feat: edit monitors + notification channels; HTTP monitor insecure-TLS option

agent/internal/checker/checker.go

@@ -0,0 +1,226 @@
+// Package checker runs service checks (http/tcp/icmp/tls) and returns a uniform
+// Result. It has no dependency on models or pb so it can be duplicated verbatim
+// into the agent module (agent-run monitors) — callers map their own monitor
+// representation onto Spec.
+package checker
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+)
+
+// Check types (mirror models.Monitor* constants).
+const (
+	TypeHTTP = "http"
+	TypeTCP  = "tcp"
+	TypeICMP = "icmp"
+	TypeTLS  = "tls"
+)
+
+// Spec is a self-contained description of a single check.
+type Spec struct {
+	Type           string
+	URL            string
+	Host           string
+	Port           int
+	Method         string
+	ExpectedStatus int
+	Keyword        string
+	TLSWarnDays    int
+	Insecure       bool // skip TLS certificate verification (HTTP checks)
+	TimeoutSec     int
+}
+
+// Result is the uniform outcome of running a check.
+type Result struct {
+	Up         bool
+	LatencyMs  int
+	Message    string
+	CertExpiry *time.Time
+}
+
+func (s Spec) timeout() time.Duration {
+	t := s.TimeoutSec
+	if t <= 0 || t > 10 {
+		t = 10
+	}
+	return time.Duration(t) * time.Second
+}
+
+// Run executes the check described by s.
+func Run(ctx context.Context, s Spec) Result {
+	switch s.Type {
+	case TypeHTTP:
+		return runHTTP(ctx, s)
+	case TypeTCP:
+		return runTCP(ctx, s)
+	case TypeICMP:
+		return runICMP(ctx, s)
+	case TypeTLS:
+		return runTLS(ctx, s)
+	default:
+		return Result{Message: "unknown check type: " + s.Type}
+	}
+}
+
+func runHTTP(ctx context.Context, s Spec) Result {
+	method := s.Method
+	if method == "" {
+		method = http.MethodGet
+	}
+	expect := s.ExpectedStatus
+	if expect == 0 {
+		expect = 200
+	}
+	client := &http.Client{Timeout: s.timeout()}
+	if s.Insecure {
+		client.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec // opt-in per monitor
+	}
+	start := time.Now()
+	req, err := http.NewRequestWithContext(ctx, method, s.URL, nil)
+	if err != nil {
+		return Result{Message: err.Error()}
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	defer resp.Body.Close()
+	res := Result{LatencyMs: msSince(start), Up: true}
+	if resp.TLS != nil && len(resp.TLS.PeerCertificates) > 0 {
+		exp := resp.TLS.PeerCertificates[0].NotAfter
+		res.CertExpiry = &exp
+	}
+	if resp.StatusCode != expect {
+		return Result{LatencyMs: res.LatencyMs, CertExpiry: res.CertExpiry, Message: fmt.Sprintf("status %d (want %d)", resp.StatusCode, expect)}
+	}
+	if s.Keyword != "" {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+		if !strings.Contains(string(body), s.Keyword) {
+			return Result{LatencyMs: res.LatencyMs, CertExpiry: res.CertExpiry, Message: "keyword not found"}
+		}
+	}
+	return res
+}
+
+func runTCP(ctx context.Context, s Spec) Result {
+	addr := net.JoinHostPort(s.Host, fmt.Sprint(s.Port))
+	start := time.Now()
+	d := net.Dialer{Timeout: s.timeout()}
+	conn, err := d.DialContext(ctx, "tcp", addr)
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	conn.Close()
+	return Result{Up: true, LatencyMs: msSince(start)}
+}
+
+func runTLS(ctx context.Context, s Spec) Result {
+	port := s.Port
+	if port == 0 {
+		port = 443
+	}
+	addr := net.JoinHostPort(s.Host, fmt.Sprint(port))
+	start := time.Now()
+	d := net.Dialer{Timeout: s.timeout()}
+	conn, err := tls.DialWithDialer(&d, "tcp", addr, &tls.Config{ServerName: s.Host})
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	defer conn.Close()
+	certs := conn.ConnectionState().PeerCertificates
+	if len(certs) == 0 {
+		return Result{LatencyMs: msSince(start), Message: "no peer certificate"}
+	}
+	exp := certs[0].NotAfter
+	res := Result{LatencyMs: msSince(start), CertExpiry: &exp}
+	warn := s.TLSWarnDays
+	if warn <= 0 {
+		warn = 14
+	}
+	remaining := time.Until(exp)
+	if remaining <= 0 {
+		res.Message = "certificate expired"
+		return res
+	}
+	if remaining <= time.Duration(warn)*24*time.Hour {
+		res.Message = fmt.Sprintf("certificate expires in %d days", int(remaining.Hours()/24))
+		return res
+	}
+	res.Up = true
+	return res
+}
+
+func msSince(t time.Time) int { return int(time.Since(t).Milliseconds()) }
+
+// runICMP sends a single ICMP echo request and waits for the reply. Requires
+// raw-socket privileges (the agent and server run as root). Returns down with a
+// descriptive message when the socket cannot be opened or no reply arrives.
+func runICMP(ctx context.Context, s Spec) Result {
+	dst, err := net.ResolveIPAddr("ip4", s.Host)
+	if err != nil {
+		return Result{Message: err.Error()}
+	}
+	conn, err := net.ListenPacket("ip4:icmp", "0.0.0.0")
+	if err != nil {
+		return Result{Message: "icmp socket: " + err.Error()}
+	}
+	defer conn.Close()
+
+	id := os.Getpid() & 0xffff
+	pkt := icmpEcho(id, 1)
+	deadline := time.Now().Add(s.timeout())
+	if d, ok := ctx.Deadline(); ok && d.Before(deadline) {
+		deadline = d
+	}
+	_ = conn.SetDeadline(deadline)
+
+	start := time.Now()
+	if _, err := conn.WriteTo(pkt, dst); err != nil {
+		return Result{Message: err.Error()}
+	}
+	reply := make([]byte, 1500)
+	for {
+		n, peer, err := conn.ReadFrom(reply)
+		if err != nil {
+			return Result{LatencyMs: msSince(start), Message: "no reply"}
+		}
+		// Skip the IPv4 header (20 bytes) to reach the ICMP message.
+		if n < 28 || peer.String() != dst.String() {
+			continue
+		}
+		if reply[20] == 0 { // ICMP echo reply type
+			return Result{Up: true, LatencyMs: msSince(start)}
+		}
+	}
+}
+
+func icmpEcho(id, seq int) []byte {
+	// Type(8)=echo request, Code=0, Checksum, ID, Seq, no payload.
+	b := []byte{8, 0, 0, 0, byte(id >> 8), byte(id), byte(seq >> 8), byte(seq)}
+	cs := icmpChecksum(b)
+	b[2] = byte(cs >> 8)
+	b[3] = byte(cs)
+	return b
+}
+
+func icmpChecksum(b []byte) uint16 {
+	var sum uint32
+	for i := 0; i < len(b)-1; i += 2 {
+		sum += uint32(b[i])<<8 | uint32(b[i+1])
+	}
+	if len(b)%2 == 1 {
+		sum += uint32(b[len(b)-1]) << 8
+	}
+	for sum>>16 != 0 {
+		sum = (sum & 0xffff) + (sum >> 16)
+	}
+	return ^uint16(sum)
+}

agent/internal/grpc/client.go

@@ -126,6 +126,30 @@ func (c *Client) ReportUpdates(serverID, agentToken string, updates []pb.Package
 	return err
 }
 
+func (c *Client) ReportInventory(report *pb.InventoryReport) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	_, err := c.client.ReportInventory(ctx, report)
+	return err
+}
+
+func (c *Client) SyncMonitors(serverID, agentToken string) ([]pb.MonitorSpec, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	resp, err := c.client.SyncMonitors(ctx, &pb.SyncMonitorsRequest{ServerId: serverID, AgentToken: agentToken})
+	if err != nil {
+		return nil, err
+	}
+	return resp.Monitors, nil
+}
+
+func (c *Client) ReportChecks(serverID, agentToken string, results []pb.CheckResult) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	_, err := c.client.ReportChecks(ctx, &pb.ReportChecksRequest{ServerId: serverID, AgentToken: agentToken, Results: results})
+	return err
+}
+
 // CommandStream opens a long-lived bidirectional stream for server-pushed commands.
 // The caller controls the stream lifetime via ctx.
 func (c *Client) CommandStream(ctx context.Context) (pb.Vantage_CommandStreamClient, error) {

agent/internal/grpc/pb/vantage.pb.go

@@ -60,6 +60,75 @@ type ReportUpdatesRequest struct {
 
 type ReportUpdatesResponse struct{}
 
+// Inventory report message types
+
+type CPUReport struct {
+	Model    string  `json:"model,omitempty"`
+	Cores    int     `json:"cores,omitempty"`
+	UsagePct float64 `json:"usage_pct"`
+	Load1    float64 `json:"load1,omitempty"`
+}
+type MemReport struct {
+	TotalBytes uint64 `json:"total_bytes"`
+	UsedBytes  uint64 `json:"used_bytes"`
+}
+type PartitionReport struct {
+	Device     string `json:"device"`
+	Mountpoint string `json:"mountpoint"`
+	Fstype     string `json:"fstype,omitempty"`
+	TotalBytes uint64 `json:"total_bytes"`
+	UsedBytes  uint64 `json:"used_bytes"`
+}
+type InventoryReport struct {
+	ServerId      string            `json:"server_id"`
+	AgentToken    string            `json:"agent_token"`
+	IncludeStatic bool              `json:"include_static"`
+	CPU           *CPUReport        `json:"cpu,omitempty"`
+	Memory        *MemReport        `json:"memory,omitempty"`
+	SwapTotal     uint64            `json:"swap_total"`
+	SwapUsed      uint64            `json:"swap_used"`
+	Partitions    []PartitionReport `json:"partitions,omitempty"`
+	Kernel        string            `json:"kernel,omitempty"`
+}
+type InventoryReportResponse struct{}
+
+// Monitor sync / check report message types
+
+type MonitorSpec struct {
+	MonitorId      string `json:"monitor_id"`
+	Type           string `json:"type"`
+	URL            string `json:"url,omitempty"`
+	Host           string `json:"host,omitempty"`
+	Port           int    `json:"port,omitempty"`
+	Method         string `json:"method,omitempty"`
+	ExpectedStatus int    `json:"expected_status,omitempty"`
+	Keyword        string `json:"keyword,omitempty"`
+	TLSWarnDays    int    `json:"tls_warn_days,omitempty"`
+	Insecure       bool   `json:"insecure,omitempty"`
+	IntervalSec    int    `json:"interval_sec"`
+	Retries        int    `json:"retries"`
+}
+type SyncMonitorsRequest struct {
+	ServerId   string `json:"server_id"`
+	AgentToken string `json:"agent_token"`
+}
+type SyncMonitorsResponse struct {
+	Monitors []MonitorSpec `json:"monitors,omitempty"`
+}
+type CheckResult struct {
+	MonitorId      string `json:"monitor_id"`
+	Up             bool   `json:"up"`
+	LatencyMs      int    `json:"latency_ms"`
+	Message        string `json:"message,omitempty"`
+	CertExpiryUnix int64  `json:"cert_expiry_unix,omitempty"`
+}
+type ReportChecksRequest struct {
+	ServerId   string        `json:"server_id"`
+	AgentToken string        `json:"agent_token"`
+	Results    []CheckResult `json:"results,omitempty"`
+}
+type ReportChecksResponse struct{}
+
 type ApplyUpdatesCmd struct{}
 
 type ServerCommand struct {
@@ -190,6 +259,9 @@ type VantageClient interface {
 	SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error)
 	UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error)
 	ReportUpdates(ctx context.Context, in *ReportUpdatesRequest, opts ...grpc.CallOption) (*ReportUpdatesResponse, error)
+	ReportInventory(ctx context.Context, in *InventoryReport, opts ...grpc.CallOption) (*InventoryReportResponse, error)
+	SyncMonitors(ctx context.Context, in *SyncMonitorsRequest, opts ...grpc.CallOption) (*SyncMonitorsResponse, error)
+	ReportChecks(ctx context.Context, in *ReportChecksRequest, opts ...grpc.CallOption) (*ReportChecksResponse, error)
 	CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error)
 }
 
@@ -245,6 +317,30 @@ func (c *keyManagerClient) ReportUpdates(ctx context.Context, in *ReportUpdatesR
 	return out, nil
 }
 
+func (c *keyManagerClient) ReportInventory(ctx context.Context, in *InventoryReport, opts ...grpc.CallOption) (*InventoryReportResponse, error) {
+	out := new(InventoryReportResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/ReportInventory", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) SyncMonitors(ctx context.Context, in *SyncMonitorsRequest, opts ...grpc.CallOption) (*SyncMonitorsResponse, error) {
+	out := new(SyncMonitorsResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/SyncMonitors", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) ReportChecks(ctx context.Context, in *ReportChecksRequest, opts ...grpc.CallOption) (*ReportChecksResponse, error) {
+	out := new(ReportChecksResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/ReportChecks", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *keyManagerClient) CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error) {
 	desc := &grpc.StreamDesc{StreamName: "CommandStream", ServerStreams: true, ClientStreams: true}
 	stream, err := c.cc.NewStream(ctx, desc, "/vantage.v1.Vantage/CommandStream", opts...)

agent/internal/inventory/collect_linux.go

@@ -0,0 +1,157 @@
+//go:build linux
+
+package inventory
+
+import (
+	"bufio"
+	"os"
+	"strconv"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/mrhid6/vantage/agent/internal/grpc/pb"
+)
+
+func collect(r *pb.InventoryReport, includeStatic bool) {
+	r.CPU.UsagePct = cpuUsage()
+	r.CPU.Load1 = load1()
+	memTotal, memAvail, swapTotal, swapFree := meminfo()
+	if memTotal > memAvail {
+		r.Memory.UsedBytes = memTotal - memAvail
+	}
+	if swapTotal > swapFree {
+		r.SwapUsed = swapTotal - swapFree
+	}
+	if includeStatic {
+		r.Memory.TotalBytes = memTotal
+		r.SwapTotal = swapTotal
+		r.CPU.Model, r.CPU.Cores = cpuStatic()
+		r.Kernel = kernel()
+		r.Partitions = partitions()
+	}
+}
+
+func readProc(path string) string { b, _ := os.ReadFile(path); return string(b) }
+
+func cpuSample() (idle, total uint64) {
+	f, err := os.Open("/proc/stat")
+	if err != nil {
+		return
+	}
+	defer f.Close()
+	sc := bufio.NewScanner(f)
+	if sc.Scan() {
+		fields := strings.Fields(sc.Text()) // cpu user nice system idle iowait ...
+		for i, v := range fields[1:] {
+			n, _ := strconv.ParseUint(v, 10, 64)
+			total += n
+			if i == 3 { // idle
+				idle = n
+			}
+		}
+	}
+	return
+}
+
+func cpuUsage() float64 {
+	i1, t1 := cpuSample()
+	time.Sleep(100 * time.Millisecond)
+	i2, t2 := cpuSample()
+	dt := float64(t2 - t1)
+	if dt <= 0 {
+		return 0
+	}
+	return (1 - float64(i2-i1)/dt) * 100
+}
+
+func load1() float64 {
+	fields := strings.Fields(readProc("/proc/loadavg"))
+	if len(fields) > 0 {
+		v, _ := strconv.ParseFloat(fields[0], 64)
+		return v
+	}
+	return 0
+}
+
+func meminfo() (total, avail, swapTotal, swapFree uint64) {
+	f, err := os.Open("/proc/meminfo")
+	if err != nil {
+		return
+	}
+	defer f.Close()
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		fields := strings.Fields(sc.Text())
+		if len(fields) < 2 {
+			continue
+		}
+		kb, _ := strconv.ParseUint(fields[1], 10, 64)
+		b := kb * 1024
+		switch strings.TrimSuffix(fields[0], ":") {
+		case "MemTotal":
+			total = b
+		case "MemAvailable":
+			avail = b
+		case "SwapTotal":
+			swapTotal = b
+		case "SwapFree":
+			swapFree = b
+		}
+	}
+	return
+}
+
+func cpuStatic() (model string, cores int) {
+	f, err := os.Open("/proc/cpuinfo")
+	if err != nil {
+		return
+	}
+	defer f.Close()
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		line := sc.Text()
+		if strings.HasPrefix(line, "processor") {
+			cores++
+		} else if strings.HasPrefix(line, "model name") && model == "" {
+			if i := strings.Index(line, ":"); i >= 0 {
+				model = strings.TrimSpace(line[i+1:])
+			}
+		}
+	}
+	return
+}
+
+func kernel() string {
+	return strings.TrimSpace(readProc("/proc/sys/kernel/osrelease"))
+}
+
+func partitions() []pb.PartitionReport {
+	allowed := map[string]bool{"ext4": true, "xfs": true, "btrfs": true, "zfs": true, "vfat": true, "ntfs": true, "ext3": true}
+	f, err := os.Open("/proc/mounts")
+	if err != nil {
+		return nil
+	}
+	defer f.Close()
+	var out []pb.PartitionReport
+	seen := map[string]bool{}
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		fields := strings.Fields(sc.Text())
+		if len(fields) < 3 || !allowed[fields[2]] || seen[fields[1]] {
+			continue
+		}
+		seen[fields[1]] = true
+		var st syscall.Statfs_t
+		if syscall.Statfs(fields[1], &st) != nil {
+			continue
+		}
+		total := st.Blocks * uint64(st.Bsize)
+		free := st.Bavail * uint64(st.Bsize)
+		out = append(out, pb.PartitionReport{
+			Device: fields[0], Mountpoint: fields[1], Fstype: fields[2],
+			TotalBytes: total, UsedBytes: total - free,
+		})
+	}
+	return out
+}

agent/internal/inventory/collect_other.go

@@ -0,0 +1,8 @@
+//go:build !linux
+
+package inventory
+
+import "github.com/mrhid6/vantage/agent/internal/grpc/pb"
+
+// collect is a no-op best-effort stub on non-Linux platforms.
+func collect(r *pb.InventoryReport, includeStatic bool) {}

agent/internal/inventory/inventory.go

@@ -0,0 +1,11 @@
+package inventory
+
+import "github.com/mrhid6/vantage/agent/internal/grpc/pb"
+
+// Collect gathers metrics always and static hardware info when includeStatic.
+// Platform specifics are provided by collect_linux.go / collect_other.go.
+func Collect(includeStatic bool) *pb.InventoryReport {
+	r := &pb.InventoryReport{IncludeStatic: includeStatic, CPU: &pb.CPUReport{}, Memory: &pb.MemReport{}}
+	collect(r, includeStatic)
+	return r
+}

agent/internal/monitors/monitors.go

@@ -0,0 +1,166 @@
+// Package monitors runs agent-side service checks. It polls the server for the
+// monitors assigned to this agent (SyncMonitors), runs each on its own interval
+// using the local checker package, and reports results back (ReportChecks).
+package monitors
+
+import (
+	"context"
+	"log"
+	"sync"
+	"time"
+
+	"github.com/mrhid6/vantage/agent/internal/checker"
+	"github.com/mrhid6/vantage/agent/internal/config"
+	grpcclient "github.com/mrhid6/vantage/agent/internal/grpc"
+	"github.com/mrhid6/vantage/agent/internal/grpc/pb"
+)
+
+// syncInterval controls how often the agent re-fetches its assigned monitors.
+const syncInterval = 30 * time.Second
+
+type runner struct {
+	intervalSec int
+	cancel      context.CancelFunc
+}
+
+// Run starts the agent monitor loop and blocks until ctx is cancelled.
+func Run(ctx context.Context, cfg *config.Config) {
+	active := map[string]*runner{}
+	var mu sync.Mutex
+
+	// results is a shared channel every check writes to; a single reporter
+	// goroutine batches and ships them so we make one ReportChecks call per tick.
+	results := make(chan pb.CheckResult, 64)
+	go reporter(ctx, cfg, results)
+
+	syncOnce := func() {
+		specs, err := fetchSpecs(cfg)
+		if err != nil {
+			log.Printf("monitors: sync: %v", err)
+			return
+		}
+		want := map[string]pb.MonitorSpec{}
+		for _, s := range specs {
+			want[s.MonitorId] = s
+		}
+
+		mu.Lock()
+		defer mu.Unlock()
+		for id, r := range active {
+			s, ok := want[id]
+			if !ok || s.IntervalSec != r.intervalSec {
+				r.cancel()
+				delete(active, id)
+			}
+		}
+		for id, s := range want {
+			if _, ok := active[id]; ok {
+				continue
+			}
+			rctx, cancel := context.WithCancel(ctx)
+			active[id] = &runner{intervalSec: s.IntervalSec, cancel: cancel}
+			go runSpec(rctx, s, results)
+		}
+	}
+
+	syncOnce()
+	t := time.NewTicker(syncInterval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			syncOnce()
+		}
+	}
+}
+
+func fetchSpecs(cfg *config.Config) ([]pb.MonitorSpec, error) {
+	client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
+	if err != nil {
+		return nil, err
+	}
+	defer client.Close()
+	return client.SyncMonitors(cfg.ServerID, cfg.AgentToken)
+}
+
+func runSpec(ctx context.Context, s pb.MonitorSpec, out chan<- pb.CheckResult) {
+	interval := time.Duration(s.IntervalSec) * time.Second
+	if interval <= 0 {
+		interval = 60 * time.Second
+	}
+	spec := checker.Spec{
+		Type:           s.Type,
+		URL:            s.URL,
+		Host:           s.Host,
+		Port:           s.Port,
+		Method:         s.Method,
+		ExpectedStatus: s.ExpectedStatus,
+		Keyword:        s.Keyword,
+		TLSWarnDays:    s.TLSWarnDays,
+		Insecure:       s.Insecure,
+		TimeoutSec:     s.IntervalSec,
+	}
+
+	run := func() {
+		res := checker.Run(ctx, spec)
+		cr := pb.CheckResult{MonitorId: s.MonitorId, Up: res.Up, LatencyMs: res.LatencyMs, Message: res.Message}
+		if res.CertExpiry != nil {
+			cr.CertExpiryUnix = res.CertExpiry.Unix()
+		}
+		select {
+		case out <- cr:
+		case <-ctx.Done():
+		}
+	}
+
+	run()
+	t := time.NewTicker(interval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			run()
+		}
+	}
+}
+
+// reporter batches results on a short interval and ships each batch in one call.
+func reporter(ctx context.Context, cfg *config.Config, in <-chan pb.CheckResult) {
+	t := time.NewTicker(5 * time.Second)
+	defer t.Stop()
+	var batch []pb.CheckResult
+	flush := func() {
+		if len(batch) == 0 {
+			return
+		}
+		client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
+		if err != nil {
+			log.Printf("monitors: report dial: %v", err)
+			batch = nil
+			return
+		}
+		if err := client.ReportChecks(cfg.ServerID, cfg.AgentToken, batch); err != nil {
+			log.Printf("monitors: report: %v", err)
+		}
+		client.Close()
+		batch = nil
+	}
+	for {
+		select {
+		case <-ctx.Done():
+			flush()
+			return
+		case r := <-in:
+			batch = append(batch, r)
+			if len(batch) >= 32 {
+				flush()
+			}
+		case <-t.C:
+			flush()
+		}
+	}
+}

agent/internal/sync/sync.go

@@ -21,7 +21,9 @@ import (
 	agentexec "github.com/mrhid6/vantage/agent/internal/exec"
 	grpcclient "github.com/mrhid6/vantage/agent/internal/grpc"
 	"github.com/mrhid6/vantage/agent/internal/grpc/pb"
+	"github.com/mrhid6/vantage/agent/internal/inventory"
 	"github.com/mrhid6/vantage/agent/internal/keys"
+	"github.com/mrhid6/vantage/agent/internal/monitors"
 	"github.com/mrhid6/vantage/agent/internal/updates"
 )
 
@@ -68,6 +70,12 @@ func Run(ctx context.Context, cfg *config.Config, version string) error {
 	// Check for OS updates on startup and then hourly.
 	go runUpdateCheck(ctx, cfg)
 
+	// Report host inventory: metrics every 30s, full static snapshot every 15 min.
+	go runInventory(ctx, cfg)
+
+	// Run agent-side service monitors assigned to this server.
+	go monitors.Run(ctx, cfg)
+
 	ticker := time.NewTicker(cfg.PollInterval)
 	defer ticker.Stop()
 
@@ -272,6 +280,40 @@ func runUpdateCheck(ctx context.Context, cfg *config.Config) {
 	}
 }
 
+// runInventory reports host metrics every 30s and a full static snapshot every
+// 15 min (and once immediately on startup so static fields populate without delay).
+func runInventory(ctx context.Context, cfg *config.Config) {
+	client, err := grpcclient.New(cfg.ServerURL, cfg.TLS)
+	if err != nil {
+		log.Printf("inventory dial error: %v", err)
+		return
+	}
+	defer client.Close()
+
+	report := func(static bool) {
+		r := inventory.Collect(static)
+		r.ServerId = cfg.ServerID
+		r.AgentToken = cfg.AgentToken
+		if err := client.ReportInventory(r); err != nil {
+			log.Printf("report inventory: %v", err)
+		}
+	}
+
+	report(true) // full snapshot on startup
+	ticker := time.NewTicker(30 * time.Second)
+	defer ticker.Stop()
+	tick := 0
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			tick++
+			report(tick%30 == 0) // every 30th tick = 15 min → include static
+		}
+	}
+}
+
 func handleApplyUpdates(cfg *config.Config, cmd *pb.ServerCommand) {
 	log.Printf("applying OS updates (cmd=%s)…", cmd.CommandId)
 	if err := updates.ApplyAll(); err != nil {

deploy/docker-compose.yml

@@ -36,10 +36,13 @@ services:
       OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
       OIDC_REDIRECT_URL: ${OIDC_REDIRECT_URL:-}
       KEY_ENCRYPTION_KEY: ${KEY_ENCRYPTION_KEY:-}
+      VANTAGE_WORKFLOW_LOG_DIR: ${VANTAGE_WORKFLOW_LOG_DIR:-}
       GUACD_ADDR: guacd:4822
     depends_on:
       redis:
         condition: service_healthy
+    volumes:
+      - ./data:/data
   web:
     image: gitea.hostxtra.co.uk/mrhid6/vantage/web:latest
     restart: unless-stopped

docs/superpowers/plans/2026-07-20-fleet-inventory.md

@@ -645,9 +645,222 @@ git commit -m "fix: fleet inventory verification fixes"
 
