key, value } = params ?? {};
   if (!key) {
@@ -26669,7 +26705,7 @@ async function run230(context) {
     appliedCommands
   };
 }
-var set_sr_param_default = task(run230, {
+var set_sr_param_default = task(run226, {
   inputSchema: XcpngSetSrParamParamsSchema,
   outputSchema: XcpngSetSrParamResultSchema,
   description: "Updates a storage repository parameter (wraps xe sr-param-set)."
@@ -26690,7 +26726,7 @@ var XcpngStartVmResultSchema = z.object({
   finalPowerState: z.string().optional(),
   waitAttempts: z.number().optional()
 });
-async function run231(context) {
+async function run227(context) {
   const { params, error } = context;
   const { vm_uuid, start_paused: rawStartPaused, force: rawForce } = params;
   const startPaused = coerceBoolean(rawStartPaused, false);
@@ -26757,7 +26793,7 @@ async function run231(context) {
     waitAttempts: waitResult.attempts
   };
 }
-var start_vm_default = task(run231, {
+var start_vm_default = task(run227, {
   inputSchema: XcpngStartVmParamsSchema,
   outputSchema: XcpngStartVmResultSchema,
   description: "Starts an XCP-ng virtual machine with optional paused or forced modes."
@@ -26778,7 +26814,7 @@ var XcpngStopVmResultSchema = z.object({
   finalPowerState: z.string().optional(),
   waitAttempts: z.number().optional()
 });
-async function run232(context) {
+async function run228(context) {
   const { params, error } = context;
   const { vm_uuid, force: rawForce, timeout_seconds: rawTimeout } = params;
   const force = coerceBoolean(rawForce, false);
@@ -26853,7 +26889,7 @@ async function run232(context) {
     waitAttempts: waitResult.attempts
   };
 }
-var stop_vm_default = task(run232, {
+var stop_vm_default = task(run228, {
   inputSchema: XcpngStopVmParamsSchema,
   outputSchema: XcpngStopVmResultSchema,
   description: "Stops an XCP-ng virtual machine gracefully or forcefully."
@@ -26882,7 +26918,7 @@ var XcpngImportIsoResultSchema = z.object({
   commands: z.array(z.string()),
   error: z.string().optional()
 });
-async function run233(context) {
+async function run229(context) {
   if (!context.host) {
     return {
       success: false,
@@ -27088,7 +27124,7 @@ async function findIsoVdi2(context, srUuid, isoFileName) {
   }
   return { vdi };
 }
-var import_iso_default = task(run233, {
+var import_iso_default = task(run229, {
   inputSchema: XcpngImportIsoParamsSchema,
   outputSchema: XcpngImportIsoResultSchema,
   description: "Ensures an ISO file is represented as a VDI in an ISO SR by rescanning and importing when necessary."
@@ -27117,7 +27153,7 @@ var XcpngUploadIsoHostResultSchema = z.object({
   remotePath: z.string().optional(),
   error: z.string().optional()
 });
-async function run234(context) {
+async function run230(context) {
   if (context.host) {
     return {
       success: false,
@@ -27172,10 +27208,10 @@ async function run234(context) {
   const uploads = await context.ssh(
     [],
     async (remoteContext) => {
-      const { run: run253 } = remoteContext;
+      const { run: run249 } = remoteContext;
       const remotePath = pathPosix3.join(resolvedLocation, remoteFileName);
       try {
-        const srResult = await run253(
+        const srResult = await run249(
           find_or_create_iso_sr_default({
             name_label: isoSrName,
             location: resolvedLocation,
@@ -27192,7 +27228,7 @@ async function run234(context) {
             error: srResult.error ?? "Failed to ensure ISO SR exists."