 ---
 
+# Service Monitoring (uptime-kuma replacement)
+
+Extends the fleet work: in-app service monitors replacing uptime-kuma. Monitors (HTTP/TCP/ICMP/TLS) run **server-side** (public endpoints) or **agent-side** (agent probes its own host). Both runners feed one server-side ingest pipeline: state → incidents → rollups → notifications.
+
+**Design:** validated in brainstorm 2026-07-21. Hybrid runners, all 4 check types, latest+incidents+rollups history, multi-channel notify (webhook/SMTP/Discord/Slack/Telegram), dedicated `SyncMonitors`/`ReportChecks` RPCs.
+
+**Build order — 3 phases, each shippable:**
+- **P1 (Tasks 7–10):** data model, checker pkg, server scheduler, ingest pipeline, `/monitors` UI. Server-run only. No agent, no notify.
+- **P2 (Tasks 11–12):** `SyncMonitors` + `ReportChecks` RPCs, agent checker + scheduler, agent-run monitors bound to a server.
+- **P3 (Tasks 13–14):** notification channels + dispatch + settings UI.
+
+## Monitoring Global Constraints
+
+- Same as fleet: no tests this iteration; verify with `go build ./...`, `go vet ./...`, `npm run build`. JSON-codec gRPC — edit both pb files identically, mirror `ReportUpdates` wiring. Separate Go modules, so the checker pkg is **duplicated** in `server/` and `agent/` (same convention as pb files).
+- Reuse existing patterns: REST handlers like `server/internal/api`, services like `server/internal/services/servers.go`, `db.Col(...)`, react-query + Tailwind UI like `web/app/servers`.
+
+---
+
+## Task 7: Monitoring data model + checker package (server)
+
+**Files:**
+- Create: `server/internal/models/monitor.go`
+- Create: `server/internal/checker/checker.go` (+ `http.go`, `tcp.go`, `icmp.go`, `tls.go`)
+
+**Interfaces:**
+- Produces: `models.Monitor` (+ `MonitorState`, `MonitorTarget`), `models.Incident`, `models.Rollup`. `checker.Run(ctx, models.Monitor) checker.Result` where `Result{Up bool; LatencyMs int; Message string; CertExpiry *time.Time}`.
+
+- [ ] **Step 1: Model**
+
+```go
+type MonitorTarget struct {
+	URL            string `bson:"url,omitempty" json:"url,omitempty"`
+	Host           string `bson:"host,omitempty" json:"host,omitempty"`
+	Port           int    `bson:"port,omitempty" json:"port,omitempty"`
+	Method         string `bson:"method,omitempty" json:"method,omitempty"`
+	ExpectedStatus int    `bson:"expected_status,omitempty" json:"expected_status,omitempty"`
+	Keyword        string `bson:"keyword,omitempty" json:"keyword,omitempty"`
+	TLSWarnDays    int    `bson:"tls_warn_days,omitempty" json:"tls_warn_days,omitempty"`
+}
+type MonitorState struct {
+	Status       string     `bson:"status" json:"status"` // up|down|pending
+	LastCheckAt  *time.Time `bson:"last_check_at,omitempty" json:"last_check_at,omitempty"`
+	LatencyMs    int        `bson:"latency_ms" json:"latency_ms"`
+	Message      string     `bson:"message,omitempty" json:"message,omitempty"`
+	CertExpiryAt *time.Time `bson:"cert_expiry_at,omitempty" json:"cert_expiry_at,omitempty"`
+	Fails        int        `bson:"fails" json:"fails"` // consecutive failures
+}
+type Monitor struct {
+	MonitorID   string        `bson:"monitor_id" json:"monitor_id"`
+	Name        string        `bson:"name" json:"name"`
+	Type        string        `bson:"type" json:"type"` // http|tcp|icmp|tls
+	Target      MonitorTarget `bson:"target" json:"target"`
+	IntervalSec int           `bson:"interval_sec" json:"interval_sec"`
+	Runner      string        `bson:"runner" json:"runner"` // "server" or a server_id
+	Retries     int           `bson:"retries" json:"retries"` // consecutive fails before down
+	Enabled     bool          `bson:"enabled" json:"enabled"`
+	ChannelIDs  []string      `bson:"channel_ids,omitempty" json:"channel_ids,omitempty"`
+	State       MonitorState  `bson:"state" json:"state"`
+	CreatedAt   time.Time     `bson:"created_at" json:"created_at"`
+}
+type Incident struct {
+	IncidentID string     `bson:"incident_id" json:"incident_id"`
+	MonitorID  string     `bson:"monitor_id" json:"monitor_id"`
+	StartedAt  time.Time  `bson:"started_at" json:"started_at"`
+	ResolvedAt *time.Time `bson:"resolved_at,omitempty" json:"resolved_at,omitempty"`
+	Cause      string     `bson:"cause,omitempty" json:"cause,omitempty"`
+}
+type Rollup struct {
+	MonitorID   string    `bson:"monitor_id" json:"monitor_id"`
+	PeriodStart time.Time `bson:"period_start" json:"period_start"` // hour bucket
+	Checks      int       `bson:"checks" json:"checks"`
+	UpCount     int       `bson:"up_count" json:"up_count"`
+	SumLatency  int64     `bson:"sum_latency" json:"sum_latency"`
+}
+```
+
+- [ ] **Step 2: Checker package** — `Run(ctx, m)` switches on `m.Type`:
+  - **http**: `http.Client` GET/HEAD `m.Target.URL`, assert status == ExpectedStatus (default 200), optional `Keyword` body contains; capture TLS peer cert expiry when https.
+  - **tcp**: `net.DialTimeout("tcp", host:port)`, latency = dial time.
+  - **icmp**: raw ICMP echo (agent/server run as root). Fall back to `net.Dial("ip4:icmp")`; on permission error return down with message.
+  - **tls**: `tls.Dial`, read `ConnectionState().PeerCertificates[0].NotAfter` → `CertExpiry`; down if within `TLSWarnDays` or expired.
+  - All: wrap with per-check timeout (min(IntervalSec, 10s)); `Result.Message` = short reason on failure.
+
+- [ ] **Step 3: Verify build** — `cd server && go build ./... && go vet ./...`
+
+- [ ] **Step 4: Commit** — `feat(server): monitor model + checker package`
+
+---
+
+## Task 8: Ingest pipeline + rollups service
+
+**Files:**
+- Create: `server/internal/services/monitors.go`
+
+**Interfaces:**
+- Produces: `IngestResult(monitorID string, res checker.Result) error` — the single entry both runners use. `ListMonitors`, `GetMonitor`, `CreateMonitor`, `UpdateMonitor`, `DeleteMonitor`, `ListIncidents(monitorID)`, `UptimeRollups(monitorID, since)`.
+
+- [ ] **Step 1: `IngestResult`** — load monitor; compute new status with `Retries` threshold (increment `state.Fails` on failure, flip to `down` only when `Fails >= Retries`; reset + flip `up` on success). On **transition**: open incident (`down`) or resolve open incident (`up`), and enqueue notification (P3 — leave a `// TODO(P3): dispatch` hook now). Always `$set` state fields. Upsert current-hour `Rollup` (`$inc` checks/up_count/sum_latency). Use `db.Col("monitors")`, `db.Col("incidents")`, `db.Col("monitor_rollups")`, `context.WithTimeout`.
+
+- [ ] **Step 2: CRUD + queries** — standard service funcs mirroring `services/servers.go`. `UptimeRollups` aggregates buckets since a cutoff → uptime % + avg latency series.
+
+- [ ] **Step 3: Verify build** — `go build ./... && go vet ./...`
+
+- [ ] **Step 4: Commit** — `feat(server): monitor ingest pipeline, incidents, rollups`
+
+---
+
+## Task 9: Server scheduler + REST API
+
+**Files:**
+- Create: `server/internal/monitorsched/scheduler.go`
+- Create: `server/internal/api/monitors.go`
+- Modify: server bootstrap (wherever services/gRPC start) to launch the scheduler; router registration where `api` routes are mounted.
+
+**Interfaces:**
+- Produces: a scheduler that ticks enabled `runner=="server"` monitors on their `IntervalSec` and calls `checker.Run` → `services.IngestResult`. REST: `GET/POST /api/monitors`, `GET/PUT/DELETE /api/monitors/:id`, `GET /api/monitors/:id/incidents`, `GET /api/monitors/:id/uptime`.
+
+- [ ] **Step 1: Scheduler** — on boot load monitors; per-monitor goroutine or a min-heap wheel keyed on next-run. Only `runner=="server"`. Reload on CRUD (simplest: re-read every N sec, or a reload channel fired by the service). Skip disabled.
+
+- [ ] **Step 2: REST handlers** — mirror an existing `server/internal/api` handler file for style + auth middleware. JSON in/out of `models.Monitor`.
+
+- [ ] **Step 3: Verify build** — `go build ./... && go vet ./...`
+
+- [ ] **Step 4: Commit** — `feat(server): server-run monitor scheduler + REST API`
+
+---
+
+## Task 10: Frontend — monitors UI (P1)
+
+**Files:**
+- Modify: `web/lib/api.ts` (Monitor types + bindings)
+- Create: `web/app/monitors/page.tsx` (list), `web/app/monitors/[id]/page.tsx` (detail), `web/app/monitors/new/page.tsx` (create/edit form)
+- Modify: main nav to add **Monitors** (same place Steps was added)
+
+**Interfaces:**
+- Consumes: `/api/monitors*` (T9).
+
+- [ ] **Step 1: Types + api bindings** — `Monitor`, `MonitorState`, `Incident`, uptime series; `api.monitors.list/get/create/update/remove/incidents/uptime`.
+- [ ] **Step 2: List page** — table: name, type, status badge (up/down/pending), uptime % (24h), latency, last check. `refetchInterval: 30000`.
+- [ ] **Step 3: Detail page** — status header, heartbeat/uptime bars (24h + 30d from rollups), latency chart, incident timeline, cert expiry, assigned channels (read-only until P3).
+- [ ] **Step 4: Create/edit form** — type-dependent fields (URL vs host/port), interval, retries, runner select (`server` or a registered server for agent-run — server option only wired in P2), enabled.
+- [ ] **Step 5: Verify build** — `cd web && npm run build`
+- [ ] **Step 6: Commit** — `feat(web): monitors list/detail/form UI`
+
+---
+
+## Task 11: SyncMonitors + ReportChecks RPCs (P2)
+
+**Files:**
+- Modify: `proto/vantage/v1/vantage.proto`, `server/internal/grpc/pb/vantage.pb.go`, `agent/internal/grpc/pb/vantage.pb.go`, `server/internal/grpc/server.go`, `agent/internal/grpc/client.go`
+
+**Interfaces:**
+- Produces: `SyncMonitors(server_id, agent_token) -> repeated MonitorSpec`; `ReportChecks(server_id, agent_token, repeated CheckResult) -> ReportChecksResponse`. `MonitorSpec{monitor_id, type, target fields, interval_sec, retries}`. `CheckResult{monitor_id, up, latency_ms, message, cert_expiry_unix}`.
+
+- [ ] **Step 1: pb structs + proto** — add messages to both pb files + proto doc.
+- [ ] **Step 2: Wire both RPCs** — mirror `ReportUpdates` plumbing (interface, Unimplemented stub, client method, `Vantage_ServiceDesc.Methods`, `_Vantage_*_Handler`) in both pb files. Server handlers on `vantageServer` (after `ReportUpdates` at server.go:78): `SyncMonitors` returns monitors where `runner==req.ServerId && enabled`; `ReportChecks` validates token then loops `services.IngestResult`. Client methods on `*Client` in client.go (after `ReportUpdates` at client.go:117).
+- [ ] **Step 3: Verify build** — both modules `go build ./... && go vet ./...`
+- [ ] **Step 4: Commit** — `feat(proto): SyncMonitors + ReportChecks RPCs`
+
+---
+
+## Task 12: Agent checker + scheduler (P2)
+
+**Files:**
+- Create: `agent/internal/checker/` (duplicate of server checker pkg)
+- Create: `agent/internal/monitors/monitors.go` (poll + run + report loop)
+- Modify: agent main loop to start it (alongside the sync loop in `agent/internal/sync` / the inventory ticker from Task 4)
+
+**Interfaces:**
+- Consumes: `client.SyncMonitors`, `client.ReportChecks`, agent `checker`.
+
+- [ ] **Step 1: Duplicate checker pkg** into agent module (identical logic; imports agent pb).
+- [ ] **Step 2: Monitor loop** — poll `SyncMonitors` every 30s for assigned specs; per-spec ticker on `IntervalSec` runs `checker.Run`; batch `CheckResult`s and `ReportChecks`. `serverID`/`agentToken`/`*Client` in scope from the existing loop.
+- [ ] **Step 3: Verify build** — `cd agent && go build ./... && go vet ./...` (+ `GOOS=windows go build ./...`; icmp may no-op on Windows).
+- [ ] **Step 4: Commit** — `feat(agent): agent-run monitor scheduler`
+
+---
+
+## Task 13: Notification channels + dispatch (P3)
+
+**Files:**
+- Create: `server/internal/models/channel.go`, `server/internal/services/channels.go`, `server/internal/notify/` (`dispatch.go`, `webhook.go`, `smtp.go`, `discord.go`, `slack.go`, `telegram.go`), `server/internal/api/channels.go`
+- Modify: `server/internal/services/monitors.go` (replace the P2 `// TODO(P3): dispatch` hook)
+
+**Interfaces:**
+- Produces: `models.NotificationChannel{channel_id, name, type, config map, enabled}`. `notify.Dispatch(channel, event)` where `event` = monitor + old/new status + message. `notify.Test(channel)`.
+
+- [ ] **Step 1: Model + CRUD service + REST** (`/api/channels*`, incl. `POST /api/channels/:id/test`).
+- [ ] **Step 2: Dispatch abstraction** — webhook/discord/slack/telegram are HTTP POST with per-type JSON payload; SMTP via `net/smtp`. Per-monitor routing via `monitor.ChannelIDs`; resend interval so an ongoing `down` re-alerts at most every N min (track `last_notified_at` on monitor state).
+- [ ] **Step 3: Fire on transition** — in `IngestResult`, on up/down flip resolve channels and `notify.Dispatch` each (goroutine, best-effort, log failures).
+- [ ] **Step 4: Verify build** — `go build ./... && go vet ./...`
+- [ ] **Step 5: Commit** — `feat(server): multi-channel monitor notifications`
+
+---
+
+## Task 14: Frontend — notification settings (P3)
+
+**Files:**
+- Modify: `web/lib/api.ts` (channel types + bindings), `web/app/settings/` (add notifications section/page)
+- Modify: monitor create/edit form (Task 10) to select channels
+
+**Interfaces:**
+- Consumes: `/api/channels*`.
+
+- [ ] **Step 1: Channel types + api bindings.**
+- [ ] **Step 2: Settings UI** — list/add/edit channels, type-dependent config fields, **Test** button hitting `/api/channels/:id/test`.
+- [ ] **Step 3: Wire channel multi-select** into the monitor form.
+- [ ] **Step 4: Verify build** — `cd web && npm run build`
+- [ ] **Step 5: Commit** — `feat(web): notification channel settings UI`
+
+---
+
 ## Self-Review Notes
 
 - **Spec coverage:** §3 model → T1; §4 RPC → T1; §5 collectors + scheduler → T3, T4; §6 handler/store → T2; §7 frontend → T5. Split cadence (30s metrics / 15m static) in T4 scheduler; merge rules preserving static in T2 `StoreInventory`. Tests omitted per Global Constraints.
 - **Startup snapshot:** agent sends `Collect(true)` immediately so static fields populate without waiting 15 min.
 - **Types consistent:** `InventoryReport` field names identical across proto, both pb files, store service, and TS interface (`usage_pct`, `used_bytes`, `total_bytes`, `swap_*`).
 - **Follow-ups (out of scope):** time-series history, usage alerting, Windows collectors, servers-list CPU/RAM badges.
+- **Monitoring (Tasks 7–14):** hybrid runner service-monitor replacing uptime-kuma, added 2026-07-21. 3 phases — P1 server-run engine+UI (T7–10), P2 agent-run RPCs (T11–12), P3 multi-channel notify (T13–14). Single `IngestResult` pipeline for both runners; checker pkg duplicated per module (pb convention). Design: brainstorm 2026-07-21. Follow-ups out of scope: status pages, maintenance windows, per-check auth headers, ICMP on Windows.

proto/vantage/v1/vantage.proto

@@ -9,6 +9,9 @@ service Vantage {
   rpc SyncKeys(SyncRequest)                    returns (SyncResponse);
   rpc UploadGeneratedKey(UploadKeyRequest)      returns (UploadKeyResponse);
   rpc ReportUpdates(ReportUpdatesRequest)       returns (ReportUpdatesResponse);
+  rpc ReportInventory(InventoryReport)          returns (InventoryReportResponse);
+  rpc SyncMonitors(SyncMonitorsRequest)         returns (SyncMonitorsResponse);
+  rpc ReportChecks(ReportChecksRequest)         returns (ReportChecksResponse);
   // Bidirectional stream: agent sends auth once, server pushes commands.
   rpc CommandStream(stream AgentMessage)        returns (stream ServerCommand);
 }
@@ -82,6 +85,80 @@ message ReportUpdatesRequest {
 
 message ReportUpdatesResponse {}
 
+message CPUReport {
+  string model     = 1;
+  int32  cores     = 2;
+  double usage_pct = 3;
+  double load1     = 4;
+}
+
+message MemReport {
+  uint64 total_bytes = 1;
+  uint64 used_bytes  = 2;
+}
+
+message PartitionReport {
+  string device      = 1;
+  string mountpoint  = 2;
+  string fstype      = 3;
+  uint64 total_bytes = 4;
+  uint64 used_bytes  = 5;
+}
+
+message InventoryReport {
+  string server_id      = 1;
+  string agent_token    = 2;
+  bool   include_static = 3;
+  CPUReport cpu         = 4;
+  MemReport memory      = 5;
+  uint64 swap_total     = 6;
+  uint64 swap_used      = 7;
+  repeated PartitionReport partitions = 8;
+  string kernel         = 9;
+}
+
+message InventoryReportResponse {}
+
+message MonitorSpec {
+  string monitor_id      = 1;
+  string type            = 2;
+  string url             = 3;
+  string host            = 4;
+  int32  port            = 5;
+  string method          = 6;
+  int32  expected_status = 7;
+  string keyword         = 8;
+  int32  tls_warn_days   = 9;
+  int32  interval_sec    = 10;
+  int32  retries         = 11;
+  bool   insecure        = 12;
+}
+
+message SyncMonitorsRequest {
+  string server_id   = 1;
+  string agent_token = 2;
+}
+
+message SyncMonitorsResponse {
+  repeated MonitorSpec monitors = 1;
+}
+
+message CheckResult {
+  string monitor_id       = 1;
+  bool   up               = 2;
+  int32  latency_ms       = 3;
+  string message          = 4;
+  int64  cert_expiry_unix = 5;
+}
+
+message ReportChecksRequest {
+  string server_id   = 1;
+  string agent_token = 2;
+  repeated CheckResult results = 3;
+}
+
+message ReportChecksResponse {}
+
 message ApplyUpdatesCmd {}
 
 message ServerCommand {

server/cmd/main.go

@@ -11,6 +11,7 @@ import (
 	"github.com/mrhid6/vantage/server/internal/auth"
 	"github.com/mrhid6/vantage/server/internal/db"
 	grpcserver "github.com/mrhid6/vantage/server/internal/grpc"
+	"github.com/mrhid6/vantage/server/internal/monitorsched"
 	"github.com/mrhid6/vantage/server/internal/services"
 )
 
@@ -31,6 +32,12 @@ func main() {
 		log.Printf("warning: failed to ensure workflow indexes: %v", err)
 	}
 
+	if created, updated, err := services.SeedDefaultSteps(); err != nil {
+		log.Printf("warning: failed to seed default steps: %v", err)
+	} else {
+		log.Printf("default steps seeded: %d created, %d updated", created, updated)
+	}
+
 	services.StartLogSweeper()
 
 	redisAddr := getEnv("REDIS_ADDR", "localhost:6379")
@@ -61,6 +68,9 @@ func main() {
 		}
 	}()
 
+	// Start the server-side monitor scheduler.
+	monitorsched.Start(context.Background())
+
 	// Start REST server
 	r := gin.New()
 	r.Use(gin.Recovery())

server/internal/api/channels.go

@@ -0,0 +1,96 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+func registerChannelRoutes(g *gin.RouterGroup) {
+	g.GET("/channels", listChannels)
+	g.POST("/channels", createChannel)
+	g.PUT("/channels/:id", updateChannel)
+	g.DELETE("/channels/:id", deleteChannel)
+	g.POST("/channels/:id/test", testChannel)
+}
+
+func listChannels(c *gin.Context) {
+	channels, err := services.ListChannels()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, channels)
+}
+
+func createChannel(c *gin.Context) {
+	var ch models.NotificationChannel
+	if err := c.ShouldBindJSON(&ch); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if ch.Name == "" || ch.Type == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "name and type are required"})
+		return
+	}
+	created, err := services.CreateChannel(&ch)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusCreated, created)
+}
+
+func updateChannel(c *gin.Context) {
+	var body struct {
+		Name    *string            `json:"name"`
+		Type    *string            `json:"type"`
+		Config  *map[string]string `json:"config"`
+		Enabled *bool              `json:"enabled"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	upd := bson.M{}
+	if body.Name != nil {
+		upd["name"] = *body.Name
+	}
+	if body.Type != nil {
+		upd["type"] = *body.Type
+	}
+	if body.Config != nil {
+		upd["config"] = *body.Config
+	}
+	if body.Enabled != nil {
+		upd["enabled"] = *body.Enabled
+	}
+	if len(upd) == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "no fields to update"})
+		return
+	}
+	if err := services.UpdateChannel(c.Param("id"), upd); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func deleteChannel(c *gin.Context) {
+	if err := services.DeleteChannel(c.Param("id")); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func testChannel(c *gin.Context) {
+	if err := services.TestChannel(c.Param("id")); err != nil {
+		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"status": "sent"})
+}

server/internal/api/handlers.go

@@ -80,6 +80,8 @@ func RegisterRoutes(r *gin.Engine) {
 		apiGroup.GET("/console/tunnel", consoleTunnel)
 
 		registerWorkflowRoutes(apiGroup)
+		registerMonitorRoutes(apiGroup)
+		registerChannelRoutes(apiGroup)
 	}
 }
 

server/internal/api/monitors.go

@@ -0,0 +1,139 @@
+package api
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+func registerMonitorRoutes(g *gin.RouterGroup) {
+	g.GET("/monitors", listMonitors)
+	g.POST("/monitors", createMonitor)
+	g.GET("/monitors/:id", getMonitor)
+	g.PUT("/monitors/:id", updateMonitor)
+	g.DELETE("/monitors/:id", deleteMonitor)
+	g.GET("/monitors/:id/incidents", getMonitorIncidents)
+	g.GET("/monitors/:id/uptime", getMonitorUptime)
+}
+
+func listMonitors(c *gin.Context) {
+	monitors, err := services.ListMonitors()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, monitors)
+}
+
+func createMonitor(c *gin.Context) {
+	var m models.Monitor
+	if err := c.ShouldBindJSON(&m); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if m.Name == "" || m.Type == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "name and type are required"})
+		return
+	}
+	created, err := services.CreateMonitor(&m)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusCreated, created)
+}
+
+func getMonitor(c *gin.Context) {
+	m, err := services.GetMonitor(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if m == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "monitor not found"})
+		return
+	}
+	c.JSON(http.StatusOK, m)
+}
+
+func updateMonitor(c *gin.Context) {
+	var body struct {
+		Name        *string               `json:"name"`
+		Type        *string               `json:"type"`
+		Target      *models.MonitorTarget `json:"target"`
+		IntervalSec *int                  `json:"interval_sec"`
+		Runner      *string               `json:"runner"`
+		Retries     *int                  `json:"retries"`
+		Enabled     *bool                 `json:"enabled"`
+		ChannelIDs  *[]string             `json:"channel_ids"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	upd := bson.M{}
+	if body.Name != nil {
+		upd["name"] = *body.Name
+	}
+	if body.Type != nil {
+		upd["type"] = *body.Type
+	}
+	if body.Target != nil {
+		upd["target"] = *body.Target
+	}
+	if body.IntervalSec != nil {
+		upd["interval_sec"] = *body.IntervalSec
+	}
+	if body.Runner != nil {
+		upd["runner"] = *body.Runner
+	}
+	if body.Retries != nil {
+		upd["retries"] = *body.Retries
+	}
+	if body.Enabled != nil {
+		upd["enabled"] = *body.Enabled
+	}
+	if body.ChannelIDs != nil {
+		upd["channel_ids"] = *body.ChannelIDs
+	}
+	if len(upd) == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "no fields to update"})
+		return
+	}
+	if err := services.UpdateMonitor(c.Param("id"), upd); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func deleteMonitor(c *gin.Context) {
+	if err := services.DeleteMonitor(c.Param("id")); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+func getMonitorIncidents(c *gin.Context) {
+	incidents, err := services.ListIncidents(c.Param("id"), 50)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, incidents)
+}
+
+func getMonitorUptime(c *gin.Context) {
+	since := time.Now().Add(-30 * 24 * time.Hour)
+	rollups, err := services.UptimeRollups(c.Param("id"), since)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, rollups)
+}

server/internal/api/workflows.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"fmt"
+	"io"
 	"net/http"
 	"os"
 	"regexp"
@@ -19,6 +20,11 @@ func registerWorkflowRoutes(g *gin.RouterGroup) {
 	g.POST("/steps", createStep)
 	g.PUT("/steps/:id", updateStep)
 	g.DELETE("/steps/:id", deleteStep)
+	g.GET("/steps/:id/export", exportStep)
+	g.POST("/steps/import", importStep)
+	g.POST("/steps/seed-defaults", seedDefaults)
+	g.GET("/steps/usage", stepUsage)
+	g.POST("/steps/parse", parseStep)
 
 	g.GET("/workflows", listWorkflows)
 	g.POST("/workflows", createWorkflow)
@@ -149,6 +155,15 @@ func listSteps(c *gin.Context) {
 	c.JSON(http.StatusOK, steps)
 }
 
+func stepUsage(c *gin.Context) {
+	counts, err := services.StepUsageCounts()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, counts)
+}
+
 func createStep(c *gin.Context) {
 	var s models.WorkflowStep
 	if err := c.ShouldBindJSON(&s); err != nil {
@@ -187,6 +202,61 @@ func deleteStep(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"deleted": true})
 }
 
+func exportStep(c *gin.Context) {
+	b, err := services.ExportStep(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return
+	}
+	c.Header("Content-Disposition", fmt.Sprintf("attachment; filename=step-%s.json", c.Param("id")))
+	c.Data(http.StatusOK, "application/json", b)
+}
+
+func seedDefaults(c *gin.Context) {
+	created, updated, err := services.SeedDefaultSteps()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent("workflow.defaults_synced", actorFromCtx(c), "", "", fmt.Sprintf("default steps synced: %d created, %d updated", created, updated))
+	c.JSON(http.StatusOK, gin.H{"created": created, "updated": updated})
+}
+
+const maxStepBodyBytes = 1 << 20 // 1 MiB
+
+func importStep(c *gin.Context) {
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, maxStepBodyBytes)
+	body, err := io.ReadAll(c.Request.Body)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	out, err := services.ImportStepToLibrary(body)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	services.LogEvent("workflow.step_imported", actorFromCtx(c), "", out.StepID, fmt.Sprintf("step '%s' imported", out.Name))
+	c.JSON(http.StatusCreated, out)
+}
+
+// parseStep validates a step doc and returns the normalized step WITHOUT
+// persisting — used by the editor to insert an imported ad-hoc (inline) step.
+func parseStep(c *gin.Context) {
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, maxStepBodyBytes)
+	body, err := io.ReadAll(c.Request.Body)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	s, err := services.ParseStepDoc(body)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, s)
+}
+
 func listWorkflows(c *gin.Context) {
 	wfs, err := services.ListWorkflows()
 	if err != nil {

server/internal/checker/checker.go

@@ -0,0 +1,226 @@
+// Package checker runs service checks (http/tcp/icmp/tls) and returns a uniform
+// Result. It has no dependency on models or pb so it can be duplicated verbatim
+// into the agent module (agent-run monitors) — callers map their own monitor
+// representation onto Spec.
+package checker
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+)
+
+// Check types (mirror models.Monitor* constants).
+const (
+	TypeHTTP = "http"
+	TypeTCP  = "tcp"
+	TypeICMP = "icmp"
+	TypeTLS  = "tls"
+)
+
+// Spec is a self-contained description of a single check.
+type Spec struct {
+	Type           string
+	URL            string
+	Host           string
+	Port           int
+	Method         string
+	ExpectedStatus int
+	Keyword        string
+	TLSWarnDays    int
+	Insecure       bool // skip TLS certificate verification (HTTP checks)
+	TimeoutSec     int
+}
+
+// Result is the uniform outcome of running a check.
+type Result struct {
+	Up         bool
+	LatencyMs  int
+	Message    string
+	CertExpiry *time.Time
+}
+
+func (s Spec) timeout() time.Duration {
+	t := s.TimeoutSec
+	if t <= 0 || t > 10 {
+		t = 10
+	}
+	return time.Duration(t) * time.Second
+}
+
+// Run executes the check described by s.
+func Run(ctx context.Context, s Spec) Result {
+	switch s.Type {
+	case TypeHTTP:
+		return runHTTP(ctx, s)
+	case TypeTCP:
+		return runTCP(ctx, s)
+	case TypeICMP:
+		return runICMP(ctx, s)
+	case TypeTLS:
+		return runTLS(ctx, s)
+	default:
+		return Result{Message: "unknown check type: " + s.Type}
+	}
+}
+
+func runHTTP(ctx context.Context, s Spec) Result {
+	method := s.Method
+	if method == "" {
+		method = http.MethodGet
+	}
+	expect := s.ExpectedStatus
+	if expect == 0 {
+		expect = 200
+	}
+	client := &http.Client{Timeout: s.timeout()}
+	if s.Insecure {
+		client.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec // opt-in per monitor
+	}
+	start := time.Now()
+	req, err := http.NewRequestWithContext(ctx, method, s.URL, nil)
+	if err != nil {
+		return Result{Message: err.Error()}
+	}
+	resp, err := client.Do(req)
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	defer resp.Body.Close()
+	res := Result{LatencyMs: msSince(start), Up: true}
+	if resp.TLS != nil && len(resp.TLS.PeerCertificates) > 0 {
+		exp := resp.TLS.PeerCertificates[0].NotAfter
+		res.CertExpiry = &exp
+	}
+	if resp.StatusCode != expect {
+		return Result{LatencyMs: res.LatencyMs, CertExpiry: res.CertExpiry, Message: fmt.Sprintf("status %d (want %d)", resp.StatusCode, expect)}
+	}
+	if s.Keyword != "" {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+		if !strings.Contains(string(body), s.Keyword) {
+			return Result{LatencyMs: res.LatencyMs, CertExpiry: res.CertExpiry, Message: "keyword not found"}
+		}
+	}
+	return res
+}
+
+func runTCP(ctx context.Context, s Spec) Result {
+	addr := net.JoinHostPort(s.Host, fmt.Sprint(s.Port))
+	start := time.Now()
+	d := net.Dialer{Timeout: s.timeout()}
+	conn, err := d.DialContext(ctx, "tcp", addr)
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	conn.Close()
+	return Result{Up: true, LatencyMs: msSince(start)}
+}
+
+func runTLS(ctx context.Context, s Spec) Result {
+	port := s.Port
+	if port == 0 {
+		port = 443
+	}
+	addr := net.JoinHostPort(s.Host, fmt.Sprint(port))
+	start := time.Now()
+	d := net.Dialer{Timeout: s.timeout()}
+	conn, err := tls.DialWithDialer(&d, "tcp", addr, &tls.Config{ServerName: s.Host})
+	if err != nil {
+		return Result{LatencyMs: msSince(start), Message: err.Error()}
+	}
+	defer conn.Close()
+	certs := conn.ConnectionState().PeerCertificates
+	if len(certs) == 0 {
+		return Result{LatencyMs: msSince(start), Message: "no peer certificate"}
+	}
+	exp := certs[0].NotAfter
+	res := Result{LatencyMs: msSince(start), CertExpiry: &exp}
+	warn := s.TLSWarnDays
+	if warn <= 0 {
+		warn = 14
+	}
+	remaining := time.Until(exp)
+	if remaining <= 0 {
+		res.Message = "certificate expired"
+		return res
+	}
+	if remaining <= time.Duration(warn)*24*time.Hour {
+		res.Message = fmt.Sprintf("certificate expires in %d days", int(remaining.Hours()/24))
+		return res
+	}
+	res.Up = true
+	return res
+}
+
+func msSince(t time.Time) int { return int(time.Since(t).Milliseconds()) }
+
+// runICMP sends a single ICMP echo request and waits for the reply. Requires
+// raw-socket privileges (the agent and server run as root). Returns down with a
+// descriptive message when the socket cannot be opened or no reply arrives.
+func runICMP(ctx context.Context, s Spec) Result {
+	dst, err := net.ResolveIPAddr("ip4", s.Host)
+	if err != nil {
+		return Result{Message: err.Error()}
+	}
+	conn, err := net.ListenPacket("ip4:icmp", "0.0.0.0")
+	if err != nil {
+		return Result{Message: "icmp socket: " + err.Error()}
+	}
+	defer conn.Close()
+
+	id := os.Getpid() & 0xffff
+	pkt := icmpEcho(id, 1)
+	deadline := time.Now().Add(s.timeout())
+	if d, ok := ctx.Deadline(); ok && d.Before(deadline) {
+		deadline = d
+	}
+	_ = conn.SetDeadline(deadline)
+
+	start := time.Now()
+	if _, err := conn.WriteTo(pkt, dst); err != nil {
+		return Result{Message: err.Error()}
+	}
+	reply := make([]byte, 1500)
+	for {
+		n, peer, err := conn.ReadFrom(reply)
+		if err != nil {
+			return Result{LatencyMs: msSince(start), Message: "no reply"}
+		}
+		// Skip the IPv4 header (20 bytes) to reach the ICMP message.
+		if n < 28 || peer.String() != dst.String() {
+			continue
+		}
+		if reply[20] == 0 { // ICMP echo reply type
+			return Result{Up: true, LatencyMs: msSince(start)}
+		}
+	}
+}
+
+func icmpEcho(id, seq int) []byte {
+	// Type(8)=echo request, Code=0, Checksum, ID, Seq, no payload.
+	b := []byte{8, 0, 0, 0, byte(id >> 8), byte(id), byte(seq >> 8), byte(seq)}
+	cs := icmpChecksum(b)
+	b[2] = byte(cs >> 8)
+	b[3] = byte(cs)
+	return b
+}
+
+func icmpChecksum(b []byte) uint16 {
+	var sum uint32
+	for i := 0; i < len(b)-1; i += 2 {
+		sum += uint32(b[i])<<8 | uint32(b[i+1])
+	}
+	if len(b)%2 == 1 {
+		sum += uint32(b[len(b)-1]) << 8
+	}
+	for sum>>16 != 0 {
+		sum = (sum & 0xffff) + (sum >> 16)
+	}
+	return ^uint16(sum)
+}

server/internal/grpc/pb/vantage.pb.go

@@ -63,6 +63,75 @@ type ReportUpdatesRequest struct {
 
 type ReportUpdatesResponse struct{}
 
+// Inventory report message types
+
+type CPUReport struct {
+	Model    string  `json:"model,omitempty"`
+	Cores    int     `json:"cores,omitempty"`
+	UsagePct float64 `json:"usage_pct"`
+	Load1    float64 `json:"load1,omitempty"`
+}
+type MemReport struct {
+	TotalBytes uint64 `json:"total_bytes"`
+	UsedBytes  uint64 `json:"used_bytes"`
+}
+type PartitionReport struct {
+	Device     string `json:"device"`
+	Mountpoint string `json:"mountpoint"`
+	Fstype     string `json:"fstype,omitempty"`
+	TotalBytes uint64 `json:"total_bytes"`
+	UsedBytes  uint64 `json:"used_bytes"`
+}
+type InventoryReport struct {
+	ServerId      string            `json:"server_id"`
+	AgentToken    string            `json:"agent_token"`
+	IncludeStatic bool              `json:"include_static"`
+	CPU           *CPUReport        `json:"cpu,omitempty"`
+	Memory        *MemReport        `json:"memory,omitempty"`
+	SwapTotal     uint64            `json:"swap_total"`
+	SwapUsed      uint64            `json:"swap_used"`
+	Partitions    []PartitionReport `json:"partitions,omitempty"`
+	Kernel        string            `json:"kernel,omitempty"`
+}
+type InventoryReportResponse struct{}
+
+// Monitor sync / check report message types
+
+type MonitorSpec struct {
+	MonitorId      string `json:"monitor_id"`
+	Type           string `json:"type"`
+	URL            string `json:"url,omitempty"`
+	Host           string `json:"host,omitempty"`
+	Port           int    `json:"port,omitempty"`
+	Method         string `json:"method,omitempty"`
+	ExpectedStatus int    `json:"expected_status,omitempty"`
+	Keyword        string `json:"keyword,omitempty"`
+	TLSWarnDays    int    `json:"tls_warn_days,omitempty"`
+	Insecure       bool   `json:"insecure,omitempty"`
+	IntervalSec    int    `json:"interval_sec"`
+	Retries        int    `json:"retries"`
+}
+type SyncMonitorsRequest struct {
+	ServerId   string `json:"server_id"`
+	AgentToken string `json:"agent_token"`
+}
+type SyncMonitorsResponse struct {
+	Monitors []MonitorSpec `json:"monitors,omitempty"`
+}
+type CheckResult struct {
+	MonitorId     string `json:"monitor_id"`
+	Up            bool   `json:"up"`
+	LatencyMs     int    `json:"latency_ms"`
+	Message       string `json:"message,omitempty"`
+	CertExpiryUnix int64 `json:"cert_expiry_unix,omitempty"`
+}
+type ReportChecksRequest struct {
+	ServerId   string        `json:"server_id"`
+	AgentToken string        `json:"agent_token"`
+	Results    []CheckResult `json:"results,omitempty"`
+}
+type ReportChecksResponse struct{}
+
 type ApplyUpdatesCmd struct{}
 
 type ServerCommand struct {
@@ -195,6 +264,9 @@ type VantageServer interface {
 	SyncKeys(context.Context, *SyncRequest) (*SyncResponse, error)
 	UploadGeneratedKey(context.Context, *UploadKeyRequest) (*UploadKeyResponse, error)
 	ReportUpdates(context.Context, *ReportUpdatesRequest) (*ReportUpdatesResponse, error)
+	ReportInventory(context.Context, *InventoryReport) (*InventoryReportResponse, error)
+	SyncMonitors(context.Context, *SyncMonitorsRequest) (*SyncMonitorsResponse, error)
+	ReportChecks(context.Context, *ReportChecksRequest) (*ReportChecksResponse, error)
 	CommandStream(Vantage_CommandStreamServer) error
 }
 
@@ -216,6 +288,18 @@ func (UnimplementedVantageServer) ReportUpdates(context.Context, *ReportUpdatesR
 	return nil, status.Errorf(codes.Unimplemented, "method ReportUpdates not implemented")
 }
 
+func (UnimplementedVantageServer) ReportInventory(context.Context, *InventoryReport) (*InventoryReportResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ReportInventory not implemented")
+}
+
+func (UnimplementedVantageServer) SyncMonitors(context.Context, *SyncMonitorsRequest) (*SyncMonitorsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SyncMonitors not implemented")
+}
+
+func (UnimplementedVantageServer) ReportChecks(context.Context, *ReportChecksRequest) (*ReportChecksResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ReportChecks not implemented")
+}
+
 func (UnimplementedVantageServer) CommandStream(Vantage_CommandStreamServer) error {
 	return status.Errorf(codes.Unimplemented, "method CommandStream not implemented")
 }
@@ -227,6 +311,9 @@ type VantageClient interface {
 	SyncKeys(ctx context.Context, in *SyncRequest, opts ...grpc.CallOption) (*SyncResponse, error)
 	UploadGeneratedKey(ctx context.Context, in *UploadKeyRequest, opts ...grpc.CallOption) (*UploadKeyResponse, error)
 	ReportUpdates(ctx context.Context, in *ReportUpdatesRequest, opts ...grpc.CallOption) (*ReportUpdatesResponse, error)
+	ReportInventory(ctx context.Context, in *InventoryReport, opts ...grpc.CallOption) (*InventoryReportResponse, error)
+	SyncMonitors(ctx context.Context, in *SyncMonitorsRequest, opts ...grpc.CallOption) (*SyncMonitorsResponse, error)
+	ReportChecks(ctx context.Context, in *ReportChecksRequest, opts ...grpc.CallOption) (*ReportChecksResponse, error)
 	CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error)
 }
 
@@ -270,6 +357,30 @@ func (c *keyManagerClient) ReportUpdates(ctx context.Context, in *ReportUpdatesR
 	return out, nil
 }
 
+func (c *keyManagerClient) ReportInventory(ctx context.Context, in *InventoryReport, opts ...grpc.CallOption) (*InventoryReportResponse, error) {
+	out := new(InventoryReportResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/ReportInventory", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) SyncMonitors(ctx context.Context, in *SyncMonitorsRequest, opts ...grpc.CallOption) (*SyncMonitorsResponse, error) {
+	out := new(SyncMonitorsResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/SyncMonitors", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *keyManagerClient) ReportChecks(ctx context.Context, in *ReportChecksRequest, opts ...grpc.CallOption) (*ReportChecksResponse, error) {
+	out := new(ReportChecksResponse)
+	if err := c.cc.Invoke(ctx, "/vantage.v1.Vantage/ReportChecks", in, out, opts...); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *keyManagerClient) CommandStream(ctx context.Context, opts ...grpc.CallOption) (Vantage_CommandStreamClient, error) {
 	stream, err := c.cc.NewStream(ctx, &Vantage_ServiceDesc.Streams[0], "/vantage.v1.Vantage/CommandStream", opts...)
 	if err != nil {
@@ -292,6 +403,9 @@ var Vantage_ServiceDesc = grpc.ServiceDesc{
 		{MethodName: "SyncKeys", Handler: _Vantage_SyncKeys_Handler},
 		{MethodName: "UploadGeneratedKey", Handler: _Vantage_UploadGeneratedKey_Handler},
 		{MethodName: "ReportUpdates", Handler: _Vantage_ReportUpdates_Handler},
+		{MethodName: "ReportInventory", Handler: _Vantage_ReportInventory_Handler},
+		{MethodName: "SyncMonitors", Handler: _Vantage_SyncMonitors_Handler},
+		{MethodName: "ReportChecks", Handler: _Vantage_ReportChecks_Handler},
 	},
 	Streams: []grpc.StreamDesc{
 		{
@@ -364,6 +478,51 @@ func _Vantage_ReportUpdates_Handler(srv interface{}, ctx context.Context, dec fu
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Vantage_ReportInventory_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(InventoryReport)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VantageServer).ReportInventory(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/vantage.v1.Vantage/ReportInventory"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VantageServer).ReportInventory(ctx, req.(*InventoryReport))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Vantage_SyncMonitors_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SyncMonitorsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VantageServer).SyncMonitors(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/vantage.v1.Vantage/SyncMonitors"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VantageServer).SyncMonitors(ctx, req.(*SyncMonitorsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Vantage_ReportChecks_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ReportChecksRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(VantageServer).ReportChecks(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{Server: srv, FullMethod: "/vantage.v1.Vantage/ReportChecks"}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(VantageServer).ReportChecks(ctx, req.(*ReportChecksRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Vantage_CommandStream_Handler(srv interface{}, stream grpc.ServerStream) error {
 	return srv.(VantageServer).CommandStream(&keyManagerCommandStreamServer{stream})
 }

server/internal/grpc/server.go

@@ -7,6 +7,7 @@ import (
 	"net"
 	"time"
 
+	"github.com/mrhid6/vantage/server/internal/checker"
 	"github.com/mrhid6/vantage/server/internal/grpc/pb"
 	"github.com/mrhid6/vantage/server/internal/models"
 	"github.com/mrhid6/vantage/server/internal/services"
@@ -95,6 +96,63 @@ func (s *vantageServer) ReportUpdates(ctx context.Context, req *pb.ReportUpdates
 	return &pb.ReportUpdatesResponse{}, nil
 }
 
+func (s *vantageServer) ReportInventory(ctx context.Context, req *pb.InventoryReport) (*pb.InventoryReportResponse, error) {
+	srv, err := services.ValidateAgentToken(req.ServerId, req.AgentToken)
+	if err != nil {
+		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
+	}
+	if err := services.StoreInventory(srv.ServerID, req); err != nil {
+		log.Printf("store inventory for %s: %v", srv.ServerID, err)
+	}
+	return &pb.InventoryReportResponse{}, nil
+}
+
+func (s *vantageServer) SyncMonitors(ctx context.Context, req *pb.SyncMonitorsRequest) (*pb.SyncMonitorsResponse, error) {
+	srv, err := services.ValidateAgentToken(req.ServerId, req.AgentToken)
+	if err != nil {
+		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
+	}
+	monitors, err := services.ListMonitorsForRunner(srv.ServerID)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "list monitors")
+	}
+	specs := make([]pb.MonitorSpec, 0, len(monitors))
+	for _, m := range monitors {
+		specs = append(specs, pb.MonitorSpec{
+			MonitorId:      m.MonitorID,
+			Type:           m.Type,
+			URL:            m.Target.URL,
+			Host:           m.Target.Host,
+			Port:           m.Target.Port,
+			Method:         m.Target.Method,
+			ExpectedStatus: m.Target.ExpectedStatus,
+			Keyword:        m.Target.Keyword,
+			TLSWarnDays:    m.Target.TLSWarnDays,
+			Insecure:       m.Target.Insecure,
+			IntervalSec:    m.IntervalSec,
+			Retries:        m.Retries,
+		})
+	}
+	return &pb.SyncMonitorsResponse{Monitors: specs}, nil
+}
+
+func (s *vantageServer) ReportChecks(ctx context.Context, req *pb.ReportChecksRequest) (*pb.ReportChecksResponse, error) {
+	if _, err := services.ValidateAgentToken(req.ServerId, req.AgentToken); err != nil {
+		return nil, status.Errorf(codes.Unauthenticated, "invalid agent token")
+	}
+	for _, r := range req.Results {
+		res := checker.Result{Up: r.Up, LatencyMs: r.LatencyMs, Message: r.Message}
+		if r.CertExpiryUnix > 0 {
+			t := time.Unix(r.CertExpiryUnix, 0)
+			res.CertExpiry = &t
+		}
+		if err := services.IngestResult(r.MonitorId, res); err != nil {
+			log.Printf("ingest check %s: %v", r.MonitorId, err)
+		}
+	}
+	return &pb.ReportChecksResponse{}, nil
+}
+
 func (s *vantageServer) CommandStream(stream pb.Vantage_CommandStreamServer) error {
 	// First message authenticates the agent and signals readiness.
 	msg, err := stream.Recv()

server/internal/models/channel.go

@@ -0,0 +1,29 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+// Notification channel types.
+const (
+	ChannelWebhook  = "webhook"
+	ChannelSMTP     = "smtp"
+	ChannelDiscord  = "discord"
+	ChannelSlack    = "slack"
+	ChannelTelegram = "telegram"
+)
+
+// NotificationChannel is an outbound alert destination. Config holds
+// type-specific settings (e.g. url; or smtp host/port/username/password/from/to;
+// or telegram token/chat_id).
+type NotificationChannel struct {
+	ID        bson.ObjectID     `bson:"_id,omitempty" json:"_id,omitempty"`
+	ChannelID string            `bson:"channel_id" json:"channel_id"`
+	Name      string            `bson:"name" json:"name"`
+	Type      string            `bson:"type" json:"type"`
+	Config    map[string]string `bson:"config" json:"config"`
+	Enabled   bool              `bson:"enabled" json:"enabled"`
+	CreatedAt time.Time         `bson:"created_at" json:"created_at"`
+}

server/internal/models/monitor.go

@@ -0,0 +1,78 @@
+package models
+
+import (
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+// Monitor check types.
+const (
+	MonitorHTTP = "http"
+	MonitorTCP  = "tcp"
+	MonitorICMP = "icmp"
+	MonitorTLS  = "tls"
+)
+
+// Monitor status values.
+const (
+	StatusUp      = "up"
+	StatusDown    = "down"
+	StatusPending = "pending"
+)
+
+// RunnerServer is the reserved Runner value for server-run monitors. Any other
+// value is treated as a server_id whose agent runs the check locally.
+const RunnerServer = "server"
+
+type MonitorTarget struct {
+	URL            string `bson:"url,omitempty" json:"url,omitempty"`
+	Host           string `bson:"host,omitempty" json:"host,omitempty"`
+	Port           int    `bson:"port,omitempty" json:"port,omitempty"`
+	Method         string `bson:"method,omitempty" json:"method,omitempty"`
+	ExpectedStatus int    `bson:"expected_status,omitempty" json:"expected_status,omitempty"`
+	Keyword        string `bson:"keyword,omitempty" json:"keyword,omitempty"`
+	TLSWarnDays    int    `bson:"tls_warn_days,omitempty" json:"tls_warn_days,omitempty"`
+	Insecure       bool   `bson:"insecure,omitempty" json:"insecure,omitempty"` // skip TLS cert verification (HTTP monitors)
+}
+
+type MonitorState struct {
+	Status         string     `bson:"status" json:"status"` // up|down|pending
+	LastCheckAt    *time.Time `bson:"last_check_at,omitempty" json:"last_check_at,omitempty"`
+	LatencyMs      int        `bson:"latency_ms" json:"latency_ms"`
+	Message        string     `bson:"message,omitempty" json:"message,omitempty"`
+	CertExpiryAt   *time.Time `bson:"cert_expiry_at,omitempty" json:"cert_expiry_at,omitempty"`
+	Fails          int        `bson:"fails" json:"fails"` // consecutive failures
+	LastNotifiedAt *time.Time `bson:"last_notified_at,omitempty" json:"last_notified_at,omitempty"`
+}
+
+type Monitor struct {
+	ID          bson.ObjectID `bson:"_id,omitempty" json:"_id,omitempty"`
+	MonitorID   string        `bson:"monitor_id" json:"monitor_id"`
+	Name        string        `bson:"name" json:"name"`
+	Type        string        `bson:"type" json:"type"` // http|tcp|icmp|tls
+	Target      MonitorTarget `bson:"target" json:"target"`
+	IntervalSec int           `bson:"interval_sec" json:"interval_sec"`
+	Runner      string        `bson:"runner" json:"runner"` // "server" or a server_id
+	Retries     int           `bson:"retries" json:"retries"` // consecutive fails before down
+	Enabled     bool          `bson:"enabled" json:"enabled"`
+	ChannelIDs  []string      `bson:"channel_ids,omitempty" json:"channel_ids,omitempty"`
+	State       MonitorState  `bson:"state" json:"state"`
+	CreatedAt   time.Time     `bson:"created_at" json:"created_at"`
+}
+
+type Incident struct {
+	IncidentID string     `bson:"incident_id" json:"incident_id"`
+	MonitorID  string     `bson:"monitor_id" json:"monitor_id"`
+	StartedAt  time.Time  `bson:"started_at" json:"started_at"`
+	ResolvedAt *time.Time `bson:"resolved_at,omitempty" json:"resolved_at,omitempty"`
+	Cause      string     `bson:"cause,omitempty" json:"cause,omitempty"`
+}
+
+type Rollup struct {
+	MonitorID   string    `bson:"monitor_id" json:"monitor_id"`
+	PeriodStart time.Time `bson:"period_start" json:"period_start"` // hour bucket
+	Checks      int       `bson:"checks" json:"checks"`
+	UpCount     int       `bson:"up_count" json:"up_count"`
+	SumLatency  int64     `bson:"sum_latency" json:"sum_latency"`
+}

server/internal/models/server.go

@@ -12,6 +12,37 @@ type PackageUpdate struct {
 	NewVersion     string `bson:"new_version" json:"new_version"`
 }
 
+type CPUInfo struct {
+	Model    string  `bson:"model,omitempty" json:"model,omitempty"`
+	Cores    int     `bson:"cores,omitempty" json:"cores,omitempty"`
+	UsagePct float64 `bson:"usage_pct" json:"usage_pct"`
+	Load1    float64 `bson:"load1,omitempty" json:"load1,omitempty"`
+}
+
+type MemInfo struct {
+	TotalBytes uint64 `bson:"total_bytes" json:"total_bytes"`
+	UsedBytes  uint64 `bson:"used_bytes" json:"used_bytes"`
+}
+
+type Partition struct {
+	Device     string `bson:"device" json:"device"`
+	Mountpoint string `bson:"mountpoint" json:"mountpoint"`
+	Fstype     string `bson:"fstype,omitempty" json:"fstype,omitempty"`
+	TotalBytes uint64 `bson:"total_bytes" json:"total_bytes"`
+	UsedBytes  uint64 `bson:"used_bytes" json:"used_bytes"`
+}
+
+type Inventory struct {
+	CPU            CPUInfo     `bson:"cpu" json:"cpu"`
+	Memory         MemInfo     `bson:"memory" json:"memory"`
+	SwapTotalBytes uint64      `bson:"swap_total_bytes" json:"swap_total_bytes"`
+	SwapUsedBytes  uint64      `bson:"swap_used_bytes" json:"swap_used_bytes"`
+	Partitions     []Partition `bson:"partitions,omitempty" json:"partitions,omitempty"`
+	Kernel         string      `bson:"kernel,omitempty" json:"kernel,omitempty"`
+	MetricsAt      *time.Time  `bson:"metrics_at,omitempty" json:"metrics_at,omitempty"`
+	StaticAt       *time.Time  `bson:"static_at,omitempty" json:"static_at,omitempty"`
+}
+
 type Server struct {
 	ID               bson.ObjectID  `bson:"_id,omitempty" json:"_id,omitempty"`
 	ServerID         string         `bson:"server_id" json:"server_id"`
@@ -30,5 +61,6 @@ type Server struct {
 	LastSeen         *time.Time     `bson:"last_seen,omitempty" json:"last_seen,omitempty"`
 	AvailableUpdates []PackageUpdate `bson:"available_updates,omitempty" json:"available_updates,omitempty"`
 	UpdatesCheckedAt *time.Time     `bson:"updates_checked_at,omitempty" json:"updates_checked_at,omitempty"`
+	Inventory        *Inventory     `bson:"inventory,omitempty" json:"inventory,omitempty"`
 	CreatedAt        time.Time      `bson:"created_at" json:"created_at"`
 }

server/internal/models/workflow.go

@@ -22,12 +22,15 @@ type WorkflowStep struct {
 	DeclaredOutputs []string      `bson:"declared_outputs" json:"declared_outputs"`
 	DeclaredInputs  []InputParam  `bson:"declared_inputs" json:"declared_inputs"`
 	SecretRefs      []string      `bson:"secret_refs" json:"secret_refs"`
+	Source          string        `bson:"source" json:"source"` // "user" | "default"
+	Slug            string        `bson:"slug,omitempty" json:"slug,omitempty"`
 	CreatedAt       time.Time     `bson:"created_at" json:"created_at"`
 	UpdatedAt       time.Time     `bson:"updated_at" json:"updated_at"`
 }
 
 type WorkflowStepRef struct {
-	StepID     string            `bson:"step_id" json:"step_id"`
+	StepID     string            `bson:"step_id,omitempty" json:"step_id,omitempty"`
+	Inline     *WorkflowStep     `bson:"inline,omitempty" json:"inline,omitempty"`
 	Order      int               `bson:"order" json:"order"`
 	OnFailure  string            `bson:"on_failure" json:"on_failure"` // "stop" | "continue" | "retry"
 	MaxRetries int               `bson:"max_retries" json:"max_retries"`

server/internal/monitorsched/scheduler.go

@@ -0,0 +1,107 @@
+// Package monitorsched runs server-side monitors on their configured interval
+// and funnels results through services.IngestResult. Agent-run monitors
+// (runner != "server") are excluded — those execute on the agent.
+package monitorsched
+
+import (
+	"context"
+	"log"
+	"sync"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/checker"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/services"
+)
+
+// reloadInterval controls how often the scheduler re-reads monitor definitions
+// so CRUD changes (new/removed/edited monitors) take effect.
+const reloadInterval = 30 * time.Second
+
+type runner struct {
+	monitorID   string
+	intervalSec int
+	cancel      context.CancelFunc
+}
+
+// Start launches the scheduler loop. It returns immediately; the loop runs until
+// ctx is cancelled.
+func Start(ctx context.Context) {
+	go loop(ctx)
+}
+
+func loop(ctx context.Context) {
+	active := map[string]*runner{}
+	var mu sync.Mutex
+
+	sync := func() {
+		monitors, err := services.ListMonitorsForRunner(models.RunnerServer)
+		if err != nil {
+			log.Printf("monitorsched: list monitors: %v", err)
+			return
+		}
+		want := map[string]models.Monitor{}
+		for _, m := range monitors {
+			want[m.MonitorID] = m
+		}
+
+		mu.Lock()
+		defer mu.Unlock()
+		// Stop runners for monitors that vanished or changed interval.
+		for id, r := range active {
+			m, ok := want[id]
+			if !ok || m.IntervalSec != r.intervalSec {
+				r.cancel()
+				delete(active, id)
+			}
+		}
+		// Start runners for new/changed monitors.
+		for id, m := range want {
+			if _, ok := active[id]; ok {
+				continue
+			}
+			rctx, cancel := context.WithCancel(ctx)
+			active[id] = &runner{monitorID: id, intervalSec: m.IntervalSec, cancel: cancel}
+			go runMonitor(rctx, m)
+		}
+	}
+
+	sync()
+	t := time.NewTicker(reloadInterval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			sync()
+		}
+	}
+}
+
+func runMonitor(ctx context.Context, m models.Monitor) {
+	interval := time.Duration(m.IntervalSec) * time.Second
+	if interval <= 0 {
+		interval = 60 * time.Second
+	}
+	spec := services.SpecFor(&m)
+
+	run := func() {
+		res := checker.Run(ctx, spec)
+		if err := services.IngestResult(m.MonitorID, res); err != nil {
+			log.Printf("monitorsched: ingest %s: %v", m.MonitorID, err)
+		}
+	}
+
+	run() // check immediately on (re)start
+	t := time.NewTicker(interval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			run()
+		}
+	}
+}

server/internal/notify/dispatch.go

@@ -0,0 +1,64 @@
+// Package notify formats and delivers monitor state-change alerts to
+// notification channels. It depends only on models so services can call it
+// without an import cycle.
+package notify
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+// Event describes a monitor state transition worth alerting on.
+type Event struct {
+	MonitorName string
+	Type        string
+	OldStatus   string
+	NewStatus   string
+	Message     string
+	Time        time.Time
+}
+
+// title is a short one-line summary used by the text-based channels.
+func (e Event) title() string {
+	verb := "recovered"
+	if e.NewStatus == models.StatusDown {
+		verb = "is DOWN"
+	}
+	s := fmt.Sprintf("[Vantage] %s (%s) %s", e.MonitorName, e.Type, verb)
+	if e.Message != "" {
+		s += ": " + e.Message
+	}
+	return s
+}
+
+// Dispatch delivers ev to a single channel, formatting per channel type.
+func Dispatch(ch models.NotificationChannel, ev Event) error {
+	switch ch.Type {
+	case models.ChannelWebhook:
+		return dispatchWebhook(ch, ev)
+	case models.ChannelDiscord:
+		return dispatchDiscord(ch, ev)
+	case models.ChannelSlack:
+		return dispatchSlack(ch, ev)
+	case models.ChannelTelegram:
+		return dispatchTelegram(ch, ev)
+	case models.ChannelSMTP:
+		return dispatchSMTP(ch, ev)
+	default:
+		return fmt.Errorf("unknown channel type: %s", ch.Type)
+	}
+}
+
+// Test delivers a synthetic event so users can verify a channel's configuration.
+func Test(ch models.NotificationChannel) error {
+	return Dispatch(ch, Event{
+		MonitorName: "Test monitor",
+		Type:        "http",
+		OldStatus:   models.StatusUp,
+		NewStatus:   models.StatusDown,
+		Message:     "this is a test alert from Vantage",
+		Time:        time.Now(),
+	})
+}

server/internal/notify/http.go

@@ -0,0 +1,71 @@
+package notify
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+var httpClient = &http.Client{Timeout: 10 * time.Second}
+
+func postJSON(target string, payload any) error {
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return err
+	}
+	resp, err := httpClient.Post(target, "application/json", bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 300 {
+		return fmt.Errorf("HTTP %d from %s", resp.StatusCode, target)
+	}
+	return nil
+}
+
+// dispatchWebhook posts the full event as JSON to a user-supplied URL.
+func dispatchWebhook(ch models.NotificationChannel, ev Event) error {
+	target := ch.Config["url"]
+	if target == "" {
+		return fmt.Errorf("webhook: missing url")
+	}
+	return postJSON(target, map[string]any{
+		"monitor":    ev.MonitorName,
+		"type":       ev.Type,
+		"old_status": ev.OldStatus,
+		"new_status": ev.NewStatus,
+		"message":    ev.Message,
+		"time":       ev.Time.Format(time.RFC3339),
+	})
+}
+
+func dispatchDiscord(ch models.NotificationChannel, ev Event) error {
+	target := ch.Config["url"]
+	if target == "" {
+		return fmt.Errorf("discord: missing url")
+	}
+	return postJSON(target, map[string]string{"content": ev.title()})
+}
+
+func dispatchSlack(ch models.NotificationChannel, ev Event) error {
+	target := ch.Config["url"]
+	if target == "" {
+		return fmt.Errorf("slack: missing url")
+	}
+	return postJSON(target, map[string]string{"text": ev.title()})
+}
+
+func dispatchTelegram(ch models.NotificationChannel, ev Event) error {
+	token := ch.Config["token"]
+	chatID := ch.Config["chat_id"]
+	if token == "" || chatID == "" {
+		return fmt.Errorf("telegram: missing token or chat_id")
+	}
+	api := fmt.Sprintf("https://api.telegram.org/bot%s/sendMessage", token)
+	return postJSON(api, map[string]string{"chat_id": chatID, "text": ev.title()})
+}

server/internal/notify/smtp.go

@@ -0,0 +1,106 @@
+package notify
+
+import (
+	"crypto/tls"
+	"fmt"
+	"net"
+	"net/smtp"
+	"strings"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+const smtpTimeout = 15 * time.Second
+
+// dispatchSMTP sends the alert as a plain-text email. Config keys: host, port,
+// username, password, from, to. Auth is skipped when username is empty. Port 465
+// uses implicit TLS; other ports use STARTTLS when the server advertises it.
+//
+// It dials with a timeout and sets a connection deadline so an unreachable or
+// misconfigured SMTP host fails fast instead of hanging the request until the OS
+// TCP timeout (which resets the upstream proxy connection).
+func dispatchSMTP(ch models.NotificationChannel, ev Event) error {
+	host := ch.Config["host"]
+	port := ch.Config["port"]
+	from := ch.Config["from"]
+	to := ch.Config["to"]
+	if host == "" || port == "" || from == "" || to == "" {
+		return fmt.Errorf("smtp: missing host/port/from/to")
+	}
+
+	addr := net.JoinHostPort(host, port)
+	conn, err := net.DialTimeout("tcp", addr, smtpTimeout)
+	if err != nil {
+		return fmt.Errorf("smtp: dial %s: %w", addr, err)
+	}
+	_ = conn.SetDeadline(time.Now().Add(smtpTimeout))
+
+	// Implicit TLS on 465; otherwise start plain and upgrade via STARTTLS.
+	if port == "465" {
+		conn = tls.Client(conn, &tls.Config{ServerName: host})
+	}
+
+	c, err := smtp.NewClient(conn, host)
+	if err != nil {
+		conn.Close()
+		return fmt.Errorf("smtp: client: %w", err)
+	}
+	defer c.Close()
+
+	if port != "465" {
+		if ok, _ := c.Extension("STARTTLS"); ok {
+			if err := c.StartTLS(&tls.Config{ServerName: host}); err != nil {
+				return fmt.Errorf("smtp: starttls: %w", err)
+			}
+		}
+	}
+
+	if user := ch.Config["username"]; user != "" {
+		if err := c.Auth(smtp.PlainAuth("", user, ch.Config["password"], host)); err != nil {
+			return fmt.Errorf("smtp: auth: %w", err)
+		}
+	}
+
+	recipients := strings.Split(to, ",")
+	for i := range recipients {
+		recipients[i] = strings.TrimSpace(recipients[i])
+	}
+
+	if err := c.Mail(from); err != nil {
+		return fmt.Errorf("smtp: mail from: %w", err)
+	}
+	for _, rcpt := range recipients {
+		if rcpt == "" {
+			continue
+		}
+		if err := c.Rcpt(rcpt); err != nil {
+			return fmt.Errorf("smtp: rcpt %s: %w", rcpt, err)
+		}
+	}
+
+	title := ev.title()
+	msg := strings.Join([]string{
+		"From: " + from,
+		"To: " + to,
+		"Subject: " + title,
+		"",
+		title,
+		"",
+		"Monitor: " + ev.MonitorName,
+		"Status: " + ev.OldStatus + " -> " + ev.NewStatus,
+		"Time: " + ev.Time.String(),
+	}, "\r\n")
+
+	w, err := c.Data()
+	if err != nil {
+		return fmt.Errorf("smtp: data: %w", err)
+	}
+	if _, err := w.Write([]byte(msg)); err != nil {
+		return fmt.Errorf("smtp: write: %w", err)
+	}
+	if err := w.Close(); err != nil {
+		return fmt.Errorf("smtp: close data: %w", err)
+	}
+	return c.Quit()
+}