           };
         }
-        const fileExistsResult = await run253(exists_default2({ path: remotePath }));
+        const fileExistsResult = await run249(exists_default2({ path: remotePath }));
         if (fileExistsResult.exists) {
           return {
             success: true,
@@ -27259,7 +27295,7 @@ function resolveChunkSizeBytes(chunkSizeMb) {
   const bounded = Math.min(Math.max(safeSize, MIN_CHUNK_SIZE_MB), MAX_CHUNK_SIZE_MB);
   return bounded * 1024 * 1024;
 }
-var upload_iso_default = task(run234, {
+var upload_iso_default = task(run230, {
   inputSchema: XcpngUploadIsoParamsSchema,
   outputSchema: XcpngUploadIsoHostResultSchema,
   description: "Uploads a local ISO to the remote XCP-ng hypervisor, ensuring the target ISO SR exists beforehand."
@@ -27296,7 +27332,7 @@ function parseMapValue(raw) {
     return acc;
   }, {});
 }
-async function run235(context) {
+async function run231(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuidParam,
@@ -27434,7 +27470,7 @@ async function run235(context) {
   }
   return result;
 }
-var get_vm_info_default = task(run235, {
+var get_vm_info_default = task(run231, {
   inputSchema: XcpngGetVmInfoParamsSchema,
   outputSchema: XcpngGetVmInfoResultSchema,
   description: "Returns structured VM details (platform, boot configuration, memory/CPU sizing, and optional VBD/VIF inventory)."
@@ -27458,7 +27494,7 @@ var XcpngExportVdiResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run236(context) {
+async function run232(context) {
   const { params, error } = context;
   const {
     vdi_uuid: vdiUuidParam,
@@ -27538,7 +27574,7 @@ async function run236(context) {
     appliedCommands
   };
 }
-var export_vdi_default = task(run236, {
+var export_vdi_default = task(run232, {
   inputSchema: XcpngExportVdiParamsSchema,
   outputSchema: XcpngExportVdiResultSchema,
   description: "Exports a VDI to the hypervisor filesystem via xe vdi-export."
@@ -27592,7 +27628,7 @@ var XcpngProvisionVmFromIsoResultSchema = z.object({
   steps: z.array(z.any()),
   error: z.string().optional()
 });
-async function run237(context) {
+async function run233(context) {
   if (!context.host) {
     return {
       success: false,
@@ -27919,7 +27955,7 @@ async function run237(context) {
     steps
   };
 }
-var provision_vm_from_iso_default = task(run237, {
+var provision_vm_from_iso_default = task(run233, {
   inputSchema: XcpngProvisionVmFromIsoParamsSchema,
   outputSchema: XcpngProvisionVmFromIsoResultSchema,
   description: "Creates a VM from a template, attaches storage, network, and ISO media, and optionally boots it for installation."
@@ -28949,7 +28985,7 @@ function resolveMemoryMib(input) {
   }
   return { value: Math.floor(value) };
 }
-async function run238(context) {
+async function run234(context) {
   if (!context.host) {
     return runLocal(context);
   }
@@ -29162,7 +29198,7 @@ function buildLocalFailure(step, message) {
     error: message
   };
 }
-var provision_vm_default = task(run238, {
+var provision_vm_default = task(run234, {
   inputSchema: XcpngProvisionVmParamsSchema,
   outputSchema: XcpngProvisionVmResultSchema,
   description: "Provisions a VM from an XCP-ng template by cloning its root disk, configuring cloud-init metadata, and attaching network resources."
@@ -29228,7 +29264,7 @@ var XcpngSnapshotVmResultSchema = z.object({
   command: z.string().optional(),
   error: z.string().optional()
 });
-async function run239(context) {
+async function run235(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuidParam,
@@ -29298,7 +29334,7 @@ async function run239(context) {
     command: snapshotResult.command
   };
 }
-var snapshot_vm_default = task(run239, {
+var snapshot_vm_default = task(run235, {
   inputSchema: XcpngSnapshotVmParamsSchema,
   outputSchema: XcpngSnapshotVmResultSchema,
   description: "Creates a snapshot of an XCP-ng VM (optionally with quiesce)."