server/internal/services/channels.go

@@ -0,0 +1,100 @@
+package services
+
+import (
+	"errors"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/notify"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+func ListChannels() ([]models.NotificationChannel, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	cur, err := db.Col("notification_channels").Find(ctx, bson.M{}, options.Find().SetSort(bson.M{"created_at": 1}))
+	if err != nil {
+		return nil, err
+	}
+	var out []models.NotificationChannel
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func GetChannel(channelID string) (*models.NotificationChannel, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	var ch models.NotificationChannel
+	err := db.Col("notification_channels").FindOne(ctx, bson.M{"channel_id": channelID}).Decode(&ch)
+	if errors.Is(err, mongo.ErrNoDocuments) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &ch, nil
+}
+
+// GetChannels loads multiple channels by ID, skipping any not found.
+func GetChannels(channelIDs []string) ([]models.NotificationChannel, error) {
+	if len(channelIDs) == 0 {
+		return nil, nil
+	}
+	ctx, cancel := monCtx()
+	defer cancel()
+	cur, err := db.Col("notification_channels").Find(ctx, bson.M{"channel_id": bson.M{"$in": channelIDs}})
+	if err != nil {
+		return nil, err
+	}
+	var out []models.NotificationChannel
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func CreateChannel(ch *models.NotificationChannel) (*models.NotificationChannel, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	ch.ChannelID = uuid.NewString()
+	ch.CreatedAt = time.Now()
+	if ch.Config == nil {
+		ch.Config = map[string]string{}
+	}
+	if _, err := db.Col("notification_channels").InsertOne(ctx, ch); err != nil {
+		return nil, err
+	}
+	return ch, nil
+}
+
+func UpdateChannel(channelID string, upd bson.M) error {
+	ctx, cancel := monCtx()
+	defer cancel()
+	_, err := db.Col("notification_channels").UpdateOne(ctx, bson.M{"channel_id": channelID}, bson.M{"$set": upd})
+	return err
+}
+
+func DeleteChannel(channelID string) error {
+	ctx, cancel := monCtx()
+	defer cancel()
+	_, err := db.Col("notification_channels").DeleteOne(ctx, bson.M{"channel_id": channelID})
+	return err
+}
+
+// TestChannel sends a synthetic alert to verify configuration.
+func TestChannel(channelID string) error {
+	ch, err := GetChannel(channelID)
+	if err != nil {
+		return err
+	}
+	if ch == nil {
+		return errors.New("channel not found")
+	}
+	return notify.Test(*ch)
+}

server/internal/services/defaults.go

@@ -0,0 +1,94 @@
+package services
+
+import (
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+// DefaultStepsDir returns the directory holding default step JSON files.
+func DefaultStepsDir() string {
+	dir := os.Getenv("VANTAGE_DEFAULT_STEPS_DIR")
+	if dir == "" {
+		dir = filepath.Join("data", "default-steps")
+	}
+	_ = os.MkdirAll(dir, 0700)
+	return dir
+}
+
+// readDefaultStepFiles parses every *.json in the defaults dir into
+// source=default library steps (with slug set). Non-json and invalid files are
+// skipped silently; a slug is derived from the step name.
+func readDefaultStepFiles() ([]models.WorkflowStep, error) {
+	matches, err := filepath.Glob(filepath.Join(DefaultStepsDir(), "*.json"))
+	if err != nil {
+		return nil, err
+	}
+	out := []models.WorkflowStep{}
+	for _, path := range matches {
+		b, err := os.ReadFile(path)
+		if err != nil {
+			continue
+		}
+		s, err := ParseStepDoc(b)
+		if err != nil {
+			continue
+		}
+		s.Source = "default"
+		s.Slug = Slugify(s.Name)
+		if s.Slug == "" {
+			continue
+		}
+		out = append(out, s)
+	}
+	return out, nil
+}
+
+// SeedDefaultSteps upserts default steps from disk keyed on {slug, source}.
+// Re-sync overwrites default-step content; user steps are never touched.
+func SeedDefaultSteps() (created, updated int, err error) {
+	steps, err := readDefaultStepFiles()
+	if err != nil {
+		return 0, 0, err
+	}
+	ctx, cancel := wfCtx()
+	defer cancel()
+	col := db.Col("workflow_steps")
+	for _, s := range steps {
+		filter := bson.M{"slug": s.Slug, "source": "default"}
+		set := bson.M{
+			"name":             s.Name,
+			"description":      s.Description,
+			"interpreter":      s.Interpreter,
+			"script":           s.Script,
+			"declared_outputs": s.DeclaredOutputs,
+			"declared_inputs":  s.DeclaredInputs,
+			"secret_refs":      s.SecretRefs,
+			"updated_at":       time.Now(),
+		}
+		res, uerr := col.UpdateOne(ctx, filter, bson.M{
+			"$set": set,
+			"$setOnInsert": bson.M{
+				"step_id":    uuid.New().String(),
+				"slug":       s.Slug,
+				"source":     "default",
+				"created_at": time.Now(),
+			},
+		}, options.UpdateOne().SetUpsert(true))
+		if uerr != nil {
+			return created, updated, uerr
+		}
+		if res.UpsertedCount > 0 {
+			created++
+		} else if res.ModifiedCount > 0 {
+			updated++
+		}
+	}
+	return created, updated, nil
+}

server/internal/services/defaults_test.go

@@ -0,0 +1,38 @@
+package services
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestDefaultStepsDirEnv(t *testing.T) {
+	dir := filepath.Join(t.TempDir(), "ds")
+	t.Setenv("VANTAGE_DEFAULT_STEPS_DIR", dir)
+	got := DefaultStepsDir()
+	if got != dir {
+		t.Fatalf("got %q want %q", got, dir)
+	}
+	if _, err := os.Stat(dir); err != nil {
+		t.Fatalf("dir not created: %v", err)
+	}
+}
+
+func TestReadDefaultStepFiles(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("VANTAGE_DEFAULT_STEPS_DIR", dir)
+	good := `{"kind":"vantage.step/v1","name":"Ping Host","interpreter":"bash","script":"ping -c1 x=1 >> $WORKFLOW_ENV"}`
+	os.WriteFile(filepath.Join(dir, "ping.json"), []byte(good), 0600)
+	os.WriteFile(filepath.Join(dir, "notes.txt"), []byte("ignore me"), 0600)
+
+	steps, err := readDefaultStepFiles()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(steps) != 1 {
+		t.Fatalf("want 1 step, got %d", len(steps))
+	}
+	if steps[0].Slug != "ping-host" || steps[0].Source != "default" {
+		t.Fatalf("bad seed step: %+v", steps[0])
+	}
+}

server/internal/services/inventory.go

@@ -0,0 +1,52 @@
+package services
+
+import (
+	"context"
+	"time"
+
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/grpc/pb"
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+// StoreInventory upserts the latest inventory snapshot onto the server document.
+// Metrics fields update every call; static fields only when r.IncludeStatic.
+func StoreInventory(serverID string, r *pb.InventoryReport) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	now := time.Now()
+	set := bson.M{"inventory.metrics_at": now}
+	if r.CPU != nil {
+		set["inventory.cpu.usage_pct"] = r.CPU.UsagePct
+		set["inventory.cpu.load1"] = r.CPU.Load1
+	}
+	if r.Memory != nil {
+		set["inventory.memory.used_bytes"] = r.Memory.UsedBytes
+	}
+	set["inventory.swap_used_bytes"] = r.SwapUsed
+
+	if r.IncludeStatic {
+		set["inventory.static_at"] = now
+		set["inventory.swap_total_bytes"] = r.SwapTotal
+		set["inventory.kernel"] = r.Kernel
+		if r.CPU != nil {
+			set["inventory.cpu.model"] = r.CPU.Model
+			set["inventory.cpu.cores"] = r.CPU.Cores
+		}
+		if r.Memory != nil {
+			set["inventory.memory.total_bytes"] = r.Memory.TotalBytes
+		}
+		parts := make([]bson.M, 0, len(r.Partitions))
+		for _, p := range r.Partitions {
+			parts = append(parts, bson.M{
+				"device": p.Device, "mountpoint": p.Mountpoint, "fstype": p.Fstype,
+				"total_bytes": p.TotalBytes, "used_bytes": p.UsedBytes,
+			})
+		}
+		set["inventory.partitions"] = parts
+	}
+
+	_, err := db.Col("servers").UpdateOne(ctx, bson.M{"server_id": serverID}, bson.M{"$set": set})
+	return err
+}

server/internal/services/monitors.go

@@ -0,0 +1,270 @@
+package services
+
+import (
+	"context"
+	"errors"
+	"log"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/mrhid6/vantage/server/internal/checker"
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+	"github.com/mrhid6/vantage/server/internal/notify"
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+func monCtx() (context.Context, context.CancelFunc) {
+	return context.WithTimeout(context.Background(), 5*time.Second)
+}
+
+// SpecFor maps a monitor onto a checker.Spec.
+func SpecFor(m *models.Monitor) checker.Spec {
+	return checker.Spec{
+		Type:           m.Type,
+		URL:            m.Target.URL,
+		Host:           m.Target.Host,
+		Port:           m.Target.Port,
+		Method:         m.Target.Method,
+		ExpectedStatus: m.Target.ExpectedStatus,
+		Keyword:        m.Target.Keyword,
+		TLSWarnDays:    m.Target.TLSWarnDays,
+		Insecure:       m.Target.Insecure,
+		TimeoutSec:     m.IntervalSec,
+	}
+}
+
+func ListMonitors() ([]models.Monitor, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	cur, err := db.Col("monitors").Find(ctx, bson.M{}, options.Find().SetSort(bson.M{"created_at": 1}))
+	if err != nil {
+		return nil, err
+	}
+	var out []models.Monitor
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ListMonitorsForRunner returns enabled monitors whose Runner matches runner.
+func ListMonitorsForRunner(runner string) ([]models.Monitor, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	cur, err := db.Col("monitors").Find(ctx, bson.M{"runner": runner, "enabled": true})
+	if err != nil {
+		return nil, err
+	}
+	var out []models.Monitor
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func GetMonitor(monitorID string) (*models.Monitor, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	var m models.Monitor
+	err := db.Col("monitors").FindOne(ctx, bson.M{"monitor_id": monitorID}).Decode(&m)
+	if errors.Is(err, mongo.ErrNoDocuments) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &m, nil
+}
+
+func CreateMonitor(m *models.Monitor) (*models.Monitor, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	m.MonitorID = uuid.NewString()
+	m.CreatedAt = time.Now()
+	if m.IntervalSec <= 0 {
+		m.IntervalSec = 60
+	}
+	if m.Retries <= 0 {
+		m.Retries = 1
+	}
+	if m.Runner == "" {
+		m.Runner = models.RunnerServer
+	}
+	m.State = models.MonitorState{Status: models.StatusPending}
+	if _, err := db.Col("monitors").InsertOne(ctx, m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func UpdateMonitor(monitorID string, upd bson.M) error {
+	ctx, cancel := monCtx()
+	defer cancel()
+	_, err := db.Col("monitors").UpdateOne(ctx, bson.M{"monitor_id": monitorID}, bson.M{"$set": upd})
+	return err
+}
+
+func DeleteMonitor(monitorID string) error {
+	ctx, cancel := monCtx()
+	defer cancel()
+	if _, err := db.Col("monitors").DeleteOne(ctx, bson.M{"monitor_id": monitorID}); err != nil {
+		return err
+	}
+	db.Col("incidents").DeleteMany(ctx, bson.M{"monitor_id": monitorID})
+	db.Col("monitor_rollups").DeleteMany(ctx, bson.M{"monitor_id": monitorID})
+	return nil
+}
+
+func ListIncidents(monitorID string, limit int64) ([]models.Incident, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	if limit <= 0 {
+		limit = 50
+	}
+	cur, err := db.Col("incidents").Find(ctx, bson.M{"monitor_id": monitorID},
+		options.Find().SetSort(bson.M{"started_at": -1}).SetLimit(limit))
+	if err != nil {
+		return nil, err
+	}
+	var out []models.Incident
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// UptimeRollups returns hourly rollups for a monitor since the cutoff, oldest first.
+func UptimeRollups(monitorID string, since time.Time) ([]models.Rollup, error) {
+	ctx, cancel := monCtx()
+	defer cancel()
+	cur, err := db.Col("monitor_rollups").Find(ctx,
+		bson.M{"monitor_id": monitorID, "period_start": bson.M{"$gte": since}},
+		options.Find().SetSort(bson.M{"period_start": 1}))
+	if err != nil {
+		return nil, err
+	}
+	var out []models.Rollup
+	if err := cur.All(ctx, &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// IngestResult applies a check result to a monitor: updates state, opens/resolves
+// incidents on up<->down transitions, rolls up the hourly bucket, and fires
+// notifications on transition. Both the server scheduler and agent-reported
+// results funnel through here.
+func IngestResult(monitorID string, res checker.Result) error {
+	ctx, cancel := monCtx()
+	defer cancel()
+
+	m, err := GetMonitor(monitorID)
+	if err != nil || m == nil {
+		return err
+	}
+
+	now := time.Now()
+	prev := m.State.Status
+	retries := m.Retries
+	if retries < 1 {
+		retries = 1
+	}
+
+	newStatus := prev
+	fails := m.State.Fails
+	if res.Up {
+		fails = 0
+		newStatus = models.StatusUp
+	} else {
+		fails++
+		if fails >= retries {
+			newStatus = models.StatusDown
+		} else if prev == "" || prev == models.StatusPending {
+			newStatus = models.StatusPending
+		}
+	}
+
+	state := bson.M{
+		"state.status":        newStatus,
+		"state.last_check_at": now,
+		"state.latency_ms":    res.LatencyMs,
+		"state.message":       res.Message,
+		"state.fails":         fails,
+	}
+	if res.CertExpiry != nil {
+		state["state.cert_expiry_at"] = *res.CertExpiry
+	}
+	if _, err := db.Col("monitors").UpdateOne(ctx, bson.M{"monitor_id": monitorID}, bson.M{"$set": state}); err != nil {
+		return err
+	}
+
+	// Hourly rollup.
+	bucket := now.Truncate(time.Hour)
+	up := 0
+	if res.Up {
+		up = 1
+	}
+	db.Col("monitor_rollups").UpdateOne(ctx,
+		bson.M{"monitor_id": monitorID, "period_start": bucket},
+		bson.M{"$inc": bson.M{"checks": 1, "up_count": up, "sum_latency": int64(res.LatencyMs)}},
+		options.UpdateOne().SetUpsert(true))
+
+	// Transition handling.
+	if newStatus != prev {
+		switch newStatus {
+		case models.StatusDown:
+			inc := models.Incident{
+				IncidentID: uuid.NewString(),
+				MonitorID:  monitorID,
+				StartedAt:  now,
+				Cause:      res.Message,
+			}
+			db.Col("incidents").InsertOne(ctx, inc)
+			notifyTransition(m, newStatus, res.Message)
+		case models.StatusUp:
+			if prev == models.StatusDown {
+				db.Col("incidents").UpdateOne(ctx,
+					bson.M{"monitor_id": monitorID, "resolved_at": nil},
+					bson.M{"$set": bson.M{"resolved_at": now}})
+				notifyTransition(m, newStatus, res.Message)
+			}
+		}
+	}
+	return nil
+}
+
+// notifyTransition dispatches notifications on an up<->down transition to each
+// enabled channel bound to the monitor. Deliveries run in the background;
+// failures are logged, not fatal.
+func notifyTransition(m *models.Monitor, newStatus, message string) {
+	if len(m.ChannelIDs) == 0 {
+		return
+	}
+	channels, err := GetChannels(m.ChannelIDs)
+	if err != nil {
+		log.Printf("notify: load channels for %s: %v", m.MonitorID, err)
+		return
+	}
+	ev := notify.Event{
+		MonitorName: m.Name,
+		Type:        m.Type,
+		OldStatus:   m.State.Status,
+		NewStatus:   newStatus,
+		Message:     message,
+		Time:        time.Now(),
+	}
+	for _, ch := range channels {
+		if !ch.Enabled {
+			continue
+		}
+		go func(c models.NotificationChannel) {
+			if err := notify.Dispatch(c, ev); err != nil {
+				log.Printf("notify: dispatch to %s (%s): %v", c.Name, c.Type, err)
+			}
+		}(ch)
+	}
+	_ = UpdateMonitor(m.MonitorID, bson.M{"state.last_notified_at": time.Now()})
+}

server/internal/services/resolve_test.go

@@ -0,0 +1,37 @@
+package services
+
+import (
+	"testing"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+func TestResolveInlineStep(t *testing.T) {
+	ref := models.WorkflowStepRef{
+		Order:     2,
+		OnFailure: "",
+		Inline: &models.WorkflowStep{
+			Name:        "adhoc",
+			Interpreter: "bash",
+			Script:      "echo hi",
+			SecretRefs:  []string{"TOKEN"},
+			DeclaredInputs: []models.InputParam{
+				{Name: "REGION", Default: "eu"},
+			},
+		},
+		Inputs: map[string]string{"REGION": "us"},
+	}
+	rs := resolveInlineStep(ref)
+	if rs.Name != "adhoc" || rs.Script != "echo hi" || rs.Order != 2 {
+		t.Fatalf("bad resolve: %+v", rs)
+	}
+	if rs.OnFailure != "stop" {
+		t.Fatalf("want default on_failure=stop, got %q", rs.OnFailure)
+	}
+	if rs.Inputs["REGION"] != "us" {
+		t.Fatalf("want input override us, got %q", rs.Inputs["REGION"])
+	}
+	if len(rs.SecretRefs) != 1 || rs.SecretRefs[0] != "TOKEN" {
+		t.Fatalf("bad secret refs: %v", rs.SecretRefs)
+	}
+}

server/internal/services/stepio.go

@@ -0,0 +1,86 @@
+package services
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+const StepDocKind = "vantage.step/v1"
+
+// StepDoc is the portable, id-free representation of a step.
+type StepDoc struct {
+	Kind            string              `json:"kind"`
+	Name            string              `json:"name"`
+	Description     string              `json:"description"`
+	Interpreter     string              `json:"interpreter"`
+	Script          string              `json:"script"`
+	DeclaredOutputs []string            `json:"declared_outputs"`
+	DeclaredInputs  []models.InputParam `json:"declared_inputs"`
+	SecretRefs      []string            `json:"secret_refs"`
+}
+
+// ExportStepDoc builds a portable doc from a library step (ids/source stripped).
+func ExportStepDoc(s models.WorkflowStep) StepDoc {
+	return StepDoc{
+		Kind:            StepDocKind,
+		Name:            s.Name,
+		Description:     s.Description,
+		Interpreter:     s.Interpreter,
+		Script:          s.Script,
+		DeclaredOutputs: s.DeclaredOutputs,
+		DeclaredInputs:  s.DeclaredInputs,
+		SecretRefs:      s.SecretRefs,
+	}
+}
+
+// ParseStepDoc validates a v1 doc and returns a normalized (id-free) step with
+// declared_outputs recomputed from the script.
+func ParseStepDoc(b []byte) (models.WorkflowStep, error) {
+	var d StepDoc
+	if err := json.Unmarshal(b, &d); err != nil {
+		return models.WorkflowStep{}, fmt.Errorf("invalid step JSON: %w", err)
+	}
+	if d.Kind != StepDocKind {
+		return models.WorkflowStep{}, fmt.Errorf("unsupported kind %q (want %q)", d.Kind, StepDocKind)
+	}
+	if d.Name == "" || d.Interpreter == "" {
+		return models.WorkflowStep{}, fmt.Errorf("step name and interpreter are required")
+	}
+	if d.SecretRefs == nil {
+		d.SecretRefs = []string{}
+	}
+	if d.DeclaredInputs == nil {
+		d.DeclaredInputs = []models.InputParam{}
+	}
+	return models.WorkflowStep{
+		Name:            d.Name,
+		Description:     d.Description,
+		Interpreter:     d.Interpreter,
+		Script:          d.Script,
+		DeclaredOutputs: DeriveOutputs(d.Script),
+		DeclaredInputs:  d.DeclaredInputs,
+		SecretRefs:      d.SecretRefs,
+	}, nil
+}
+
+// ImportStepToLibrary parses a doc and persists it as a new user library step.
+func ImportStepToLibrary(b []byte) (*models.WorkflowStep, error) {
+	s, err := ParseStepDoc(b)
+	if err != nil {
+		return nil, err
+	}
+	return CreateStep(s)
+}
+
+// ExportStep loads a library step and marshals it to a portable doc.
+func ExportStep(stepID string) ([]byte, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	s, err := getStep(ctx, stepID)
+	if err != nil {
+		return nil, err
+	}
+	return json.MarshalIndent(ExportStepDoc(*s), "", "  ")
+}

server/internal/services/stepio_test.go

@@ -0,0 +1,60 @@
+package services
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+func mkStep() models.WorkflowStep {
+	return models.WorkflowStep{
+		StepID: "should-not-export", Source: "default", Name: "Restart",
+		Interpreter: "bash", Script: "echo x=1 >> $WORKFLOW_ENV",
+		SecretRefs: []string{"TOK"},
+	}
+}
+
+func TestParseStepDocValid(t *testing.T) {
+	raw := `{"kind":"vantage.step/v1","name":"Restart","interpreter":"bash",
+	  "script":"echo x=1 >> $WORKFLOW_ENV","declared_outputs":["stale"],
+	  "declared_inputs":[{"name":"A","default":"1"}],"secret_refs":["TOK"]}`
+	s, err := ParseStepDoc([]byte(raw))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if s.Name != "Restart" || s.Interpreter != "bash" {
+		t.Fatalf("bad parse: %+v", s)
+	}
+	// declared_outputs recomputed from script, ignoring the file's ["stale"].
+	if len(s.DeclaredOutputs) != 1 || s.DeclaredOutputs[0] != "x" {
+		t.Fatalf("outputs should be derived, got %v", s.DeclaredOutputs)
+	}
+	if s.StepID != "" || s.Source != "" {
+		t.Fatalf("parse must not set id/source")
+	}
+}
+
+func TestParseStepDocBadKind(t *testing.T) {
+	if _, err := ParseStepDoc([]byte(`{"kind":"nope","name":"x"}`)); err == nil {
+		t.Fatal("want error for bad kind")
+	}
+}
+
+func TestParseStepDocBadJSON(t *testing.T) {
+	if _, err := ParseStepDoc([]byte(`{`)); err == nil {
+		t.Fatal("want error for bad json")
+	}
+}
+
+func TestExportStepDocRoundTrip(t *testing.T) {
+	doc := ExportStepDoc(mkStep())
+	b, _ := json.Marshal(doc)
+	s, err := ParseStepDoc(b)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if s.Name != "Restart" || s.Interpreter != "bash" {
+		t.Fatalf("round trip lost data: %+v", s)
+	}
+}

server/internal/services/stepscan.go

@@ -0,0 +1,44 @@
+package services
+
+import (
+	"regexp"
+	"strings"
+)
+
+// keyAssign matches an env-var assignment target: KEY= (captures KEY).
+var keyAssign = regexp.MustCompile(`([A-Za-z_][A-Za-z0-9_]*)=`)
+
+// DeriveOutputs scans a step script and returns the output keys it writes to
+// $WORKFLOW_ENV. Best-effort: only lines that reference WORKFLOW_ENV are
+// considered. Deduplicated, first-seen order preserved.
+func DeriveOutputs(script string) []string {
+	out := []string{}
+	seen := map[string]bool{}
+	for _, line := range strings.Split(script, "\n") {
+		if !strings.Contains(line, "WORKFLOW_ENV") {
+			continue
+		}
+		for _, m := range keyAssign.FindAllStringSubmatch(line, -1) {
+			key := m[1]
+			// Skip the sentinel itself (e.g. "WORKFLOW_ENV=..." assignments).
+			if key == "WORKFLOW_ENV" || key == "env" {
+				continue
+			}
+			if seen[key] {
+				continue
+			}
+			seen[key] = true
+			out = append(out, key)
+		}
+	}
+	return out
+}
+
+var slugStrip = regexp.MustCompile(`[^a-z0-9]+`)
+
+// Slugify converts a step name into a stable kebab-case slug.
+func Slugify(name string) string {
+	s := strings.ToLower(name)
+	s = slugStrip.ReplaceAllString(s, "-")
+	return strings.Trim(s, "-")
+}

server/internal/services/stepscan_test.go

@@ -0,0 +1,45 @@
+package services
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestDeriveOutputs(t *testing.T) {
+	script := `#!/bin/bash
+echo "test=123" >> $WORKFLOW_ENV
+echo "other=hi" >> "$WORKFLOW_ENV"
+printf 'third=1\n' >> $WORKFLOW_ENV
+echo "test=456" >> $WORKFLOW_ENV
+echo "ignored=nope"
+NORMAL=assignment
+`
+	got := DeriveOutputs(script)
+	want := []string{"test", "other", "third"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("got %v want %v", got, want)
+	}
+}
+
+func TestDeriveOutputsPowershell(t *testing.T) {
+	script := `"result=ok" >> $env:WORKFLOW_ENV
+Add-Content $env:WORKFLOW_ENV "count=5"`
+	got := DeriveOutputs(script)
+	want := []string{"result", "count"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("got %v want %v", got, want)
+	}
+}
+
+func TestDeriveOutputsNone(t *testing.T) {
+	got := DeriveOutputs("echo hello\nNOPE=1")
+	if len(got) != 0 {
+		t.Fatalf("got %v want empty", got)
+	}
+}
+
+func TestSlugify(t *testing.T) {
+	if got := Slugify("Restart NGINX  Service!"); got != "restart-nginx-service" {
+		t.Fatalf("got %q", got)
+	}
+}

server/internal/services/validate.go

@@ -0,0 +1,19 @@
+package services
+
+import (
+	"fmt"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+// ValidateWorkflow checks each step ref sets exactly one of step_id / inline.
+func ValidateWorkflow(w models.Workflow) error {
+	for i, ref := range w.Steps {
+		hasLib := ref.StepID != ""
+		hasInline := ref.Inline != nil
+		if hasLib == hasInline {
+			return fmt.Errorf("step %d: exactly one of step_id or inline must be set", i)
+		}
+	}
+	return nil
+}

server/internal/services/validate_test.go

@@ -0,0 +1,29 @@
+package services
+
+import (
+	"testing"
+
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+func TestValidateWorkflow(t *testing.T) {
+	inline := &models.WorkflowStep{Name: "x", Interpreter: "bash", Script: "echo hi"}
+	cases := []struct {
+		name    string
+		ref     models.WorkflowStepRef
+		wantErr bool
+	}{
+		{"library only", models.WorkflowStepRef{StepID: "abc"}, false},
+		{"inline only", models.WorkflowStepRef{Inline: inline}, false},
+		{"both set", models.WorkflowStepRef{StepID: "abc", Inline: inline}, true},
+		{"neither set", models.WorkflowStepRef{}, true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := ValidateWorkflow(models.Workflow{Steps: []models.WorkflowStepRef{tc.ref}})
+			if (err != nil) != tc.wantErr {
+				t.Fatalf("got err=%v want wantErr=%v", err, tc.wantErr)
+			}
+		})
+	}
+}

server/internal/services/workflow_runner.go

@@ -83,6 +83,10 @@ func resolveSteps(wf *models.Workflow) ([]models.ResolvedStep, error) {
 	defer cancel()
 	out := make([]models.ResolvedStep, 0, len(wf.Steps))
 	for _, ref := range wf.Steps {
+		if ref.Inline != nil {
+			out = append(out, resolveInlineStep(ref))
+			continue
+		}
 		lib, err := getStep(ctx, ref.StepID)
 		if err != nil {
 			return nil, err
@@ -123,6 +127,35 @@ func resolveSteps(wf *models.Workflow) ([]models.ResolvedStep, error) {
 	return out, nil
 }
 
+// resolveInlineStep freezes an ad-hoc (inline) step ref into a ResolvedStep.
+func resolveInlineStep(ref models.WorkflowStepRef) models.ResolvedStep {
+	in := ref.Inline
+	inputs := map[string]string{}
+	for _, p := range in.DeclaredInputs {
+		if ref.Inputs != nil {
+			if v, ok := ref.Inputs[p.Name]; ok {
+				inputs[p.Name] = v
+				continue
+			}
+		}
+		inputs[p.Name] = p.Default
+	}
+	onFailure := ref.OnFailure
+	if onFailure == "" {
+		onFailure = "stop"
+	}
+	return models.ResolvedStep{
+		Order:       ref.Order,
+		Name:        in.Name,
+		Interpreter: in.Interpreter,
+		Script:      in.Script,
+		SecretRefs:  in.SecretRefs,
+		OnFailure:   onFailure,
+		MaxRetries:  ref.MaxRetries,
+		Inputs:      inputs,
+	}
+}
+
 // executeRun fans out one goroutine per server run and waits for all to finish.
 func executeRun(runID string) {
 	run, err := GetRun(runID)

server/internal/services/workflows.go

@@ -25,6 +25,13 @@ func EnsureWorkflowIndexes() error {
 	}); err != nil {
 		return err
 	}
+	if _, err := db.Col("workflow_steps").Indexes().CreateOne(ctx, mongo.IndexModel{
+		Keys: bson.D{{Key: "slug", Value: 1}},
+		Options: options.Index().SetUnique(true).
+			SetPartialFilterExpression(bson.M{"source": "default"}),
+	}); err != nil {
+		return err
+	}
 	if _, err := db.Col("workflows").Indexes().CreateOne(ctx, mongo.IndexModel{
 		Keys: bson.D{{Key: "workflow_id", Value: 1}}, Options: options.Index().SetUnique(true),
 	}); err != nil {
@@ -54,14 +61,43 @@ func ListSteps() ([]models.WorkflowStep, error) {
 	return steps, nil
 }
 