@@ -29325,7 +29361,7 @@ var XcpngImportVdiResultSchema = z.object({
   appliedCommands: z.array(z.string()),
   error: z.string().optional()
 });
-async function run240(context) {
+async function run236(context) {
   const { params, error } = context;
   const {
     sr_uuid: srUuidParam,
@@ -29447,7 +29483,7 @@ async function run240(context) {
     appliedCommands
   };
 }
-var import_vdi_default = task(run240, {
+var import_vdi_default = task(run236, {
   inputSchema: XcpngImportVdiParamsSchema,
   outputSchema: XcpngImportVdiResultSchema,
   description: "Imports a VDI file into a storage repository via xe vdi-import."
@@ -29549,7 +29585,7 @@ var XcpngVmMigrateResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run241(context) {
+async function run237(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuidParam,
@@ -29673,7 +29709,7 @@ async function run241(context) {
     appliedCommands
   };
 }
-var vm_migrate_default = task(run241, {
+var vm_migrate_default = task(run237, {
   inputSchema: XcpngVmMigrateParamsSchema,
   outputSchema: XcpngVmMigrateResultSchema,
   description: "Migrates a VM to another host (and optionally storage repository) via xe vm-migrate."
@@ -29698,7 +29734,7 @@ var XcpngVmExportResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run242(context) {
+async function run238(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuidParam,
@@ -29787,7 +29823,7 @@ async function run242(context) {
     appliedCommands
   };
 }
-var vm_export_default = task(run242, {
+var vm_export_default = task(run238, {
   inputSchema: XcpngVmExportParamsSchema,
   outputSchema: XcpngVmExportResultSchema,
   description: "Exports a VM to an XVA file via xe vm-export."
@@ -29809,7 +29845,7 @@ var XcpngVmImportResultSchema = z.object({
   appliedCommands: z.array(z.string()),
   error: z.string().optional()
 });
-async function run243(context) {
+async function run239(context) {
   const { params, error } = context;
   const {
     filename,
@@ -29878,7 +29914,7 @@ async function run243(context) {
     appliedCommands
   };
 }
-var vm_import_default = task(run243, {
+var vm_import_default = task(run239, {
   inputSchema: XcpngVmImportParamsSchema,
   outputSchema: XcpngVmImportResultSchema,
   description: "Imports a VM image from an XVA file via xe vm-import."
@@ -29905,7 +29941,7 @@ var XcpngVmCopyResultSchema = z.object({
   skipped: z.boolean().optional(),
   error: z.string().optional()
 });
-async function run244(context) {
+async function run240(context) {
   const { params, error } = context;
   const {
     vm_uuid: vmUuidParam,
@@ -30032,7 +30068,7 @@ async function run244(context) {
     appliedCommands
   };
 }
-var vm_copy_default = task(run244, {
+var vm_copy_default = task(run240, {
   inputSchema: XcpngVmCopyParamsSchema,
   outputSchema: XcpngVmCopyResultSchema,
   description: "Creates a full copy of a VM, optionally targeting a different SR."
@@ -30052,7 +30088,7 @@ var XcpngDetachCdMediaResultSchema = z.object({
   error: z.string().optional(),
   skipped: z.boolean().optional()
 });
-async function run245(context) {
+async function run241(context) {
   if (!context.host) {
     return {
       success: false,
@@ -30189,7 +30225,7 @@ function filterCdDisks(disks) {
   }
   return results;
 }
-var detach_cd_media_default = task(run245, {
+var detach_cd_media_default = task(run241, {
   inputSchema: XcpngDetachCdMediaParamsSchema,
   outputSchema: XcpngDetachCdMediaResultSchema,
   description: "Detaches CD/DVD virtual media from a VM by unplugging and destroying associated VBDs."
@@ -30212,7 +30248,7 @@ var XcpngCleanupConfigDriveResultSchema = z.object({
   error: z.string().optional(),
   skipped: z.boolean().optional()
 });
-async function run246(context) {
+async function run242(context) {
   if (!context.host) {
     return {
       success: false,
@@ -30412,7 +30448,7 @@ async function run246(context) {
     steps
   };
 }
-var cleanup_config_drive_default = task(run246, {
+var cleanup_config_drive_default = task(run242, {
   inputSchema: XcpngCleanupConfigDriveParamsSchema,
   outputSchema: XcpngCleanupConfigDriveResultSchema,
   description: "Detaches an attached config-drive ISO from a VM and removes the associated VDI once the guest is halted."
@@ -30551,7 +30587,7 @@ var YumAddRepositoryResultSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run247(context) {
+async function run243(context) {
   const { params, exec, info, error } = context;
   const { content, name, sudo = true } = params;
   if (!content) {
@@ -30583,7 +30619,7 @@ EOF`;
     return { success: false, error: errorMsg };
   }
 }
-var add_repository_default2 = task(run247, {
+var add_repository_default2 = task(run243, {
   description: "Adds a YUM repository.",
   inputSchema: YumAddRepositoryParamsSchema,
   outputSchema: YumAddRepositoryResultSchema
@@ -30609,7 +30645,7 @@ var DownloadOutputSchema = z.object({
   path: z.string().optional(),
   error: z.string().optional()
 });
-async function run248(context) {
+async function run244(context) {
   const { params, info, error, exec } = context;
   const { url, dest, mode, sudo = false } = params;
   if (!url || !dest) {
@@ -30654,7 +30690,7 @@ async function run248(context) {
     return { success: false, error: errorMsg };
   }
 }
-var download_default = task(run248, {
+var download_default = task(run244, {
   description: "Downloads a file from a URL using curl or wget.",
   inputSchema: DownloadInputSchema,
   outputSchema: DownloadOutputSchema
@@ -30685,7 +30721,7 @@ var InterfacesOutputSchema = z.object({
     error: z.string()
   })
 );
-async function run249(context) {
+async function run245(context) {
   const { params, info, error, exec } = context;
   const { sudo = false } = params;
   try {
@@ -30777,7 +30813,7 @@ async function run249(context) {
     return { success: false, error: errorMsg };
   }
 }
-var interfaces_default = task(run249, {
+var interfaces_default = task(run245, {
   name: "interfaces",
   description: "Lists network interfaces with their properties.",
   inputSchema: InterfacesInputSchema,
@@ -30803,7 +30839,7 @@ var NftablesApplyOutputSchema = z.object({
     error: z.string().optional()
   })
 );
-async function run250(context) {
+async function run246(context) {
   const { params, exec, info } = context;
   const { config } = params;
   if (!config) {
@@ -30827,7 +30863,7 @@ async function run250(context) {
     return { success: false, error };
   }
 }
-var apply_default = task(run250, {
+var apply_default = task(run246, {
   description: "Applies an nftables configuration.",
   inputSchema: NftablesApplyInputSchema,
   outputSchema: NftablesApplyOutputSchema
@@ -30850,7 +30886,7 @@ var FirewalldDisableResultSchema = z.object({
   success: z.boolean(),
   error: z.string().optional()
 });
-async function run251(context) {
+async function run247(context) {
   const { run: runTask, debug, error, info } = context;
   const statusResult = await runTask(status_default({ service: "firewalld", sudo: true }));
   if (!statusResult.success && (statusResult.error?.includes("Could not find") || statusResult.error?.includes("not-found"))) {
@@ -30874,7 +30910,7 @@ async function run251(context) {
   info("firewalld service disabled successfully.");
   return { success: true };
 }
-var disable_default3 = task(run251, {
+var disable_default3 = task(run247, {
   description: "Disables and stops the firewalld service.",
   inputSchema: FirewalldDisableInputSchema,
   outputSchema: FirewalldDisableResultSchema
@@ -32169,6 +32205,7 @@ import Handlebars3 from "handlebars";
 // src/remote-runtime.ts
 import Handlebars2 from "handlebars";
 import "path";
+import * as fs10 from "fs";
 
 // src/ssh-session.ts
 import { signalsByName } from "human-signals";
@@ -32316,6 +32353,15 @@ import "chalk";
 import "util";
 import "typescript-string-operations";
 import { match as match4, P as P3 } from "ts-pattern";
+function normalizePrivateKey(value) {