+// StepUsageCounts returns, per library step_id, the number of distinct
+// workflows that reference it. Inline steps have no step_id and are ignored.
+func StepUsageCounts() (map[string]int, error) {
+	ctx, cancel := wfCtx()
+	defer cancel()
+	cur, err := db.Col("workflows").Find(ctx, bson.M{})
+	if err != nil {
+		return nil, err
+	}
+	defer cur.Close(ctx)
+	var wfs []models.Workflow
+	if err := cur.All(ctx, &wfs); err != nil {
+		return nil, err
+	}
+	counts := map[string]int{}
+	for _, w := range wfs {
+		seen := map[string]bool{}
+		for _, ref := range w.Steps {
+			if ref.StepID == "" || seen[ref.StepID] {
+				continue
+			}
+			seen[ref.StepID] = true
+			counts[ref.StepID]++
+		}
+	}
+	return counts, nil
+}
+
 func CreateStep(s models.WorkflowStep) (*models.WorkflowStep, error) {
 	ctx, cancel := wfCtx()
 	defer cancel()
 	s.StepID = uuid.New().String()
 	s.CreatedAt = time.Now()
 	s.UpdatedAt = s.CreatedAt
-	if s.DeclaredOutputs == nil {
-		s.DeclaredOutputs = []string{}
+	s.DeclaredOutputs = DeriveOutputs(s.Script)
+	if s.Source == "" {
+		s.Source = "user"
 	}
 	if s.SecretRefs == nil {
 		s.SecretRefs = []string{}
@@ -83,7 +119,7 @@ func UpdateStep(stepID string, s models.WorkflowStep) error {
 		"description":      s.Description,
 		"interpreter":      s.Interpreter,
 		"script":           s.Script,
-		"declared_outputs": s.DeclaredOutputs,
+		"declared_outputs": DeriveOutputs(s.Script),
 		"declared_inputs":  s.DeclaredInputs,
 		"secret_refs":      s.SecretRefs,
 		"updated_at":       time.Now(),
@@ -178,6 +214,10 @@ func CreateWorkflow(w models.Workflow) (*models.Workflow, error) {
 	if w.Steps == nil {
 		w.Steps = []models.WorkflowStepRef{}
 	}
+	if err := ValidateWorkflow(w); err != nil {
+		return nil, err
+	}
+	normalizeInlineSteps(&w)
 	if _, err := db.Col("workflows").InsertOne(ctx, w); err != nil {
 		return nil, err
 	}
@@ -187,6 +227,10 @@ func CreateWorkflow(w models.Workflow) (*models.Workflow, error) {
 func UpdateWorkflow(id string, w models.Workflow) error {
 	ctx, cancel := wfCtx()
 	defer cancel()
+	if err := ValidateWorkflow(w); err != nil {
+		return err
+	}
+	normalizeInlineSteps(&w)
 	_, err := db.Col("workflows").UpdateOne(ctx, bson.M{"workflow_id": id}, bson.M{"$set": bson.M{
 		"name":              w.Name,
 		"target_server_ids": w.TargetServerIDs,
@@ -196,6 +240,29 @@ func UpdateWorkflow(id string, w models.Workflow) error {
 	return err
 }
 
+// normalizeInlineSteps derives outputs for inline steps and strips fields that
+// only belong to library steps.
+func normalizeInlineSteps(w *models.Workflow) {
+	for i := range w.Steps {
+		in := w.Steps[i].Inline
+		if in == nil {
+			continue
+		}
+		in.DeclaredOutputs = DeriveOutputs(in.Script)
+		in.StepID = ""
+		in.Slug = ""
+		in.Source = ""
+		in.CreatedAt = time.Time{}
+		in.UpdatedAt = time.Time{}
+		if in.SecretRefs == nil {
+			in.SecretRefs = []string{}
+		}
+		if in.DeclaredInputs == nil {
+			in.DeclaredInputs = []models.InputParam{}
+		}
+	}
+}
+
 func DeleteWorkflow(id string) error {
 	ctx, cancel := wfCtx()
 	defer cancel()

server/internal/services/workflows_usage_test.go

@@ -0,0 +1,66 @@
+package services
+
+import (
+	"os"
+	"testing"
+
+	"github.com/mrhid6/vantage/server/internal/db"
+	"github.com/mrhid6/vantage/server/internal/models"
+)
+
+var mongoAvailable bool
+
+func TestMain(m *testing.M) {
+	uri := os.Getenv("VANTAGE_TEST_MONGO_URI")
+	if uri == "" {
+		uri = "mongodb://localhost:27117"
+	}
+	if err := db.Connect(uri, "vantage_test"); err != nil {
+		// No MongoDB available in this environment; DB-backed tests will be skipped
+		// individually, but the rest of the package's tests must still run.
+		mongoAvailable = false
+	} else {
+		mongoAvailable = true
+	}
+	os.Exit(m.Run())
+}
+
+func mkUsageStep(name string) models.WorkflowStep {
+	return models.WorkflowStep{Name: name, Interpreter: "bash", Script: "echo hi"}
+}
+
+func mkWorkflowWithStep(name, stepID string) models.Workflow {
+	return models.Workflow{Name: name, Steps: []models.WorkflowStepRef{{StepID: stepID, Order: 0, OnFailure: "stop"}}}
+}
+
+func TestStepUsageCounts(t *testing.T) {
+	if !mongoAvailable {
+		t.Skip("mongo unavailable: set VANTAGE_TEST_MONGO_URI")
+	}
+	// A step used by two workflows, a step used by none.
+	used, err := CreateStep(mkUsageStep("used-step"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	unused, err := CreateStep(mkUsageStep("unused-step"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := CreateWorkflow(mkWorkflowWithStep("wf-a", used.StepID)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := CreateWorkflow(mkWorkflowWithStep("wf-b", used.StepID)); err != nil {
+		t.Fatal(err)
+	}
+
+	counts, err := StepUsageCounts()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if counts[used.StepID] != 2 {
+		t.Fatalf("used step: want 2, got %d", counts[used.StepID])
+	}
+	if counts[unused.StepID] != 0 {
+		t.Fatalf("unused step: want 0, got %d", counts[unused.StepID])
+	}
+}

web/app/monitors/[id]/edit/page.tsx

@@ -0,0 +1,58 @@
+"use client";
+
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import { useParams, useRouter } from "next/navigation";
+import Link from "next/link";
+import { api, MonitorInput } from "@/lib/api";
+import { Card } from "@/components/ui";
+import { MonitorForm } from "@/components/monitors/MonitorForm";
+
+export default function EditMonitorPage() {
+  const params = useParams();
+  const router = useRouter();
+  const queryClient = useQueryClient();
+  const monitorId = params.id as string;
+
+  const { data: monitor, isLoading } = useQuery({
+    queryKey: ["monitors", monitorId],
+    queryFn: () => api.getMonitor(monitorId),
+  });
+
+  const { mutate: update, isPending, error } = useMutation({
+    mutationFn: (input: MonitorInput) => api.updateMonitor(monitorId, input),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["monitors"] });
+      queryClient.invalidateQueries({ queryKey: ["monitors", monitorId] });
+      router.push(`/monitors/${monitorId}`);
+    },
+  });
+
+  if (isLoading) {
+    return (
+      <div className="flex h-full items-center justify-center">
+        <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+      </div>
+    );
+  }
+
+  if (!monitor) {
+    return (
+      <div className="p-8">
+        <div className="rounded-lg border border-danger/30 bg-danger/10 p-4 text-danger">Monitor not found.</div>
+      </div>
+    );
+  }
+
+  return (
+    <div className="p-8">
+      <Link href={`/monitors/${monitorId}`} className="text-sm text-text-secondary hover:text-text-primary">
+        ← {monitor.name}
+      </Link>
+      <h1 className="mb-6 mt-2 text-2xl font-bold text-text-primary">Edit Monitor</h1>
+
+      <Card className="max-w-2xl">
+        <MonitorForm initial={monitor} submitLabel="Save Changes" onSubmit={update} isPending={isPending} error={error as Error | null} />
+      </Card>
+    </div>
+  );
+}

web/app/monitors/[id]/page.tsx

@@ -0,0 +1,239 @@
+"use client";
+
+import { useState } from "react";
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import { useParams, useRouter } from "next/navigation";
+import Link from "next/link";
+import { api, Monitor, MonitorStatus, Rollup } from "@/lib/api";
+import { Badge, Button, Card, CardHeader, CardTitle, Table, Thead, Tbody, Tr, Th, Td } from "@/components/ui";
+
+function statusVariant(status: MonitorStatus) {
+  switch (status) {
+    case "up":
+      return "success";
+    case "down":
+      return "danger";
+    default:
+      return "warning";
+  }
+}
+
+function uptimePct(rollups: Rollup[]): number {
+  const checks = rollups.reduce((a, r) => a + r.checks, 0);
+  const up = rollups.reduce((a, r) => a + r.up_count, 0);
+  return checks > 0 ? (up / checks) * 100 : 0;
+}
+
+function Heartbeat({ rollups }: { rollups: Rollup[] }) {
+  const recent = rollups.slice(-48);
+  return (
+    <div className="flex items-end gap-0.5">
+      {recent.map((r) => {
+        const pct = r.checks > 0 ? (r.up_count / r.checks) * 100 : 0;
+        const color = r.checks === 0 ? "bg-surface-2" : pct >= 99 ? "bg-success" : pct >= 80 ? "bg-warning" : "bg-danger";
+        return (
+          <div
+            key={r.period_start}
+            className={`h-8 w-1.5 rounded-sm ${color}`}
+            title={`${new Date(r.period_start).toLocaleString()} — ${pct.toFixed(0)}% up`}
+          />
+        );
+      })}
+      {recent.length === 0 && <span className="text-xs text-text-secondary">No history yet.</span>}
+    </div>
+  );
+}
+
+export default function MonitorDetailPage() {
+  const params = useParams();
+  const router = useRouter();
+  const queryClient = useQueryClient();
+  const monitorId = params.id as string;
+  const [confirmDelete, setConfirmDelete] = useState(false);
+
+  const { data: monitor, isLoading } = useQuery({
+    queryKey: ["monitors", monitorId],
+    queryFn: () => api.getMonitor(monitorId),
+    refetchInterval: 30_000,
+  });
+
+  const { data: rollups } = useQuery({
+    queryKey: ["monitors", monitorId, "uptime"],
+    queryFn: () => api.getMonitorUptime(monitorId),
+    refetchInterval: 60_000,
+  });
+
+  const { data: incidents } = useQuery({
+    queryKey: ["monitors", monitorId, "incidents"],
+    queryFn: () => api.getMonitorIncidents(monitorId),
+    refetchInterval: 60_000,
+  });
+
+  const { mutate: deleteMonitor, isPending: isDeleting } = useMutation({
+    mutationFn: () => api.deleteMonitor(monitorId),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["monitors"] });
+      router.push("/monitors");
+    },
+  });
+
+  const { mutate: toggleEnabled } = useMutation({
+    mutationFn: (enabled: boolean) => api.updateMonitor(monitorId, { enabled }),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: ["monitors", monitorId] }),
+  });
+
+  if (isLoading) {
+    return (
+      <div className="flex h-full items-center justify-center">
+        <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+      </div>
+    );
+  }
+
+  if (!monitor) {
+    return (
+      <div className="p-8">
+        <div className="rounded-lg border border-danger/30 bg-danger/10 p-4 text-danger">Monitor not found.</div>
+      </div>
+    );
+  }
+
+  const all = rollups ?? [];
+  const last24 = all.slice(-24);
+
+  return (
+    <div className="p-8">
+      <div className="mb-6 flex items-start justify-between">
+        <div>
+          <Link href="/monitors" className="text-sm text-text-secondary hover:text-text-primary">
+            ← Monitors
+          </Link>
+          <div className="mt-2 flex items-center gap-3">
+            <h1 className="text-2xl font-bold text-text-primary">{monitor.name}</h1>
+            <Badge variant={statusVariant(monitor.state.status)}>{monitor.state.status}</Badge>
+            <Badge variant="neutral">{monitor.type}</Badge>
+            {!monitor.enabled && <Badge variant="warning">disabled</Badge>}
+          </div>
+          {monitor.state.message && <p className="mt-1 text-sm text-text-secondary">{monitor.state.message}</p>}
+        </div>
+        <div className="flex gap-2">
+          <Link href={`/monitors/${monitorId}/edit`}>
+            <Button variant="secondary">Edit</Button>
+          </Link>
+          <Button variant="secondary" onClick={() => toggleEnabled(!monitor.enabled)}>
+            {monitor.enabled ? "Disable" : "Enable"}
+          </Button>
+          {!confirmDelete ? (
+            <Button variant="danger" onClick={() => setConfirmDelete(true)}>
+              Delete
+            </Button>
+          ) : (
+            <div className="flex items-center gap-2">
+              <span className="text-sm text-danger">Are you sure?</span>
+              <Button variant="danger" loading={isDeleting} onClick={() => deleteMonitor()}>
+                Confirm
+              </Button>
+              <Button variant="ghost" onClick={() => setConfirmDelete(false)}>
+                Cancel
+              </Button>
+            </div>
+          )}
+        </div>
+      </div>
+
+      <div className="mb-6 grid grid-cols-2 gap-4 sm:grid-cols-4">
+        <Card>
+          <p className="text-xs text-text-secondary">Uptime (24h)</p>
+          <p className="mt-1 text-2xl font-bold text-text-primary">{uptimePct(last24).toFixed(1)}%</p>
+        </Card>
+        <Card>
+          <p className="text-xs text-text-secondary">Uptime (30d)</p>
+          <p className="mt-1 text-2xl font-bold text-text-primary">{uptimePct(all).toFixed(1)}%</p>
+        </Card>
+        <Card>
+          <p className="text-xs text-text-secondary">Latency</p>
+          <p className="mt-1 text-2xl font-bold text-text-primary">{monitor.state.latency_ms}ms</p>
+        </Card>
+        <Card>
+          <p className="text-xs text-text-secondary">Cert expiry</p>
+          <p className="mt-1 text-sm font-medium text-text-primary">
+            {monitor.state.cert_expiry_at ? new Date(monitor.state.cert_expiry_at).toLocaleDateString() : "—"}
+          </p>
+        </Card>
+      </div>
+
+      <Card className="mb-6">
+        <CardHeader>
+          <CardTitle>Heartbeat (last 48h)</CardTitle>
+        </CardHeader>
+        <Heartbeat rollups={all} />
+      </Card>
+
+      <div className="grid grid-cols-1 gap-6 lg:grid-cols-2">
+        <Card padding={false}>
+          <div className="border-b border-border px-6 py-4">
+            <h2 className="text-lg font-semibold text-text-primary">Incidents</h2>
+          </div>
+          {!incidents || incidents.length === 0 ? (
+            <div className="py-12 text-center text-sm text-text-secondary">No incidents recorded.</div>
+          ) : (
+            <Table>
+              <Thead>
+                <Tr>
+                  <Th>Started</Th>
+                  <Th>Resolved</Th>
+                  <Th>Cause</Th>
+                </Tr>
+              </Thead>
+              <Tbody>
+                {incidents.map((inc) => (
+                  <Tr key={inc.incident_id}>
+                    <Td>
+                      <span className="text-xs text-text-secondary">{new Date(inc.started_at).toLocaleString()}</span>
+                    </Td>
+                    <Td>
+                      {inc.resolved_at ? (
+                        <span className="text-xs text-text-secondary">{new Date(inc.resolved_at).toLocaleString()}</span>
+                      ) : (
+                        <Badge variant="danger">ongoing</Badge>
+                      )}
+                    </Td>
+                    <Td>
+                      <span className="text-xs text-text-primary">{inc.cause || "—"}</span>
+                    </Td>
+                  </Tr>
+                ))}
+              </Tbody>
+            </Table>
+          )}
+        </Card>
+
+        <Card>
+          <CardHeader>
+            <CardTitle>Configuration</CardTitle>
+          </CardHeader>
+          <dl className="space-y-3 text-sm">
+            <div>
+              <dt className="text-text-secondary">Runner</dt>
+              <dd className="mt-0.5 font-mono text-text-primary">{monitor.runner}</dd>
+            </div>
+            <div className="border-t border-border pt-3">
+              <dt className="text-text-secondary">Interval</dt>
+              <dd className="mt-0.5 text-text-primary">{monitor.interval_sec}s</dd>
+            </div>
+            <div className="border-t border-border pt-3">
+              <dt className="text-text-secondary">Retries before down</dt>
+              <dd className="mt-0.5 text-text-primary">{monitor.retries}</dd>
+            </div>
+            <div className="border-t border-border pt-3">
+              <dt className="text-text-secondary">Target</dt>
+              <dd className="mt-0.5 font-mono text-xs text-text-primary break-all">
+                {monitor.target.url || `${monitor.target.host ?? ""}${monitor.target.port ? `:${monitor.target.port}` : ""}`}
+              </dd>
+            </div>
+          </dl>
+        </Card>
+      </div>
+    </div>
+  );
+}

web/app/monitors/new/page.tsx

@@ -0,0 +1,34 @@
+"use client";
+
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { useRouter } from "next/navigation";
+import Link from "next/link";
+import { api, MonitorInput } from "@/lib/api";
+import { Card } from "@/components/ui";
+import { MonitorForm } from "@/components/monitors/MonitorForm";
+
+export default function NewMonitorPage() {
+  const router = useRouter();
+  const queryClient = useQueryClient();
+
+  const { mutate: create, isPending, error } = useMutation({
+    mutationFn: (input: MonitorInput) => api.createMonitor(input),
+    onSuccess: (m) => {
+      queryClient.invalidateQueries({ queryKey: ["monitors"] });
+      router.push(`/monitors/${m.monitor_id}`);
+    },
+  });
+
+  return (
+    <div className="p-8">
+      <Link href="/monitors" className="text-sm text-text-secondary hover:text-text-primary">
+        ← Monitors
+      </Link>
+      <h1 className="mb-6 mt-2 text-2xl font-bold text-text-primary">New Monitor</h1>
+
+      <Card className="max-w-2xl">
+        <MonitorForm submitLabel="Create Monitor" onSubmit={create} isPending={isPending} error={error as Error | null} />
+      </Card>
+    </div>
+  );
+}

web/app/monitors/page.tsx

@@ -0,0 +1,109 @@
+"use client";
+
+import { useQuery } from "@tanstack/react-query";
+import Link from "next/link";
+import { api, Monitor, MonitorStatus } from "@/lib/api";
+import { Badge, Button, Card, Table, Thead, Tbody, Tr, Th, Td } from "@/components/ui";
+
+function statusVariant(status: MonitorStatus) {
+  switch (status) {
+    case "up":
+      return "success";
+    case "down":
+      return "danger";
+    default:
+      return "warning";
+  }
+}
+
+function targetSummary(m: Monitor): string {
+  if (m.type === "http") return m.target.url ?? "";
+  if (m.type === "tls") return `${m.target.host ?? ""}:${m.target.port || 443}`;
+  if (m.type === "icmp") return m.target.host ?? "";
+  return `${m.target.host ?? ""}:${m.target.port ?? ""}`;
+}
+
+export default function MonitorsPage() {
+  const { data: monitors, isLoading } = useQuery({
+    queryKey: ["monitors"],
+    queryFn: () => api.listMonitors(),
+    refetchInterval: 30_000,
+  });
+
+  return (
+    <div className="p-8">
+      <div className="mb-6 flex items-center justify-between">
+        <div>
+          <h1 className="text-2xl font-bold text-text-primary">Monitors</h1>
+          <p className="mt-1 text-sm text-text-secondary">Service uptime and latency checks.</p>
+        </div>
+        <div className="flex gap-2">
+          <Link href="/settings/notifications">
+            <Button variant="secondary">Notifications</Button>
+          </Link>
+          <Link href="/monitors/new">
+            <Button variant="primary">New Monitor</Button>
+          </Link>
+        </div>
+      </div>
+
+      <Card padding={false}>
+        {isLoading ? (
+          <div className="flex justify-center py-16">
+            <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+          </div>
+        ) : !monitors || monitors.length === 0 ? (
+          <div className="py-16 text-center">
+            <p className="text-sm text-text-secondary">No monitors yet.</p>
+            <Link href="/monitors/new">
+              <Button variant="secondary" size="sm" className="mt-3">
+                Create your first monitor
+              </Button>
+            </Link>
+          </div>
+        ) : (
+          <Table>
+            <Thead>
+              <Tr>
+                <Th>Name</Th>
+                <Th>Type</Th>
+                <Th>Target</Th>
+                <Th>Status</Th>
+                <Th>Latency</Th>
+                <Th>Last check</Th>
+              </Tr>
+            </Thead>
+            <Tbody>
+              {monitors.map((m) => (
+                <Tr key={m.monitor_id}>
+                  <Td>
+                    <Link href={`/monitors/${m.monitor_id}`} className="font-medium text-text-primary hover:text-accent">
+                      {m.name}
+                    </Link>
+                  </Td>
+                  <Td>
+                    <Badge variant="neutral">{m.type}</Badge>
+                  </Td>
+                  <Td>
+                    <span className="font-mono text-xs text-text-secondary">{targetSummary(m)}</span>
+                  </Td>
+                  <Td>
+                    <Badge variant={statusVariant(m.state.status)}>{m.state.status}</Badge>
+                  </Td>
+                  <Td>
+                    <span className="text-sm text-text-secondary">{m.state.latency_ms}ms</span>
+                  </Td>
+                  <Td>
+                    <span className="text-xs text-text-secondary">
+                      {m.state.last_check_at ? new Date(m.state.last_check_at).toLocaleTimeString() : "—"}
+                    </span>
+                  </Td>
+                </Tr>
+              ))}
+            </Tbody>
+          </Table>
+        )}
+      </Card>
+    </div>
+  );
+}

web/app/servers/[id]/page.tsx

@@ -4,7 +4,7 @@ import { useState } from "react";
 import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
 import { useParams, useRouter } from "next/navigation";
 import Link from "next/link";
-import { api, ServerStatus, GenerateKeyOptions, PackageUpdate } from "@/lib/api";
+import { api, ServerStatus, GenerateKeyOptions, PackageUpdate, Inventory } from "@/lib/api";
 import { Badge, Button, Card, CardHeader, CardTitle } from "@/components/ui";
 import { Table, Thead, Tbody, Tr, Th, Td } from "@/components/ui";
 
@@ -23,6 +23,60 @@ function formatDate(dateStr: string) {
     return new Date(dateStr).toLocaleString();
 }
 
+function formatBytes(n: number): string {
+    if (!n) return "0 B";
+    const u = ["B", "KB", "MB", "GB", "TB"];
+    const i = Math.floor(Math.log(n) / Math.log(1024));
+    return `${(n / Math.pow(1024, i)).toFixed(1)} ${u[i]}`;
+}
+
+function UsageBar({ used, total }: { used: number; total: number }) {
+    const pct = total > 0 ? Math.min(100, (used / total) * 100) : 0;
+    return (
+        <div className="h-2 w-full overflow-hidden rounded-full bg-surface-2">
+            <div className={`h-full rounded-full ${pct > 90 ? "bg-danger" : "bg-accent"}`} style={{ width: `${pct}%` }} />
+        </div>
+    );
+}
+
+function InventoryPanel({ inv }: { inv: Inventory }) {
+    return (
+        <Card>
+            <h2 className="mb-4 text-lg font-semibold text-text-primary">Inventory</h2>
+            <div className="grid gap-4 sm:grid-cols-2">
+                <div>
+                    <div className="mb-1 flex justify-between text-sm"><span className="text-text-secondary">CPU</span><span className="text-text-primary">{inv.cpu.usage_pct.toFixed(0)}%</span></div>
+                    <UsageBar used={inv.cpu.usage_pct} total={100} />
+                    <p className="mt-1 text-xs text-text-secondary">{inv.cpu.model} · {inv.cpu.cores} cores · load {inv.cpu.load1?.toFixed(2)}</p>
+                </div>
+                <div>
+                    <div className="mb-1 flex justify-between text-sm"><span className="text-text-secondary">Memory</span><span className="text-text-primary">{formatBytes(inv.memory.used_bytes)} / {formatBytes(inv.memory.total_bytes)}</span></div>
+                    <UsageBar used={inv.memory.used_bytes} total={inv.memory.total_bytes} />
+                    <div className="mb-1 mt-3 flex justify-between text-sm"><span className="text-text-secondary">Swap</span><span className="text-text-primary">{formatBytes(inv.swap_used_bytes)} / {formatBytes(inv.swap_total_bytes)}</span></div>
+                    <UsageBar used={inv.swap_used_bytes} total={inv.swap_total_bytes} />
+                </div>
+            </div>
+            {inv.partitions && inv.partitions.length > 0 && (
+                <div className="mt-5">
+                    <h3 className="mb-2 text-sm font-medium text-text-secondary">Partitions</h3>
+                    <div className="space-y-3">
+                        {inv.partitions.map((p) => (
+                            <div key={p.mountpoint}>
+                                <div className="mb-1 flex justify-between text-xs">
+                                    <span className="font-mono text-text-primary">{p.mountpoint}</span>
+                                    <span className="text-text-secondary">{formatBytes(p.used_bytes)} / {formatBytes(p.total_bytes)} · {p.fstype}</span>
+                                </div>
+                                <UsageBar used={p.used_bytes} total={p.total_bytes} />
+                            </div>
+                        ))}
+                    </div>
+                </div>
+            )}
+            {inv.kernel && <p className="mt-4 text-xs text-text-secondary">Kernel {inv.kernel}</p>}
+        </Card>
+    );
+}
+
 const KEY_SIZES: Record<string, number[]> = {
     rsa: [2048, 3072, 4096],
     ecdsa: [256, 384, 521],
@@ -432,6 +486,12 @@ export default function ServerDetailPage() {
                 </Card>
             </div>
 
+            {server.inventory && (
+                <div className="mb-6">
+                    <InventoryPanel inv={server.inventory} />
+                </div>
+            )}
+
             <div className="grid grid-cols-1 gap-6 lg:grid-cols-3">
                 <Card className="lg:col-span-1">
                     <CardHeader>

web/app/settings/notifications/page.tsx

@@ -0,0 +1,187 @@
+"use client";
+
+import { useState } from "react";
+import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import Link from "next/link";
+import { api, ChannelInput, ChannelType, NotificationChannel } from "@/lib/api";
+import { Badge, Button, Card } from "@/components/ui";
+
+const inputClass =
+  "w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder:text-text-tertiary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30";
+const labelClass = "mb-1.5 block text-sm font-medium text-text-secondary";
+
+// Config fields required per channel type.
+const CONFIG_FIELDS: Record<ChannelType, string[]> = {
+  webhook: ["url"],
+  slack: ["url"],
+  discord: ["url"],
+  telegram: ["token", "chat_id"],
+  smtp: ["host", "port", "username", "password", "from", "to"],
+};
+
+function ChannelForm({ initial, onDone }: { initial?: NotificationChannel; onDone: () => void }) {
+  const queryClient = useQueryClient();
+  const [name, setName] = useState(initial?.name ?? "");
+  const [type, setType] = useState<ChannelType>(initial?.type ?? "webhook");
+  const [config, setConfig] = useState<Record<string, string>>(initial?.config ?? {});
+
+  const { mutate: submit, isPending, error } = useMutation({
+    mutationFn: (input: ChannelInput) =>
+      initial ? api.updateChannel(initial.channel_id, input) : api.createChannel(input).then(() => undefined),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["channels"] });
+      onDone();
+    },
+  });
+
+  return (
+    <form
+      onSubmit={(e) => {
+        e.preventDefault();
+        submit({ name, type, config, enabled: initial?.enabled ?? true });
+      }}
+      className="space-y-4"
+    >
+      <div>
+        <label className={labelClass}>Name</label>
+        <input className={inputClass} value={name} onChange={(e) => setName(e.target.value)} required />
+      </div>
+      <div>
+        <label className={labelClass}>Type</label>
+        <select
+          className={inputClass}
+          value={type}
+          onChange={(e) => {
+            setType(e.target.value as ChannelType);
+            setConfig({});
+          }}
+        >
+          {(["webhook", "smtp", "discord", "slack", "telegram"] as const).map((t) => (
+            <option key={t} value={t}>
+              {t}
+            </option>
+          ))}
+        </select>
+      </div>
+      {CONFIG_FIELDS[type].map((field) => (
+        <div key={field}>
+          <label className={labelClass}>{field}</label>
+          <input
+            className={inputClass}
+            type={field === "password" ? "password" : "text"}
+            value={config[field] ?? ""}
+            onChange={(e) => setConfig({ ...config, [field]: e.target.value })}
+          />
+        </div>
+      ))}
+      {error && <p className="text-sm text-danger">{(error as Error).message}</p>}
+      <div className="flex gap-3">
+        <Button type="submit" variant="primary" loading={isPending}>
+          {initial ? "Save Changes" : "Add Channel"}
+        </Button>
+        <Button type="button" variant="ghost" onClick={onDone}>
+          Cancel
+        </Button>
+      </div>
+    </form>
+  );
+}
+
+function ChannelRow({ ch }: { ch: NotificationChannel }) {
+  const queryClient = useQueryClient();
+  const [testMsg, setTestMsg] = useState<string | null>(null);
+  const [editing, setEditing] = useState(false);
+
+  const { mutate: remove } = useMutation({
+    mutationFn: () => api.deleteChannel(ch.channel_id),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: ["channels"] }),
+  });
+
+  const { mutate: test, isPending: testing } = useMutation({
+    mutationFn: () => api.testChannel(ch.channel_id),
+    onSuccess: () => setTestMsg("Sent!"),
+    onError: (e) => setTestMsg((e as Error).message),
+  });
+
+  const { mutate: toggle } = useMutation({
+    mutationFn: (enabled: boolean) => api.updateChannel(ch.channel_id, { enabled }),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: ["channels"] }),
+  });
+
+  if (editing) {
+    return (
+      <div className="border-b border-border p-4 last:border-0">
+        <ChannelForm initial={ch} onDone={() => setEditing(false)} />
+      </div>
+    );
+  }
+
+  return (
+    <div className="flex items-center justify-between border-b border-border px-4 py-3 last:border-0">
+      <div>
+        <div className="flex items-center gap-2">
+          <span className="font-medium text-text-primary">{ch.name}</span>
+          <Badge variant="neutral">{ch.type}</Badge>
+          {!ch.enabled && <Badge variant="warning">disabled</Badge>}
+        </div>
+        {testMsg && <p className="mt-1 text-xs text-text-secondary">{testMsg}</p>}
+      </div>
+      <div className="flex items-center gap-2">
+        <Button variant="ghost" size="sm" loading={testing} onClick={() => test()}>
+          Test
+        </Button>
+        <Button variant="ghost" size="sm" onClick={() => setEditing(true)}>
+          Edit
+        </Button>
+        <Button variant="ghost" size="sm" onClick={() => toggle(!ch.enabled)}>
+          {ch.enabled ? "Disable" : "Enable"}
+        </Button>
+        <Button variant="danger" size="sm" onClick={() => remove()}>
+          Delete
+        </Button>
+      </div>
+    </div>
+  );
+}
+
+export default function NotificationSettingsPage() {
+  const [showForm, setShowForm] = useState(false);
+  const { data: channels, isLoading } = useQuery({ queryKey: ["channels"], queryFn: () => api.listChannels() });
+
+  return (
+    <div className="p-8">
+      <div className="mb-6 flex items-center justify-between">
+        <div>
+          <Link href="/monitors" className="text-sm text-text-secondary hover:text-text-primary">
+            ← Monitors
+          </Link>
+          <h1 className="mt-2 text-2xl font-bold text-text-primary">Notification Channels</h1>
+          <p className="mt-1 text-sm text-text-secondary">Alert destinations for monitor state changes.</p>
+        </div>
+        {!showForm && (
+          <Button variant="primary" onClick={() => setShowForm(true)}>
+            New Channel
+          </Button>
+        )}
+      </div>
+
+      {showForm && (
+        <Card className="mb-6 max-w-xl">
+          <ChannelForm onDone={() => setShowForm(false)} />
+        </Card>
+      )}
+
+      <Card padding={false}>
+        {isLoading ? (
+          <div className="flex justify-center py-16">
+            <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+          </div>
+        ) : !channels || channels.length === 0 ? (
+          <div className="py-16 text-center text-sm text-text-secondary">No channels configured.</div>
+        ) : (
+          channels.map((ch) => <ChannelRow key={ch.channel_id} ch={ch} />)
+        )}
+      </Card>
+    </div>
+  );
+}

web/app/settings/page.tsx

@@ -2,423 +2,243 @@
 
 import { useEffect, useState } from "react";
 import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
-import { api, AlertSettings, EmailSettings } from "@/lib/api";
-import { Button, Card, CardHeader, CardTitle } from "@/components/ui";
+import Link from "next/link";
+import { api } from "@/lib/api";
+import { Button, Card } from "@/components/ui";
 
-function Toggle({ enabled, onChange }: { enabled: boolean; onChange: (v: boolean) => void }) {
-  return (
-    <button
-      type="button"
-      onClick={() => onChange(!enabled)}
-      className={`relative inline-flex h-6 w-11 flex-shrink-0 items-center rounded-full transition-colors focus:outline-none ${
-        enabled ? "bg-accent" : "bg-surface-2 border border-border"
-      }`}
-    >
-      <span
-        className={`inline-block h-4 w-4 transform rounded-full bg-white shadow transition-transform ${
-          enabled ? "translate-x-6" : "translate-x-1"
-        }`}
-      />
-    </button>
-  );
+function SectionCard({ title, description, icon, children, className }: { title: string; description?: string; icon: React.ReactNode; children: React.ReactNode; className?: string }) {
+    return (
+        <Card className={className}>
+            <div className="mb-4 flex items-start gap-3">
+                <div className="mt-0.5 flex h-9 w-9 flex-shrink-0 items-center justify-center rounded-lg border border-border bg-surface-2 text-accent">{icon}</div>
+                <div>
+                    <h2 className="text-base font-semibold text-text-primary">{title}</h2>
+                    {description && <p className="mt-0.5 text-sm text-text-secondary">{description}</p>}
+                </div>
+            </div>
+            {children}
+        </Card>
+    );
 }
 
-function ToggleRow({
-  label,
-  description,
-  enabled,
-  onChange,
-}: {
-  label: string;
-  description: string;
-  enabled: boolean;
-  onChange: (v: boolean) => void;
-}) {
-  return (
-    <div className="flex items-center justify-between rounded-lg border border-border bg-surface-2 px-4 py-3">
-      <div>
-        <p className="text-sm font-medium text-text-primary">{label}</p>
-        <p className="text-xs text-text-secondary">{description}</p>
-      </div>
-      <Toggle enabled={enabled} onChange={onChange} />
-    </div>
-  );
-}
-
-function Field({
-  label,
-  hint,
-  children,
-}: {
-  label: string;
-  hint?: string;
-  children: React.ReactNode;
-}) {
-  return (
-    <div>
-      <label className="mb-1.5 block text-sm font-medium text-text-secondary">{label}</label>
-      {children}
-      {hint && <p className="mt-1 text-xs text-text-tertiary">{hint}</p>}
-    </div>
-  );
-}
-
-const inputClass =
-  "w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder:text-text-tertiary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30";
-
-function SecretsTokenCard({
-  tokenSet,
-  rotatedAt,
-}: {
-  tokenSet: boolean;
-  rotatedAt?: string;
-}) {
-  const queryClient = useQueryClient();
-  const [token, setToken] = useState<string | null>(null);
-  const [copied, setCopied] = useState(false);
-  const readUrl =
-    typeof window !== "undefined"
-      ? `${window.location.origin}/api/secrets/<group>/values`
-      : "/api/secrets/<group>/values";
-
-  const { mutate: rotate, isPending } = useMutation({
-    mutationFn: api.rotateSecretsToken,
-    onSuccess: (res) => {
-      setToken(res.token);
-      queryClient.invalidateQueries({ queryKey: ["settings"] });
-    },
-  });
-
-  async function copy() {
-    if (!token) return;
-    await navigator.clipboard.writeText(token);
-    setCopied(true);
-    setTimeout(() => setCopied(false), 2000);
-  }
-
-  return (
-    <Card>
-      <CardHeader>
-        <CardTitle>Secrets Read Token (ESO)</CardTitle>
-      </CardHeader>
-      <p className="mb-5 text-sm text-text-secondary">
-        Kubernetes External Secrets Operator authenticates to the read endpoint with this bearer
-        token. Point your <span className="font-mono">ClusterSecretStore</span> at{" "}
-        <span className="font-mono text-text-primary">{readUrl}</span>.
-      </p>
-
-      <div className="mb-4 flex items-center gap-2 text-sm">
-        <span
-          className={`inline-block h-2 w-2 rounded-full ${tokenSet ? "bg-success" : "bg-text-tertiary"}`}
-        />
-        <span className="text-text-secondary">
-          {tokenSet ? "A read token is configured" : "No read token configured yet"}
-          {tokenSet && rotatedAt && ` · rotated ${new Date(rotatedAt).toLocaleString()}`}
-        </span>
-      </div>
-
-      {token && (
-        <div className="mb-4 rounded-lg border border-warning/30 bg-warning/10 p-3">
-          <p className="mb-2 text-xs font-medium text-warning">
-            Copy this token now — it will not be shown again.
-          </p>
-          <div className="flex items-center gap-2">
-            <code className="flex-1 overflow-x-auto rounded bg-surface-2 px-2 py-1.5 font-mono text-xs text-text-primary">
-              {token}
-            </code>
-            <Button type="button" variant="ghost" size="sm" onClick={copy}>
-              {copied ? "Copied!" : "Copy"}
-            </Button>
-          </div>
+function Field({ label, hint, children }: { label: string; hint?: string; children: React.ReactNode }) {
+    return (
+        <div>
+            <label className="mb-1.5 block text-sm font-medium text-text-secondary">{label}</label>
+            {children}
+            {hint && <p className="mt-1 text-xs text-text-tertiary">{hint}</p>}
         </div>
-      )}
+    );
+}
 
-      <Button type="button" variant="primary" loading={isPending} onClick={() => rotate()}>
-        {tokenSet ? "Rotate Token" : "Generate Token"}
-      </Button>
-      {tokenSet && (
-        <p className="mt-2 text-xs text-text-tertiary">
-          Rotating invalidates the previous token. Update the Kubernetes secret afterwards.
-        </p>
-      )}
-    </Card>
-  );
+function BellIcon() {
+    return (
+        <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+            <path
+                strokeLinecap="round"
+                strokeLinejoin="round"
+                d="M14.857 17.082a23.848 23.848 0 005.454-1.31A8.967 8.967 0 0118 9.75V9A6 6 0 006 9v.75a8.967 8.967 0 01-2.312 6.022c1.733.64 3.56 1.085 5.455 1.31m5.714 0a24.255 24.255 0 01-5.714 0m5.714 0a3 3 0 11-5.714 0"
+            />
+        </svg>
+    );
+}
+
+function ServerIcon() {
+    return (
+        <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+            <path
+                strokeLinecap="round"
+                strokeLinejoin="round"
+                d="M21.75 17.25v-.228a4.5 4.5 0 00-.12-1.03l-2.268-9.64a3.375 3.375 0 00-3.285-2.602H7.923a3.375 3.375 0 00-3.285 2.602l-2.268 9.64a4.5 4.5 0 00-.12 1.03v.228m19.5 0a3 3 0 01-3 3H5.25a3 3 0 01-3-3m19.5 0a3 3 0 00-3-3H5.25a3 3 0 00-3 3m16.5 0h.008v.008h-.008v-.008zm-3 0h.008v.008h-.008v-.008z"
+            />
+        </svg>
+    );
+}
+
+function DocumentIcon() {
+    return (
+        <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+            <path
+                strokeLinecap="round"
+                strokeLinejoin="round"
+                d="M19.5 14.25v-2.625a3.375 3.375 0 00-3.375-3.375h-1.5A1.125 1.125 0 0113.5 7.125v-1.5a3.375 3.375 0 00-3.375-3.375H8.25m2.25 0H5.625c-.621 0-1.125.504-1.125 1.125v17.25c0 .621.504 1.125 1.125 1.125h12.75c.621 0 1.125-.504 1.125-1.125V11.25a9 9 0 00-9-9z"
+            />
+        </svg>
+    );
+}
+
+function KeyIcon() {
+    return (
+        <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+            <path
+                strokeLinecap="round"
+                strokeLinejoin="round"
+                d="M15.75 5.25a3 3 0 013 3m3 0a6 6 0 01-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1121.75 8.25z"
+            />
+        </svg>
+    );
+}
+
+function SecretsTokenCard({ tokenSet, rotatedAt }: { tokenSet: boolean; rotatedAt?: string }) {
+    const queryClient = useQueryClient();
+    const [token, setToken] = useState<string | null>(null);
+    const [copied, setCopied] = useState(false);
+    const readUrl = typeof window !== "undefined" ? `${window.location.origin}/api/secrets/<group>/values` : "/api/secrets/<group>/values";
+
+    const { mutate: rotate, isPending } = useMutation({
+        mutationFn: api.rotateSecretsToken,
+        onSuccess: (res) => {
+            setToken(res.token);
+            queryClient.invalidateQueries({ queryKey: ["settings"] });
+        },
+    });
+
+    async function copy() {
+        if (!token) return;
+        await navigator.clipboard.writeText(token);
+        setCopied(true);
+        setTimeout(() => setCopied(false), 2000);
+    }
+
+    return (
+        <SectionCard title="Secrets Read Token (ESO)" description="Kubernetes External Secrets Operator authenticates to the read endpoint with this bearer token." icon={<KeyIcon />}>
+            <p className="mb-4 text-sm text-text-secondary">
+                Point your <span className="font-mono">ClusterSecretStore</span> at <span className="font-mono text-text-primary">{readUrl}</span>.
+            </p>
+
+            <div className="mb-4 flex items-center gap-2 text-sm">
+                <span className={`inline-block h-2 w-2 rounded-full ${tokenSet ? "bg-success" : "bg-text-tertiary"}`} />
+                <span className="text-text-secondary">
+                    {tokenSet ? "A read token is configured" : "No read token configured yet"}
+                    {tokenSet && rotatedAt && ` · rotated ${new Date(rotatedAt).toLocaleString()}`}
+                </span>
+            </div>
+
+            {token && (
+                <div className="mb-4 rounded-lg border border-warning/30 bg-warning/10 p-3">
+                    <p className="mb-2 text-xs font-medium text-warning">Copy this token now — it will not be shown again.</p>
+                    <div className="flex items-center gap-2">
+                        <code className="flex-1 overflow-x-auto rounded bg-surface-2 px-2 py-1.5 font-mono text-xs text-text-primary">{token}</code>
+                        <Button type="button" variant="ghost" size="sm" onClick={copy}>
+                            {copied ? "Copied!" : "Copy"}
+                        </Button>
+                    </div>
+                </div>
+            )}
+
+            <Button type="button" variant="primary" loading={isPending} onClick={() => rotate()}>
+                {tokenSet ? "Rotate Token" : "Generate Token"}
+            </Button>
+            {tokenSet && <p className="mt-2 text-xs text-text-tertiary">Rotating invalidates the previous token. Update the Kubernetes secret afterwards.</p>}
+        </SectionCard>
+    );
 }
 
 export default function SettingsPage() {
-  const queryClient = useQueryClient();
+    const queryClient = useQueryClient();
 
-  const { data: settings, isLoading } = useQuery({
-    queryKey: ["settings"],
-    queryFn: api.getSettings,
-  });
+    const { data: settings, isLoading } = useQuery({ queryKey: ["settings"], queryFn: api.getSettings });
 
-  // Webhook / offline alerting state
-  const [alertsEnabled, setAlertsEnabled] = useState(false);
-  const [webhookURL, setWebhookURL] = useState("");
-  const [thresholdMinutes, setThresholdMinutes] = useState(5);
+    const [thresholdMinutes, setThresholdMinutes] = useState(5);
+    const [logRetentionDays, setLogRetentionDays] = useState(30);
+    const [saved, setSaved] = useState(false);
 
-  // Email state
-  const [emailEnabled, setEmailEnabled] = useState(false);
-  const [smtpHost, setSmtpHost] = useState("");
-  const [smtpPort, setSmtpPort] = useState(587);
-  const [smtpUser, setSmtpUser] = useState("");
-  const [smtpPass, setSmtpPass] = useState("");
-  const [fromAddr, setFromAddr] = useState("");
-  const [toAddrs, setToAddrs] = useState(""); // comma-separated in UI
-  const [useTLS, setUseTLS] = useState(false);
+    useEffect(() => {
+        if (!settings) return;
+        setThresholdMinutes(settings.alerts.offline_threshold_minutes || 5);
+        setLogRetentionDays(settings.workflow_log_retention_days ?? 30);
+    }, [settings]);
 
-  // Workflow log retention (days). 0 = keep forever.
-  const [logRetentionDays, setLogRetentionDays] = useState(30);
-
-  const [saved, setSaved] = useState(false);
-
-  useEffect(() => {
-    if (!settings) return;
-    setAlertsEnabled(settings.alerts.enabled);
-    setWebhookURL(settings.alerts.webhook_url ?? "");
-    setThresholdMinutes(settings.alerts.offline_threshold_minutes || 5);
-    setEmailEnabled(settings.email?.enabled ?? false);
-    setSmtpHost(settings.email?.smtp_host ?? "");
-    setSmtpPort(settings.email?.smtp_port || 587);
-    setSmtpUser(settings.email?.username ?? "");
-    setSmtpPass(settings.email?.password ?? "");
-    setFromAddr(settings.email?.from_addr ?? "");
-    setToAddrs((settings.email?.to_addrs ?? []).join(", "));
-    setUseTLS(settings.email?.use_tls ?? false);
-    setLogRetentionDays(settings.workflow_log_retention_days ?? 30);
-  }, [settings]);
-
-  const { mutate: save, isPending } = useMutation({
-    mutationFn: (payload: {
-      alerts: AlertSettings;
-      email: EmailSettings;
-      workflow_log_retention_days?: number | null;
-    }) => api.saveSettings(payload),
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ["settings"] });
-      setSaved(true);
-      setTimeout(() => setSaved(false), 3000);
-    },
-  });
-
-  function handleSubmit(e: React.FormEvent) {
-    e.preventDefault();
-    const toList = toAddrs
-      .split(",")
-      .map((s) => s.trim())
-      .filter(Boolean);
-
-    save({
-      alerts: {
-        enabled: alertsEnabled,
-        webhook_url: webhookURL,
-        offline_threshold_minutes: thresholdMinutes,
-      },
-      email: {
-        enabled: emailEnabled,
-        smtp_host: smtpHost,
-        smtp_port: smtpPort,
-        username: smtpUser,
-        password: smtpPass,
-        from_addr: fromAddr,
-        to_addrs: toList,
-        use_tls: useTLS,
-      },
-      workflow_log_retention_days: logRetentionDays,
+    const { mutate: save, isPending } = useMutation({
+        mutationFn: (payload: Parameters<typeof api.saveSettings>[0]) => api.saveSettings(payload),
+        onSuccess: () => {
+            queryClient.invalidateQueries({ queryKey: ["settings"] });
+            setSaved(true);
+            setTimeout(() => setSaved(false), 3000);
+        },
     });
-  }
 
-  if (isLoading) {
+    function handleSubmit(e: React.FormEvent) {
+        e.preventDefault();
+        if (!settings) return;
+        // Preserve legacy alert/email values (managed via Notification Channels now);
+        // only the offline threshold and log retention are edited here.
+        save({
+            alerts: { ...settings.alerts, offline_threshold_minutes: thresholdMinutes },
+            email: settings.email,
+            workflow_log_retention_days: logRetentionDays,
+        });
+    }
+
+    if (isLoading) {
+        return (
+            <div className="flex h-full items-center justify-center">
+                <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
+            </div>
+        );
+    }
+
     return (
-      <div className="flex h-full items-center justify-center">
-        <div className="h-8 w-8 animate-spin rounded-full border-2 border-border border-t-accent" />
-      </div>
-    );
-  }
-
-  return (
-    <div className="p-8">
-      <div className="mb-6">
-        <h1 className="text-2xl font-bold text-text-primary">Settings</h1>
-        <p className="mt-1 text-sm text-text-secondary">Configure alerting and monitoring behaviour</p>
-      </div>
-
-      <form onSubmit={handleSubmit} className="max-w-xl space-y-6">
-        {/* Webhook alerting */}
-        <Card>
-          <CardHeader>
-            <CardTitle>Webhook Alerting</CardTitle>
-          </CardHeader>
-          <p className="mb-5 text-sm text-text-secondary">
-            POST a JSON payload to a URL when a server goes offline. Compatible with Slack,
-            Discord, n8n, and any service that accepts JSON.
-          </p>
-          <div className="space-y-4">
-            <ToggleRow
-              label="Enable webhook alerts"
-              description="Webhook fires only when this is on"
-              enabled={alertsEnabled}
-              onChange={setAlertsEnabled}
-            />
-            <Field
-              label="Webhook URL"
-              hint={`POST body: { event, hostname, server_id, ip_address, timestamp, message }`}
-            >
-              <input
-                type="url"
-                value={webhookURL}
-                onChange={(e) => setWebhookURL(e.target.value)}
-                placeholder="https://hooks.slack.com/... or https://discord.com/api/webhooks/..."
-                className={inputClass}
-              />
-            </Field>
-            <Field
-              label="Offline threshold (minutes)"
-              hint="How long a server must be silent before being marked offline. Agents poll every 30s, so 5 minutes is a safe minimum."
-            >
-              <input
-                type="number"
-                min={1}
-                max={60}
-                value={thresholdMinutes}
-                onChange={(e) => setThresholdMinutes(Number(e.target.value))}
-                className="w-32 rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
-              />
-            </Field>
-          </div>
-        </Card>
-
-        {/* Email alerting */}
-        <Card>
-          <CardHeader>
-            <CardTitle>Email Notifications</CardTitle>
-          </CardHeader>
-          <p className="mb-5 text-sm text-text-secondary">
-            Send an email when a server goes offline. Uses the same offline threshold as the
-            webhook setting above.
-          </p>
-          <div className="space-y-4">
-            <ToggleRow
-              label="Enable email alerts"
-              description="Emails are only sent when this is on"
-              enabled={emailEnabled}
-              onChange={setEmailEnabled}
-            />
-            <div className="grid grid-cols-3 gap-3">
-              <Field label="SMTP Host" hint="">
-                <input
-                  type="text"
-                  value={smtpHost}
-                  onChange={(e) => setSmtpHost(e.target.value)}
-                  placeholder="smtp.gmail.com"
-                  className={inputClass}
-                />
-              </Field>
-              <Field label="Port" hint="">
-                <input
-                  type="number"
-                  value={smtpPort}
-                  onChange={(e) => setSmtpPort(Number(e.target.value))}
-                  placeholder="587"
-                  className={inputClass}
-                />
-              </Field>
-              <div className="flex flex-col justify-center pt-5">
-                <ToggleRow
-                  label="TLS (port 465)"
-                  description="Use implicit TLS instead of STARTTLS"
-                  enabled={useTLS}
-                  onChange={(v) => {
-                    setUseTLS(v);
-                    setSmtpPort(v ? 465 : 587);
-                  }}
-                />
-              </div>
+        <div className="p-8">
+            <div className="mb-8">
+                <h1 className="text-2xl font-bold text-text-primary">Settings</h1>
+                <p className="mt-1 text-sm text-text-secondary">Configure monitoring, alerting, and integrations.</p>
             </div>
-            <div className="grid grid-cols-2 gap-3">
-              <Field label="Username">
-                <input
-                  type="text"
-                  value={smtpUser}
-                  onChange={(e) => setSmtpUser(e.target.value)}
-                  placeholder="user@example.com"
-                  className={inputClass}
-                  autoComplete="username"
-                />
-              </Field>
-              <Field label="Password">
-                <input
-                  type="password"
-                  value={smtpPass}
-                  onChange={(e) => setSmtpPass(e.target.value)}
-                  placeholder="App password or SMTP password"
-                  className={inputClass}
-                  autoComplete="new-password"
-                />
-              </Field>
+
+            <div className="space-y-6">
+                {/* Alerting — replaces the legacy webhook/email settings */}
+                <SectionCard title="Alerting" description="Alerts are now delivered through notification channels, triggered by service monitors." icon={<BellIcon />}>
+                    <div className="flex flex-wrap gap-3">
+                        <Link href="/settings/notifications">
+                            <Button variant="secondary">Manage Notification Channels</Button>
+                        </Link>
+                        <Link href="/monitors">
+                            <Button variant="ghost">View Monitors</Button>
+                        </Link>
+                    </div>
+                    <p className="mt-4 text-xs text-text-tertiary">
+                        Webhook, email (SMTP), Discord, Slack, and Telegram destinations are configured under Notification Channels and attached per monitor.
+                    </p>
+                </SectionCard>
+
+                <form onSubmit={handleSubmit}>
+                    <div className="grid grid-cols-1 gap-6 lg:grid-cols-2">
+                        <SectionCard title="Server Health" description="When to consider an agent-backed server offline." icon={<ServerIcon />}>
+                            <Field label="Offline threshold (minutes)" hint="How long a server must be silent before being marked offline. Agents poll every 30s, so 5 minutes is a safe minimum.">
+                                <input
+                                    type="number"
+                                    min={1}
+                                    max={60}
+                                    value={thresholdMinutes}
+                                    onChange={(e) => setThresholdMinutes(Number(e.target.value))}
+                                    className="w-32 rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                                />
+                            </Field>
+                        </SectionCard>
+
+                        <SectionCard title="Workflow Logs" description="How long run logs are kept before automatic deletion." icon={<DocumentIcon />}>
+                            <Field label="Log retention (days)" hint="0 = keep forever. Applies to per-run step output logs.">
+                                <input
+                                    type="number"
+                                    min={0}
+                                    value={logRetentionDays}
+                                    onChange={(e) => setLogRetentionDays(Number(e.target.value))}
+                                    className="w-32 rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
+                                />
+                            </Field>
+                        </SectionCard>
+                    </div>
+
+                    <div className="mt-6 flex items-center gap-3">
+                        <Button type="submit" variant="primary" loading={isPending}>
+                            {saved ? "Saved!" : "Save Settings"}
+                        </Button>
+                        {saved && <span className="text-sm text-success">Settings saved successfully.</span>}
+                    </div>
+                </form>
+
+                <SecretsTokenCard tokenSet={settings?.secrets?.read_token_set ?? false} rotatedAt={settings?.secrets?.rotated_at} />
             </div>
-            <Field label="From address">
-              <input
-                type="email"
-                value={fromAddr}
-                onChange={(e) => setFromAddr(e.target.value)}
-                placeholder="vantage@example.com"
-                className={inputClass}
-              />
-            </Field>
-            <Field
-              label="To addresses"
-              hint="Separate multiple addresses with commas"
-            >
-              <input
-                type="text"
-                value={toAddrs}
-                onChange={(e) => setToAddrs(e.target.value)}
-                placeholder="admin@example.com, ops@example.com"
-                className={inputClass}
-              />
-            </Field>
-          </div>
-        </Card>
-
-        {/* Workflow logs */}
-        <Card>
-          <CardHeader>
-            <CardTitle>Workflow Logs</CardTitle>
-          </CardHeader>
-          <p className="mb-5 text-sm text-text-secondary">
-            How long to keep workflow run logs on the server before they are
-            automatically deleted.
-          </p>
-          <Field
-            label="Log retention (days)"
-            hint="0 = keep forever. Applies to per-run step output logs."
-          >
-            <input
-              type="number"
-              min={0}
-              value={logRetentionDays}
-              onChange={(e) => setLogRetentionDays(Number(e.target.value))}
-              className="w-32 rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30"
-            />
-          </Field>
-        </Card>
-
-        <div className="flex items-center gap-3">
-          <Button type="submit" variant="primary" loading={isPending}>
-            {saved ? "Saved!" : "Save Settings"}
-          </Button>
-          {saved && <span className="text-sm text-success">Settings saved successfully.</span>}
         </div>
-      </form>
-
-      <div className="mt-6 max-w-xl">
-        <SecretsTokenCard
-          tokenSet={settings?.secrets?.read_token_set ?? false}
-          rotatedAt={settings?.secrets?.rotated_at}
-        />
-      </div>
-    </div>
-  );
+    );
 }

web/app/steps/page.tsx

@@ -0,0 +1,214 @@
+"use client";
+
+import { useMemo, useRef, useState } from "react";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { api, WorkflowStep } from "@/lib/api";
+import { Button } from "@/components/ui";
+import { EditStepModal } from "@/components/workflows/EditStepModal";
+
+type Tab = "all" | "bash" | "powershell" | "default" | "shared";
+
+const inputClass =
+  "w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder-text-secondary/50 focus:border-signal focus:outline-none focus:ring-1 focus:ring-signal";
+
+function ShellBadge({ interpreter }: { interpreter: "bash" | "powershell" }) {
+  const isBash = interpreter === "bash";
+  return (
+    <span className={`rounded px-1.5 py-0.5 font-mono text-[10px] uppercase ${isBash ? "bg-bash/15 text-bash" : "bg-pwsh/15 text-pwsh"}`}>
+      {isBash ? "bash" : "pwsh"}
+    </span>
+  );
+}
+
+export default function StepsPage() {
+  const qc = useQueryClient();
+  const { data: steps } = useQuery({ queryKey: ["steps"], queryFn: api.listSteps });
+  const { data: usage } = useQuery({ queryKey: ["step-usage"], queryFn: api.stepUsage });
+
+  const [search, setSearch] = useState("");
+  const [tab, setTab] = useState<Tab>("all");
+  const [editOpen, setEditOpen] = useState(false);
+  const [editing, setEditing] = useState<WorkflowStep | null>(null);
+  const [importing, setImporting] = useState(false);
+  const [syncing, setSyncing] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [notice, setNotice] = useState<string | null>(null);
+  const fileRef = useRef<HTMLInputElement>(null);
+
+  const rows = useMemo(() => {
+    const q = search.toLowerCase();
+    return (steps ?? []).filter((s) => {
+      const matchesText = s.name.toLowerCase().includes(q) || (s.description ?? "").toLowerCase().includes(q);
+      const matchesTab =
+        tab === "all" ||
+        (tab === "bash" && s.interpreter === "bash") ||
+        (tab === "powershell" && s.interpreter === "powershell") ||
+        (tab === "default" && s.source === "default") ||
+        (tab === "shared" && s.source !== "default");
+      return matchesText && matchesTab;
+    });
+  }, [steps, search, tab]);
+
+  const openNew = () => {
+    setEditing(null);
+    setEditOpen(true);
+  };
+  const openEdit = (s: WorkflowStep) => {
+    setEditing(s);
+    setEditOpen(true);
+  };
+
+  const onImport = async (e: React.ChangeEvent<HTMLInputElement>) => {
+    const file = e.target.files?.[0];
+    if (!file) return;
+    setImporting(true);
+    setError(null);
+    try {
+      const doc = JSON.parse(await file.text());
+      await api.importStep(doc);
+      qc.invalidateQueries({ queryKey: ["steps"] });
+      setNotice("Step imported.");
+    } catch (err) {
+      setError((err as Error).message);
+    } finally {
+      setImporting(false);
+      e.target.value = "";
+    }
+  };
+
+  const onSync = async () => {
+    setSyncing(true);
+    setError(null);
+    try {
+      const { created, updated } = await api.seedDefaults();
+      qc.invalidateQueries({ queryKey: ["steps"] });
+      setNotice(`${created} created, ${updated} updated`);
+    } catch (err) {
+      setError((err as Error).message);
+    } finally {
+      setSyncing(false);
+    }
+  };
+
+  return (
+    <div className="p-8">
+      <div className="mb-6 flex items-center gap-3">
+        <div>
+          <h1 className="text-xl font-semibold text-text-primary">Steps</h1>
+          <p className="text-sm text-text-secondary">Reusable steps shared across all workflows.</p>
+        </div>
+        <div className="ml-auto flex items-center gap-2">
+          <input ref={fileRef} type="file" accept="application/json" className="hidden" onChange={onImport} />
+          <Button variant="secondary" size="sm" loading={syncing} onClick={onSync}>
+            Sync defaults
+          </Button>
+          <Button variant="secondary" size="sm" loading={importing} onClick={() => fileRef.current?.click()}>
+            Import
+          </Button>
+          <Button size="sm" onClick={openNew}>
+            + New step
+          </Button>
+        </div>
+      </div>
+
+      {error && <div className="mb-4 rounded border border-danger/30 bg-danger/10 px-3 py-2 text-sm text-danger">{error}</div>}
+      {notice && <div className="mb-4 rounded border border-signal/30 bg-signal/10 px-3 py-2 text-sm text-signal">{notice}</div>}
+
+      <div className="mb-4 flex items-center gap-2">
+        <input className={`${inputClass} max-w-sm`} placeholder="Search steps…" value={search} onChange={(e) => setSearch(e.target.value)} />
+        <div className="flex gap-1.5">
+          {(["all", "bash", "powershell", "default", "shared"] as Tab[]).map((t) => (
+            <button
+              key={t}
+              onClick={() => setTab(t)}
+              className={`rounded-full border px-3 py-1 text-xs capitalize ${
+                tab === t ? "border-signal/50 bg-signal/15 text-signal" : "border-border bg-surface-2 text-text-secondary hover:text-text-primary"
+              }`}
+            >
+              {t === "powershell" ? "PowerShell" : t}
+            </button>
+          ))}
+        </div>
+      </div>
+
+      <div className="overflow-x-auto rounded-lg border border-border">
+        <table className="w-full text-sm">
+          <thead>
+            <tr className="border-b border-border text-left text-[11px] uppercase tracking-wide text-text-secondary">
+              <th className="px-4 py-2.5 font-bold">Name</th>
+              <th className="px-4 py-2.5 font-bold">Shell</th>
+              <th className="px-4 py-2.5 font-bold">Source</th>
+              <th className="px-4 py-2.5 font-bold">Outputs</th>
+              <th className="px-4 py-2.5 font-bold">Used by</th>
+              <th className="px-4 py-2.5 text-right font-bold">Actions</th>
+            </tr>
+          </thead>
+          <tbody>
+            {rows.map((s) => {
+              const count = usage?.[s.step_id] ?? 0;
+              return (
+                <tr key={s.step_id} className="border-b border-border last:border-0">
+                  <td className="px-4 py-3">
+                    <div className="font-medium text-text-primary">{s.name}</div>
+                    {s.description && <div className="text-xs text-text-secondary">{s.description}</div>}
+                  </td>
+                  <td className="px-4 py-3">
+                    <ShellBadge interpreter={s.interpreter} />
+                  </td>
+                  <td className="px-4 py-3">
+                    <span className="rounded bg-surface-2 px-1.5 py-0.5 font-mono text-[10px] uppercase text-text-secondary">
+                      {s.source === "default" ? "default" : "shared"}
+                    </span>
+                  </td>
+                  <td className="px-4 py-3">
+                    <div className="flex flex-wrap gap-1">
+                      {(s.declared_outputs ?? []).map((o) => (
+                        <span key={o} className="rounded border border-signal/35 px-1.5 py-0.5 font-mono text-[10px] text-signal">
+                          {o}
+                        </span>
+                      ))}
+                    </div>
+                  </td>
+                  <td className="px-4 py-3 text-text-secondary">
+                    {count === 0 ? "—" : `${count} workflow${count === 1 ? "" : "s"}`}
+                  </td>
+                  <td className="px-4 py-3 text-right">
+                    <div className="flex items-center justify-end gap-3 text-text-secondary">
+                      <button onClick={() => openEdit(s)} className="hover:text-text-primary">
+                        Edit
+                      </button>
+                      <a href={api.exportStepUrl(s.step_id)} download className="hover:text-text-primary">
+                        Export
+                      </a>
+                      <button onClick={() => openEdit(s)} className="hover:text-danger">
+                        Delete
+                      </button>
+                    </div>
+                  </td>
+                </tr>
+              );
+            })}
+            {rows.length === 0 && (
+              <tr>
+                <td colSpan={6} className="px-4 py-8 text-center text-sm text-text-secondary">
+                  No steps found.
+                </td>
+              </tr>
+            )}
+          </tbody>
+        </table>
+      </div>
+
+      <EditStepModal
+        key={editing?.step_id ?? "new"}
+        open={editOpen}
+        step={editing}
+        onClose={() => {
+          setEditOpen(false);
+          qc.invalidateQueries({ queryKey: ["steps"] });
+          qc.invalidateQueries({ queryKey: ["step-usage"] });
+        }}
+      />
+    </div>
+  );
+}

web/app/workflows/[id]/page.tsx

@@ -1,13 +1,13 @@
 "use client";
 