+  if (!value.includes("\n") && value.includes("\\n")) {
+    return value.replace(/\\n/g, "\n");
+  }
+  return value;
+}
+function looksLikePrivateKey(value) {
+  return /-----BEGIN [A-Z0-9 ]+PRIVATE KEY-----/.test(value);
+}
 function normalizeWriteMode(mode) {
   if (mode === void 0) {
     return void 0;
@@ -32555,9 +32601,28 @@ var RemoteRuntime = class {
       // Assuming defaultSshUser on App
       port: this.host.port,
       // node-ssh parses port from host string if present
-      privateKey: await this.host.plaintextSshKeyPath(),
       password: await this.host.decryptedPassword()
     };
+    const sshKeyPassphrase = await this.host.decryptedSshKeyPassphrase();
+    if (sshKeyPassphrase) {
+      sshConnectOpts.passphrase = sshKeyPassphrase;
+    }
+    const decryptedKey = await this.host.decryptedSshKey();
+    if (decryptedKey) {
+      const normalizedKey = normalizePrivateKey(decryptedKey).trim();
+      if (looksLikePrivateKey(normalizedKey)) {
+        sshConnectOpts.privateKey = normalizedKey;
+      } else if (fs10.existsSync(normalizedKey)) {
+        sshConnectOpts.privateKeyPath = normalizedKey;
+      } else {
+        sshConnectOpts.privateKey = normalizedKey;
+      }
+    } else {
+      const keyPath = await this.host.plaintextSshKeyPath();
+      if (keyPath) {
+        sshConnectOpts.privateKeyPath = keyPath;
+      }
+    }
     try {
       if (!this.sshSession.isConnected()) {
         await this.sshSession.connect(sshConnectOpts);
@@ -32648,7 +32713,7 @@ var RemoteRuntime = class {
 };
 
 // src/local-runtime.ts
-import * as fs10 from "fs";
+import * as fs11 from "fs";
 import chalk4 from "chalk";
 function normalizeMode(mode) {
   if (mode === void 0) {
@@ -32671,7 +32736,7 @@ var LocalInvocation = class _LocalInvocation extends Invocation {
     )(params);
     this.config = this.runtime.app.config;
     this.file = {
-      read: async (path14) => fs10.promises.readFile(path14, "utf-8"),
+      read: async (path14) => fs11.promises.readFile(path14, "utf-8"),
       write: async (path14, content, options) => {
         const mode = normalizeMode(options?.mode);
         const writeOptions = {
@@ -32680,20 +32745,20 @@ var LocalInvocation = class _LocalInvocation extends Invocation {
         if (mode !== void 0) {
           writeOptions.mode = mode;
         }
-        await fs10.promises.writeFile(path14, content, writeOptions);
+        await fs11.promises.writeFile(path14, content, writeOptions);
       },
       exists: async (path14) => {
         try {
-          await fs10.promises.access(path14);
+          await fs11.promises.access(path14);
           return true;
         } catch {
           return false;
         }
       },
       mkdir: async (path14, options) => {
-        await fs10.promises.mkdir(path14, options);
+        await fs11.promises.mkdir(path14, options);
       },
-      rm: async (path14, options) => fs10.promises.rm(path14, options)
+      rm: async (path14, options) => fs11.promises.rm(path14, options)
     };
   }
   config;
@@ -32932,6 +32997,9 @@ import AdmZip from "adm-zip";
 
 // src/hash.ts
 import { createHash } from "crypto";
+function sha256(str) {
+  return createHash("sha256").update(str).digest("hex");
+}
 
 // src/param-map.ts
 import { match as match5 } from "ts-pattern";
@@ -33040,7 +33108,7 @@ function serializeError(value) {
   }
   return { error: String(value) };
 }
-async function run252(context) {
+async function run248(context) {
   const { params, ssh } = context;
   const { taskFn, params: taskParams } = params;
   const remoteResults = await ssh([], async (remoteContext) => {
@@ -33069,13 +33137,170 @@ async function run252(context) {
   });
   return Object.fromEntries(normalizedEntries);
 }
-var runAllRemote_default = task(run252, {
+var runAllRemote_default = task(run248, {
   description: "run a task on all selected hosts",
   inputSchema: RunParamsSchema,
   outputSchema: RunResultSchema
 });
 
+// src/task-cache.ts
+var DEFAULT_CACHE_MODE = "use";
+var LOCAL_HOST_SCOPE_KEY = "host:local";
+function normalizeValue(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (value === null) {
+    return null;
+  }
+  if (typeof value === "bigint") {
+    return value.toString();
+  }
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => {
+      const normalized = normalizeValue(item);
+      return normalized === void 0 ? null : normalized;
+    });
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    const sortedKeys = Object.keys(obj).sort();
+    const result = {};
+    for (const key of sortedKeys) {
+      const normalized = normalizeValue(obj[key]);
+      if (normalized !== void 0) {
+        result[key] = normalized;
+      }
+    }
+    return result;
+  }
+  return value;
+}
+function stableJson(value) {
+  const normalized = normalizeValue(value);
+  return JSON.stringify(normalized ?? null);
+}
+function normalizeCacheConfig(cache) {
+  if (!cache) {
+    return { enabled: false, mode: DEFAULT_CACHE_MODE };
+  }
+  if (cache === true) {
+    return { enabled: true, mode: DEFAULT_CACHE_MODE };
+  }
+  if (typeof cache === "string") {
+    return { enabled: true, scope: cache, mode: DEFAULT_CACHE_MODE };
+  }
+  return {
+    enabled: true,
+    scope: cache.scope,
+    key: cache.key,
+    ttlMs: cache.ttlMs,
+    mode: cache.mode ?? DEFAULT_CACHE_MODE
+  };
+}
+function buildTaskCacheKey(taskIdentity, params) {
+  const taskName = taskIdentity?.task?.name;
+  const modulePath = taskIdentity?.task?.taskModuleAbsolutePath;
+  const identity2 = taskName ?? (modulePath ? Path.new(modulePath).absolute().toString() : "unknown-task");
+  const paramsHash = sha256(stableJson(params ?? {}));
+  return `${identity2}:${paramsHash}`;
+}
+function buildHostScopeKey(host, configRef) {
+  if (!host) {
+    return LOCAL_HOST_SCOPE_KEY;
+  }
+  const identity2 = {
+    alias: host.alias ?? "",
+    hostname: host.hostname ?? "",
+    user: host.user ?? "",
+    port: host.port ?? 22,
+    config: configRef ?? ""
+  };
+  return `host:${sha256(stableJson(identity2))}`;
+}
+function buildInvocationScopeKey(rootInvocationId) {
+  return `invocation:${rootInvocationId}`;
+}
+var TaskCacheStore = class {
+  entries = /* @__PURE__ */ new Map();
+  runId;
+  constructor(runId) {
+    this.runId = runId ?? crypto.randomUUID();
+  }
+  globalScopeKey() {
+    return `global:${this.runId}`;
+  }
+  get(scopeKey, cacheKey2) {
+    const scope = this.entries.get(scopeKey);
+    if (!scope) {
+      return void 0;
+    }
+    const entry = scope.get(cacheKey2);
+    if (!entry) {
+      return void 0;
+    }
+    if (entry.expiresAt > 0 && Date.now() > entry.expiresAt) {
+      scope.delete(cacheKey2);
+      if (scope.size === 0) {
+        this.entries.delete(scopeKey);
+      }
+      return void 0;
+    }
+    return entry;
+  }
+  set(scopeKey, cacheKey2, value, ttlMs) {
+    const scope = this.entries.get(scopeKey) ?? /* @__PURE__ */ new Map();
+    const expiresAt = ttlMs && ttlMs > 0 ? Date.now() + ttlMs : 0;
+    const entry = { value, expiresAt };
+    scope.set(cacheKey2, entry);
+    this.entries.set(scopeKey, scope);
+    return entry;
+  }
+  delete(scopeKey, cacheKey2) {
+    const scope = this.entries.get(scopeKey);
+    if (!scope) {
+      return;
+    }
+    scope.delete(cacheKey2);
+    if (scope.size === 0) {
+      this.entries.delete(scopeKey);