-import { useEffect, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import Link from "next/link";
 import { useParams, useRouter } from "next/navigation";
-import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { useQuery } from "@tanstack/react-query";
 import { api, Workflow, WorkflowStep, WorkflowStepRef, SecretGroupSummary } from "@/lib/api";
 import { Button } from "@/components/ui";
-import { EditStepModal } from "@/components/workflows/EditStepModal";
 import { EditWorkflowModal } from "@/components/workflows/EditWorkflowModal";
+import { StepPickerModal } from "@/components/workflows/StepPickerModal";
 
 const inputClass =
     "w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder-text-secondary/50 focus:border-signal focus:outline-none focus:ring-1 focus:ring-signal";
@@ -16,34 +16,55 @@ type DragPayload = { kind: "lib"; stepId: string } | { kind: "move"; from: numbe
 
 function ShellBadge({ interpreter }: { interpreter: "bash" | "powershell" }) {
     const isBash = interpreter === "bash";
-    return (
-        <span
-            className={`rounded px-1.5 py-0.5 font-mono text-[10px] uppercase ${
-                isBash ? "bg-bash/15 text-bash" : "bg-pwsh/15 text-pwsh"
-            }`}
-        >
-            {isBash ? "bash" : "pwsh"}
-        </span>
-    );
+    return <span className={`rounded px-1.5 py-0.5 font-mono text-[10px] uppercase ${isBash ? "bg-bash/15 text-bash" : "bg-pwsh/15 text-pwsh"}`}>{isBash ? "bash" : "pwsh"}</span>;
+}
+
+function AdhocBadge() {
+    return <span className="rounded px-1.5 py-0.5 font-mono text-[10px] uppercase bg-signal/15 text-signal">ad-hoc</span>;
+}
+
+// Stable snapshot of only the fields the editor controls. Excludes volatile
+// server-echo fields (e.g. updated_at) that would otherwise change on every
+// save and cause autosave to loop forever.
+function snapshotOf(w: Workflow): string {
+    return JSON.stringify({
+        name: w.name,
+        target_server_ids: w.target_server_ids,
+        steps: w.steps,
+    });
+}
+
+function timeAgo(date: Date): string {
+    const s = Math.floor((Date.now() - date.getTime()) / 1000);
+    if (s < 5) return "just now";
+    if (s < 60) return `${s}s ago`;
+    const m = Math.floor(s / 60);
+    if (m < 60) return `${m}m ago`;
+    const h = Math.floor(m / 60);
+    return `${h}h ago`;
 }
 
 export default function WorkflowBuilder() {
     const params = useParams<{ id: string }>();
     const id = params.id;
     const router = useRouter();
-    const queryClient = useQueryClient();
 
     const [wf, setWf] = useState<Workflow | null>(null);
     const [selected, setSelected] = useState<number | null>(null);
-    const [search, setSearch] = useState("");
     const [saving, setSaving] = useState(false);
+    const [lastSaved, setLastSaved] = useState<Date | null>(null);
+    const [, setTick] = useState(0);
+    const savedSnapshotRef = useRef<string | null>(null);
+    const savingRef = useRef(false);
+    const wfRef = useRef<Workflow | null>(null);
     const [running, setRunning] = useState(false);
     const [error, setError] = useState<string | null>(null);
+    const [notice, setNotice] = useState<string | null>(null);
+    const [importingInline, setImportingInline] = useState(false);
     const [groupKeys, setGroupKeys] = useState<Record<string, string[]>>({});
     const [editWorkflowOpen, setEditWorkflowOpen] = useState(false);
-    const [editingStep, setEditingStep] = useState<WorkflowStep | null>(null);
-    const [editStepOpen, setEditStepOpen] = useState(false);
     const [dragOverZone, setDragOverZone] = useState<number | null>(null);
+    const [pickerOpen, setPickerOpen] = useState(false);
 
     const { data: loaded } = useQuery({
         queryKey: ["workflow", id],
@@ -56,7 +77,10 @@ export default function WorkflowBuilder() {
     });
 
     useEffect(() => {
-        if (loaded && !wf) setWf(loaded);
+        if (loaded && !wf) {
+            setWf(loaded);
+            savedSnapshotRef.current = snapshotOf(loaded);
+        }
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [loaded]);
 
@@ -80,11 +104,36 @@ export default function WorkflowBuilder() {
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [secretGroups]);
 
+    // Keep a ref to the latest workflow so an in-flight save can tell whether
+    // the user edited again while the request was on the wire.
+    wfRef.current = wf;
+
+    // Autosave: debounce 800ms after any change to the workflow (step added,
+    // removed, reordered, or edited) and persist. Diffing the serialized state
+    // against the last saved snapshot skips no-op saves and the initial load.
+    // Must stay above the early return below so hook order is stable.
+    useEffect(() => {
+        if (!wf || savedSnapshotRef.current === null) return;
+        if (snapshotOf(wf) === savedSnapshotRef.current) return;
+        const t = setTimeout(() => {
+            save();
+        }, 800);
+        return () => clearTimeout(t);
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [wf]);
+
+    // Re-render every 15s so the "Saved … ago" label stays current.
+    useEffect(() => {
+        if (!lastSaved) return;
+        const iv = setInterval(() => setTick((n) => n + 1), 15000);
+        return () => clearInterval(iv);
+    }, [lastSaved]);
+
     if (!wf) {
         return <div className="p-8 text-text-secondary">Loading…</div>;
     }
 
-    const libById = (sid: string) => library?.find((l) => l.step_id === sid);
+    const libById = (sid?: string) => (sid ? library?.find((l) => l.step_id === sid) : undefined);
 
     const sortedSteps = [...wf.steps].sort((a, b) => a.order - b.order);
     const selectedRef = selected !== null ? sortedSteps[selected] : null;
@@ -92,19 +141,44 @@ export default function WorkflowBuilder() {
     const selectedIdxInWf = selectedRef ? wf.steps.indexOf(selectedRef) : -1;
 
     const save = async () => {
+        // Never run two saves concurrently: a request in flight would race the
+        // next one. The finally block re-triggers if edits landed meanwhile.
+        if (savingRef.current) return;
+        const current = wfRef.current;
+        if (!current) return;
+        const snapshot = snapshotOf(current);
+        if (snapshot === savedSnapshotRef.current) return;
+        savingRef.current = true;
         setSaving(true);
         setError(null);
         try {
-            const updated = await api.updateWorkflow(id, wf);
+            const updated = await api.updateWorkflow(id, current);
             if (!updated || !Array.isArray(updated.steps)) {
                 setError("Save failed: server returned an unexpected response.");
                 return;
             }
-            setWf(updated);
+            if (wfRef.current && snapshotOf(wfRef.current) === snapshot) {
+                // Nothing changed while the request was in flight: adopt the
+                // server echo as the new saved baseline.
+                savedSnapshotRef.current = snapshotOf(updated);
+                setWf(updated);
+            } else {
+                // The user edited again mid-flight. Keep their newer state and
+                // mark only the SENT snapshot as saved, so the effect re-fires
+                // and persists the remaining changes.
+                savedSnapshotRef.current = snapshot;
+            }
+            setLastSaved(new Date());
         } catch (e) {
             setError((e as Error).message);
         } finally {
+            savingRef.current = false;
             setSaving(false);
+            // If edits arrived during the save (or a concurrent save was
+            // skipped), persist them on the next tick.
+            if (wfRef.current && snapshotOf(wfRef.current) !== savedSnapshotRef.current) {
+                setTimeout(() => save(), 0);
+            }
         }
     };
 
@@ -128,6 +202,28 @@ export default function WorkflowBuilder() {
         setWf({ ...wf, steps: resequence(next) });
     };
 
+    const appendRef = (ref: WorkflowStepRef) => {
+        setWf({ ...wf, steps: resequence([...sortedSteps, ref]) });
+    };
+
+    const addAdhocStep = () => {
+        appendRef({
+            inline: {
+                step_id: "",
+                name: "New ad-hoc step",
+                description: "",
+                interpreter: "bash",
+                script: "",
+                declared_outputs: [],
+                declared_inputs: [],
+                secret_refs: [],
+            },
+            order: wf.steps.length,
+            on_failure: "stop",
+            max_retries: 0,
+        });
+    };
+
     const moveStep = (from: number, pos: number) => {
         const next = [...sortedSteps];
         const [item] = next.splice(from, 1);
@@ -165,6 +261,12 @@ export default function WorkflowBuilder() {
             steps: wf.steps.map((r, i) => (i === idx ? { ...r, ...patch } : r)),
         });
 
+    const updateInline = (idx: number, patch: Partial<WorkflowStep>) =>
+        setWf({
+            ...wf,
+            steps: wf.steps.map((r, i) => (i === idx && r.inline ? { ...r, inline: { ...r.inline, ...patch } } : r)),
+        });
+
     const removeStep = (idx: number) => {
         const remaining = resequence(wf.steps.filter((_, i) => i !== idx));
         setWf({ ...wf, steps: remaining });
@@ -173,17 +275,18 @@ export default function WorkflowBuilder() {
 
     const toggleSecretRef = (ref: string) => {
         if (selectedIdxInWf === -1 || !selectedRef) return;
+        if (selectedRef.inline) {
+            const current = selectedRef.inline.secret_refs ?? [];
+            const next = current.includes(ref) ? current.filter((r) => r !== ref) : [...current, ref];
+            updateInline(selectedIdxInWf, { secret_refs: next });
+            return;
+        }
         const current = selectedRef.overrides?.secret_refs ?? [];
         const next = current.includes(ref) ? current.filter((r) => r !== ref) : [...current, ref];
         updateRef(selectedIdxInWf, { overrides: { ...selectedRef.overrides, secret_refs: next } });
     };
 
-    const filteredLibrary = (library ?? []).filter((s) => s.name.toLowerCase().includes(search.toLowerCase()));
-    const bashSteps = filteredLibrary.filter((s) => s.interpreter === "bash");
-    const pwshSteps = filteredLibrary.filter((s) => s.interpreter === "powershell");
-
-    const upstreamOutputsFor = (i: number) =>
-        Array.from(new Set(sortedSteps.slice(0, i).flatMap((r) => libById(r.step_id)?.declared_outputs ?? [])));
+    const upstreamOutputsFor = (i: number) => Array.from(new Set(sortedSteps.slice(0, i).flatMap((r) => r.inline?.declared_outputs ?? libById(r.step_id)?.declared_outputs ?? [])));
 
     const DropZone = ({ pos }: { pos: number }) => (
         <div
@@ -204,103 +307,42 @@ export default function WorkflowBuilder() {
                 <div className="flex items-center gap-1.5 text-sm">
                     <span className="text-text-secondary">Workflows /</span>
                     <span className="font-medium text-text-primary">{wf.name}</span>
-                    <span className="text-text-secondary">· draft</span>
+                    <span className="text-text-secondary">· {saving ? "Saving…" : lastSaved ? `Saved ${timeAgo(lastSaved)}` : ""}</span>
                 </div>
                 <div className="ml-auto flex items-center gap-2">
-                    <span className="rounded-full border border-border bg-surface-2 px-3 py-1 text-xs text-text-secondary">
-                        {wf.target_server_ids.length} servers
-                    </span>
-                    <Link
-                        href={`/workflows/${id}/runs`}
-                        className="rounded-lg border border-border bg-surface-2 px-3 py-1.5 text-sm text-text-secondary hover:text-text-primary"
-                    >
+                    <span className="rounded-full border border-border bg-surface-2 px-3 py-1 text-xs text-text-secondary">{wf.target_server_ids.length} servers</span>
+                    <Link href={`/workflows/${id}/runs`} className="rounded-lg border border-border bg-surface-2 px-3 py-1.5 text-sm text-text-secondary hover:text-text-primary">
                         Runs
                     </Link>
                     <Button variant="secondary" size="sm" onClick={() => setEditWorkflowOpen(true)}>
                         Edit
                     </Button>
-                    <Button variant="secondary" size="sm" loading={saving} onClick={save}>
-                        Save
-                    </Button>
-                    <Button
-                        size="sm"
-                        loading={running}
-                        onClick={run}
-                        className="bg-signal text-signal-ink border-transparent hover:bg-signal/90"
-                    >
+                    <Button size="sm" loading={running} onClick={run} className="bg-signal text-signal-ink border-transparent hover:bg-signal/90">
                         Run workflow
                     </Button>
                 </div>
             </div>
 
-            {error && (
-                <div className="border-b border-danger/30 bg-danger/10 px-4 py-2 text-sm text-danger">{error}</div>
-            )}
-
-            <div className="grid h-[calc(100vh-53px)] grid-cols-[264px_1fr_320px]">
-                {/* LEFT: library */}
-                <aside className="overflow-auto border-r border-border bg-surface p-3">
-                    <div className="mb-2 flex items-center justify-between">
-                        <h2 className="text-xs font-bold uppercase tracking-wide text-text-secondary">Step Library</h2>
-                        <Button
-                            variant="ghost"
-                            size="sm"
-                            onClick={() => {
-                                setEditingStep(null);
-                                setEditStepOpen(true);
-                            }}
-                        >
-                            +
-                        </Button>
-                    </div>
-                    <input
-                        className={`${inputClass} mb-3`}
-                        placeholder="Search steps…"
-                        value={search}
-                        onChange={(e) => setSearch(e.target.value)}
-                    />
-
-                    {bashSteps.length > 0 && (
-                        <>
-                            <h3 className="mb-1 mt-2 text-[11px] font-bold uppercase tracking-wide text-text-secondary">
-                                Shared · Bash
-                            </h3>
-                            {bashSteps.map((s) => (
-                                <LibraryCard key={s.step_id} step={s} onAdd={() => insertLibStep(s.step_id, sortedSteps.length)} onEdit={() => {
-                                    setEditingStep(s);
-                                    setEditStepOpen(true);
-                                }} />
-                            ))}
-                        </>
-                    )}
-
-                    {pwshSteps.length > 0 && (
-                        <>
-                            <h3 className="mb-1 mt-3 text-[11px] font-bold uppercase tracking-wide text-text-secondary">
-                                Shared · PowerShell
-                            </h3>
-                            {pwshSteps.map((s) => (
-                                <LibraryCard key={s.step_id} step={s} onAdd={() => insertLibStep(s.step_id, sortedSteps.length)} onEdit={() => {
-                                    setEditingStep(s);
-                                    setEditStepOpen(true);
-                                }} />
-                            ))}
-                        </>
-                    )}
-
-                    {filteredLibrary.length === 0 && <p className="mt-2 text-xs text-text-secondary">No steps found.</p>}
-                </aside>
+            {error && <div className="border-b border-danger/30 bg-danger/10 px-4 py-2 text-sm text-danger">{error}</div>}
+            {notice && <div className="border-b border-signal/30 bg-signal/10 px-4 py-2 text-sm text-signal">{notice}</div>}
 
+            <div className="grid h-[calc(100vh-53px)] grid-cols-[1fr_320px]">
                 {/* CENTER: canvas */}
-                <main
-                    className="overflow-auto bg-background bg-[radial-gradient(circle_at_1px_1px,theme(colors.border)_1px,transparent_0)] bg-[length:22px_22px] p-8"
-                >
+                <main className="overflow-auto bg-background bg-[radial-gradient(circle_at_1px_1px,theme(colors.border)_1px,transparent_0)] bg-[length:22px_22px] p-8">
+                    <div className="pointer-events-none sticky top-0 z-10 flex justify-center pt-4">
+                        <button
+                            onClick={() => setPickerOpen(true)}
+                            className="pointer-events-auto inline-flex items-center gap-2 rounded-[9px] bg-signal px-4 py-2.5 text-sm font-semibold text-signal-ink shadow-[0_6px_20px_rgba(245,165,36,0.28)] hover:bg-signal/90"
+                        >
+                            <span className="text-base leading-none">+</span> Add step
+                        </button>
+                    </div>
                     <div className="mx-auto flex w-[340px] flex-col items-center">
                         <DropZone pos={0} />
                         {sortedSteps.map((ref, i) => {
                             const lib = libById(ref.step_id);
                             const outs = upstreamOutputsFor(i);
-                            const script = ref.overrides?.script ?? lib?.script ?? "";
+                            const script = ref.inline?.script ?? ref.overrides?.script ?? lib?.script ?? "";
                             const wfIdx = wf.steps.indexOf(ref);
                             const isSelected = selected === i;
                             return (
@@ -312,10 +354,7 @@ export default function WorkflowBuilder() {
                                                 <div className="flex w-fit max-w-[300px] flex-wrap items-center justify-center gap-1 rounded-full border border-dashed border-signal/55 bg-surface px-3 py-1">
                                                     <span className="text-[10px] uppercase text-text-secondary">passes</span>
                                                     {outs.map((o) => (
-                                                        <span
-                                                            key={o}
-                                                            className="rounded bg-signal px-2 py-0.5 font-mono text-[11px] text-signal-ink"
-                                                        >
+                                                        <span key={o} className="rounded bg-signal px-2 py-0.5 font-mono text-[11px] text-signal-ink">
                                                             {o}
                                                         </span>
                                                     ))}
@@ -330,16 +369,14 @@ export default function WorkflowBuilder() {
                                             e.dataTransfer.setData("text/plain", JSON.stringify({ kind: "move", from: i }));
                                         }}
                                         onClick={() => setSelected(i)}
-                                        className={`w-[340px] cursor-pointer rounded-[10px] border bg-surface p-3 ${
-                                            isSelected ? "border-signal ring-2 ring-signal/40" : "border-border"
-                                        }`}
+                                        className={`w-[340px] cursor-pointer rounded-[10px] border bg-surface p-3 ${isSelected ? "border-signal ring-2 ring-signal/40" : "border-border"}`}
                                     >
                                         <div className="mb-2 flex items-center gap-2">
-                                            <span className="grid h-5 w-5 place-items-center rounded border border-border font-mono text-[10px] text-text-secondary">
-                                                {i + 1}
-                                            </span>
-                                            <span className="text-sm font-medium text-text-primary">{lib?.name ?? ref.step_id}</span>
-                                            {lib && <ShellBadge interpreter={lib.interpreter} />}
+                                            <span className="grid h-5 w-5 place-items-center rounded border border-border font-mono text-[10px] text-text-secondary">{i + 1}</span>
+                                            <span className="text-sm font-medium text-text-primary">{ref.inline?.name ?? lib?.name ?? ref.step_id}</span>
+                                            {ref.inline && <ShellBadge interpreter={ref.inline.interpreter} />}
+                                            {lib && !ref.inline && <ShellBadge interpreter={lib.interpreter} />}
+                                            {ref.inline && <AdhocBadge />}
                                         </div>
                                         <pre className="max-h-16 overflow-hidden text-ellipsis whitespace-pre-wrap rounded border border-border bg-surface-2 p-2 font-mono text-xs text-text-secondary">
                                             {script.slice(0, 200)}
@@ -353,9 +390,10 @@ export default function WorkflowBuilder() {
                             <button
                                 onDragOver={(e) => e.preventDefault()}
                                 onDrop={(e) => handleDrop(e, 0)}
+                                onClick={() => setPickerOpen(true)}
                                 className="mt-2 w-full rounded-[10px] border border-dashed border-border bg-surface py-6 text-sm text-text-secondary hover:border-signal/50 hover:text-text-primary"
                             >
-                                + Drop a step here
+                                + Add your first step
                             </button>
                         )}
                     </div>
@@ -368,42 +406,75 @@ export default function WorkflowBuilder() {
                     ) : (
                         <div className="space-y-4">
                             <div>
-                                <div className="mb-1 text-[11px] font-bold uppercase tracking-wide text-text-secondary">
-                                    Step {selected + 1} · Inspector
-                                </div>
+                                <div className="mb-1 text-[11px] font-bold uppercase tracking-wide text-text-secondary">Step {selected + 1} · Inspector</div>
                                 <div className="flex items-center gap-2">
-                                    {selectedLib && <ShellBadge interpreter={selectedLib.interpreter} />}
-                                    <h2 className="text-sm font-bold text-text-primary">{selectedLib?.name ?? selectedRef.step_id}</h2>
+                                    {selectedRef.inline && <ShellBadge interpreter={selectedRef.inline.interpreter} />}
+                                    {selectedLib && !selectedRef.inline && <ShellBadge interpreter={selectedLib.interpreter} />}
+                                    {selectedRef.inline && <AdhocBadge />}
+                                    <h2 className="text-sm font-bold text-text-primary">{selectedRef.inline?.name ?? selectedLib?.name ?? selectedRef.step_id}</h2>
                                 </div>
                             </div>
 
-                            <div className="border-b border-border pb-4">
-                                <label className="mb-1 block text-xs uppercase text-text-secondary">Command</label>
-                                <textarea
-                                    className={`${inputClass} h-32 font-mono text-xs`}
-                                    value={selectedRef.overrides?.script ?? selectedLib?.script ?? ""}
-                                    onChange={(e) =>
-                                        updateRef(selectedIdxInWf, {
-                                            overrides: { ...selectedRef.overrides, script: e.target.value },
-                                        })
-                                    }
-                                />
-                                <p className="mt-1 text-xs text-text-secondary">
-                                    Write <code className="text-signal">KEY=value</code> to <code className="text-signal">$WORKFLOW_ENV</code> to expose
-                                    it to later steps.
-                                </p>
-                            </div>
+                            {selectedRef.inline ? (
+                                <div className="space-y-4 border-b border-border pb-4">
+                                    <div>
+                                        <label className="mb-1 block text-xs uppercase text-text-secondary">Name</label>
+                                        <input className={inputClass} value={selectedRef.inline.name} onChange={(e) => updateInline(selectedIdxInWf, { name: e.target.value })} />
+                                    </div>
+                                    <div>
+                                        <label className="mb-1 block text-xs uppercase text-text-secondary">Interpreter</label>
+                                        <select
+                                            className={inputClass}
+                                            value={selectedRef.inline.interpreter}
+                                            onChange={(e) =>
+                                                updateInline(selectedIdxInWf, {
+                                                    interpreter: e.target.value as WorkflowStep["interpreter"],
+                                                })
+                                            }
+                                        >
+                                            <option value="bash">bash</option>
+                                            <option value="powershell">powershell</option>
+                                        </select>
+                                    </div>
+                                    <div>
+                                        <label className="mb-1 block text-xs uppercase text-text-secondary">Command</label>
+                                        <textarea
+                                            className={`${inputClass} h-32 font-mono text-xs`}
+                                            value={selectedRef.inline.script}
+                                            onChange={(e) => updateInline(selectedIdxInWf, { script: e.target.value })}
+                                        />
+                                        <p className="mt-1 text-xs text-text-secondary">
+                                            Write <code className="text-signal">KEY=value</code> to <code className="text-signal">$WORKFLOW_ENV</code> to expose it to later steps. Outputs are derived
+                                            automatically on save.
+                                        </p>
+                                    </div>
+                                </div>
+                            ) : (
+                                <div className="border-b border-border pb-4">
+                                    <label className="mb-1 block text-xs uppercase text-text-secondary">Command</label>
+                                    <textarea
+                                        className={`${inputClass} h-32 font-mono text-xs`}
+                                        value={selectedRef.overrides?.script ?? selectedLib?.script ?? ""}
+                                        onChange={(e) =>
+                                            updateRef(selectedIdxInWf, {
+                                                overrides: { ...selectedRef.overrides, script: e.target.value },
+                                            })
+                                        }
+                                    />
+                                    <p className="mt-1 text-xs text-text-secondary">
+                                        Write <code className="text-signal">KEY=value</code> to <code className="text-signal">$WORKFLOW_ENV</code> to expose it to later steps.
+                                    </p>
+                                </div>
+                            )}
 
-                            {(selectedLib?.declared_inputs ?? []).length > 0 && (
+                            {(selectedRef.inline?.declared_inputs ?? selectedLib?.declared_inputs ?? []).length > 0 && (
                                 <div className="border-b border-border pb-4">
                                     <label className="mb-2 block text-xs uppercase text-text-secondary">Inputs</label>
                                     <div className="space-y-2">
-                                        {selectedLib?.declared_inputs.map((param) => (
+                                        {(selectedRef.inline?.declared_inputs ?? selectedLib?.declared_inputs ?? []).map((param) => (
                                             <div key={param.name}>
                                                 <div className="mb-1 font-mono text-xs text-text-primary">{param.name}</div>
-                                                {param.description && (
-                                                    <div className="mb-1 text-[11px] text-text-secondary">{param.description}</div>
-                                                )}
+                                                {param.description && <div className="mb-1 text-[11px] text-text-secondary">{param.description}</div>}
                                                 <input
                                                     className={inputClass}
                                                     placeholder={param.default}
@@ -423,9 +494,7 @@ export default function WorkflowBuilder() {
                             <div className="border-b border-border pb-4">
                                 <label className="mb-2 block text-xs uppercase text-text-secondary">Inputs · from upstream</label>
                                 <div className="flex flex-wrap gap-1">
-                                    {upstreamOutputsFor(selected).length === 0 && (
-                                        <p className="text-xs text-text-secondary">No upstream outputs.</p>
-                                    )}
+                                    {upstreamOutputsFor(selected).length === 0 && <p className="text-xs text-text-secondary">No upstream outputs.</p>}
                                     {upstreamOutputsFor(selected).map((o) => (
                                         <span key={o} className="flex items-center gap-1 rounded bg-surface-2 border border-border px-2 py-0.5 font-mono text-[11px] text-text-primary">
                                             <span className="text-[9px] uppercase text-text-secondary">in</span>
@@ -438,10 +507,8 @@ export default function WorkflowBuilder() {
                             <div className="border-b border-border pb-4">
                                 <label className="mb-2 block text-xs uppercase text-text-secondary">Outputs · to $WORKFLOW_ENV</label>
                                 <div className="flex flex-wrap gap-1">
-                                    {(selectedLib?.declared_outputs ?? []).length === 0 && (
-                                        <p className="text-xs text-text-secondary">No declared outputs.</p>
-                                    )}
-                                    {(selectedLib?.declared_outputs ?? []).map((o) => (
+                                    {(selectedRef.inline?.declared_outputs ?? selectedLib?.declared_outputs ?? []).length === 0 && <p className="text-xs text-text-secondary">No declared outputs.</p>}
+                                    {(selectedRef.inline?.declared_outputs ?? selectedLib?.declared_outputs ?? []).map((o) => (
                                         <span key={o} className="flex items-center gap-1 rounded bg-signal px-2 py-0.5 font-mono text-[11px] text-signal-ink">
                                             <span className="text-[9px] uppercase">out</span>
                                             {o}
@@ -458,15 +525,10 @@ export default function WorkflowBuilder() {
                                             <div className="font-mono text-[11px] font-semibold text-text-secondary">{g.group}</div>
                                             {(groupKeys[g.group] ?? []).map((key) => {
                                                 const ref = `${g.group}/${key}`;
-                                                const checked = (selectedRef.overrides?.secret_refs ?? []).includes(ref);
+                                                const checked = (selectedRef.inline ? (selectedRef.inline.secret_refs ?? []) : (selectedRef.overrides?.secret_refs ?? [])).includes(ref);
                                                 return (
                                                     <label key={ref} className="ml-2 flex cursor-pointer items-center gap-2 text-xs text-text-primary">
-                                                        <input
-                                                            type="checkbox"
-                                                            className="accent-signal"
-                                                            checked={checked}
-                                                            onChange={() => toggleSecretRef(ref)}
-                                                        />
+                                                        <input type="checkbox" className="accent-signal" checked={checked} onChange={() => toggleSecretRef(ref)} />
                                                         <span className="font-mono">{key}</span>
                                                     </label>
                                                 );
@@ -515,46 +577,40 @@ export default function WorkflowBuilder() {
                 </aside>
             </div>
 