+    }
+  }
+  async resolve(scopeKey, cacheKey2, compute, options = {}) {
+    const mode = options.mode ?? DEFAULT_CACHE_MODE;
+    if (mode === "bypass") {
+      return await compute();
+    }
+    if (mode === "use") {
+      const cached = this.get(scopeKey, cacheKey2);
+      if (cached) {
+        return await cached.value;
+      }
+    }
+    const promise = Promise.resolve().then(compute);
+    this.set(scopeKey, cacheKey2, promise, options.ttlMs);
+    try {
+      return await promise;
+    } catch (error) {
+      this.delete(scopeKey, cacheKey2);
+      throw error;
+    }
+  }
+};
+
 // src/app.ts
+function normalizePrivateKey2(value) {
+  if (!value.includes("\n") && value.includes("\\n")) {
+    return value.replace(/\\n/g, "\n");
+  }
+  return value;
+}
+function looksLikePrivateKey2(value) {
+  return /-----BEGIN [A-Z0-9 ]+PRIVATE KEY-----/.test(value);
+}
 var TaskTree = class {
   // private taskEventBus: Emittery<{ newTask: NewTaskEvent; taskComplete: TaskCompleteEvent }>;
   listr;
@@ -33171,6 +33396,7 @@ var App6 = class _App {
   outputStyle;
   _tmpDir;
   tmpFileRegistry;
+  taskCache;
   taskTree;
   verbosity = Verbosity.ERROR;
   passwordProvider;
@@ -33180,6 +33406,7 @@ var App6 = class _App {
     this.taskTree = new TaskTree();
     this.outputStyle = "plain";
     this.tmpFileRegistry = new TmpFileRegistry(this.hostctlTmpDir());
+    this.taskCache = new TaskCacheStore();
     this.configRef = void 0;
     this.hostSelector = void 0;
     process4.on("exit", (code) => this.appExitCallback());
@@ -33194,8 +33421,8 @@ var App6 = class _App {
   }
   get tmpDir() {
     if (!this._tmpDir) {
-      if (!fs11.existsSync(this.hostctlDir().toString())) {
-        fs11.mkdirSync(this.hostctlDir().toString(), { recursive: true });
+      if (!fs12.existsSync(this.hostctlDir().toString())) {
+        fs12.mkdirSync(this.hostctlDir().toString(), { recursive: true });
       }
       this._tmpDir = this.createNamedTmpDir(version);
     }
@@ -33209,10 +33436,11 @@ var App6 = class _App {
     this.configProvider = provider;
     if (provider instanceof FileConfigProvider) {
       this.configRef = provider.path;
+      this._config = await provider.getConfigFile();
     } else {
       this.configRef = "provider";
+      this._config = await ProviderConfig.load(provider);
     }
-    this._config = await ProviderConfig.load(provider);
   }
   isValidUrl(url) {
     try {
@@ -33416,9 +33644,28 @@ ${cmdRes.stderr.trim()}`));
         host: host.hostname,
         port: host.port,
         username: host.user,
-        password: hostPassword,
-        privateKeyPath: await host.plaintextSshKeyPath()
+        password: hostPassword
       };
+      const sshKeyPassphrase = await host.decryptedSshKeyPassphrase();
+      if (sshKeyPassphrase) {
+        sshConnection.passphrase = sshKeyPassphrase;
+      }
+      const decryptedKey = await host.decryptedSshKey();
+      if (decryptedKey) {
+        const normalizedKey = normalizePrivateKey2(decryptedKey).trim();
+        if (looksLikePrivateKey2(normalizedKey)) {
+          sshConnection.privateKey = normalizedKey;
+        } else if (fs12.existsSync(normalizedKey)) {
+          sshConnection.privateKeyPath = normalizedKey;
+        } else {
+          sshConnection.privateKey = normalizedKey;
+        }
+      } else {
+        const keyPath = await host.plaintextSshKeyPath();
+        if (keyPath) {
+          sshConnection.privateKeyPath = keyPath;
+        }
+      }
       const interactionHandler = InteractionHandler.with(withSudo(hostPassword));
       const session = new SSHSession();
       await session.connect(sshConnection);