-            <EditWorkflowModal open={editWorkflowOpen} workflow={wf} onSaved={(w) => setWf(w)} onClose={() => setEditWorkflowOpen(false)} />
-            <EditStepModal
-                key={editingStep?.step_id ?? "new"}
-                open={editStepOpen}
-                step={editingStep}
-                onClose={() => {
-                    setEditStepOpen(false);
-                    queryClient.invalidateQueries({ queryKey: ["steps"] });
+            <EditWorkflowModal
+                open={editWorkflowOpen}
+                workflow={wf}
+                onSaved={(w) => {
+                    // The modal already persisted w; sync the snapshot so
+                    // autosave doesn't fire a redundant follow-up save.
+                    savedSnapshotRef.current = snapshotOf(w);
+                    setWf(w);
+                }}
+                onClose={() => setEditWorkflowOpen(false)}
+            />
+            <StepPickerModal
+                open={pickerOpen}
+                onClose={() => setPickerOpen(false)}
+                onSelect={(stepId) => insertLibStep(stepId, sortedSteps.length)}
+                onAddAdhoc={() => {
+                    addAdhocStep();
+                    setPickerOpen(false);
+                }}
+                onImportAdhoc={async (file) => {
+                    setPickerOpen(false);
+                    setImportingInline(true);
+                    setError(null);
+                    try {
+                        const doc = JSON.parse(await file.text());
+                        const step = await api.parseStep(doc);
+                        appendRef({ inline: step, order: wf.steps.length, on_failure: "stop", max_retries: 0 });
+                    } catch (err) {
+                        setError((err as Error).message);
+                    } finally {
+                        setImportingInline(false);
+                    }
                 }}
             />
         </>
     );
 }
-
-function LibraryCard({ step, onAdd, onEdit }: { step: WorkflowStep; onAdd: () => void; onEdit: () => void }) {
-    return (
-        <div
-            draggable
-            onDragStart={(e) => {
-                e.dataTransfer.setData("text/plain", JSON.stringify({ kind: "lib", stepId: step.step_id }));
-            }}
-            onClick={onAdd}
-            className="group relative mb-2 cursor-grab rounded-lg border border-border bg-surface-2 p-2 text-left hover:border-signal/50"
-        >
-            <div className="mb-1 flex items-center gap-2">
-                <span className="text-text-secondary">⠿</span>
-                <ShellBadge interpreter={step.interpreter} />
-                <span className="text-sm font-medium text-text-primary">{step.name}</span>
-                <button
-                    onClick={(e) => {
-                        e.stopPropagation();
-                        onEdit();
-                    }}
-                    className="ml-auto hidden text-text-secondary hover:text-text-primary group-hover:block"
-                    title="Edit step"
-                >
-                    ✎
-                </button>
-            </div>
-            {step.description && <p className="text-xs text-text-secondary">{step.description}</p>}
-        </div>
-    );
-}

web/components/Sidebar.tsx

@@ -60,11 +60,29 @@ function SettingsIcon() {
   );
 }
 
+function MonitorIcon() {
+  return (
+    <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+      <path strokeLinecap="round" strokeLinejoin="round" d="M3 12h4l2 6 4-14 2 8h6" />
+    </svg>
+  );
+}
+
+function StepsIcon() {
+  return (
+    <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+      <path strokeLinecap="round" strokeLinejoin="round" d="M6 6.75A.75.75 0 016.75 6h10.5a.75.75 0 010 1.5H6.75A.75.75 0 016 6.75zm0 5.25a.75.75 0 01.75-.75h10.5a.75.75 0 010 1.5H6.75A.75.75 0 016 12zm0 5.25a.75.75 0 01.75-.75h10.5a.75.75 0 010 1.5H6.75A.75.75 0 016 17.25zM3 6.75a.75.75 0 11-1.5 0 .75.75 0 011.5 0zM3 12a.75.75 0 11-1.5 0 .75.75 0 011.5 0zm0 5.25a.75.75 0 11-1.5 0 .75.75 0 011.5 0z" />
+    </svg>
+  );
+}
+
 const navItems: NavItem[] = [
   { href: "/servers", label: "Servers", icon: <ServerIcon /> },
+  { href: "/monitors", label: "Monitors", icon: <MonitorIcon /> },
   { href: "/keys", label: "SSH Keys", icon: <KeyIcon /> },
   { href: "/secrets", label: "Secrets", icon: <SecretIcon /> },
   { href: "/workflows", label: "Workflows", icon: <WorkflowIcon /> },
+  { href: "/steps", label: "Steps", icon: <StepsIcon /> },
   { href: "/audit", label: "Audit Log", icon: <AuditIcon /> },
   { href: "/settings", label: "Settings", icon: <SettingsIcon /> },
 ];

web/components/monitors/MonitorForm.tsx

@@ -0,0 +1,215 @@
+"use client";
+
+import { useState } from "react";
+import { useQuery } from "@tanstack/react-query";
+import Link from "next/link";
+import { api, Monitor, MonitorInput, MonitorType } from "@/lib/api";
+import { Button } from "@/components/ui";
+
+const inputClass =
+  "w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder:text-text-tertiary focus:border-accent/50 focus:outline-none focus:ring-1 focus:ring-accent/30";
+const labelClass = "mb-1.5 block text-sm font-medium text-text-secondary";
+
+export function MonitorForm({
+  initial,
+  submitLabel,
+  onSubmit,
+  isPending,
+  error,
+}: {
+  initial?: Monitor;
+  submitLabel: string;
+  onSubmit: (input: MonitorInput) => void;
+  isPending: boolean;
+  error?: Error | null;
+}) {
+  const [name, setName] = useState(initial?.name ?? "");
+  const [type, setType] = useState<MonitorType>(initial?.type ?? "http");
+  const [url, setUrl] = useState(initial?.target.url ?? "");
+  const [host, setHost] = useState(initial?.target.host ?? "");
+  const [port, setPort] = useState<number>(initial?.target.port ?? 443);
+  const [method, setMethod] = useState(initial?.target.method ?? "GET");
+  const [expectedStatus, setExpectedStatus] = useState<number>(initial?.target.expected_status ?? 200);
+  const [keyword, setKeyword] = useState(initial?.target.keyword ?? "");
+  const [tlsWarnDays, setTlsWarnDays] = useState<number>(initial?.target.tls_warn_days ?? 14);
+  const [insecure, setInsecure] = useState<boolean>(initial?.target.insecure ?? false);
+  const [intervalSec, setIntervalSec] = useState<number>(initial?.interval_sec ?? 60);
+  const [retries, setRetries] = useState<number>(initial?.retries ?? 1);
+  const [runner, setRunner] = useState(initial?.runner ?? "server");
+  const [enabled, setEnabled] = useState(initial?.enabled ?? true);
+  const [channelIds, setChannelIds] = useState<string[]>(initial?.channel_ids ?? []);
+
+  const { data: servers } = useQuery({ queryKey: ["servers"], queryFn: () => api.listServers() });
+  const { data: channels } = useQuery({ queryKey: ["channels"], queryFn: () => api.listChannels() });
+
+  function handleSubmit(e: React.FormEvent) {
+    e.preventDefault();
+    const target: MonitorInput["target"] = {};
+    if (type === "http") {
+      target.url = url;
+      target.method = method;
+      target.expected_status = expectedStatus;
+      if (keyword) target.keyword = keyword;
+      target.insecure = insecure;
+    } else if (type === "tls") {
+      target.host = host;
+      target.port = port || 443;
+      target.tls_warn_days = tlsWarnDays;
+    } else if (type === "icmp") {
+      target.host = host;
+    } else {
+      target.host = host;
+      target.port = port;
+    }
+    onSubmit({ name, type, target, interval_sec: intervalSec, retries, runner, enabled, channel_ids: channelIds });
+  }
+
+  return (
+    <form onSubmit={handleSubmit} className="space-y-4">
+      <div>
+        <label className={labelClass}>Name</label>
+        <input className={inputClass} value={name} onChange={(e) => setName(e.target.value)} placeholder="e.g. API health" required />
+      </div>
+
+      <div>
+        <label className={labelClass}>Type</label>
+        <div className="grid grid-cols-4 gap-2">
+          {(["http", "tcp", "icmp", "tls"] as const).map((t) => (
+            <button
+              key={t}
+              type="button"
+              onClick={() => setType(t)}
+              className={`rounded-lg border px-3 py-2 text-sm font-medium transition-colors ${
+                type === t ? "border-accent bg-accent/10 text-accent" : "border-border bg-surface-2 text-text-secondary hover:border-accent/40 hover:text-text-primary"
+              }`}
+            >
+              {t.toUpperCase()}
+            </button>
+          ))}
+        </div>
+      </div>
+
+      {type === "http" && (
+        <>
+          <div>
+            <label className={labelClass}>URL</label>
+            <input className={inputClass} value={url} onChange={(e) => setUrl(e.target.value)} placeholder="https://example.com/health" required />
+          </div>
+          <div className="grid grid-cols-2 gap-4">
+            <div>
+              <label className={labelClass}>Method</label>
+              <select className={inputClass} value={method} onChange={(e) => setMethod(e.target.value)}>
+                <option>GET</option>
+                <option>HEAD</option>
+              </select>
+            </div>
+            <div>
+              <label className={labelClass}>Expected status</label>
+              <input type="number" className={inputClass} value={expectedStatus} onChange={(e) => setExpectedStatus(Number(e.target.value))} />
+            </div>
+          </div>
+          <div>
+            <label className={labelClass}>Keyword (optional, body must contain)</label>
+            <input className={inputClass} value={keyword} onChange={(e) => setKeyword(e.target.value)} placeholder="e.g. ok" />
+          </div>
+          <label className="flex items-center gap-2 text-sm text-text-secondary">
+            <input type="checkbox" checked={insecure} onChange={(e) => setInsecure(e.target.checked)} />
+            Ignore TLS certificate errors (self-signed / expired)
+          </label>
+        </>
+      )}
+
+      {(type === "tcp" || type === "tls" || type === "icmp") && (
+        <div className="grid grid-cols-2 gap-4">
+          <div>
+            <label className={labelClass}>Host</label>
+            <input className={inputClass} value={host} onChange={(e) => setHost(e.target.value)} placeholder="example.com" required />
+          </div>
+          {type !== "icmp" && (
+            <div>
+              <label className={labelClass}>Port</label>
+              <input type="number" className={inputClass} value={port} onChange={(e) => setPort(Number(e.target.value))} />
+            </div>
+          )}
+        </div>
+      )}
+
+      {type === "tls" && (
+        <div>
+          <label className={labelClass}>Warn days before expiry</label>
+          <input type="number" className={inputClass} value={tlsWarnDays} onChange={(e) => setTlsWarnDays(Number(e.target.value))} />
+        </div>
+      )}
+
+      <div className="grid grid-cols-2 gap-4">
+        <div>
+          <label className={labelClass}>Interval (seconds)</label>
+          <input type="number" className={inputClass} value={intervalSec} onChange={(e) => setIntervalSec(Number(e.target.value))} min={10} />
+        </div>
+        <div>
+          <label className={labelClass}>Retries before down</label>
+          <input type="number" className={inputClass} value={retries} onChange={(e) => setRetries(Number(e.target.value))} min={1} />
+        </div>
+      </div>
+
+      <div>
+        <label className={labelClass}>Runner</label>
+        <select className={inputClass} value={runner} onChange={(e) => setRunner(e.target.value)}>
+          <option value="server">Server (central)</option>
+          {servers?.map((s) => (
+            <option key={s.server_id} value={s.server_id}>
+              Agent · {s.hostname}
+            </option>
+          ))}
+        </select>
+        <p className="mt-1 text-xs text-text-tertiary">Agent-run monitors require the agent monitor scheduler (P2).</p>
+      </div>
+
+      <div>
+        <label className={labelClass}>Notification channels</label>
+        {!channels || channels.length === 0 ? (
+          <p className="text-xs text-text-tertiary">
+            No channels yet.{" "}
+            <Link href="/settings/notifications" className="text-accent hover:underline">
+              Add one
+            </Link>
+            .
+          </p>
+        ) : (
+          <div className="space-y-1.5">
+            {channels.map((ch) => (
+              <label key={ch.channel_id} className="flex items-center gap-2 text-sm text-text-secondary">
+                <input
+                  type="checkbox"
+                  checked={channelIds.includes(ch.channel_id)}
+                  onChange={(e) =>
+                    setChannelIds((prev) => (e.target.checked ? [...prev, ch.channel_id] : prev.filter((id) => id !== ch.channel_id)))
+                  }
+                />
+                {ch.name} <span className="text-text-tertiary">({ch.type})</span>
+              </label>
+            ))}
+          </div>
+        )}
+      </div>
+
+      <label className="flex items-center gap-2 text-sm text-text-secondary">
+        <input type="checkbox" checked={enabled} onChange={(e) => setEnabled(e.target.checked)} />
+        Enabled
+      </label>
+
+      {error && <p className="text-sm text-danger">{error.message}</p>}
+
+      <div className="flex gap-3 pt-1">
+        <Button type="submit" variant="primary" loading={isPending}>
+          {submitLabel}
+        </Button>
+        <Link href="/monitors">
+          <Button type="button" variant="ghost">
+            Cancel
+          </Button>
+        </Link>
+      </div>
+    </form>
+  );
+}

web/components/workflows/EditStepModal.tsx

@@ -13,9 +13,7 @@ export function EditStepModal({ open, step, onClose }: { open: boolean; step: Wo
   const [name, setName] = useState(step?.name ?? "");
   const [interpreter, setInterpreter] = useState<"bash" | "powershell">(step?.interpreter ?? "bash");
   const [script, setScript] = useState(step?.script ?? "");
-  const [outputs, setOutputs] = useState<string[]>(step?.declared_outputs ?? []);
   const [inputs, setInputs] = useState<InputParam[]>(step?.declared_inputs ?? []);
-  const [newOut, setNewOut] = useState("");
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState<string | null>(null);
 
@@ -27,7 +25,7 @@ export function EditStepModal({ open, step, onClose }: { open: boolean; step: Wo
     try {
       const payload: Partial<WorkflowStep> = {
         name: name.trim(), description: step?.description ?? "", interpreter, script,
-        declared_outputs: outputs, declared_inputs: inputs.filter((i) => i.name.trim() !== ""),
+        declared_inputs: inputs.filter((i) => i.name.trim() !== ""),
         secret_refs: step?.secret_refs ?? [],
       };
       if (step) await api.updateStep(step.step_id, payload);
@@ -71,17 +69,17 @@ export function EditStepModal({ open, step, onClose }: { open: boolean; step: Wo
         </div>
         <div>
           <label className="mb-1 block text-xs uppercase text-text-secondary">Outputs</label>
-          <div className="mb-2 flex flex-wrap gap-1">
-            {outputs.map((o) => (
+          <div className="mb-1 flex flex-wrap gap-1">
+            {(step?.declared_outputs ?? []).length === 0 && (
+              <p className="text-xs text-text-secondary">No declared outputs.</p>
+            )}
+            {(step?.declared_outputs ?? []).map((o) => (
               <span key={o} className="flex items-center gap-1 rounded bg-signal px-2 py-0.5 font-mono text-[11px] text-signal-ink">
-                {o}<button onClick={() => setOutputs(outputs.filter((x) => x !== o))}>✕</button>
+                {o}
               </span>
             ))}
           </div>
-          <div className="flex gap-2">
-            <input className={inputClass} placeholder="OUTPUT_NAME" value={newOut} onChange={(e) => setNewOut(e.target.value)} />
-            <Button variant="ghost" size="sm" onClick={() => { if (newOut.trim()) { setOutputs([...outputs, newOut.trim()]); setNewOut(""); } }}>Add</Button>
-          </div>
+          <p className="text-xs text-text-secondary">Outputs are detected automatically from lines writing to $WORKFLOW_ENV.</p>
         </div>
         <div>
           <label className="mb-1 block text-xs uppercase text-text-secondary">Inputs</label>

web/components/workflows/StepPickerModal.tsx

@@ -0,0 +1,191 @@
+"use client";
+
+import { useMemo, useRef, useState } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { api, WorkflowStep } from "@/lib/api";
+import { Modal } from "@/components/ui";
+
+type Tab = "all" | "bash" | "powershell" | "adhoc";
+
+function ShellBadge({ interpreter }: { interpreter: "bash" | "powershell" }) {
+  const isBash = interpreter === "bash";
+  return (
+    <span
+      className={`rounded px-1.5 py-0.5 font-mono text-[10px] uppercase ${
+        isBash ? "bg-bash/15 text-bash" : "bg-pwsh/15 text-pwsh"
+      }`}
+    >
+      {isBash ? "bash" : "pwsh"}
+    </span>
+  );
+}
+
+function DefaultBadge() {
+  return (
+    <span className="rounded bg-surface-2 px-1.5 py-0.5 font-mono text-[10px] uppercase text-text-secondary">
+      default
+    </span>
+  );
+}
+
+function StepCard({ step, onAdd }: { step: WorkflowStep; onAdd: () => void }) {
+  return (
+    <button
+      onClick={onAdd}
+      className="group relative rounded-[10px] border border-border bg-surface-2 p-3 text-left transition-colors hover:border-signal/55"
+    >
+      <span className="absolute right-3 top-3 text-xs font-semibold text-signal opacity-0 group-hover:opacity-100">
+        + Add
+      </span>
+      <div className="mb-1.5 flex items-center gap-2">
+        <ShellBadge interpreter={step.interpreter} />
+        {step.source === "default" && <DefaultBadge />}
+        <span className="text-sm font-medium text-text-primary">{step.name}</span>
+      </div>
+      {step.description && <p className="text-xs text-text-secondary">{step.description}</p>}
+      <div className="mt-2 flex flex-wrap gap-1.5">
+        {(step.declared_inputs ?? []).map((p) => (
+          <span key={p.name} className="rounded border border-border bg-background px-1.5 py-0.5 font-mono text-[10px] text-text-secondary">
+            in {p.name}
+          </span>
+        ))}
+        {(step.declared_outputs ?? []).map((o) => (
+          <span key={o} className="rounded border border-signal/35 bg-background px-1.5 py-0.5 font-mono text-[10px] text-signal">
+            out {o}
+          </span>
+        ))}
+      </div>
+    </button>
+  );
+}
+
+export function StepPickerModal({
+  open,
+  onClose,
+  onSelect,
+  onAddAdhoc,
+  onImportAdhoc,
+}: {
+  open: boolean;
+  onClose: () => void;
+  onSelect: (stepId: string) => void;
+  onAddAdhoc: () => void;
+  onImportAdhoc: (file: File) => void;
+}) {
+  const { data: library } = useQuery({ queryKey: ["steps"], queryFn: api.listSteps });
+  const [search, setSearch] = useState("");
+  const [tab, setTab] = useState<Tab>("all");
+  const fileRef = useRef<HTMLInputElement>(null);
+
+  const filtered = useMemo(() => {
+    const q = search.toLowerCase();
+    return (library ?? []).filter(
+      (s) =>
+        (s.name.toLowerCase().includes(q) || (s.description ?? "").toLowerCase().includes(q)) &&
+        (tab === "all" || tab === "adhoc" ? true : s.interpreter === tab),
+    );
+  }, [library, search, tab]);
+
+  const group = (source: "default" | "shared", interp: "bash" | "powershell") =>
+    filtered.filter(
+      (s) => s.interpreter === interp && (source === "default" ? s.source === "default" : s.source !== "default"),
+    );
+
+  const groups: { label: string; steps: WorkflowStep[] }[] = [
+    { label: "Default · Bash", steps: group("default", "bash") },
+    { label: "Default · PowerShell", steps: group("default", "powershell") },
+    { label: "Shared · Bash", steps: group("shared", "bash") },
+    { label: "Shared · PowerShell", steps: group("shared", "powershell") },
+  ];
+
+  const showLibrary = tab !== "adhoc";
+  const showAdhocCards = tab === "all" || tab === "adhoc";
+
+  return (
+    <Modal open={open} onClose={onClose} title="Add a step" wide>
+      <div className="space-y-4">
+        <input
+          autoFocus
+          className="w-full rounded-lg border border-border bg-surface-2 px-3 py-2 text-sm text-text-primary placeholder-text-secondary/50 focus:border-signal focus:outline-none focus:ring-1 focus:ring-signal"
+          placeholder="Search steps by name or description…"
+          value={search}
+          onChange={(e) => setSearch(e.target.value)}
+        />
+
+        <div className="flex gap-1.5">
+          {(["all", "bash", "powershell", "adhoc"] as Tab[]).map((t) => (
+            <button
+              key={t}
+              onClick={() => setTab(t)}
+              className={`rounded-full border px-3 py-1 text-xs capitalize ${
+                tab === t
+                  ? "border-signal/50 bg-signal/15 text-signal"
+                  : "border-border bg-surface-2 text-text-secondary hover:text-text-primary"
+              }`}
+            >
+              {t === "all" ? "All" : t === "powershell" ? "PowerShell" : t === "adhoc" ? "Ad-hoc" : "Bash"}
+            </button>
+          ))}
+        </div>
+
+        {showAdhocCards && (
+          <div className="grid grid-cols-2 gap-2.5">
+            <button
+              onClick={onAddAdhoc}
+              className="flex min-h-[74px] items-center justify-center gap-2 rounded-[10px] border border-dashed border-border text-sm text-text-secondary hover:border-signal/55 hover:text-signal"
+            >
+              + New ad-hoc step
+            </button>
+            <button
+              onClick={() => fileRef.current?.click()}
+              className="flex min-h-[74px] items-center justify-center gap-2 rounded-[10px] border border-dashed border-border text-sm text-text-secondary hover:border-signal/55 hover:text-signal"
+            >
+              ⬆ Import ad-hoc from file
+            </button>
+            <input
+              ref={fileRef}
+              type="file"
+              accept="application/json"
+              className="hidden"
+              onChange={(e) => {
+                const f = e.target.files?.[0];
+                if (f) onImportAdhoc(f);
+                e.target.value = "";
+              }}
+            />
+          </div>
+        )}
+
+        {showLibrary &&
+          groups.map(
+            (g) =>
+              g.steps.length > 0 && (
+                <div key={g.label}>
+                  <div className="mb-2.5 flex items-center gap-2 text-[11px] font-bold uppercase tracking-wide text-text-secondary">
+                    {g.label}
+                    <span className="h-px flex-1 bg-border" />
+                  </div>
+                  <div className="grid grid-cols-2 gap-2.5">
+                    {g.steps.map((s) => (
+                      <StepCard key={s.step_id} step={s} onAdd={() => onSelect(s.step_id)} />
+                    ))}
+                  </div>
+                </div>
+              ),
+          )}
+
+        {showLibrary && filtered.length === 0 && (
+          <p className="text-sm text-text-secondary">No steps match your search.</p>
+        )}
+
+        <p className="text-xs text-text-secondary">
+          Click a card to append it to the workflow · manage the library on the{" "}
+          <a href="/steps" className="text-signal hover:underline">
+            Steps
+          </a>{" "}
+          page.
+        </p>
+      </div>
+    </Modal>
+  );
+}

web/lib/api.ts

@@ -7,6 +7,17 @@ export interface PackageUpdate {
   new_version: string;
 }
 
+export interface Inventory {
+  cpu: { model?: string; cores?: number; usage_pct: number; load1?: number };
+  memory: { total_bytes: number; used_bytes: number };
+  swap_total_bytes: number;
+  swap_used_bytes: number;
+  partitions?: { device: string; mountpoint: string; fstype?: string; total_bytes: number; used_bytes: number }[];
+  kernel?: string;
+  metrics_at?: string;
+  static_at?: string;
+}
+
 export interface Server {
   id: string;
   server_id: string;
@@ -20,6 +31,89 @@ export interface Server {
   available_updates?: PackageUpdate[];
   updates_checked_at?: string;
   console_protocols?: string[];
+  inventory?: Inventory;
+}
+
+export type MonitorType = "http" | "tcp" | "icmp" | "tls";
+export type MonitorStatus = "up" | "down" | "pending";
+
+export interface MonitorTarget {
+  url?: string;
+  host?: string;
+  port?: number;
+  method?: string;
+  expected_status?: number;
+  keyword?: string;
+  tls_warn_days?: number;
+  insecure?: boolean;
+}
+
+export interface MonitorState {
+  status: MonitorStatus;
+  last_check_at?: string;
+  latency_ms: number;
+  message?: string;
+  cert_expiry_at?: string;
+  fails: number;
+}
+
+export interface Monitor {
+  monitor_id: string;
+  name: string;
+  type: MonitorType;
+  target: MonitorTarget;
+  interval_sec: number;
+  runner: string; // "server" or a server_id
+  retries: number;
+  enabled: boolean;
+  channel_ids?: string[];
+  state: MonitorState;
+  created_at: string;
+}
+
+export interface MonitorInput {
+  name: string;
+  type: MonitorType;
+  target: MonitorTarget;
+  interval_sec: number;
+  runner: string;
+  retries: number;
+  enabled: boolean;
+  channel_ids?: string[];
+}
+
+export interface Incident {
+  incident_id: string;
+  monitor_id: string;
+  started_at: string;
+  resolved_at?: string;
+  cause?: string;
+}
+
+export interface Rollup {
+  monitor_id: string;
+  period_start: string;
+  checks: number;
+  up_count: number;
+  sum_latency: number;
+}
+
+export type ChannelType = "webhook" | "smtp" | "discord" | "slack" | "telegram";
+
+export interface NotificationChannel {
+  channel_id: string;
+  name: string;
+  type: ChannelType;
+  config: Record<string, string>;
+  enabled: boolean;
+  created_at: string;
+}
+
+export interface ChannelInput {
+  name: string;
+  type: ChannelType;
+  config: Record<string, string>;
+  enabled: boolean;
 }
 
 export interface ConsoleConnectRequest {
@@ -148,10 +242,13 @@ export interface WorkflowStep {
   declared_outputs: string[];
   declared_inputs: InputParam[];
   secret_refs: string[];
+  source?: "user" | "default";
+  slug?: string;
 }
 
 export interface WorkflowStepRef {
-  step_id: string;
+  step_id?: string;
+  inline?: WorkflowStep;
   order: number;
   on_failure: "stop" | "continue" | "retry";
   max_retries: number;
@@ -263,6 +360,56 @@ export const api = {
     return `curl -fsSL "${window.location.origin}/update" | bash`;
   },
 
+  // Monitors
+  listMonitors(): Promise<Monitor[]> {
+    return request<Monitor[]>("/monitors");
+  },
+
+  getMonitor(monitorId: string): Promise<Monitor> {
+    return request<Monitor>(`/monitors/${monitorId}`);
+  },
+
+  createMonitor(input: MonitorInput): Promise<Monitor> {
+    return request<Monitor>("/monitors", { method: "POST", body: JSON.stringify(input) });
+  },
+
+  updateMonitor(monitorId: string, input: Partial<MonitorInput>): Promise<void> {
+    return request<void>(`/monitors/${monitorId}`, { method: "PUT", body: JSON.stringify(input) });
+  },
+
+  deleteMonitor(monitorId: string): Promise<void> {
+    return request<void>(`/monitors/${monitorId}`, { method: "DELETE" });
+  },
+
+  getMonitorIncidents(monitorId: string): Promise<Incident[]> {
+    return request<Incident[]>(`/monitors/${monitorId}/incidents`);
+  },
+
+  getMonitorUptime(monitorId: string): Promise<Rollup[]> {
+    return request<Rollup[]>(`/monitors/${monitorId}/uptime`);
+  },
+
+  // Notification channels
+  listChannels(): Promise<NotificationChannel[]> {
+    return request<NotificationChannel[]>("/channels");
+  },
+
+  createChannel(input: ChannelInput): Promise<NotificationChannel> {
+    return request<NotificationChannel>("/channels", { method: "POST", body: JSON.stringify(input) });
+  },
+
+  updateChannel(channelId: string, input: Partial<ChannelInput>): Promise<void> {
+    return request<void>(`/channels/${channelId}`, { method: "PUT", body: JSON.stringify(input) });
+  },
+
+  deleteChannel(channelId: string): Promise<void> {
+    return request<void>(`/channels/${channelId}`, { method: "DELETE" });
+  },
+
+  testChannel(channelId: string): Promise<{ status: string }> {
+    return request<{ status: string }>(`/channels/${channelId}/test`, { method: "POST" });
+  },
+
   getLatestAgentVersion(): Promise<{ version: string }> {
     return request<{ version: string }>("/agent/latest-version");
   },
@@ -419,6 +566,34 @@ export const api = {
     return request<void>(`/steps/${stepId}`, { method: "DELETE" });
   },
 
+  exportStepUrl(stepId: string): string {
+    return `/api/steps/${stepId}/export`;
+  },
+
+  importStep(doc: unknown): Promise<WorkflowStep> {
+    return request<WorkflowStep>("/steps/import", {
+      method: "POST",
+      body: JSON.stringify(doc),
+    });
+  },
+
+  parseStep(doc: unknown): Promise<WorkflowStep> {
+    return request<WorkflowStep>("/steps/parse", {
+      method: "POST",
+      body: JSON.stringify(doc),
+    });
+  },
+
+  seedDefaults(): Promise<{ created: number; updated: number }> {
+    return request<{ created: number; updated: number }>("/steps/seed-defaults", {
+      method: "POST",
+    });
+  },
+
+  stepUsage(): Promise<Record<string, number>> {
+    return request<Record<string, number>>("/steps/usage");
+  },
+
   // Workflows
   listWorkflows(): Promise<Workflow[]> {
     return request<Workflow[]>("/workflows");