@@ -33495,6 +33742,27 @@ ${cmdRes.stderr.trim()}`));
   }
   taskContextForRunFn(invocation, params, hostForContext) {
     const effectiveHost = hostForContext || invocation.host;
+    const rootInvocationId = (() => {
+      let current = invocation;
+      while (current.parent) {
+        current = current.parent;
+      }
+      return current.id;
+    })();
+    const defaultScope = () => effectiveHost ? "host" : "global";
+    const scopeKeyFor = (scope) => {
+      switch (scope) {
+        case "global":
+          return this.taskCache.globalScopeKey();
+        case "host":
+          return buildHostScopeKey(effectiveHost, this.configRef);
+        case "invocation":
+          return buildInvocationScopeKey(rootInvocationId);
+      }
+    };
+    const isTaskFn = (candidate) => {
+      return typeof candidate === "function" && !!candidate.task;
+    };
     return {
       // Properties from TaskContext
       params,
@@ -33524,8 +33792,58 @@ ${cmdRes.stderr.trim()}`));
       ssh: async (tags, remoteTaskFn) => {
         return await invocation.ssh(tags, remoteTaskFn);
       },
-      run: async (taskPartialFn) => {
-        return await invocation.run(taskPartialFn);
+      run: async (...args) => {
+        const [firstArg, secondArg, thirdArg] = args;
+        let taskPartialFn;
+        let taskIdentity;
+        let paramsForKey;
+        let options;
+        if (isTaskFn(firstArg)) {
+          taskIdentity = firstArg;
+          paramsForKey = secondArg ?? {};
+          options = thirdArg;
+          taskPartialFn = taskIdentity(paramsForKey);
+        } else {
+          taskPartialFn = firstArg;
+          options = secondArg;
+          const meta = taskPartialFn;
+          taskIdentity = meta.taskFn;
+          paramsForKey = meta.params;
+        }
+        const cacheDecision = normalizeCacheConfig(options?.cache);
+        if (!cacheDecision.enabled || cacheDecision.mode === "bypass") {
+          return await invocation.run(taskPartialFn);
+        }
+        const scope = cacheDecision.scope ?? defaultScope();
+        const cacheKey2 = cacheDecision.key ?? buildTaskCacheKey(taskIdentity, paramsForKey ?? {});
+        const scopeKey = scopeKeyFor(scope);
+        return await this.taskCache.resolve(scopeKey, cacheKey2, () => invocation.run(taskPartialFn), {
+          ttlMs: cacheDecision.ttlMs,
+          mode: cacheDecision.mode
+        });
+      },
+      memoize: async (key, valueOrFactory, options) => {
+        const cacheDecision = normalizeCacheConfig({
+          scope: options?.scope,
+          ttlMs: options?.ttlMs,
+          mode: options?.mode,
+          key
+        });
+        const scope = cacheDecision.scope ?? defaultScope();
+        const scopeKey = scopeKeyFor(scope);
+        const compute = async () => {
+          if (typeof valueOrFactory === "function") {
+            return await valueOrFactory();
+          }
+          return await valueOrFactory;
+        };
+        if (cacheDecision.mode === "bypass") {
+          return await compute();
+        }
+        return await this.taskCache.resolve(scopeKey, key, compute, {
+          ttlMs: cacheDecision.ttlMs,
+          mode: cacheDecision.mode
+        });
       },
       getPassword: async () => {
         return await invocation.getPassword();
@@ -33757,7 +34075,7 @@ ${cmdRes.stderr.trim()}`));
       await configFile.decryptAllIfPossible();
       const successfullyUsedIdentityPaths = configFile.loadPrivateKeys().filter((identity2) => {
         try {
-          return fs11.existsSync(identity2.identityFilePath);
+          return fs12.existsSync(identity2.identityFilePath);
         } catch (e) {
           return false;
         }